Folder Access restriction in Shared Hosting In a shared hosting I use (where I don't have access to httpd.conf files) I want PHP files in "MyTargetFolder" to not have ability to access anything in upper directories.

It needs some configuration like OPEN_BASEDIR, SAFE_MODE, passthru,readfile,exec,system,shell_exec,escapeshellarg,escapeshellcmd,proc_close...

But here I have found OPEN_BASEDIR is said to be not a good solution. Also, SAFE_MODE is deprecated.  What can be a solution?

Note: question  was for "shared" hosting, not VPS or above.

If I understand you correctly, you are not trying to be a shared hosting provider, but you are using shared hosting, and want to restrict access for files inside one specific folder.

In that case, open_basedir would do exactly what you want.

If you are allowed to use .htaccess files, just create one in MyTargetFolder and put this line in it:

php_value open_basedir /var/www/

If you are not allowed to use .htaccess files, you would need to set the setting in every one of your PHP files inside MyTargetFolder:

ini_set("open_basedir", "/var/www/");

If you now have a PHP file in the folder with eg this line:

echo file_get_contents($_GET['x']);

A call to:

?x=../../../../../../etc/passwd

Would result in:

 Warning: file_get_contents(): open_basedir restriction in effect. File(../../../../../../etc/passwd) is not within the allowed path(s)

Please do note that remote files can still be accessed, eg:

?x=http://localhost/shell.php


ISO 27001 and ChromeOS logging Is it possible to use ChromeOS devices within an organization that is ISO 27001 compliant?

The consultant my employer has hired to assist us in becoming ISO 27001 certified has indicated that ChromeOS devices "aren't secure". It's my understanding this certification requires computers to be able to implement logging and that these logs can't just be local to the device, but recorded on one of our company's servers.

I'm looking for confirmation that ChromeOS devices can and have been successfully used in an ISO 27001 certified company.

I think the requirement from ISMS point of view should be fulfilled if "logs are available all the time and their integrity isn't questionable". If they are adamant on logs availability on-premise, you can write a program/script (selenium code) to download and save the file regularly using below steps documented at http://www.dell.com/support/article/in/en/inbsdt1/SLN288529/en

To access Chrome logs:

Type chrome:net-internals and select Export in the drop down box.
Open second tab and reproduce the steps that generate the issue.
Go back to the tab running chrome:net-internals, type a description of the issue in the box, and click the button to save the log file. The file will be saved in the downloads folder on the Chromebook.


How do browsers detect authentication type? To elaborate, HTTP basic auth is pretty straightforward - we can skip that. Auth with client certs is cumbersome and unpopular - skip that too. What I am really interested in is:

With form-based auth, how does the browser know which HTML page contains fields for credentials, and how does it know which fields to look for?
When Oauth is required, how does the browser know that?
Are there any custom authentication schemes which browser learns on the fly, as it interacts with the page? If so, how does it learn?

With form-based auth, how does the browser know which HTML page contains fields for credentials, and how does it know which fields to look for?

The browser does not know and the browser does not need to know. The server is sending a HTML document with a form and which form fields have which kind of meaning is known to the server. The browser is just rendering the HTML document and displaying the form according to the HTML standard. The user is filling in the information into the displayed form. Any local handling will be done according to the HTML standard (like not displaying the password in fields of type "password") and maybe some Javascript which was also provided by the server. The browser then submits the filled in form to the server and the server will know which field names contain which kind of information, i.e. where to look for username, password etc.

  When Oauth is required, how does the browser know that?

The server will issue the necessary redirects if it wants the client to authenticate. Please have a look at how the communication flow works with Oauth yourself for the details.

  Are there any custom authentication schemes which browser learns on the fly, as it interacts with the page?

No. The browser does not "learn". The browser gets instructions on what to do and what to display. The logic is implemented server side and/or in Javascript provided by the server but running inside the browser as part of the rendered document.


What would a hacker do if he got your router password over the internet? I was wondering!!
I like configuring my router so that I can access it over the Internet
even when am not home.
What are the most critical risks if a hacker got my router password?

There are a few main things.  The first thing would probably be to take down your firewall and expose your internal network to the outside world so that they could access your internal traffic.

The next would likely be to change the DNS information so that it provides a misbehaving DNS server that could direct you to fairly convincing phishing sites.  While SSL locks wouldn't appear, when you went to www.mybank.com, they could send you to a site that looks just like mybank.com but doesn't have any SSL and try to steal your login.

What else they could do depends largely on the capabilities of your router.  If VPN is supported, they could actually connect directly in to your local network and monitor traffic between your systems, potentially gleaning significant information.  Any systems with vulnerabilities due to lack of patching would be accessible to them.

All in all, it isn't like it automatically assures they will get access to anything, but it does mean that any amount of defense your router normally gives is gone and gives them control over how your network behaves.


Should a service indicate the usage of multi-factor authentication by a user for building trust? We all know that MFA done right can greatly increase the security of an online identity.

There are services around with a fundamental trust problem among the users. For example online market places and classifieds. As long as the user accounts can be compromised via phishing, all indicators of authenticity are worthless.

Would the public indication of MFA usage for an account a valid measure to strengthen the trust relationship? Of course, some factors have to be taken into account (especially since MFA activation) as well:

Duration of membership
Amount of successful transactions
Usage of a trusted (and consistent?) payment method

There's always the possibility that any user can go bad or that the fraud is planned long beforehand.

But are there any other major caveats? Do you think it is worth the effort?

A service could require MFA for every user, but it shouldn't publicly disclose whether a user has it enabled or not.

Rather than giving users using MFA better reputation it would make users not using MFA easy targets – low-hanging fruits. They would be targeted first not only because there are less barriers without the MFA, but as not enabling MFA is also a possible indicator that the user may not take security that seriously. This could manifest, for example, as weak passwords or recycling the same password on several services. Additionally, they could be easier targets for social engineering.


How does sending referrer HTTP headers protect against CSRF attacks? How does sending referrer HTTP headers protect against CSRF attacks?

I tried logging into an HTTPS site with Firefox's network.http.sendRefererHeader set to 0 (i.e., completely disabled, as a measure against tracking), and it said:

  Forbidden (403)

  CSRF verification failed. Request aborted.

  You are seeing this message because this HTTPS site requires a
  'Referer header' to be sent by your Web browser, but none was sent.
  This header is required for security reasons, to ensure that your
  browser is not being hijacked by third parties.

  If you have configured your browser to disable 'Referer' headers,
  please re-enable them, at least for this site, or for HTTPS
  connections, or for 'same-origin' requests.

How would this prevent CRSF attacks? Couldn't the attacker just spoof the referrer header, making it look like one I would've sent?

To understand this, one first needs to understand what a cross-site request forgery is.

A Cross-Site Request Forgery is when the attacker has some script or embedded media on a website they control which makes any visitors to that website request a resource from a different site. That request appears to that other site in the context of the user. I could, for example, add an image with the url https://othersite.example.com/delete_my_account.php?really=true to my website. When you visit my site and are currently logged into your account on othersite.example.com, your browser will request that URL, which would cause othersite.example.com to delete your account.

But there is a catch: When othersite.example.com can read your referrer, it can see that this request is caused by someone interacting with a different site. There is no good reason why a website would have a deep-link to an URL which performs an action. When the other site reject requests without a referrer, that attack becomes impossible.

Regarding referrer spoofing: Keep in mind that the client which does the request isn't the attacker. The attacker is a website operator. The worst that operator can do is have your web browser execute Javascript in the context of their website. While there are several ways to make requests to other websites using Javascript, none of those APIs allows to fake the referrer.


How to stop search engines from saving your history? I'm using firefox - I've disabled any cookies (Accept cookies from sites is not ticked and the Show cookies page is empty) but no-matter what search engine I use - my clicked pages are saved! How is this possible?

For example I've searched "Hello" with ecosia, then clicked the first result and now if I search "Hello" for example even with DuckDuckGo the first result I clicked before is highlighted - how does the search engine knows?

the first result I clicked before is highlighted - how does the search engine knows?

Visited links are highlighted because your browser keeps track of them in the browser history, not because the sites are tracking you.

There is a special CSS selector for that. When your browser renders a page, it looks for links with the :visited CSS selector and checks if the link appears in your history. If it does, the link is displayed according to the selector rules (which by default is a different text color).

The website itself cannot read this value, so it can't track that you visited the link before. (At least it's supposed to not know that you visited it. In the past there have been several vulnerabilities known as history leaks that allow websites to reverse-engineer the sites you visited.)

To stop visited links from displaying differently in Firefox, you can go to about:config and set layout.css.visited_links_enabled = false. If you don't want Firefox to keep track of visited sites at all, you can disable the browser history in your preferences under the Privacy tab.


Is my sons' school portal in violation of any Password/UserID rules? My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not.

If I change the password, it sends a confirmation via email with both userid and password.

The portal has info on all students like birthdays, addresses, grades, etc. It also has information on school events, teacher addresses, etc.

This absolutely feels like they are breaking some rules, but inquiries to the IT Director at the school have not been returned. I plan to escalate but would like to be armed with specifics on true violations and/or risks.

It certainly doesn't sound like best practice, but I'm not sure if it necessarily is violating any laws. I'm guessing you are from the US, so there are data protection laws, but they aren't as defined as we'd like - same as in the UK the guidance tends to use words like 'appropriate protection'.

You should be able to use the argument that if they continue to send paper mail or emails which have both username and password, they could end up suffering not only a big fine, but also have considerable reputational damage. Depending on which state you are in - some require public disclosure of sensitive information, but even if not, parents will pass the word around!

The expectation should be that two messages would have to be intercepted in order to get unauthorised access. And it would be even better if one was by USPS and one by email, thus requiring an attacker to compromise two forms of communication, but that could be overly complex for a school.


Allowing users to input a safe subset of HTML I recently posted this question on Code Review and it was recommended that I ask you guys about it.
Basically, this will be used to allow users to generate formatted content. It gets put inside of HTML tags, so I don't have to worry about an attacker breaking out of an attribute. If that's not clear, here's an example:
<div>
Generated content
</div>

Edit: I'm not inserting the content into an attribute, so escaping quotes isn't a concern. I know I still have to check for bad attributes inside the user-generated content, which is what a large portion of the script is for.
I've established that I'm vulnerable to an attacker posting a malicious link or posting a tracking image, but that's something I'm willing to accept. I don't think you can prevent that without white listing URLs, which would also dramatically reduce the freedom users have. If there is a feasible way to fix this vulnerability, I'd love to hear about it.
I've read the OWASP XSS cheat sheet, and I think I have all of those bases covered.
What do I have to worry about outside of that cheat sheet? Did I miss anything on it? Is my code future-proof? Am I in way over my head? Should I just switch to BBCode or Markup?
Current code

You are in a correct path as you go with whitelisting, but implementing it bullet proof is tricky.

I.e. your  links can be fooled to execute JS by just writing:

xss

Also, especially older browsers may execute JS in img src etc.

I'd recommend you to go with HTMLPurifier, which, besides XSS, also helps you to deal with broken HTML (tag nesting etc.).


Lost my PGP private key, Is the backup on keyserver the samething? I can find the key I created and backed up to the key server. Can I import that key on the server and use it as my default key? No idea where my back up went, I must have ate it. So I guess simply asking. Is the key I backed up to the key server the same as the missing backup? Can I import it to GNU and use my passphrase that I DO remember and that be my key?

A key server does not provide backups. The task of the key server is to make it possible to find the public keys of others, which means only the public keys gets published.


What Linux software can I use to explore entropy of a file? I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have certain entropy patterns that could suggest compressed or encrypted data?

There is no such thing as "entropy" of a file. The entropy is a characteristic of a process -- for instance, of a process that generates a file. The entropy does not describe what the file contents are; it describes what the file contents could have been. As such, any tool which purports to identify "entropy patterns" is, at best, loosing extremely poor terminology.

That being said, one can still do some heuristics. It so happens that most "real-life data" exhibits a lot of redundancy in its structure; this is what data compression is about. So you may work on the following assumption: data which can be compressed by a non-trivial amount is not data which has already been compressed or encrypted. Indeed:

Compression algorithms strive at identifying and removing redundancies. The result should not be susceptible to further compression; otherwise, this means that the compression algorithm does a poor job.
Encrypted data is supposed to be indistinguishable from randomness (if the encryption algorithm is any good); thus, it has extremely low probability of being compressible.

So you could extract chunks from your file, and compress them (e.g. with gzip), to see if they can be substantially reduced. For instance, this command extracts a 2000-byte chunk from file data.bin (at offset 15000), compresses it, and reports the resulting length:

dd if=data.bin bs=1 skip=15000 count=2000 2>/dev/null | gzip | wc -c

If the resulting value is substantially smaller than 2000, then the chunk, most probably, contains data which is not encrypted or already compressed. For instance, if I use as data file the /usr/bin/gcc-4.8 file (an executable full of code, but not compressed) from my Linux laptop, I get an output length of 1491 bytes for that chunk, which is indeed quite smaller than 2000. If I try on /dev/urandom, I get 2023 bytes.

(These figures get printed on my screen as sequences of characters, that I process with my eyes and brain. This, in my view, qualifies as "graphical".)

Running the command in a loop which extracts various file chunks and compresses them all is left as an exercise to the reader (it is not hard, and if you cannot do that, then chances are that you won't be able to do much with the files anyway; practical data processing requires some programming skills).

Caveat: gzip, like most general-purpose compressors, works on a per-byte basis, and tries to find repeated patterns and biases in usage of byte values. This is known to work poorly on analog data which has been digitized, e.g. audio samples. Compression ratio offered by gzip on WAV files is thus often poor, while the WAV file is still "not compressed" (this page claims to have measured a compressed length of about 92% of the original, though it will depend on the WAV file characteristics).

So don't imagine that the "compress by gzip" test is the ultimate detection method for compressed/encrypted data. Still, that can give good results, provided that the compressed/encrypted chunks you are trying to locate are long enough (you won't find 50-byte chunks that way).


How do you go about researching and discovering zero days? How do you go about researching and discovering zero days? Breakdown the process. What positions can I expect to see that offers a more offensive and research oriented approach to security?

i see How are zero days found?
but i need more

Everyone has its own method.

Bugs come in various species.

Be curious and ask yourself questions. Start with the "Five Ws" (https://en.wikipedia.org/wiki/Five_Ws) . Rinse and repeat and soon you will be able to recognize them then to classify them. Then you will be able to spot them. Then you will be able to see the trace they leave. Then, for example, you will understand that by following the trace they leave, you can get to their nest.

On your own path to wisdom you will need some specific tools to see and follow, but they will come to you naturally when you answer your own questions.

Soon you will have found lots of nests of various bug species just about anywhere.

Only then, when you have seen the fundamental nature of bugs, will you be able to decide where you want to go, and develop your own code of conduct and ethic by asking yourself "Should I" questions, or "Why wouldn't I" questions.

Should I eliminate some ? Should I eliminate them once and for all ? Should I profit from them ? Why wouldn't I cultivate them so that there are more of them ? Why wouldn't I design new bug species ?

Computer security is a collaborative art. Be curious, and have fun guiding it along the way you wish it to go.

Below is Edit 1 :

(Doing the exercise together to help you be convinced)

I pointed now explicitly to the 5Ws wikipedia article which is a rather good generic strategy. The question is rather open, so I was providing a rather open answer giving some methodology.

I could have oriented you to any CVE vulnerability list and told you to analyse. But imho vulnerabilities are less fundamental than bugs (vulnerabilities are bugs with security consequences).

So by speaking of bugs, if you were to ask yourself "Where could I find example bugs" as I suggested you should, soon you would have answered your question and went to github.com/trending, picked a random project and go to issues page. And then for example ask yourself 'What is this project', 'Who is doing this', 'Why is he doing this'...

Have an open mindset set on attack mode (you can train like you would train in chess).

As of today at the top of the trending list we got https://github.com/neutraltone/awesome-stock-resources .

What is it ? a list of websites which offer free reusable pics and resources

Who made the project ? "a Front-End Designer" -> good he probably isn't a security expert -> He will make errors that we will be able to exploit.

Who uses such site ? Webmasters who needs pictures or resources but don't have time and money to do them themselves.  (In a sense this is already a vulnerability, and it's already a red flag for easy preys)

Why ? It seems to be a common problem to find free legally usable resources, (Does this project solve this problem with security in mind ? -> No -> good for us)

Where will those free resources be used ? On various random websites somewhere.

When ? The project is trending now so the security doors may not yet be closed, or fully opened yet.

How would someone exploit it ? Just "give" some free resources to the websites pointed by those lists or make one of such websites (Some of the websites he point to are in Beta, so the curator is not very regarding). Sooner or later your resources will end up in the browser of a client while being served by a third party.

For now this project doesn't point to free javascript resources, which would have been easy XSS, maybe we should ask a random question to the author go to the issues page and suggest : "add other media assets?" (so bad I've already been beaten to it but it's revealing that the author is open to suggestions).

But it points to site which offer to load CSS (for the moment too simple to hide a hack without risks but it shows it's already on a dangerous path :) ). And in CSS it seems (I'm no css expert) you can "import" other css from absolute urls. So you could easily have a css that looks good now but later by updating what's pointed by the link in the future (once it found its way to a website) you will be able at will to deface a target website by serving a custom made CSS.

In today's effective offensive security, which was OP question, you plant bugs, you create backdoors, you give people the rope they need to hang themselves, you reward bad behavior (like copy/pasting, like giving economic advantage for not caring about security, like hyping false-security...). You just have to sow the seeds and harvest the bugs.


How to read CVE - 2016 - 5696 correctly The Ubuntu CVE Tracker page contains  multiple tables related to kernel packages, some of which say DNE , others pending and version next to each . I would like to know how to properly read each table. Does the version next to pending refer to kernel version for which the fix is released ?

Context for the Question: I mostly answer questions on the Ask Ubuntu site. Lately, a new user on the site has been convinced that I misinterpreted the mentioned above CVE report, to the point of editing my original answer in very intrusive way.

To be perfectly frank, the CVE page indeed is confusing for person who doesn't regularly read the CVE reports.  So it would be nice to know how to properly read such reports for the future, and have a 3rd party opinion.

Does the version next to pending refer to kernel version for which the fix is released?

Yes- more precisely, the version next to "pending" refers to the version of the package within the lineage in which the fix is included.
There are lots of binary packagings of the upstream kernel sources for different hardware platforms and other use cases- "linux", "linux-mako", "linux-snapdragon", etc- and there are also many release lineages- Ubuntu 12.04 LTS/14.04/etc- of all those packages that are maintained concurrently.
So the upstream bug may need to be fixed in multiple packagings of the same sources across multiple lineages. Because of the complexity, a triage process is used to conduct the relevant classifications and track work. This page reports on the state of that triage process for this particular bug.
This can be traced as follows:

pick one of the packages- "linux"- and one of the lineages- "Ubuntu 12.04 LTS".
The table indicates that the state of the fix for that package in that lineage is "pending". The version of the package that will contain the fix within that lineage is "3.2.0-109.150".

to confirm, follow the lineage link for the package- https://launchpad.net/ubuntu/precise/+source/linux

scroll down to the "Releases in Ubuntu" section of the lineage-package page, and find the specific fix version, which has its own page: https://launchpad.net/ubuntu/+source/linux/3.2.0-109.150

on that page is a changelog. In that changelog includes a reference to the CVE (CVE-2016-5696), the particular fix that was made, and the person who made it

The CVE page is confusing because it is automatically published from a complex data model that tracks the interrelationships between upstream sources and their packagings within and across lineages. It follows a template that is optimized for authority, not necessarily for readability.
The classifications, like "DNE" or "pending" refer to the triage and release workflow that Ubuntu follows. States on that page are:

"DNE" means that the package does not exist within the lineage
"ignored" means that energy is not being expended for determining whether the problem exists in the particular package within the lineage, because support has ended for one reason or another. See for instance the linux-lts-quantal package, in the Ubuntu 12.04 LTS lineage. Support for that particular package (a backported hardware enablement package) in that lineage is beyond end-of-life.
"needs triage" means that the package within the lineage is still supported, but work is needed to determine if the reported problem actually exists within that package-lineage pair. See for instance the "linux-goldfish" package in Ubuntu 16.10.
"not affected" means that the underlying source code vulnerability exists in the particular package within the lineage, but triage determined that for some other reason the issue will not occur. See for instance "linux-mako" within Ubuntu 16.04 LTS.
"needed" of course means that triage has determined that the package within the lineage is affected, but work to apply the fix to the particular package within the lineage is still needed. See for instance the linux-armadaxp package within the 12.04 lineage.
"pending" means that the work needed to apply the fix to the particular package within the lineage has been done, a version has been cut, and a release is in the works.
"released" means that the fix for the package within the lineage has been released


getting the private key from modulus While doing an internal pentest (a red team exercise basically) I figured out the following components of a private key (to be exact OpenSSLRSAPrivateCrtKey):

Modulus
Public exponent
Private exponent
First prime
Second prime
First exponent
Second exponent
Coefficient

Now is there a way to reconstruct the whole of the private key with this?
And will that key (if re-constructed) be sufficient to decrypt the traffic ?
To give better context here are the values I have been able to extract so far :

modulus = e62a3583cb27093288d04f0a329ccec23f4fce25832f9a91633ed845f31c72cc276f538a313a4dd29d71770bafa0a828e931767c8fa7839e966f9222854a800980771f4998a25acfdea4c0fbcef9171827fe813b59a24f44ec0b09e8983ac7150636cff3d527be5554d2e8266d9f4ad3704406c01c4faabb2e3692c2f449da3fff865d99586e9a54bfe602a54566f74eb0841e545e5f76408ee68bd65c086b46bd47ebfffd84d537b47c3b938b1777549294cfa2b08c7b690728af55c194aae743166a237f92ff69c85e931e4c424fe9940d55ac15cfa2830f8cec4de04dc4afa8f2b74454a35f9175970c22830d5de2038e0768abb7ca2c8f746cde79d757e3
publicExponent = 10001
privateExponent = b205bfb29a752cf5fb4033824db75f6c7b0fbd00e2c0f52ab2baaf091b8acb7800a068db204c5a592711d5e422097f4775669ea0a57409a7a5efd1f60566a435b5396de7bcb906c8750ab5818e8ab74425db0215e7b454df983ac985300976665a9216b22012477334d29460f4b51a69041279ae29b7acf46e4023afcac73c9880012ef8ea0c46f80af6e00c6ca3dd051bf8e48a70419bf2097609ef41547f0852a469dcbb360e90e16a8a7cf5b23ebdfde0ca20c69f8346fb2cac8b227168733ea30f7ca07d51b61a9f50b9b911de31676a2e5826c78094f2fd8b73611d02b3b1a9cee7bfe43cf73f8f12c47d1d31e04f7a9acc9fea829053c24f7546342021
primeP = f5da5ef5099cc70460afb65874f0981e4220d79005c3ee07ea7557be612e9890ac28c47bee93d6a556bc8205826daf1bd23c768fe47dc50f65d33b0f7c5328047b51d85dec29b7f4fcb01984966b272f37e3cd5c45cd0e2216f916c9408d0b5d468b60f9231a73c83d70dc455f1360f8a254338305930220b403053f33d24ee9
primeQ = efaa14abb77223209b416f147acec8c1805393d688864cb33c896d84eb2fa2d4859925a1a0a619799c152d2dd5ade93ab2981f784dc735e882dcac298254e1365127a2b64b31307d87edf882662dd378ee236c3d90ae5568c7eb9b2c19740027625da33b791143ce2a7dd40d2dfce0735a338b325ea028713c43a4924400a8eb
primeExponentP = 3637eb5b14bc9b734eb3517e5e83b4b86f92f8970d7e711f13c8bf0a003a9b70c456d546138e4cf6f792e905b806e2683b4c14491cc5d3d09a7f23f63d4fc5727f93c428aa6d64e1455cbcb3edcc41befb0f64f9a5771c57ce432e90418919697fa63b4396473e2379d14af28d8e238390a10a1f29fa8aac95a658e0e057d009
primeExponentQ = 750ef3adb39a32021912eab86c0b580efb28d74aafc038f24a9d2d3b00cc7191aff74f64145d4c9013665c7cc8a37b094a75f6d901d44d4655b486fa774812003fbf46401795dd0353432e60329c2b70239075abd460f2228d934c654bc156d9e5b7aaa4bfcb68fce7d031a48653bf2558675893af983668a870b98f1f5bdb25
crtCoefficient = 354ba87acadf85a7f1178011a03ca25a8c359400d2ca7cffc0391d911342bc2f424268d0e445470b306f0179c780cad52c8a011ebffae5f1269f80ab0b6d68697aa977a0a8992b887477711ecb3caf1176b9ea2c940eff41e2de6c314ca73590275d654025cd56637a0b856152ff31cf7d814d5d6b47676c78b9dc783711214c

Yes, assuming that you indeed got all the correct values. All you need to do so is the private exponent (d) and the modulus (n).

Let c be a ciphertext and m be a message. This is computed like this:

Here's how the RSA cryptosystem's private key is generated (simplified for your purposes).

Two prime numbers are chosen: p and q
n =pq
We compute Carmichael's totient function of n, lcm(p-1, q-1), let's call the value that we obtain C
We choose an integer e such that 1< e < C and such that e and C are coprime.
We find d = e^-1 (mod C). d is the modular multiplicative inverse of e modulo C

Now, the public key is composed of the pair (e, n). The private key is composed of the pair (d, n). e is the "public exponent" and d is the "private exponent."


How can I protect myself from the VPN operator when using a VPN to gain free access to the Internet? I live in a country that the government blocks most ways of accessing to the uncensored Internet (like blocking VPN pptp, l2tp), Luckily there are some very fast services still available like Kerio VPN.

But as I found out, It does not seem to be very safe as the person running the service could easily track your activity.

My question is, Is it possible for them to access to our information such as transferred data or passwords and such... ?

Is there anything you would suggest to prevent this?

Once you connect to a VPN service, they can record what they wish. A potential way around this is to VPN the VPN, if the service allows it (most do not). An alternate method is to connect to Tor from within the VPN connection, if the service allows it.

Secure connections, like https, should be encrypted, so passwords transmitted in that way would be recorded, but not in the clear. The goal is to keep as much control as you can so that you can make it difficult for your VPN provider to understand what is being passed through their network.


Documentation on Meterpreter Shells I've been looking for some decent documentation on Meterpreter shells, but I can't seem to find anything useful.

I would like to know when to use what kind of shell for a certain situation. All I can find are guides that just mention what shell they are using but never elaborate why they prefer the shell.

Do any of you have a decent source where I can find this kind of information?

Meterpreter is a multi-stage payload where the first stage is send first which then downloads the second stage DLL. Two things you need to understand here: what transport will be used by the Meterpreter to communicate with the handler and whether the first stage should connect back to the handler or the handler should connect to the listening socket (reverse vs bind).

There are three types of transports available: TCP, HTTP and HTTPS. If you are operating inside a LAN environment, you can use the TCP transport since it is a reliable transport mechanism. However, TCP transport needs an established socket to communicate which means if for some reason the session gets close between the attacker's machine and victim's, it can't get reconnected (unless persistence is already achieved). TCP transport can't traverse proxy servers in order to access Internet and first stage transport is in plain text which can trigger IDS/IPS.

HTTP and HTTPS both use WinInet which means if the victim is behind an HTTP proxy, the first stage meterpreter will be able to use the proxy server and the cached credentials (if required) to traverse the proxy and access the Internet.

HTTPS transport has the added benefit to transfer the second stage DLL on  a complete SSL tunneled transport that can't be sniffed by IDS/IPS unless the session is MITM-ed at the proxy.

In case of bind vs reverse, reverse is almost always the preferred method because a lot of times organizations have script ingress filtering in place but egress filtering is not that much strict (although it is changing).

One final thing you need to understand is that compared to TCP, HTTP(S) transport is bigger in size that is why it won't be fit in every exploit due to the limited payload space they can carry. However, egy7t did some great work to reduce the size of reverse HTTPS transport so that most of the exploits can carry it. You can find more details regarding this at Shellcode Golf: Every Byte is Sacred.


Are there currently any standards for Homomorphic encryption? I am curious if there are any released standards for homomorphic encryption, or computing on encrypted data. Perhaps by NIST, ANSI, or ISO. If not, are there any that are under development right now? If you have any estimates for a time frame about when a standard might arise, that would be helpful too.

There's an ISO publication currently under development called "Information technology security techniques -- Encryption algorithms -- Part 6: Homomorphic encryption". It is listed under ISO/IEC DIS 18033-6, there is a table of contents available here.

NIST has a group which researches cryptographic technology and in their research areas they list privacy-enhancing cryptography and there they say:

  The Computer Security Division's (CSD) Cryptographic Technology Group
  (CTG) is also following the progress of emerging technologies, such as
  fully homomorphic encryption (FHE). FHE could potentially solve a
  large class of problems by allowing computation on encrypted data
  without decryption. CTG has also shown that the NIST Randomness Beacon
  (discussed below) can be used as a primitive in secure multi-party
  computation, such as sealed-bid online auctions, in which losing bids
  are never opened.

ANSI has nothing so far on homomorphic encryption, neither has the German BSI.

There are no other standards available as far as I know but there is a lot of research going into FHE. What can be said: FHE has not found its way into any major standard yet and if you try to run a standardized production environment you probably should not try to implement FHE or use FHE.


Is htaccess secure enought to whitelist clients IPs? I'm using .htaccess to control source IP of connections to my web application. My configuration looks more or less like this:

order deny,allow
deny from all
allow from X.Y.Z.Q

These days we can trust less and less things, every days some commonly used technique is found to be vulnerable. So I started to ask myself questions:

Is this method really save and sufficient?
Should I employ some additional mechanism to protect my web-app better?

I am using Apache 2.2.24 and PHP 5.4.17 in Fast-CGI mode.
Thanks in advance!

This method is sufficient to protect against Apache serving this directory, but a configuration error may disable this:

If your main Apache configuration contains AllowOverride None (or similar), then .htaccess files are ignored. Thus your IP whitelist does not apply. Depending on the hostname or directory, different configuration might be set.
If you have Satisfy any set (not default) and a client is authenticated with the server, then it is still granted access.

Furthermore, there are other attack surfaces that may bypass your IP restrictions:

On a shared webserver, it might be possible for other users of the server to access your files over the filesystem, bypassing Apache.
If your webapp does not use HTTPS, it is already vulnerable to sniffing and MitM attacks.
Your app could still be vulnerable to CSRF. If someone knows that a particular app is running on this host, (s)he could trick you into opening a page that exploits a CSRF vulnerability in your app (if any).

Suggestions:

If this is a dedicated server for this webapp, configure the firewall to whitelist your IP addresses for this port. Remember to check your IPv6 configuration as well.
Ensure that file permissions are correctly configured. Should any service (running as a different user that is not root) on your server be compromised, then your app should still be safe (providing there are no privilege escalation bugs).


ZTE router antihacking option I have a ZTE Modem router using it to get internet connection for a home PC, I opened the tab : security and under it choosed "firewall".

I found that the option : "enable anti hacking" is unchecked.
According to ZTE help, checking this option protects against (ping flood, ping to death, sync flood attacks).

And I found the option " Firewall level" is set to high, and a small hint below it is written as follows : "Allow legal WAN side access, but prohibit Ping from WAN side."

I checked the " enable anti hacking " option.

But I'm asking, I there a possibility that I have been hacked in the period before I enable this option or this is impossible because the firewall is set to high which prevents WAN ping?

The router model is " ZXHN H108N V2.5"

Thanks in advance.

The help for the "anti hacking" feature you show only describes some trivial attacks which are no problem for most modern systems anyway or, in the case of SYN flood, at most make the system very slow (i.e. denial of service). This feature in no way protects against the most common attacks against clients today, i.e. malware, ransomware, banking trojans etc delivered through phishing mails, malicious ads or malicious or hacked web sites.
In other words: it is more marketing than useful.


What kind of safety does software isolation (e.g. in operating systems) offer (e.g. between OS and browser)? What kind of safety does software isolation (e.g. in operating systems) offer (e.g. between OS and browser)?

Particularly, what kind of safety mechanisms are there and how secure are they?

By software isolation I mean process isolation and related things (e.g. fault isolation). That different softwares (running on an OS) and the OS itself are isolated so that they may not access each other, or at least not access all features. This is believed to give security since that way a hacker may not easily be able to access another, potentially more critical part of software, through something else that his able to access.

TL;DR
It's the most basic form of an anti-malware, long before a traditional antimalware works.

Consider that an OS is a software ecosystem where multiple applications developed by multiple parties interact. Exactly like a big bazar where multiple merchants offer services and goods to the same customer. They must share the common space. And some may be evil under any extent.
Sharing of resources
Isolation between kernel mode and userland mode allows OS to prevent an application from stealing too many resources, making it safely crash when it comes to requesting too much memory or disk space. In this scope, OS also prevents an application to take control of disk by overwriting data related to another application.
Memory isolation
Applications may contain sensitive data. Your OS stores your user password, or at least its encrypted form, in memory. If OS did not isolate its own memory from the app memory, any app can tinker with your user password.
Not to mention with your Bitcoin wallet...
Fault tolerance
Do you really want an application crashing to reset your entire device?
Think for a second: you are on a Skype work meeting and your favourite messenger application crashes because of a bug. OS makes the IM crash, and notifies the event, but your computer/tablet will not reboot so you won't have to explain your boss why your video was interrupted.
This third case covers unintentional faults.


ssl client authentication: check only one certificate VS certs signed from a ca i'm about to secure a webservice with client authentication. (apache2, mod_ssl, openssl).

from what i googled, i found that it's more common to have a ca, which signs the client certs, which will then be checked.

also i found that it should be possible with the help of the sslrequire directive (in the apache configuration) to check something i guess the issuer and subject DN's of the client cert, or would there be a better field for this, in order to check if the client has a certain certificate.

something like (pseudocode):
sslrequire issuer_dn='issuer_dn_from_client_cert' AND subject_dn='subject_dn_from_client_cert'

my question is: would that really work ? i mean, if an attacker would guess the issuer&subject DN's - couldn't he craft himself a valid certificate ?

Certificates are signed. When a server authenticates clients through certificates, the following three things happen:

The client demonstrates mastery of the private key corresponding to the public key which is contained in its certificate. This part happens within SSL; as part of the protocol, a signature is computed by the client over a challenge from the server. You don't have to care about that because the SSL library you use already does it.
The server validates the certificate. Validation is about making sure that the certificate contents are genuine. To validate a certificate, the server verifies the signature on the certificate, with regards to its issuing CA public key. The CA public key is itself obtained through the CA certificate, which has to be validated as well, and so on. This process ultimately binds to a public key known a priori, called a trust anchor or root CA.

The Apache SSLCACertificateFile and SSLCACertificatePath directives are used to configure which root CA your server will use.
The server decides whether the authenticated user should be granted access or not. This is what Apache's SSLRequire directive is about: a filter on authenticated identities.

The first step is the method by which the server makes sure that the client is "whoever owns public key Kp" (as found in the sent certificate). Second step is the mechanism which reveals to the server the identity I of the owner of Kp. First and second step together give to the server some guarantee about the identity of the client. Now that the server knows who is calling, the server must still verify that the caller is indeed allowed to do the call. If we want to use strict terminology, the first two steps are authentication per se, while the third step is authorization.

An analogy:

The client is Bob.
The private key is Bob's face.
The certificate is Bob's ID card.
The SSLRequire directive is the list of expected guest, within the hands of the security guard.

Bob demonstrates ownership of is face by virtue of that face being firmly attached to his body (the guard checks that the face is not a mask); that's the first step.

The security guards inspects the ID card, concludes that the card is genuine (we assume here that ID cards cannot be falsified), and that the photo on the ID card matches the face of the individual currently standing in front of him. Since Bob's name appears on the ID card, the security guard now knows that he is talking to the genuine "Bob". That's the second step.

Then the security guard checks whether his list of allowed guest contains Bob's name. If it does, he will let Bob in. Otherwise, he will shoo Bob away.

Dave, a party crasher, wants to get pass the security guard. To achieve that, he has to break through one of these steps: either get a fake Bob face (with a mask so perfect that the guard will be fooled), or get a fake ID card (with Dave's face but Bob's name), or alter the guard's list (simply adding his own name to the list). Going back to the Apache server, this means either stealing the client private key (e.g. by cryptographically breaking it -- good luck with that !), obtaining a fake certificate (which entails bribing or hacking one of the CA which Apache has been configured to accept), or altering Apache's configuration (its SSLRequire directive). Since altering Apache's configuration means that Dave already has root access to the machine, this is usually not a relevant attack.

Knowing Bob's name is not sufficient for Dave. THAT is the answer to your question: no, knowing what to put in a fake certificate (the issuer and subject DN required by SSLRequire) does not allow crafting a fake certificate; the attacker still has to corrupt some CA so that he gets his certificate signed (in a way that the server accepts).


Metasploit remote exploit locally I have a test machine running:

Windows 7
Symantec Endpoint Protection.

The firewall only allows access to Symantec Endpoint Protection via 127.0.0.1.

If I have gained a shell to the machine via windows/meterpreter/reverse_tcp.

And I have found a exploit to use against symantec, but the exploit is a remote one and only accepts RHOST and not SESSION.

Is there a way for my to provide a session instead of a remote IP for the exploit to work?

Within your meterpreter forward the port from your local machine:

meterpreter > portfwd add –l 3389 –p 3389 –r 127.0.0.1
[*] Local TCP relay created: 0.0.0.0:3389 <-> 127.0.0.1:3389
meterpreter > background

Then set RHOST to 127.0.0.1.

msf > set RHOST 127.0.0.1
msf > exploit

Docco here.


Email notification on accounts lockout I am debating the merits of a feature being requested for our web application.

The request is asking for an email to be issued to a user when an account is locked. Accounts are
locked after 5 failed attempts. For each failed attempt the user is simply informed of an invalid username / password and we don't indicate the account is locked on the front end, to mitigate against username enumeration.

My points against this request are

I am suggesting the feature could possibly open the email system to attack by locking all users accounts and issuing emails on mass assuming someone knows all usernames.
Feature does not add value to the user, as our product provides a nice forgotten password ability.

Any thoughts, recommendations or industry standard. From my knowledge as long as a secure feature allowing user to initiate forgotten password should suffice.

The addition of the user requested feature doesn't seem to add any security vulnerability to the current flow of things.

  I am suggesting the feature could possibly open the email system to
  attack by locking all users accounts and issuing emails on mass
  assuming someone knows all usernames.

Does the "forgot username/password" feature send an email to the user with a password reset link? If so, then an attacker that knows the username could still force the victim to be peppered with a different category of emails, by initiating password reset emails a bunch of times

  Feature does not add value to the user, as our product provides a nice
  forgotten password ability.

In line with Matthew's comment, the average user very probably does not know why they are not able to successfully log in. Unless they explicitly know that this because of a lockout, they would most likely blame the application.

Additionally, it is never bad to have a measure in place that doesn't pepper locked out users with repeated "locked-out" emails. One email with the necessary information on the account being locked out should be sufficient. The user not acting on the email is their own bad. Beyond that, as you say, they could always access the forgot password feature.


Google Accessed My MSN Account! I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a text from a number that has texted me before about Microsoft Live-related stuff, then as an email from account-security-noreply@account.microsoft.com less than a minute later, so I can be reasonably sure this comes directly from Microsoft. When I traced the problem back, I found out, using speedguide.net, that the IP address, 209.85.212.146, is currently, when I'm asking this question, at Beacon, New York, and that it is allocated to Google. This is backed up by a couple other Google search results for the IP range 209.85.x.x. I think this is Google trying to get my MSN email to show it in my linked Gmail account.

This brings up a couple questions:

Is there another reason Microsoft blocked this address, besides it being a "new" address?

Should I be worried? Could this actually be a Google employee and not an automated script, etc.? Worse, could it be someone pretending to be Google?

If it is indeed from Google getting my email for my linked email address, why didn't Microsoft block the IP addresses Google used before this one? If it is the same address Google used before, why is Microsoft suddenly blocking it?

Why does Google need my username and password to get my email? Why not use a cookie or something?

I changed the password for my Microsoft account some months or years ago, but I never told Google the new password. Now, I still get some MSN emails through both addresses, but not all. If this is why this "breach" happened, because Google has tried my password too many times, why has it taken so long for Google to try it so many times?

Is there another reason Microsoft blocked this address, besides it being a "new" address?

That's a good question. I'm not sure, and maybe some other members of the community can answer it.

  Should I be worried? Could this actually be a Google employee and not an automated script, etc.? Worse, could it be someone pretending to be Google?

It is probably an automated script in Gmail trying to download your Microsoft email. You gave your MSN details to Gmail so it can use POP3 / IMAP to download your MSN email, right?

  If it is indeed from Google getting my email for my linked email address, why didn't Microsoft block the IP addresses Google used before this one? If it is the same address Google used before, why is Microsoft suddenly blocking it?

This is another good question. I have a few thoughts about this, but don't want to inaccurately speculate. However,  I don't thnk this is a sign of maliciousness.

  Why does Google need my username and password to get my email? Why not use a cookie or something?

You use a cookie to log into the authenticated part of a website. Gmail uses POP3 and/or IMAP, which are protocols that are used by desktop mail clients like Microsoft Outlook. It is a lot easier for computers to deal with mail when it comes through a standard like POP3 or IMAP.


Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key? Starting with a one time pad say you want to encrypt some small strings like the words in this sentence but you want to reuse the same OTP key for each string so that when you encounter the same word the ciphered text comes out the same.

But say you modify the OTP algorithm in some way, say by jumping around on an extremely long key according to some special calculation that places you on different positions along the key (for the same word you end up at the same position each time)  So different words end up at different positions.

Would making the key very long and alternating positions along its entire length make any difference in decrypting the resulting message?

It's not a "one time pad" if you reuse the key.

You lose the perfect security properties of a one time pad with any key reuse, period. Your scheme just reduces the security level of the algorithm to your "special calculation", which is simply security by obscurity.


How should large organisations manage credentials? How should large companies store credentials for important systems, such as root access to an integral machine (e.g. high-traffic web server), or social media accounts?

First, root access to a machine does not require to be shared. The number of human beings that need to be administrators should be small before the number of users that the machine can accept. Said differently, each administrator of a machine should have personal credentials for that machine, that should allow him/her to require administrative priviledges. That is the only way to be able to know who is responsable for what in case of trouble. And that comes out of the box for Unix-Linux systems as well as Microsoft ones.

In the opposite it is no harm in having the same credentials allow access to a group of machines. Single Sign On systems can be found everywhere, from the good old Kerberos to Microsoft Active Directory or LDAP. What matters is that the group of machines must be identified. Even inside a datacenter, it is common for administators to share same credentials for all machines of one security zone.

That does not mean that companies pretending to be serious never do security horrors like installing the credentials for a bunch of machines (mainly machines belonging to their clients) in some relay host. Nor does that mean that credentials for the company facebook account is not written on a paperboard in the communication service office, but those are definitely poor security practices.


Wireless mouse security How secure are wireless mice?

Is it possible to control a wireless mouse from a different computer?

Is it possible to know the mouse movements from a different computer?

From testing, I have demonstrated to clients that yes, both of these are possible. The machines are supposed to have a 1 to 1 relationship with the mouse, but for some types of mouse there aren't a lot of ID codes, so you can get overlap.

The same is true for some wireless keyboards.

Simplest solution: if you are worried at all, use wired devices


Storing bank account information - AWS RDS Encryption I currently have a requirement to store bank account information (transit numbers/account numbers/routing numbers) and I need to know how best to store them and retrieve them from the database.

I'm currently using Amazon's RDS to store the data, and I've turned on the AES-256 encryption at rest feature. I believe this encrypts the data on the volume, but I don't know if it's enough to secure the bank accounts.

My current line of thought is that I should keep a secret on the server and whenever writing the bank account I should AES-256 encrypt it with the secret and save that encryption on the entity. Whenever retrieving that entity I'll have to decrypt it manually using the secret (serverside).

My thinking is if the Database is ever compromised (even with the RDS encryption) they wont get bank account information.  I should also note that the database should be locked down only allow connections coming from the server the code is running on.  Maybe in my case, this is overkill?

My main questions are:

Is this a good method to use store bank accounts?
Is this necessary if I'm using AWS RDS's encryption feature or is it overkill?

No. If your secret is on the same server you are encrypting the data on, you are making a mistake. It should be separate and physically secure, preferably on an encrypted USB drive. If you need to encrypt data while you are not around, I would suggest encrypting it with a public key and then decrypting it later, separately. However, if neither of these is an option, I suppose security by obscurity is still an option (however meager it might be)....


Key's random art image is mostly black I have generated an SSH key on Ubuntu 10.04 with

 ssh-keygen -t rsa -C "example@example.com"

and the key's random art image comes out mostly empty (modified slightly):

+--[ RSA 2048]----+
|                 |
|                 |
|                 |
|                 |
|        D        |
|      s.J        |
|       Bv.++=    |
|      =ooo.=o+   |
|     c .+*.+o.   |
+-----------------+

Does that indicate an issue with the random number generator?

No.

The "random art" image is created by a random walk through the image area, using the key's fingerprint as the sequence of moves to make.  The fingerprint is short enough that the art can never cover more than about 40% of the image.

An analysis of the art and some attempts at attacks on it are available in the paper "The Drunken Bishop".


Can Windows 8 be PCI compliant? I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows & Mac OS X (not for available for Linux which is the most secured). Anyway, I was trying almost all the Windows versions and I couldn't get PCI. Can Windows 8 get all the requirements to be PCI?

If desktop computers are within scope of your PCI boundary then they will have to be subject to the same controls as any other device in scope. This means a number of controls on the configuration, AV and malware protection, security policy (password management controls), etc. as well as processes around usage need to be considered. There is nothing specific that I have found about Windows 8 that means it can't form part of a PCI compliant solution.

Are you concerned about any specific control or process or any specific scanner result?

Remember that if a specific scan plugin fails against a device there is also opportunity to put in place compensating controls (though this is normally a last resort).


What is the point of hashes when downloading over the same channel? What is the point of providing shaXXX hashes for downloads of software over say TLS when any attacker that could change the download could have easily changed the hash? Isn't there enough information in the download to know that it is corrupt? Just seems brain dead to me.

Correct, if the hash is provided on the website next to the download then it does nothing. If the hash is provided over a separate channel, especially if something reliably archives the hash that was published when the binary was published, then it provides some security. Not as much security as a digital signature, but some.

So hashes published in archives of mailing lists, hashes you received by email directly, hashes in package manager manifests, etc. are useful.


Are there any pen testing tools/methods for wpa2 networks that don't require using an adapter that supports monitor mode? I really enjoy reading and researching about networking and pentesting. Recently I heard from a friend that there are ways that can be used to get into wireless networks without needing an adapter that supports monitor mode. He spoke about a Wireshark tweak but thats all he knew of. Hopefully someone here knows. anyway Are there any alternative methods?

Practically speaking, no.

In order to break a WPA2-Personal network you need to capture a four way handshake. There are basically two methods to do this. In one case you simply eavesdrop while others connect, and when that connection is established the four way handshake occurs. The other option is to kick a client off of the network and again, capture the four way handshake.

In both cases you are capturing traffic that is not destined for your machine (mac address) and in most cases, you do not know the mac addresses of the clients that are currently on the network. For these reasons in almost every practical case to break into a WPA2 network you will need to put your network adapter into monitor mode*.

For WPA2 enterprise the scenario is completely different, but the answer is the same. In order to attack the network you need to set up a rouge AP. Although the steps for creating this AP technically don't dictate that you need to put your card into monitor mode; in order to know all of the configurations to successfully carry out the attack you will need to put your wireless interface into monitor mode.

*Note: If you do know the mac address of a client, and you have already connected to the network - it is possible to change your mac address to that of another client and receive their packets without the use of monitor mode. But then you're not really attacking the network are you?


Reality check: what actions should be taken if an hack attempt seems to be a false positive Premise:

Some time ago a friend of mine created a Microsoft based mail account (Live Id/Microsoft Account. He just needed the mail) to use for receiving some messages. The account was created and then left unused for a few days. Later, when accessing the account again about one week later, the system reported that the account was suspended because some suspicious activities were detected.
The security page for the account reported an "successful login attempt" from an unrecognized IP about 10 minutes after the account was initially created. The account password was pretty strong and not shared with any other account, the account name was chosen at the time the account was created and couldn't be reasonably know to other people, so the only way some third party could get to know the account credentials in less than 10 minutes from the account creation I could think of was a keylogger or similar spy malware on the machine.

At this point my friend contacted me for help. I immediately searched for traces of an infection or other system-compromise but wasn't able to find any sign of infection on the machine - a IMac/Osx based computer. No visible rogue app, router config seems ok (I had also tried some online tools like F-Secure Router Checker to check if there was any trace of a router-lever dns hijack). I then noticed that the reported "unknown ip" that supposedly accessed the mail was 65.55.52.40 - an IP belonging to Microsoft. Contacting the service support yield no result (no wonder) : some of the employees seemed to hint that the system could indeed sometime cause false positives originating from internal maintenance scripts, but no official documentation was found about the issue.

So, long story short: Microsoft reports that someone used the correct credentials to access the account, the access is dated just <10minutes after the account creation so there is no time to bruteforce the account. Either I assume that there is some sort of spyware on my friend machine and suggest a full wipe OR I tell him that it probably was a false positive (the Microsoft owned ip seems to suggest so) and that he should probably ignore it.

I am now wondering on what the best actions would be in such case.

SIDE NOTE:
Technically, an hacker accessing the account could very easily spoof its IP to appear as a Microsoft owned one in order to try to hide its activity. But I wonder if such technique could really work: imho such behavior would be the equivalent to trying to fool a bank into giving you access to someone else account while presenting them a fake ID card with the name of the employee in front of you printed on it.... I would hope that Microsoft would at least be a little suspicious when receiving a request over the internet from a remote PC claiming to be a machine in their own network...

As proof of a successful compromise has been cited, my suggestion would be to isolate the computer from the network and watch its behaviour (i.e. the network traffic). Information gleaned from this might shed some light upon how the compromise was performed, and thus how to avoid it in the future.

After this step, the computer should be erased, updates performed and all passwords and credentials for user accounts should be changed.

To emphasize on earlier postulations: Whether Microsoft is directly or indirectly involved in a compromise is irrelevant here; a Microsoft system could be hacked, and a proxy or VPN software installed upon it to cover tracks... After all, nobody in Microsoft would want to admit to such an embarrassing attack; they'd cover it up.

  I am now wondering on what the best actions would be in such case

At the very least, to quote what I wrote earlier, "the computer should be erased, updates performed and all passwords and credentials for user accounts should be changed." This won't shed insight upon how the compromise was performed, but that insight might not be necessary. I tend to be curious about these kinds of things, so I'd be likely to perform some investigations prior to that system restoration phase, and from my experience there's usually a botnet to observe, and a leader repeating the same attack upon multiple people well into the future.

EDIT: The following was the result of misinterpretation of the question, and doesn't answer the question, but does present some good advice so I'll leave it, with invalid sections struck out like this.

It's a good practice to change the password every few months. The account was only freshly created, and there are no reasonable grounds to suspect the password is known.

  Some time ago a friend of mine created a Microsoft based mail account (Live Id/Microsoft Account. He just needed the mail) to use for receiving some messages. ... All seems to point to a keylogger or similar infection on the client used to create the account.

It seems crazy to assume the only person who knew about the email address was the client, does it not? After all, the client was "receiving some messages".

Additionally, if the client is keylogged, it seems crazy to assume the hackers need to brute-force; if they have your keystrokes, they can... replay your password.

Perhaps the sender wanted to crack the account open but doesn't want there to be any evidence and so to cover tracks, used an irrelevant Microsoft system (the IP you mentioned).

There are also emotions to consider. Suppose sender thinks receiver will get paranoid, and to trigger the paranoia merely inserts the email to a phishing page with a fake password. Yes, people are often extremely vulnerable to emotional hacking.

Whether the sender/hacker/whatever is internal to Microsoft or not, this detail matters not to the question. Nonetheless, it's possible that Microsoft system was infiltrated by a Microsoft employee posing as a Russian hacker via Tor, which was then used to host a phishing site later used by sender to trigger anxiety meaning the blame is shared amongst two (edit: multiple) attackers, and the service staff you spoke to not wanting to get in trouble for such a stupid (edit: an embarrassing) attack implicitly being a third; how deep could the rabbit-hole go? It's not important.

No, the computer shouldn't be erased unless there's conclusive evidence that it was compromised. In this case, there seems to be no such conclusive evidence (or even mildly suggestive evidence), so even changing the password for the inbox seems unnecessary.

  I am now wondering on what the best actions would be in such case

(edit: see suggestion at top of post)

Nonetheless, changing your password every few months is a good security practise. Perhaps making a memo to change the password in a few months is the most appropriate course of action here :)


Do websites grant their own JWT token after successful OpenID/OAuth2 login? I am looking at implementing an Authorization Code with PKCE grant on a mobile app to communicate to an API.  What I am curious about is what applications currently do with the OpenID token that is granted to the user via Google.  Do servers typically use the token granted by Google to handle which user is interacting with the API or do servers take the information from the user info endpoint and grant their own token with claims that they control?

Recommendation would be to generate ones own as then you are now in full control of that token, when it expires, etc. that said, I'm sure there is a site somewhere that doesn't follow this practice.

That said, you may keep a record of the original token as well for audit trail purposes.


How do I act as a go-between for two parties that do not trust each other? I am speculating on the design of a system that allows trusted information exchange between two parties.

Party A:

Is a large corporation.
Wants to offer access to their employees via a single-sign-on arrangement to materials held by Party B.
Employees will have access to only parts of what is made available by Party B.

Party B:

Wants to share proprietary information with Party A.
Does not entirely trust Party A to not disseminate information beyond authorized users.
Does not want to give Party A complete access to all their data.
The data in question include a variety of web-resources, files, etc. What Party A does with all this stuff is beyond the scope of the question.

A go-between system (man in the middle, clearing house type of arrangement) needs to audit what Party A does with the information, keep logs of who logged in when, what they looked at, for how long, etc.

What kind of systems arrangement would make sense to ensure that access to Party B's information by Party A only happens when specifically allowed?

It sounds like your requirements are:

Party B has a wealth of content.
Party B would like to grant certain employees of Party A access to certain resources.
There are flexible access controls for controlling who has access to what.
Party B should be able to modify or revoke any access at any time.

Correct?

Lots of ways to skin this cat, in increasing order of complexity / cost:

The dumbest way is to set up a 3rd party document manager. At the simplest end of the spectrum is Google Drive that would give you the access control, and at the high end are enormous content platforms like SalesForce. Moving your content over one page at a time is clearly not ideal for various reasons.
See if whatever program the content is currently in has flexible enough access control rules. For example if the content is in Office365 or Confluence then you may be able to get away with giving them O365 accounts, or working with IT to give them network accounts that only have access to Confluence.
Look a product built to solve this specific problem. As a shameless plug, Entrust GetAccess is such a product that acts as a firewall / authentication wall, allowing you to specify which users are allowed to access which URLs.


File Vault 1 password from memory dump I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption on-the-fly without reinstalling everything.

Moreover I have

physical access
user and root password which are same (but not masterkey which is different)
memory dump while machine was running and file system mounted and readable (ELF RAW and MACH format, each about 5gigabyte)

What I tried to get the password:

With disk decryptor to search for the keys automatically. The result looks like a list:

Algorithm: 'PGP' Volume Master Key (AES-256)
Key data (hex): 6f757268617264776f726b62797468657365776f72647367756172646564706c
When I converted it I got:
ourhardworkbythesewordsguardedpl
Which is not the password, but a string of fakesmc.kext. There are other hex values as well, but not human readable if I convert them from hex to text using hex2text
Tried this which is intended for filefault2 human readable string search

strings memdump_0x100000-0x100000000.bin | grep --after-context=5 AuthorityRequestType | grep --after-context=1 password | sed "s/^`//g"

But it gives me back nothing. If i remove or modify some grep arguments it gives me back a hole bunch of strings but I don't even know what and where to look at or how the structure is.
Look around in backtrack/kali but I could not figure out how I should approach the final step.

How can I extract the master key? Should be even easier because its only version 1, but nothing - it seems even more complex, so any help is really appreciated =)

It's been nine days with no other answers, so I'll put in this poor attempt.
As a note, your references to both "master key" and "master password" are a bit confusing.

Start by looking at the john-dev mailing list entry on FileVault cracking; in particular, that post lists VileFault which may be of some use to you, and  Openciphers appears to have an FPGA FileVault implementation if you have a budget.

Also, Jeremiah Grossman had perhaps a similar problem.

Peachpit has an article that has guidance on resetting the master password assuming you know the FileVault passwords, if that helps you.

The actual encryption key should certainly be in RAM when you're able to decrypt the files - can you see what areas of RAM are being accessed every time you read files?

Last, I assume simply copying them all off to an external drive and then back to a fresh partition isn't suitable, since you mentioned "installing" everything again?


Generating partical Eliptic Curve Diffie-Hellman keys I want to generate a pair of ECDH keys (64 bytes each), where the first 12 bytes of the public key will suit my format.

For example, if I have a unique sequence "13456789ABC" I'd like to use it as the first 12 bytes of the 64 bytes long public key (the rest of the length is padded by the generated values). For each generation of the keys, the sequence will change a little bit so it is unique.

So I'm basically asking two things:

Is this possible?
Is there a generator which would allow me to specify a prefix of a suitable length for the public key?

Quick answers:

Not impossible, but pretty much in the realm of defeating PKI - so not easy by a long shot (yet).
[edit: If it ever becomes easy, you might want to stop using that implementation of PKI for security in the first place!]
I have not come across such a generator.

PKI makes that difficult by design (not necessarily in implementation though that's a digression) - so you might want to look for design solutions that better suit your needs. Or state your underlying need, to explore possibilities.


How do RF remote clones manage to clone rolling codes? I wanted to clone my garage door remote to learn more about IoT security in particular so I read a lot about rolling codes, and the more I read the more I am convinced there is no way to actually clone any rolling/hopping code remote even with its master key (seed value or encrypting key) - there are many algorithms out there to derive the next values for a given synchronisation counter and seed value/encrypting key.

And yet! The so-called "universal remote" manage to clone rolling-code remotes when fed the master key in addition to the button signal... How is that possible? Do they use a very common encrypting technique and just assume that the majority of remotes out there use the same algorithm (I stumbled upon the HCS301 during my research, maybe Keeloq is the most widespread?)?

Generating rolling code is as simple as passing a secret key (sk) and initialising it with an incremental value of counter.

HMAC-SHA256(sk, counter)

Most of the key fobs use proprietary algorithms to generate rolling codes. You can't create a universal remote even if you know which algorithm manufacturers are using. The seed value is unique per key fob. To generate same rolling code as the targeted key fob, you need to know this seed value or a secret key depends on the implementation.

The easier way is instead of figuring out the secret value, clone the rolling code and replay.

Jam+Listen(1), Jam+Listen(2), Replay (1)

2nd rolling code is still unused and can be replayed later. This is called rolljam attack. Hacking a Car’s Key Fob with a Rolljam Attack

This attack works on any key fob which doesn't authenticate the device. A generic remote exploiting this attack can be built using software defined radio. You don't even need to know the underlying implementation.

  The so-called "universal remote" manage to clone rolling-code remotes when fed the master key

It is still not universal. The master key is specific to the manufacturer and its car model. You can derive the secret key for key fob using this master key but you also need to implement the same algorithm specific to the manufacturer.


Is end to end email encryption possible without unique domain/subdomain for each user? Lets say Alice@gmail.com wants to send message to Bob@secureMail.com

Alice <--> gmail.com <--> secureMail.com <--> Bob

We know gmail.com can read the unencrypted message. Is it possible for secureMail.com to receive the message such that only Bob can decrypt the message?

If my understanding is correct, secureMail.com will have a ssl certificate and gmail.com will encrypt using secureMail's public key so that the communication is secure. So secureMail.com can read unencrypted message. It can however re-encrypt with Bob's public key before persisting on disk.

Does email protocol allow secureMail.com to present different certificate/publicKey for each user to gmail.com so that it never gets to read unencrypted message?

Update:

This website claims emails are end to end encrypted and even the server cannot access decrypted data. Did i miss something? site: https://protonmail.ch/

https://protonmail.ch/pages/security-details

  ProtonMail's segregated authentication and decryption system means
  logging into a ProtonMail account that requires two passwords. The
  first password is used to authenticate the user and retrieve the
  correct account. After that, encrypted data is sent to the user. The
  second password is a decryption password which is never sent to us. It
  is used to decrypt data on your device so we do not have access to the
  decrypted data, or the decryption password. For this reason, we are
  also unable to do password recovery. If you forget your decryption
  password, we cannot recover your data.

Unless you're doing end-to-end encryption (where the servers only see encrypted messages, other than the recipient's name), there's no real security, so having something like this in the mail submission or transport protocols isn't going to be useful.

The receiving server could certainly encrypt incoming (unencrypted) messages with the recipient's public key, then securely erase the unencrypted message and transient key, which would make it somewhat more secure, but you still have to trust all intermediate servers.  You can't even force them to use a secure transport from server to server!

Even if there was an extension to the mail transport protocol for the receiving server to send a public key of the recipient, you're still trusting that the receiving server is sending the correct key.  It could easily send a false key, decrypt and save it, then re-encrypt with the correct key.  If you CAN trust the server, you might as well have it just get the unencrypted message (using secure transport) and encrypt the  message itself.

Having an e-mail client with built in support for encryption and authentication/key management is really the only secure way of doing it.  There's no reason you should have to trust the mail servers.


SSL/TLS cipher suites Which factors affect the cipher suites lists?

Me and my friend are both using Internet Explorer, which support the same version of SSL TLSv1.2, and the cipher suites lists are different.

Note: our browser versions are different.

I assume that you are asking about the list of cipher suites sent from the client to the server in the first message of the TLS handshake. A browser needs configuration, and potentially code, to implement a cipher suite. As changing the configuration and code requires development and (lots of) testing, browser vendors frequently don't bother to port all cipher suites to all supported browsers. In part this is due to laziness, though spending effort to support the latest-and-greatest cipher suite if it is not widely used by servers does seem like a poor use of limited resources.

So browser vendors try to choose a set of cipher suites that will provide universal connectivity with servers as well as sufficient security.

Over time, browsers tend to add stronger cipher suites to their implementation and drop support for weaker suites.

The exact set of available cipher suites varies from one version of SSL/TLS to the next. The Wikipedia has a nice table showing how old cipher suites have become insecure and were then dropped from later versions of the the protocol. You can see the draft list cipher suites for upcoming TLS 1.3 protocol.


Using a HSM device for code signature generation I currently generate code signatures for my open source package by using openssl.

The way I do it is :

Generate RSA private-public key pair (E.g. openssl genrsa)
During packaging , I create a signature by generating a sha-512 digest for the package and encrypting the digest using the private key ( E.g. openssl dgst -sign)
I give my public key to the person downloading the package , and they verify the package using my public key and the signature (E.g. openssl dgst -verify)

I am considering using a HSM server for storing my private key for increased security , but I want to keep the verification workflow the same for my users.

For example , I want my users to be able to verify the signature by using openssl without having to access the HSM device.

Would this workflow be possible with HSM type devices (E.g. CloudHSM from AWS)?

Thanks for your help.

Yes. Of course the users do not need any access to the HSM at all. They only need the public key.

This is what is done with a smartcard and an x.509 certificate. The certificate is handed to other users. They get the certificate as a file. It contains the public key. Usually they do not know anything about the private key.

The private key could be generated on a smartcard or HSM.


Location/proximity based decryption using separate machine I read a long thread where the whole issue was revolving around deriving decryption keys from GPS location. This has huge issues, as being present at a location is not needed to know the location. Maps can give us coordinates without getting near the actual location.

Someone suggested to stick a QR code at the actual location, perhaps in a non trivial place like under a table in a caffee. You need to physically go there to get it, or at least delegate someone to go there, but clearly you need a physical presence. My problem with this approach however is that once you acquire the code on the sticker, you no longer need to stay there.

Consider this then: A small cheap and disposable machine, like a Raspberry buried in a wall, can be programmed with a random key that is fixed by owner and not exportable. There is a running program that answers wireless requests to decrypt arbitrary data under said fixed key. So the actual message to be ultimately obtained is encrypted with a one time random key, which itself is encrypted with the fixed key and appended. Sender needs to have the fixed key. Receiving user being present at location can decrypt by requesting the attached one time key to be decrypted over wireless. Since one time keys are not predictable in advance and fixed key is secret, user needs to be present at the site to obtain decryption of each new message.

What could be the less obvious threats to the security of this scheme? Obtaining a search warrant or breaking concrete wall in which the device is buried is a significant effort that is above most attackers.

I would say sticking a NFC Smartcard would be the best solution. Then physical presence would be required, and you could even have assymetric encryption, eg encrypting with a public key and then you have to be physically present to decrypt data, and it works in the way you say, eg you ask the card to decrypt something.

The advantage with a NFC Smartcard, is also that it can be embedded into objects (eg cast or mounted inside something), making it significantly more difficult to "steal" the smartcard. Google "NFC OpenPGP" and you will find a few solutions on this.

Another advantage is that no power is required, since the interrogating reader (for example a mobile phone) will provide the required power to card.


When are HTTP session cookies at risk over Wi-Fi? If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties?

Are cookies only at risk during login, or am I at risk any time I use HTTP?

If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties?

No.  Outsiders can crack WEP networks almost as if they weren't encrypted at all, these days.  Insiders have even more ease of access.  Even on WPA/WPA2 networks, there are still exploits that enable insiders to sniff the traffic of others on the network.  Lastly, there's always the risk of someone listening in on the wired side of the network where your data is not protected by the encryption used over the air.

  Are cookies only at risk during login, or am I at risk any time I use HTTP?

Your data is at risk any time it is sent in the clear.  Even if the login page itself is HTTPS, other webpages that transfer your session cookie over HTTP can put that account at risk.  You are vulnerable as long as you remain logged in and the website is transferring your data un-encrypted.

The only effective way to protect your session cookies is to only use websites that transfer all data over HTTPS all the time, or use a VPN for everything.  Even then, the VPN is only as trustworthy as the VPN service provider.  There's also MITM attacks against HTTPS, so you've really got to trust the system and network you're on if that's your only protection.

Related:

Ways to secure yourself from Firesheep kiddies and other sniffing
Why is FireSheep such a big deal?


What are examples of code found in Polymorphic anti-virus? Viruses used to have specific "signatures" which anti-virus software used to identify them. However, in today's world, viruses can change their code (while maintaining purpose) at specific points in time, after certain numbers of infections, and so on to avoid detection (polymorphic viruses). What are good example lines of code found in anti-virus software that can recognize polymorphic viruses?

Signatures are only created after a piece of malware has been analysed. So whenever a malware comes out with a different byte pattern, the av relies on behavioral analysis of the malware, like if the malware if dropping a certain registry key or a file with a specific name, hooking a certain api function from windows etc.


How secure are phones in the context of 2-factor authentication? My bank started using 2-factor authentication with phone being part 2, so I am wondering is it difficult for someone to impersonate my mobile phone to receive the text message with the code?

NIST (National Institute of Standard and Technology) is recommending not to use SMS based 2 factor authentication.
According to NIST guidance.

  OOB [out-of-band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

This article by Brian Krebs has details on how the current 2 factor auth using SMS can be used by bad guys to scam people. It also has details on the alternatives which are more secure.

SMS is easy to intercept because of the SS7 protocol used by carriers which was designed with no security.


Courses on "Secure Software Development" This semester, I'm offering a course on "secure software development". The course is divided into three parts:

Secure Software Engineering
Reverse Engineering
Secure Coding

Do you know of any courses (especially, those offered at universities) with similar content, that you advise me to look at? I don't want my students to feel that only Windows suffers from security issues; so both generic courses and courses specific to 'NIX-based OS's are appreciated.

For Reverse Engineering: The University of Helsinki in collaboration with F-Secure offer a course titled Malware Analysis and Antivirus Technologies which has the curriculum available online.
For Secure Coding: CERT is always a good reference, especially for C & C++. They have a Secure Coding in C and C++ course at SEI @ CMU.


Does HSTS make using a public WiFi safe? What attacks, if any, are possible if I connect to a public WiFi network and only use my computer to access a previously-visited site that uses HSTS. I believe that attacks such as SSLstrip are not possible if my browser has an up-to-date HSTS header on file for the site I visit. Are there other attacks that are possible?

For this question, let's assume that I am visiting a security-conscious site such as https://paypal.com that does not load any resources from 3rd-party sites. That is, I am visiting exactly one site.

Short answer:

Yes, for resonable defintions of safe.

HSTS protects you against sslstrip type attacks for sites you have visited recently using a non-compromised connection (or for some browsers sites that are stored in a hardcoded "preload list").

The regular SSL CA system protects you against MITM attacks of ssl connections where the attacker has not compromised the CA system.

HKP (which is often used in conjuction with HSTS) provides you with a large degree of protection against compromises of the public CA system for sites you have visited before (or for some browsers sites that are stored in a hardcoded "preload list"). Exactly how much depends on what keys the site operator decides to pin, if they pin an intermediate cert rather than the server certs then the entity controlling that intermediate cert can MITM you.

HKP does not protect against MITM attacks by roots you manually added to the trust store. This was a deliberate design desicion to allow corporate SSL inspection systems to keep working.

No SSL based system protects you from MITM attacks if the attackers have managed to compromised the legitimate server's private key.

And of course there is always the risk of bugs in the protocol design or implementation or weaknesses in the underlying cryptography.

I covered a load of scenarios more explicitly in my (rather long) post at https://security.stackexchange.com/a/110004/79347


Shared terminal security hole I want to ask you about what I think is a pretty obvious security hole and what can be done about it.

Suppose my library has a room containing network-connected workstations serving Linux. You log on to them by typing your username and password. I create a program that mimics the login screen and sends the username and password typed to a server I control. The program then logs out.

I login to my library account and run this program and then I leave the computer. Next person comes along, logs in and voila! I now have this persons credentials. I can repeat this process as many times as I want and after I've gotten someone else's credentials I don't even need to login to my own account, making it impossible to track the phishing attack to me.

This above is obvious and I wonder why people aren't worried about it?

The security professionals are worried about this but this is an area of security which already has a working (good enough) solution.  The solution is part of the Operating System and its function is to protect what shows up on the login page from compromise.  In other words you cannot easily run a program you want instead of the default OS login page and log credentials this way.

There are social engineering attacks which mimic this scenario, for example once logged in you may be able to run a program which to an end user looks like a login screen.  It isn't possible to make it look exactly like that special screen because of built in graphical "modes" that are part of OS protection, but it can be made to look close enough to fool an inexperienced user into providing their login information and someone capturing it maliciously.  These attacks are more used in phishing and logins into web based services than a local terminal workstation in your library.

Additionally other attacks can accomplish the same goal without running a special program on the system, for example someone could rig the keyboard to record electrical signals as a key logger, though it may not be trivial either.

Whether the security measure is applied against these attacks is also a function of risk of attack succeeding.  Some environments will have better security budgets than others and apply varying degrees of protection.


Are RSA 2048, ECDSA, and the SHA uncrackable in the sense that AES-256 is uncrackable? The answer

https://security.stackexchange.com/a/25392

has seemingly shown that AES-256 will not be directly cracked for at least the next 200 years (unless we manage to harvest the energy output of distant stars). The only available attacks will continue to be indirect attacks like brute-forcing the original password, etc.

Questions:

I repeat the first question to the above answer that nobody answered: What about quantum computing?
Does the same hold for RSA 2048 and ECDSA? Will those be cracked (factorable) any time soon? I understand that RSA 1024 will be cracked very soon - is that true?
What about SHA-1 or SHA-256? Will those be cracked (reversed) any time soon?

I'm sorry for my cluelessness. I'm essentially trying to understand

whether my PGP encrypted emails (RSA 2048)
whether Bitcoin (SHA-256 and ECDSA)

will be safe for the next 200 years or so. Bitcoiners especially talk about its money supply after 150 years, so I'm wondering whether there is any basis for their confidence!

RSA-2048, ECDSA (on a 256-bit curve), SHA-1, SHA-256 and AES-256 are all "equally" uncrackable in that they are all in the wide category of "we don't know how to break them with existing or foreseeable technology".

(SHA-1 resistance to collisions, but not to preimages, is not in that category. That one we know how to break -- it would be quite expensive, but not beyond our collective reach.)

We can make some asymptotic estimates that state that if computers are allowed to increase in power in arbitrary amounts (but there are good reasons why this will probably not happen), then RSA-2048 will fall first (approximately 2112 resistance), then ECDSA with P-256 (2128), then SHA-1 (2160), then SHA-256 and AES-256 (2256). But such comparisons are quite meaningless, since they rely on an hypothesis which does not seem wholly compatible with laws of physics as we know them.

Quantum computers, if they can ever be built, will make short work of RSA and ECDSA. They will only weaken SHA-* and AES, down to levels which will still be somewhere between "fiendishly hard to break" and "unbreakable".

Prospective on technology evolution for 150 years are pure guesswork. Nobody really knows what the World will look like 100 years from now. Personally I do not make prophecies beyond 40 years.


What is the difference between EV-SSL certificates and Normal SSL certificates? Recently while looking at several banking URLs I can see the domain name with security certificate at address bar and normal locker security certificate at address bar. Have a look at the screenshots:

Is it just an additional feature? What's the main difference between those two?

The first example is a normal SSL certificate meaning that it's a valid certificate issued by a trusted Certificate Authority, but there was no extended validation of the owner of the domain/site. This could mean that the certificate claims to be from Foo Inc. but the CA did not check that the person/entity applying for the certificate was indeed Foo Inc. when they issued the certificate.

The second example is that of a Extended Validation SSL Certificate. This type of certificate does extended validation in that the CA verifies the physical address and other details of Foo Inc. before issuing the certificate. In the end this just serves to give more assurance to the end user that the owner of the site/domain is indeed the company Foo Inc.

You can read more here: How is EV-SSL different from SSL?


What is a quantum computing attack? As far as i know, a quantum attack is a brute force attack performed by a quantum computer. source: wiki

Is this very simple definition correct ? or the scope of a quantum computing attack is bigger.

No, it's an attack using algorithms such as Shor's algorithm that cannot be efficiently executed on conventional computers. A sufficiently powerful quantum computer can factor an integer in polynomial time, and many encryption algorithms rely on the difficulty of factoring large numbers.


How to protect Time Machine backups from Ransomware? According to Heise (German) Time Machine backups can be encrypted by Ransomware. Sorry I didn't find an English source, please use Google translate. KeRanger had an inactive module _encrypt_timemachine, which was able to modify backups as normal user (not admin).

How to secure Time Machine backups? I don't wish to unplug the disk.

Probably the best low-impact solution is to use multiple disks. OSX supports it already.

You could keep a regular disk plugged in, and use the second disk on a weekly basis (keeping it unplugged and in a safe location). If your backup gets compromised you only risk losing a week's worth of work.

Also, keep your backups encrypted!