How secure is e-mail landscape right now? In light of recent news about some flaws in PGP standard, I (a non-PGP user) started to think how secure are regular e-mails these days.

I have found the STARTTLS Everywhere project, and they have a very worrying warning:

  Most email transferred between SMTP servers (aka MTAs) is transmitted in the clear and trivially interceptable. Encryption of SMTP traffic is possible using the STARTTLS mechanism, which encrypts traffic but is vulnerable to trivial downgrade attacks.

Does it still hold true to this day? Is "regular" e-mail still going back and forth in plaintext?

Edit: my question is different from How (in)secure is POP/IMAP/SMTP because that question is focused on e-mail retrieval by final user. My focus here is on SMTP server to SMTP server communication.

First, end-to-end decryption offered by PGP and S/MIME and hop-by-hop encryption provided by SMTP STARTTLS and the TLS use in IMAP and POP are totally different things. With end-to-end encryption the mail is encrypted by the sender and decrypted by the final recipient. With hop-by-hop encryption instead the mail is only encrypted during transit from one mail server to the next, which means it is accessible in plain on each mail server involved and it is also stored in plain at the providers mail server where it then gets retrieved using POP or IMAP.

That said, there are some kind of recent statistics about how much STARTTLS for SMTP is supported in practice:

SMTP-over-TLS usage stats (2017 edition):
83% support TLS  (down from 86% in 2015), of these 65% support TLS 1.2, ...
Measuring SMTP STARTTLS Deployment Quality from 2016:
around 82% of servers support TLS, of these around 20% have no valid publicly trusted certificate

While these statistics describe how much mail servers support receiving mail bei TLS they don't say how much mail is actually delivered by TLS. There are some interesting statistics from Google which describe how much TLS is used for incoming and outgoing mails from them. It shows for example that at the beginning of 2016 about 60% of incoming traffic was using TLS, beginning of 2017 already 80% and now about 92%. The current number for outgoing mails is around 88%. The last number means that for 12% of the recipients their mail server does not support TLS.

To get some real-life statistics of my own I had a look of some mails I have collected within the last 3 years, about 300.000 non-spam mails and about the same number of spam mails. From the non-spam mails around 77% where delivered with TLS while with spam mails this number was 42%. When only looking at the mails from this year 87% of incoming non-spam mails used TLS while only 53% of spam mails.


NFC used in place of contact based smart card two-factor authentication My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor authentication. We are looking into NFC, and we have the NFC cards (with built in contacts as well) in the standard ISO ID1 full-card size, but I'm having a hard time finding an NFC based reader that will fit our demands. Is NFC used currently for two-factor authentication? I can't find any documentation on it aside from the yubi key supporting it.

The second problem is the only NFC hardware I can find right now is USB based. The problem is these machines are going to be on site in a dangerous construction environment and so the keys will probably break off if they are a USB based solution. We had USB key authentication and the users broke off their keys in the port and damaged the motherboard of their laptops.

Basically the question boils down to this: is it possible to integrate NFC authentication from a software standpoint into our current smartcard solution easily? I assume the hardware will change eventually to integrate NFC into most devices.

Whether and how to integrate NFC into an industrial application is a shopping question, and off-topic for this site.

But the advisability of using NFC for 2nd factor authentication is interesting. NFC use in ID cards isn't quite as popular as the more broad RFID specification, on which NFC is based. But the challenges are the same: specifically, if the ID token is a simple number, then reading the card is all that needs to be done to clone the card. The proxmark3 is a popular tool among penetration testing teams which can read and then replicate most popular ID tags at a fair distance.

If the ID tag instead embeds a cryptographic key, then the tools and architecture around it has to be dramatically more complex. But such a card should be resistent to drive-by cloning.


Need some docs that say we shouldn't upper the string when saving it as a password I'm trying to find on the Internet some manual, guide or policy secure about

  applications should not convert lower string to upper string to store
  as password

I mean, don't make "testpassword123" into this "TESTPASSWORD123".

I have read a lot of recommendations, but I need some explicit documment that tells we "you should not upper the string when saving it as a password", explicit as that.

Thanks a lot by the help until now.

I also could not find any password storage policies that mention that passwords should not be upper-cased. But I also didn't find any guides which told me not to set every password to "password", not to remove all special characters, or not to shorten them to 4 characters. It's just obvious.

You should not change the password that the user supplied. This can lead to unreasonably weak passwords (without the users knowledge!), and to compatibility issues later on (the user will always type in their password the way they set it, so each login/verification mechanism needs to perform the password transformation on each login).

If you can't deal with some special characters, report this back to the user that submitted them, do not silently change the supplied password.


Best router/s for timely updates and decent security? I’ve had a few routers and they all have suffered from poor update support, often getting abandoned in the update department after only 6 months. As I am constantly reading about insecure routers, how can I pick a good one that will receive updates and be reasonable from a security standpoint? I’m reluctant to flash a device with os firmware, I’d prefer something that doesn’t take a masters in networking to figure out.

Any suggestions?

It is not so much about the router as it is about the firmware which is running on that hardware. You can buy any device which is supported by DD-WRT - just check the list.

DD-WRT also pushed a fix for the latest vulnerability known as KRACK.

http://svn.dd-wrt.com/changeset/33525

The thing is that you should go with better maintained firmware.


Ubuntu/Debian Is it okay to use a sudouser account as my primary on a workstation? This question comes to you from the the common WindowsNT advice that "I", as the computer administrator, should login with a normal unprivileged user account for day to day use. Does this concept have a place in the Linux (Specifically the Debian and Ubuntu [derivatives])?

In fact it does not matter much.

The admin / normal user separation comes from the world of mainframes, back in the previous century; it was expected that a given computer was used by several (many) users, often at the same time, and these users do not trust each other. The OS enforced separation, and becoming "administrator" allowed for bypassing that separation, and thus was the ultimate goal of any attacker. In that models, attackers are the users themselves.

In modern computer usage, especially for "workstations", there is only a single user on a given machine. Your computer is yours; thus, you are not an attacker. It is expected that you can become an administrator whenever you wish it so, and, in practice, since you have physical access to the machine, it would be hard to prevent you from doing so. Attackers, in that model, are external people who want to access your data (not root's data, but yours). The attacker wins if he gets to run his code with your privileges, because then he can plunder all your data, and/or use the machine as a relay host to attack other machines. In modern workstation usage, there is no strong security need for user/admin separation. You still want to log in as a non-root account (but still sudoer) to protect you against accidental mishaps: as a non-root, if you want to make your machine unbootable, you have to do it on purpose. Anyway, due to the longstanding firmly entrenched Tradition of mainframes, modern Linux distributions frown upon opening sessions as "root", in the same way that playing satanic hard rock might offend the Pope (although that's not guaranteed with the current incumbent).

What you do with your machine will fall somewhere between these two models, but probably closer to "modern workstation" than "mainframe". As a rule of thumb: if your machine does not run a SSH daemon (sshd), then you are in the "modern workstation" model and user/admin separations are irrelevant; you can be a sudoer as much as you want.


Why don't CDNs require authentication to access static files? Why don't companies like Facebook require authenticated HTTP/HTTPS requests to access content (like images) using CDNs?
In a way, once one "friend" can access the image URL, he/she can effectively publish that URL to the world, allowing anonymous access. This is literally "security through obscurity", as it only relies on the URL consisting of a (UUID-like) fbID being secret. I believe Facebook calls this a Capability-based security model, but wouldn't it make sense to tie URLs to particular users to have attribution, as well as employ some form of periodic URL/fbID rotation?

The reason for this is large scale applications. When you have large scale applications, checking for authorization takes unacceptable amount of resources. Thats why static resources, like pictures, videos and other content, are stored externally on static CDN servers using a random token, and then the authorized response can include this token.

This means they only need a few replicated database servers, and then they can have large amounts of CDN servers that cache each other permanently.

Distributed servers is what makes rotation difficult aswell, as then the static CDN servers need to be told to rotate that value. And that incurs unacceptable resource usage, as that needs to be done periodically. As opposed to a random value only needs to be set at upload.

Even calculating a md5 hash, generating a random value or something that seems "simple", can be a heavy lift for a distributed CDN server to do.

So the server is a simple storage of files. Basically, all authentication and generating of random values happen on the "active servers" (that run code), while the static servers only store files based on filenames, and serves files based on filenames.


Privacy issues in Peer to Peer networks In any typical P2P file sharing app, say DC++, the typical operations are search content, push content and pull content.  A peer node broadcasts/multicasts its query to fellow peers and receives replies.

My question here is, that when a peer X contacts and connects to other peers in the network, what of his private information could be exposed through the exchange of TCP/IP connections- whether it be in the packet headers or the payloads? His MAC address? His IP address? His system configurations?

Am I right in assuming that the TCP stream (for example) of the connection carries information (in ascii) which could reveal personal information which the user did not intend to reveal?

And is the information visible only to the first peer he connects to, or even after the first hop?

If the P2P software isn't explicitly designed for privacy you should assume that it does not provide any privacy.

Some of the data that you are likely to leak when using P2P software might be:

IP address
Any personal files you accidentally share
Any data you provide to the P2P software (e.g. username)
Any data wilfully provided by the P2P software (e.g. version, operating system)
Any data leakage associated with vulnerabilities in the P2P software


How can I track executed PowerShell commands within a network? I wanto to track PowerShell commands which are executed by users in the intranet. How can I do this?

I need the user's information and their executed commands. Is it possible?

Edit 1: I guess I can use;

Set-PSDebug -Trace 1

How can I build a script which I then can deploy over whole intranet. I also use an orchestrator.

Edit 2: I tried;

$created = Get-WinEvent -FilterHashtable @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 } #| Where-Object { $_.<...> }
$sortedScripts = $created | sort { $_.Properties[0].Value }
$mergedScript = -join ($sortedScripts | % { $_.Properties[2].Value })

And got this output;

DEBUG:    1+  >>>> $created = Get-WinEvent -FilterHashtable @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 }# | Where-Object { $_.<...> }

DEBUG:    2+  >>>> $sortedScripts = $created | sort { $_.Properties[0].Value }

DEBUG:    2+ $sortedScripts = $created | sort  >>>> { $_.Properties[0].Value }

DEBUG:    2+ $sortedScripts = $created | sort {  >>>> $_.Properties[0].Value }

DEBUG:    2+ $sortedScripts = $created | sort { $_.Properties[0].Value  >>>> }

DEBUG:    2+ $sortedScripts = $created | sort  >>>> { $_.Properties[0].Value }

DEBUG:    2+ $sortedScripts = $created | sort {  >>>> $_.Properties[0].Value }

DEBUG:    2+ $sortedScripts = $created | sort { $_.Properties[0].Value  >>>> }

DEBUG:    2+ $sortedScripts = $created | sort  >>>> { $_.Properties[0].Value }

DEBUG:    2+ $sortedScripts = $created | sort {  >>>> $_.Properties[0].Value }

DEBUG:    2+ $sortedScripts = $created | sort { $_.Properties[0].Value  >>>> }

DEBUG:    2+ $sortedScripts = $created | sort  >>>> { $_.Properties[0].Value }

DEBUG:    2+ $sortedScripts = $created | sort {  >>>> $_.Properties[0].Value }...

I did comment pipeline codes because I couldn't get "$_.<...>" parameter.

Edit 3: This works perfectly; Firstly I wrote Microsoft's ScriptBlock Enable Code Block

function Enable-PSScriptBlockLogging {
    [CmdletBinding()]
    param ()
    $BasePath = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"

    if (-not (Test-Path $BasePath)) {
        Write-Verbose "ScriptBlockLogging registry key doesn't exist. Creating now."
        $null = New-Item $BasePath –Force

        Write-Verbose "Setting registry key value to 1 of type DWORD."
        $null = New-ItemProperty $BasePath -Name EnableScriptBlockLogging -Value "1" -PropertyType DWORD
    } else {
        if ((Get-ItemProperty -Path $BasePath).EnableScriptBlockLogging.getType().Name -eq 'Int32') {
            Write-Verbose "Key exists, updating value to 1."
            Set-ItemProperty $BasePath -Name EnableScriptBlockLogging -Value "1"
        } else {
            Write-Verbose "Key exists of wrong data type, removing existing entry."
            Remove-ItemProperty $BasePath -Name EnableScriptBlockLogging

            Write-Verbose "Setting new registry key value to 1 of type DWORD."
            $null = New-ItemProperty $BasePath -Name EnableScriptBlockLogging -Value "1" -PropertyType DWORD
        }
    }
}

Then, when I open Event Viewer GOTCHA! Logs see perfectly. Now I need manage these logs with PowerShell.

PowerShell Script Block Logging might be useful.

I haven't tried it yet, so I don't know how you can track user information, but it surely tracks the executed commands.

Here's a link to Microsoft Docs about how to enable it: Script Tracing and Logging. And here is another with broader information about auditing and logging:  Practical PowerShell Security: Enable Auditing and Logging with DSC. Otherwise just search for Script Block Logging.


Is WhatsApp or Facebook Messenger secret conversation a reasonable method for transferring passwords? I have the Netflix account in our family, meaning I have the password.

It's a secure password, with 16 characters, including symbols, numbers and uppercase, for example 3?TeJ)6RK]4Z_a>c, which has around 80 bits of entropy.

However, I have to share this password with other members of the family, so they can also login to it. Is using WhatsApp or Facebook Messenger secret conversation an acceptable method for this?

Are there better methods?

Both Facebook Messenger (using secret conversations) and WhatsApp implement end-to-end encryption, which means that when you send a message your text is encrypted on your computer and decrypted on the destination computer. The text of your messages is not visible to anyone in between unless they break the encryption, which for practical purposes is not going to happen (unless you happen to be the subject of a national security investigation, in which case you've got bigger problems than sharing your Netflix password with the wonks at the NSA).

However, beware that end-to-end encryption only protects the communication channel itself. It does not protect you from threats such as:

Malware, such as keyloggers or screen grabbers that have been installed on your machine or the destination machine
Friends/family who decide to re-share or change your password without your permission
Netflix, who monitors these things and will see that your account is being used in multiple geographic places and thus probably being shared against their terms of service. Netflix has plans that allow multiple streams among family members, so this in itself is not an actionable issue unless your password is somehow shared widely.
Law enforcement, if you happen to live in an area that has criminalized password sharing
As pointed out by daniel in the comments, Facebook (who owns both Facebook Messenger and WhatsApp) might accidentally provide weak security or be complicit in breaking user security (e.g. in order to assist a law enforcement investigation). As proprietary applications (not open source) neither of these softwares have been vetted by outside security researchers, so Facebook might have a poor implementation or they might be copying/inspecting your data at either the source or destination device. Additionally, since these applications create and control the encryption keys used to implement the end-to-end encryption, you must assume that Facebook can break the encryption if they so desire (or anyone they would give the keys to, e.g. law enforcement).
Another excellent point from Gert van den Berg in the comments: some messaging apps will automatically back up to the cloud. The security around cloud storage is not nearly as strong as the end-to-end encryption used in the communications channel. See, for example, the Fappening attacks for more info as to how the cloud represents a threat to data privacy. (Even for supposedly deleted data!)


Where should I go from here to be a pentester? I would like some tips on what I can study to be a better penetration tester. That is what I would like to work towards being, although I have trouble knowing where to start.

I have a decent knowledge of varying security technologies, exploits webapps and operating systems. I reviewed the CBT Nuggets instruction videos and materials for the Certified Ethical Hacker course and found it to be far too basic/elementary.

At the same time I have been trying to practice on WebGoat, yet it seems to advanced for me. When it comes to the injection or ajax attacks especially I am unable to solve the problems successfully, without resorting to checking the solution.

What courses can I take or books can I read to fill this gap, where I can understand and solve something like WebGoat with ease?

Sans has a Web Penetration Testing and Ethical Hacking: Capture the Flag class you might be interested at https://www.sans.org/security-training/web-penetration-testing-ethical-hacking-capture-flag-day-6-13632-cid

There are some capture the flag sites that you might learn from using

http://hax.tor.hu/
https://pwn0.com/
http://www.smashthestack.org/
http://www.hellboundhackers.org/
http://www.overthewire.org/wargames/
http://counterhack.net/Counter_Hack/Challenges.html
http://www.hackthissite.org/

A larger list can be found at http://captf.com/practice-ctf/

I have done one of the certifications at http://www.securitytube.net/ and found it very useful. They also have videos available that will teach you different skills.

I would also recommend getting some credits at http://www.safaribooksonline.com/ and using them to cycle through some good books.

such as
Hacking the art of exploitation
Shell coders handbook
Reversing
Metasploit: The Penetration Tester's Guide


Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited? I am making a presentation to the class about "SSL 2.0 deprecated protocol" and I really have no idea how this exploit is used or how the attacker can use this vul. I understand the impact of this vul, but I need a complete explanation on how it works out and the steps that an attacker would approach to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. Please explain the process that an attacker can use in a specific explanation if possible.

SSL 2.0 is not a vulnerability; it is a protocol which happens to contain structural vulnerabilities, and, as such, should not be allowed.

There is a RFC which says just that, and lists the main known deficiencies in SSL 2.0:

SSL version 2.0 [SSL2] deficiencies include the following:

o  Message authentication uses MD5 [MD5].  Most security-aware users
   have already moved away from any use of MD5 [RFC6151].

o  Handshake messages are not protected.  This permits a man-in-the-
   middle to trick the client into picking a weaker cipher suite than
   it would normally choose.

o  Message integrity and message encryption use the same key, which
   is a problem if the client and server negotiate a weak encryption
   algorithm.

o  Sessions can be easily terminated.  A man-in-the-middle can easily
   insert a TCP FIN to close the session, and the peer is unable to
   determine whether or not it was a legitimate end of the session.

Of the four, only the last one is really a structural serious issue with the protocol. Indeed:

Though MD5 is broken with regards to collisions, it is still quite strong for other usages, including how it is used in SSL 2.0 to protect integrity.
When an attacker tricks client and server to use a weak cipher suite, the real problem is not that the attacker can trick the client and the server; it is that the client and server actually agree to use a weak cipher suite.
The point about using the same key for encryption and integrity makes sense, again, only if the client and server agree to use weak encryption. This could happen in older days because of compliance with the US export regulations, but this has all disappeared since year 2000.
The lack of verified termination is a problem when the SSL is used to convey a protocol where messages are not self-terminated. A typical case is HTTP 0.9: the client knows that it has obtained the complete file because the server closes the connection. With SSL 2.0, an active attacker can force an early connection close and the client has no way to know whether this is the genuine end-of-file, or a malicious truncate.

One may argue that with modern HTTP, this issue no longer applies.

So, in fact, if a client and server use SSL 2.0 right now (May 2014), then chances are that this is not an actual problem (or, at least, not the biggest security problem). The real reason why SSL 2.0 is banned is that it has been deprecated for a long time (since 1996 and the invention of SSL 3.0), so any use of SSL 2.0 indicates that some of the involved software has not been updated for at least that long -- and that is a problem. SSL 2.0 is a glorified canary.

Or, said otherwise, using or even allowing SSL 2.0 reveals you as a sloppy, outdated, untrendy sysadmin.


Academic papers on GPU password cracking? Are there any scientific papers or publications on GPU password cracking?

I'm sure a lot of article can be found on the web giving a clear explanation on how to setup a GPU password cracking system, but if you are looking for an academic paper, you can take a look at those reports :

http://staff.science.uva.nl/~delaat/rp/2010-2011/p11/report.pdf
http://www.inf.ed.ac.uk/publications/thesis/online/IM100812.pdf
http://mnsu.academia.edu/KhaiTran/Papers/1559507/GPU_-_accelerated_WPA_PSK_cracking_solutions

I think this blog post (not an academic paper, I admit), is quite complex and very interesting to read : http://mytechencounters.wordpress.com/2011/04/03/gpu-password-cracking-crack-a-windows-password-using-a-graphic-card/

You can also give a look at the Google Scholar page that will list some result regarding your research.


SSL vs TLS, which is less vulnerable to DOS attacks? When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks.

However, all I seem to find on the topic is stuff about TLS Renegotiation DoS attacks.

Are either of these technologies more robust, specificially wth regards to DoS attacks?

Thank you.

TLS is the "standard" name of SSL. SSL is, initially, a protocol developed by people at Netscape (the vendor of the then-leading Web browser, back in 1995). When SSL was made an open standard, specified as RFC 2246, a new name was given to it, partly to avoid legal issues, partly to convey the message that SSL can be applied to any bidirectional stream of bytes, not just TCP sockets; the new name is TLS. Internally, when the client and the server talk to each other and tell them which protocol version they use, they announce SSL 3.0 as "3.0" and TLS 1.0 as "3.1". For all practical purposes, SSL and TLS are two names for the same protocol, which can have several versions; I often write "SSL/TLS" to designate them.

For all security characteristics, TLS 1.0 can be considered equivalent to SSL 3.0; differences are minimal and more relate to alignment on existing standards than functional changes (e.g. the MAC algorithm in SSL 3.0 is a "sort of" HMAC, while the MAC algorithm in TLS 1.0 is HMAC, exact down to the last bit). Ulterior versions of TLS bring some improvements for security.

However, none of the SSL/TLS versions is better or worse than the others with regards to DoS attacks. The main vulnerability of SSL/TLS, in that respect, is that the initial handshake entails some relatively expensive computations on the server side, and a fake client can force the server to spend a lot of CPU power on making handshake without needing to invest much effort in the process (the client just has to send some random junk of approximately the right size as the ClientKeyExchange message, and the server will spend some time trying to decrypt it). A good PC will handle a few hundreds or at most one or two thousands of SSL handshakes per seconds, so DoSing an unprotected SSL server is not very hard. Mitigation measures are along the lines of refusing too many TCP connection attempts per second from a given IP address.


Security risks of user generated HTML? I am creating a website that allows people to upload HTML content.

Currently these are the tags that are banned:

<script></script>
<iframe>
<object>
<embed>
<style></style>
All on= attributes, i'm not gonna list them all there are like 70 of them

I don't want the user using any JavaScript or placing any code that will effect other tags on the page, so no style tags either.

Are there any other tags that I need to be mindful of when enabling users to generate HTML without impacting other things on the page?

User-defined HTML
You're attempting to sanitize user input by blacklisting things you don't want to allow.  Unfortunately, especially given the very large list of options for HTML5, it's quite easy to miss something.  Missing something will result in a potentially dangerous XSS vulnerability, which you really don't want.  To pick some random examples off the top of my head:

Do you know that SVG tags can execute scripts in some (limited) circumstances?
In your list of on event attributes you banned, did you make sure and get the onbounce event attribute of the obsolete (but still available) marquee tag?
Are you going to make sure and keep track of any changes to the HTML spec that might roll out over the next X years, just in case one might add a dangerous tag/event?

There can be so many gotchas that securing input with a blacklist is nearly impossible.  Moreover, you're approaching the problem from the wrong perspective.  In security the approach you want to start with is the Principle of Least Privilege.  Rather than asking, "what should I stop my users from doing", it's much safer to ask, "What should I allow them to do?".  Therefore you need a two step process:
1. Robust Parser.  You need a very robust parser.  This is surprisingly difficult because browsers are so very forgiving when it comes to parsing HTML.  If an attacker gives you bad HTML and your parser stops trying and says, "There's no HTML here - you're safe!", but the browser takes the same input, takes some guesses at what the HTML was supposed to be, and ends up with something malicious, you have an XSS vulnerability.  This is even more difficult that it sounds because different browsers can apply different "corrections" when processing HTML input, making the already difficult task of parsing HTML reliably even more difficult.
As an example of browsers playing fast an loose with HTML, you can save this HTML to a file and load it in your browser:

<img src="1" <table onerror="alert(1)"

hi

If you load it up with Chrome and inspect element on the page, you'll see that the browser actually rendered this (probably depends on your version though):
<img src="1" <table="" onerror="alert(1)"
hi

That's an image tag with an active XSS payload (which is mildly obfuscated by the fact that a table tag and the p turned into meaningless attributes), a literal string hi, an empty p tag, and an empty table tag.  The end result is quite different than the input.  I haven't tried very hard to hide the payload, but would your parser have understood it the same way?  Perhaps your parser would have tried to ignore the img tag inside of the table tag since anything not in a td tag would technically be illegal.  Maybe your parser would have been confused by the <table inside the img tag and ignored the onerror since a table tag doesn't technically have events.  As it turns out though, none of that stopped the browser from executing my javascript payload.  Would your parser have caught it?
2. Whitelist allowed tags and attributes Once you've parsed the user's HTML, you don't want to compare with a blacklist and remove disallowed tags/attributes.  Instead you want to compare to a whitelist and remove anything that you haven't specifically vetted and approved as safe.  This puts your security on much stronger footing and - let's be honest - do you really want your users to use the marquee tag anyway?
Most importantly though, building a robust HTML parser is surprisingly difficult.  If you try to do it yourself you'll spend a lot of time and probably get a lot wrong.  Under normal circumstances, you'll be much better off just finding a well supported third party library to use.
Alternate Suggestion
A different tactic I would normally recommend would be to not let user's use HTML at all.  Rather, allow a more limited language (like the markdown used for writing questions and answers in stack overflow).  The more limited language specification makes writing a parser much easier and less error-prone, and the process of converting markdown to HTML makes it easier to guarantee "safeness" (note: easier, not guaranteed - markdown to HTML converters still suffer from occasional XSS vulnerabilities).  There is a slight disadvantage that it limits the sort of formatting options users have (although I don't really consider that a disadvantage under most circumstances), but you also have a nice advantage that markdown parsers and HTML-converters are available in a wide variety of languages.  A more limited option like this is typically a good trade off between usability and security.  You can even add in a WYSIWYG editor that builds the markdown for users.


Copy SSH Public Key from Windows to Ubuntu I am trying to get my ssh public key from my windows client to ubuntu host, but I have no idea how to. I tried to find the authorized_keys file, but had zero success. ssh-copy-id command did not work from windows. I generated the public/private key pair in PuTTYgen. I am using OpenSSH on the Ubuntu host. Any ideas on what to do?

Any ideas on what to do?

1. EDIT Download cmder or use your favorite console emulator. Move your public key (id_rsa.pub) and your private key (id_rsa) to C:\Users\yourUserName\.ssh\ create the .ssh folder if needed.

2. On your windows host via cmder:

cp C:\Users\yourUserName\.ssh\id_rsa.pub C:\Users\yourUserName\authorized_keys

3. On your ubuntu host:

service ssh status Start sshd if necessary

mkdir ~/.ssh/ (if it doesn't already exist)

4. On your Windows host via cmder:

cd C:\Users\yourUserName\

scp authorized_keys login-id@ubuntu-Host-Ip:~/.ssh

5. On your Ubuntu host:

chmod 700 ~/.ssh

chmod 600 ~/.ssh/authorized_keys

6. On your Windows host via cmder:

Test if you can ssh into your ubuntu host without login/pw auth. If yes:

rm C:\Users\yourUserName\authorized_keys

(you might encounter difficulties running your ssh-agent on windows, write a comment if so)


In Microservice Architecture, how to secure inter service to service In Microservice architecture, public clients & confidential clients are there
as per API Gateway Pattern, Public clients connecting from Browser to backend reaches it via API Gateway

API Gateway does Authentication / Authorization and reaches backend point

Depending on the client [ OAUTH2 Grants type are used].

Question is, If there are multiple microservice  A, B, C

A is microservice - invovked from a Browser app [ Angular or SPA] , A has to invoke B for some purpose
B microservice is not exposed directly to outside world , it is a internal

A Reaches B via HTTP as a service

Apart from Mutual TLS, what is security to be adopted
Do all microservice [ internal] to be registed in API Gateway and Microservie A has to reach B only via API Gateway,
If Not, What kind of authentication and authorization to be used as practise
Most of the places [ AUthentication & Authorization are coming out of box with API Gateway backed with Key Managers]
If we by pass API Gateway, Should Authentication and authorization has to be implemented custom way?

The rule is that a request coming from B to A should provide the same authorization context  as if it came from the API Gateway. The details depend on the implementation.

If all the authentication and authorization is handled at the gateway, and only authorized requests can reach the back end services, B has nothing special to provide: A will answer without wondering about authorization

If the gateway only handles authentication and passes roles to the backend microservices  that are used to control the permissions parts, then B has to provide the roles it received in the request it submits to A

... you mileage may vary...


How can ransomware know file types? When ransomware searches the victim's files in scanning step, how can ransomware know the types of files?

It can check the file name (e.g. book.pdf) or file signatures.

What I'm wondering is when I change the extension in my file's name (say, book.pdf --> book.customEX), I think that ransomware should not be able to find my files, so encrypting files also cannot be done.

Can I have some opinions or advice?

First off, not all ransomware are created equal: just like any software, some ransomware is well-written, while some are poorly-written. You can get an overview of major ransomware variants on wikipedia/ransomware. Some ransomware - notably CryptoLocker - do use lists of file extensions to decide which files to encrypt, and why not? Users knowledgeable enough to change their file extensions probably have backups and won't pay you anyway. As @usr points out, you can still get a lot of people with simple approaches. That said, some ransomware, like CryptoWall, is very sophisticated, and while I don't know how it works, I can speculate on what's possible.

As you say, files often contain a "file signature" - a short hex code near the start of the file that indicates what type of file it is. Here are two lists of these "magic numbers" from Wikipedia: [1], [2].

The Windows OS itself relies quite heavily on file extensions in the file name and is notoriously brittle if you change it, but that doesn't mean all software needs to be so terrible.

For example, there's a standard Unix utility called file that will look at the magic number and tell you what type of file it is, there's no reason ransomware can't do the same.


Most secure password hash algorithm(s)? What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP)

Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of iterations). What I'm interested in is the mathematical strength.

My intuition tells me it's whirlpool, being the largest and slowest of the bunch. That or SHA-512. But where on the 'net can I see what the experts recommend?

Crypographers could point out that, when you read the fine print, there is no proof that secure hash functions actually exist at all. The only thing we have now are candidates for which no weakness has been found yet.

So the best you can hope for is a function which has survived scrutiny by many cryptographers for a long time. Also, you need it to have a wide enough output (256 bits are enough if you wish to achieve "128-bit security" and getting beyond that has little sense). Right now, as of summer 2011, this points to SHA-256 or SHA-512, not Whirlpool.

Basing the iteration count on the time it takes on a typical machine is a good idea -- but basing it on the time it really takes on your machine is not a good idea. Otherwise, you could end up with low iteration counts for some passwords because the machine was handling many requests at that instant (a situation which an attacker could force, by the way). Using many iterations is meant to thwart attackers by making password hashing slow on the attacker's computer -- that it also makes it slow on your system is an unfortunate byproduct; but the true target is whatever machine power the attacker could muster. Since you cannot really make benchmarks on the attacker's machine, you have to resort to rough estimates, hence a fixed count, as high as possible as long as the average burden is tolerable on your system (the important word here being "average", which disqualifies a dynamic measure as you intend to perform).

Also, the attacker's machine needs not look like yours; it may be, e.g., a GPU or a FPGA, which offers distinct computing abilities from what you can get on a typical server. You want a function for which an attacker will not be able to get huge performance boosts by using non-PC hardware. There again, this promotes SHA-256 or SHA-512, which are meant for CPU efficiency (with 32-bit or 64-bit arithmetic operations), not Whirlpool, which can benefit from hardware optimizations similar to those AES was designed for.

Finally, iterations are just part of the job; you also need a long enough, unique enough salt. Iterations and salting can be a bit tricky to do at the same time; you are warmly encouraged to use a standard construction such as PBKDF2 (although it was meant as a key derivation function, not a password hasher, PBKDF2 turns out to be reasonably good at that too).


Detect message tampering without shared key and without certificate authority Is it possible to detect if a message has been tampered with, without using MAC (i.e. shared key) and without using a "trusted" third party (i.e. certificate authority)?

I'm pretty sure it's not, but I would just like to be sure.

Note: I don't care if the message is read by anyone else, I just don't want them to be able to modify it along the path of transmission.

No The recipient must know something about the sender to detect tampering. Otherwise, there is nothing to distinguish the legitimate sender from someone who is tampering.

There are a few choices for what the recipient knows:

Shared secret key - to produce a MAC
Sender's public key - to verify a signature
Trusted third party's public key - to verify a certificate, and then a signature


Permanently erasing a file As far as I know, there is a table of files present in the hard drive that does not contain the data of each file but can point you to it.

When you delete a file, the record of it gets deleted from the file table, but the data remains on the computer.

So the question is: If you overwrite a file's data with, let's say, just using WriteFile Win API to overwrite all data with zeros, will that become unrecoverable?

Yes, most likely. However there can always be edge cases:

SSDs are doing wear leveling etc., and will most probably not write your zeroes to the same cells your original data was written to. How the attacker will find and access that data is another matter altogether of course.
On a traditional spinning HDD, the original data may exist on other sectors because the disk got defragmented. Or the OS may decide to relocate your file on write, to consolidate the file. At least OS/2 used to do that, I am not sure if current windows version still do that.
NTFS stores small files directly in the directory structure btree, that may lead to your data getting copied around the disk.
the OS may have created a system snapshot, etc.


Why IE/Windows forces you to install self-signed certificates as root CA to make them work? In old versions of IE/Windows you could install a self-signed certificate for a web site and it just worked: the warnings disappeared.

In more recent versions (and with Chrome) this just didn't work. The only way to make it work is to install the self-signed certificate as a Root Certificate Authority.
I need to install it because Chrome disables caching of non-trusted SSL sites, which makes this site too slow (i could switch to another browser though).

Isn't this an unnecessary security risk? If the certificate key gets compromised it will not only affect the site but everything else.
Why isn't there an option for trusted sites alone?

In X.509, a certificate can be validated if it can be put at the end of a valid chain, where each certificate in the chain has issued the next one, and the chain starts with a trust anchor. The trust anchor is the certificate that you trust "ex nihilo", i.e. not by virtue of the certificate being signed by another, trusted certificate; the trust anchor is trusted by configuration. This configuration is, indeed, putting the certificate in the "root CA" certificate store.

When you put a certificate in the "root CA" store, this does not automatically means that your machine will begin to use this certificate as a CA, i.e. to validate other certificates. This merely means that the certificate is "trusted". Whether this certificate will also be accepted in the role of a CA depends on what is written in it (the Basic Constraints extension).(*)

To initiate trust, you must do "something". A Web browser must not trust transparently any self-signed certificate that it encounters; it would be a gross vulnerability. The user must make an explicit action to allow the self-signed certificate to be trusted for SSL; and, preferably, this action must not be a too easy one-click thing, because otherwise users will do it without even noticing it. Clicking through warning popups, however scary they can be, is a well-entrenched behaviour in human users; and, unfortunately, accepting a self-signed certificate without due manual verification leads to Man-in-the-Middle attacks.

In Windows/IE, the "something" needed to prime the trust system is installation of the self-signed server certificate in the "root CA" store. This requires some not-easy GUI invocations, and that's by design. It MUST NOT be easy.

For other browsers, things may vary, though the core concept is the same. For Firefox, installation of a self-signed SSL certificate is described as a "security exception"; Firefox has its own X.509 subsystem, completely disjoint from the one of the underlying OS. For Chrome, this depends a lot on the OS, the OS version and the browser version.

(*) There are subtleties. Old X.509 certificates, aka "v1", more than 15 years ago, did not support extensions at all, so there was no way to mark a certificate as "good for CA" or "not good for CA". This means that a v1 self-signed certificate, installed in the "root CA" store, will act as a CA, thus be accepted in the role of a CA, for validating other certificates. You should take care, when installing a self-signed certificate, that you do not open that door. Unfortunately, this depends on rather technical details of the certificate, so it is not easy to test for end-users.


Would cookie always change when browser changes? I have been told that when the browser changes, the cookie will also change.  If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it's more likely that the cookie got stolen and the attacker simply pretend to use the same cookie, same IP?

Browser cookies contain only what the server sends to your browser.

If the server can tell that you're the same user using multiple browsers, then the server can send the same cookies to each of your browsers.

I suspect that you're asking about session cookies.  Most well configured servers will send a completely unique session ID each time a new session is started, and browsers will delete session cookies when they are closed.

There is no technical requirement that a server send a unique session ID in its cookies; nothing except decent security, reasonable session handling defaults on the web-platform's part, and common sense enforces this behavior on the server.


Why should XSS filters escape forward slash? In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following:

& --> &amp;
< --> &lt;
> --> &gt;
" --> &quot;
' --> &#x27;  &apos; not recommended because its not in the HTML spec (See: section 24.4.1) &apos; is in the XML and XHTML specs.
/ --> &#x2F;  forward slash is included as it helps end an HTML entity

What is the purpose of including / in there? Indeed, / is part of the ending entity, but since we're already escaping < and AFAIK no known browser would accept / without preceding < as entity end, what is the reason to escape it?

Back before HTML 5 came with a standard parsing algorithm, HTML 4 was defined based on SGML.
And its SGML-based syntax had features that differed in terms of browser support and differed in terms of people being aware of them.

One of the more obscure features that you'll be interested in, for the purposes of this question, is Null End Tag (NET).
Have a look at the following code for an HTML page:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
  "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title/hello/
<body>
<p/hello/

If you want, try putting it through an HTML validator.
NET specifies that code like <TAGNAME/text/ is parsed into the same thing you'd get from <TAGNAME>text</TAGNAME>.

From here, you may be able to see why it's a good idea to escape the / character when interpolating user-provided data into markup. A / could potentially end up in one of these NET constructions and be interpreted as the end tag, instead of a literal solidus.

Sure no browser now understands the NET syntax, but it's part of the spec, so it's prudent to account for it.


What happens when a server needs to change the cipher during an established TLS session I have read the following excellent post How does SSL/TLS work? but unfortunately it does not clear up one question I have.

If during an established TLS session the server becomes busy and needs to renegotiate the cipher being used what exactly happens, assuming secure renegotiation is in place.

Does the server initiate a new full handshake, does it simply use session resumption?

Session Resumption will re-use the previously negotiated cipher spec, so if you need to renegotiate a different cipher, you will need a new handshake.  To quote RFC 5246 section 7 (emphasis mine):

  The Handshake Protocol is responsible for negotiating a session, which
  consists of the following items:

  ...(session identifier, peer certificate, compression method)...

  cipher spec: Specifies the pseudorandom function (PRF) used to generate keying
  material, the bulk data encryption algorithm (such as null, AES, etc.)
  and the MAC algorithm (such as HMAC-SHA1).  It also defines
  cryptographic attributes such as the mac_length.  (See Appendix A.6
  for formal definition.)

  ...(master secret, is resumable)...

  These items are then used to create security parameters for use by the
  record layer when protecting application data.  Many connections can
  be instantiated using the same session through the resumption feature
  of the TLS Handshake Protocol.


import list of domains into recon-ng Is there a way to add domains into recon-ng from a text file (newline delimited)? I've tried comma delimiting entries but reco-ng takes the comma as part of the domain.
At the moment I am doing:

for line in $(cat domains.txt); do printf "add domains\n%s\n" $line; done

in a shell then pasting the resultant output into recon-ng.
It's a little kludgy but doesn't take too long and it works.
Is there an official way to do this? Thanks.

recon-ng already supports import of external data (by newlines) with the SOURCE variable. SOURCE should be available via most plugins, including the domain ones you are interested in.

Check the wiki -- https://bitbucket.org/LaNMaSteR53/recon-ng/wiki/Usage%20Guide -- which includes information on using the SOURCE variables for data from the local filesystem.

There are also the import/csv_file and import/list modules in recon-ng which will push your data into the recon-ng database.

The method for creating a workspace and using add domains to add domains to that workspace's database can be seen in this blog post -- https://www.stevencampbell.info/2016/10/passive-information-gathering/ -- after which you can see the domains along with IP-address data by way of show hosts. This appears to be the way that you are adding domains, which is one way of doing this.

Once a domain plugin is run, or if a workspace is created and domains are added -- as long as you see your domain via show hosts, then the recon-ng database (usually best performed per workspace) can be modified just like any sqlite3 database. For more information on where recon-ng places these sqlite3 databases on your local filesystem as well as other tips and tricks, see this blog post --https://www.codemetrix.net/practical-osint-recon-ng/


How do I secure my REST api that is being accessed by only one application? Suppose we have 2 webapps, appA and appB.
They communicate via REST. Say for example, when appA updates let's say, a file, it should inform appB via REST and so on.

I was thinking, how do I make this secure? I mean, what if an ordinary user got the api url and started sending requests? I was looking around the internet and I found out I could secure this through tokens, but how do tokens make it secure? I mean, what if the user got hold of the token and the api url? Wouldn't that be game over?

You must use SSL. If you don't - no matter what other security scheme you select - it will be prone to sniffing and hence the bypass of your security mechanism.
For example an attacker by utilizing DNS poisoning will make your AppA think it is talking to AppB and send the token to the attacker... from there your whole security mechanism is broken.

SSL will provide you with both authentication of your application to the API and confidentiality + tamper resistance of your data between the app and the API

In SSL you can configure two way authentication, which means that beyond AppA being sure it is talking to AppB, also AppB can be sure it is talking to AppA. This is done by configuring SSL to request also client certificate in the SSL handshake.
That is your best option. I would not risk trying any self made security protocol instead.


Disk Encryption vs File Encryption for Embedded Linux? The Security page for Android discusses file-based vs full-disk encryption. It discusses some rationale about why FBE in Android 7.0 is an enhancement over FDE when it come to a smartphone.

But, if the encryption subject is considered for Embedded Linux devices which approach works better for

live streaming security camera (like nest-cam)
Adventure camera (e.g., GoPro Camera)
Amazon Echo

Do all these devices use:

same kind of encryption, or rather
the FDE/FBE choice differs based on class of device.

Choice of encryption model is going to depend on the device's threat model and available resources.  Both Full Disk Encryption and File-based encryption are designed to protect data at rest.  Full disk encryption is going to offer you more protection in the event of a stolen HDD, provided the device is powered off.  FDE, however, will not protect you in the event the device is powered on.  File-based encryption will offer more protection against attacks when the device is powered on, as it allows you to unlock different files using different keys independently.

Regarding the specific devices you mentioned, the choice is all going to depend on the threat model that the developer used.


Derive a shared secret between different curves Is it possible to derive a shared secret between different curves?
An explanation would be nice.
How can I decide which curve I should use in my software?
Highest amount of bits has in my case the brainpoolP320r1 curve, but on this site https://safecurves.cr.yp.to/ the brainpool curves are rated as not safe.
The German Federal Office for Information Security recommend amongst others the brainpoolP320r1.

These curves can I use with my HSM (hardware security module):

secp192r1 (aka prime192v1)
secp256r1 (aka prime256v1)
brainpoolP192r1
brainpoolP224r1
brainpoolP256r1
brainpoolP320r1
secp192k1
secp256k1 (the Bitcoin curve)

For two parties using ECC, both must use the same curve. The reason for this is that ECC algorithms use an operation (EC addition) which is defined over a set (points on the given curve). Adding 2 points on a curve gives you another point on the same curve. For ElGamal encryption, for example, Alice adds and scalar-multiplies (which is the same thing as repeatedly adding) her plaintext (represented by points on her curve) with Bob's public key (points on his curve) to get a new EC points, which is the ciphertext. If Alice and bob are not using the curves, then these operations are not defined (i.e. points from different curves are like apples and oranges). Applying the EC addition algorithm to 2 points from different curves may be technically possible, but will give you meaningless results. This is true of all ECC primitives (encryption, key-exchange, authentication, etc.)

As for the "safety" of a curve, these is some subjectivity. If there is a theoretical attack that could lead to a $100 000 000 computer breaking your cipher in 250 years, do you consider this "safe"? Some organizations will say "yes", others "no". To independently asses the security of a curve, you would need at the minimum a  PhD in Group Theory, so I would just defer to a credible standard. If you're limited to pre-packaged curves, I would have no problem using such a curve that is approved by the Federal Office on for Information Security, where teams of said PhD-holding experts work on these problems.


Detecting web app attacks by parsing log files Following up on this question as the answers are now 5 years old:
  Can I detect web app attacks by viewing my Apache log file?

My boss has tasked me with analyzing our access.log and error.log files after an attempted mySQL injection attack last week.  It's pretty obvious when viewing the logs by hand, but we'd like something automated (either a service or a task that can be run regularly through cron) that will detect attack patterns.

We're using nginx, but that shouldn't matter because the logs are in standard format.  Any suggestions on programs that do this type of log analysis?  I don't care about standard traffic analysis that programs such as Webalyzer do.

Further, for those of you who do this type of attack detection and analysis, what patterns are you looking for in your log files other than just a larger than normal amount of traffic?

Also, do you look at both the access.log and error.log or just one?

It depends if you're going to get a budget or not to do this. Welcome to the world of IDS/IPS and SIEMs.

My favorite tool that I used as an intern, and still use is OSSEC HIDS (Open Source Security Host-Based Intrusion Detection System).

It's a really sweet open source tool if you only need a small cluster of hosts monitored and don't have the funds to hire an entire SOC team or the budget for a giant, fully-supported SIEM like FireEye or ArchSight. You can pretty write your own rules (in XML) and it allows you to generate alerts based on those rules. You also set the directory paths you want monitored (i.e., var/adm/log or /var/syslog etc).

For a UI, you can use OSSEC's Web UI and host it on a server with apache. Also, you will need to know what you are looking for in order to write the rules, but there are tricks around this. You can set rules to look for the word "failed" that occurs more than 3 times in 60 seconds to generate an alert (just one example).

Hope that helps.


Is it secure to use a single pair of RSA keys to achieve mutual authentication? I saw this design recently in an infotainment product. The goal is mutual authentication between two ECUs, E1 and E2. They only care about each other. The basic idea is to keep both keys secret and let each ECU have one. Let's call the keys k1 and k2, instead of public key and secret key, or E and D. Both keys are large.

Suppose E1 has k1, and E2 has k2. To perform mutual authentication in a cost efficient way:

E1 generates random data D of a fix length, and encrypts hash(D) with k1, resulting in S1. D and S1 are sent to E2.
E2 decrypts S1 with k2, and check if it matches hash(D).
If OK, E2 calculates the binary complement of D, denoted D'. Then it encrypts hash(D') with k2, resulting in S2. S2 is sent to E1.
E1 calculate D', decrypts S2 with k1, and check if it matches hash(D').

I have a hunch this design is risky, but fail to find the weakness. Is it secure enough in the real world?

Edit: I see there is replay attack again E2, but the "master" node, E1, can never be fooled, right? I guess the use of D' may leak some chance of MITM attack, but it's complicated to find any.

Don't make your own crypto.

I see a MITM potential there, since an attacker could copy the mutual authentication tokens and change the rest of the communication, but there's probably some hidden risks behind the RSA primitives you are using and the data you are transmitting.

Why not use at least a couple of keys, anyway?


Is TextKey SMS 2 factor authentication secure against cell phone cloning? I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods.

In typical SMS authentication, the provider sends you an access code that you use to log on to the site. The TextKey system works the other way around - when you log on to a site, it displays a special code that you type into an SMS message and send it to the provider to complete authentication.

The TextKey website claims that this is more secure and immune to phone cloning  because the phone sends a UDID that is hardcoded into the phone along with the SMS message, and unless your phone has the correct UDID, the cellular provider will not accept the message. This makes cloning much harder because the attacker would have to change this hardcoded ID which is burned into the phone and immutable. )

Is this true? I've moved a SIM card among multiple phones and have had no problem sending and receiving SMS messages from the phone number associated with that SIM, despite never having registered a UDID (IMEI, whatever) with the carrier. Does a short-code provider get to see the phone's unique IMEI or MEID?

It seems that this system faces the same risk of interception due to cloning as any other SMS based authentication method -- if someone is able to clone a phone's SIM, then they can send and receive text messages as that user, bypassing the SMS portion of the authentication.

I am the CEO of TextPower and wanted to address your question directly.  Thanks for taking the time to put together a thoughtful query.

I think that you have to step back and look at the bigger picture here. TextPower's 2FA product TextKey works on the basis that you have to have physical possession of the phone, including the SIM card in it to authenticate properly. If you physically possess more than one phone, you can use any one of them, but only the one that is registered with TextPower can be used to authenticate using the TextKey 2FA. If you have a phone with a replaceable SIM card (standard GSM phones such as those found on AT&T or T-Mobile) you can move that SIM card around to multiple devices that have replaceable SIM cards. That is because you are in physical possession of the SIM card that carries the UDID that the phone uses to communicate with the network. Note that the phone number DOES NOT appear in the SIM card. Only the UDID identifies the physical phone. The UDID is a really long unique number and is what the carrier sees when a call or SMS goes through their system - they don't "see" the phone number.

So, could you clone a SIM from a phone and then use it? In theory, yes but in practice that is extremely difficult to do and highly impractical (and improbable) from a hacking standpoint.  Why?  Because to clone a SIM you would have to steal someone's phone, remove the SIM card and then have access to a burner that could make a SIM card.  You'd have to have a supply of blank SIM cards.  By the time you got that done, the owner would probably report the phone as stolen and their carrier would invalidate the UDID rendering your stolen SIM card as useless except for providing a marvelous way for the police to track and arrest you. (The number of criminals arrested in this manner is now relatively large.) The owner of the stolen phone/SIM Card could also stop you by simply un-registering their phone with TextPower.

Furthermore you might think that you could steal someone's SIM card, clone it and then replace it in the original device without the owner's knowledge.  Unfortunately what happens in that case is that besides all the problems listed in the above paragraph, you will have created a couple of other problems. (Of course you first have to manage to steal the device, clone the SIM card AND replace it without the owner's knowledge - no easy task - but we'll let that go for now.)  The additional problem which you've created in this situation is that if the original device that you managed to steal and return was powered up when you powered up your device with the stolen/cloned SIM card, it would fail network registration because of the duplicate UDID (yes, carriers watch this stuff - very closely).  If your stolen device was powered up first then the real owner of the SIM card could not register their device. They would likely report this quickly to their carrier who would discover the duplicate UDID and then invalidate it.

Is TextKey absolutely un-hackable?  We certainly wouldn't say that.  Like any authentication scheme, there are theoretical ways to break it. In practice however, the ways to break it are way out of the range of anyone with less than huge resources and the
willingness to use significant thievery and take considerable risk.  That's why, while we don't promote TextKey as being "un-hackable" we do think that it is more secure than other 2FA methods, particularly those that use a mobile-terminated SMS where a code is sent to the phone, thus opening the authentication process to a MITM/MITB browser attack on the website in question.

I hope that this answers your question clearly.  I am happy to address any more detailed questions or concerns you may have and do sincerely appreciate your interest.


Why doesn't the number of bytes required by GnuPG generating the key decrease? I ran a gpg --gen-key on a remote machine connected with SSH and left it to do its job. It finished successfully, however during the execution time it asked to perform random actions to collect more entropy.

First message claimed GnuPG required 162 bytes, then: 212, 243, and 250.
On the second run: 178, 202, 249, 245.
On the third: 224, 193, 247, 246.

Why doesn't this number decrease steadily (and instead increases in some cases)?

Side question: why does it always seem to finish after 4th warning?

$ gpg --gen-key
gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.

(...)

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 162 more bytes)
.....+++++

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 212 more bytes)
............+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 243 more bytes)
......+++++

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 250 more bytes)
..+++++
gpg: ~/.gnupg/trustdb.gpg: trustdb created
gpg: key 8458470F marked as ultimately trusted
public and secret key created and signed.

The reason for this is indeed not obvious from the GnuPG user interface.

RSA key generation requires to random prime numbers. GnuPG generates a primary key and an encryption subkey by default. Both of them are usually RSA keys, so they require two primes each, totaling four. This is also visible in the following message being printed twice, once for each RSA key:

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

After this, the two random numbers (which act as starting points for searching primes) are retrieved:

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 243 more bytes)
......+++++

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 250 more bytes)
..+++++

The number of bytes can differ each time you generate keys because there might be additional entropy generated after enough random bytes have been available.


Verify that input is a string - is it safe? I was trying to find out how to prevent MongoDB injections, and I came across this. So, the vulnerable code here is

app.post('/', function (req, res) {
        db.users.find({username: req.body.username, password: req.body.password}, function (err, users) { // This line!
            // TODO: handle the rest
        });
});

Could I protect against a MongoDB injection by verifying that the POST body username and password are both strings, and not objects?

Are there any other ways to inject data into a MongoDB database?

Yes, verifying the input is a string will sanitize it.

MongoDB doesn't parse strings, only JSON. A common attack on MongoDB is:

{"$gte":""}

When put in a query, this will return all objects. An attacker can pass this as a parameter, and some parsers will automatically expand it into an object, which will make your JSON look like this

{
    username: "root",
    password: { $gte: ""}
}

When this find command is run, it'll return the root user even though a password wasn't supplied.
(Note: Do not verify passwords like this)

Now here's an example where we ensure that the input is a string

{
    username: "root",
    password: "{\"$gte\":\"\"}"
}

As you can see, there's no injection, and we're literally looking for that password.


Is using a server as bridge secure enough to protect the end data? It comes to my mind a security problem that I would have accessing some data. My current problem is the following:

There is a server in AWS London where you can access some data,
by law, that data should be accessible only by Europe.
I want to access that data being in Brazil physically but operationally
talking in Europe.
I want to avoid at all cost data that could be stolen or seen by a third party.

My question is this:
Is it secure that I could for example create an AWS server in Frankfurt let's say, connect it from Brazil via ssh and from there connect to London's server. Legally will be Europe, technically is possible, my question is, how secure could this be? or for example create a GCP instance and access it to the web console/shell to ssh my server and from it connect to the one in Frankfurt?
I'm very unsure what could be like a "really" secure option given these circumstances. Is there a really secure way to do it? even if I connect to a computer in Frankfurt via a remote desktop or ssh tunnel and later connect to the server I will have the same problem?
Ideas?

As long as the AWS London server, not sure how the server location is enforced, supports a secure (HTTPS) connection, any kind of bridge that doesn't break the connection should be fine.
You can accomplish the same thing simply by using a commercial VPN and selecting a Europe based access point.
Legally mandated location access restrictions are doomed to failure.


Is there any benefit in having CNNIC certificates installed, if you're not in China? All modern browsers/OS come with root certificates from the China Internet Network Information Center. AFAIK these certificates are required for computers sitting behind the Great Firewall to function properly.

Personally I don't live in China and I don't go to Chinese sites since I simply don't speak the language. Thus I don't see any benefit of having these certificates installed. The drawbacks are quite clear however, since China is known to have issued fraudulent Google certificates (1, 2). Is there any reason for me to keep CNNIC certificates on my computer? Could I experience problems with legitimate sites if I remove those?

If you don't use Chinese websites and internet-based products, you won't need to worry about removing them; you are unlikely to experience problems with legitimate websites by removing these dodgy certificates.

I used to live in China, and I never used any of CNNIC's certs outside of a virtual environment.

Legitimate browsers - Firefox and Chrome for example - are excluding these certificates as a result of fraud. Get rid of them.


Meterpreter Session over OpenVPN Last month I made a pentesting course and now they opened a lab for us to practice before we apply for the certification exam. We connect to the lab over OpenVPN in our Kali Linux machine.

I'm trying to attack a Windows XP machine in the lab with EternalBlue (ms17_010) using a reverse_tcp payload but it doesn't work. I also tried to attack a Windows 2003 and I can't get session.

I'm using as LHOST my tun0 interface and my LPORT is 4444, I have verified many times and all the remote hosts info it's ok.

Is there anything different that we need to do or configure when trying to get a session when using OpenVPN?

This isn't the type of thing that is easy to remotely troubleshoot, you should speak to your training provider for technical support.

Besides other users on the network, is there a reason why you cannot use a bind shell. While there are good reasons to choose reverse over a bind shell for production infrastructure a  bind shell mitigates a lot of potential networking problems


How can I select a compression utility that is popular and secure enough In a previous posting on Which is a safe way to transfer a copy of a sensitive document?, I have received suggestions to compress and encrypt an attachment file using the options of utilities such as zip, rar, 7zip and suchlike.

Although the specifics are not important here, the manual page of zip alerted me that there is much more to it than choosing a compression utility and send. Very seriously, the page zip is cautious to the point of hinting that you are not getting any serious encryption (emphasis added)

  -P password
     --password password

  Use password to encrypt zipfile entries (if any).  THIS IS INSECURE!   Many  multi-user
                operating  systems  provide  ways  for  any user to see the current command line of any
                other user; even on stand-alone systems there is always the threat of over-the-shoulder
                peeking.   Storing  the  plaintext  password  as part of a command line in an automated
                script is even worse.  Whenever possible, use the non-echoing,  interactive  prompt  to
                enter passwords.  (And where security is truly important, use strong encryption such as
                Pretty Good Privacy instead of the relatively weak standard encryption provided by zip‐
                file utilities.)

Forewarned is forearmed. I have browsed/scanned several postings in this community such as

How can I encrypt compressed data safely?
Encrypted password inside compressed archive
Does password protecting an archived file actually encrypt it?
Is it easier to crack a ZIP file than a 7z archived file given they have the same password?
Various questions about file compression and encryption regarding hacking (zip, rar, 7z)
Which is more effective and 'secure': Compression+Encryption, or only Encryption?

It is a lot of (interesting, well-presented) information, and the problem has many dimensions: compression utility, encryption algorithms, archive handler, perhaps many more.
The drawback there is that I am a lay, moderately computer-savvy user, who faces the problem of choosing a compression utility that should have the following features:

be OS-agnostic. I am principally a Linux user, but I cannot afford making assumptions on which OS the mail recipient is using -- it'll probably be a Windows family member, although not necessarily -- I might wish to dual-boot on Windows one-off to bridge this gap;
produce an encrypted file that is archive-handler agnostic. Likewise, I don't know which archive handler the recipient is using -- it'll probably be a Windows Explorer of sorts, but not necessarily;
provide serious security; any perfunctory scrambling or placebo is obviously a waste of time;
produce a file that is relatively handy to decompress and decrypt; I cannot make assumptions on how lay and computer-savvy the recipient is. He/she might even be someone for whom installing a new program can be taxing, assuming that his/her employer permits this in the first place.

Apparently, I need some guideline to navigate this problem and choose what to do for an informed guess.

Is there any 'self-aid' wiki resource that you would recommend to find what one is heading for when using this or that utility? Any other suggestions ideas allaying these sorts of headache?

WinZip offers AES 256 and uses PBKDF2 to generate the key.  It only uses 1,000 iterations, but with a sufficiently long password it should provide good security.

http://www.winzip.com/win/en/aes_info.html

To be honest, I think plain Zip with PGP would be better, but if you have non-technical people that you want to access this then passwords are easier.


Why gpg-signed files differ every time I signed the same file producing a separate file for the signatures, and I noticed that every file is signed with a different signature. I don't get it. Shouldn't it always be signed with the same public key in the end?

gpg2 --output FILE1.sig --detach-sig --armor FILE

I made three files (FILE1,2,3). Every file has a different signature - why is that?

real time

Looking at the signed message, the reason gets very obvious. gpg --list-packets takes the input and lists all packets contained in a somewhat readable fashion:

$ echo "foo" | gpg --sign | gpg --list-packets

[gpg asking for passphrase]

:compressed packet: algo=1
:onepass_sig packet: keyid 8E78E44DFB1B55E9
    version 3, sigclass 0x00, digest 2, pubkey 1, last=1
:literal data packet:
    mode b (62), created 1421012528, name="",
    raw data: 4 bytes
:signature packet: algo 1, keyid 8E78E44DFB1B55E9
    version 4, created 1421012528, md5len 0, sigclass 0x00
    digest algo 2, begin of digest 96 e3
    hashed subpkt 2 len 4 (sig created 2015-01-11)
    subpkt 16 len 8 (issuer key ID 8E78E44DFB1B55E9)
    data: [4096 bits]

The "literal data packet" and also the "signature packet" contain the creation timestamp, here 1421012528. The actual signature data also takes the literal data packet's creation timestamp into account, thus will also be different for every signature calculated.

faketime

To verify this, use the glorious faketime program and calculate the checksum of the signature (which is always the same, no matter how often you run the command):

faketime 5pm /bin/bash -c "echo "foo" | gpg --sign | sha256sum"


Can a website know whether I'm streaming or downloading content? I'm taking a paid online course in which the videos are streamed through Flash. After much trouble such as quality fluctuations, unexpected changes in playback speed and frozen screens (also experienced by other users), I've decided to download the videos using an add-on for Firefox.

That, however, violates the terms of service, even though I obviously don't intend to make any commercial use of the videos and I'm going to be the only one watching them. I'd like to know if the content provider can notice, using some kind of heuristic, that I'm not streaming the videos but downloading them.

I've been careful not to download a whole bunch of classes in a short period of time (before they'd have finished streaming if I were watching them), and in order to emulate an expected bandwidth usage I've been setting the videos at the end before I begin downloading them - even though that probably doesn't make any sense. I'd be glad if someone could illuminate me on that.

I've decided to download the videos using an add-on for Firefox.

As far as I know these add-ons, download works by going through the full video stream and saving it permanently. So they make exactly the same request as you would do whilst watching the stream.

If the content provider does not serve another direct download method, the only way to reach the content is by streaming (you get the same application/octet-stream), while a direct download would serve you something like video/mp4.

So I say, it's most likely undetectable. But if you paid for the content, the legal side is not something to worry about.


Detecting Hardware keyloggers... elegant solutions? My company recently discovered a hardware keylogger installed during an routine maintenance procedure.

We tried catching the culprit but unfortunately it doesn't seem like we are going to be able to, so the culprit is still at large.

We're looking into ways to prevent this problem in the future. I did some research and it seems like some endpoints security software advertises the ability to detect keyloggers. Does anybody have any insight into how reliable this? ( the program I saw was called "device lock")

Another solution I have in mind is perhaps we could monitor for if the keyboard ever gets disconnected. However, would it be possible to continue monitoring the keyboards when the computer is turned off?

Please let me know of any thoughts you guys might have in dealing with this problem. Outside of gluing the keyboard into the port or physically securing the premise (unfortunately impossible), I'm quite stumped!

Anyone with physical access to the ports on the computer can do a lot of damage. The elegant solution is to physically secure access to those ports. Endpoint solutions can usually detect software keyloggers, but hardware keyloggers are tough.

  would it be possible to continue monitoring the keyboards when the
  computer is turned off?

When you turn off a computer, you cannot monitor its activity.


What are the security implications of a dead laptop? My laptop recently died.  I've got a replacement, and I've already pulled both hard drives out of the old one and ensured that there's no disc in the DVD drive.  As far as I know, that should constitute all of the sensitive data that could possibly be gleaned from my system.  Is it now safe to hand the remains over to a computer recycling outfit that, for all I know, might have one or more malicious actors working as employees, or is there anything else I need to be aware of first?

If you have removed the hard drive and checked that no removable media was left in it, then none of your data can be found on it. (They will be able to see your BIOS settings, but that isn't considered sensitive data for a dead laptop.)

By the way, if you have an SD slot, make sure you check that too.


Best practices for securing an android device Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal information on it.

Question taken from: http://www.reddit.com/r/netsec/comments/hsdgc/best_practices_for_securing_an_android_device/

Use the features already on the phone as your first choice. The features on the phone:

Are battle-hardened technology.
Don't require Apps from third parties.
Are very well embedded in the Operating System.
Usually provide great value for money and effort.
Just don't look as sexy as additional features (they don't have the marketing budget).

Other Recommendations.

Screen lock / password. ( Make your password strong enough that it cant be easily guessed / compromised, my daughter cracked my complex pattern password easily, so don't use pattern passwords and probably not pin passwords)
Only allowing Known Sources (i.e Android Market), remember that an application is a major attack vector.
Don't load hacked applications ;)
Don't load many applications at all.
Dont root your phone.
Use a password manager on your phone. I recommend Android LastPass myself as it encrypts at rest, but the password has to be entered on demand to make this very secure.
Unless you have a secure folder as @Traroth mentions, everything on the sim card can be retrieved by your attacker (and malware is probably able to read encrypted content when you unlock the encrypted volume, this goes for a password manager too).
Remote Wipe (Google Play and a lot of other services offer this).
Don't select "Always" for important functionality like 'Send SMS', because this can allow a compromised application to send paid-for-sms without user intervention.

Remember that each of these security technologies offer an improvement in security. But equally, they also can provide a avenue for compromise.

Remote wipe and other 'control' tools can also maliciously wipe your phone if the account/service is compromised.
If the Application provider is compromised, then the malware enabled application can cause a lot of mischief.

Updated for 2018:

Encrypted storage. Allows for (among other things) simple and complete device wipe.
Fingerprint unlock. Can ensure much better usability, but can also allow bully-boys to physically force you to unlock your phone.


Is it safe to store the token expiration time in local storage? I understand why one shouldn't store the contents of the JWT token client-side but what about just storing the token expiration time?

I'm using the auth0 authentication service in my app and I'd like to save the tokenExpiry value to localstorage. From a security standpoint, is this considered bad practice?

First of all, storing the JWT client-side is not only acceptable, it is mandatory; your client can't make authenticated requests if it doesn't have its session token. You can store it different places, each with their own security tradeoffs (a cookie is traditional, and can be hidden from script with the httponly flag, but also needs to use the secure flag and puts you at risk of CSRF and similar if you don't use the samesite flag or your browser doesn't support it yet; persistent or session local storage won't be sent automatically the way cookies are and can protect against CSRF, but an XSS payload could steal them). It can be stored ephemerally (session storage or session cookies, although realistically, people often don't actually close their browsers these days) or persistently (its lifetime should be short enough, and included in the signed data of the token and therefore immutable, that this is probably safe but pointless). It's gotta be stored, though.

With that said, even if the token is stored in an httponly cookie (where script can't see it), there's no harm in storing the token's expiration time in local storage. I'm not sure what you plan to do with this data (warn the user when their session is running out? Submit a refresh token request?) but there's no security impact to doing so.

EDIT: A bit more background

JWTs include their expiration time / validity lifetime within themselves, in a portion that is cryptographically signed. Only the server can generate a valid signature, and if any of the signed data (including the expiry) is tampered with, the signature becomes invalid. A JWT with an invalid signature cannot be used (the server will reject it). The server will also reject a JWT that has expired, of course, so the server neither cares what the client thinks the expiration is, nor should ever ask anything except the JWT itself (including its timestamp and signature) whether it is currently valid.


Can a Bitcoin miner generate SHA2 hashes on arbitrary data? I'm not asking about bitcoin's design...but am interested in the hashing capacity of a bitcoin miner.

To be short: do bitcoin miners(or some of them) accept customizable inputs and hash them in bulk(instead of accepting some more high-level instruction and do mining works automatically)?

The real question is, I've read some articles about a signing scheme of post-quantum cryptography, the Merkle Signature Scheme(MSS):

This new way of doing digital signature requires lots amount of hashes being calculated, for example:

a single One-Time-Signature(OTS) requires at least 512 times of hashes if we use SHA-256 with an output size of 512*256/8=16kBytes.

If smaller output is desired, which requires a time-memory tradeoff, e.g. to reduce the size by nearly 8, it requires 2^8 * (256 / 8) = 8192 hashes with an output size about 256 * 256 / 8 / 8 = 1024 Bytes; to reduce by 16, it requires 2^16 * (256 / 16) = 1048576 hashes with an output size about 512 bytes.
each signature of MSS consists several OTSes, which are authenticated by chained binary trees(the OTS on one leaf is used to authenticate the underlying tree's root public key), which means, for n trees there exists n OTSes to be done.
to calculate the tree's root public key, it may be necessary to hash the whole tree: with m levels, it takes about 2^m hashes.

And finally, in this way a life of n*m may be achieved(the limit of doing signature). For example: if 2^80 signatures are being designed, with n=4, m=20 and a tradeoff with 16, for worst case it takes 4*1048576 + 4*2^20=8388608 hashes(but with an attractive output size about (256*256/16*4+80*256)/8=4608Bytes compared with popular algorithms).

This requirement seems too high for software(OpenSSL may do that in 3 seconds, but if one signature takes 3 seconds, why should we design a life of 2^80 signs?), but for hardware like bitcoin miners, it seems still too easy(not sure, I've never played with that). So I've been considering the possibility of adapting a bitcoin miner into a hardware acceleration for such signature algorithm. In order to do so, it's necessary to feed the miner with inputs that we want it to calculate. Is this possible?(I think it should, since they should at least allow some user-related parameters to be customized into hashcash tests...)

Do bitcoin miners(or some of them) accept customizable inputs and hash them in bulk(instead of accepting some more high-level instruction and do mining works automatically)?

Bitcoin miners generally take a parameter called "target" and "header" and return a nonce+overflow.  I don't think it's possible to hash X times, resulting in predictable output (e.g. you want to compare hashes).  The Bitcoin game is one of "finding a lower number" and "hash as fast as you can until you do".

Yes, Bitcoin is literally comparing the SHA2 output of two values as a BigInteger and should only return when this is found.  (maybe what you need is possible, but I would think this feature would introduce inefficiencies for the Bitcoin game and would be undesirable)

Here is what goes on inside bitcoin miners:

Note: step 3 and 4 is Bitcoin Hardware, the rest is your custom driver software

Step 1

At a high level, the miner software takes a list of active transactions, and then groups them together in something called a "block".

Or more accurately stated: The miner software coverts all the transactions into a summary view called a  "merkle root", and hashes it, which is representative of the transactions.

Step 2

Then mining software converts this to into a binary format called a Block Header, which also references the previous blocks (also called a chain).

Field           Purpose                          Updated when...               Size (Bytes)
Version         Block version number             You upgrade the software and   4
                                                 it specifies a new version

hashPrevBlock   256-bit hash of the previous     A new block comes in          32
                block header
hashMerkleRoot  256-bit hash based on all        A transaction is accepted     32
                the transactions in the block

Time            Current timestamp as seconds     Every few seconds              4
                since 1970-01-01T00:00 UTC

Bits            Current target in compact format   The difficulty is adjusted   4

Nonce           32-bit number (starts at 0)       A hash is tried (increments)  4

Step 3:

The miner hardware changes a small portion of this block called a "nonce".

Step 4:

The block header is hashed and compared to the Target as if it were simply a large number like 10,000,000 > 7,000,000  (the real numbers are much bigger, and in hex).  The target is compressed and stored in each block in a field called bits.

An expanded target looks like this:

  Target   0000000000000083ef00000000000000000000000000000000000000000000000

And the goal is to make sure the SHA256 hash of the block is less than this value.  In the example below "83ee" is smaller than "83ef"

To simplify this concept, you can ballpark the target by counting the leading zeros (as the other answer here explains).  Here is an example:

Here is a sample block with transactions you can view on BlockChain.info. Look in the upper right hand corner of the webpage for this hash:

   Hash 0000000000000083ee9371ddff055eed7f02348e4eda36c741a2fc62c85bc5cf

That previous hash was from today and has 14 leading zeroes.  Let's compare that to what was needed 3 years ago with block 100 which has 8 leading zeros.

   Hash 00000000a8ed5e960dccdf309f2ee2132badcc9247755c32a4b7081422d51899

Summary

So at the end of the day, all a miner does is:

Take a block header as input
Change the Nonce
Test if the Block Header hash is less than the Target.  If it is, you win.
Go to step 2  (or go to step 1 if someone else won the block)


Discover what workstations a user us connected to in a Windows AD Environment? I currently have a naughty user in my environment.  We don't want to set any alarms of (even from speaking to the AD admins), and wish to discover the workstation the user is connected to in our AD environment.  At this point in time all I know is the username.

How can I discover the workstation name the user is connected to from only knowing the username?

i)  I could export the AD security log and look for the users logon event, as the logon event captures the workstation name.

ii)  Scan through all the IP's in my network and write a script like the below to get the username currently logged into IP x

for /f %%a in (IP.txt) do WMIC /NODE:%%a computersystem GET name, username

Thanks.

Find out which computers in Active Directory a user is logged into.

  This will find the user if they're logged in using the console or
  remotely using terminal services by examining the explorer.exe
  processes on all active directory machines.  This script requires the
  free Quest ActiveRoles Management Shell for Active Directory snap-in:
  Located http://www.quest.com/powershell/activeroles-server.aspx

find full article here

Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction SilentlyContinue
$ErrorActionPreference = "SilentlyContinue"

# Retrieve Username to search for, error checks to make sure the username
# is not blank and that it exists in Active Directory

Function Get-Username {
$Global:Username = Read-Host "Enter username you want to search for"
if ($Username -eq $null){
    Write-Host "Username cannot be blank, please re-enter username!!!!!"
    Get-Username}
$UserCheck = Get-QADUser -SamAccountName $Username
if ($UserCheck -eq $null){
    Write-Host "Invalid username, please verify this is the logon id for the account"
    Get-Username}
}

get-username

$computers = Get-QADComputer | where {$_.accountisdisabled -eq $false}
foreach ($comp in $computers)
    {
    $Computer = $comp.Name
    $ping = new-object System.Net.NetworkInformation.Ping
    $Reply = $null
    $Reply = $ping.send($Computer)
    if($Reply.status -like 'Success'){
        #Get explorer.exe processes
        $proc = gwmi win32_process -computer $Computer -Filter "Name = 'explorer.exe'"
        #Search collection of processes for username
        ForEach ($p in $proc) {
            $temp = ($p.GetOwner()).User
            if ($temp -eq $Username){
            write-host "$Username is logged on $Computer"
        }}}}

Joe commented there:

  Joe0126 - Dec 12, 2011 Replace:  $computers = Get-QADComputer | where
  {$_.accountisdisabled -eq $false} With:  $computers = Get-QADComputer
  -OSname 'Server' | where {$_.accountisdisabled -eq $false}


The new CCMP attack against WPA/WPA2 PSK The use of Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) for WPA/WPA2 PSK is being attacked.   This is a trivial attack (offline brute force) against the initial key exchange.  It should be noted that the IEEE does not recognize this attack.

The concern is that there is a tool called Pyrit  which claims to make 7.9 million password guesses per second or about 682.5 Billion per day. This is made possible by using the new Intel i7 chips which have the AES-NI instruction set.  One of these chips costs less than $300.

What changes to WPA2-PSK are needed in order to mitigate this attack?

To be precise, the "new attack" is an optimization of brute-force, by using a slightly faster way to check whether a key is correct or not, mainly through the knowledge of the first few bytes of plaintext. This offers a speed increase of 50% -- in other words, attacks which took 6 days can now be done in 4 days. To put things in perspective, using a PC from next years will offer the same kind of speedup (but it is cumulative, of course).

The main issue with WPA2-PSK has not changed: the conversion from the password to the cryptographic keys is too fast. It should use the same tricks than for password storage, namely iterating hundreds or thousands of hash function invocations. It would not induce any noticeable slowdown in normal usage, but it would makes things much harder for the attacker.