Crypto software: overwrite sensitive buffer Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory?
For example when they contain a private key or the plaintext message.

It is common but a bit of a myth, too. In older days, the overwrite was felt to be important because of the following:

Some widely deployed operating systems (in particular Windows from the "3.1" lineage, up to and including Windows 98 and Millenium) did not zero out memory pages before giving them to applications, so an application could obtain excerpts of old memory from another application.
Data in RAM may leak to the disk through virtual memory.
It was believed at some point that "partial leakage" could be prevalent, e.g. that a read-only buffer overflow could reveal part of the RAM but not everything.

These properties have gone quite stale nowadays. In particular, modern operating systems (including Windows 2000, XP and successors) do zero out pages systematically. Also, swap file usage has diminished; devices like smartphones and tablets don't use swap at all, and are happy with that (and I also do as such on my laptop computers). More importantly, people have begun to understand that the problem of leaked data has a large scope: when you decrypt a private message, the private key is indeed a piece of sensitive data, but so is the message itself. And the memory buffers used to display the said message on the screen, too. As well as all the temporary buffers for the algorithm which computed how the private text had to be broken down into properly justified paragraphs for display. And so on.

At the same time, the software ecosystem has evolved, and we now use a lot more programming languages which allocate memory through a garbage collector (e.g. Java, C#, Python, PHP, Javascript, Perl, Ruby... all use a GC). The efficient GC algorithms move objects around in RAM, transparently. And by "move" I really mean "copy". A consequence is that "wiping out" memory from the program itself no longer guarantees that no trace of the data remains.

The synthetic conclusion is that wiping data from application code is a poor response to the overall problem of data leakage. It is common, but that's not the same as recommended. If the local security model calls for such wiping out at all, then it should be done in a systematic and system-wide fashion, by the memory allocator (e.g. the GC, for languages which are GC-based), not by cluttering the application code with explicit calls to memset().

One first step, which is easy enough to apply, is to see whether you could not just deactivate swap space altogether. This would remove the source of the most serious leaks (leaks to physical mediums).


Necessary education for InfoSec? So, as it stands I'm a 21 year old recent Bio-Chemistry graduate looking for a path into InfoSec.

Without a background in any computing discipline I assumed that it would be seen as compulsory that I attain a degree in some related field, so I applied to several MS programs in both CS and IS. I have acceptances to several grad. schools among the top 30, and I'm attempting to decipher where I should go from here.

Would it be better to choose a program specifically geared towards IS and get my MS in Information Assurance & Security?

Would it be better to generalize and select a MS in Computer Science program and then have my electives in InfoSec?

Or is pursuing further education not advisable?

I would be cautious about masters in Computer Science, they tend to be more research oriented building on the basis of an undergrad in the field.  Not that they couldn't be helpful, but you'll want to make sure that you have a firm understanding of the material they are going to assume you know prior to starting such a program.

It would probably first be worth picking up something like a good CISSP study guide and read it.  InfoSec isn't really all that different from Security in general and while a strong technical foundation is certainly very valuable, just as much or more of the knowledge is about people and how they operate, physical security, general thinking and then some specific details about what strengths and weaknesses are of existing technical systems.

Being such a broad field, I'd recommend looking in to some of the more overview material and that will give you a better idea where your strengths and weaknesses are and then you can work from there to determine what kind of additional training you need.


How can I validate time-sensitive data is coming from a mobile app, and not being forged? In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and storing the score, but it obviously cannot record  the exact time spent itsself due to latency.

Somehow, the mobile app will have to send the server the time it took for them to answer the question according to it's own clock. How do I verify that the value in that API call is not being forged?

I figure that at the very least, we can have a string that is hardcoded into both applications that will encrypt/decrypt the timestamps (is AES good for this?) but this is not 100% secure as someone could manage to get that string through decompilation or whatever.

After that, I reckon we could measure the latency in a test request when we first communicate with the mobile app. Then we can ensure the times being sent are within a reasonable window based on that latency. To me this seems kind of finicky and inaccurate. It would be tough to decide on what the window would be since the values are so small. For example, if it took "5s" to answer a question with ~200ms latency, is the window 6? 7? 10? If the window is too large, forgery would still be worth it. Too small and you might screw over legit users who just had a second of lag or whatever.

Is there any robust solution? Would the encryption/decryption be "safe enough"?

As others have noted you can never trust the client, ever. You can make it difficult for people but there will always be attacks they can perform:

Artificially inflate measure of round trip time (RTT)
Extract encryption keys
Alter local clocks

Monitoring for suspicious behavior / timing irregularities may be possible though extremely difficult. For example what are typical RTT for people on a certain network / location and what is the typical variance in this? (e.g. statistical anomaly detection: http://en.wikipedia.org/wiki/Anomaly_detection )

A combination of making it hard and detecting anomalies would probably be the best you can do such that someone goes to a lot of effort, and then gets their scores wiped and account suspended for a while - similar to failing a doping test...


website - infected by malware and if yes, how can I treat it? A friend told me that the website of our association, here , got blocked by the corporate network of the company he is working for, due to malware (see picture below)

I've tried a few website like this one here and this one too , both are giving differents answers.

How can I know if our website got infested? Are there any reliable web based tools , I can use to figure it?

And if it was infected, how can I deal with that?

The page is powered by wordpress and I'm a total n00bs with wordpress e.g. any steps by steps hands on are more than welcomed.

Thanks in advance for any insights you will be able to provide me with.

Update: @Lukas helped me out and i've accepted his answer. Hence, I'm removing the website's url.

I've taken a look at the website and I couldn't find any evidence that it has been hacked - however, this does not necessarily mean that the site is clean.

Norton claims that your site is a Web Attack: Mass Injection Website and has therefore put the site on a blacklist. This blacklist seems to be used by other services (like sucuri and maybe the company firewall you mentioned).

But Web-based tools can never be as exact as searching for malicious content by yourself. Therefore, it is better to have a closer look at the server and the files stored on it than wasting much time with online tests.

For you, the next steps could be:

Skim through all the files of your website. Find out if there are any suspicious PHP or JavaScript files. Open them in a text editor and review them: If the source is obfuscated like in this example, it is quite probably a backdoor:
$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF3.$sF[11].$sF[8].$sF[10].$sF [...]
You should also check the log files (if your hoster provides them) and search for any php files accessed.
If you are not sure whether a file is suspicious, compare them with the files in a new Wordpress installation. You can download a zip file from wordpress.org for comparison.
Oh, and always keep Wordpress and its plugins and themes up-to-date. The website is currently not running the latest available version.

If you find a backdoor or other malicious code - then check out the thread How do I deal with a compromised server provided by Stephane.


Security of Moblie Hotspot (4G LTE, WiFi) vs. Apartment Complex Cable Internet The overwhelming majority of my banking is done online. As such, I try to be as cautious as possible. I am moving into a new apartment in a few months which offers internet. (I am not sure whether it is WiFi or direct wire.) Unfortunately, you cannot have your own service exclusive to your apartment: your choices are either (a) no internet or  (b) their internet. Now, I have a mobile hotspot (Verizon Jet Pack), which offers connection to the 4G LTE network via WiFi. In general, would that be more secure than connecting to the internet offered by an apartment complex (especially if it WiFi)? The apartment complex is not “sketchy” by an means; however, I rather be informed! Thank you!

I'm sure you could get your own internet if you wanted, there's nothing stopping you from ordering your own ADSL, is there? Regarding snooping there's nothing that your building could be doing that an ISP or 4G LTE network couldn't be doing as well. Your building could keep a log of your traffic and see what you connect to, so could an ISP (depending on where you live this could already be happening). They could inspect unencrypted traffic to see the content, so could your ISP. My main concern would be whether the building forces you through a proxy as that would allow them to read your encrypted traffic as well. Of course an ISP could force you through a proxy but they almost never do.

So if the building is not going to proxy your traffic then it's just the same as using an ADSL or LTE connection. It's unlikely they would do any inspection or tracking - these technologies cost money and this service is probably just a value-add, however it is within the realm of possibility. They probably have a contract and/or AUP you will have to agree to as a condition of using the service, get a copy and read it as it may be illuminating. Also ask the building management for details, they will probably give you all the details you want.

If you are concerned about snooping in general then you should be just as worried about your ISP or LTE provider, they are more likely to be the ones watching what you do. In that case use tor or a similar technology.


How should we announce vulnerabilities in our application? I have asked about security release notes Considerations for security release notes

I need additional clarification about security vulnerabilities announcement.
We create major release of our product about each half years and security or maintenance releases each month. Our product is Java Web Application that runs on Apache and Tomcat.

How should we announce about security vulnerabilities?
Should we add our company as a vendor to CVE database http://cve.mitre.org/ (like Apache) and create new CVE each time we found it? Or is it enough to list our internal bug number?
Should we add to CVE database only vulnerabilities that were discovered by our customers? Or should we add to CVE database also vulnerabilities that were discovered by QA?

I recommend reading the CVE FAQ.  In short the CVE system is created to share knowledge of vulnerabilities in software, keep track of their severity and reduce the duplication of effort.   The fundamental purpose of the CVE system is to notify users that they are in  danger,  and to update immediately.

It is appropriate to obtain a CVE for any publicly disclosed vulnerability that could endanger users.  A bug found internally though QA, is probably not being publicly exploited, and therefore a CVE would probably not help.

Consider offering a mailing-list to your users to inform them of security related updates.


Are bcrypt hashes safe enough if exposed? Considering:

A VERY motivated attacker,
A large entropy password, as in 256bits¹ hashed in bcrypt (with recommended cost factor of 12), and
Attacker knowledge of everything he might need (except the password): hash, salt, cost, etc [AFAIK those are included in the bcrypt hash]

Is it safe to assume that an exposed bcrypt hash is secure and therefore the attacker won't be able to access the password (or find a collision) any time soon?
If the answers is "depends" you are free to make assumptions, please explain why though :)

I did previous research on the topic, and it seems that the answer is YES, but I didn't actually found that in a clear statement. There is a similar question to mine here but IT'S NOT A DUPLICATE, as the answers address implementation/designs flaws and not the security of the hashes.
I also found this and it made me question the security of the hashes when he mentions he "side-step the brute-forcing process", although it isn't clear if it's even related to the hash.
Some notes:
1: Just to be sure, I'm calculating entropy as log2(R^L) where R = 62 (Alphanumeric with uppercase) and L = 43 (as in number of characters).
2: I haven't been pwned or anything, I just want to get a clear understanding if it's safe to assume this or if there is something I might be missing.

We don't need a motivated attacker since security is already considered with the strongest attackers. Therefore we can say that they have all information, except the password and have a huge computing power like the Bitcoin miners that can reach ~293 SHA256 hashes per year with massive parallelization.
Now, assuming that your password has strength 256-bit then even we omit the iteration count of bcrypt and set the one bcrypt password test equal to one call of SHA256 then the attackers need around ~2163 years to search. No way! Now consider the iteration count then this number will be higher.
Now, bcrypt is very old dated to 1999. It is not a memory-hard password hashing, that is requiring some adjustable huge memory that prevents parallelization like in ASICs that BitCoin miners use. You should rather use modern password encryption function like Argon2. It is memory-hard, it can be adjusted to require threads. Also, it can have resistance to side-channel attacks that the side-channle attackers can steal the password over time. The side-channel protected version of Argon2 is Argon2i. And, It is always better to use Argon2id if you unsure about using Argon2d (data-dependent) or Argon2i (data-independent).
Side note: collisions are not related to passwords,  finding pre-images are related. In finding collision the attacker just needs to find two input values a and b such that h(a) = h(b).  In password finding, the attacker needs to find x given the password hash h that satisfies h(x|salt) = . The cost of collision finding is the square root of pre-images attacks due to the birthday paradox.


How secure is PIN login to Windows? I've just noticed that Windows 10 allow me to change my login method to PIN which is obviously much more convenient than entering my long and secure password after every startup / wake. I am just wondering how secure that is.  I have the following questions:

Does Windows 10 only allow a small number of pin attempts and then require a full password?  Is it possible to enable this type of functionality?
If my disk is not encrypted does it matter if I use a password or a pin?
In general is it advisable to turn this login feature on or stick with password based login?

This question addresses a portion of Question 1, but not completely.

PIN numbers do not replace passwords. A password is still required. PINs allow you to have a very strong password with the convenience of being able to quickly unlock your device.

PIN numbers in Windows 10 are not really included to increase the security of that specific device. In order to configure a PIN number on a device you must first log into that device using your Microsoft account and then configure a PIN number - the PIN number only unlocks the device you've set that PIN number up on, meaning that if the PIN number is compromised the attacker only gains access to that machine, not to your other devices, not to your Microsoft account.

As per one of the moderators on the Microsoft Answers question "PIN makes Windows LESS, FAR, FAR, LESS secure":

The PIN can only be used on the physical device it is set up on
PIN login only allows 4 incorrect attempts before you're challenged
After 1 more failure, you must restart the machine
After going through the above process a couple of times the PIN is blocked

Essentially this is a convenience feature, allowing you to a use a very strong password for your account and a much easier password for unlocking your devices. Entering the PIN number also requires physical access to the device, so brute forcing it would be time consuming and require manual input.


Does "New seat seat0" indicate something successful? I've just setup my Raspberry Pi. Checking the Auth.log, I noticed some failed attempts from a foreign IP address. However, there was one (final) attempt that confused me.

This line (also note the time has gone backwards)

Feb 23 21:29:52 raspberrypi sshd[17102]: Connection from 210.107.198.201 port 43566 on 192.168.0.102 port 22
Feb 23 21:17:13 raspberrypi systemd-logind[341]: New seat seat0.

I'm no security expert, but I know systemd-logind is a daemon that manages logins, but does the New seat seat0` indicate something successful?

The docs didn't really clarify it for me. I think it's related to this

  AttachDevice() may be used to assign a specific device to a specific seat. The device is identified by its /sys path, and must be eligible for seat assignments. Takes three arguments: the seat id, the sysfs path, and a boolean for controlling PolicyKit interactivity (see above). Device assignments are persistently stored to disk. To create a new seat, simply specify a previously unused seat id. For more information about the seat assignment logic see Multi-Seat for Linux.

Some more lines if relevant

Feb 23 21:29:50 raspberrypi sshd[17099]: Connection from 210.107.198.201 port 43394 on 192.168.0.102 port 22
Feb 23 21:29:51 raspberrypi sshd[17099]: Invalid user admin from 210.107.198.201
Feb 23 21:29:51 raspberrypi sshd[17099]: input_userauth_request: invalid user admin [preauth]
Feb 23 21:29:52 raspberrypi sshd[17099]: Connection closed by 210.107.198.201 [preauth]
Feb 23 21:29:52 raspberrypi sshd[17102]: Set /proc/self/oom_score_adj to 0
Feb 23 21:29:52 raspberrypi sshd[17102]: Connection from 210.107.198.201 port 43566 on 192.168.0.102 port 22
Feb 23 21:17:13 raspberrypi systemd-logind[341]: New seat seat0.
Feb 23 21:17:14 raspberrypi sshd[405]: Set /proc/self/oom_score_adj from 0 to -1000
Feb 23 21:17:14 raspberrypi sshd[405]: Server listening on 0.0.0.0 port 22.
Feb 23 21:17:14 raspberrypi sshd[405]: Server listening on :: port 22.

New seat seat0 indicates that the login manager started successfully.

seat0 is a default seat in systemd and is created on service start (see Multi-Seat on Linux).

There must have been a reboot (likely not clean, probably the system crashed) on 21:29:52 (according to the clock settings before reboot). The lower numbers in PIDs also indicate that system was recently restarted.

Given the information in the question, not much else can be told. However, if you have not changed the default password for pi nor disabled the password authentication, then you can assume the system is not yours anymore.


Builder vs. Breaker - Do developers make good pen testers & vice versa Do developers necessarily make good penetration testers & vice versa?

The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can be manipulated than actually designing and developing things myself.

I can program and I'd say I have an intermediate level of expertise but I have a hard time going from idea to finished project.  I'm much more motivated and feel like I'm much more in a mental state of flow when trying to reverse engineer how something I have in front of me is working.

I think it's kind of the same idea as a writer or painter who talks about that anxiety of looking at a blank page.  I feel like when working backwards from an existing piece of software there are constraints and context already there that gives me something to latch onto mentally.  Whereas when developing software that 'blank page' and all the possible ways of designing and implementing something make my mind spin up and analyze every possibility.

I've seen this discussed in security circles as builders vs. breakers. The idea that some people are just wired more for building stuff with the traits that favor that and others for pointing out what's wrong with it.

In your experience is this a real thing or just a false dichotomy?

How essential are development skills for penetration testing?

I definitely really enjoy learning about how things are implemented and I'm not shy to read the source to figure it out. I like writing smaller scripts and tools that have a specific purpose but big full on programming projects with a lot of architecture abstractions I find I often end up losing interest and momentum.

How much should I let this bother me if my goal is pen testing rather than an actual development position?

Generally speaking, to be a good pentester you have to master some of the skills that are required to be a good programmer. Solid development experience about possible programming mistakes is very helpful, because a lot of pentesting is about finding corner cases that the programmer did not think of -- i.e., bugs. This goes both way: a good developer should have some pentesting skills because making robust code implies taking care of anomalous conditions, the kind of things that the pentester (and potential attackers) try hard to trigger.

There are facets of software development which do not directly help with pentesting; in particular structural abilities like knowing how to design a simple, slick and extensible API, or being good at documenting code.

There are facets of pentesting which do not directly help with development, e.g. everything which amounts to social engineering.

As for psychological traits, I'd say that it is not really a question of building vs breaking; at least not about being good at building or breaking. It is more about having fun at building or breaking. Pentesting can be frustrating, especially if you are on the "creative" side of people, because you spend all day dealing with poorly written code and you know you could do much better, but that's not your job. On the other hand, a successful intrusion into a seemingly robust server is intellectually rewarding; pentesting is a battle of wits, where you fight against the mind of the developers, while development is a battle against the laws of physics, which can be daunting at times. Development or pentesting, you can do it for a long time only if you find the activity pleasurable.

Alexander the Great was a developer; Machiavelli was a pentester. Genghis Khan was both.


Canary token on desktop triggers when I plug in my phone I've just found out about canary tokens and how they can be hidden in a lot of object types. So I put a canary token on my desktop as a Windows folder. Now, whenever I unplug my phone from the computer, I get a notification that the canary was triggered.

I moved the canary token to another location and it won't trigger the canary. I checked my phone and it isn't in data transfer mode when connected, only charging mode. Why would I be getting a trigger when the canary isn't opened?

edit:link to create canary token http://canarytokens.org/generate

Windows Explorer Canary Tokens are used to trigger "browsing activity" within a specific folder and not system wide.

You have put the desktop.ini file on your desktop, which will for sure trigger the alert action.

Canary code should look like:

[.ShellClassInfo]
IconResource=\\%USERNAME%.%COMPUTERNAME%.%USERDOMAIN%.INI.TOKEN.domain.tld\resource.dll

try to put the file inside a folder: C:\testfolder\desktop.ini let's say, so that whenever someone tries to "browse" that path as in C:\testfolder\ locally or within the network (if the folder is shared), an alert will be triggered.


How bad of a practice is it to mount tomcat's manager to Apache2? If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2.

E.g.,:

JkMount /manager/html* ajp13_worker

I'm doing this because my company has a firewall which blocks anything but web and mail.

I would put this on the same level as installing mysqladmin or phpmyadmin on a public web server. Ideally you would not put applications that can do administrative actions on a publicly accessible location (even when protected with passwords, you are vulnerable to a brute force attack).

Furthermore, Tomcat's manager has been known to have had security flaws, so I would avoid using it from anywhere but localhost.

If I understand you correctly, you are trying to access Tomcat's manager from your office. In that case my recommendation would be set it up behind SSL, and to require an approved client SSL certificate for access - this should make it secure enough, provided that you trust your office workstation.


Is using a weak password for the non-hidden volume acceptable? Considering that I can only safely choose the filesystem for the hidden partition of a VeraCrypt container, and that I would like to use a particular filesystem, is it acceptable to use a weak password for the non-hidden and a strong password for the hidden?

The non-hidden partition will never be used (at least I'm not planning on using it) and the hidden partition with my desired filesystem will be the primary place to store my files.

If the weak password is discovered, will this also compromise the security of the hidden partition?

This is to prove (or show with high likelihood) that I do not have a partition containing hidden data (ie. I will be able to give out the password to both the hidden and non-hidden password, if forced).

You really should read in depth all the documentation on Plausible deniability. Hidden volumes are a very powerful tool but still not a magic bullet. In particular:

you must be ready to lose the hidden partition if you have you reveal the outer one: many operations that you could be asked to do will destroy it.
you must be able to explain why you created a VeraCrypt volume, and why you put there the files it contains - only storing pictures of your dog is not really plausible...
you must either use it on a regular base or be able to explain why you do not use it - in short you must be able to explain how you use it in addition to why
if you choose a really weak password you must be able to explain why you did that - this one is to answer your question

Said differently, the choice of a password is only one of the multiple questions you should ask yourself before using a hidden volume.

That being said, being a teenager that just wants to protect files from his younger sister is plausible for example, whatever the password...


How do hackers intercept messages? It is often said that the main reason of using encryption is to unable middlemen (listeners) to understand the messages exchanged between parties even if they intercept it.  But it is overlooked to mention how can someone actually intercept the message at the first place, whether it is encrypted or not. During the Caesar period, it is obvious that enemy can intercept messages by physically capturing the messenger. Thus they began to use ciphers to encrypt their communication. But in the digital world, how does that actually work?
My questions are:

Do hackers have special hardware to intercept digital messages  or
anybody with a standard computer and internet can do it?
Do hackers have some specific software?
Can any device be attacked? (phones,.. )

No, anybody with a computer
Sometimes
If it is connected to a network, yes. IOT is an emerging threat now.

You just have to know what to look for. You can find an insane amount of information using wireshark, Cain and Abel is pretty ridiculous too on active networks, it does the parsing for you.

Wireshark for example - say you captured traffic for a while and your looking through and see a telnet session (port 23) - you can right click on a packet of that session and select Follow TCP Stream and there is a chance that you end up with someones password. I'm sure someone could provide more detailed examples but, hopefully that gives you an idea.

https://www.youtube.com/watch?v=xShwyUq-uHk - Video on what I described (telnet)

Cain and Abel - in my experience is like the laziest recon tool ever. I was sitting in a computer lab way back in the day and just messing around being a nerdy teenager. Every new account that was being created or entered around me I had a record of. At first I thought, wow, this is way too easy it must be wrong. So I shouted across the room, "Hey, Girl X - did you just create a Zanga account?"...I had her username and password.


Does routers, firewalls log dedicated server connections? I would like to learn about logging policy of datacenters about dedicated servers? Is it possible to log every connection/port to dedicated servers by datacenters with using routers/firewalls? Or is it practical and generally used policy?

Thanks for your help :)

It is certainly possible and should indeed be done.

However, your question is very broad indeed as there are many uses for data centres ranging from ones that cater for a single customer through to global cloud data centres. You need to be more specific.

One of the major issues with logging in DCs is obviously the amount of traffic generated and this can be a real headache. Busy DC's will generate MB of data per hour or more which has, somehow to be handled.

So while it is possible, it isn't necessarily easy and some DC's will limit the traffic in certain logs.

There is also the issue of what to do with the data. Having it is one thing, using it is totally another. You absolutely have to have systems that summarise and chart the data so that humans can spot issues and react to them in a reasonable time.

You may note that, depending on what the DC is used for and also what country it is in, there may also be legal requirements for logging.


Security of emails from ProtonMail to Gmail I understand that Gmail to Gmail is not very secure. On the other hand, ProtonMail is a very good option with great features. But there is one thing I don't quite understand:

Why should I use ProtonMail if the recipient uses Gmail? How is this more secure? I mean, if Gmail is not secure enough, then what's the point of sending an email to Gmail from ProtonMail instead of just keep using Gmail (given that it has extra features)?

I understand that Gmail to Gmail is not very secure.

Depends on the threat. Do you care that a handful of people who work for google and the government can read your messages? If not, then gmail's great.

On the other hand, ProtonMail is a very good option with great features. But there is one thing I don't quite understand:
Why should I use ProtonMail if the recipient uses Gmail? How is this more secure? I mean, if Gmail is not secure enough, then what's the point of sending an email to Gmail from ProtonMail instead of just keep using Gmail (given that it has extra features)?

Yeah, once you send the message outside of the protonmail ecosystem it's only as secure as the least secure link. It's likley that protonmail uses TLS to communicate with gmail, and again, gmail's pretty darn safe.
However, if you had sent the messages to yahoo in the past, then the NSA had a tap on yahoo's network, and that would not have been very safe, unless you don’t care if the NSA reads your mail.
If you sent the message to Hillary Clinton's basement email server, then the cleaning lady could have taken the hard drive. That's not very safe.
Then again, if you sync your email to your personal device, or your computer is compromised, then your proton mail is also compromised.
Maybe use signal on your phone for really really sensitive messages, and gmail with two factor for the rest.


Anatomy of a very creative .txt virus/trojan. How does it work? So I downloaded a PDF which is password protected. Inside the same folder there are the following apparently harmless files:

As you can see, they are both .txt files, right? Pretty harmless.. Actually, not: if you look closely you can see that the PDF Password file is actually a shortcut link, investigating within it, it has the following command in the shortcut:

C:\Windows\System32\cmd.exe cmd /c Credits.txt

Ok. So it's not a .txt file and it runs a command for the other apparently harmless .txt file.. which also happens not to be a .txt file, because it's contents look something like:

Binary data. So when you run this, a process called TaskMgr with a weird icon appears. I'm a programmer and I'm curious, what's the anatomy of this attack? What type of data can be run using CMD like this? Which programming language is in this file and how can I decompile it to see exactly what it's doing to the system?

I must admit, this one is pretty clever.

The other answers are basically correct, but are missing the key element:

A weird legacy behavior in cmd.exe is that when you give it a file as a command (either via the /c parameter or by just typing the file name into the interactive shell), the first thing it does is call CreateProcess on that file. CreateProcess is the Win32 API to launch a program, and it does not care about the file extension; it only cares whether or not the file is executable code and has Execute permission (which all Windows files have, by default). Only if CreateProcess fails does cmd fall back to ShellExecute, which takes an action based on the file extension and registered handler.

As the other answers noted, your ".txt" file is actually a Windows PE executable binary (basically, a renamed ".exe" file). If you ran it on your machine, there's a pretty good chance your system is now compromised by malware.


Deliberately vulnerable Flash applications? I'm trying to find some deliberately vulnerable Flash applications that I can practice security testing on (in the same vein as applications like the Damn Vulnerable applications).

Ive noticed there are a lot of resources on the net that show how to de-compile SWF applications, or how to exploit Flashvars, but there doesnt seem to be any deliberately vulnerable Flash applications out there that I can use for practice.

Does anyone have any suggestions, aside from writing one myself?

You can use OWASP Flash Security Project. There are plenty of resources for such kind of applications: https://www.owasp.org/index.php/Category:OWASP_Flash_Security_Project


Discrepancies between rkhunter itemized report and summary I am new to rkhunter, which I have been using on Lubuntu 18.04. While it is running, it indicates an itemized scan of rootkits in two waves. First, it states: Performing check of known rootkit files and directories. Then: Performing additional rootkit checks. In both instances, literally every item scanned comes back as [not found]. So it is quite perplexing to find the following in the system checks summary at the bottom:

Rootkit checks...
    Rootkits checked : 479
    Possible rootkits: 4

What is happening here? Why does the summary indicate four possible rootkits when the itemized scan indicate none?

I think you are probably getting a couple [WARNING] messages in the Performing file properties checks, which is being flagged as a possible rootkit.

Running:

sudo rkhunter --propupd

when you first install rkhunter and after any software upgrades should fix it. Just understand that all this program does is check for changes in system files vs stored values in it's database. If these files were maliciously changed and you ran the above command, rkhunter would report everything as okay.

Source and additional info: https://help.ubuntu.com/community/RKhunter


Why are non-collision-resistant hash functions considered insecure for signing self-generated information Let we have a hash function that is second preimage resistant but not collision-resistant.

Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for both of which the signature will be valid.

I don't understand why it is an issue in the setting where signatures are used to authenticate origin of data created by the same entity. So if one signs some software he claims "I have created this content myself, if it contains malware, blame me". And for keys: "this public key has a corresponding private key, I have access to it".

If one crafts a collision and signs self-generated data ... he still claims the above statements.

So should such hash functions be considered secure for things like self-signed certificates and code signing?

Digital signatures are designed to do three things:

Ensure the integrity of the data that has been signed
Create some degree of non-repudiation by the signer
The purpose you mentioned, which is to authenticate the origin of the message

The biggest issue with hash functions that are susceptible to collisions is that you very quickly lose the first design goal.  If two different messages can have the same signature, then you can't know which are genuine.

So, what's the big deal if I can sign two different messages with the same signature?  You still know they both came from me and can hold me accountable, right?  Well, perhaps.  There are certainly some cases where this can be abused, but we're going to ignore them because they aren't the real issue.   The real issue is where you can craft two messages that will have the same signature and the submit one of them for someone else to sign.

The canonical example here is a x.509 (SSL/TLS) certificate request.  In this case, a poorly designed certificate signing process can be leveraged to induce a Certificate Authority to sign a certificate for one subject or with one set of properties (like an end-entity certificate), only to have the signature collide with the signature for a second certificate also generated by the attackers that would not have been issued for a subject the attackers don't control, or for a CA cert, and that rogue cert can now benefit from the perfectly valid signature associated with first, benign certificate.


What if IoT devices are fabricated with random passwords? Considering the Dyn DDOS attack which was possible because the IoT devices have poor default passwords, will it be a solution if the company who produces the devices might generate random default passwords for them?

These random passwords can be printed in a letter inside the box of the device.

Getting rid of default passwords would be a start. But default passwords are not the only problem with these devices. Apart from this obvious problem we have undocumented accounts users cannot even change, backdoors which might be deliberately placed or just accidently left in for debugging, vulnerabilities against CSRF, XSS, DNS hijacking and much more.

A major reason for this mess are vendors which don't know much about security and don't really care and users which don't know and don't care either and also like to have the cheapest device possible. And as long as nobody causing this problem will be held accountable for this mess and will feel the harm they do to others it will not get better.

Making vendors feel the problem can actually be very effective. For example the influential german computer magazine c't did a lot of tests of routers in the last years and probably also thanks to their successful public shaming of vendors with insecure settings now probably most routers sold in Germany enforce changing of the access credentials on first use or don't use default passwords at all and also take care of various other security problems.


How to preventing timing attacks against values used for authentication, like emails, stored in Databases? I am building a web app that allows login with an email and password. I understand that I need to use a timing safe function to compare the passwords to prevent timing attacks. However I realized that the emails might be vulnerable to the same attack.  I am unsure how to prevent timing attacks on the emails.

The emails are stored in a database and the database handles finding the user with the matching email:

 SELECT * FROM users WHERE email = $1

This means that the database handles searching through all the users' emails and looking for a match. The internal database function (in this case the db happened to be PostgresSQL) used to compare the emails provided in the WHERE clause with the ones in the database is not timing safe (I assume because that would be really slow and inefficient). This is an issue at login where inputted emails must be compared against the entire (or much of) the database.

How can I prevent timing attacks on email?

From the comments:

Store a second column with the hash of the email. When a user submits their email and password, hash the input email and look it up in the db. This will mitigate timing attacks to the point where it is insignificant.

How hashing mitigates timing attacks is discussed on the below post:

https://stackoverflow.com/a/27029501/7886229


What would be a simple example of an asymmetric encryption function (asymmetric function)? I am trying to understand RSA encryption but the algorithm seems quite complex.

I know that with asymmetric encryption you use a key and a function to encrypt data and a different function to decrypt it.

I understand the xor-ing used in most basic symmetric algorithms (functions). The same key (a series of bits of the same length as the plain data is used to encrypt and decrypt). This is possible because the xor function is symmetric (from what I know).

What are some examples of asymmetric functions? What is the function that you use to encrypt and what is the function you use to decrypt and how do you compute the second argument of the function (the first one being the data you are trying to encrypt/decrypt)?

RSA is about the simplest known instance of asymmetric encryption. There are a few others, but all of them rely on mathematics.

Symmetric encryption is easy (conceptually), because it is just about making a big knot with the data, and remembering how the knot was made; with that knowledge (that's the "key") you can untie the knot, basically by undoing all operations in reverse order.

Asymmetric encryption requires something magical. If you want to go with the knot metaphor, then it is a kind of knot where even knowing how things were tied up does not reveal how to untie them. In cryptographic terms, it must not be feasible to recover the private key (which is the power to decrypt data), even if the public key (the power to encrypt data) is known. Private and public key share a common mathematical structure, since one decrypts what the other encrypts, but that structure must resist analysis.

In this answer, I tried to explain RSA in simple terms. If you want to understand asymmetric cryptography, then you have to grasp enough mathematics to understand RSA. The good news is that such knowledge is not that hard, and it is reusable. So I encourage you to work up your algebra. Basically, you have to get familiar with the notion of computing things "modulo" an integer.


Key Exchange algorithm to be used for REST framework I was required to create key exchange module for custom Rest framework which supports document level security in REST requests.
Framework has its own security module which allows to encrypt parameter entities in rest request when keys available.

I have done some research and found that ECMQV key exchange algorithm can be use instead of ECDH  since it wasn't prone to MIMA attacks.

ECMQV can be used with out prior authentication.But I have seen that MQV has some issues on its usefulness. eg:Its not used in SSL.

My question is,Isn't that MQV can be used to define custom protocol such instance as mine ?

I'm not 100% clear on your question, but I can hopefully offer some guidance:

In general, you should never try to, or have to, create a custom security protocol. It's ill-advised and prone to serious error. Not even the experts trust themselves to do this quickly and/or without a ton of peer review.

Not being familiar with the exact problem you're facing I can simply say this: find out how this has been done successfully in the past with a known-good (secure) protocol, and use that.

Do not try to make your own.


Securing IPC between kernel and user-mode application We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service can get data from the driver and send actions to perform. The communication is implemented using IOCTL.

The problem is, how we should secure this communication, so that no 3rd party software can abuse this.

From the documentation I've learned to set permissions to the device-file, but these are very limited. We can only grant permissions to the admin-group or the SYSTEM account.

The service itself does not need elevated privileges and we therefore don't want to run the service with too much rights (principle of least privilege...)

Our approach now is to create a local user with restricted privileges that runs the service, like it is often done in Linux.

We can also get the user from the IOCTL calls and by comparing them to the expected user, we are able to 'grant' and 'deny' access.

The question now is, is this approach secure? Or does it have flaws we do not see? Because we could not find anyone following this approach.

--edit--

Considerations we have taken (assuming the user's password is secret): as a normal user you cannot pretend to be the app-defined user and therefore you can't communicate with the driver. An Admin/SYSTEM has this possibility (at least the password can be changed). But an Admin/SYSTEM could also communicate with the driver if the permissions on the device are set.

There are ELAM (early launch anti malware) drivers that can launch protected processes. This would probably solve the problem, but right now we would not get the required certificates from Microsoft.

If the service doesn't need to run as any specific user, it should run as its own user or, more accurately, as a service account, potentially a virtual account. Unlike user accounts, service accounts don't need the permission to log into the machine except as a service, but otherwise are broadly similar; you can define access control entries for them in any ACL (including on driver objects), they can have their own private locations in the file system and private registry hive, etc.

There are three built-in service accounts on Windows, though you can also create your own (either through a domain controller or locally). The built-in ones - which are used widely both by services that come with Windows and by third-party services - are Local Service, Network Service, and LocalSystem (pretty sure they aren't case-sensitive; I've seen it written as LOCALSYSTEM and such too). The first two have privileges similar to (but not quite the same as) a normal user account. The last has every privilege a process can have, including some that even the built-in Administrator account doesn't get by default. Of course, these are shared accounts; if a service running in one of these accounts is malicious or gets compromised, it can see and do anything that any other service in that account could see or do.

Virtual accounts are intended to be more convenient than custom-made service accounts, but provide similar levels of security. You don't create or manage passwords for them, don't need to manually create them or set them up for service login, and in general they are supposed to "just work". They are only available on Win7 / Server 2008 R2 or later, though. Starting with Vista / Server 2008, every single service automatically has a unique security identity (SID) that is distinct from other SIDs (such as for users, computers, integrity levels, AppContainer capabilities, etc.). This service SID is based on the name of the service (the actual service name, not the display name; it is in fact possible to get the service SID for a service that doesn't even exist, if you know what it'd be called). In Win7 and later, it is possible for a service to use this SID as a "virtual account" (the service "logs in" to an account named NT SERVICE\<servicename>, as opposed to Local Service or similar).

In the scenario you describe, I would recommend setting the ACL (using SDDL, via whatever framework you're using to create the driver) on the driver's device object so that only NT SERVICE\<servicename> (and possibly the localsystem account, which can override or ignore ACLs anyhow) can access the device. This will work whether or not the service is "logging in" using that virtual account; it will have that SID regardless (a process' security token can - and almost always does - have multiple SIDs). Adding an additional check of getting the calling process' user and comparing it to the expected service account (virtual or otherwise) probably won't do any harm, but shouldn't be necessary (though be sure to write tests, including "negative" tests that are supposed to fail with Access Denied errors!)


Using smart cards for email encryption and SSH Suppose I have a small organization, every user has a recent Macbook Pro, can buy a ~$25 smart card reader on Amazon, and I want to use keypairs where the private keys are on personal smartcards to do email encryption and SSH authentication.

It seems most of these readers are geared towards the DOD CAC or Federal PIV infrastructure. I do not need to integrate with these things - I want to own the root CA or just manually put everybody's public keys in some kind of directory.

What are the different kinds of commercially available smart cards, and what do I need to stick to (or steer clear of) to get something working reliably at small scale using open source software? It seems the many vendors have different implementations and it's not clear how interoperable they are (if it all) outside of their enterprisey Windows-based software.

Basically, I'm looking to do something similar to what the Yubikey Neo does, but with generic cards (ideally having multiple suppliers) and readers. I understand specific product recommendations are off topic, just looking for a rundown on what words to look/search for to find cards that can be used for this purpose.

Terms I've come across:

ISO7816 seems to be a standard electrical interface, but I'm not sure whether this means all ISO7816-compliant cards and readers are interoperable at a software level.
CCID seems to be a standard protocol overlaid on USB for communication with card readers.
PKCS#11 and PCKS#15 seem to be higher-level public key crypto primitives that i.e. Thunderbird can consume from a smart card.

Can I just use any ISO7816 cards and readers compatible with both CCID and ISO7816, or is there more to it then that?

I'm really keen on what the Yubikey Neo does because it has so many open / generic modes (such that I've bought two), including presenting a CCID interface, OpenPGP supporting application on the card, and offering open source and specification U2F support.

I think what you're ultimately looking for is CCID + a card with the appropriate applets. OpenPGP cards may be enough for this.


buffer overflow 64 bit issue I have a problem when trying to overwrite the EIP (basic 64 bit buffer overflow) with an address 0x0000000000400546 which is a function that is located in the same program .. the EIP is at 88 bytes .. so my code in gdb will be :

gdb> r python -c 'print "A"*88 + "\x46\x05\x40\x00\x00\x00\x00\x00"'

I finally get the address modified to : 0x00007fff00400546

Program received signal SIGSEGV, Segmentation fault.
0x00007fff00400546 in ?? ()

Why it is modified with the 7fff in the middle? And how to point to this specific address?

Without knowing the of the vulnerable code I'm going to  guess that the vulnerable function uses a C based string operation like strcpy() which terminates on null byte. Hence your string stops writing after \x46\x05\x40\x00 as it encounters a null byte. This results in a partial overwrite and the 0x00007fff portion of the 0x00007fff00400546 address is whatever value was already on the stack.


Is it safe for a client server to log into a non-trusted server with SSH? I was switching a frontend to use SSH instead of HTTP for the backend, and then it hit me. HTTP is stateless, so I can send requests to a server which I don’t trust. But how about SSH? Isn’t SSH a two side channel communication?

Example:
Server A executes commands on Server B with SSH. Opens, executes and closes the session.

How safe is this for Server A in case Server B gets compromised? Could an attacker potentially use this connection to log back into Server A, executes commands or pull data on the channel?

To resume is it safe for the end client to SSH into non-trusted servers?

It should be as safe as HTTPS, meaning that a malicious server would need to be able to exploit some vulnerability in the client in order to abuse the connection -- which is true for both HTTPS and SSH protocols.

However, you should make sure that you don't forward your ssh-agent to servers you don't trust. A good way to ensure that is to set the following in your .ssh/config:

ClearAllForwardings yes


CoinHive Bitcoin Mining 2 clients (call them Client R and Client B) reported users of their websites complaining about their anti-viruses detecting a trojan called: CoinHive.js. This seem to be a bitcoin mining malware, that starts threads when a user accesses the website to use processing power and generate bit coin.

After a lot of analysis, and after MalwareBytes (and other anti-malware software) scan returned no virus/trojan hits, we ended up downloading the published websites locally and scanning them with Autopsy.

Client R's website returned various hits. Some were false positives, others were straight and plain, the injected coin mining script. What fixed the issue was manually removing the scripts from the files, and deleting the server cache: C:\Windows\Temp

Client B's website returned no hits. But when entering the website and inspecting element, the bit coin mining script still seems to appear at the bottom of the html markup and our Mcaffee still detects it (for some reason it detects it in Internet explorer but not Chrome???).

We also scanned all other websites on the same server and no other website seems to contain the script: we thought perhaps the fact that Client B's website is infected was due to another website injecting the script into it.

I found 2 tools: Anti Web Miner and No Coin but they both seem to have to do with the client users accessing the website and nothing to do with the hosting server.

Where could the script be injected from? What can we try?  Is there some kind of executable or anything else we can look for manually?

Where could the script be injected from? Pretty much anywhere.  It's a web server, so by definition is exposed to the internet.  There may be a compromised device on your network (although that possibility is low).  You could have a malicious administrator.  First step is to start closing down possible vectors for this.

What can we try? I'd start by looking at permissions and reducing them.  Which accounts have rights to that directory?  Who has access to those acocunts?
  Are all accounts tied to a specific person?  Also, this doesn't appear to be a virus - someone or something is altering the web page code.  If it were me, on any internet-facing server I'd put application whitelisting as part of the build process before I allowed that to touch the intenet.  There are also products out that that can protect the directories in question from unauthorized changes and if one is attempted revert them.  That would as a rule of thumb be a good decision to make as well.

If the website administrators don't have 2 accounts (one for normal use and one for administrative tasks on the servers), they should do that.  I worked at one job where the server admins used their normal accounts for server admin tasks.  One of them got a worm on his computer, and it quickly found its way onto our servers.  They spent an entire weekend remediating that mess.  Have a user account that they log into their workstation with and an administrator account that they ONLY use to log in to the web server with.  Then block all other accounts from logging into that server.

Is there some kind of executable or anything else we can look for manually?  Sure there is, but what would it be called?  Where would you look for it?  That's a needle in a haystack.  It could reside in pretty much any location on your network.  Also, if an account with access to that server has been compromised, the parties responsible for this could put content on it from anywhere in the world.  Changing administrator passwords might not be a bad idea there.  I'd think that the server itself is compromised and an entity is doing this and not some executable.

This all depends on how strongly you want to react to this.  It sounds like there's not a lot of cybersecurity experience there and you want to do forensics as well.  I'd suggest engaging with a reputable consulting company to do those and then some penetration testers to find out where the holes are.  sure, it'll cost money; these folks don't come cheap.  But they can help resolve this for you and bring a lot of experience and expertise to the table.


How to perform buffer overflow on non-argument parameters? I am new to buffer overflow attacks and I am trying to do the same on a sample c code which I have.

I have three variables a, b and buffer.
a and b have values assigned to them in the code itself. buffer
interactively takes user input. The value of 'buffer' is not
taken from the argument.
My intention is to overflow buffer such that it will overwrite b with
a desired value. Overwriting EIP or ESP is not the intention here.
With gdb I was able to figure out that if I pass on a certain number
of values it would overwrite the value of variable b.
However I am stuck here as gdb doesn't allow me to type or paste the
ASCII characters which corresponds to the desired value of b. For
example consider 1356 is the desired value. The hex for the same is
0x0000054C. So to overwrite b, I should give in the ASCII of 4C, 05,
00 and 00 in gdb as the last four bytes of the input respectively.
Unfortunately this is not possible.
Another way which I found on web is to pass the hex values using
perl. However this method pipes the perl output to the code argument.
The variable which I am overflowing here takes it's value from user
input while executing the program interactively and not the from the
program argument.

Is there a way to pass hex values to non-argument parameters to perform stack based buffer overflow?

A few techniques to achieve this is discussed over here

Methods 1 and 2 should work outside gdb as well.

Edit:
(The techniques are copy-pasted below to preserve them)

Method #1:

perl -e 'print "A"x48; print "\x1b\x88\x04\x08";' > /tmp/input
gdb ./a.out
(gdb) run < /tmp/input   # voila: GDB reads terminal,
                         # your program reads /tmp/input

Or outside gdb:

$ perl -e 'print "A"x48; print "\x1b\x88\x04\x08";' > /tmp/input
$ ./foo < /tmp/input

Method #2:

mkfifo /tmp/pipe
perl -e 'print "A"x48; print "\x1b\x88\x04\x08";' > /tmp/pipe &
# perl will block, waiting for someone to read the pipe
gdb ./a.out
(gdb) run < /tmp/pipe

This is also usable outside gdb in the manner described before.


Software library for 1-2 oblivious transfer? I'm looking for software libraries that support 1-2 oblivious transfer of a single bit between two parties.

Googling seems to bring up lecture notes, explanations, and research papers but not implementations.

I'd just implement it myself, but crypto is notoriously hard to get right. I don't know nearly enough about, say, generating primes that won't be trivially factored when multiplied together to go down that route.

Normally things are done in this order:

Cryptographers come up with new ideas for algorithms and publish them.
Other cryptographers break them, then fix them again, and so on, until there is an algorithm which can be deemed "secure enough" by virtue of having survived the process relatively unscathed.
A cryptographer with a practical mind writes a specification which tells how to implement the algorithm, minding details like endianness.
A developer follows the specification and writes code.

Sometimes steps 3 and 4 are done in the reverse order: someone writes the code, and only then the specification is written to match the arbitrary conventions that the original developer decided upon (usually on a whim: e.g. you will get little-endian or big-endian encoding depending on what was simplest to do in the programming framework of that developer).

Oblivious transfer is a concept, and actual algorithms are somewhere between steps 1 and 2 right now. So no usable library: if you find an implementation, then it will be part of some research project (a cryptographer using it for research purposes, such as looking for biases and so on), but not an incarnation of a generally agreed-upon "secure" algorithm, ready for the specification step.

Theoretically, oblivious transfer being just an algorithm, it has no value by itself, but only as part of a wider protocol which uses it (and possibly other algorithms) in some way. For anything which looks like production code, you should first find (or define) that overarching protocol, which may use an oblivious transfer primitive, and from the actual protocol structure will depend the actual required characteristics of the oblivious transfer.

In a way, requesting a "library that supports oblivious transfer" is akin to sending a general request for "a combustion engine" without telling whether this is for a boat, a car, a plane or a power plant. It is a bit unanswerable.


Website certificates in different browsers I looked at a certificate of (e.g. stackoverflow) a website and the fingerprint in chrome was different then microsoft edge, so I was wondering how it that possible?
chrome: f67e91c916ce8f5f8aee8abdf99328613dd298a3

edge: 3D:BB:0B:22:63:21:01:3B:1B:6A:2D:9A:FF:5A:84:5B:25:C0:D3:17:49:B9:15:42:EC:50:3A:D7:1A:67:7F:2F

I thought that one might be hex and the other converted to ascii or something ...but converting does not help.

Chrome is showing you the SHA-1 hash of the certificate.
Edge is showing you the SHA-256 hash of the certificate.
FYI, Firefox shows both.  Copied below is a snip of the fingerprints of the certificate for *.stackexchange.com as displayed by Firefox:

Finally, hashing does not involve exponents.  You might be thinking of assymmetic RSA or DH encryption, which involve exponents.


Protecting Passwords Using Short Hash Length Does anybody use deliberately short hash lengths for passwords to increase the chance of false positive collisions in the event of a brute force attack on the database?

When trying to decide on a hash length, my default assumption was "storage is cheap, make it huge". However, in reality since the weakness of a password is often that it's short or easily guessable, no amount of hash length would help users in the case of a database breach.

That got me wondering, does anybody deliberately use short hashes in order to obscure the original password better? If there are only, say, a million possible hashes, you're going to get collisions all over the place. When the application is running normally, it won't let an attacker try more than a handful of times anyway, reducing the chance of a lucky guess almost to 0. If the database is compromised, an attacker is going to be brute forcing and finding all the easy passwords no matter what your hashing scheme. However, if the chance of collisions is high, a brute force is likely to find a password match that the user doesn't actually reuse anywhere else.

I suppose you would need to choose a length that sufficiently protects random input from colliding in a handful of tries while also having a relatively high chance of having multiple dictionary words that match. And maybe that balance doesn't exist.

So my question is: does anybody do that? Is there a name for that?

I'm not aware of anyone doing this, currently or historically.

I see what you're getting at -- resistance to password discovery -- but increasing the likelihood of collision as a way to mitigate offline attacks is of dubious value. Any potential benefit of doing so is outweighed by the drawbacks:

If a specific user is targeted, unless there were many collisions, it would be easy for the attacker to try all of the collisions against another site or leak until they got a match ... which would confirm the real password and cancel out any benefit from the collisions.
As the number of collisions goes up, the risk of an online false positive for authenticating (with the original site) goes up.
This also means that the trustworthiness / nonrepudiation of the authentication is reduced. Someone else other than the user could (theoretically) log in as the user, without the user's actual password. Usually, the risk of this is effectively zero in the real world when using a sufficiently collision-resistant hash function. But by deliberately seeking out collisions, it could be argued that you are not following the best practices that ensure nonrepudiation in practice.

Instead, you can get a lot of the benefit you're looking for simply by storing extra private material (an encryption key or a pepper) in an HSM. If implemented properly, this would get you some real resistance to offline attack - without the drawbacks of frequent collisions.


What prevents ISPs from tracking chain of proxies' (or Tor relays') IP addresses? I searched all over the internet for the answer for my simple question, but couldn't find anything useful.

I already know that police have to access PCs used as proxies or Tor relay nodes to read logs (if there are any) in order to track down original IP address. Also Tor prevents my ISP from finding out what website is accessed and data transmitted, but exit node still knows the website accessed.

So, what prevents ISP from seeing IP address of the first relay I'm connected to?

Similarly, what prevents other ISPs of each Tor relay nodes/chain of proxies to see where they route traffic to and from, even when they are located in different countries?

What stops authorities to contact those ISPs for that information and just connect the dots? It won't give them the data transmitted, but they will know which original IP address was connected to what website/server at specific time over Tor network/chain of proxies.

I hope I described my question correctly.

So, what prevents ISP from seeing IP address of the first relay I'm connected to?

Nothing. This is the whole point of Tor: this is part of the security model and it doesn't matter that your ISP can see you talking to a Tor node.

  Similarly, what prevents other ISPs of each Tor relay nodes/chain of proxies to see where they route traffic to and from, even when they are located in different countries?

There are two questions here, and one is a legal one which I will ignore as it's off topic here. On the technical side, the idea is that Tor nodes are continuously forwarding traffic for a range of other Tor nodes, so the traffic all gets mixed together and you can never be sure which nodes are initiating a new connection to a new endpoint, and which ones are just forwarding someone else's traffic, or at what point in the chain a node is for a particular conversation. Even if you analyse the traffic, you can't read it, as it's all encrypted in a way that prevents even the individual nodes (apart from the exit node) knowing what the destination is. The exit node itself knows the destination of the traffic, but not the source. The intermediate nodes only know who sent them the traffic and where they should send it next. So, at any point no node knowns both the sender and the destination (and message).

  What stops authorities to contact those ISPs for that information and just connect the dots? It won't give them the data transmitted, but they will know which original IP address was connected to what website/server at specific time over Tor network/chain of proxies.

Same thing as above, mostly. Nation states, however, do sometimes have the capability to identify Tor traffic flow using packet shape analysis. The idea is that you can look at the size of traffic from one person, and look for another outbound packet from the relay that roughly matches the size, all the way to the target. This requires the traffic of all nodes in the chain to be simultaneously monitored, which is quite difficult even for a dragnet solution like PRISM. It's also made harder by the fact that lots of people are passing data between individual Tor nodes, so there are so many packets being sent/received that the "shapes" of the conversations in terms of packet size are obfuscated by the volume of other traffic.


How can I extract the encrypted master key from LUKS header? I know that a LUKS partition has a plain-text header that stores many informations like master key (MK) digest, MK iterations of PBKDF2, information about the 8 key-slots etc. I also know that in the header there is the af-splitted and encrypted master key.

I'm asking if there is a way to recover that. I know I could simply use:

cryptsetup luksDump --dump-master-key /dev/whatever

However, this only give me the decrypted MK.

Only information I have are from header:

key-material-offset: 8 (start sector of key material)

number of stripes: 4000

My goal would be to manually decrypt the master key with the derived key from pbkdf2, do af-merge and then decrypt the whole data bulk with this candidate key.

It looks like this is what you want. It creates a copy of the header, without making any assumptions about the header size.

# cryptsetup luksHeaderBackup /dev/sda5 --header-backup-file /tmp/luks-header

But I'm not sure if I 100% understand your question. Are you asking how to extract the LUKS header including the master key, or just the encrypted master key and nothing else?


Is there a name for using a web site email feature to harass someone or the site? The scenario is that a website has a password recovery feature: you enter your email and if you have an account with that email, it sends you a recovery link.

But then someone writes a script that requests a recovery every 5 seconds all day long and gives someone else's email to:

harass that person
waste site resources sending emails
get the site blacklisted as a spammer
other unpleasant consequences

To be clear, the attacker doesn't compromise the site, but just causes grief of different kinds via that site emailer channel. Does this have a name?

As far as I know, the attack that you described is known as "Password reset email spamming", "Password reset email bombing" or just simply "email flooding".

Taking the definition from Techopedia:

Email Bomb:

  An email bomb is a form of Internet abuse which is perpetrated through
  the sending of massive volumes of email to a specific email address
  with the goal of overflowing the mailbox and overwhelming the mail
  server hosting the address, making it into some form of denial of
  service attack.

  An email bomb is also known as a letter bomb.

Also the definition from Cloudmark Security Blog says:

  DDoS attacks are not limited to websites. We are currently seeing some
  email inboxes being attacked by being inundated by blog forum sign up
  confirmation and password reset emails. A DDoS attack on an inbox is
  known as mail bombing, and it is a technique sometimes used by cyber
  criminals to cover up a more serious attack.

I also include two links where both terms mentioned before are used in a similar attack to the one you described, these attacks were reported on www.hackerone.com as part of a bug bounty:

password reset email spamming
The email API to reset password is unlimited and can be used as a email bomb

If you want to read more about this attack, I include some extra links:

Cloudmark Security Blog
The Return of Email Flooding
If you start suddenly getting email/spam "bombed" there's probably a reason
How Email Bombing Uses Spam to Hide an Attack
OWASP Periodic Table of Vulnerabilities - Insufficient Password Recovery
mail bomb
Reset password - should I prevent abusing it?


How can someone use my phone to make an outgoing call and have it show up to network provider as my number that made the call? I made a call to co-worker this morning. While I was talking the call disconnected. When I looked at my phone it was making a call to another number, which I did not recognize. I let the call connect and a recording came on saying, in effect, that "it was not a working number". I called back my coworker and explained what happened. I researched my at&t online account and it shows the call as an incoming call from my coworker BUT he did not call me, I called him - both times. The phone number that kicked me off my original call shows up in my phone's call history list as an "outgoing" call but shows up in my online account calling history as an incoming call from my coworker. How does this work?

There are many reasons this could have happened but there is one primary that springs to mind:

Error on Provider Network causing the disconnection and an erroneous forwarding and recording instead of a proper reconnect

This isn't that uncommon, especially during maintenance windows. It is however always startling.

Basically what happened is that you changed communication points. Usually during these times you're handed off without interruption in service by being forwarded to the new point. It's why you can make a call and it will keep in contact as you cross points.

However every now and again you make a call and the forwarding logic hits a hiccup, and instead of being forwarded correctly your phone's link to the point has gotten confused and it thinks it's supposed to make a call.

In the cases the dropped call is seen as received because the call received a forward notice... that instead initiated the call out.

To be certain though you should DEFINITELY call and confirm this was the problem with your provider. The main reason we can come to this conclusion however is that your records show and incoming call when it was actually outgoing on one record, but the correction on the other. This shouts carrier error but it's always better to get an authoritative answer form the source.


How to obtain privacy and authenticity with DNS? I use pfSense (Unbound) as my local resolver. Historically I've pointed it at root recursive resolution, because I perceived my main threat as trustworthiness and recency of data (poisoned/invalid DNS) and local ISP DNS tracking. (I don't know if that's so, but I felt that a root DNS server overseas might be less connected to me personally and have less interest in any queries I generate.) I mainly use IPv4 which may be relevant.

With all the attention on DNS tracking, some concerns and perceptions have arisen:

Should I use some kind of DNS encyrption or signing method, for privacy/certainty? I'm not using DNSSEC or any other extensions, so my DNS queries are "in the clear" plain text. They are watchable between here and the various DNS servers, and there's no certainly over manipulation "on the wire" (less likely but noted). But what to use and how far will it help, as it's not supported by everyone.
Should I use an external resolver instead of querying root servers? I'm querying root servers from the start, so I'm issuing many queries from root servers down to the actual subnet of interest, instead of using a precached entry on some existing DNS resolver/cache. But each DNS server only sees one component of the domain, they don't get to see the entire target. If I use an intermediate resolver, especially one with signing/encryption, I issue far fewer DNS requests and what I do issue would always be encrypted and signed. But it requires a chosen intermediary with considerable trust (caching etc), and doesn't affect the risk of interception.
Should I route DNS over some kind of anonymising proxy? It's slower for first requests, but Unbound would cache any replies locally and also request refresh data in advance of the cached data expiring, and I'm guessing the 80/20 rule applies (most queries will be to the same subset of domains where I already have cached data), so I'm not too worried about the speed aspect. But how practical is this? The most prominent anonymising method is tor. Tor doesn't do UDP so it handles DNS by asking the exit node to do a DNS query and trusts the result. I could configure Unbound to query DNS over TCP only, and route via local tor, if that would solve it (= if most exit nodes will allow port 53, and if most DNS servers speak TCP). I'm also happy to run a DNS anonymising node if there is a tor equivalent specific to DNS, if it will help others (this might let me merge my traffic with general DNS queries) but does such a thing exist?

So my current risk model is probably something like this -

Poisoned/invalid data;
Logging/monitoring at the server(s), and modification/monitoring "on the wire";
Tying queries to source IP / DNS anonymisation.If I don't use DNS proxying/anonymisation, then there's only 2 options.  I can resolve everything myself from root servers down, in which case I trust every DNS server on every domain not to log queries which is unlikely, but identifying query targets is less easy since the resulting subdomain queries are very widely distributed. If I use a public resolver I place "all my eggs in one basket" as they see the entire target domain, not just parts of it, and I'm trusting them not to be logged which may also be unrealistic. So DNS anonymisation seems necessary, but it's not clear if it's realistic.

I'm happy to put in the work to resolve this, and I'm sure I can improve on what I'm doing. But workarounds will be needed, since DNS is fundamentally insecure.

Given the current state of DNS and the current state of anonymising technologies, what is my best approach to threat mitigation for DNS queries?

In short, either install a DNSSEC enabled resolver with QNAME minimization (RFC 7816) on your computer or use DNS over TLS (RFC 7858) towards a remote server you trust/control.

Now in more details, as the previous setup caters for different cases, and can also be combined in some way.

First DNSSEC is not something that you can just use on your side to be applied everywhere, and it is not something that will help for privacy. For zones that are DNSSEC enabled (that have signatures), if you resolver validates them, then you have the guarantee of authenticity (you could not get fake data) and integrity (things could not be changed or downgraded).
This is useful and solves some issue but:

not all domain names are DNSSEC enabled, far from it even
it does not prevent anyone reading your DNS traffic as it remains in clear, both the request and the replies

So if you do that, you must trust your ISP or anyone on the network not to sniff your traffic. Anyone will be able to watch your DNS messages, and alter the one not DNSSEC enabled.

The other option is to connect with TLS to some remote DNS server that speaks this new protocol. This gives you two benefits:

noone will be able to snoop, nor change, your DNS messages as they are all protected by TLS, and this applies to both DNSSEC and not DNSSEC enabled domains
the authoritative nameservers you query will only see the other nameserver IP and never yours.

Of course a poor man's alternative would be to do an IPSEC or SSH tunnel, to get almost the same benefits, however not without some complexities, as you need to handle both UDP and TCP. Or a SOCKS proxy. But since DNS over TLS is a standard now (at least a RFC) it may make more sense to pursue this way instead.

I said you need to trust/control this remote DNS server because obviously it will see all your DNS traffic. So it depends on you to define who you can trust or not. Some public open DNS providers do also provide DNS over TLS nowadays, for example CloudFlare: https://developers.cloudflare.com/1.1.1.1/dns-over-tls/ but you can find many other ones here: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers

If you need to use such nameservers that you do not control completely, some may advise you to set things up in such a way that you use multiple ones and that you spread your queries among them, so that no single one could reconstruct your whole DNS session. A little more complicated to put in place as this is not the standard way a list of nameservers operate by default.

As a side note, the standard of DNS over HTTPS is currently cooking and should arrive "soon". I guess that many providers will offer this service, so you will have the same dilemas as today with VPN providers
(who to trust, etc.)

Also you said "But each DNS server only sees one component of the domain, they don't get to see the entire target." which is wrong in practice today. The protocol allows that but for various reasons since no one remembers when, the recursive nameservers were sending the whole name (each label) to each authoritative nameserver at each step. It is only now with QNAME minimization standard (RFC 7816) that resolvers can do the traversal by sending only one label each time. This is not without problems, as some nameservers do not cope with that (hence some recursive ones implemented a fallback strategy: first try with QNAME minimization and if it fails start again with full name as before)


Should network firewall rules be secret? At my workplace only the security team have access to see the rules on the server network firewalls.

Developers and system engineers don't have any visibility, so they just deploy applications to servers and find out what's broken rather than checking application requirements against the rules in advance.

Is this kind of secrecy a normal/valid security practice?

It is normal that the only people with access to view and review the network rules are the network engineers and the security team.

The development team should know what ports and protocols are required to use their applications and work with the networks team to ensure the appropriate rules are in place. If there are standard ports in use by other applications, these might be re-used. Otherwise, when making changes for testing or deploying to prod, the applications team (or product owner etc) should coordinate with the networks team. The security team should be reviewing the change request to ensure no vulnerabilities are introduced.


How Dirbuster find the files within a directory? (Differentiating between files and directories) I am writing the python code of DIRBUSTER tool in kali linux but I got stuck at finding files that lies within directories. So my question is how can I differentiate between Files and Directories while bruteforcing the directories recursively?

This question has been asked a few times- here and here- within the general SO community. From what I can gather, the synopsis is that you cannot tell the difference between a file and a directory, at least without some fu, and even then there is no guarantee.

This answer provided the most promise, and in summary states that you should just check for the presence of a file extension. And though this does not guarantee that a file extension will be present, it likely covers many use cases.


How can I ensure that default passwords are no longer in use? There are two situations in which 'default' passwords get used on a network:

A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial password.
A new piece of hardware is deployed. In its factory state it has a default admin password so you can go in and configure the hardware.

How can I check for these default passwords still being used on my network, and enforce that they get changed?

So much depends on context - see @nealmcb comment.

If it's for an operating system, most OS's these days offer a setting for "change on first use"

If it's for an application you control, don't provide users with a default password - generate a unique password for them which expires on first use.

If it's a device shipped from vendor - trickier, unless you can persuade the vendor to do this for you.

In summary - various different options, but you need to place the question in context or you may not get useful answers. See the "what background" section in the faq.


What happens if my ISP gives me an IP address that's already being used Like the title says, what happens if my ISP gives my connection (by accident/on purpose) a public IP address that someone else is currently using to browse the web or send an email or pay his bills?

More importantly, what are possible exploits (for me, the other guy with the same IP, a third party maybe) and how are they prevented?

Also, is there any difference with IPv6 vs IPv4 related to this question?

Of course I'm just asking out of curiosity :)

The primary problem in this case is not a security one first and foremost; this situation creates apparent packet loss, as the link layer protocol mapping for your IP address will typically change between you and the other node according to the action of a race condition and much traffic will not go to the requestor.  Of course, this does all depend on the link layer.

It's certainly possible that you would see some of each other's traffic, and if you were malicious you could certainly dump it.  Of course, you would probably not get all of it.  However, this is no different from viewing traffic in transit through a mirror port or by getting it out of a router or something - it wouldn't make it any easier to break the security of SSL sessions, for instance.  So, even if this happened (and it would indicate severe incompetence on the part of the ISP), I would not expect an actual security breach unless I wasn't encrypting things.

You'd also see the return traffic of the other person, but not what they send.

In practice, when there are duplicate IPs like this on an ethernet and the nodes do not detect and handle the failure, it's basically impossible to complete the TCP 3-way handshake (let alone negotiate a TLS session) and the connection looks to be extremely poor or entirely down.

Most differences would be as a result of the link layer and how it maps link layer addresses to network addresses, and most security differences would be a function of the application layer protocol being used and whether IPsec is in use.  In IPv6, since you are assigned a prefix and that is what would have to conflict, the consequence would be almost identical except that there isn't likely to be anyone on your network with the same IP as the misdirected packets are destined to.


Is inserting url parameters directly into the page safe in angular 2+? So the other day at work I noticed this code in one of our web apps:

this.activatedRoute.params.subscribe(params => {
    this.a = params['b'];
});

and then in the HTML:

{{a}}

So basically if I navigate to http://example.com/lol the string "lol" will be inserted in the page. My intuition tells me that this is not quite right since you can potentially inject malicious code into the url, but so far I've had no luck doing it because either the url doesn't get matched properly or angular just inserts the parameter as plain string in the page so that it's not interpreted by the browser.

Is there absolutely no way for an attacker to exploit this?

As stated on angular's security page, interpolated content is always escaped. Unless the application explicitly marks the content as trusted using the DomSanitizer or there is a vulnerability in angular, there is no way for an attacker to exploit this.


SELinux ignoring /etc/sysconfig/selinux directive I'm running SELinux on CentOS 6.5. In /etc/sysconfig/selinux I have set SELINUX=permissive. But everytime the system starts, sudo getenforce shows SELinux as Enforcing. What could be causing it to go into enforcing mode?

sestatus shows the following:

SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

Do sestatus and see what it says for "Mode from config file". If it says "permissive" there, then something else sets enforcing -- either during the boot-up process, or via the kernel command line (look for enforcing=1 in /etc/grub.conf).


Buffer Overflow EDI but not EIP Is possible to exploit a program if you can only overwrite ESI or EDI register without EIP?
Program in question does seg fault and overwrite EDI, ESI and ECX but can't get it to overflow EIP. Anyone know why?
Thanks, Tom

Almost certainly, but it may not translate to a reliable exploit. As you are controlling ESI, EDI and ECX you are most likely controlling a byte copy operation and I'm assuming the crash is caused because you're trying to read/write to an address like 0x41414141.

At worst you can hard code some addresses where ESI points at the start of your shell code, EDI points to the next instruction address (EIP+opcode bytes). ECX should be the length of your shellcode. This will overwrite the next series of instructions with your shell code.

For a more reliable exploit you would have to do some more analysis on how you ended up controlling these registers and what code paths are available depending on what you point these registers at.


Why would a heap buffer overflow cause a crash on only some Windows 10 systems? I have a stl::vector (VS 2010 SP1, x86) out-of-bounds read access attempt that causes a crash on only three Windows 10 systems.  It is completely reproducible on those systems, but cannot be reproduced on other systems (Windows 10 or otherwise), using the exact same executable and data files.

What security protections could be in place on those three systems that detect the violation, or why might it not be occurring on the other systems?

The errant software is in a C++ static library that is running from a .NET (managed) executable.

As someone already pointed out: Don't expect undefined behavior to be reproducible.

That said, there are a lot of variables. Of course there are the obvious ones (like CPU architecture / 32 bit or 64 bit mode; exact versions of the OS or other software involved (like .NET); etc.) but there also are the more subtle ones. Like how much memory the process is given at a time when it asks for some or even how much it asks for at a time.

So if you check how much virtual memory the process has on different machines before crashing, and the numbers are different, this can be a good reason for it crashing on one system but not the other.

How much memory the process is given at a time can depend on a lot of different factors like how much physical memory is available, how much swap space is available, which swap strategy is used, how the memory is currently allocated, etc. If you tested it on a machine with 16 GB of ram 10 times with it currently using 1 GB of ram for the OS and other applications and the process not crashing, you didn't really reproduce that behavior reliably. You kept the variables relatively constant. It might very well crash all 10 times on a machine with the exact same software but only 4 GB of ram and using 3 GB of it.


Steganography CTF question I have recently participated in a CTF competition and failed in the following stage where the solution was never revealed.
After a really hard job I got access to a text file that contains a really strange set of letters which should guide me through the next stage.
Some of the text is:

OOOMoOMoOMoOMoOMoOMoOMoOMoOMMMmoOMMMMMMmoOMMMMOOMOomOoMoOmoOmoomOo
MMMmoOMMMMMMmoOMMMMOOMOomOoMoOmoOmoomOoMMMmoOMMMMMMmoOMMMMOOMOomOo
MoOmoOmooOOOmoOOOOmOomOoMMMmoOMMMMOOMOomoOMoOmOomoomOomOoMMMmoOmoO
MMMMOOMOomoOMoOmOomoomOomOomOoMMMmoOmoOmoOMMMMOOMOomoOMoOmOomoomoO
MoOMoOMoOMoOMoomOoOOOmoOOOOmOomOoMMMmoOMMMMOOMOomoOMoOmOomoomOomOo

Any ideas of what I can do with it? I am really interested in learning new things and knowing how this should have been solved

It appears to be COW.
COW programing language

The COW programming language is an esoteric programming language
created by Sean Heber in 2003. It is a Brainfuck variant designed
humorously with Bovinae in mind. COW has twelve instructions (four
more than Brainfuck) and is Turing-complete. Most instructions are
moos, only the capitalization varies: mOo, moO, mOO, Moo, and so on.
MMM, OOO, oom and OOM are the exceptions. All other character
combinations are ignored and treated as comments.

Here is Javascript Interpreter for COW, COW Interpreter
Your sample translates to "t", just the letter t.


Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule) I have the following rule:

alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; within:100; classtype:trojan-activity; sid:1000001; rev:1;)

The header and general options are not the issue - it's the payload and non-payload options that are throwing me off.  My understanding is that this rule should only fire under the following conditions:

There is an established session (flow:established)
Trigger on client requests from $HOME_NET to $EXTERNAL_NET (to_server)
Content includes 'GET'
'GET' within 4 bytes of the beginning of the payload
Content includes 'Set-Cookie:' within HTTP headers
'GET' and 'Set-Cookie' are within 100 bytes of each other

This is version 2.9.1.x.  The http_inspect preprocessor has been modified from default but I don't think this is the problem.  So, I'm wondering how this rule fires on traffic that doesn't have 'Set-Cookie' coming from the client (Set-Cookie should only come in a server response whereas Cookie should only come in a client request).  Maybe I'm going down the wrong path my research revealed that Snort uses Boyer–Moore string search algorithm (http://en.wikipedia.org/wiki/Boyer%E2%80%93Moore_string_search_algorithm) which matches "...on the tail of the pattern rather than the head...".  So in my case, is the rule firing on client traffic that includes a cookie since it would see 'Cookie' (which is a part of 'Set-Cookie')??

I didn't write the rule and the person who did is unavailable.  I need to understand why this is firing on traffic that in my eyes does not match what the rule is looking for.  Is the rule written incorrectly to capture $HOME_NET (client) traffic to $EXTERNAL_NET (server) that has 'Set-Cookie' HTTP header set?

Thanks for your time and feedback.

Boyer-Moore isn't the problem.  Snort should match the entire string, always.  It doesn't make sense to have the "within:100" in the second content match because http_header is a completely different buffer.  That should be removed.  But that doesn't explain why this would alert if the content wasn't in the original packet.

Do you have a pcap of traffic that trips this?

Thanks,

~Patrick


Security of an IoT network using AES (LoRaWAN) I am studying the security of LoRaWAN. Here is a simplified architecture of the network:

As you can see, there are two keys:

one for the network security (no mitm, no modificatiof the messages). It uses an AES 128 bits key to generate a MIC (Message Integrity Code) for each message.
one for the end-to-end (application to application) ciphering of the payload. This is also an AES 128 bits key.

So there are two static keys which are stored in the device and in the gateway. I guess that the security is pretty good, but only until one of the key is compromised. With a device that is not under surveillance (for example in the customer home), it could be easy to duplicate the key.

Another problem is that in case of a compromission, it is impossible to change the AES keys on the device (considering there is no secure out of band channel).

Is my analyze correct? Are there other security flaws I haven't seen? (probably yes) And what could be an amelioration for a developper (like integrate an and-to-end asymmetric ciphering)?

In case, here are the spec of LoRaWAN.

You are correct that once the session keys are compromised, security will be ineffective. This the case in any system. However, there are number of good practices to improve security in LoRaWAN. It's too involved of a topic for a short answer, but here are some good practices:

Use OTAA provisioning where the keys/certificates are dynamically negotiated
between a device and the Network and Application Servers for each
session. Then, force network rejoin in the device periodically to
change session keys. This is in contrast to ABP provisioning method which
permanently sets both session keys, leading to vulnerability you pointed out.
If using ABP method, make session keys unique to each device. If one gets compromised, others are unaffected
Use a secure hardware element in a device to store the security credentials. This will make it very hard to reverse-engineer the keys by scanning device memories. Additionally, use secure boot to ensure integrity of device firmware.
Add additional layer of encryption and authentication at the application layer. You could use asymmetric keys which can be very effective.
Always enable uplink/downlink message counter checks in the Network Server to prevent replay attacks
You can use your own private network server and/or application server with own gateways to prevent unauthorized access at the cloud level

If you follow the best practices, you can achieve a system that is very hard to hack.
LoRaWAN was designed for hardware-constrained devices, so it had to balance many tradeoffs. Also, keep in mind that most applications are for sending data from distributed sensors to the cloud, not for controlling ATM cash dispensers. For typical applications, it's an easy to use, cheap, and effectively secure solution.