Was TRESOR integrated in the Linux kernel? If a computer is switched off, the data can stay in RAM memory for a while; decaying over about 5 minutes. This can be made longer by cooling the chips:

https://citp.princeton.edu/research/memory/media/

This makes it possible to do a cold boot attack on cryptographic keys.

There is TRESOR which stores the secret key inside CPU registers rather than in RAM.

Although if people would use FDE with ex.: LUKS, the "password/key in RAM in plaintext" could be still an issue.

Can TRESOR or a TRESOR-like solution solve these problems (?) or does it introduce new ones?

The Question: Was this method (encrypting RAM and store the key for it in CPU?) integrated in the Linux kernel? Or is it just not enabled by default?

No, TRESOR was never integrated into the Linux kernel. It is specific to the x86 architecture, and requires AES-NI in order to not have a pretty nasty overhead. Due to the limited size of DR registers where the key is stored, it cannot store and precompute round keys (a common AES optimization), and thus must recompute them every single time. This isn't much of a problem if you have AES-NI, but it can be a pain if you don't. Linux devs don't like adding a feature that's a hacky workaround to a specific forensic technique applied against a hardware bug, especially when the mitigation only works well on newer x86 CPUs with AES-NI.

In addition, it prevents setting hardware breakpoints. Now, people usually set software breakpoints when debugging, because you can only set a maximum of 4 hardware breakpoints at a time, but some people cannot use software breakpoints because of the lower performance. TRESOR, because it uses all DR registers, requires the kernel tell userland that the number of DR registers is 0, and block all access to them for security reasons.

Regarding whether or not it solves the problem of cold boot attacks, the answer is partially. It completely mitigates the issue of stealing encryption keys from memory, but it does not encrypt the rest of memory. If you open a super secret file, it will stay in your page cache for a while. If your system is cold booted right then, the majority of your disk may be protected, along with your AES key, but all the files in your cache, including that super secret file, are exposed. The same goes with the rest of the data in RAM, like pages open in your web browser, etc.


What should I do if I get no response from a security mailing list I reported a vulneratility to? Two weeks ago I reported a vulnerability to a security mailing list of a large open source software organization. I provided details of how to reproduce the issue and the exact place in the code where the bug causing the vulneratility is. So far I didn't get any response on that yet. I also wrote to one of the main developers asking if he was made aware of the issue. So far there was also no response from him.

The component the vulnerability is about hasn't been released for years, though there is still some developement going on and it is still widely used.

Is it normal for feedback to take that long? What shall I do about it?

Sometimes you never get any feedback at all. It's just part of the game. It could also be a case of lots of people passing it over as "it's not their job to to look at this issue/component " in fact it's possible that nobody is working on that specific component anymore ..

P.s. I assume you got a cve number and included it with the report ?


Crackstation "Secure Salted Password" Java example - is it really secure? I'm making an auth service so I've been looking for some good Java/Groovy implementations of password + salt hashing. I've found this article on crackstation along with a code example and decided to make it mine. First thing I noticed is SHA1 and only 1000 iterations so I changed those to SHA256 and 90510(still have to test the performance on the server and perhaps increase it to at least 100k).

One thing however kind of struck me. The result string is "[iterations]:[salt as hex]:[hash as hex]". Why are iterations added to the result? Wouldn't that be insecure? Wouldn't that be akin to giving away a piece of the key? Or am I just too paranoid.

I have removed it, but I'm wondering why is it there? What is the purpose of showing that? In case the default number of iterations changes? Should the number of iterations be randomized to a degree?

Much like the salt, the iteration count isn't expected to be kept secret from attackers.  It does make the job of attackers slightly more difficult if they don't know the iteration count since that adds one piece of info they have to find elsewhere.  But that generally isn't expected to be a hurdle that they are unable to overcome.

By storing the iteration value alongside the password you make it easier for the iteration count to be updated on the system while still supporting the existing passwords until they can be changed.  Your password checking routine always knows the appropriate number of iterations to try when matching a password hash for each particular user.  Otherwise you'd have to try to accommodate different past and current possible iteration counts within the password checking code.

Randomizing the number of iterations doesn't really add much value since attackers aren't limited to cracking tools with hardcoded iteration counts or using precomputed rainbow tables with a certain number of iterations.


Printer Driver Threats In an environment where users connect their devices to printers through USB, the device will be prompted to install its driver if it's the first time. As far as I'm aware for OSX, the drivers are downloaded from Apple and you can't download without internet connection.

For example, this huge 100MB driver: http://www.support.xerox.com/support/phaser-6700/downloads/enus.html?operatingSystem=macosx1010&fileLanguage=en&x=16&y=5

What privileges & capabilities does the driver have on the users machine when installed?
How are drivers registered to this Apple repository (Equivalent for Microsoft, etc)? How are driver modifications handled & pushed?
Can the printer be modified so that the device is requested to download the wrong driver? (eg for a different model printer, although still from Apples repo)? Can the printer protect the integrity of which driver it requires?
How can someone analyze the driver and effectively reverse-engineer it to understand what it's doing?
Is there existing, open source printer drivers that can be installed to eliminate this threat model entirely?

Hypothetical threat: A printer is purchased, and modified to become non-existent model ABC1. A malicious driver that is then created & registered as a publicly available driver for a 'legitimate' printer model ABC1. This implanted driver is then used for ______, either on connection to the printer in future or LAN or otherwise.

First I'm not very familiar with details about MacOS, so I can't say anything to your 2. point.

For clarification, I assume there is an attacker who (somehow) succeeded in registering and uploading a malicious driver to the Apple repository which is assigned to the imaginary printer model ABC1. And the attacker has some real modified printers (any actual model) which tell connected computers they were of the model ABC1.

About 1. Hardware drivers, assuming the proprietary drivers are USB drivers, usually run at elevated privilege level (kernel mode), which allow them to do nearly everything with your computer, once installed and active. This includes but is not limited to accessing and modifying your whole file system content, recording your keystrokes and monitoring your network traffic. It would be a kind of Rootkit.

About 3. Yes and No, well thats more than one question. First, a USB printer can't actually request your OS to download anything. It is connected via a UBS connection (as printer) and is communicating with your OS per data packets. It's a bit like a network connection. But your printer tells the OS which model it is, and with this information the OS can download an appropriated driver for the printer. So an attacker has just to play the Man-in-the-middle in the USB connection and send a different model number to the OS.

To the second part. The nature of USB, which is exchanging small data packets, does not allow e.g. a printer to simply verify the identity of its communication parter, here the computer. This especially includes things like verifying the binary of the printer driver. There for could neither the printer nor the OS ensure that there is not a Man-in-the-middle attack as described above.

About 4. Well, I'm not an expert in revers-engineering, but you can always analyze a given binary program. However, this is usually a long, difficult and tedious work especially for bigger binaries. But beside the actual reverse engineering there alternative methods like Black-box testing which try not to understand the whole binary, but to observe what it actually does.

About 5. AFAIK. USB itself defines an primitive interface how to print with a USB printer, but it requires additional information. However, the printing system of the OS like CUPS in Linux and MacOS have some support for generic models available which could do the job. But a printer might have additional features like an integrated scanner. Those features won't work without the proprietary driver.


How can I decrypt a file with gpg to screen and not write to disk? I currently use a script to decrypt a file, but it writes it to disk. I then use wipe to clear it. Is there  a way to write it to screen so it never writes it to disk?

I use the command $ echo PASSWORD | gpg file.txt.gpg and it creates a file.txt. Then I use wipe to erase the file. Can I extract it to my screen or tmp file system and use more/less to view it?

I know I can create a script to build a tmp file system, then decrypt to it, then view it under /tmp/ramdisk. I could just delete the tmp/ramdisk, but I was sure there was a program or a method to view it one time only to tmp ram system.

All you need is the -d option to gpg:

gpg -d file.txt.gpg


How to deal with low-probability high-impact risks? There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this:

There is a type of attack against our systems that can cause a lot of damage if missed or not addressed properly. More precisely, this could cause a major blow to the company's operations and potentially ruin the entire business.
The probability of such an attack is very low. Nonetheless it does happen to other companies in the field regularly (however rarely). It has not happened to our systems yet.
In order to be able to mitigate the attack, we must hire another employee and spend an additional 8% (at least) of our budget every year. Both of which are significant investments.
Usually we gauge such problems by multiplying the probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to infinity to come up with cohesive answer.
Along the same lines, our team in divided into two camps: one thinks that the attack will never happen and the investment of time and money will be wasted; the other camp thinks that the attack will come tomorrow. Everybody agrees, though, that half-assed measures will be both a waste of resources and will not protect against the attack – we either go all-in or don't bother at all.

As the team leader, I see merit in both opinions – we may operate for the next 20 years without encountering such an attack, and we might have it today (out of the blue, as it usually happens). But I still have to decide which way to proceed.

In that regard, I would like to ask you whether you encountered such puzzles and what is the industry's approach to dealing with them.

Now usually we gauged such problems by multiplying probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to infinity and come up with cohesive answer.

Unfortunately this is what you need to do in this case. But I don't believe that this calculation is really as difficult as you make it out to be.

The risk can be estimated by first estimating how many companies face the same security threat and don't take the necessary precautions. Then you skim the news reports to check how many companies get affected by it each year (plus an educated guess how many of them managed to prevent the mess from becoming public). Divide the second number by the first, and you have a risk percentage.

Your damage does not tend towards infinity. The event which would come closest to "infinite damage" would be a collapse of the entire time/space continuum of the universe (and even that's an event where you could make a fermi estimate to quantify the damage in dollars, if you are bored and interested in astrophysics). The highest damage you might be able to cause realistically is bankrupting your company. Maybe you could cause even more damage if you also account for damages caused to other people. But when your company is bankrupt, it can't pay those liabilities. So you can use the net worth of the company as the upper limit of your expected damage.


Is HTTPS redirecting to HTTP a vulnerability? Let's say a user is authenticated, and the entire account authentication process happened under secure HTTPS.

Upon successful login, the user is redirected back to the homepage. However, the homepage contains links within the website which do not have SSL enabled - basic HTTP.

For example:

https://example.com
https://example.com/login
https://example.com
http://example.com/foobar (no SSL)

Is this a security vulnerability, and if so, what severity? If not, why? Aren't the cookies unsafe when going from HTTPS to HTTP?

In terms of browsing security/privacy, any time you are over http, your traffic could be (and often is, see cache discussion below) intercepted and fiddled with by servers along the way.  Period.  You can't be sure if the page you see over an http connection is in fact the page that the webserver sent in response to your web client's request.

As far as session hijacking, the answer is a bit more complicated.  The concern would be that you type your username and password over an https connection, and the server then sets a cookie on your browser that identifies you.  That cookie will be sent back to the server by your browser with each subsequent request for pages, and the server will thus know that it is you asking for the pages.  The concern is that somebody along the way was listening and copied that cookie.  They could then send requests to the same website using your cookie, and the site would think it was you.

The Set-Cookie header has a secure flag (see here) which can be turned on when the cookie is originally given to your browser.  If this flag is set, the web client will not send the cookie back to the originating domain except over an https connection.

It would be possible for a site to, say, have two authentication cookies, one of which is marked secure.  That way, anytime you want to do something really sensitive you are required to have the secure cookie, and are thus redirected to an https page.

In that case, the site designers have to make a per-page decision as to what is "really sensitive" and what is not.  The scope for "oops" is enormous.  This is one reason why https all the way is preferred.  There are reasons why this is not done by all sites:

(Probably the biggest reason): Many networks (your ISP potentially) maintain a cache server that watches traffic leaving their network.  If it sees that you are trying to retrieve content (all the little pictures & icons on a popular page for example) that other people have recently retrieved, it will give you a cached version.  There is all kinds of support for this: the original site has a way to indicate what can and cannot be cached, and for how long.  All this is good for the ISP and the original site, since it means that they both have less bandwith crossing into/out of their networks.  Https breaks this, as the proxy now has no idea what you are asking the original site for.
(no longer a problem) There is computational overhead to setting up a secure connection to a site for the first time.  This used to be a problem for a server accepting lots https connections.  This problem is largely gone now - there are several mitigating protocol factors, as well as acceleration hardware and other methods that have basically fixed this problem.  I only mention this in case you hear that https puts a heavy computational load on the server: AFAIK that is no longer true.


Password Manager or Password Generator If you use the same email and password for every site, one breach and all your accounts are hacked. This is why I like to create a unique password for every site.

This causes a problem since the passwords become more complex and harder to remember. So I want to know what's best, password managers or password generators?

What are the advantages and disadvantages to each of them?

This is what I can think of:

Password generators (such as masterpassword...

Data is offline, meaning hackers have to target my computer
Generated by using an algorithm. Means they are not stored anywhere
If you forget the length of password or mistype it, you cannot recover the password
You need to manually enter the password, or copy it to the clipboard which could be accessed by 3rd party apps

Password managers (such as 1password)

Syncs across multiple devices
Autofill so you don't need to enter password manually or copy it to clipboard. Can also be a disadvantage because if someone else logs into my computer, they can log in to the account.
Stored on well known servers. Could be an ingesting target for hackers.

What other points are there? I would like to know the advantages and disadvantages of each so I can decide what I think is best.

Both have pros and cons. IMO there is a main reason to use a password manager instead of a password generator:

To store assigned passwords.

In the particular case of Master Key, it can be stored anyway using your master key as an AES key and encrypting the assigned password. The problem with this approach is that as soon as you need to store an assigned password your password generator turns into an hybrid password generator + password manager. Why do you need 2 solutions for the same problem? Even more, if you need this feature then you have the worst of the two worlds

The other (Argable) reason to use a password manager is usability. In the case of a password manager you just remember your master password and it's it, you can use it. In a password generator (Just talking about Master Key specific needs) you need to remember your master password, your name (You shouldn't forget this though), the type of password and the password counter PER APPLICATION!. It may not be a problem for a few sites, but as soon as you have 50 applications it can be messy to remember the values for each one

About password managers, personally I don't like online password managers, I prefer offline ones like Password Safe, the reason: I trust myself more than a server with an unknown process to protect my passwords. Also, an attacker trying to break into my vault will need access to my master password and the vault, instead of just my password (Unless using 2FA)

Anyway, all the three options are good enough if you understand the risks


How do I destroy references to wiped files? I partially wiped my hard drive using the null-fill method through command prompt by
copying a 1 Gigabyte file filled with NULL over and over until I ran out of space.
After that I tried recovering files and what do you know, I got back the references and names.
I look through the data of those files using a HEX editor and surely the null-fill method did
its
job very well, the problem is the filenames are still there.
I have some torrent references to pirated software and would want to destroy those references
without actually wiping the entire drive, as I do have important documents on there and no other
media to temporary move it to.
Thanks.

I'm assuming you are using Windows and NTFS?
The problem with wiping file names is that the Master File Table (MFT) is never deallocated, so writing fill data to unallocated space only effects a single MFT entry for each file regardless of the file size. Writing a gazillion tiny files will have a bigger effect on the MFT, but even then it's semi-random.
It would be possible to over-write available unused MFT entries with a custom program, but not from within the running Windows OS, it won't let you. I'm not aware of an existing utility to do this, but it shouldn't be that difficult for an experienced programmer.
For most mere mortals, the easiest thing to do is to encrypt your drive. The data is not destroyed but it's effectively out of reach.
I've seen some claims that Eraser can clean MFT entries, but have not personally verified that.


KeePass Key File - Does it provide any meaningful security? KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much.

I can see a couple of scenario's:

The database and key are on one system: basicly a open door.
The PC is yours and the datbase is on it, and the key is on a usb stick: secure as long as your system it not compromised.

So only if you use a USB Stick it's secure-ish. But it isn't (meaningfully) more secure than just having a password right? Remembering a single complex password is quite possible. And if it takes over a lifespan to bruteforce the complex password, it's not that meaningful that the keyfile has a longer and more complex password, right?

And if the system is compromise it doesn't really matter either way. Only one time password could protect against that.

So am I getting this completely wrong and is the keyfile in fact more secure? Or is it more of a thing where some people prefer sticking a USB stick in their PC instead of typing a password?

And lastly, since you can use both, is there any point to having both a keyfile and master password if I am unwilling to plug the USB stick in and out (thus leaving the keyfile on the harddrive (or letting the USB stick stay connected 24/7)? Or would that render it nothing more than a little security through obscurity?

The keyfile for KeePass is just another kind of passphrase, as it is stated in the Keepass Documentation:

  A key file is basically a master password in a file. Keyfiles are typically stronger than master passwords, because the key can be a lot more complicated; however it's also harder to keep them secret.

The keyfile is more something you have (though it might be copied by adversaries), and a password is something you know. So by combining both you might gain some extra security in some scenarios.
If an attacker has the database and gains knowledge of your password by shoulder surfing, the additional keyfile on your USB will keep you somewhat safer.

Storing the keyfile on the hard drive of the computer as well will not really increase security, as the documentation correctly states:

  Location

  [...] The point is not to keep the location of the key file secret –
  selecting a file out of thousands existing on your hard disk basically
  doesn't increase security at all, because it's very easy for
  malware/attackers to find out the correct file (for example by
  observing the last access times of files, the recently used files list
  of Windows, malware scanner logs, etc.). Trying to keep the key file
  location secret is security by obscurity, i.e. not really effective.

However you are correct, if your computer is compromised, password and keyfile will at some point be accessible for an attacker and therefore need to be considered as insecure in this scenario.


Which is the best way to secure login password and safeguard user data? (even DBAs couldn't connect data to users) Lets say that I'm building an website and a app which saves the users' secrets. The user logs in and can save into the app his deepest secrets.

I'm worried about two things:
 - Should I save the password (hashed/bcrypted/etc)?
- How can I prevent people who has access to the database to be able to correlate the secrets with the users, with the emails?

I read a article recommending to not store the user hashed password and to not use traditional foreign keys to relate the tables. To use a hash as foreign key instead. How would it work?

If I don't save the password hash somewhere how can I verify if the username/password matches?

If you want to store data in a way that the person holding the data cannot read it, then

You need to encrypt the data client-side.  Encrypting server-side opens the possibility that someone (say, the operator of the service) can record the data while it's in transit.
The encryption needs to be done using client-selected keys.  If anyone else provides the keys, they can record them.
The client needs to be storable offline (so the service operator can't tamper with it after the fact) and should have source code available (so the user can audit it to ensure it does what it's supposed to).

To prevent the service operator from associating data with an account, the "store" operation is not "associate a new record with this account", but "store a record tagged with this hash", where the hash in question is provided by the client (say, a salted hash of their password, where the salt is the index number of the desired record).  Conversely, the retrieval operation is not "select records associated with this account", but "select records tagged with this hash".  Further, the "store" and "retrieve" operations cannot require the user to be logged in.  There's probably a way for a user to prove they have an account without revealing which account it is, but I don't know how to do it.

Theoretically, any user can request any other user's records, though with a 256-bit hash, the odds of any random request returning a value are vanishingly rare (1 in 10^68, if you've got a billion records stored).  Since an attacker doesn't have the decryption password, being able to retrieve someone else's record is of little value.


TCP IN connection from another user in my home network. Is it safe? I'm using Comodo Firewall and I noticed that sometimes I'm getting TCP IN connection from another IP address in my home network (only one router and few wireless users):

TCP IN  | 192.168.1.50 | 192.168.1.75, where firs address is source and second one (my address) is destination. Why this is happening? Could it be a sniffer running at 192.168.1.50 computer?

Whether it is a threat is going to depend on what services you are running on your computer, whether you are aware of them or not, and what the device at 192.168.1.50 is.

For instance, it would be okay if you are sharing files on the local network using your computer, and 192.168.1.50 is a known IP address of a client computer wanting to download files from your computer. You could also have software installed on your computer that allows network printing for instance, and that TCP connection is just your network printer doing routine communication with your computer.

Or, it could be that someone has hacked into your device on 192.168.1.50 and is probing your computer, or that there is malware listening on your computer. Maybe 192.168.1.50 belongs to a device that shouldn't be on your network in the first place...

Without context and knowledge of what's running and what every device should be doing on your network, there's little that can be determined about that connection and its intended purpose.


Is there a way to estimate the difference of temperature or voltage of PC CPU per differet code command? would like to know if I run code that contains different commands such as: for, if etc. I would like to know if there is a constant change in temperature or voltage on the CPU or on any other component in PC? And is it vice versa if I run code is there a way to know by temperature change or voltage difference what command is running? I know that there's a technique for cracking encryption on smart cards which actually looks at the current draw of the card and based on a plot of that current it determines how many times each loop gets executed.

Woohoo, with temperature it's a no go.

With voltage/power consumption you can roughly guess how much transistors are in use, and with knowledge of the inner processor diagram and command coding (ASM "version") you may guess wich command (set of transistor) is in use, but it sounds really error prone (see end of answer).

Deriving the same information from temperature is a no go because the temperature will vary from a ridiculous small amount and there's some inertia between warming and cooling, so a set of command could be done without noticing a 0.00000001° (Choose your temperature unit here) difference (assuming you could mesure at this precision).

For what it worth, for and if are nothing in a computer, those instruction would be translated (by compilation or interpretation) to assembly instructions, an if command will be made of a bunch of ASM commands, at least a CMP and JMP one (excluding the test itself which need loading values in registers etc.).

For the cracking technique, the algorithm is usually known, the variables are not, so you can 'guess' some variables (number of iterations, complexity of encryption) from the power needed by the card, it is more a rainbow table comparison from cards with the same components used with known algorithm and variables when measured AFAIK.


Options when defending against SSLstrip? I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?

Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks:

Install HTTPS Everywhere or ForceTLS.  (HTTPS Everywhere is easier to use.)  This tells your browser to use the SSL versions of web sites, where possible.
If the browser gives you a certificate warning, do not bypass the warning, and do not continue browsing that web site.
For critical sites, like online banking, go to the HTTPS (SSL) version of the site from your machine while using a secure network, and then bookmark that page.  Then, always open the site by opening the bookmark whenever you want to go to that page.  Never type its address into the address bar or search bar.
If you will only be browsing a single site, consider configuring a site-specific browser.  This is probably not needed for most purposes, but it will provide additional security against some attacks; it might be appropriate, e.g., for businesses that are using online banking.
Alternatively, instead of HTTPS Everywhere, you can do your web browsing via a VPN service.
Configure your email client to use SSL (also known as TLS) and to check the validity of certificates.  This will ensure the connection to the email server is encrypted.

Here are my recommendations for what web sites can do to protect their users against Firesheep, SSLstrip, and similar attacks:

Enable SSL sitewide (i.e., HTTPS).
Enable HSTS (HTTP Strict Transport Security).
Make sure that your certificate is valid.  Consider buying an Extended Validation (EV) certificate, for more security-critical sites.
Enable secure cookies, i.e., ensure that all cookies are served with the secure attribute, so that your user's browsers will only send those cookies back over SSL-protected connections and never disclose them over any non-SSL (HTTP) link.
Disable HTTP (non-SSL) access, or redirect users to the SSL version of the web site.
Avoid or minimize use of third-party Javascript libraries, widgets, like buttons, etc.  Or, if you must use them, make sure they are served from a https: URL and that the site hosting them is one you trust.

On a different topic, administrators of mail servers can protect their users by enabling SSL/TLS protection for IMAP (or, better yet, requiring use of SSL/TLS on all connections) and by enabling STARTTLS on their SMTP servers.


When will CMP be part of OpenSSL? CMP means Certificate Management Protocol.
CMP for OpenSSL is currently a fork of OpenSSL. Do you know when it will be part of OpenSSL?

https://github.com/mpeylo/cmpossl

It will be part of OpenSSL 3.0. The code is currently being contributed in chunks. Chunks 1-6 have already been merged into the OpenSSL master branch (which will eventually become OpenSSL 3.0). Chunk 7 is being reviewed right now:

https://github.com/openssl/openssl/pull/10620

There are 12 chunks planned:

https://github.com/mpeylo/cmpossl/wiki

OpenSSL 3.0 is scheduled for release at the end of this year. The release schedule is here (scroll down about 2/3 of the page):

https://www.openssl.org/policies/releasestrat.html


Someone registered a domain name with the IP of my VPS I rented a VPS server to run my website a few month ago. Today, I looked at the /var/log/apache2/access.log and noticed a strange line :

192.0.2.123 - - [02/Aug/2015:05:21:29 -0400] "GET / HTTP/1.1" 200 4043 "http://buttons-for-website.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:38 -0400] "GET /ressources/css/genericons.css HTTP/1.1" 200 14062 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:38 -0400] "GET /ressources/css/style.css HTTP/1.1" 200 894 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:38 -0400] "GET /ressources/css/header-style.css HTTP/1.1" 200 1208 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:38 -0400] "GET /ressources/js/mobile.js HTTP/1.1" 200 774 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:40 -0400] "GET /ressources/frameworks/font-awesome/css/font-awesome.min.css HTTP/1.1" 200 5782 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
192.0.2.123 - - [02/Aug/2015:05:21:44 -0400] "GET /ressources/img/nav.svg HTTP/1.1" 200 966 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"

It wasn't http://example.com/, I changed it for privacy purpose. I was intrigued, and decided to go on that site. I was surprised to see that it was the exact copy of mine. With my own personal files (CV, etc). So I decided to check the IP address of that website :

; <<>> DiG 9.8.3-P1 <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10369
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;example.com.       IN  A

;; ANSWER SECTION:
example.com.    14400   IN  A   IP_OF_MY_WEBSERVER

;; Query time: 60 msec
;; SERVER: 208.67.222.222#53(208.67.222.222)
;; WHEN: Tue Aug  4 16:52:53 2015
;; MSG SIZE  rcvd: 49

I was surprised to see it was the IP of my own VPS. Indeed, it seems that someone rented the example.com domain name and linked it to my website.

- Why would anyone do that ?
- Is there any security issue I should be worried about ?

While it could be part of some attack, my suspicion is that it was a mistake. Perhaps the registrant had that IP previously. You'll have to check your VPS company's/plan's details. You may have a fixed IP or a variable one (not likely). Even with a fixed IP, the VPS provider likely gave that IP to a previous VPS user.
However it happened, they need to get a new IP.
There is the possibility that the DNS entry for bye-powerpoint.com still points to your IP address. If this is the case, it likely means that the site is dead (otherwise they would have noticed that their site has become inaccessible).
Actions you can take:

Contact your VPS provider and see if they can help you. They've given you an IP address that is prone to spam. They should fix it or give you another one.
Lookup the domain name in an online whois site (eg: this one) and see if you can get contact information about the registrant. You usually can get an email (though sometimes it is just a dead drop). Let them know the problem and see if they will/can correct it.
Contact the registrar that registered bye-powerpoint.com and let them know what is going on. They should fix the DNS mapping once they know it's wrong.
You can configure your web server to have a vhost that will reject requests, perhaps with a 403 status code.

Hope this helps.
EDIT: I updated the answer based on comments. Thanks everyone for the help.


Why does metasploit still work? Metasploit is publicly available as well as all the exploits and the vulnerabilities in its database. This means that a company can patch and secure its network and software accordingly to the metasploit database thus renders metasploit useless.

How can metasploit still hack?

If a company were to actually patch all their systems, then Metasploit would have very little to offer in that environment.  However, it's extremely common for companies not to patch all of their systems for any of a number of reasons:

Bad inventory management -- some companies don't even know all the systems they have
3rd party software that's only certified for old software
A belief that patching leads to instability/crashes/unacceptable downtime
Understaffed or underskilled IT department
Human error
Mistaken beliefs about security ("We have a firewall, why do we need to patch?")

There's probably other reasons I'm forgetting right now.  Even before the availability of Metasploit, there's resources like Exploit-DB that list exploits and vulnerabilities.  Companies didn't patch then either.

Look at all the other questions tagged patching for more insight into how patching is not a trivial problem.


Does a TLS interception proxy present the user's browser with the end server's certificate? I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels in the middle. To obfuscate that interception is occurring, however, the client's machine must be configured to accept the proxy's certificate as trusted, so the user doesn't receive a pop-up message that identity cannot be established. This is easy to do in corporate environments where client machines are joined to a domain that can quietly push out certificates in users' root directories.

Now, when you access a website through TLS, you can view that site's certificate in your browser. If there is an intercepting proxy in the middle, does the site's certificate in the browser change if you check it? In other words, while the proxy can't duplicate the server's certificate for the purpose of establishing the TLS tunnel to the client (because it needs the server's private key which it doesn't have), can it still just visually output the server's certificate to the user, so that they are unaware, just by looking at the certificate, that interception is occurring? So for example, you're in a corporate environment that intercepts all TLS connections, and the organization's proxy certificates are installed on all clients. You don't get a pop-up if you connect via TLS to your bank account, but on the bank's site, will the certificate still display the same fingerprint as it does when you connect from home, where you can assume (at least for the purpose of this discussion) that you are connecting securely and directly?

Stated differently, is checking a secure site's certificate enough to detect a man-in-the-middle, or do you have to look through all your trusted certificates on your corporate laptop to determine if any of them are unusual (i.e. the company's)?

The certificate sent to the client will be the one generated by the proxy, not by the originating server.  It can't send the end server's certificate because that certificate is specific to the key in use by the end server.  If it changed out the key being sent to the client and didn't change out the certificate, validation would fail because the calculated hash of the public key would not match the hash in the certificate, rendering it invalid.

The browser or TLS client should show the trust path to whatever CA the intercepting proxy is using, whether installed by default (there are actually intermediate certificates for sale for these sorts of MITM setups, if you're a big enough corporation!) or installed by an organization through policy/management.


How long should zip encryption password be for it take 10 years to crack? I am using zip 3.0.0 on macOS High Sierra and Ubuntu. Here is my zip version on macOS:
$ zip --version | head
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.
Currently maintained by E. Gordon.  Please send bug reports to
the authors using the web page at www.info-zip.org; see README for details.

Latest sources and executables are at ftp://ftp.info-zip.org/pub/infozip,
as of above date; see http://www.info-zip.org/ for other sites.

Compiled with gcc 4.2.1 Compatible Apple LLVM 10.0.1 (clang-1001.0.37.14) for Unix (Mac OS X) on Feb 22 2019.

Here's the one on Ubuntu:
$ zip --version | head
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.
Currently maintained by E. Gordon.  Please send bug reports to
the authors using the web page at www.info-zip.org; see README for details.

Latest sources and executables are at ftp://ftp.info-zip.org/pub/infozip,
as of above date; see http://www.info-zip.org/ for other sites.

Compiled with gcc 6.3.0 20170221 for Unix (Linux ELF).

I have read this answer at https://security.stackexchange.com/a/186132/108239 which recommends against using zip for encryption.
However, in the environment I am in, I need to send a file securely to non-technical users. Here are my constraints:

I am allowed to send my recipients an arbitrarily long password.
I am allowed to send them zip files (encrypted or unencrypted).
I am not allowed to ask my recipients to install additional software.
I only care about confidentiality of the content of the file.
I do not care about the confidentiality of the filename or file metadata.
I do not care about integrity or non-repudiation.

Given these constraints, so far I have been sending files this way:
zip -e secret.zip secret.txt

I use a 80-character long randomly generated alphanumeric (A-Za-z0-9) password to encrypt the secret file. The zip utility does not accept passwords any longer. Trying to do so results in the (line too long--try again) error.
This uses the following crypto method:
$ 7z l -slt secret.zip | grep Method
Method = ZipCrypto Deflate

My questions:

Is a 80-character long randomly generated alphanumeric password strong enough to compensate for the weak cipher technology of zip utility?
What is the minimum entropy that a password should have to make it secure enough to be used with the zip utility? To define "secure enough", say, cracking the zip file should take 10 or so years with the current computing power (ignore an increase in computing power for now for the sake of simplicity).

If you are using ZipCrypto for encryption, then any password length is insecure.
You are using the ZipCrypto cipher, rather than the more secure AES. ZipCrypto is extremely weak, as it is based internally on a non-cryptographic construction called a CRC. It is highly vulnerable to a known-plaintext attack, which in practice does not require knowing exactly what your Zip file contains, only a minuscule portion. This can typically be satisfied by using the header of a file, which is typically known for the vast majority of commonly compressed files.
The attack, discovered in the 90s, is detailed in A Known Plaintext Attack on the PKZIP Stream Cipher. With 13 bytes of known plaintext, the full key can be recovered with a complexity of 238, which is not much. In fact, it took only a few hours on a personal computer, and that was with 90s hardware! Attacks only get better over time, and the attack against ZipCrypto is no exception to this trend: An Improved Known Plaintext Attack on PKZIP Encryption Algorithm.

If you switch to the newer Zip encryption format which supports AES, then you can securely encrypt files and trust that they will stay confidential indefinitely. Assuming you want a minimum of 128 bits of security and are choosing a password from a set of 62 symbols (an alphanumeric password), you would want to use at least 22 characters, as log2(6222) ≈ 131 bits and, obviously, 131 ≥ 128. Zip encryption of any kind does not provide integrity, but you specified that you only need confidentiality.


How to know when an OpenSSH rekey occured, and how to trigger one? I have a twofold question about OpenSSH rekeying. I use OpenSSH 6.4 on the server side and the connection between client and server is a SSH2 connection.

The questions:

How do I know when a rekey has happened? Should I check any logs, or any specific output? Running sshd in debug more (-d) does not show me anything related to rekeying.
How can I trigger a rekey?

How do I know when a rekey has happened? Should I check any logs, or any specific output? Running sshd in debug more (-d) does not show me anything related to rekeying.

It is printed only in debug mode, because it should not be a think you should care about. It should work out of the box as it is. But anyway, you can increase log level from your client using:

-vvv switch to your ssh command (DEBUG3)
LogLevel DEBUG3 config option in your ~/.ssh/config
~v escape sequence during your session

  How can I trigger a rekey?

Rekey is handled by configuration option RekeyLimit in both client and server config (even though a bit broken until openssh-7.2). If you set up low value it should rekey more often, but there is no point in doing that.

By hand in session, you can trigger one, by escape sequence ~R. After that (in at least DEBUG log level or -v, you will see a lot of debug messages:

[root@f24 ~]# ~?
Supported escape sequences:
 ~.   - terminate connection (and any multiplexed sessions)
 ~B   - send a BREAK to the remote system
 ~C   - open a command line
 ~R   - request rekey
 ~V/v - decrease/increase verbosity (LogLevel)
 ~^Z  - suspend ssh
 ~#   - list forwarded connections
 ~&   - background ssh (when waiting for connections to terminate)
 ~?   - this message
 ~~   - send the escape character by typing it twice
(Note that escapes are only recognized immediately after newline.)

[root@f24 ~]# ~v [LogLevel VERBOSE]
~v [LogLevel DEBUG]
[root@f24 ~]# ~R
debug1: SSH2_MSG_KEXINIT sent
debug1: rekeying in progress
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
debug1: kex: curve25519-sha256@libssh.org need=64 dh_need=64
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: rekeying in progress
debug1: rekeying in progress
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:E9HuzpVQJ/5DavNIZhWzJrADNj5Ntw69RJ1obXJtlGo
debug1: set_newkeys: rekeying, input 5156 bytes 167 blocks, output 5864 bytes 0 blocks
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: set_newkeys: rekeying, input 5168 bytes 0 blocks, output 5864 bytes 0 blocks
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received


MacOS: quarantining data for import I have collected over many, many years data from many sources, some of which could be questionable - for example an upload page on a web server at home - to the point where I don't completely trust the integrity of the data.

My current plan is to set up a sacrificial laptop that can be reinstalled easily, running a decent security package and scan all disks before importing the data to my main system.

Is this a decent approach? Is it overkill? Are there better/cheaper/easier/more reliable techniques I could consider?

You could always use a live disk on a computer and mount the hard disks in such a way that the files cannot execute, then scan them from the live disk.

I'm fairly certain AVG has a live disk that can work like this, as does any linux distribution with a live disk that lets you install Clam-AV.

Keep in mind though no anti-virus program is perfect and there is a chance that even after scanning everything you will still have malware.


Solution for store sensitive data without having access to it I need to develop a system where we need to store cryptographed sensitive data, but have no directly access to it.

What I think is something like a private/public-ish key pair. We would hold the private one to encrypt the data the Users may enter and give they the public-ish key. The data can them only be decrypted using both the private and the public-ish key.

This way, we can store the data, but have no access to it. Also, once the Users wants to get their information, they will need to inform their key, so we can decrypt it and send it back.

Does this make sense? Is there a crypto standard for something like this? Or is there another crypto concept/system that I could use in this case?

Thanks!

From your description, I assume you (A) don't actually need access to the users (B) data at any point of time? Ie. A stores B's data, nothing more.

If so, your whole idea sounds pretty bad.

Something about normal asymmetric encryption first:

The public key is used to encrypt. The public key, not the private key. The idea is that decrypting is hard. It won't be hard if you need the public key for it.
There's not something like a public-ish/semi-private key. One of the two key holders always can calculate the other key too (but not vice-versa), namely the private key can be used to calculate the public key.
There's no (single) asymmetric encryption scheme where decrypting needs both keys. You could use two kay pairs, ie. 4 keys, to make something like that, but not a single public/private pair.

Said that, the next problem is your definition of "storage without access". If A wants to store data without having access, why B should send the plain data to A? Because that's exactly what you're proposing: B sends data to A so that A can encrypt it then. Before encrypting, A has plenty access. Same story later when it is decrypted on A's side again before the data is sent back to B.

Third, A gives B a key, and later B sends the key back to A? How are you sure A won't keep the key to have access all the time? And why keys are sent around at all?

What you could do (and it's much easier): A stores the data, like you said, and nothing more. Don't make up nonsenical encryption strategies involving both sides. If B wants the data to be private, B can encrypt the data alone, with own keys and own methods, before sending it to A. A won't ever get any key.

And if you have that, you should think of integrity+authenticity too.


Virustotal says file is clean but PDFexaminer finds it suspicious I have spent some time reading other questions regarding PDFs and scanning them. PDFExaminer says that the file does "suspicious obfuscation using eval". I am using the latest version of adobe on protected mode with java script off, should I be worried of this PDF? I also have malwarebytes installed on my PC which also says the PDF is clean.

Given that PDFExaminer uses heuristics to examine PDFs, some false positives are likely.  (I'm not sure exactly what it uses to detect the "obfuscation" with eval.)  On the other hand, given that virustotal and malwarebytes predominantly use signature-based engines, some false negatives are likely.  This combination leaves you, as you've noticed, in a middle ground.

If you need to read this PDF and are concerned, I'd consider opening it in a VM.  It's unlikely that they have both an unknown PDF exploit and a VM escape (unless you have reason to believe you're being targeted by a nation state).

If you're interested in learning more about malicious PDFs, I'd manually take a look at the details of the PDFExaminer findings and see what the PDF is doing with eval.  It could be it's some kind of watermarking or copy protection, which (though some people do not like such measures) poses no risk to the integrity of your PC.


What does my ISP see if I change my DNS server? I have an interesting question and I really want to get an answer to this.
What does my ISP see if I change my DNS server and I use an HTTPS connection?
Firstly, when I use my ISP's DNS server:
So, I think, when I type a certain URL in my browser (for example https://google.com), I send a request through my ISP to my ISP's DNS server, my provider gets the response (IP address of google.com), goes by this IP, sends a request to this server (google.com) and gets a response - an HTML page that will be sent to me by my provider. Is it so?
Secondly, when I use another DNS server:
I think, when I type a certain URL in my browser (for example https://google.com), I send a request through my ISP to the other DNS server, my provider gets a response (IP address of google.com), goes by this IP address, sends a request to this server (google.com), and gets a response - an HTML page that will be sent to me by my provider.
Or (for second variant)
When I type a certain URL in my browser (for example https://google.com), I send a request through my ISP to my ISP's DNS server in order to get the IP address of the other DNS server, my provider sends a request to the other DNS server, gets the IP address of google.com, goes by this IP address, sends a request to this server (google.com) and gets a response - an HTML page that will be sent to me by my provider.
Here follows my third question: Will I be connected to DNS if I type just the IP address (not domain name) of google.com in my URL bar?

So, I think, that when I type certain URL in my browser (for example https://google.com) I send request through ISP to ISP DNS and my provider gets response (ip of google.com) and goes by this IP and send request to this server (google.com) and gets response - html page that will be sent to me by my provider. Is it so?

No, this does not work as you described.
When you use the ISP's DNS server you get the IP address of the target server (google.com in your example) from the ISP. The ISP's DNS server itself provides this IP address from a cache or resolves the DNS query for you - see DNS Lookups Explained for the finer details.
Then your browser uses this IP address to access the target site itself, i.e. the ISP does not retrieve the site for you. The ISP will forward the packets from your client to the target server though, but what's inside the packets is usually irrelevant for the ISP.
There are some exceptions from this behavior though: In some cases there might be an explicit proxy at the ISP involved, where the client (i.e. your browser) asks the proxy and the proxy will retrieve the data and send it back to the client. The proxy might also cache data to serve the client faster and also to save bandwidth. Such setup was pretty common in the early days of the internet where bandwidth was more scare, but is much less common today.
Some ISP might also snoop at the traffic with Deep Packet Inspection (DPI) and might also block or delay traffic based on this. Some might also enforce an implicit proxy to modify the traffic. This is especially true in countries where the ISP is ordered to block specific sites. It happened also in the past that ISP injected their own advertisements in the traffic. Or mobile ISP where found to "enrich" the traffic to provide information about the client (like the phone number) to the final server in order to provide more targeted advertisements. Traffic modification is mostly impossible when HTTPS is used though, but blocking traffic will even work with HTTPS.

Secondly, when I use other DNS: I think, that when I type certain URL in my browser (for example https://google.com) I send request through ISP to other DNS and my provider gets response (ip of google.com) and goes by this IP and send request to this server (google.com) and gets response - html page that will be sent to me by my provider.

Again the provider is (usually) only involved in forwarding the data between client (your browser) and server, but not in requesting the data from the server itself. The main difference between using the DNS from your ISP vs using a different DNS server is that another DNS server now resolves the query for you. This might be desired if one does not trust the ISP and fears blocking of sites or logging of what sites you access (i.e. privacy invasion). It might also be desired if the new DNS provider offers some useful features, like blocking malicious domains.
It is still possible and not uncommon though that your DNS query does not actually end at the DNS server you want to use but will still be handled by the ISP's DNS server. This can be done with a cheap redirection of all packets destined for port 53 to the ISP's DNS server. Enforcing the use of the ISP's DNS server is usually done if the ISP is ordered to block access to specific domains. But even without redirecting the ISP might be able to see what domains you query: DNS queries are by default not encrypted and thus visible to Deep Packet Inspection.  When using DNS over HTTPS (DoH) or DNS over TLS (DoT) the ISP will no longer be able to intercept these DNS requests though, nor will it be able to see the content of the DNS queries. It can still determine the domains you visit from DPI on the web traffic itself though in most cases.

It`s follows third question: will I be connected to DNS if I type just IP (not domain name) of google.com in my URL bar?

If one explicitly uses the IP address no DNS lookup is needed to access the server. Note though that most servers will not work if just accessed by IP address. It is pretty common that multiple domains are served on the same IP address. Thus the server also needs the domain name to find out which certificates to provide for HTTPS and which content to serve. If one just puts the IP address in the browser, the browser does not know which domain is meant and thus cannot provide this crucial information to the server.


Is there any way to check the certificates in a client's root CA store? When a client connected to a web server, is there any way the check to see what root CAs the client has?

Edit: Could I use JavaScript to send a GET or POST request to the server, providing a certificate that the CA I'm checking for has to sign? If the connection fails I'll know that the root CA isn't installed on the client.

No, the web server cannot check to see all the CA's the client has installed.

If you have access to the client machine, you can check by viewing the Trusted Root Certification Authorities store.


How will we stop BlueBorne on older devices? The BlueBorne vulnerability was announced on September 12, 2017.  It's a family of attacks against several implementations of the Bluetooth protocol that enable full compromises of various Bluetooth stacks, including Linux BlueZ (including Android), iOS, and allows for MitM takeover of Windows network connections.

The discoverers at Armis claim that the vulnerabilities are so bad that they are fully "wormable"; and the evidence they've presented supports that assertion.

All the big manufacturers have been notified and patched their newer systems.  However, the problems will remain in the smaller  players, as well as all the existing embedded devices that have Bluetooth connectivity.  These would include cars,  activity trackers, headphones, TVs, selfie sticks, and every other ridiculous "we-jammed-Bluetooth-chips-in-there-because-we-are-so-IoT" device.

What options exist to help companies and people prevent this from spreading, as it is almost certain to?  Can we build "worm detectors" to help prevent carriers from bringing infected devices into secure environments?  Can we build "vulnerability testers" to constantly scan nearby devices, warning us when they encounter a device that needs to be replaced?  What can we do to respond?

It really depends on your use case, but generally if you're wanting to defend your company:

If you are worried about employees or visitors bringing in older, unpatched devices onto your network, segment those devices to a completely separate WiFi network that doesn't in any way touch your main network.
Similarly, if your organization uses IoT devices, create a special segmented network that only those devices are given the password to. Don't let this network touch either your public WiFi network or your main network.
For monitoring these networks, there are products that specifically monitor networks for unusual IoT and BYOD activity (Senr.io is one example). These products can monitor these vulnerable networks and alert you when unusual or malicious traffic occurs.

Beyond that, there is not much you can do. Turn off Bluetooth on any vulnerable device you have control over and educate your employees on this danger.


Location of Password Hashes on a Windows Local Machine? "Where are the two locations that user's password hashes are stored on a local windows machine?"

My place of business asked me this question.  I know that the SAM stores password hashes, where would the other location be?

C:\windows\system32\config\SAM (Registry: HKLM/SAM)
System memory

The SAM file is mounted in the registry as HKLM/SAM. Windows locks this file, and will not release the lock unless it's shut down (restart, BSOD, etc). However, if you look at the SAM entry in the aforementioned registry section, you will not find the hash.

Therefore, it seems more than likely that the hash, or password, will also be stored in memory. In fact, there are quite a few password crackers that take your password directly from memory.


How will IPv6 affect DDoS mitigation techniques? IPv6 introduces a much larger address space than IPv4 and with it there are many new techniques in creating and mitigating DDoS attacks.  What are some examples of risks and mitigations?
For example, with the additional address space of IPv6 is there a new set of Bogon IPs that can be filtered?
Is there any proof-of-work or whitelisting possible for valid connections?
Are there any features inherent to IPv6 that could influence DDoS risk (positively or negatively) ?

Remember that IPv6 is not that different than IPv4.

Layer 2 is still the same, as is Layer 4 and above. Routing protocols also remains the same.

So a good old "lets fill the victims internet link" attack, works similar in IPv6, but with different tools.
What one could hope, is that ISP's does a better job stopping spoofed adresses from leaving their network when they implement IPv6.


self-signed CA next to signed CA? What I'm trying to do is implement client-certificate authentication on my website (running on Apache).

From this question I understand that it's not possible to generate a client certificate myself based on a signed certificate (published by for instance Comodo).

My question is; For any website on for instance Apache, can I use a self-signed CA with which I verify my users (by them importing a client-certificate) and at the same time use a signed certificate so that 'the url bar' goes green?

Thanks a lot!

The certificate used to authenticate the server and the client do not have to be issued by the same entity. It is totally possible for you to set the web-server up with a certificate you bought and in the meantime create your own Public Key-Infrastructure to handle client certificates.

The authentication process is not mutual, so this situation is possible and yet remains secure thanks to asymmetric cryptography and proper trust chain.


Are UEFI motherboards software flashable? If so, is there any way to prevent it? I have the idea that many UEFI motherboards are software flashable. For example, Gigabyte's flashing instructions for their motherboards describes a "A Windows-based BIOS live update utility" which would appear to just run as application software on the computer. Is this correct, are Gigabyte and other motherboard manufacturers now producing software flashable motherboards?

By "software flashable" I mean that no action on the computer hardware (like pushing a button or inserting a USB key) needs to be done, thus the machine could be flashed remotely.

If so, then this is a huge security problem because malware or an enemy operative with remote control of the computer (RAT) could reflash the BIOS/UEFI. Since UEFI code cannot be read from the chip by external software, there is no way to know if I have a genuine OEM UEFI on my system or a malware UEFI.

Is there any way to hardware block UEFI flashing to make it impossible for a remote attacker to reflash my UEFI/BIOS?

Well, that's one reason why UEFI sucks. In theory (and don't get me wrong: nobody serious in sec. ever believed this would work in RL) secure boot and signed drivers should prevent "malware" from being installed. But well: certs get stolen and exploits get found. There have already been many papers on that topic. This driver signing BS is more like a salesman argument from UEFI vendors in case anyone asks (as you just did). Story goes like this: Salesman: "yes we're aware of the risks and we're doing some magic that prevents that. Now I'm not an tech guy but our experts say it works. 100%.". Silence. Everybody in the management board nods in approval, IT-sec guy jumps out of the window.

Now while I'm bashing UEFI let's not forget that long before UEFI there have been (many) vendors that enabled you to flash your BIOS from within the OS (very common in the server / enterprise market but I've seen it on high-end enduser mainboard (ASUS WS PRO series) as well). They did that building proprietary chips  and interfaces. So this is not a entirely new problem with UEFI and one could argue UEFI made it better because atleast now we have a standard way to fuc* things up. One could also argue that now you don't have to reverse engineer ALL the mainboards because everyone is using the same known vulnerabilities. One could also say that UEFI made it worse due to unnecessary complexity, adding features to a bootloader nobody ever asked for, which increases the chance of bugs in the implementation.

That said please note that there are efforts to do things better. But unfortunately I yet have not had time to dig in deep into what those alternatives do better (maybe someone wiser can elaborate on this topic?) and - as so often in the history of technology - even if those approaches would be better than what UEFI has to offer they will probably always life in the shadow of the crap the industry has choosen (UEFI). So, till the first nuclear power plant explodes and people die I guess we'll have to live with UEFI (and even then I'm not sure something would change when it comes to IT security).

Oh and because you asked: no, there is nothing you can do to prevent malware from doing such an attack. Besides installing something else then UEFI (with potentially other risks and vulnerabilities). I'm not sure about possible "hardware modifications" that would prevent write access to the UEFI env. but if there is a way it'll probably be very hardware specific and probably not easy to DIY.

But let me tell you: if you panic by knowing this now better don't have a look at what Intel did with AMT (hint: AMD has similar BS). And no: you can't turn off that crap either.


Identifying and preventing execution of "any" function via Late-Bound commands The Command Pattern is widely used to create a robust, salable applications.  However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the caller to call any assembly, class, and method available to the running process:

Figure 7

[Serializable()]
public class LateBoundCommand : ICommand
{
    protected string AssemblyName;
    protected string ClassName;
    protected string MethodName;
    protected object[] Parameters;

    protected LateBoundCommand()
    {
    }

    public LateBoundCommand(string assemblyName, string className,
                            string methodName)
    {
        AssemblyName = assemblyName;
        ClassName = className;
        MethodName = methodName;
    }

    // sets all parameter values
    public void SetParameters(params object[] myParameters)
    {
        Parameters = myParameters;
    }

    public virtual void Execute()
    {
        Console.WriteLine(&quot;LateBoundCommand.Execute starting&quot;);
        Assembly a = Assembly.LoadWithPartialName(AssemblyName);
        Type TargetType = a.GetType(ClassName);
        MethodInfo TargetMethod = TargetType.GetMethod(MethodName);
        TargetMethod.Invoke(null, Parameters);
        Console.WriteLine(&quot;LateBoundCommand.Execute complete&quot;);
    }

}

Since this article was published in 2004, and the underlying pattern was developed in 1995, there must be a lot of software developed this way.  Outside of SDLC what is the right way to protect IT Infrastructure from software developed this way?

Is there any .NET or Java specific auditing that can be done to identify late bound execution... atypical of the running service?

Can I scan the MSIL (or Java equivalent) for this type of invocation?

Sure, you could scan the MSIL for code that calls into the reflection bits, but there really isn't much that can be done at runtime unless you are monitoring the call stack on each request.


Estimating the cost of implementing security measures Are there good resources or good practices on how to estimate the cost for implementing security measures in a company? My purpose is to justify to management that they need to spend this amount to beef up the security of our company in our industry. I believe some sort of standardised risk management tool can help. Or is there any industry research reports out there that already illustrates an estimated amount for each industry in the market? thanks

Security is about loss prevention, not profit.

There are plenty of reports about how to calculate the ROI (Return On Investment) for a company (I even saw a PhD on that) but this usually ends up with some wild hand waving and I am still waiting, after running budgets of $MM, for some magical formula which would tell management that the investment is worth the price.

I am sorry not to have a reply which has that neat formula, but you are not likely to find one. Companies which have a short path between IT and profits may find some reasonable links, though. You could argue that if you make x $/s, a downtime of N seconds means N*x $ loss. A DDos protection solution will cost you this and that so if you expect to be DDoSed (this does not cost much) then the investment is maybe worth it.

You will find reports that state that an intrusion costs a company whatever big amount of dollars. This is true for direct costs (ie. you have to pay legal fines) but does not take into account (or, on the other side of the spectrum - grossly exaggerates) collateral costs. Putting a dollar value next to loss confidence is not easy either.

This is to say that you can google some reports (ENISA has a good introduction) but the budget discussions about security are usually belly dancing.


Sending Encryption/Decryption keys over HTTPS I am a newbie to the cryptographic world so bear with me.

Thinking of a strategy (for securing P2P data) in which server is generating a key which should be used for AES encryption between clients and sending that to multiple clients (Android, iOS, web). I was wondering should I be using encryption in sending this key over https network to clients or https can take care of this? I understand Diffie Hellman key exchange is made for the very same reason but is it an overkill?

HTTPS (or TLS in general) can be used to send the secret to the clients in a secure way, i.e. protected against sniffing and modification. But, it needs to have some form of authentication in order to protect against man in the middle attacks (which might sniff or modify the secret). Authentication is usually done with a certificate which the client must either know up-front or where the client can derive the trust because it was signed by a trusted issuer.

Diffie-Hellman alone is not enough to exchange the key since it is missing the authentication part. In fact, TLS commonly (but not always) uses Diffie-Hellman as key exchange itself but also does server authentication.


Does typing something in Notepad but not saving it leave any trace? Sometimes, if I'm having trouble typing a long password, I'll open up Notepad, type it in their (so I can make sure what I'm typing is correct), and the copy+paste it into the form, and then close the Notepad file without saving anything.

Assuming I don't have somebody looking over my shoulder, and I don't have a keylogger on my computer, would this leave any recoverable trace?

I'm primarily a Windows user, but I'd be interested to know if different OS's would handle this differently.

Microsoft Notepad will not save anything to disk unless you explicitly tell it to do so (by using "Save As"). This is in contrast to more complex programs like Word or Notepad++ that has autorecovery features and might save safety copies of files. I do not know, but suspect, that simple, basic text editors on other OS's work the same way.

If it would be saved to disk, it would persist and possibly be recoverable even after it would supposedly have been deleted. So that would be a bad practice.

Malware could off course read it from the clipboard, or extract it from RAM (where it must be stored sometime anyway, even if you just type it into the password box). But if you have malware on your system all your passwords are lost anyway, so how you type them isn't really an issue.

I would say the major security issue with your scheme is that the password will remain in the clipboard (unless you always remember to copy something else directly afterwards) so that someone who uses the computer after you could stumble upon the password just by pasting.

Also, there are legitimate programs that reads the clipboard and saves it so you can get a clipboard history. Obviously, if you have one of those installed, you are in trouble.

I would recommend that you just use a password manager.


Has a HTTP server access to SSL session ID? I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. Can the webserver "see" the SSL session ID. If not, how is the connection between the HTTP requests and the SSL session handled?

Whether the SSL session identifier is made accessible, by your SSL hardware, to the rest of the server, is entirely up to the interface that this hardware offers.

A decent SSL hardware box should offer some kind of session management, so that the consumer (your Apache / nginx / whatever server behind the box) may know whether successive connections are from the same client (i.e. the client reconnected, offered to do an "abbreviated handshake", and the box accepted because it still remembers the SSL session parameters). How this session management is offered is up to the box; it may or may not use the same "session identifiers" as what is exchanged in the SSL handshake (in the ClientHello and ServerHello messages). You will have to use to documentation for that box.

If the hardware does not offer session management of any kind, then it is junk and you should switch vendors.


Does the Flash installer use an encrypted download? A lot of popular applications use customer downloaders rather than allow the user to download the installation binary directly from Adobe, or whoever the OEM might be. For example, here is the Flash installer doing its work:

The security risk here is obvious: if the download is conducted in plain text it is vulnerable to a man in the middle attack. A hacker who controls any router between me and Adobe, including control of my cable modem, can target and intercept this update and supply their own modified binary.

If I use a web HTTPS download from Adobe then I can still be compromised by a MIM attack, but in this case I can know that there is poison because the false certificate my browser is given by the MIM will not match Adobe's HTTPS certificate.

However, when I use the custom Adobe Flash Player Installer (as above) I have no way to know what certificates are being exchanged. For all I know, the binary is being transferred in plain text, which is highly insecure obviously.

Is this installer to be trusted?

Is this installer to be trusted?

No? As you said, you have no way of trusting what it downloads – even if it did encrypt and cryptographically authenticate the download, you wouldn't know whether what you're downloading is what you want. So this question is the same as "Can I trust any software downloaded from anywhere?", which probably is "no".

Anyway, as you said, there's no way for you to look inside and tell whether it's doing crypto, and if it does, if it's doing it right (i.e. verifying the authenticity of the server according to built-in keys, hoping these are untampered with, since you've downloaded the downloader from somewhere you trust).  So even just capturing the traffic (using e.g. wireshark), which is trivial, will only let you confirm the unencryptedness (if that is the case), not the correctness of implementation.

So, short answer: no.

EDIT also: Is that a Windows XP window decoration?!


How to handle 3rd party vulnerable code? We have recently done a static analysis of our application/s, and there are few critical findings for a 3rd party code i.e. jquery and swagger UI.

What are security best practices in this case to mitigate the risk?

You can use subresource integrity. This prevents an attacker from altering scripts. It adds a hash to the script tag, and if that hash does not match with the script it does not get executed.


A certificate site name mismatch when using preinstalled Toshiba software? (Superfish?) On my Toshiba laptop there are a variety of different Toshiba programs that came pre-installed. Many of them are some sort of utility, optimizer, checkup, and update kind of programs that I guess are commonly referred to as bloatware.

One of these programs in particular, called "Toshiba Laptop Checkup" tries to run its "checkup" every so often automatically, and when it does, the following error message is displayed:

  Security Alert

  A secure connection with this site cannot be verified. Would you still
  like to proceed? The certificate you are viewing does not match the
  name of the site you are trying to view.

If I click "Show Certificate" details, I get a certificate with the following information:

Issued to: www.bcrea.bc.ca

Issued by: Go Daddy Secure Certificate Authority - G2

Valid from 3/10/2015 to 10/2/2017

When I google www.bcrea.bc.ca , the top result is the British Columbia Real Estate Association .

That is extremely random and unrelated to me, and the "Toshiba Laptop Checkup", so what gives?

I have read this article about Superfish. While a lot of information there and elsewhere about Superfish is over my head, and I don't really understand it the technical details, I remember that the vulnerability involves certificates and pre-installed software on computers. That also made me wonder just what is going on here?

It is hard to tell you exactly what is going on because we don't know what request actually triggered the message and you do.

What it looks like, however, is that for some reason, a secure request intended for Toshiba's update server went to www.bcrea.bc.ca. There can be many reason for this but few are really encouraging:

Something in your DNS resolution is being exploited to redirect requests to different web site. Given the nature of the target web site (a real estate company), that purpose could be either advertising or a DDoS attempt. Note that this could very well be the result of a locally installed trojan.
Toshiba's DNS server (or, possibly, the CDN that handle their traffic) is misconfigured and pointing you to the wrong (network) location.
The update client you're using is incorrectly interpreting the answer it is getting from Toshiba's update server and it is using a link sent as advertisement as a link to the actual content it is expecting.

At this point, it is hard to give you any more details since there isn't much more information. I would suggest that you treat your system as potentially compromised (running an AV check would be a first step). You might as well ask the question to Toshiba support: since they are the ones who provided you with the problematic tool, they might help you figure out what is happening.

In all likeliness, however, you aren't seeing the result of superfish (or similar TLS terminating proxy software) since the certificate details you provided reference a valid CA but an invalid host name.


Different Security Issues Depending on OS? I'm interested in learning more about OS specific security issues if there are any. I'm very new to this topic but I want to learn more about if there are specific security vulnerabilities associated with different operating systems and how this work (Any reference would be greatly appreciated).

In general does the OS play a large role in the types of exploits available, or will one type of attack work on multiple system? Any information on this topic would be appreciated.

Best

Yes, the nature of a host's OS plays a big part in how it can be attacked.

Here's the quick 101, but this is a big enough area that the best I can do it point you on the road to further research...

Security Architecture

Every OS will have some similarities in architecture - after all, they all server the same purpose of providing a useful abstraction for applications that run above it and a management capability for resources that have to be optimized - like access to memory, CPU utilization, various I/O streams, etc.  So there's always some similarites, but even at a low level, OSes have different approaches to even some very basic functions.

The very nature of how the basic features of an operating system are put together forms the baseline for what attacks are likely to be the most successful.  In any OS, the star of the show, from a security perspective, is the Trusted Computing Base (TCB).  This is the combination of hardware and software on which the security of the system depends.  This is classically definted as the kernal and its most trusted processes.

In almost any operation, you'll see that an application has to use the TCB to do something of importance, so a big part of OS managemenet is allowing proceses to make use of TCB capabilities, moving from a state of low trust to high trust.  How that's negotiated and the basic premises involved in this element of the architecture are central to understanding how to both protect and attack a given OS.

Market Share

A really, really interesting corrallary to the vulnerability of an OS is it's market share.  I can never really believe an OS manufacturer when they say "well... we have less vulnerabilities than X" - because the number of known vulnerabilities is not something is derived from an academic lab (most of the time) - a great number of exploits come from the wild - and the most well tested (and exploited) operating systems are the ones with the greatest market share.

Attackers won't go after an archaic OS - there's no gold or glory in a small user base or a minor deployment with nothing of value.  As an OS rises in popularity, it's not surprising that hacks of the OS tend to rise as well.

Learning More:

Books

You can spend months really digging into the nature of the Trusted Computing Base and it's implementation in the various popular OSes.  To do so, the best avenue is to dig into a few books on "Computer Security", or "Operating System Security" - there's quite a few books out there that will take you through a fairly abstract path to understanding the basic premise of a TCB and the fundamentals of it's implementation in a few major operating systems.  You may or may not wish to fall back to a fundamental book on OS basics or grab a college course on this.  It's an area that doesn't change in the basics so very much that a college professor would be monumentally out of date.

OS Evaluations

Then, if you're still tantalized, I recommend digging into the manufacturer's documentation.  In many cases, bigger OS manufacturers have had to go through various types of security certifications to get the bigger government contracts.  That usually includes publicly available documentation, such as what's available with the Common Criteria.  This link provides all successfully evaluated products, and there's a pull down that will let you choose "Operating Systems" to get just those OSes that have passed review.  Each one includes links to details about how the evaluators evaluated the product and what they came up with.  The goal of a rating like this is to give consumers an independant assessment by an expert of what security protections a given product can and cannot provide.  The value of the evaluation is a topic for a whole other debate, but what I like about it is that it's a (somewhat!) consistent review process, so it lets you see the writeup of different products in a single category.

WARNING: These are dry, dry, dry.  I usually have to glue my eyelids open, but in all honesty, this is heavy reading and I don't see a way to make it light.

Vulnerabilities

Lastly, I'd just out vulnerability alert systems.  You'll see that attacks can be aimed directly at OSes, or at a combination of application and OS.  I'm a fan of NIST's simply because it has a search window and I'm relatively familiar with other parts of NIST's work, and I like the source databases it pulls from.  A quick run of "LINUX", "Mac OS X" and "Windows" will show you plenty.  One thing that's interesting is in some cases, it's a vulnerability in multiple OSes, because it's really targeting an upper layer application (like Adobe Flash) and then exploiting the OS from there.

Vendor Websites

You can also check vendor websites for the patches themselves.  Almost everything you see on the list above will result, sooner or later, in a patch.  But it varies wildly how quickly a given patch can be fixed.

It's a fine exercise, but realize that each vendor has their own motivation to give the impression that their security is well under control.  So you may not hear the most useful information here.  You will hear good advice on how to lock down a given OS, however.


Monitoring of Logging I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation.

What all features could I select in the Windows' auditing options, so that I could make it very useful to detect malware, unauthorised admin privilege usage, unauthorised network usage, and etc?

Interesting question. I've worked in secure file transfer software and I am currently in log collection.

Are you carrying out managed file transfers? For example, you have a secure file transfer configuration rules set to automate certain tasks. Or do you mean that you have a Win 10 machine set up with a GUI file transfer software that is being used by a user?

Also this is on the FTP protocol, right? Not like FTPES/FTPIS? Is the network accessible as something like a VPN for local network? AFAIK, some users still use FTP but under certain circumstances, and any other circumstance we'd recommend they use FTPS.

--

  I could make it very useful to detect malware, unauthorised admin privilege usage, unauthorised network usage, and etc?

To start, here's a few to look into:

Windows EventLog collection. To start, check out Malware Archaelogy's talk Security Compliance - Finding Advanced Attacks PDF via search which lists out EventIDs to log and monitor.

Windows Registry Monitoring. To monitor changes in the registry made by Windows or a certain program.

Windows DNS Monitoring ie monitor any calls to CnC servers.

If you have any important files (like the file transfer configuration file) you may want to implement file integrity monitoring to monitor for any changes to this file.

Then you would want to collect these logs with something like NXLog (disclaimer, I am involved in that project) and send these out to a centralized log server on the event that the FTP client is unavailable or goes down.


PHP crypt() or phpass for storing passwords? When storing passwords, should I use PHP's built in crypt or phpass?

If using crypt, should I use CRYPT_SHA512 or CRYPT_BLOWFISH?

For storing passwords, use PHPass

example of code using phpass:

require('PasswordHash.php');

$pwdHasher = new PasswordHash(8, FALSE);

// $hash is what you would store in your database
$hash = $pwdHasher->HashPassword( $password );

// $hash would be the $hashed stored in your database for this user
$checked = $pwdHasher->CheckPassword($password, $hash);
if ($checked) {
    echo 'password correct';
} else {
    echo 'wrong credentials';
}

internally, PHPass uses PHP's crypt() function, but all the nasty details have already been solved.

Currently, using CRYPT_BLOWFISH is the best practice.
CRYPT_BLOWFISH in PHP is an implementation of the Bcrypt hash. Bcrypt is based on the Blowfish block cipher, making use of it's expensive key setup to slow the algorithm down.

If you use PHPass as in the above example and PHP >= 5.3, you will be using BCrypt.


Should I allow communication on public networks? I apologize if this is a newb question. Reading this prompt, it appears that I should check Private Networks and uncheck Public Networks. However, Windows defaults to the opposite being checked.

Am I misreading this? Why is the default to allow public networks, and disallow private networks? Is there ever a case where it is appropriate to allow public but not private?

I had the same feelings as you regarding the default selection being set to public.  After reading the other answers to this question I didn't really feel like they directly addressed your question around why Public is set to the default. So, I've done some testing and have found the following:
The default selection is based on the state of your current network. It is not based on what is considered best practice for firewall rules. If the network that you are on is set to Public, then the default checkbox is set to Public.
I think that most of us generally consider our home networks to be Private, however Windows cannot assume that is the case and so by default your network is set as Public. You can follow the steps below to set your trusted home network to Private. After you have done this, you will notice that future security prompts will default to Private rather than Public.
How to set your Trusted Home Network as a "Private" Network (windows 10):

Open up Network & Internet Settings (this should bring open the network "Status" section by default)
Click on "Change connection properties". If you have more than one network adapter, you may be connected to more than one network.  Make sure you're selecting the correct one.
Select "Private" for the Network profile.

What the default selection looks like after setting your Network to "Private":

Just to wrap everything up: the reason that Windows selects Public, Private (or Domain) based on your current network settings is because it would cause mass mayhem for most end-users if they instead defaulted to Private (or Domain). None of their apps that required inbound network connections would work because the safe default for networks is Public, while the safe default for firewall rules is Private.
Hope this helps!


Review of a protocol I am wondering if anyone could give a second opinion whether the following is secure or not.

I have a system which consist of a mobile device, FTP server and a PC.
The mobile device is to upload sensitive data to the FTP server for a PC to download it... After download, the data on the FTP server is deleted.

The PC is in a secure network and can have the sensitive data as plain-text.
The data is to be encrypted with AES-256. Since key exchange with symmetric keys is a pain, I would like to encrypt the symmetric key with Asymmetric key.

Protocol I thought to use:

1) The PC would generate an Asymmetric Key pair (public and private key, RSA-2048 or better).

2) Use private key to create a signature of the public key.

3) Upload the public key and its signature to the FTP server.

4) Mobile device downloads the public key and its signature.

5) Mobile device uses the public key to verify the signature.

6) If the signature is verified, we are sure that the public key belongs to the private key in the PC (and not to a potential attacker).

7) Mobile device generates a symmetric (secret) AES-256 key.

8) Mobile device encrypts sensitive with the symmetric key and then uploads the encrypted data to the FTP server.

9) Mobile device encrypts symmetric key with public key and uploads it to the FTP server.

10) Mobile device generates MAC using encrypted symmetric-key as the message and public key as the MAC-key, then uploads the MAC to FTP server. (Is this part necessary?)

11) The PC downloads the following: encrypted data, encrypted AES-256 symmetric-key, MAC of the encrypted symmetric-key. (The PC also deletes the data on the FTP server after the download)

12) The PC calculates the MAC of the downloaded encrypted symmetric-key and compares it with the downloaded MAC. If both, the downloaded and PC-generated MACs match, we can conclude that the encrypted symmetric-key is authentic.

13) The PC decrypts the encrypted symmetric key with the private asymmetric key.

14) The PC decrypts the sensitive data with the symmetric AES-256 key.

15) Done!

The Asymmetric keys are to be changed over a certain period, not exceeding 2 years. The symmetric keys are "session" based i.e. a new key is generated for each dataset.

2) Use private key to create a signature of the public key.

  3) Upload the public key and its signature to the FTP server.

  4) Mobile device downloads the public key and its signature.

  5) Mobile device uses the public key to verify the signature.

Why do this. Anyone who can create a keypair can sign the public key via the corresponding private key. If I am an attacker I'll just generate my own keypair, sign my public key with my private key and upload it to the FTP. The signature is valid and you'll be none the wiser. At this point everything falls apart. I can decrypt any message by using my private key to get the symmetric key and the associated data.


Is there a way to check lists of cracked passwords without revealing my password? I want check if my various passwords are in lists of cracked passwords, but I don't want to type the passwords online.  For example, I'd rather scroll through an ordered list of passwords that have been merged from all rainbow tables and other sources to see if my favorite passwords are in there.  I don't want to use a search engine because doing would require that I type in my passwords, thus revealing them to the site operator or middlemen.  I could download all the rainbow tables, one by one, and search through them on my computer, but that's a lot of work.

What method(s) can I use to check my passwords without revealing them?

We need to know more about the reason for your question.

If you're a sysadmin or an auditor, and you want to use leaked lists and and dictionaries to check the strength of people's passwords prior to acceptance, that is a sound idea. Projects like zxcvbn that provide a password blacklist, plus a length requirement, provide at least a cursory assurance of strength.

But if, as it sounds, you are asking this question in order to verify the strength of your own personal password, then you should reconsider. If you're generating the password in a sound way, then you should already know how hard it is to crack.

If you select a strong password (say, 15 random characters or more) or a strong passphrase (5 or more random words from a sufficiently long dictionary of 10K or more), then the strength of that password relies solely on the pure math of how many combinations are possible, and you know that the likelihood of it appearing in any list is very, very low.

But if your password is 'JellyfishVacation2014", or a keyboard pattern, or your childhood address backwards, or any of the hundreds of different psychologies of non-random human password selection ... then even if your specific password doesn't appear in a giant dictionary, it is still weak enough to fall to offline bruteforce and hybrid password-guessing attacks. The password crackers know all of these human selection processes. When hundreds of millions of accounts are leaked yearly, the likelihood that your "favorite" password method is unique is very low.

In other words, Kerkhoffs' Principle applies to password selection methodology. If you might be reluctant to share exactly how you generated your password, then you should switch to a different method.


Can UNIX Domain Sockets be locked by user ID? If I created a folder /tmp/me with permissions 700, and started a process under me that starts a listen socket under /tmp/me/socket.

I currently assume that a connection to that socket originated from a process that is running on the very same server (malicious or otherwise), and was not a connection from another server (unless through one of the processes).
Can I also assume that the only users who can access that socket are me, and root?

I am asking about Solaris in particular.

Note: I'm aware that setting permissions on the socket file itself is not effective on various Operating Systems. That is why I chose to contain the socket file within a directory me.

I currently assume that a connection to that socket originated from a process that is running on the very same server

Correct. Filesystem sockets must be read by a process that has access to the file.

  Can I also assume that the only users who can access that socket are me, and root?

Yes. Since me is the only user with permissions, they are the only ones who may enter that folder and view the socket. root, of course, is root.