Writing a Simple SHA256 Salted Hash Generator I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):

using System;
using System.Text;
using System.Security.Cryptography;

namespace MyApplication
{
    class Program
    {
        const int SALT_SIZE = 10;

        static void Main(string[] args)
        {
            string salt = CreateSalt();
            string password = "securePassword";
            string hashedPassword = GenerateSHA256Hash(password, salt);

            Console.WriteLine("salt: " + salt);
            Console.WriteLine("hashedPassword: " + hashedPassword);
        }

        private static string CreateSalt()
        {
            var rng = new RNGCryptoServiceProvider();
            var buffer = new byte[SALT_SIZE];
            rng.GetBytes(buffer);

            return Convert.ToBase64String(buffer);
        }

        private static string GenerateSHA256Hash(string input, string salt)
        {
            byte[] bytes = Encoding.UTF8.GetBytes(input + salt);
            var hashManager = new SHA256Managed();
            byte[] hash = hashManager.ComputeHash(bytes);

            return ByteArrayToHexString(hash);
        }

        private static string ByteArrayToHexString(byte[] bytes)
        {
            StringBuilder sb = new StringBuilder(bytes.Length * 2);

            foreach (byte b in bytes)
                sb.AppendFormat("{0:x2}", b);

            return sb.ToString();
        }
    }
}

From what I've read online, salted hashes are one of the most secure ways of storing passwords. However, I have a few questions:

I have read that it's not enough to hash a salted password once. You need to keep hashing it thousands of times to make brute-forcing more difficult for attackers.

Would doing something like below be more secure, and what would be a good number of times to repeat hashing?

var hash = hashManager.ComputeHash(bytes);

for (int i = 0; i < 10000; i++)
    hash = hashManager.ComputeHash(hash);

I've also read that you also need to include the salt when rehashing, but I don't understand how to add it properly.
For the salt buffer size, is 10 a good number to use, or would a higher/lower number be more secure (e.g. 16)?
I'm taking this with a grain of salt, but I've read that SHA256 isn't a secure choice anymore because it's too fast, meaning brute forces are quicker to do.

Does this mean that fast algorithms like SHA are obsolete and need to be replaced with slower algorithms like bcrypt?
I assume that Hex Strings are a secure way to store salted hashes. Is this correct?
After applying all changes from the above questions (if any), would the above code be secure enough to use in a production setting?

I have read that it's not enough to hash a salted password once. You need to keep hashing it thousands of times to make brute forcing more difficult for attackers.

That is right. You want your password hash function to be slow, so that an offline brute-force attack would also be slow.

  hash = hashManager.ComputeHash(hash);

You really want to use the password within the iteration, to avoid the possibility of precomputation. If your algorithm does h=sha1(h) 10,000 times, I can create a table (or perhaps even an algorithm?) that applies sha1 10,000 times. I have to do this work only once for all passwords, and I can do it before your database is even leaked. So typically, the password is included in each iteration.

The HMAC primitive is typically used to hash multiple things together, but for learning purposes, simply concatenating values together is also acceptable.

  For the salt buffer size, is 10 a good number to use, or would a higher/lower number be more secure (e.g. 16)?

Preferably, each password has a unique salt. So your salt should be long enough to accomplish this. 10 bytes is sufficient, and making this longer doesn't really give better security.

  I'm taking this with a grain of salt, but I've read that SHA256 isn't a secure choice anymore because it's too fast, meaning brute forces are quicker to do.

SHA256 by itself is fast. That is why you iterate it many times, which makes it slow again.

  Does this mean that fast algorithyms like SHA are obsolete and need to be replaced with slower algorithms like bcrypt?

For password hashing, yes. For password hashing you should use PBKDF2, Argon2, bcrypt, or scrypt.

However, there are many other applications for hashes, and SHA256 is fine for many applications, so I wouldn't say that SHA256 is obsolete.

  I assume that Hex Strings are a secure way to store salted hashes. Is this correct?

Yes.

  After applying all changes from the above questions (if any), would the above code be secure enough to use in a production setting?

Since you don't seem to know what you are doing, and this is critical security code, I would not use it in production. Also, there would be no reason not to use the built-in Rfc2898DeriveBytes class, which does PBKDF2.

Also, I wrote a blog post about Requirements for iterative password hashing.


Is ZRTP for secure multi user group video conferencing? I haven't find anywhere specifics about ZRTP's ability for secure encrypted group video/audio conferencing, so I am asking you. I know that OTR does not support multi user group chat, so is that same with ZRTP for multi user group video conferencing. Point me to some good websites (other than Wikipedia.).
And what are the limitations of it?

ZRTP is only used for end-to-end encryption... https://en.wikipedia.org/wiki/ZRTP

Since you can't make groups with end-to-end, there are other protocols that would support that https://de.wikipedia.org/wiki/SILC (as an example). Afaik - there are just text-chat implementations of this protocol.


Attacker models of long-term logins: how should sensitive server endpoints require re-authentication? Let's see the following scenario:

"GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut".
Alice logged in to GutHib with her password and 2FA, providing a strong proof that she really is the one who the registered account belongs to. (Let's assume she did well keeping her password and 2FA information safe, and no one else can access her account.)
Alice set remember me to true at login, so she does not need to log in every time she wants to browse on GutHib.
After 3 months of the first & only login to GutHib, Alice accidentally left her laptop open in a café while paying with her phone at the cash register. An attacker came to the laptop, opened GutHib, and since Alice set the remember me to true, the attacker could access the site's functionality while impersonating Alice, and clicked on "Transfer repository ownership" button at an important repository's admin page. This only required to be logged in, so one of Alice's important repos were stolen.

With applying re-authentication for this sensitive & destructive writer operation, GutHib could have prevented stealing Alice's code: the password is only known by her, also the phone with the 2FA app was also at her.

E.g. the api/transfer-repository endpoint could require an elevated session type based on password/2FA re-entry (e.g. PasswordSession or PasswordSession + TwoFactorSession, valid for 10min), or even a OneTimeSession acquired with the TwoFactorSession, which is specifically requested and signed for one particular endpoint call (valid only for the next endpoint call it is requested for).

How come that today's industry standards or best practices do not support these re-authentication flows?

tl;dr

Is there a standardized way to ensure that the user making a request to a server endpoint (which performs a sensitive, destructive writer action) really sits in front of the computer and is the same user who logged in 3 months ago with remember me, and not a malicious attacker?
This a real attack model. How come this is not supported by today's authentication & authorization industry standards like OpenID Connect & OAuth 2.0? Am I missing something?

The "level of assurance" of the authentication (how much you trust that the user is who she says she is, is usually stored in the standard-defined claim "acr". It's usually between 1 and 3, and is set during login based on the form of authentication. 2 factors give a higher acr than just a password, for instance.  NIST SP 800-63 gives some more details.

What you can do, is to require a certain acr value for important endpoints, and require reauthentication if the level is not high enough.

This solves your problem, if you have a mechanism to reduce the acr value over time  or when issuing long lived sessions. Then Alice is only able to use the "ownership" functionality for a short period after logging in.


How do you prevent a computer in a network from accessing RDP? So you're on a domain.

I know that Remote Desktop needs an authorized user's credentials (e.g admin) to log in with a remote computer. But can you also place a condition that you need to be using a certain computer(s) in the domain to log into it? That way you wouldn't be able to use Remote Desktop with just the admin username and password, you'd also need access to the admin's computer.

This can be done using Windows Firewall

Open Windows Firewall with Advanced Security
Click on Inbound Rules
Locate the RDP Rule
Right click the rule, go to Properties, switch to the Scope tab.
Add your IP addresses or IP address ranges


Why does bettercap and sslstrip work sometimes on Google and Facebook? sslstrip and bettercap work “sometimes” on Chrome browsers on sites such as Facebook, Google, AOL, and other sites that use preload HSTS. Why does it work sometimes when it shouldn’t work at all?

According to the documentation, this works by rewriting HTTPS links to HTTP links with a different subdomain. Since none of these sites use the includeSubDomains directive, the browser won't use HSTS for these rewritten links. Using the includeSubDomains directive prevents this attack by having browsers force the use of HTTPS for all subdomains of a site, instead of just certain subdomains.

Normally this shouldn't work for preloaded sites, given that the preload list requires that includeSubDomains be specified, but it appears the list has made certain exceptions to that requirement, notably for Google and Facebook. Google has a long list of subdomains preloaded including accounts.google.com, docs.google.com, encrypted.gogole.com, etc, but google.com is not preloaded. Likewise Facebook has www.facebook.com, m.facebook.com, secure.facebook.com, and several others preloaded, but facebook.com is not. Thus if you're already on an HTTP site, sslstrip2 can rewrite a link from www.facebook.com to wwww.facebook.com to avoid HSTS.

While testing this I discovered that Firefox's preload list also differs from Chrome's more than one might expect. As noted here, Firefox's list is based on Chrome's, but Firefox does its own validation of the list. This results in cases like touch.facebook.com, where Chrome has includeSubdomains set to true in its preload list, but Firefox has it set to false (indeed when I just tested it the header I got was strict-transport-security max-age=15552000; preload).


anti virus acting up/DNS poisoning I was running my desktop and the AV deleted a file that it said was a virus (this was not during a scan, just normal usage). Now I'm just browsing the web and I got a couple of DNS poisoning attacks detected. What is going on and is there anything I can do? I've got ESET smart security.

Not to sound alarmist but when the DNS poisoning attack happened I was viewing this page on past CIA projects from wikipedia. https://en.wikipedia.org/wiki/Project_MKUltra

Sounds like nothing big - DNS poisoning attacks and random other attack-like packets from the 'net are an every-day occurrence. I'm surprised your AV caught them though, unless it's a combined AV and firewall solution.

If the malware managed to run at all, however, your machine is compromised. Nuke it from orbit and start over. Now would be a good time to dust off your backups. You do have backups, right? ;)


Passing an encrypted value in Java Spring REST API query string I am using set of REST APIs build using Java Spring. I need to pass an encrypted value from client to a REST service. The client invokes a GET request.

My question is how secure and efficient it is to pass the encrypted value (as a string) in the query string. If it not that secure , what are the alternatives I have ?

Assuming that the risk could be a MiTM attack between your Spring client and the REST service, it doesn't necessary matter whether it's in a query string or POST body.  A query string would get cached (in a browser, proxy server, ...) which could lead to disclosure; but all in all I would encourage using end to end encryption.

If you Spring client ensures that it's talking to the right REST service (cert validation, pinning, ...) - then you can send "secrets" over that connection with a reasonable assurance of confidentiality and integrity.

Additionally, I don't know what your "encrypted" value is, if it's encrypted with a shared key, then someone could spend enough resources/time to reverse engineer it and get the secret.  If you're sending secret data; try to stay away from custom implementations; an end-to-end SSL/TLS tunnel has been proven very robust.


Is it technically possible to clear WhatsApp chat also on receiver's phone? A friend of mine whom I trust 100% states that a user he was exchanging messages via WhatsApp deleted the whole chat,on his phone as well. He was able to take a screenshot of the last messages before the chat had been cleared. I have seen, both the empty chat and the screenshot.The chat is totally empty,my friend's messages are also gone. Having read through WhatsApp's official FAQ I learned it is impossible to clear contents written by the receiver.
As a software developer,I am sure, there is nothing impossible when it comes to hacking and it pretty much depends on the skills set, but in this case I would like to know how hard / easy would it be to perform such a hack by someone who is not a hacker? Maybe there is a software people download and use to  hack WhatsApp account? I don't ask for recommendations of such a soft, just want to understand how accessible such tools are for normal users and how hard could it be to do this technically.

This doesn't really have much to do with "hacking". There is a command in the WhatsApp protocol where the sender can send to the receiver "Please delete message X". Whether or not the client honors that command is a different matter (it would be trivial for a client to simply ignore this command), but the official WhatsApp client by Facebook obviously does honor it.

So, there is nothing sinister going on, it's simply the WhatsApp client deleting a message in its own database because it was asked to do so by another WhatsApp client through perfectly normal usage of the WhatsApp protocol.

Note that there is a time limit built into the WhatsApp client, where after a certain time it will not delete the message anymore.

Also note that this will not wipe out the message from existence, e.g. it will still be present in any screenshots you made.


Is it possible to extract secret key in compiled code automatically? If we have a program that contains a secret key in its compiled code, is it possible to write a program that can automatically extract the secret key? Let's assume that the program contains a secret key is not obfuscated and the secret key is used to decrypt some messages. We can know the extracted key is correct if we can use it to decrypt messages.

This depends on how is manage the private key on the binary, and probably you will need to do reverse engineer to figure out the correct private key. I have seen keys split-ed in two parts: one on the text segment of the binary and the other component was opcodes on the execution segment as well as some keys can make mathematical operations on the assembler to be tricky to discover.

By the way, ask this question on https://reverseengineering.stackexchange.com/ probably you will find better responses


When first connecting via SSH to my server, the reported fingerprint does not match that given to me when I generated the SSH key When I used ssh-genkey on macOS to generate the pair of key files (one named with .pub), that tool reported a SHA256 hash as a public key fingerprint.
When first connecting to my server, a Digital Ocean droplet virtual server instance running FreeBSD initialized with the contents of my .pub public key file, on first trying to connect with ssh 1.2.3.4 I get the message:

The authenticity of host '1.2.3.4 (1.2.3.4)' can't be established.
ECDSA key fingerprint is SHA256:tjdoQBGbHexAm+uwZ5rZwxyJH0nxjMC08QtO47QGQjE.

This does not appear to match the SHA256 returned by ssh-keygen when I created the key files.
Some sites seem to say I should ignore this issue. They claim the key fingerprint that appears when connecting to my server via ssh is unrelated to the fingerprint of the ssh public key file’s content I uploaded to Digital Ocean for use in creating that server instance. I find this difficult to fathom.

What point is there in Digital Ocean insisting I supply a SSH public key to use in configuring my new server if it is ignored or is irrelevant?
What stops a Man-In-The-Middle attack if I am to ignore the fingerprint reported during the first attempt at establishing a ssh connection/session?
Why does ssh even report a key fingerprint if we are to ignore it?

There are two separate keys at play here:

Your personal client ssh key that you generated on your laptop, the private key is on your laptop, and therefore this key identifies that a connection is originating from your laptop.
The server's ssh key which was generated on the server during first-time boot (at least I assume so since you say you only uploaded a public key), the private key is on the server, and therefore this key identifies that the connection is terminating at your server.

Your core question seems to be: What does Digital Ocean do with the public key I uploaded during VM creation?

For an authoritative answer, you'd have to read Digital Ocean's documentation, but my guess is that they stick it in /home/user/.ssh/authorized_keys so that your public key (aka your laptop) is the only one that's allowed to connect to that machine. See this guide for more info.

To answer your 2nd and 3rd questions: ssh clients follow the Trust On First Use (TOFU) paradigm, and inherit all the strengths and weaknesses of it. It's not ideal, but it's probably at least as good as what would happen if you tried to switch ssh to certificates: half the ssh servers in the world would use the default cert that ships with openssh.


Proving a software deployment's origin sourcecode Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL?

sourcecode

  from commit #10020 at https://git.localhost/ (contains a file with a signed message?)

deployment

  using the sourecode commit #10020 at https://app.localhost/ ...provides signed response header like X-Hash: 1123123abcdef312 and X-Signature: 987987978978879 ??

Considering all https certificates are valid and there is no tls mitm happening from outside the domain(s), is there a way to prove the link between source and output?

It is impossible to prove that a specific output was created by a specific implementation just by looking at the output since there are unlimited possible implementations to create the same output. Use of HTTPS does not help here since HTTPS only protects the communication itself. It does not include a signature of the code creating the output or similar.


How do I make it so aireplay-ng deauth doesnt send a broadcast? Doing some testing on my home network with Kali and was messing around with deauth commands using aireplay-ng, however when I input my target IP address it will still send a broadcast and deauth all devices connected. Am I doing something wrong?

The command Im using: aireplay-ng wlan0 --deauth 0 -a (My bssid) -k (Target IP address)

I think that you are misusing air*-ng suite : this framework is intended for a "lower level" manipulation. You don't need to be on the same network as target, or even know its IP address.
When using aireplay, you should already have a clear understanding of "lower level" network topology : you should already know (e.g. through airodump) which client is associated with which AP.

Note: When I mean "client" and "AP", I'm talking about their BSSID's (which is often the MAC address).

Once there, you can tell aireplay to deauth client (identified by BSSID) by impersonating the AP (still identified by its BSSID), e.g. :

aireplay-ng -0 100 -a 00:14:6C:7E:40:80 -c 00:0F:B5:34:30:30 ath0

Note: Previous command is from https://www.aircrack-ng.org/doku.php?id=deauthentication; I just change -0 1 by -0 100 because in real cases, you need more than 1 deauth packet to effectively deauth target.

If you do so, aireplay will inject fake wifi packets in order to break the link between client and AP.

If you intend to break the passphrase, you should capture the (re)assotiating challenges (e.g. with airodump) and then break the key (e.g. with aircrack).

Hope this helps.


A "good enough" digital signature, with short key In my application, I want to hide debug feature behind a password. I don't want the password to be easily known by issuing strings executable, so I want to rely on digital signature.

We want Debbie to be able to debug the program.

The main scheme is:

Give the private RSA key to Debbie, put public RSA key in the program.
Give a random number sig to Debbie and put it in the program.
Debbie will "encrypt" sig with the private key, and access the debug features through the url /debug/<base64_encoded_encrypted_sig>
The software will verify that "decrypting" the number Debbie wrote in the URL, gives sig, and then allow access to debug features.

Why do I use plain RSA and not a known signature standard (such as PGP etc)?

The reason is, a typical signature is too long. Even 256 bits is long, and looks like that:

RS69BdGmd7330TNZU0Wk46VbTHvGLE46hIiy2ecHFX4T

So my question is, is my scheme secure enough?

update: even 256 bits keys are trivial to factor, so the answer is probably, this is not the way to go.

No scheme like this one will prevent a determined attacker from activating the "debug feature", by the simple expedient of reverse engineering the code to locate the part which, in the software code, will look like:

if (is_good_password(password)) {
    activate_debug();
}

and turn it into:

if (true) {
    activate_debug();
}

which is usually only a matter of turning a conditional jump into an unconditional jump, or an unconditional non-jump (i.e. a nop opcode). It is not even hard to do, even in big pieces of software (e.g. I did it once for Windows 2000, to allow for testing a custom CSP -- CSP must be signed, and the Microsoft-provided solution for deactivating the signature verification on development platforms was good only up to Win2k SP2, or WinXP, while I had a Win2k SP4; so I had to hack into the advapi32.dll, which took me 3 hours).

That being said, if you just want to verify a password, the easy way is to store in your software a password-verification token, i.e. a hash value computed over the password. No need to bring the whole paraphernalia of digital signatures ! Just a simple hash, and this can accommodate passwords of any length. The software embeds the hash value; when the "debug" URL is entered, it hashes the part after the "debug/" and sees if it matches the recorded hash value. Thus, the password does not appear in the software code itself (neither in cleartext, or merely "scrambled"), and you can use a "password" short enough to be typed.

Digital signatures are any good here only if you have an unbounded number of "Debbies", and you want to be able to give a "debug password" to each Debbie, so that each Debbie has her own password distinct from the passwords given to the other Debbies, and you want to make it impossible for an evil Debbie, regardless of how much reverse engineering she does, to recompute the other passwords from the one she already has (if you have only, say, 20 Debbies, you can just include 20 hash values in your code; by "unbounded" I mean "potentially millions"). This is a pretty specific scenario. An example is "product keys" -- digital signatures could theoretically thwart product-key-generators. Nevertheless, the strongest digital signature will do no better than a password hash against an attacker who does a few hours of reverse engineering on the code to locate the right conditional jump opcode. The signature would not protect against illicit access to the debug code; it protects only against extending an illicit access to an industrial scale, giving it to many other customers without requiring a local modification of the code -- a so-called "hack".

For the hash function, if in doubt, use SHA-256 -- if (and only if) the "password" is long and random enough (say 128 random bits). If the Debbie is allowed to choose a "meaningful" password (one that a human being will be able to remember, as opposed to have it written down on a piece of paper), then you should use a hash function which resists dictionary attacks, e.g. PBKDF2 or bcrypt.

Do not use the "encrypt with the private key" way of describing a signature; it is a terrible explanation, which does not work for all signature algorithms. It is just an historical way with which RSA was first presented, but even for RSA it is wrong: it does not take padding into account, and padding is essential for security (see PKCS#1). Just forget it. There is nothing wrong in "using the private key to sign some data" and "using the public key to verify some data".


Sniffing packet on wireless connection (airodump-ng) Short Question:

Is it important for a sniffing device to be in the broadcasting range of a client (NOT THE ROUTER) to sniff its packets?

Complete Scenario:

I assume that a wireless sniffing tool, like airodump-ng, is able to capture the packets from a client because the client sends its packets in all the directions in a wireless connection (unlike a wired connection where the packets travel through the wire in a certain direction).

Now, let's say we have a router A with a broadcasting range of 50m radius. 20m east of it is a client, B, connected to it. B has a range of 25m. And the sniffing device, say C, is placed 20m to the west of A. Is it, anyhow, possible for C to sniff B's packets?

Yes.

It's possible, it will be shown in the list of detected stations, and if it's connected to an AP, the AP can be shown in the AP list, but with little information it's gathered from the packets sent from the client to the AP.

Give it a try and see it for yourself.

wireshark output.cap

or .pcap, or .ivs file.

EDIT (This is a NO)

I misread the question, as @thomas-weller said, A (The AP) doesn't re-transmit packets of B.
I thought the monitor antenna (B was it?) was in range of the client (c?)


Lightweight block ciphers definition I've read in many papers something that looks an specialisation of the block ciphers calling them with a lightweight tag, but I couldn't found a definition.

If I understand correctly, those lightweight block ciphers are ciphers that due to their characteristics, are particularly interesting environments like embedded and small memory resources.

But how can be them defined formally to trace a clear line to distinguish which algorithms are, and which not, in this lightweight block ciphers set?

There is no absolute notion of "lightweightness": by definition, this is a relative notion: on a given architecture, a specific algorithm may be "lighter" than another. Depending on the usage context, this may be "light enough" or not. Moreover, there are several metrics:

On software platforms, we consider CPU usage and RAM usage (both L1 cache for code, depending on code size, and L1 cache for data, exercised by lookup tables).
On hardware platforms (FPGA, ASIC...), silicon area, latency, bandwidth, enery consumption... are important values and neither is "more important" generically than any other.

An algorithm can be lighter than another for one of these metrics, and heavier for another. For instance, with typical implementations, on software platforms, AES will use less CPU than 3DES, but will need from RAM (about 4 kB for constant lookup tables; usually, this cache usage is perfectly tolerable, which is why AES is almost invariably "much faster" than 3DES).

Every researcher eager on touting the performance characteristics of his pet cipher will define his own formal line of weight, his creation being, of course, in the "light" side.


Difference/Relationship between data leakage analysis and vulnerability analysis? What is the difference/relationship between data leakage analysis and vulnerability analysis? How much and what kind of vulnerability testing is required for data leakage analysis?

I have to give data leakage analysis report for some mobile applications. According to what I know, data leakage is happening when an app itself is sending important data to outside environment e.g. to remote server or a log file(which is accessible to other apps on mobile OS) or keeping it in some unsafe and vulnerable place.

According to my understanding, I only have to check how is app communicating and saving important data.

As for vulnerabilities and exploitation, so it is possible that some malicious party can use sophisticated and clever ways to hack an app, and steal its data. I.e. they neither hacked the victim's data communication method nor the possible storage locations(e.g. log), but some other component of application. E.g. call a function with a different remote server to send data to....

I understand that some vulnerability analysis will be required, e.g. data posted to server should not be un-encrypted....but how much deep(and what kind of) vulnerability analysis is required usually? E.g. the scenario that I mentioned in above paragraph, are such testing required?

"Data Leakage" is typically defined as unauthorized data that becomes available due to the actions of the normal operation of the program/user. As for your example of data transmitted unencrypted, I would see that as not a a vulnerability analysis but a normal part of a data analysis (any place the data touches requires appropriate protections for the classification of that data).

The relationship, then, to "vulnerabilities" has to do with information that can be extracted if a user exploits a weakness in the program.

The difference is normal operation vs unexpected operation.

As for how much Vulnerability Analysis might be required, it depends on the scope and expectation of the report. If you are tasked with defining the impact of normal operations ("operational focus"), then you do not need to do any vulnerability testing. If, on the other hand, the report is supposed to define each and every threat the to data ("data focus)", then you need to perform very detailed analysis of not only the potential vulnerabilities, but also a deep dive into an analysis of the code and architecture itself.


Is placing an `autorun.inf` folder in a drive's root a good safety precaution? Is it possible for viruses to use Windows' autorun.inf mechanism to start their execution? If so, is placing an autorun.inf folder a good safety precaution? My reasoning is that it can help in one fo two ways:

Best case scenario, the virus cannot write its own autorun.inf file because it is blocked by the folder.
Worst case scenario, the virus deletes the folder and replaces it with its own autorun.inf file. The drive is now infected, but at least you can notice the folder is missing and you are aware of it.

Well, it might help. Better yet, make your computer not to obey autorun.inf on removable drives (but assuming you plug your usb into another -infected- system, it can help noticing it).

There is a solution taking the next step, USB Vaccine, which creates a unwriteable, undeletable file with that name in your usb drive. It does so by marking it with some extra bits at low-level, so the normal fs aren't able to remove it (the program can uninstall it, of course). Virus are very unlikely to go down at such level just to remove an autorun.inf

But regardless of that, disable its execution. And remember that there are more ways of getting infected via usb than due to an autorun.inf.


Threat modelling tools and alternative threats From looking at threat modelling tools which are available (Microsoft SDL for Threat Modelling is probably the prime example) they seem to consider only threats at a low level, and I get the feeling that they are aimed primarily at developers.

On systems threats are not just from attackers, threats on the cloud can include location or service based threats (eg, laws may require certain kinds of data to be kept within certain jurisdictions, an alternative security problem but an issue nonetheless). This kind of threat is also not 'low level', such as the ones identified in the tools mentioned, but more medium level. These kinds of threats do not seem to be represented in any tools that I can find, and nor are those threats which come from sources other than attackers. My questions are the following:

Is 'threat modelling' as a process considered to be one which views threats from a low level only, and one aimed at developers? Because this is the understanding I get from seeing how these tools work. Or is it just that because these tools are used primarily by developers, they have come to prioritise the viewpoints of developers and like minded people?
Am I perhaps missing tools which provide information about other kinds of threats? Perhaps tools which consider a higher level view of threats and vulnerabilities? Or those which consider threats from non attackers as well as from attackers? I know that manual processes such as STRIDE and DREAD can allow people to identify threats at whatever level they want, but I am more interested in knowing about tools which might do this.

You're right that the Microsoft tooling is aimed at developers.  When we developed the v3 SDL tool, we wanted to focus in on what the developer would likely know about.  Managing jurisdiction is a requirement that's going to come from somewhere else.  So to your question 1, the current Microsoft threat modeling tooling focuses on developers and prioritizes their needs, and   As I discuss in my book, threat modeling is something anyone can do, and everyone should.  Unfortunately, the models of attacks outside the very technical are not as well developed.

[Apparently, I'm not allowed to comment, so I'll add a bit more here to your question 2. It's very helpful to define a scope of "other kind of threats."  One thing that can sink a threat modeling process is a succession of threats about which you can't do anything. Many of the threats you'll find with STRIDE can be addressed by developers.  So what scope are you looking for in #2?]


Why does Yahoo cached results button lead to blacklisted "malicious"/"phishing" IP? I did a search for some on Yahoo, I then click on the little arrow next to one of the search results and then clicked the Cached button because I wanted to view an older version of the page. It took me to the following URL:

http://98.139.236.92/search/srpcache?p=bath+cheese&ei=UTF-8&hspart=mozilla&hsimp=yhs-001&fr=yhs-mozilla-001&u=http://cc.bingj.com/cache.aspx?q=bath+cheese&d=4563864025038867&mkt=en-US&setlang=en-US&w=sVSPjqG8BYYbZ4DSlYO9uBJj_-F6Hk1P&icp=1&.intl=us&sig=lAvXGeEt7zIwy1nClj6spQ--

Which took me to a page which reportedly (by uMatrix in Firefox) had one script on it which was allowed. My browser told me, or at least I was taken to a page which said, that my browser was unable to connect.

Because this is a rather strange occurrence I scanned the IP using VirusTotal. So far it's not looking good:

There are also multiple reports as follows on this either being a phishing site or malicious:

McAfee
Quttera
Securi

I have an up-to-date 64-bit Arch Linux installation with Firefox 53.0.3 and GNOME 3.24.2. Is this anything to worry about? Have Yahoo been compromised or is there a perfectly innocent explanation for all this?

I think a possible reason that my browser couldn't reach the site is because it doesn't appear to support HTTPS and thus HTTPS Everywhere would have blocked it from loading since it only allows HTTPS and automatically redirects to it.

I don't think yahoo has been comprised. Not that I would expect them to tell us if they discover they were!

I agree with the https everywhere scenario. Plus it could be that the IP is marked by these services as phishing because

It's and IP rather than domain name
on this IP is returning 'fake' copies of sites. Which is correct as they are cached but this might trigger some phishing protection services
the lack of HTTPS could also influence the above possibly


ISO 27001 For Outsourcer Just to clarify, my company is a software outsourcing provider (commonly referred to as "outsourcer") and we - not our customer - are planning to get certified to ISO 27001.
Given that we only take care of the the development for customers projects, and don't have access to their production environment or any production data, are the following controls applicable to these projects, or are they only applicable to our internal projects?
A.6.1 Internal organization
A.14.2 Security in development and support processes

There are sections of ISO (270002) that refer directly to outsourced development and vendor agreements. The rest pertains to your organization.

Controls that Reference Outsourcing:

13.1.2
14.2.1
14.2.5
14.2.7
14.2.8
15.1.3


How to search for all computers running memcached on shodan Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port 11211. A client software (such as web server) can make get and set queries to memcached server. As clients can store sensitive information in Memcached, it is not advisable to connect Memcached servers to internet.

For my research, I would like to search the active memcached servers that are connected to internet. A simple search query on shodan.io would be "port:11211". As I only want "active" memcached servers, I want to list the servers which store more than 1000 items (cur_items > 1000). May I know how to query shodan?

Shodan sends the STATS command and that information can be seen in the Memcached banner and metadata:

https://www.shodan.io/search?query=product%3Amemcached

You can use that information to see the number of stored items though we don't allow filtering by that information via the API/ website so you need to download the search results to process it locally.


Any additional security with large blacklisting hosts file? I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm.  I update this file as regularly as I remember and layer it with appropriate add-ons in my modern web browser of choice, A/V, and firewall solutions.

Basically, I realize that a large (generally static) blacklisting hosts file is protection against KNOWN threats (and only those with names!), and very little help against unknown and emerging threats (or straight up IPs).  I must admit that I have not checked to see if there are stats regarding the attack/infection rates of new threats vs. known threats though I would expect that old, known threats probably still outweigh new threats simply due to volume.

QUESTION: Is there any added value from running with a large (generally static) blacklisting hosts file when used with modern consumer-grade anti-virus and firewall solutions?  Is it a redundant layer?  I admit that A/V is generally a black box to me, so I'm not sure what kinds of signatures their engines scan for, and whether hostnames are part of those signatures.

Although this seems like a free extra security layer, there are "costs" with manually updating the file, and the fact that I turn off DNS caching to prevent the whole file from hanging the machine each time it reloads itself (which can be frequent). (I've migrated DNS caching to the router instead which doesn't help me when I use my laptop elsewhere.)

Hosts file blacklists only provide protection by mapping specific domains away from their intended targets (generally to local). This does not block IPs or data transfer, just the lookup of the IP. I'd say the added value is minimal, especially if you're using local blocking like AdBlock or Ghostery. If you want to blacklist "known threats", use IP blocking software with a well-maintained list. If you want to be totally secure, unplug the ethernet cable.

As you've pointed out, it causes a major slowdown with DNS lookups (it linearly parses the text file on DNS cache miss). That's because the hosts file was never intended to be used as a blacklist.

edit:
Here's script to use Windows Firewall to block IPs: http://www.sans.org/windows-security/2011/10/25/windows-firewall-script-block-addresses-network-ranges


Is there a security method for data transfer that hides the sender? I would like to know if there are any security methods that their approach for security of data transfer would be to hide the identity of the sender (and not the data itself)? If they exist how do they work?
I would like to relate for both cases the following cases:
1. hiding the sender
2. hiding the sender only against man in the middle attacks but making sure the recipients knows the sender

There are several options:

burn the data to a CD-ROM and mail it while not giving a proper sender address
use anonymizing tools like Tor, anonymous mailers etc
work from an internet kiosk, open hotspot or similar

Of course there are often ways to at least narrow down possible senders based on the data they send (who has access), writing style etc.


Is explicitly disabling a default in the sudoers file the same as not listing it at all? I'm reviewing the /etc/sudoers file on a machine in response to CVE-2019-18634, a buffer-overflow vulnerability present in sudo. The bulletin on the sudo.ws website recommends the following mitigation:

  If the sudoers file has pwfeedback enabled, disabling it by pre-pending an exclamation point is sufficient to prevent exploitation of the bug. For example, change:

  Defaults pwfeedback

  To:

  Defaults !pwfeedback

However, upon reviewing the sudoers file, the configuration I see is what I presume is an implicit deny, where there is no mention at all of pwfeedback, which has sparked my curiosity.

What I've tried so far:

I have tested the behavior of sudo when pwfeedback is explicitly denied by adding Defaults !pwfeedback to the sudoers file as per the recommended mitigation, as well as when there is nothing added. As I would expect, there is no difference in behaviour. This appears to confirm my belief that (in this instance) anything not explicitly allowed is treated as implicitly denied.

My question:
Both solutions appear to solve the issue, removing Defaults pwfeedback from the sudoers file should work by itself, I think.

Is explicitly disabling a default in the sudoers file the same as not listing it at all?

Both solutions appear to solve the issue, removing Defaults pwfeedback
  from the sudoers file should work by itself, I think.

You are correct because, as per the sudoers(5) man page, the implicit default for pwfeedback is off:

pwfeedback' By default, sudo reads the password like most other Unix programs,
by turning off echo until the user hits the return (or enter) key. Some users
become confused by this as it appears to them that sudo has hung at this point.
When pwfeedback is set, sudo will provide visual feedback when the user presses
a key. Note that this does have a security impact as an onlooker may be able to
determine the length of the password being entered. This flag is off by default.

However, when there is an active vulnerability like CVE-2019-18634, mitigation advice is often to explicitly disable, for a few reasons:

An explicit disable is easier to audit than an implicit default disable.
An explicit disable will work even if a particular packager has altered the implicit default.
An explicit disable is more comforting to some people than trusting implicit defaults.


Unencrypted login page for EU (utility) company handling PII Suppose a EU company provides me access to my personal information over HTTP, without even an option for HTTPS. Does that violate EU privacy laws?
Can the company be compelled to fix its website, and how?

FWIW, I'd suspect subtler issues after I got a stack trace from their production server, but have nothing specific.

The actual company is a town-owned public utility providing water, and the website provides access to name, address, email, water bills and such. Customers don't have to use the website if they are fine with only traditional snail-mail bills.

Apologies if this isn't appropriate here—I'm guess it would be if I operated at the company. Feel free to move.

It does not validate CURRENT privacy laws, as the CURRENT laws only state that you should secure the information - not how much and when - ergo, its only illegal with unsecured PII the moment a breach happens.

However, it would violate GPDR that is upcoming 1 july 2018 what I remember.
However, not all PII needs to be secured. Its depends on what PII.

A IP-adress, username, email adress is considered PII, but such a low value that theres not much requirements on securing. How much PII must be secured depends on how sensitive the PII is, where medical data and crime data is considered the most sensitive, and pseudonyms (usernames, passwords) are considered the least sensitive PII.

An adress is however PII that is considered needing extra security. Same with water usage patterns.


Is ist possible to emed a backdoor in a picture? Is it possible to infect a picture with a backdoor? And what can I google for that?

In theory, it is potentially possible to embed malicious code (e.g. a backdoor) in anything. However, for the code to be executed there must be some kind of vulnerability in the program that reads the image (e.g. Paint, Photoshop, Windows photo viewer) that makes it possible to fool the program into "accidentally" executing the code. Different types of buffer overflows are commonly used for this.

In practice this is not so easy, though. Since the program reading the image needs to be vulnerable, there is no silver bullet that will work everywhere. If you find a vulnerability, it will probably just work with a few particular versions of one particular program on one particular OS. And since vulnerabilities like this are (hopefully) patched as soon as they are discovered, you will either need to find a freash new vulnerability (a so called zero day) or only be able to attack victims who uses old, vulnerable software.

But still, this sort of thing happends in the wild. Here are two examples:

ImageTragick was the punny name of a vulnerability in ImageMagick, a software commonly used for processing user uploaded images on servers. It allowed remote code execution by sending SVG images that linked other images whose filenames contains shell commands.
If I am not mistaken, Stuxnet spread through a vulnerability in the code in Windows Explorer that processes the thumbnail images of USB drives. (I can not find a source for this, though.)

There is more on Google.


Is it possible to be a hacker without being a criminal? I am interested in information security, and I want to be a "hacker." I want to write hacking tools, make viruses, and other stuff...

For me, programming botnets are a lot of fun, but how can legally I earn a living through the creation of nefarious applications?

There are many ways you can be an "ethical hacker." Here are a few that come to mind:

You can write malware that helps catch the bad guys. Who the "bad guys" are may depend on who you're working for, and what your beliefs are. This may be a gray/black area to some.
You can write malware so you can understand how it works, and then defend against it. The best anti-virus authors are those who understand how to actually create malware.
You can get paid to find bugs in programs developed by large corporations, but this isn't generally "creating" malware; it's just finding security holes, of which people could use to inject malware.

Just because someone creates malware doesn't mean they're going to use it against others. For some, just understanding how it works is enough. Not everyone involved in information security is out to hurt someone.


can snort rules be defeated by palindrome IDS such as snort uses string match or PCRE as basis for the rules. A string rule will only match one pattern, a PCRE rule can match a list of patterns.

I wonder if hackers can use palindrome to defeat PCRE based rules. palindrome are symmetric patterns such as
abccba  uvwwvu

Since palindrome patterns can't be expressed by PCRE rules, so it's going to be hard to write a snort rule to detect it, right?

The aim of a snort rule is not to match arbitrary content but potentially malicious content. A palindrom by itself is not malicious. And if you are able to construct a specific malicious palindrom then it is probably easy to match this one with a string or PCRE match.


Automatic's Jetpack login auth....Why isn't this a security flaw? I’m framing this question vis-a-vi Automatic and Jetpack, but I think it’s about something I don’t personally understand that is happening in a WordPress context, so I’m posting here. It’s not about Automatic though, this could be any general case. So bear with me...

My hypothesis is that Automatic / Jetpack has an inhearently insecure auth system, so I expect someone here to tell me what I don’t understand, assuming I’m wrong.

There are Auth / Signon plugins for many sites to use a particular network’s auth creds to login to another one. For instance, you can login to bitbucket.org with your google.com credentials like this:

When you click the signon button, you get redirected by a modal to google.com, where you enter your password. Then google authorizes your login to the client site, WITHOUT EVER GIVING YOUR PASSWORD TO THE CLIENT SITE. In other words, when I login like this, bitbucket.org has no way to actually get my password unless my browser or the network has been compromised somehow. Many sites have this, facebook, yahoo, AOL etc.

Contrast to this login technique which I noticed on sites like
digest.bps.org.uk
jetpack.com

Which I understand to be fully qualified domains hosted by automatic, or at least sites using the jetpack product. I don't use either so I'm not sure...

When I try to make a comment on jetpack.com, I am prompted for my WordPress.com password FROM THE JETPACK.COM domain. I'm not re-directed to wordpress.com or gravatar.com . Yet, I am logged in if the password is correct.

My understanding of these auth systems used is that the SSL cert being green, is the method by which the user can confirm that the site they are dealing with can be trusted, as long as the domain is confirmed. You can log in to bitbucket.org with your google.com creds, because when you are asked for them, the browser says "google.com" at the top, not some random site. What is to stop me from setting up blogs all day on random domains, ask for wordpress.com creds, automatically check them, and then signon the user if the creds are good, and then steal them myself? Please explain to me why this isn't a massive security flaw?

(Disclaimer: I work for Automattic)

The OP is right to be concerned, because there is something wrong here. But, it's not nearly as bad as it appears on the surface.

WordPress.com is a WordPress Multisite network, so digest.bps.org.uk is not a separate site from wordpress.com, it's just an alias. It's the exact same server/codebase/database serving both sites. Once the application receives the request, it determines which content/theme/etc to show based on the hostname.

So, when you submit your credentials into digest.bps.org.uk, they are going to wordpress.com, because digest.bps.org.uk is  wordpress.com. Individual site owners do not have access to the code/servers/database, though, so they can't see the credentials that were entered.

The actual problem here is that it trains users to enter their credentials on what appears to be a different site, which would be dangerous in most situations. Fixing that is on our roadmap.

We make mistakes, but we do care deeply about security and privacy. If you come across anything else that seems wrong in the future, we'd love to hear about it privately first, so that we can have a chance to fix it before people with malicious intent learn about it. Our website describes the process for security disclosures.


OTP generation is specific to SIM or Phone number Are the messages including OTP sent to a mobile phone addressed to the SIM card or the phone number?

If I decide to have a new phone number and the old phone number is allotted to a new customer, the bank may send the OTP to the same old number even if I have the SIM.

So is OTP or messages sent to the SIM?
Are text messages specific to SIM or specific to phone number?

SMS messages are always sent to a phone number. If you don't have access to the phone number registered for 2 factor authentication at some provider, let them know immediately so they can remove the number.


Why would malware try to remove other malware? Recently my php-based website got infected with malware (probably by a stolen ftp password).
Basically, every 30 minutes a file frame_cleaner_php.php was uploaded, a HTTP-GET was done on it to execute it and it was removed. I was able to intercept a copy of the file and analyze it.

It was not obfuscated in any way and was quite easy to read.
In essence it recursively scanned all php-files, looked for 20 signatures of infections by common other malware (like <?php eval(base64_decode(" or <?PHP # Web Shell by oRb) and crudely removed the lines with that infection.

Because of a false positive some lines in my own php files where removed causing the site the go down. This was probably just an unintended side effect of the malware.

The big question: why would malware do this, what is there to gain?

There is two explanations as I see it.

Fight over the box

The different malware types want to single-handedly own the box and not share it with others. It will therefore try to patch the system and remove other malware and leave a backdoor for the creator.

Ethical worms

Malware that spreads only to patch and remove other malware is often referred to as "white worms" or "ethical worms". These types of worms has very many liability issues so they are often not seen a lot.


Advantages with PIN code authentication where the digits are placed at random positions? I noticed that a lot of high-risk websites, such as bank and payment platforms, do not use a passwords for authentication (as usual) but instead use a PIN code where the numbers are placed at random positions each time, like on this one:

What is the point with this authentication method? Any advantages or disadvantages compared to traditional passwords?

My guesses are:

Attack by keylogger is not possible.
Attack by bruteforce / rainbow tables / social engineering are more difficult.

This is to a large extent just security theater. It forces users to hop through a couple of hoops in the name of security, and thereby make them feel secure since they expended effort in the name of security.

That said, it does in fact defeat a simple key logger (since no keys are pressed) or a mouse click logger (since knowing the coordinates of a mouse click will not give you any information about what number was clicked).

However it does not protect against more sofisticated attacks. If someone has managed to install a keylogger on your computer, it is effectively game over. It is not longer your computer. If someone can install a keylogger, they can also install a program that hooks into your browser and logs everything being entered into a text or password field, or all outgoing HTTP and HTTPS requests before they are encrypted with TLS. Just like a keylogger, malware like this does not need to be targeted against a specific site to work.

In addition, they come with a number of security downsides (apart from the usability):

They are more vulnerable to "shoulder surfing", as the screen is harder to hide than the keyboard.
Since only numbers are allowed in this case, it limits the number of possible passwords and therefore makes brute force attacks easier. There are about 2000 million different passwords with six alphanumeric characters. There are 10 million different passwords with six numberic characters.

One upside, as techraf mention in comments, is that you avoid revealing smudge marks on touch devices.


Use the hash of the password to encrypted password I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the server.
the password length is minimum 12 chars (including special characters) and max 20 chars.

Is this is bad mechanism ?

Is this is bad mechanism ?

Yes. Use SSL/TLS and do not attempt to roll your own cryptograhy scheme.


DNS Hijack: Only spoofing sites listed in etter.dns I'm trying to create a more practical DNS Hijack mitm attack. I do the traditional arp poison with dns_spoof method. I don't have any issues getting it to work. The intended domain redirects exactly as expected. The only issue is that the current method isn't realistic. It would make a victim extremely suspicious because every other website would break. An attacker would need to count on him going to your domain immediately after you initiate the attack.

ALL websites not listed in the etter.dns host file gets redirected as well. How can we get ettercap to spoof ONLY the websites listed in etter.dns while forwarding everything else to their intended locations?

Comment out the following lines in /etc/ettercap/etter.conf

  redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

  redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"

Note: You will need these lines uncommented if you plan on running SSLStrip.


Eavesdropping in VoIP. Any other software besides Ethereal? In school our professor demonstrated how the software Ethereal could be used to eavesdrop VoIP calls. That software no longer seems to exist since the webpages are no longer around.

What other software I should know about that could be used by employees on my internal network  to eavesdrop VoIP calls?

How big of a concern should I make this?

Ethereal was renamed Wireshark back in 2006 due to trademark issues.

Ethereal/Wireshark is just a packet capture tool with a GUI front end, there are many packet capture tools available. As to intercepting particular traffic, that would depend on particular network architecture and/or various attack methods that end up being a man in the middle.


JWT access token and refresh token We have two applications App1 and App2. A user uses a browser to communication withe apps. App1 supports different auth. mechanisms (SSO, usr/pwd, etc.) but App2 doesn't have any access to auth data and doesn't support any auth. mechanism. So we need to provide an authorization mechanism for App2 to apply some access control. I thought of SSO and JWT for this issue. Meaning that:

App1 plays the role of auth. server and whenever the user wants to connect to App2, s/he is redirected to App1 for authentication.
After a successful authentication, a JWT token is generated by App1 (The token contains user_id and user_role).
The token is set into the header and the user is redirected to App2.

Assuming that all the communications are done over HTTPS and PKI is used for signing the token, here are my questions:

Is a simple signature verification by App2 is enough? Or there is a need that it sends the token to App1 for verification (there is a white list of public keys for App2) ?
I'm considering to add an expiration date for 30 mins, how should I handle refresh token at the client-side ?
Instead of generation refresh tokens, is it secure to say that the access token is one-time only and App2 creates a session on the server-side (using the data in the token)?

Thank you so much for your help :)

As a Developer

Unless your APP 1 is built to be federation service, you shouldn't be extending APP1 to act as a federation service. This is just bad software design.

If APP2 lacks authentication and authorizations, you should, logically just add that into the application. It can be a SSO method but make sure it's authenticating with a Service Designed to do Authentication/Authorizations.

If APP1 and APP2 have nothing to do with one another (which sounds like it) than DON'T CREATE A DEPENDENCY VIA AUTHENTICATION.

As a Security Professional

To Answer you questions:

This depends on your risks and how important these applications are to the organization. You might want to re-read about JWT's. In order to verify a token, you need the secret, and in your design APP1 has it, and you either need to have it also on APP2 (exposing more risk) or rely on APP1 to verify the token at which point you need to ask yourself "Why would APP 1 care whether the token for APP 2 is valid?" The answer is because you built an unnecessary dependency for APP 1 to be responsible for APP 2's safety.
By the nature of tokens, you don't handle them client side, if a token is not refreshed it expires, it's no good, you should be denying it.  A refresh token is used for generating a new auth token once it's expiration is hit. A 30 min refresh token means that after 30min you need to fully re-authenticate. If that was your goal, than have no refresh and 30 min auth tokens.
The purpose of a token system is to remove state from your application. If you are going to be doing sessions, than do sessions and ignore tokens. If you want to do One-Time-Passwords, for APP 2 Authentication, than do OTP, it's horrible to both because to you have all the risks of both and no good reason for both. I would read up on sessions vs token authentication.

My opinion of this based on your question -- It will be a security management, IT management, and Dev Management nightmare have an independent app relying on another independent app for authentication services.

I am sure there is more to the story, but if I was doing decision making on this, there would be a lot of "would you explain to me why this makes sense?" comments.


DOS attack to increase packets received from a single request? Is there any attack out there that can be implemented where a single request to a server i host for example responds by sending the same file say 20 times back ? the idea behind the attack is to DOS tor nodes which are hosting the stream, this attack is for a masters project, and just want to prove the concept of it working, if this can be achieved how can it be done thanks

Amplification attacks leverage the asymmetric nature of small amounts of data sent to servers producing a large amount of response towards a target. These are usually performed over protocols for which the source address is easily spoofed. This is not a strict requirement and certainly this could occur on a wide variety of protocols or services but the nature of being able to redirect traffic is what makes these protocols useful for attackers.

That said if you strictly want your dosfile.dat file to be used in a similar attack it would be easier to replicate this if you can insert it into a IP or UDP based service that can still allow for spoofing of source packets so the response can be redirected and sent to another system somehow. In theory, depending on the size of dosfile.dat you could create a DNS text record (or several) with this information and perform an DNS amplification attack of some form and that data would be included.

See the following for more information:

https://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack/


How do I monitor what a penetration tester is doing? Suppose I have a penetration tester working in my data center. She is testing my systems and is probably finding some issues, allowing her to gain root access to a machine that is inside a subnet deep inside the company network.

How can I be sure, that after the job is done, this system is not permanently compromised?

The question arises: How do I monitor what a penetration tester is doing during a penetration test to ensure that there are no longtime effects on my infrastructure?

Solutions I have thought about:

Nuke the machine from orbit.

This would protect the machine that was inside the scope, but a skilled hacker can gain access to other servers that are in the same subnet and/or pivot from the server that she has gotten access to to another machine.

Monitor all network traffic in the subnet

Not helpful if the pen tester makes a lot of noise and if the test takes several days it is also very costly.

Set up the pen testing desktop on a virtual desktop and give the penetration tester access to this machine. Monitor what this machine is doing, inspect shell history etc.

Also extremely costly, comes close to a forensic investigation and is susceptible to errors. I can probably do the pentest myself then.

Have ironclad contracts, only work with trusted companies and trust their employees.

Close enough? Is this the only solution? Or is there another way to better monitor penetration tester?

Unless absolutely necessary, do not give your pentester access to your production systems. Instead, create a dummy system with the same configuration but without any sensitive data stored in databases, etc. If you let the pentester work on the production systems, you will have to trust them. If it is absolutely necessary to allow an untrustworthy pentester to operate on production systems, at least make an off-site backup so any changes to the server can be compared to the backup.
This may not be possible if the entire network needs to be tested, or if a test system that behaves identically to the production system cannot be set up. In that case, you will need to trust them.
Generally however, a qualified pentester will be trustworthy. It is not worth it to them to compromise your computer and ruin their reputation in an industry where it's so hard to gain it back. Both you and the pentester will sign a contract specifying what they are allowed to do, what attacks are in-scope, etc. This will allow you to prove malpractice in the case that they step out of bounds (for example, if they stress test your production server against your wishes and end up effectively denying service).


How to perform penetration testing of Blackberry mobile applications? I wish to start with blackberry mobile application penetration testing.
I researched on net but no "in-depth" knowledge is available.

Here is a good article but not much is covered.
http://resources.infosecinstitute.com/security-assessment-of-blackberry-applications/

I had a look at this question BlackBerry handheld penetration testing

The above question targets the handhelds and not a particular mobile app.
It would be great to get any help regarding how to pentest blackberry mobile "app".

Any help is highly appreciated.

Regardless of the platform, a basic mobile penetration test should cover the OWASP Top 10 for mobile.


Airodump-ng occationally not showing networks near me I'm brand new to the field of pen testing, so please excuse my ignorance and the potential asking of a question that already exists. As I stated in the title, there are times when I run airodump-ng [interface] and no networks are displayed. And to be clear, I do not mean that certain networks show up sometimes and not others; I mean that zero networks are displayed. I am using the Alfa AWUS036NEH network adapter with the Ralink RT2870/RT3070 chipset, and I know of three ways in which to switch this adapter to Monitor mode (excluding code to turn off wireless adapter and turn it back on):

iwconfig wlan0 mode monitor
airmon-ng start wlan0
airmon-ng check kill followed by airmon-ng start wlan0

When I try to use any of these various methods, I get varied results. Sometimes the second approach will work and other times it won't. Same with the other methods.

My question, then, is whether this is normal or not. From what I have found online, the network adapter I am using is not one of the most popular ones, so I'm willing to buy a new one if that's the reason. But knowing that it might just be me not fully understanding how everything works, I was hoping to get some insight from this community.

For what it's worth, I'm using Airbase-ng 1.2 rc4 and running cat /etc/issue shows Kali GNU/Linux Rolling \n \l. Please let me know if more information is needed.

Try running airmon-ng first followed by airmon-ng check kill. If that does not work try killing the processes manually by typing kill [pid of the process]. And if all that does not work try "rfkill unblock all", this will unblock your adapter if it was being blocked by the firmware as it is not a very famous adapter and may not have the proper drivers installed.

Try all of the above methods and if all of them fail then your adapter may not be compatible or may partially be compatible, i suggest getting a TP-Link WN722N v-1.0. It is a budget adapter and i personally use it besides alfa adapters. Make sure you get the v-1.0 because v-2.0 is not compatible.


E-Mail Web Client: How to handle credentials I am thinking about building an e-mail web client that I can run on my server as a side project. The server addresses should be configured on the server side.

Multiple Accounts should be able to access their emails through the client.

As I see it, for POP/IMAP/SMTP the credentials have to be sent with every request, so I need to store them somewhere.

What is the most secure way to do this?

Since your web mail client is just a front end to some existing email account you can simply use the IMAP/POP login information as the login information for your web mail client. In this case you don't need to store any credentials permanently for retrieving the mail.

Since you probably need access to the credentials while the user is still logged into your web mail application and you don't want to ask the user again, you might include the credentials in encrypted form inside the session cookie, for example as encrypted payload inside a JWT based cookie.

While many (most?) mail providers have the same credentials for IMAP/POP and for SMTP they might be different for some providers. In this case you could encrypt the SMTP credentials with a key derived from the IMAP/POP credentials so that they are only accessible for somebody having the IMAP/POP credentials already. You might then store this encrypted credentials in a database or you might store it only at the client side, for example in the browsers local storage or in some cookie with a really long expiration time. Storing these encrypted information at the client side has the advantage that no sensitive client information need to be stored at the server side at all.


Should I NOT choose a password of max allowable character length? Q: Suppose an attacker knows the max allowable character length, n, for a website's passwords. Would it be smart for them to attack passwords of length n BEFORE length n - k (where k is small portion of n)?

Q: Suppose a website has max allowable password character length 32. Would it then be smart for me to choose a password of length, say, 31 or 30 rather than 32?

UPDATE: Asked another way: is there a known phenomenon of a mass of user passwords at n? And if so and knowing that, would attackers go after passwords of length n before length n - k? And if so and knowing that, would users be better to avoid passwords of length n?

Assuming that the passwords must consist of printable ASCII characters (of which there are 95), the number of possible 32-character passwords is 9532 ≈ 2 × 1063.

Meanwhile, the number of 31-character passwords is 9531 ≈ 2 × 1061, i.e. about two orders of magnitude less.  (In fact, they differ precisely by a factor of 95.)  The number of 30-character passwords is even less, 9530 ≈ 2 × 1059, and so on.  In fact, the total number of possible passwords of length less than 32 equals:

    9531 + 9530 + 9529 + ··· + 952 + 951 + 950

 = 9532 × (1/95 + 1/952 + 1/953 + ··· + 1/9531 + 1/9532)

 < 9532 × (1/95 + 1/952 + 1/953 + ··· + 1/9531 + 1/9532 + 1/9533 + 1/9534 + ··· )

 = 9532 × 1 / (95 − 1)

 = 9532 / 94

Thus, the number of possible printable ASCII passwords of exactly 32 characters is 94 times greater than the total number of such passwords of less than 32 characters.  Thus, if an attacker is able to crack a 32-character password by brute force, it will take them, on average, one 94-th of the time to crack any shorter password.

Of course, this assumes that your passwords are randomly chosen out of the space of all eligible passwords.  Few real-world passwords are such, but as a rough approximation, we can still assume that the amount of work needed to guess a password by brute force grows exponentially with the length of the password — the base of the exponent will just be something smaller than 95.

Also, there's nothing special about the number 32 in the calculation above.  Replacing it with any other maximum length will yield exactly the same result: it's always a good idea to make your passwords as long as possible, at least up to the point where the password is long enough to make brute force cracking essentially impossible.

Where is that point?  Well, the general consensus among cryptographers is that 264 ≈ 2 × 1019 brute force guesses can be done with enough effort, while 2128 ≈ 3 × 1038 guesses is probably beyond the capabilities of any currently existing or foreseeable attacker (yes, even the NSA), and 2256 ≈ 1 × 1077 guesses is definitely beyond the capabilities of mankind.  The effort required to crack a random 32-character ASCII password by brute force, i.e. 9532 ≈ 2 × 1063 guesses, is between the latter two, but definitely closer (on a logarithmic scale) to 2256 than to 2128, both of which are currently regarded as unbreakable.  Thus, we can safely say that, if your password is a random ASCII string, 32 (or even 31 or 30) characters is quite plenty enough.


How can I tell what cipher was used by python-gnupg? I'm encrypting a file using the python-gnupg module like this. Ultimately, I want to use the AES256 cipher for encryption:

status = gpg.encrypt_file(fin, recipients=['root@frarakee'], output='foo.bin.gpg')

When I check the file at the CLI, it tells me it's a PGP message:

# file foo.bin.gpg
foo.bin.gpg: PGP message

If I encrypt the file using gpg at the CLI (Ubuntu 14.04), the file command tells me its data yet gpg shows it's using AES256:

# gpg --verbose -r root@frarakee --cipher-algo AES256 -e foo.bin
gpg: using PGP trust model
gpg: using subkey 1C32653F instead of primary key A7173E08
gpg: This key belongs to us
gpg: reading from `foo.bin'
File `foo.bin.gpg' exists. Overwrite? (y/N) y
gpg: writing to `foo.bin.gpg'
gpg: RSA/AES256 encrypted for: "132653F root@frarakee <root@frarakee>"

# file foo.bin
foo.bin: data

Notably, the python docs state:

  The default cipher_algo, if unspecified, is 'AES256'

But the file command only seems to agree with this when I used symmetric encryption:

# gpg --cipher-algo AES256 -c /tmp/foo.bin
# file /tmp/foo.bin.gpg
foo.bin.gpg: GPG symmetrically encrypted data (AES256 cipher)

I'm not sure if this is a bug in the file magic, the python-gpg module, or just my understanding. How can I tell what cipher is actually being used by gpg or the python-gpg module? Is there a better place to ask this?

file only looks for some magic bytes to determine the file type, but does not fully parse the OpenPGP packets. You can view all encryption details by running gpg --list-packets or pgpdump (output is easier to read, but needs to be installed separately). Reading through RFC 4880, OpenPGP might help at understanding the very technical output.


How to have both TLS and Time Stamp Signing for data? As you know, we use TLS for multiple purposes, including integrity, confidentiality and authentication and we use TSAs (Trusted Timestamp Authorities) to have signed timestamps for our data. (Read about it here)

The question is which one of the must be applied first?

In the other words, what is the data which we feed to TSA functions?

hash(raw_data)
hash(tls_encrypted(raw_data)

For first case the final packet which the final client receives is:

TLS_ENCRYPTED_DATA + TLS_ENCRYPTED_OF_TSA_SIGNATURE

For the second case, the final packet which the client receives is:

TLS_ENCRYPTED_DATA + TSA_SIGNATURE

You don't provide an actual use case but my guess is that you want to use TLS to transfer data which have a cryptographic time stamp. In this case you need to first time stamp the data and then transfer these. You can also transfer the same time stamped data again and again within multiple TLS connections and the TSA signature stays the same and is still valid.

Time stamping the TLS traffic on the other hand does not really make sense. Since multiple transfers of the same data via TLS would result in different byte streams (since a different key and/or sequence number is used) the time stamp could only be valid for a single transfer.


How does SSD with SED encrypt and decrypt data? When you enter data and you want to save a file, the SED encrypts the data but where does the encryption process occur to be exact? Does SED encrypt  data in memory before it gets to the disk? Or do they re-encrypt a block or page on SSD once the writing is done?

The encryption process takes place in the embedded processor on the SSD.  Consequently, it's in the computer's RAM and the SATA (or PCIe) bus in plaintext, then copied to RAM on the SSD, encrypted, and written out to a flash block.  The unencrypted plaintext should never hit the flash of the SSD.


Why should you clear your pasteboard when exiting your app? I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to lose potentially userful information they have copied as a result of over-zealousness especially when the data is still very much insecure when the app has not been terminated and other apps are being run in tandem.

In a similar question to my own but for the windows pasteboard it's suggested this would not be a high risk problem as the pasteboard should be the least of my worries when malware is present on my device. What is the main reason I should be doing this and why is it considered as a fairly high risk?

The app has access to the internet and does contain SPI.

The clipboard indeed cannot be considered a safe place, this for several reasons:

Malware accessing the clipboard content: in your question you focused on malware installed in your machine, however there could be transient malware (like a malicious Adobe Flash banner on a website you visited for instance...) which will not infect your computer when run, but just attempt to get the clipboard content at that time and send it to their home,
User wrong manipulation: A wrong manipulation could lead you to paste the wrong content at the wrong place. Usually without consequences, with sensitive data such wrong manipulation can still have heavy consequences,
People around the user: When the computer is left unattended and unlocked or if the user's attention is temporarily distracted, it is very quick for someone else to press a Ctrl-V then Ctrl-Z on his keyboard to quickly see his clipboard content without the user noticing.

While it is still better to avoid completely clipboard usage, when it is required the mitigation for such threat is to ensure that the sensitive data does not remain in the clipboard for too long: ideally it should just remain there enough time to be used and no longer.

In your question you suggest to clear the clipboard when the application exits. The efficiency of this greatly depends on the way the application is used: if this is the kind of application which is closed only at the end of the day such measure seems just ineffective.

An good example and inspirational source for this situation can be the password manager KeePass which proposes to handle this in two ways, depending on user's preferences:

To avoid completely clipboard usage, KeePass proposes what it calls Auto-Type: it will directly fill targeted fields by simulating the appropriate key presses. The advantage is that no data ever passes through the clipboard, however such behavior is more complex to implement and may not be fully compatible or portable (especially true since you mention a mobile application),
When using the clipboard to copy/paste passwords, KeePass can be configured to automatically clear the clipboard after a short amount of time. When copying a password, KeePass displays at the bottom of its main window a decreasing progress bar giving the user a visual feedback over the timeout progress, and once the timeout expires (15 or 30 seconds for instance) and if the clipboard still contains KeePass data then KeePass deletes the clipboard content (the user must not use one of those "clipboard history managers" for this to be really effective though).


osquery in Docker environment I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security dilemma that I would like some thoughts and feedback on:

Running osquery on every Docker container in the infrastructure would give excellent situational awareness, but unfortunately osquery can't run on the slimmed-down, security-focused Alpine Linux distro, which means that the entire fleet of Docker containers would need to be based on much more bloated images like Debian or Ubuntu with a much larger attack surface and possibilities for an attacker, if they gain access to a container.

Is it common practice to put osquery on containers, or should they simply be treated as dumb cattle with minimal attack surface which can be shot if showing signs of weirdness, and then have advanced monitoring on the Docker host machines instead?

Docker is never targeted security and privilege separation. The targeted goal of Docker is to be able to quickly install and deploy containers for anything, on anything.

For this reason, it is a common practice to put anything into docker containers, including security tools, but it is not hardened against breaking out from a container into the physical machine (although doing this is harder as it seems).

It is not a common practice that you download a docker container, write a 10 line long script on it and it will work like charm. Yes, this is what docker offers, but it doesn't fulfill it. Its main reason is the security - not being really security-hardened, they need to disable a lot of important linux kernel features (for example, they've simply disabled the unix datagram sockets, this is why syslogd doesn't work very well in docker containers).

If osquery works on an least two different distro families (deb- and rpm based ones), then yes, it should work also on Alpine. But it is your task to make it work.

So sure, you can make osquery work, but it won't be easy. You will have to dig deeply both into osquery, alpine, and docker. As a result, you will be able to build an osquery docker container, what you will be able to use as a base for your further developments.


What are active research topics in SSL/TLS? I don't know whether it is right to ask a question here for my MTech dissertation. I thought there is no good place in the world where I can find security experts like here.

I am interested in doing research in the protocol SSL/TLS. I know a fair bit of knowledge about protocol and underlying primitives. The first paper I found browsing for research areas and give me more exposure for SSL/TLS protocol is 20 Years of SSL/TLS Research An Analysis of the Internet’s Security Foundation by Cristopher Meyer. It discusses the protocol, popular implementations and attacks in this protocol.

I was interested in doing a survey of security vulnerabilities in the SSL/TLS web servers and exploit some. For this I found a good paper Cryptographic Strength of SSL/TLS Servers:
Current and Recent Practices. Basically, I had idea of doing same work related to this paper i.e. finding security vulnerabilities that still exist by scanning a list of web servers. Also, there are online tools like ssllabs. Since, most of the work is being already done here, I want to ask experts which work I can do?

If there are some active research work currently being done on SSL/TLS protocol, I would like to know.

Thank You

The list of open TLS 1.3 issues may give you some ideas. For example:

Should SNI be encrypted to hide the server name to passive attackers? The issue states that this will complicate the handshake. Why is this the case? Maybe you can research the best way to implement this.
Can the server request a proof of work from the client to prevent DoS attacks? Should this be in TLS?
Can the handshake hashes be safely restarted? The issue states this needs "security analysis", maybe you can research that.


Link test differs from link location in plaintext view is not visible in Thunderbird Today I noticed something strange.
I got an email containing a link that links to another site than the text says. In (Simple) HTML, the review is visible when hovering over the link.
However, in plaintext, in 3 out of 4 mails only the a.com was shown
a.com
<b.com>

This makes me a bit worried however, since I only noticed the difference of displayed text and link location once another client answered, that probably had HTML view turned on.
If I switch the view of the message body to Simple HTML, I need to check if the link matches the location visually, which I want to avoid, because that might be error-prone. I do know that I could configure my Thunderbird to simply show me puny-code, but then one unaware click in the wrong moment could be fatal.
What are security-wise recent best practices to both protect yourself from clicking malicious links as well as detecting that someone has sent such a malicious link?
Specifically, is there a way to always get shown
a.com
<b.com>

in plaintext, but with the displayed part only marked as the link's location, whenever the link's text part displays an URL?

There is not going to be a way to force the link text to be the same as the target URL of the link. Else we couldn't have links.
Since the very beginning, the advice has been to hover over the link to check where it goes. That advice has not gone away, as error-prone as that might be.
To make things easier, you can always turn off HTML-view in your email clients. But that will make HTML-based email very ugly.
Each email client might have tools to make this easier, but that will be up to each email client.


Should I bother teaching buffer overflows any more? The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment.  If PaX, DEP, W^X, etc., are effective at stopping buffer overflow exploits, is there still value in learning about them?

Absolutely.  ASLR and DEP are defense-in-depth measures.  There are exploits that exist that can bypass each of them (for a real-world example, look at Peter Vreugdenhil's Pwn2Own exploit that he used against IE).

All you need to bypass ASLR for Windows is an information disclosure vulnerability that will let you know the base address of a loaded DLL in the process (that was the first vuln that Vreugdenhil exploited).  From that, you can use a ret-to-libc attack to call any function in that DLL.

The bottom line: stack (and heap) overflows are absolutely still relevant today.  They're harder to exploit than they used to be but they're still relevant.


Downloads and GPG singnatures I've recently installed Kleopatra in order to use GPG for confirming the validity of downloads. I've downloaded the following (32-bit verison):
https://www.claws-mail.org/win32/

I also downloaded the GPG signature beneath it, and tried to import it using Kleopatra. However, it fails, importing nothing.

I've tried to do some research and what I understand is that the signature is for verifying a key, however I cannot find a key from claws-mail. Have I done something wrong, or am I mistaken in thinking the signature should be able to verify a download? If I am, what is its purpose in being included with the download link?

The signature can be used to verify a download, only if you have the corresponding public key to verify against.

In order to verify that something was signed by who you think it was, you should import their public key into Kleopatra. Then you should be able to verify the signature from there.

Note: I took a short, cursory look over the website, and couldn't find the public key posted anywhere. You might be able to email the author and ask.


Will disabling the Java add-on in IE protect you from Java exploits? Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser.

However, Heise Security suggests that, when it comes to Internet Explorer, this might not be enough:

  Tests carried out by our associates at heise Security found that Microsoft's flagship browser was still able to access the Java plugin even after it had been explicitly disabled. Users running IE are therefore advised to uninstall Java completely using the Add or Remove Programs option in Windows' Control Panel.

Is there really a known weakness by which a Java exploit could harm an IE user visiting a malicious website, even if the Java add-ons are disabled?

My German is pretty rusty, but I'm pretty sure the article from Heise Security doesn't really say what the H-online article claims.

  Unter Opera erreicht man die Plugin-Verwaltung durch die Eingabe von opera:plugins in die Adressleiste. Beim Internet Explorer genügt das Deaktiveren der Plug-ins unter "Add-Ons verwalten" nicht. Wer den IE einsetzt, sollte Java daher besser vollständig über Systemsteuerung/Software deinstallieren.

Which roughly translates to

  The plugin manager for Opera can be accessed by typing opera:plugins in the address bar. For Internet Explorer, it is not sufficient to use "Manage Add-ons" for deactivation of Java plug-ins. Anyone that uses IE should completely uninstall Java via Control Panel / Programs.

IE doesn't allow you to completely disable the Java plugin from within the browser. Instead, you have to use a registry key to disable it properly. The article from Heise is hinting at this - simply turning off the plugin doesn't actually fully disable the embedded Java functionality in IE. I believe the Heise article writer was unaware of this registry trick, and that the H-online article writer just took the advice "as writ", without properly checking the facts.

So no, you don't need to uninstall it completely. Though I would certainly put it at the top of your list of stuff to uninstall if you can survive without it, considering the tirade of recent 0-days.


Why do banking websites always log you out after inactivity? It seems that every single banking & financial website that I have used logs me out after a certain period of time.

Are there a legal requirements or technical reasons for financial sites to do this?  Or is this just their form of "security" to prevent others from accessing your account should you forget to logoff or secure your computer or device?

This is very poor user experience in my opinion.  Google does not log me out after such a short period of time, and I feel that my Google account with 2-Step Verification and a legion of extremely intelligent engineers is far more secure than my banking accounts.

It seems I should be able to choose whether these sites log me out automatically, or if I may stay logged in for a reasonable period of time (30 - 90 days being common for other sites).

Edit:

I believe the selected answer is the most complete answer to the question, but none of the reasons seem to be good reasons for banks to end your session.

There are a couple of levels of risk associated with an attacker gaining access to your banking website session:

viewing your private (financial) information
modifying your account (this includes stealing money, locking you out, etc.)

This same situation exists on any website account, but for financial websites, and for most people, #2 is far more severe than for other types of sites.

I think a better solution than logging users out would be to:

default the session timeout to a short duration
allow the user to change the session timeout for his/her account
require re-authentication for actions that modify the account or move money around

It's for your security.  This way people can't accidentally stay logged into their account, so anyone with access to your computer has full access to your bank account.

This way thieves don't have motivation to break into your house to steal your computer not just for the value of the computer, but potentially to get access to your life's savings and use it to purchase items, transfer funds out of the country, etc.  (Yes, they could break in, install keyloggers, and potentially do the same attack.)

Power gmail users will check their email accounts hundreds of times a day; having to re-log in every time would be overly burdensome.  Your bank account you only need to log in rarely; maybe for 10 minutes once a week or month.

The potential repercussions of a stolen bank account is typically more severe to the average user than the repercussions of having your email account stolen.

Not to say that losing your email account can't have severe repercussions as well (especially if you can use your email to reset passwords, use as part of 2-factor authentication, use for social engineering, etc.)


Do these regex show that I was hacked? What do these regex commands mean? I found them when I ran the history command:

grep --include=\*.php -rnw . -e "update.creditcard"
grep --include=\*.php -rnw . -e "e41e"
grep --include=\*.php -rnw . -e "nobugs.com"
grep --include=\*.{php|js} -rnw . -e "nobugs.com"
grep --include=\*.[php|js] -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com|chr\("
grep --include=\*.php -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com|chr\("
grep --include=\*.php -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com"
grep --include=\*.js -rnw . -e "update.creditcard|nobugs.com|slimmingworldcyprus.com"

I noticed that my website had quite a lot of pages missing, so I went to the server and I found those commands using history. However, I don't have any idea what they do.

Only myself and one other person have admin access to the server, and neither of us recognise these commands.

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings.

However, if your shell history has unexplainable entries, that's a sign that you've been hacked.

At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your server - probably by reinstalling the OS, restoring your content from a back-up, and then plugging whatever hole led to the compromise in the first place (if you can identify it).

Checking SSH logs

On CentOS, SSH logs are written to /var/log/secure by default. On Ubuntu, they're written to /var/log/auth.log by default.

Here's a command that will search either of those locations for SSH log entries:

grep -i 'ssh' /var/log/secure /var/log/auth.log

You'll probably be interested in the most recent log entries, which will be at the end of that command's output.

Note that it's possible that there are no entries in the logs indicating a break-in; this could be because the attacker wiped SSH logs, but didn't wipe shell history.

Some commands that will be useful for log investigation are grep, tail, and less. Also remember that you can pipe output from one command into another. Check the manpages or the Unix & Linux Stack Exchange if you need more help with command line tools like those.


Firefox sending Application Data in middle of SSL handshake I am trying to write my own web server in Java 8, and i am running into a very odd problem. Whenever i make an SSL connection with Chrome, it works just fine. When i try with Firefox (59.0.2), i was having connection problems, but only with cipher suites that use GCM. It seemed that after the SSL handshake, the request from the browser was never sent. Using wireshark, i saw that Firefox was sending Application Data in middle of the SSL handshake:
From wireshark:

C = Client
S = Server

C —> S Client Hello
C <— S Server Hello, Certificate, Server Key Exchange, Server Hello Done
C —> S Client Key Exchange, Change Cipher Spec, Hello Request, Hello Request
C —> S Application Data
C <— S Change Cipher Spec
C <— S Hello Request, Hello Request

To be sure I was not misunderstanding, I checked this out with Chrome, and with Firefox without GCM cipher suites, and none of them had Application Data sent in middle of the handshake. I checked other sites, like google.com, cnn.com, etc. and they are using GCM cipher suites without any problems on Firefox, so obviously this is a problem on my side.

Java 8 does not support ALPN, so it is not a TLS False Start.  Any ideas what would cause the specific problem with Firefox and not with Chrome?

You are in fact seeing TLS False Start. The client sends application data right after its own ChangeCipherSpec and Finished messages, but before receiving the ChangeCipherSpec and Finished messages from the server.

The specification (RFC 7918) does not require the ALPN (or its predecessor, NPN) extension, this was a policy that Google implemented for Chrome. It instead imposes requirements on the cipher suite, key exchange method and protocol version. It has not an exhaustive list of forbidden or allowed combinations, but it does recommend two AES-GCM cipher suites, used with the (EC)DHE key exchange method.

As for Firefox, it used to have a preference in the past for requiring ALPN/NPN, but that that was removed in https://bugzilla.mozilla.org/show_bug.cgi?id=1321909. To disable it now, go to about:config and the security.ssl.enable_false_start preference to false.