Are there technical reasons why state actors may be more able of carrying out malware cyberattacks against critical infrastructure, than individuals? The US and the UK have publicly accused the Russian military of orchestrating attacks using the NotPetya malware:

  Foreign Office minister Lord Ahmad of Wimbledon said: "The UK government judges that the Russian government, specifically the Russian military, was responsible for the destructive NotPetya cyber attack."

Russia denies being responsible.

Malware in the past, such as the Melissa and ILOVEYOU viruses, were created by individuals.  The blame for Wannacry and Petya/NotPetya are put with countries.  Is there a technical reason why Melissa and ILOVEYOU could be developed by individuals, but the development and deployment of Wannacry and Petya/NotPetya requires the resources of a state?  I don't think either needs a supercomputer or a lot of bandwidth to be deployed; or does it?

The main question you probably need to ask is who has the motivation to do such an attack. While in former times it was often enough to brag about the attacks you did and show what a capable hacker you are, cyber attacks are now predominantly seen as crime. This means that bragging about it might even be dangerous and there must be other motivations. Thus the main motivations today are money in the direct form (i.e. ransomware, spam), getting access to important information (espionage) or causing damage against a competing individual, company or country (for example with DOS attacks).

Given that cyber attacks are seen as crime the return of investment should be much higher than the risk of getting prosecuted. If you are a lone individual mounting a larger attack then the risk of being prosecuted is high. If you are instead somehow backed by one state and attack another state then the risk of being prosecuted is usually  much lower since you cause damage to competitors in the interest of "your" state. Such state-backing might take several forms: it might be that the attacker is actually employed or otherwise paid by the state for doing such attacks (i.e. state-sponsored) but it might also be a criminal or group of criminals who gets not prosecuted as long as their attacks are only directed at the competing state (state-backed). Or it might be something in between, i.e. criminals getting paid for doing a job for the state.

Many (but not all) of the attacks you see today could actually have been done by motivated individuals or small groups. This includes attacks like NotPetya. But you have to ask what the motivation was. It looks like that in case of NotPetya the main goal was to cause damage and that the main target was Ukraine. So, who might have a large interest in spending resources just to cause damage there? And who might therefore either pay somebody to do such attacks or at least protect the attacker against prosecution? Probably not some lone individuals acting only in their own interest.

Apart from this, some attacks actually require state level resources or at least resources only a larger company has. These are for example access to brilliant cryptographers, power to influence standard bodies or the power to make companies weaken the security of their products (like weakening cryptography or adding backdoors) if they still want to sell to the government etc.


Does Google record search / source IP [/ user] pairs? Does Google record search / source IP [/ user] pairs? What if my Search History is off?

Yes, maybe, no...  Only some Google' employee can answer the question, even then they might give you false information.

A lot of sites and users out there are taking the assumption that Google and other major sites, are taking as much record as possible. For example Eli Pariser talk on filtered bubble suggested that Google is/could take track from 57 signal including web browser being used and where the computer is located.

"Usually your searches are saved along with the date and time of the search, some information about your computer (e.g. your IP address, User agent and often a unique identifier stored in a browser cookie), and if you are logged in, your account information (e.g. name and email address). " DuckDuckGo Privacy

Even if you are not logged in, Google can/could use several methods to identify you over time, again only some Google employees or someone who has solid proof can verify this.

How to create a basic extra layer of privacy/anonymity when dealing with Google?

Simplest solution:

Stop using Google, but I wouldn't recommend that maybe balance queries between two search engines like: DuckDuckGo which in short it is a beautiful, customizable search engine, but I have had better luck finding things with Google. DuckDuckGo has worked for me when doing simple queries (such as 'New York Doctors).

Still Want To Use Google?:

Customize this as fitted to your needs:

Browser: Firefox Why Firefox? As of Jan 2011 W3C reports 37.1 %  of users use Firefox, followed by Chrome 35.3 %. Making it the most used browser, the less unique the better. I recommend Firefox if you are trying to prevent Google to record any relevant information that might identify you.

Settings: Edit->Preference->Privacy:

[check]Tell Websites I don't want to be tracked.
[select]Use Custom Settings.
[unchecked all except the following:]
[check]accept cookies from site &[select] Keep until I close browser
[check]clear history when firefox closes

Proxy: If you have security expertise you might have heard of Tor or have used it before. Wouldn't recommend to always use it, except when you don't want certain personal information to be record.

Advertisement: Adblock

Track Request Blocker: Disconnect

HTTPS: HTTPS Everywhere

Once more, I am not able to answer your exact answer as I am not a Google employee neither do I have evidence to say Google is recording your searches. But I have given you some ideas on how you can create an extra layer when dealing with delicate/personal queries you wouldn't want to get recorded.


Is it possible to evaluate the connections that Tor Browser makes when we access a website? I know that a website's javascript application can open direct connections with my computer, outside the onion network, and that way the real ip of the Tor Browser user ends up being revealed. How can I evaluate if a particular site is actually "seeing" my real ip or if it is seeing just the tor exit node's ip?

JavaScript cannot bypass proxy settings in Firefox. The only way it can is by exploiting a new bug in the JavaScript engine which allows complete control over Firefox, allowing the proxy settings to be ignored. Features that are able to bypass the proxy settings at will include Flash and Java (unrelated to JavaScript), and those are not included in Tor Browser for that reason.

Detecting a bypass attempt can generally only be successfully done if you are detecting a successful bypass attempt. Assuming you are using Linux, this can be done safely by using iptables, which is the frontend for the system's firewall. If you make Tor run as its own user (for example, by using Tor in a distro's repository), you can set iptables to deny all network connections which are not coming from the dedicated Tor user. Violations can then be logged.

The Tails live operating system does this. All applications on Tails are configured to only go over Tor, and any applications which try to connect to the internet directly (whether due to being misconfigured, or having been compromised) will be blocked, with logs sent to the system log.


Enforcing personal firewall for OS X We're currently doing PCI compliance, and one of the requirements is that mobile devices that have access to systems involved in processing card data have personal firewall software installed which can't be disabled by the person using the computer.

The only mobile computers we have which that requirement applies to belong to our system administrators, and they're all Macs. (This is apparently trivial in Windows -- pretty much every endpoint protection solution implements it.) Since they're sysadmins, they've got admin access to their Mac.

I've had a couple of endpoint protection vendors promise me a solution only to fall through when we tried it out (in particular, Symantec), and now I'm stuck.

Does anyone know of something that will meet this requirement in OS X (personal firewall software which can't be modified by the end-user, even when the user has admin access)?

We have implemented Managed Preferences using MacOS Server and Open Directory to address this point for general users. The key problem is that this cannot block users with local admin access. Nothing can. The only real answer is your users should not have local admin privs for their day-to-day work, especially on a mobile device, if they want live by the letter of the PCI-DSS standard.

Yes, an sysadmin is a sysadmin and she should have the access rights to do her job. The standard implies that this just should not be done from a mobile device. We always challenge the developer or user that claims "I need admin access to run X software." Almost always, they don't. The software supplier is often lazy and just suggest root access to make it easy for them. They don't really care about your security practices. With proper analysis of least required privs, you can have non-root users do all they need without sysadmin access.

This gets a bit off your direct question, but we are pursuing card info tokenization with our payment gateway so we won't have the PCI requirement. Another option is to segregate your mobile device network access so one could be an admin on their local but just not have access to card processing systems. Finally, we've also built server-based VMs or Terminal Services hosts that provide the access needed and not have sysadmin access on the users local host.

Hope that helps.


Why SPAM mails have UK Contact Addresses and Emails? I've seen a similarity in most of the SPAM mails I receive, that majority of them are sent from Hotmail accounts and specifically from hotmail.co.uk domain.

Another thing that I noticed is, the content of the mail claims to be from UK.

For example :

  From :
  Samsung Electronics (UK) Ltd.
  Samsung House 1000, Hillswood Drive,  Chertsey,
  Surrey KT16 0PS
  Tel:+44-xxxxxxxxx, +44-yyyyyyyyyy
  Email:office@samsungukgroup.com

  Dear XXX YYY,
  We use this medium to congratulate you as one of our lucky winner of
  £450,000 Great British Pounds (G.B.P.) and 2 Samsung galaxy s6 edge+ .....

AND

  MICROSOFT® CORPORATION
  Cardinal Place
  80-100 Victoria Street
  London,SW1E 5JL
  United Kingdom

  Promo Code: MSW/5975/107/2016
  Security Number: MSW16-2345401

  MICROSOFT ANNUAL AWARD

  We wish to congratulate you on this note, for being part of our selected winners in our just concluded internal promotion draw this year, this promotion was set-up to encourage the active users of Microsoft products and its software services.

  Hence we do believe with your winning prize, you will become an active user to Microsoft products and its software services. Microsoft Corporation develops and markets software, services and hardware that deliver new opportunities, greater convenience and enhanced value to people's lives. We ran an online e-mail beta draw which your email address won Nine Hundred and Fifty Thousand Great British Pounds Sterling (Ј950,000.00). We wish to formally announce to you that you have successfully passed the requirements, statutory obligations, verifications, validations and satisfactory report Test conducted for all online winners......

So the question is: Why all the spam from UK? Does the UK Law protects such spammers in some way? Or it's just a random choice for the SPAMMERS?

This data is fake data usually. They are using UK to make it look more legitimate depending on the target address most of the times.

You can spoof anything in the email except for the sending IP address and DKIM/SPF records which the companies you have in your list are not using.


Unknown automatically generated email in sent folder I just noticed a strange email in my sent folder that I did not send. Here is the header information:

To: 5f3d36eb61801dda4063@cloudmailin.net
From: ********@gmail.com
Date: Mon, 10 Jun 2019 06:54:17 -0700
Message-ID: <CAHMUou-d6rW138ucKhKVoLWqzn2ZZ12Q0-wK+FR6SCXDr89YmQ@mail.gmail.com>
Subject: bW9KRGdIeTlyMFd2UjZQQVYrQUd0TVJ5N2IrbDlqVXh2NlF6ZUFvaDlaanpRQWwzVmZtVFlwQVo5cXUybmRFbC0ta0VvVDdmakJzVzQzL3lQM2lYL0tBQT09--19cd1b1aa0f32659eece53630df822281b44c804
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
This message was automatically generated by Gmail.

There was no content in the email, just the jumble of characters in the subject. The email address this was sent to is reported a few times on the internet as possible phishing, but it's not clear to me why Gmail would automatically generate an email on my behalf to this address. The "From" field was indeed my actual email address.

I have already changed my password as a precaution, but I am curious is this anything to worry further about?

The message line that was automatically sent says "This message was automatically generated by Gmail". It means that you marked a previous received message as spam, so it automatically sends a notification to Google in order to block further reception or messages from the same sender. Nothing to really worry about.


Using a list of three-letter words with variable capitalization as a DiceWare dictionary This is partly an exercise to see if I understand passphrase generation from a given dictionary using the DiceWare technique. But also for possible personal usage.

All three-letter word lists I can find generally involve words allowed in Scrabble and almost all include 1014 words. I would reduce this list to 972.

If I now include all combinations of capitalization of these words in my dictionary (all lower, 1st upper, 2nd upper, 3rd upper, 1/2 upper, 1/3 upper, 2/3 upper, 1/2/3 upper), that would give me 972 x 8 = 7776 words. The right amount for a 5-dice DiceWare dictionary. I can now use 5 dice to generate a passphrase.

This would minimize typing, though I'd have to use the shift key a lot, which probably negates any gain.

I also wouldn't have to type spaces since there is no chance of a combo word of six letters being in my dictionary, right?

Even though the number of entries in my dictionary is 7776, the number of words is only 972. Does this give a cracker any advantage?

It only gives the cracker an advantage if you get very very unlucky with your dice rolls and end up with a phrase consisting of one word repeated 5 times. In which case, just roll again.

As @SmokeDispenser points out in the comments however, doing this will remove one of the main benefits of Diceware, which is that Diceware does not require you to memorize weird tricks and transformations in addition to the words. So you're hurting yourself with this method to some extent. If it's easy enough for you to memorize still, then go for it, but I'd personally prefer typing a few extra characters over memorizing weird capitalization or character substitution schemes.


How to perform a security audit for a PHP application? I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.

What steps should I take to perform a self-audit? What tools are available? What is the best way to find a 3rd-party auditor? Any recommendations?

Interested in both whitebox/codereview audit and blackbox/pentest?

I suggest taking a look at the following links:

PHP Security Audit HOWTO
Spike PHP Security Audit Tool
Zend Application Security Audit
6 Free PHP Security & Auditing Tools


PCI scope when entering card details into browser Suppose I have an ecommerce web site, hosted in Azure (or AWS). I will use a third party payment gateway that is fully certified as PCI level 1. All communication is done with TLS 1.1 or better.

Scenario A: During checkout, a page is presented that asks the user for his details, including credit card. This browser form is served from my server in Azure. When the user hits PAY, using JavaScript we send the card details to the third party gateway to process the payment and wait for the response. At no time are the credit card details sent to my server in Azure.

Scenario B: Instead of serving a credit card form from my site, instead we use the third party gateway's hosted payment page. That means we do a redirect to the gateway's site, where the user enters the card details, and then the browser redirects back to my payment complete page.

Scenario C: Sort of a hybrid, we display the hosted payment page from the gateway in an iframe inside a page served from my server in Azure.

Questions:

In these three scenarios, is there a difference in PCI scope for the server running in Azure? What is the scope? Does our Azure infrastructure need to undergo an annual audit?
Does it make a difference if I am a merchant myself (so the third party gateway is using my merchant account on my behalf) vs a gateway that processes transactions with their own merchant account, and then reimburses me later.

I'm led to believe there is a difference in PCI scope between these scenarios, but I can't really see why. If the Azure server is compromised, an attacker could serve malicious pages and capture the user's card regardless of which approach is used.

I see ecommerce sites using scenario A all the time, but I'm quite sure very few of them are running in PCI compliant environments.

Caveat IANAQSA

  In these three scenarios, is there a difference in PCI scope for the
  server running in Azure? What is the scope? Does our Azure
  infrastructure need to undergo an annual audit?

Scope here should be measured as a per-merchant thing, not as a per-server.  Yes, your Azure servers would be covered by your scope (the level of which I'll discuss below).  AWS is the gold standard for cloud providers helping you understand which scope issues are yours versus theirs.  Azure appears to be less helpful in that vein; they point you to PCI, but at least they have a Compliance Matrix.

(absent other details), Scenario A would likely be considered SAQ A-EP scope and scenarios B and C would be SAQ A.  Here's a good description from PCIComplianceGuide.org:

  the Council says that a merchant can still use SAQ A if:

  Merchant website provides an inline frame (iframe) to a PCI DSS
  compliant third-party processor facilitating the payment process.
  Merchant website contains a URL link redirecting users from merchant
  website to a PCI DSS compliant third-party processor facilitating the
  payment process. (Source: Understanding SAQs for PCI DSS Version 3, p.
  5)

...

  Does it make a difference if I am a merchant myself (so the third
  party gateway is using my merchant account on my behalf) vs a gateway
  that processes transactions with their own merchant account, and then
  reimburses me later.

I don't believe so.  Customers go to your site; customers whip out their card and type numbers in; customers expect goods or services in return.  You're a merchant, whether you're managing your account with the payment processor or going through a payment facilitator.

  I'm led to believe there is a difference in PCI scope between these
  scenarios, but I can't really see why. If the Azure server is
  compromised, an attacker could serve malicious pages and capture the
  user's card regardless of which approach is used.

There is a difference between the SAQ A and A-EP scopes; the former is 14 questions; the latter is closer to 100 and requires scans.

In actual security terms there is negligible difference.  Speaking for myself, I think the reasoning that suggests iframes are more secure where javascript is less secure are specious and not technology-driven.  Both are equally vulnerable to a malicious attacker who compromises the web server and replaces {iframe,javascript} with their own.

  I see ecommerce sites using scenario A all the time, but I'm quite
  sure very few of them are running in PCI compliant environments.

I'm sure quite a few of them have properly filled out SAQs.

Some subset of those are actually PCI compliant.

Some subset of those are actually secure.


Self-changing javascript characters in text editors On Windows Server 2008-R2, certain javascript files are exhibiting the same behavior.  Text can be copied from other files and pasted into new ones.

In both NotePad++ and Windows' default notepad, characters in specific areas will either suddenly be hidden depending upon what's next to it or even switch order.

Is this a virus or some corruption that has been copied & pasted into other files or something else?

What is this?

This is an encoding issue.

If you use anything other than the most basic characters needed for English, people may not be able to read your text unless you say what character encoding you used.
For example, you may intend the text to look like this:

but it may actually display like this:

Not only does inadequate encoding information spoil the readability of displayed text, but it may mean that your data cannot be found by a search, or reliably processed in a number of other ways.

Source: https://www.w3.org/International/questions/qa-what-is-encoding.en


Can we still provide confidentiality when cryptography is outlawed? In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are permitted. Similarly, in the 1990s the U.S. government tried to force the use of Clipper, encryption hardware that would have led to all private sector encryption keys being escrowed.

Let's assume that your business needs to operate in a region where encryption is either completely forbidden, or its use is limited to the point where you don't believe it is effective. Of course, your organisation's confidentiality requirements haven't changed...

What do you do? Do you believe it is still possible to protect confidential data? If so, how?

Update as different sovereignties have different ways of writing, amending, enacting and enforcing laws, it's hard to say exactly what the text of such legislation would look like. Feel free to make (and state) assumptions, within the scope of the scenario described above: that encryption is not legal or not useful.

Thanks for the insightful question. The more I think about it the more it feels like someone has pulled the rag below my feet (living without cryptographic protection).

Analyzing the resulting threats (strictly from the business point of view - the requirements of dissidents etc. are a different story), I see them being:

Corrupt government officials who will (ab)use their position to sell confidential enterprise information passing through channels they control.
Business antagonists who will try to eavesdrop on your communication channels.

A very first thought would be to work on two fronts; diversification of paths and leak identification:

Without (or with watered down) encryption I would think that one should try a. to break down critical messages to smaller chunks and then b. diversify the paths each one would take. He would thus make life a bit more difficult to people eavesdropping by multiplying the paths they would have to work with. I suppose some of these paths should be more "traditional", like normal post, messengers etc. that the government can inspect but not the antagonists.

This of course does not exclude the government from reading all messages from all channels simultaneously, so I would suggest a kind of watermarking solution to identify  "non authorized leaks" coming from corrupt government officials. Or perhaps also adding fake (but traceable) messages in the mix?

Even governments that for their own reasons want to inspect all communications don't want to be branded as "business unfriendly". They would then probably take steps to punish any of their officials that abuse the eavesdropping capability for personal gain. A few, well publicized, cases of gov officials caught red-handed or just an announcement that the enterprise can effectively track leaks would help prevention big-time.

Now, how about a solution for the "always-on" blackberry crowds?


Would it be possible to verify ownership of digital currency without a network connection to an authority server? Lets imagine the Fed start registering digital USD for use in offline e-wallets, and they figure out a way to make it so that only registered wallets can make transactions.

Without an online centralized server validating and tracking ownership of currency to a wallet, I would worry that hackers could theoretically dupe money.

I know that each time that currency changes wallets, the transaction would need to be signed into the currency.

But what about in cases where there is a dupe (Double-spending) of that currency from the same state?

Could a digital currency function even temporarily offline?

Theoretical safeguards like unhackable wallets and a currency unit having to 'check-in' online after a certain amount of time before it can change hands again, and things like that are ok to assume. Just because whatever-coins haven't done it yet doesn't mean it can't be done.

But from an info-sec perspective, what are some ways to prevent/detect fraud in offline digital currency transactions?

A system somewhat like you suggest is used for transport payment systems, like Oyster Card in London. The cards are (supposedly) tamper-proof hardware, and the balance is held on the card. There is a centralised system, but if the network goes down, Oyster can function offline.

The main security control is the physical security of the cards themselves, and I expect there is also fraud detection in the centralised system. There have been claims of hacks but it's not widespread - presumably the limited value of the cards reduces interest in hacking, and if you travel with a fraudulent card, you are risking arrest. Still, I think it is testament to the system that there have not been more attacks.

Bitcoin has a different objective. It is an online currency (like PayPal, or inter-bank clearing systems) - but it has no centralised system. The genius of Bitcoin is that they figured a decentralised way to perform the role of the centralised system. This comes at some cost - all the Bitcoin mining rigs whirring away around the world - but people clearly think it is worthwhile.

When thinking about securing these systems, you need to distinguish between design goals and implementation flaws. You mention that Bitcoin has had some double spending vulnerabilities. This may be true, but the design goal of Bitcoin is that double spending is impossible, and in general it is very good at meeting that goal. Any vulnerability that allows double spending will be fixed by updating the implementation. It's the same for Oyster - the design goal is that double spending is impossible, but there have been some implementation flaws.


Password Strength Determination Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength metrics. The mentioned strong password policies are:

Each password you choose must be new and different.

Passwords must be memorized. If a password is written down, it must be locked up.

Passwords must be at least six characters long, and probably longer, depending on the size of the password’s character set.

Passwords must be replaced periodically.

Passwords must contain a mixture of letters (both upper- and lowercase), digits, and punctuation characters.

When it comes to building a user registering system with user-chosen password input, I want to provide some information about the strength of the password typed from the user (such as the three level results: weak, medium and strong) to guild user to set an appropriate password. The website The Password Meter performs the similar function and the criteria including number of characters, the count of uppercase letters, the count of lowercase letters, the count of symbols, etc. However, to evaluate a password is strong enough is not easy. Even a password is complex enough as something like @P3V;4sF!]9u;3G,, the strength may still be not high enough in the situation of re-using the password in multiple authentication sites.
Thus, my question is : Is there a robust benchmark / algorithm / method to determine password strength (maybe giving a password strength index) which consider not only the complexity of the password itself but also the similarity (distance) of the known passwords in leaked password databases or common password databases like 10k-most-common.txt on Github?
If I misunderstand something, please let me know.
Reference of experimental implementation
Android APP Password Strength Assessment class implementation

The fundamental problem with determining password strength is it’s entropy… you can’t predict it or calculate it easily (and not in isolation). (entropy is the amount of unpredictability of the bits used in the password)
All password strength indicators are therefor meaningless… except as an indicator.  But for an indication length is also a really good indicator. (The longer the better). Increasing the digit space also adds a little bit not nearly as much as length.
(Adding “#?!” to your digit space(password character set) increases it with 3 to while increasing the amount of digits increases it with 62 (a-z,A-Z,0-9))
Complexity therefor is dwarfed by length with even as few as 6 additional characters. So getting passwords that are 24 or longer in characters are often sufficiently hard to protect you. (If you don’t reuse or use predictable patterns)
Replacing passwords should only be done if you have reason to suspect it has been leaked or compromised. Especially when combined with a 2nd factor this is easily to detect. (Also enforcing longer passwords helps to mitigate any potential issues)
On short this advice from the papers is obsolete. The NIST has even actively discouraged things like forced password expiration and enhanced character spaces (complexity rules) in favour of simple length rules. People are good with remembering a sentence…. There bad with a simple complex password like “P@33w0r17”. Let’s stop trying to make people do things there bad at… it decreases security not improve it.


Setting up a VPN while under persistent attack As far as I know, the initial connection to a commercial VPN service is the most vulnerable.

Let’s say I have a persistent attacker on my tail.

My home modem-router from the ISP is likely compromised.

Local telecoms untrustworthy.

Is there a way to securely sign up and connect to a commercial VPN service without my keys being intercepted?

As far as I know, the initial connection to a commercial VPN service is the most vulnerable. ... Is there a way to securely sign up and connect to a commercial VPN service without my keys being intercepted?

Assuming that you start with a clean an not compromised system then the initial connection is only a problem if you rely on blindly trusting the connection, i.e. either don't use a TLS connection, ignore any certificate warnings or simply connect to a system which sounds like it would be a trustable VPN provider but is not.

If your TLS gets already actively intercepted and you notice it than you need to rely on different ways to establish a contact to the trusted VPN provider. This can be for example snail mail for initial contact and then getting some pre-configured system or software to connect to the VPN. Or it can be the use of a more trusted internet connection of some friend. Also note that if your upstream is that invasive then it might simply block the VPN connection.

  ... but I’ve repeatedly seen news about TLS coming under attack (FREAK, DROWN, etc.), so wouldn’t it be possible for the TLS implementation of a commercial VPN to be vulnerable? Also, with recent revelations about perfect forward secrecy weaknesses (Diffie-Hellman), wouldn’t this make my concerns more valid?

You are escalating problems you've heard somewhere without understanding what they actually mean and where they apply. While they were bugs in specific implementations and use cases TLS by itself is not broken. Also, the problems you cite can currently only be exploited by an attacker with lots of resources.

But, attackers usually don't waste money on such attacks if it can be done the cheaper way. If you face such an attacker you should stop trusting not only your ISP etc but also the vendor of your computer hardware, your operating system, any programs you've installed (where do you got these from - downloaded somewhere from the internet?). You should also question if the commercial VPN you want to use can be really trusted, i.e. if it has a secure infrastructure itself and will not cooperate with your enemies given enough money, which is usually still cheaper than breaking TLS.

Also, make sure nobody can enter your house to physically attack you or just manipulate your computer to install software which allows you to be tracked even if you use a VPN.


Is it possible to find the encryption key from an already decrypted file I received a decrypted file back from the hacker as proof that he could decrypt my files affected by his DjVU ransomware. Is it possible to find out which key he used to decrypt the encrypted file?

No.
Imagine you have a text file with some content M. The attacker then encrypts M with a key K, resulting in an encrypted file C.
By sending you back M, they don't directly prove that they have K, but since M is really what you are after anyways, that's alright.
The reason why it's not possible to tell anything about K is because M was created before K even existed. As such, it cannot possibly contain any information about K.
What you can do now
If you have a backup
Completely nuke your PC, re-install your OS from scratch and load your data from your backup. It might take a while, but it's better than paying ransom.
If you don't have a backup
The site No More Ransom might be able to help identify whether or not the particular ransomware used has flaws that can help recover the encryption key.
If you're lucky, then make a backup of your data now and then re-install your OS. That ransomware could have left behind some backdoors for future infections. Since you already paid once, you might pay again.
If you're not lucky, either pay the ransom or live with the fact that your data is gone. And even if you pay, you might be out of luck. Let that be a lesson to you to make proper backups.


How do I securely erase USB flash drives? I would like to know if there is a way to securely erase USB flash drives without a chance to recover data from it once it has been erased. I know, that programms like DBAN can be used to securely erase HDDs, but as they work different from flash based drives, I am not sure if I can use DBAN to securely erase my USB drives.

If DBAN cannot be used, how do I erase USB flash drives?

I know that SSDs have to be erased using programs that reset the data cells and are often available from the manufacturer, but I do not know if this is also the case for USB flash drives.

UPDATE: Upon looking back it looks like using random data is not really necessary as a successful platter-level 'previous state' attack on a zeroed drive has yet to be proven possible in a real-world attack.

I've left the references below for posterity and because it does technically work fine if you're using random data, but given that just using 0s is much faster, that's probably the more reasonable option.

Flash storage, particularly SSDs, require a block/cell be wiped before more data can be written. As a result, writing would be slow if additional technology wasn't implemented.

Instead, your drive actually has 10-20% more storage than the listed capacity and an onboard memory controller will dynamically map empty cells and, during low load, wipe unmapped ones. This creates the security issue that you've encountered.

Without a tool that can leverage the memory controller your OS has no way of addressing every single cell at any given time. Many manufacturers are now providing tools that will allow you to manage the drive and securely wipe it but should your drive not have such a tool there are few perfect workarounds.

Aside from reverse-engineering a tool to manage the memory controller the best method I know of is to do many successive writes.

dd if=/dev/urandom of=/dev/devicename

Filling the drive with random data and then doing so again and again will cause the drive to constantly remap the cells and eventually you'll overwrite enough of them to be reasonably secure. The more successive overwrites the higher the chances that you will have written to every cell.

NOTE: Technically, these successive overwrites should also be done with a traditional HDD, but for a totally different reason. High accuracy equipment may be able to read previous magnetic states directly from the platter to recover data. This is why it's important not to overwrite with 0s or 1s, as it'll leave a easy to determine the previous state of the bits.

For an easier fix, throw the drive through a physical shredder. Obviously not a solution if you plan on reselling or reusing the drive but generally one of the most secure methods.


Code Signing: Change certificate attributes during renewal? I'm quite new to code signing and could not find clear answers to the following general questions so far. It would be great if someone could clarify/explain the logic behind this and point me in the right direction:

If a code signing certificate expires and needs to be renewed, can the subject attribute be changed for the new certificate without invalidating the previously created signatures? Is the public key dependent on this attribute?
If a new certificate has to be created instead, what needs to be done in order to make sure previously signed code will still be valid (e.g. use the same private key?)

Use case:
Java code has been signed and deployed with a code signing certificate and delivered to customers.
Certificate expires and needs to be renewed/re-created in order to keep the signature valid.

Alternatively you can timestamp your code so that it remains valid even after the code signing certificate expires. There are more details about this in StackOverflow here and here.


Hardening ciphersuites on Windows Server 2012 R2 I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers.
In the past I've always manually applied the registry keys into SChannel but I've come across the handy tool, IIS Crypto.

I always intended to disable SSLv3 and have been wanting to do this for quite some time. The announcement of POODLE has enabled me to finally push through and get this protocol disabled.

I've read that the vulnerability is apparent with CBC ciphers when used with SSLv3. With this in mind, in the Cipher Suite Order list within IIS Crypto, is it okay to leave cipher suites enabled that do use CBC as long as SSLv3 is disabled in the Protocols list?

Thanks.

Yes, it is ok to have CBC ciphersuites in the list as long as SSLv3.0 is disabled.  The issue is not the CBC mode itself, but the SSLv3.0 specification for the padding format.  The padding format in TLSv1.0 is more restrictive, so the malleability required to mount the POODLE attack no longer exists.


How can a intercepting tool(Burp) breaks the SSL connection between a browser and the server even if the application employes HTTPS My Application has a ssl Certification. But when i intercept the app with a tool, am able to see the sensitive information in a plain text. How can it happen? Will the Tool Breaks the SSL connection between the browser and the server? or any other Man in Middle attacks are happening here?

Check the certificate shown in your browser when you are accessing your application. You should see that it claims to be from a company called Portswigger who are the manufacturers of Burp.

What is happening is that your browser, proxies through Burp, is picking up that certificate, and encrypting traffic with it. Burp can decrypt that traffic, and display it. It also reencrypts the traffic with the original server certificate and sends it to the server for processing.

The same happens in reverse for responses. It is effectively a man in the middle attack, but one that you are running against yourself.

There are ways to protect against this, but they aren't always appropriate for web applications due to browser support issues.


DNS spoofing+firewall port hijack/redirect to capture HTTPS requests without getting "certificate untrusted error" on the client browser If i could setup a DNS server that responds with my server's IP for a certain domain, along with redirecting https and all DNS queries requests to my local https site and my local DNS server respectively, could this result the client browser getting a site certificate over https conatining credentials that match up with what the browser is getting from its DNS queries, thereby avoiding the "certificate untrusted" error?

This is based on the logic that if i only redirected https traffic and left DNS to some external server, the DNS could respond to the client's queries with an IP that doesn't match the one in the certificate thus generating the error due to the mismatch.

If it is not the case that i can do so, how does the browser know to trust the certificate it receives? Does it compare the IP given in the cert with what DNS info it has?

Certificates do not contain IP addresses, but in fact contain the hostname of the site they are issued to.  (i.e., www.google.com)

When a browser connects to an HTTPS site, it verifies several things:

That the hostname in the certificate (specifically, a hostname listed in the "Subject Alternative Name" field) matches the requested hostname.
The the certificate was issued by a trusted issuer (for example, a trusted Certificate Authority)
That the certificate has not expired, and it is past the issue date for the certificate.

In order to successfully (meaning no browser warnings) MITM HTTPS traffic you would need a certificate for the correct hostname signed by a certificate authority trusted by the client device.  Without this mechanism, HTTPS would not be effective at protecting against active attackers.  (Just how effective it actually is is a matter of debate among industry professionals.)

DNS plays essentially no role in certificate verification.  (There are some non-mainstream uses like RFC 4398, but I'm not aware of any browser using those.)


CISCO VPN Client - Gateway's fingerprint has changed - what is the risk of simply accepting the change? I am using CISCO VPN client when working remotely to join company's VPN. Once every 2-3 months I receive an alert like the following:

Title:

  SSL Network Extender

Message:

  Gateway's fingerprint has changed. Press Yes to accept [..]
  CN: [the address of the site I am accessing to provide credentials to
  enter into VPN]
  Old Fingerprint: HIGH CORD [..]
  New Fingerprint: RAG RAVE [..]

I am wondering how safe is to blindly accept this change or should I talk to local IT to define a flow that allows VPN users to validate this fingerprint.

Question: CISCO VPN Client - Gateway's fingerprint has changed - what is the risk of simply accepting the change?

The fingerprint changed because the server side certificate changed. This can mean that your IT department has changed the certificate on the server. If it is every 3 months, it is quite likely that this is the case.

Alternatively, if this message appears, someone else is acting as you VPN server and does not have the correct certificate to create the same fingerprint as before. This warning is then a clear indication that you are sending your credentials to a malicious VPN server.

To be safe, always contact the system administrator if you see such a warning. In HTTPS, there are mechanisms which make it very hard to even ignore these types of warnings.


Automating PGP encryption? (Windows) Let's say I have daily files that need to be encrypted using PGP (and then emailed) and I want to automate this task. I would be using Windows PowerShell to manipulate the files (examine date/times etc), but how can I automate the PGP part?

I am using the PGP software manually, but I do not see any command line options. I do see a command line software from the same place (Symantec) but for $3000 which I can't do.

I found GnuPG, but (according to GnuPG's FAQ) PGP cannot decrypt GnuPG files if using v 2.x or if using v 5.x then PGP has to use more options. The receiving users are not be willing to make things more complex with extra options required.

In short, I am looking for a command line PGP for Windows.

The incompatibility is only for v2.x of PGP.  For v5.x, the GPG (not PGP as you state) needs to have more options.

If the problem with PGP 2.x is truly an issue, then you will probably have to shell out for the PGP command-line version.  Note that PGP v5 appears to have been released in 1997 and PGP v2 was in 1992-ish, so unless you are dealing with recipients that do not upgrade, you will probably have good coverage.

Import your key and others:

gpg -v --import c:\pgp\my-pub-and-priv-pgp-key.asc

Import each recipient key

gpg -v --import c:\pgp\pub\recipient1.asc
...
gpg -v --import c:\pgp\pub\recipientN.asc

For some reason the command-line options are really hard to find in the locally installed Windows manual; here they are.

Now use --batch for batch mode, --passphrase-file to have your private key unlocking phrase read from the given file instead of from the keyboard via the gpg-agent*, and always trust the recipient keys.  If you don't need to have the output signed, then obviously you won't need to use or unlock your private key.

Encrypt (-e) and sign (-s) a file

gpg -v --always-trust --batch --passphrase-file mypassphrasefile -se -r
 recipient1 -r recipient2 ... -r recipientN -o output-file file-to-encrypt

Files should be able to be decrypted and verified with PGP by the recipients.

*I don't think I have to say what kind of potentially bad idea it is to store your private key passphrase in a cleartext file.  Note that on Windows, the gpg-agent will read your private key from the keyboard and cache it.  The time period it caches it for can be set in the gpg-agent.conf file, though I've not tried this (see here for some potential pointers; the gpg-agent.conf resides in your home dir which is set using the GNUPGHOME env var or by setting the HKCU\Software\GNU\GnuPG:HomeDir string variable).


What can a site visitor do with a 777 file on my web server? Sometimes I prefer working with text files instead of database as I can later manually edit the file content.
Imagine I have created a text file blacklist and chmodded it to 777. Let's say it is accessible at http://example.com/settings/blacklist.csv. This effectively gives read/write/execute to the whole world, doesn't it? What can a normal user do with that file other than reading its content? Is this a security threat for my site and its content? Will any normal web viewer or someone else other than SSH user (or machine user) modify the file content?

Servers are not written in a way to automatically modify a file just with a simple POST or PATCH method, a security feature, to be sure, so 777's biggest threat is that it does expose read-access to potentially sensitive data. Depending on the server configuration, a 777 file could also be executable, though most server configurations limit execution to "bin" directories as an additional safety feature (e.g. "cgi-bin"). Without ftp, ssh, telnet, etc access, the file is still effectively read-only.

That said, you shouldn't rely on this, and always make sure you chmod your files correctly to avoid any potential complications. The security implications are directly related to the values inside the file, of course. If it's just a list of blacklisted IP addresses, probably harmless, but if it has server configuration values, passwords, etc, that would be an obvious security concern.

In summary, 777 by itself is "mostly harmless," but it really depends on the purpose of the file as to the importance you should place on protecting the file.


BTLE pairing: Where does the code come from? When trying to pair 2 bluetooth LE devices (e.g. 2 iPhones), a popup shows up that requires to input a code displayed on the other device.
I am aware of the concept of out-of-band authentication, and why it is necessary.

Device A generates a code.
Device A requests Device B to enter the code.
Device B shows a popup to the user.
Device B sends the entered code to Device A.
Device A compares the received code to the previously generated code.

However, I am trying to answer these questions:

How is the code calculated in the first place? From a keypair?
Isn't sending the code from device B to device A subject to a passive MITM attack? How is this communication authenticated?

Bluetooth 4.0 pairing depends on both devices agreeing to the same 128-bit "temporary key". In most practical cases the key is generated (zero-extended) from a passkey. According to the spec, the passkey is generated pseudo-randomly.

(all quotes from https://www.bluetooth.com/specifications/adopted-specifications)

  The Passkey Entry STK generation method uses 6 numeric digits passed out
  of band by the user between the devices. A 6 digit numeric randomly generated passkey achieves approximately 20 bits of entropy.

The specification also determines which device generates (and displays) the key and which one expects user input.

The bluetooth pairing protocol uses a "bit commitment" scheme, designed to prevent MitM attacks. Basically, both devices exchange a "confirm value" based on multiple parameters including the temporary key (passcode) and a private random number. The private random number is disclosed at a later stage, proving that the device indeed had known the passcode at the beginning of the process.

  The passkey Entry method provides protection against active “man-in-the-middle” (MITM) attacks as an active man-in-the-middle will succeed with a probability of 0.000001 on each invocation of the method.

The scheme was found to be fundamentally flawed, allowing an active MITM attacker to determine the passkey on-the-fly and pretend that it was known before pairing. A detailed description of the flaw can be found here: https://eprint.iacr.org/2013/309.pdf.


Is GPG a kind of digital signature? So I've been using GPG since I've touched Linux&LibreOffice, but I only knew that's its a signature, for identifying the work is created by me. But soon I've been touching some law questions and they've told me to sign documents with cross-authenticated digital signature, which I'm not really sure what it is.

I've done research on cross-authenticated digital signature and digital signature on google, and they seem to show results that are paid service like DigiCert or other members in Adobe Approved Trust List (AATL). So I have a question, why use paid service while GPG is so popular plus it's free? Is that GPG isn't trusted on legal purpose? Or is there any difference between gpg and other digital signature? As GPG also seems to provides owner's email, name, sign date, etc. Then why paid digital signature still exists?

Anyone can make a pair of cryptographic keys that provide digital signing.

Anyone can claim that a private key they have is the private key of the pope. (They'd probably be lying, of course, which is my point.)

The value of cross-authenticated signatures is that you have a third party saying that your public key is indeed yours.

This provides an extra level of non-repudiation.  If you want to take credit for something that has been signed, you probably don't need a cross-authenticated digital signature. Just prove that you have access to the same private key that matches the signature by signing something else.

However, if someone else wants you to sign something, then later prove that you did indeed use your own private key for that, they need a third party to demonstrate that the private key did belong to you at the time. Otherwise you could just say it wasn't you, and stop using that key pair.


How insecure are non-cryptographic random number generators? I always hear that C rand() is not secure, but what how many calls would you need to know in order to predict the next value (or at least cut down the possibilities)? Would they have to be sequential? If there isn't good information about rand() I am interested in any other widely used random number generators.

It generally depends on the implementation. For the mostpart, you're going to be looking at Linear Congruence Generators, or Linear Feedback Shift Registers.

A common problem with these types of generators is that their period is generally quite short, and that their mathematical form implies deterministic generation. As such, you can (generally) break them in a few hundred calls or less. Sequential results do make breaking the algorithm easier, since you can make stronger correlations that way, but they're not necessary.

The largest flaw with "novel" generators is that the seed is insufficiently large. For example, if you have a generator with a 32-bit seed and know the first 20 values of the generator, it's trivial to brute force. Just generate a sequence for each seed from 0 to 2^32, and compare it. You can employ early-out optimisation to massively reduce the computational cost of this.

Pseudo code:

// the known values from the generator
byte[] knownValues = { 9, 55, 201, 50, 41, 111, 67, 44, 122, 66 };

for(seed = 0 to 2^32)
{
    srand(seed);

    bool found = true;
    for(n = 0 to len(knownValues))
    {
        if(rand() != knownValues[n])
        {
            found = false;
            break;
        }
    }

    if(found == true)
    {
        print "Found potential seed: " + seed + "\n";
    }
}

With a reasonably fast RNG and some decent hardware, this definitely becomes a plausible attack.

I recommend you read through the following for a thorough explanation:

Random Number Generator Designs - Andreas Zeller, Stephan Neuhaus [pdf]
Randomness in Cryptography - Erik Sonnleitner [pdf]
Applied Cryptography - Bruce Schneier


You've just acquired a newly created CentOS server, what should you do to secure it? I've just acquired a new CentOS server, which will be hosting a Ruby on rails application, it is public facing. What should I do to secure this server?

The easiest way is to harden it by using the DISA/STIG (Security Technical Implementation Guides) compliance standards which are published by the department of defence.

They are quite comprehensive and exhaustive when it comes to server hardening. You can find them here: http://iase.disa.mil/stigs/.

Aside from server hardening you also need to make sure your app is written in accordance to the OWASP web application best practices.

Aside from a normal firewall you should also deploy a Web Application Firewall (WAF) such as mod_security and a host based intrusion detection system (OSSEC).

Preferably you do not expose management interfaces such as SSH on the public IP and all logging should be done towards a separate loging server (of course if your server infrastructure only covers this single server that might not be an issue).


Example of malware that spreads via USB? I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware before, so if anyone has a guide or a link to a download where I can get a sample like this I'd appreciate it.

Where can I find sample malware with source that spreads via USB?
Where can I find a tutorial on writing malware so I can understand more about how it works?

autorun.inf

[autorun]
open=file.bat
shell\option1=Open
shell\option1\command=file.bat

file.bat

@echo off
copy autorun.inf C:\ > NUL
copy file.bat C:\ > NUL
copy autorun.inf D:\ > NUL
copy file.bat D:\ > NUL
explorer .

Put them together, and you got something that will spread through USB.

On a more serious note, don't expect that someone will just hand you a piece of malware here.


Which cipher suites are proposed by client and which one chosen by server? I've sniffed several TLS/SSL communication with Wireshark, and I want to find out which cipher suites are proposed by client and which one chosen by server. How do I do that?

Here you have some of what I have sniffed:

EDIT:
Here are the first packets:

The client offers a list of cipher suites in the first message it sends, called ClientHello.

The server offers a single ciphersuite it chose from the list offered by the client, in the first message the server sends, called ServerHello.


User Binding Request with credentials in Lync Dump I've dumped a call between two lync clients and saw that there were some UDP packets that look like this:

Server -> Client

1132    14.495362000    <serverip> <clientip>   STUN    146 Binding Request user: ????:????

Client -> Server:

1133    14.499136000    <clientip>  <serverip>  STUN    130 Binding Success Response XOR-MAPPED-ADDRESS: <serverip>:54019 user: ????:????

????:???? - ? is a character from the alphabet

If I read the RFC correctly this is not a security issue, is that correct?

IIRC, you need to enable MESSAGE-INTEGRITY mode for it to be secure. MESSAGE-INTEGRITY needs to enabled and supported on your STUN/TURN server.

Take a look at Microsoft's TURN/STUN RFC http://tools.ietf.org/html/rfc5766

Without MESSAGE-INTEGRITY, depending on the level of access of the attacker, a relfection attack might possible.

Disclaimer: It's been a while since I've dealt with Windows


How do I validate a certificate by hand? I have a website, which has a signed certificate file (website.crt) from a certificate authority (CA).

How do I make sure exactly, that this certificate is valid?

I know, that browsers do it automatically, but I want to do it by hand, with tools like openssl, so I can learn about the process, and understand what browser do exactly.

Let's assume, that I have one root certificate on my computer, and that there are other intermediate authorities. Also, for the sake of accuracy, it uses x.509 version 3 standard.

Copy all CA certificates in PEM format including root into a single file. Certificate can be mostly in one of these two formats: PEM format is text, DER is binary. If it is in DER - can convert this way:

openssl x509 -in <certificate in DER> -inform DER -out <certificate in PEM> -outform PEM

Then concatenate all CA certificates in PEM format into a single file:

cat cert1.cer >> all_certs.cer
cat cert2.cer >> all_certs.cer

Then validate your certificate against this certificate chain:

openssl verify -CAfile all_certs.cer <your certificate>


Why not encrypt TLS handshake? this is my first question here, I've researched this briefly but couldn't find any satisfying answer.
TLS handshakes are being sent over the wire unencrypted. This way someone that eavesdrops can learn a number of things about the connection (e.g. domain being accessed, protocol being used [ALPN], cipher as well). Why not initially use an anonymous cipher to encrypt the handshake and then switch to non-anonymous cipher after the certificate has been verified? MITM shouldn't be an issue here because the certificate still needs to be presented and verified.

You need the parameters for the encryption in the handshake. You can't encrypt anything without having at least the public key of the other user or a shared secret. Also, using some sort of hard-coded cipher could cause compatibility problems. That is the whole point of the handshake, not to bind the protocol to a single cipher with single set of settings.


Has Palo Alto firewalls released perimeter protection for the vulnerability in the Bash shell utility? im wondering if palo alto firewalls have released perimeter protection for the bash shell vulnerability.

Shellshock has been exciting today!

To answer your question: Normal PAN-OS maintenance release updates will provide a fix for the vulnerability. I'd always recommend their wildfire professional subscription on the perimeter, it has worked well for my organization!

But you don't really need it, Palo Alto Networks released an emergency IPS signature for protection against this vulnerability, with content version 457 on Wednesday evening. Shellshock was leaked (http://seclists.org/oss-sec/2014/q3/650) with identifier CVE-2014-6271 They, Palo Alto, intends to release additional IPS coverage for the related CVE-2014-7219 vulnerability with a second emergency content release sometime within the next 24 hours. Stay Tuned and Stay Safe!


What attacks, if any, are possible against Security Support Provider Interface (SSPI)? I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various authentication mechanisms (e.g. NTLM, Kerberos,  etc.) for use in application protocols.

What attacks, if any, are possible against SSPI? Can authentication be downgraded to an easily-breakable (or null) mechanism by an active attacker? Is it possible to pull NTLM or other hashes out of the packets and crack them?

Recently, there are no new attacks, vulnerabilities or exploits but in 2010 and 2007 there were some exploits related to SSPI.

CVE-2010-0161: The nsAuthSSPI::Unwrap function in extensions/auth/nsAuthSSPI.cpp in Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 on Windows Vista, Windows Server 2008 R2, and Windows 7 allows remote SMTP, IMAP, and POP servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via crafted data in a session that uses SSPI.

CVE-2007-2108: Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 on Windows allows remote attackers to have an unknown impact, aka DB01. NOTE: as of 20070424, Oracle has not disputed reliable claims that this issue occurs because the NTLM SSPI AcceptSecurityContext function grants privileges based on the username provided even though all users are authenticated as Guest, which allows remote attackers to gain privileges.


Custom web authentication scheme For a project at work I'm currently implementing a not too large webservice. For reasons of learning something new I tried making it a REST service, which then prompted the issue of authentication. I eventually settled on HTTP Basic Auth since it has the benefit of being supported by pretty much any HTTP library, even though I had to implement the server side myself.

Yesterday a colleague suggested I should just send the hashed password instead of username and password in plain (eventually the service will be accessible only via HTTPS so I considered Basic Auth not to be a security problem, but let's leave that aside for now). But I wondered what it actually would change, security-wise.

Sending the hashed password basically means a bcrypt hash since that's what we store in the database. Which means I would first have to send the client the work factor and salt so they can arrive at the same hash I have in the database. This requires a challenge-response mechanism which already is much more complicated to implement.

Then there is the point that the hashed password the client sends for authentication essentially functions like a plain-text password, as far as auth is concerned; and could easily be replayed, should someone get hold of it.

So basically, what I found:

It solves sending the password in plain, similar to Digest, as opposed to Basic
It doesn't solve the replay issue (Digest does, due to using a nonce) of Basic
It requires password hashing on the client with less predictable performance. E.g. smartphones likely require smaller work factors than desktop machines and the main consumers of the API would be smartphones and tablets. So we would have to reduce strength of bcrypt in that case.
It would be far more complex to implement, both in the client and server, due to a custom challenge/response scheme and thus more room for errors. It probably goes against REST principles as well.

Did I miss anything? HTTPS solves the problems of Basic auth, as far as I understood and thus the custom scheme doesn't solve any actual problem, apart from developer boredom maybe. But I'm no expert on any of this.

You are basically right. In an authentication scheme where there is only one message, from client to server, whatever the client shows "grants access" and, as such, is password-equivalent and can be replayed. If sending the hash of the password works, then the hashed password is password-equivalent. Indeed, what your colleague suggests does not add security; instead, it adds a feeling of security, which is, all other things being equal, a bad thing.

HTTP digest is somewhat better because of the nonce, thus preventing replay attacks. A somewhat similar concept is one-time passwords: this is like HTTP digest, with a counter and/or the current time serving as nonce (see HOTP and TOTP.

Note, though, that even if you have a rock-solid authentication mechanism that could be safely played over plain HTTP, it would still be plain HTTP. An industrious attacker will simply observe the connection, wait for the authentication part to be finished, and then hijack the connection to send his own requests. HTTP Digest was designed at a time when most attackers were assumed to be passive, and it was (wrongly) supposed that active attacks were too hard to pull out. Modern networking has shown this idea not to be true. Therefore, SSL (HTTPS) is needed anyway so that the authentication part is really "authenticating" the communication. And if you have SSL, then Basic authentication (aka "show the password") is fine.

One may even point out that in order to support protocols like HTTP Digest, the server must more or less store the user password in cleartext or with reversible encryption, so that's actually weaker than the normal way of storing hashed passwords.


Iterate through and decode Dot11Elt layers -- Scapy OBJECTIVE

I want to iterate through the Dot11Elt layers of a beacon frame that I captured with Scapy. I also want to decode the .info of each ID layer.

def packet_handler(packet) :

    if packet.haslayer(Dot11) :
        if packet.subtype == 8 :
            for i in packet.getlayer(Dot11Elt) :
                print i.info

def main() :

    sniff(count = 50, prn = packet_handler)

if __name__ == "__main__" :
    main()

RESULTS

This is only giving me the info of ID = 0 which is the SSID

I want to be able to iterate through the layers to get to ID = 1 , ID = 3 and so forth.

Also, I have no idea what this type of encoding it is that I get when I print

packet.getlayer(Dot11Elt)
packet(Dot11Elt)

Here you go buddy. you can have whatever you want

 from netaddr.core import NotRegisteredError
 from netaddr import *
 from scapy.all import *
 import logging
 import logging.handlers

 PROBE_REQUEST_TYPE=0
 PROBE_REQUEST_SUBTYPE=4

 WHITELIST =   ['18:dc:56:f0:40:40','34:a3:95:b1:2b:d9','48:13:7e:57:ae:b6','98:0c:a5:17:7d:2d']
 my_logger = logging.getLogger('agentlogger')
 handler = logging.handlers.RotatingFileHandler('tplink3022.log',    mode='a', maxBytes=1048576, backupCount=10, encoding=None, delay=0)
my_logger.addHandler(handler)

def PacketHandler(pkt):
if pkt.haslayer(Dot11):

    if pkt.type==PROBE_REQUEST_TYPE and pkt.subtype ==      PROBE_REQUEST_SUBTYPE:
        PrintPacket(pkt)
def mac_info(mac):
    global macf
    maco = EUI(mac)
    try:
        macf = maco.oui.registration().org
    except NotRegisteredError:
        macf = "Not available"
    return macf
def PrintPacket(pkt):
    print "Probe Request Captured:"
    try:
        extra = pkt.notdecoded
    except:
        extra = None
    if extra!=None:
        signal_strength = -(256-ord(extra[-4:-3]))
    else:
        signal_strength = -100
        print "No signal strength found"
    mac_info(pkt.addr2)
    print "Time: %s   Source: %s SSID: %s MANF: %s RSSi: %d"%(pkt.time,pkt.addr2,pkt.getlayer(Dot11ProbeReq).info,macf,signal_strength)

    str = "%s,%s,%s,%s,%d\n"%(pkt.time,pkt.addr2,pkt.getlayer(Dot11ProbeReq).info,macf,signal_strength)
WriteToFile(str)

def WriteToFile(str):
    my_logger.warn(str)

def main():
    from datetime import datetime
    print "[%s] Starting scan"%datetime.now()
    print "Scanning :"
    try:
        sniff(iface=sys.argv[1],prn=PacketHandler,count=0,store=0)
    except:
          print'[!] Eroor : Failed to initialize sniffing'

if __name__=="__main__":
    main()`


Gmail may be hacked - bulk spam emails being sent FROM Google apps account I have a Google Apps email (Gmail with my own domain) - let's call it John@example.com.

3 days ago many people in my address book were sent a spam email FROM my John@example.com account.

When I logged into the web app (I use Outlook on the desktop to manage my email) these emails didn't appear in the sent items.

I changed all the passwords but now 3 days later another group spam message has gone out.

Again nothing is in the sent items. It surprises me that these messages are getting through at all if the email is just being spoofed.

How can I get to the bottom of this and stop these messages being successfully sent. How can I know  if I've been hacked?

It is more likely that your email address is being spoofed than your account is actually hacked, though either is a possibility.

Spoofer scenario: Because there are users from your contact list being sent emails from your account, it means that a spoofer likely got access to some of your emails and stole the recipient lists from them. They do this because spam that appears to come from someone you know is more likely to be read by the recipients. If this is the case, there's nothing that you can do to stop it though you can explain the situation to the recipients.

Hacked account scenario: It is possible that a hacker has somehow gotten access to your Google Apps account. You can check check your recent Google logins to see if you see anything suspicious. If you do find suspicious activity it may indicate specific actions need to be taken to correct the problem. Whether or not you see abnormal logins, there's no harm in being safe. Change your Google Apps password. Make it something random and definitely don't just change a character or two from your current password. You can also enable 2-factor authentication on the account. You may also want to change the password on your computers and lockscreens on your mobile devices just in case someone hacked them (seems extremely unlikely to me but changing passwords is pretty easy).


If your company/university requires you to install root certificates what protects you from man in the middle attacks? Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is there anything to protect you from something being wrong with the certificate of the website with which you connect? For example due to a man in the middle attack.

So visually this is how it's "supposed" to be

      cert1               cert 2
server -> company network  ->  user

but what prevents this:

         cert 1               made up cert                  cert 2
   server ->  man in the middle     ->      company network -> user

after all it seems like the company network isn't able to properly judge if a false certificate should be trusted or not (might be that the user is the companies owner and has self signed or that this is a bank that should be certified by a trusted authority and now isn't)?

Assuming they're not evil, their MITM firewall will generally have the same set of trusted root certificates as your OS so any real MITM attacks or invalid certificates will be rejected by their MITM firewall.

It's not possible to "add" their certificate at the end. They will directly generate  a new certificate for the destination website signed with their root certificate.


Can we keep our customer's X509 Certificate as BLOB on our server? I have a scenario in which I need to use the customer's X509 certificate and passphrase for executing their web services.

Now, I need to know what will it be a security breach if I store customers' X509 certificate on my server as a BLOB and use it.

If it is a security breach than what is the best approach to use that certificate.

Edit: On second thought, this seems to be an xy problem.

Iff you store the certificate, that isn't a problem as that is just a veryfied public key, i.e. public information.

I do however suspect that you do not mean certificate since you also seem to need a password.

If you do indeed mean the private key: you should not keep it; you shouldn't have it to keep in the first place. If you do need to do things on behalf of a client, ask them to provide you with reasonable means of access for whatever service you need to run for them.

One might suspect that you do mean private key for an https certificate. Yes, if you are the hoster, you do need the private key for the https certificate - and it's not a personal certificate of the client, it rather just demonstrates control over the IP or domain - which you have as a hoster.

Since you seem confused about basic terminology, I'd advise you to not store any customer data and instead focus on understanding what you're trying to do first.


How to avoid web service spam? How can I restrict users from spamming my web service by sending thousands of requests?

My web service is actually protected by a validation token only accessible through authentication, but I still can't avoid the fact that my web service will check if the token exists in my database.

I thought about saving the number of attempts by IP, but still, I would have to check every time in my database if the trying IP is blacklisted.

Is there any way to avoid web services spammers?

Fail2ban is a nice option, but it will create some problems if a sizable part of your userbase is behind a proxy, and someone on that proxy abuses your service and locks out every single user of the proxy.

You probably have a traditional database (MySQL, Postgres, Oracle, DB2) hosting your data, but the overhead of the tokens are too high for them.

You could use a small NoSQL database just for the tokens, and let the main database take care of the data. Redis is a good option, and CouchBase is another good one. Couchbase is known to be very fast, so I would try it first. On the other hand, Redis looks easier to integrate.


What details does my iPhone reveal about the user (if any) when I connect to a wifi network? I accidentally used my work's wifi to look at porn using my iPhone.

I refreshed a tab I had open from a session when I wasn't at work.  Now I'm worried my firm will find out.

The network is password protected, but I didn't have to enter a username.
My phone's name at the time was set to my own name (i have since changed this) - will this show up under wifi network history logs?
Can my MAC address or IP address of the phone be linked to my phone number?  Or does my iPhone show up any other details about me?

It is possible for them to identify you, but whether or not they will is another matter.

If the password to get on the WiFi network is simply a WPA password (or similar) then this will not identify you in itself. They will most likely have access to your device's host name and could always identify you via other methods. Whilst your MAC address identifies the device, it does not identify the owner. That said, it wouldn't be too difficult to figure out who it belonged to if you were a network administrator. The same goes for the IP really.

I wouldn't worry too much about it. Unless your company operates some incredibly stringent IT policies and has time to spend on trying to determine who you are, this will likely slip under the radar.

The lesson to learn is, do you really need to use your corporate WiFi? I have enough mobile data allowance to not have to pass my traffic through any more network operators than is necessary.


Does no response on port 80 mean that my router is blocking incoming connections? I'd like to simulate how my router will allow an outside intruder into my LAN if they know my dynamic IP address. So for that purpose, let's say that I know my IP address to be abc.def.ghj.klm: 80. Typing that into my browser address bar doesn't retrieve anything at all.

Does that mean that my router is configured to block connections coming from the outside or am I doing something wrong?

If you try to access the server behind a router from outside (i.e. internet) and this fails then this means that either the port is blocked from outside or simply not explicitly forwarded in case of a NAT router. But it could also mean that the server is currently down or that some problems inside the LAN make it temporarily unreachable. Or it could mean that the DNS does not resolve to the currently correct IP address.

If you instead attempt to access the server from inside the same LAN by its external IP address (or hostname resolving to external IP address) then it could also be that your router does not support access to the external IP address from inside. This is also called NAT loopback (or NAT hairpinning or NAT reflection) and is not supported by all routers.


Monitoring Github/Internet for source code leaks We teach an online course and would like to issue takedown notices if source code for our projects are made publicly available.

Is there a way to automate a periodic online search for any code that matches files that we have saved on disk? Currently we use Google Alerts and manually feed in keywords, but this is too noisy, and we need to manually feed in results to be ignored once a match is found (using -site:url-of-found-results). Eventually, we end up with long unwieldy search strings.

Ideally, when we add code to our "protected source list", the solution would find "unique identifiers" which currently don't exist on the Internet, and only search for those identifiers, triggering when found.

If found, an alert should be triggered. We would like to mark results as seen, or false positive so that we don't get repeated alerts.

That's one of the InfoSec / IT Sec issues currently a bit overlooked just like machine code / source code analysis for vulnerabilities and it's quite similar problem.

Basically you can approach problem with two ways:
   - Index and search for the same binary code
   - Index and search for the same source code

Now the problem is that there isn't really search for the source code which could compile and look for same binary code with the same execution sequence.

This is because it's a bit advanced subject, actually, it's the final subject which will allow for automated audits, debugging and so on.
As Elon Musk said himself, that it would eventually lead to the rise of Skynet.

There are some search engines for the code but simply by changing labels in source code you can defeat them.


RC4-MD5 vs DES-CBC3-SHA We moved to RC4-MD5 as a mitigation to BEAST attack. But our other teams are saying to use DES-CBC3-SHA

I want to know if DES-CBC3-SHA is also equivalent secure and mitigates BEAST as well ?

Also are the browser compliance different for these ciphers ?

DES-CBC3-SHA is affected by BEAST, but it might still be a better choice than RC4-MD5, because BEAST is considered mostly fixed on the client side while it gets easier every day to crack RC4.
See also https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-still-a-threat.
The best is of course to move to TLS1.1 or higher, but not all clients can do this.


Why does Directory traversal attack %C0%AF work? Introduction: I am trying to learn the basics of Directory Traversal.

Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains Directory Traversal vulnerability. It states that / is represented as %C0%2F but the representation %C0%AF also works which aids in the successful attack.

Can anyone please explain why both representations work? It would be of much help if the reason is explained at the binary level.

First, URL encoding also know as percent-encoding is simple scheme where in the URL %xx represents a byte (a number from 0-255) where each x is a hex digit (base 16: 0-9A-F; note 16*16=256 the number of different bytes).

Hence %C0%AF in a URL corresponds to putting the bytes C0 AF into the decoded URL, meaning bytes 192 (1100 0000) and byte 175 (1010 1111), while %C0%2F corresponds to bytes 192 (1100 0000) and bytes 47 (0010 1111)

Now ASCII only defines symbols for bytes 0-127.  The most common extension to ASCII to allow special symbols (e.g., for non-English writers) is unicode.  Unicode translates symbols like / to codepoints represented by numbers; e.g., / is 47-th codepoint (in hex 0x2f), π is the 960th codepoint (0x3c0), and ♥ is 9829-th codepoint (0x2665).  Now for unicode symbol to be put into a stream of bytes it has to be encoded, and the most common encoding nowadays is UTF-8, as UTF-8 continues to encode ASCII characters in a single byte (8 bits) so it doesn't screw up encoding of plain old ASCII documents.  Note ASCII only defined 128 symbols (between 0-127), which all have the first bit as 0.

The way UTF-8 works is normal ASCII characters are still encoded as usual using one byte, which a decoding application recognizes by noticing the first bit is 0.  When you get to the next byte to process, if you see that the first bit begins with a 1 it indicates that the next symbol is represented across multiple byte sequence.  The number of bytes is determined by the form of the first byte (specifically, the number of leading 1 before the first 0 in the first byte).  For example, if the first byte of the multibyte sequence is of the form 110x xxxx that indicates that the next symbol is represented with two bytes.  Similarly 1110 xxxx means it is the start of a three-byte sequence, 1111 0xxx is a four-byte sequence, etc.  Now, if you read the UTF-8 wikipedia page, you'll notice the two byte sequence should be in the form 110i jklm  10no pqrs to represent the unicode codepoint with the binary number ijk lmno pqrs, which in principle could be any binary number from 000 0000 0000 (0) to 111 1111 1111 (2047).  In our first case (C0AF), we have the bits 1100 0000 1010 1111, which represents the codepoint 00000101111 = 47 = /.  Note that 47 could also be represented more simply with just an ASCII character / that is as the bits 0010 1111.  You may wonder why the second byte is defined to start with 10 -- UTF-8 put this in, so you can tell if a character is a continuation of a start of a multibyte UTF-8 character to help catch errors.

So this seems to allow multiple ways to represent every unicode character.  But this isn't allowed in the unicode standard.  Two byte sequences are supposed to have go to values only between 128 and 2047, so C0AF shouldn't represent a / but be an error.   However, unicode libraries are often designed to be fast, where people may not consider the security-implications.  Thus some library may choose not to check that the value of the two-byte unicode character is in the valid range (even though the unicode standard forbids this).  Or the developer decided that if given a C0AF mostly likely some malformed UTF-8 application meant to send 2F, so decides to fall back on the most sensible behavior to be most convenient to the user (as displaying a / seems more sensible than any other choice of character to display).

Similarly, the even more flawed %C0%2F version also works in some bad unicode libraries, because many applications that decode unicode do not check that the first bit of the second byte is actually a 1 as the previous byte already indicated it was a two byte codepoint.  That is the bad decoder accepts 110i jklm  ??no pqrs as a valid two byte codepoint regardless of ?? being 10 as the UTF8 standard mandates.  The first two characters of the second byte are redundant, so a quick and dirty unicode decoding application could decide to not check that these characters match the proper value.

So now that we know why %C0%AF and %C0%2F both ultimately decode to the symbol / with unicode decoders that skip proper checking.

As for why this succeeds in allowing directory traversal, it often happens that the filtering of improper input and decoding the unicode symbol is done at different stages of the application.  The web server may be smart enough not to allow someone to go to navigate through to http://www.example.com/../../../etc/shadow or even http://www.example.com/..%2f..%2f..%2fetc%2fshadow by factoring out improper symbols.  However, if a web server is serving files and decoding the unicode is done after the check that prevents directory traversal or done slightly differently by the operating system, this attack may get past the filter allowing the attack to work.

For a more detailed accessible introduction to unicode, I recommend "The Absolute Minimum Every Software Developer Absolutely, Positively Must Know About Unicode and Character Sets (No Excuses!)".


How does MailChimp authenticate emails? Keeping it short, MailChimp states that:

  Authentication Should Be Simple

  Email authentication is useless if it's too hard to implement. Many
  email service providers require server setup in order to authenticate
  your email campaigns. Accessing your server to modify DNS and TXT
  records and modifying your MTA is just not practical (especially for
  small businesses). At MailChimp, our authentication is free and
  automatically added to your campaigns by default.

So that got me curious. How can MailChimp automatically authenticate emails without accessing my servers to modify my domain's DNS records?

(record types: SPF, DKIM, PTR, SenderID)

So that got me curious. How can MailChimp automatically authenticate
  emails without accessing my servers to modify my domain's DNS records?

As far as I can see... they can't.

From their own setup instructions:

  To set up custom DKIM, you must create or edit two files, known as
  "records," through your hosting provider, domain registrar, or DNS
  provider.

And from the very page you referenced:

  Some methods (SPF, SenderID) simply require a file on your server that
  can be cross-referenced by a receiver.

My guess is that either:

They're talking about sending via one of their own domains rather than your own
They mean it as an aspiration related to their participation in the  "Authentication and Online Trust Alliance" (which they link to underneath) rather than something which is true today


Is CSRF protection useless with AJAX? I've asked a question regarding an ASP.NET WebAPI implementation of CSRF protection:

https://stackoverflow.com/questions/45389512/the-anti-forgery-cookie-token-and-form-field-token-do-not-match-when-using-webap/45569019#45569019

Though there's an answer saying that, with default CORS policies, that kind of XSRF token validation with AJAX calls is useless.  Is this true, and if so, why?

Yes, you very probably need to run some check to ensure the authenticity of the request.

Basically, what is it possible from a third party website ?

Send cross site request from html form with either GET or POST method. It is not possible to set custom headers via html forms. It is not possible to use others methods such as PUT or DELETE. See this question or the RFC.
Send cross site request with ajax for whatever method you want (if there is an Access-Control-Allow-Origin and Access-Control-Allow-Methods headers sent by your server) and set custom headers. Please note that GET and POST request are not possible with ajax without those headers while they are with html form !

The different scenarii are as follow :

You use the basic javascript XMLHttpRequest object to do GET or POST request. You are vulnerable since this is possible to do the equivalent request from a cross site using html form ! You can protect your site from csrf adding an extra header such as X-CSRF-HEADER and checking for it server side.
You use $.ajax from jQuery library for a GET or POST request. Your are vulnerable if you don't do any server side check ! jQuery automatically add an header, X-REQUESTED-WITH, while performing $.ajax request, that you can check server side.
You use another method than GET or POST, you are not vulnerable since you can't send cross site request with another method without additional autorization from your website. Still, this is really thine ice (a bug in the browser or HTTP sepcs could change) so you should also protect it against csrf.

The value of the header X-XSRF-TOKEN in your example is at the time I write useless. The most important thing is the presence of the header itself because you can only add a cutstom header with ajax which itself isn't cross site natively possible. Howewer, note that this may change in the future depending of how HTTP specs evolute so that I would advice to check the token value.


windows 10 showing me that bWAPP contains a reverse shell i have downloaded bwapp from official site and windows 10 defender showing me that it contains a reverse shell ( i know these things are there for practice ) but in earlier days it is not showing that. Is it good to use it is safe to use
Or it is just a False Positive

Is it good to use it is safe to use

From the description:

bWAPP, or a buggy web application, is a free and open source deliberately insecure web application.
It helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities.
bWAPP prepares one to conduct successful penetration testing and ethical hacking projects.

No, it's not secure. It's not meant to be secure. It's explicitly meant to be insecure, as a tool for training. You should not host it in a way that is world accessible. Host it on your local computer, accessible locally - or even better - in a disposable virtual machine. Heck, they even provide a pre-configured  VM that you can download.
It should be noted that it's 6-7 years old now, so it's outdated. The learning value from it may not be as great as in 2014, as many attacks are mitigated by current technologies and best practices...


SSL: Android may not verify hostname, defining cipher suites I'm developing an Android App which sends some HTTPS requests to our own Webserver (Linux, Nginx, SSL zertificate from "Let's Encrypt").

The requests worked fine on my test devices (Android 4.2.2 & Android 6.0.1), but on another device (5.1.1) the request threw the Exception:

  Cannot verify hostname [my_domain]

Looking at the certificate in my browser, it seems to work fine, using the following connection:

  TLS 1.2 AES_128_GCM ECDHE_RSA

After searching the web for any help, I finally tried to apply a custom SSLSocketFactory, which forces the client to use the Cipher Suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (which has been used by my other test devices, at which the request worked).

Long story short: The request then did work on any device, which indicates that it's the clients fault that the connection hasn't been successful.

So now to my questions:

Why does the SSL verifying work on some Android devices, but on some not?
Why does the Exception say that the hostname couldn't be verified, while the certificate is valid and the hostname stated in the certificate is the right one?
Is it bad to bind the requests to one specific cipher suite? (Looking at those lists, the given cipher suite should be available on all needed Android devices (4.1.0 and higher))

I'm quite a newby in SSL and am looking forward to any answer that could help me to understand this.

Some background on TLS (aka SSL) - When you try to establish a secure connection from your client to the server the server will send the client its certificate to prove its identity to the client, along with a list of ciphersuites that it supports. The client verifies the identity by making sure the domain it is connecting to is the domain stated in the certificate, and that the certificate is signed by a valid certificate authority. After this is done the client and server establish some shared secret from which to derive keys and also agree on a ciphersuite.

You may notice above that ciphersuites (e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) are negotiated after the servers identity is established. This means that if there was a problem verifying the hostname it would happen when the the server sends the client its certificate, not when ciphersuites are negotiated. In other words this error should not be linked to the ciphersuite that the server and the client agree on, since it would happen before a ciphersuite is ever agreed upon.

My hunch is that this may be a misleading exception message being given to you by the SSL library being used on Android. I am not familiar with what ciphersuites come with SSL libraries on Android 5 "out of the box" so to speak, but perhaps when the server sends the client it's list of supported ciphers, the client does not see any ciphers that it supports and this cascades to some misleading exception logic. I'd suggest looking at what ciphersuites your server is configured to support and also look at the documentation for Android 5 regarding supported ciphersuites. One thing that seems to be true given what you stated is that your certificate is not the issue here.


Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks? I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. I'm interested in data relevant to what a user is able to control with the password itself (so, something like phishing isn't on my radar as much since the vulnerability is the user rather than the string of characters themselves).

So, for a secure password, I'm thinking I'll recommend, in descending order of importance:

length (brute force)
uniqueness (reverse brute force, matching username/password of hacked Site A to secure Site B)
impersonality (guessing based on knowable personal details)
ease of memorization (indirectly relevant; the first three make a password hard to remember, so you have to decide if you're gonna sacrifice those to remember better or if you're gonna write it down and risk the paper getting stolen)

I have length at the top because 1) research generally cites it as the best and easiest way to make a password safer and 2) in my experience, attacks seems to be en masse/random more than they are targeted for an average end user.

I know there are a ton of caveats; the threat model for a high-level politician's email is different than a teenager's Facebook. Maybe you trust your safe more than your memory. But is there relevant data that answers this question on a high level?

EDIT to rephrase the question:

If I must make a tradeoff in my password strength somewhere (as in, in order to make my password easier to remember, I will either make it shorter or use my birthdate instead of random numbers), which attack should be treated as more likely for the average user of a mainstream web application?

I think the question in the title is better answered as: neither. The attacks against mainstream web applications are in my experience automated against flaws in the web applications and not on the passwords themselves. My company experiences attacks daily for Wordpress, Joomla, and other CMS systems. They are exploiting flaws (mostly SQL injection) to gain access to the entire system.

Attacks against users, I have no data on.

Targeted attacks against users fall into two categories: attacks against all users; and attacks against a specific user.

It makes sense that attacks against all users would as @reed mentioned, would be against the weak passwords or offline hash cracking.

In the case of targeted user attacks, the attacker would be targeting insecure password resets like in the Sarah Palin Yahoo Email hack or using metadata on the user to figure out what is likely for their password.


How to detect a DoS attack if today all use network address translation? If a basic DoS attack can be handled by limiting the number of connections that occur in a interval of time with one IP and some enterprises and institutions use network address translation with many people using internet services.

How do you can detect if an IP is really making a DoS attack or only your service is widely used by some institution like Univerisities or an enterprise?

It's not likely a sizable number of users at some very large company will suddenly access the same resource on your server time and time again, out of nowhere. It's possible, but hardly happens, if all.

DoS almost all the time cause a very large spike on traffic, way more than a Slashdot effect, for example. Something like this:

It's an old picture, but the principle is the same. A traffic spike of 36Mb is nothing today, any current smartphone could handle that.

And if some large network gets hijacked to attack your server, all packets will come from a single netblock (or a couple related netblocks), so it's easy to detect and block such attack.

Real DDoS attacks usually come from thousands to hundreds of thousands of different addresses, not a few ones.


Can I copy a PGP revocation to another server? I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to the revocation certificate for one of them.

Is there a way to transfer the revocation from another keyserver to the one I missed? I had assumed that if I just downloaded the revoked public key from some other server and uploaded it to the out-of-date server, it would be revoked there too (after all, when you fetch a revoked certificate into your keyring, your keyring knows it's revoked). But that does not seem to be working.

Edit:

Well, I feel silly. Turns out they were revoked all along, and the web interface for this keyserver simply doesn't show revocation status (surprisingly). But if the keys are actually fetched from the server, they are indeed revoked.

However, I suppose there is still a useful question here for future readers: Would the method I described above work?

You mean a revocation-certificate, right?
The public-key remains the same, but you can calculate a 'message' stating your key is no longer in use and people can check this signed message with your public-key.
This is a certificate-revocation and it's made with your private key and then - just published.

Maybe you can grab your revocation-cert from somewhere and re-publish it again?