What are the industry guidelines on sharing secrets like API or access token? I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are:

PGP: I could share our public key with the third-party application owner, who could send us the access token for their API. However, from experience I've noticed the person on the other end is often not familiar with PGP and has neither the time or the knowledge how to sent via PGP properly.
Using an AES-256 encrypted zip over mail, and sending the zip password over another communication channel (e.g. in a text): This has the benefit of protecting the secret token from a mail compromise, and having a lower 'technical threshold' for third-party application owners.

I've looked for this in the NIST 800 guidelines without much success..

Are there other methods I'm overlooking, or is there an official source that can confirm these proposed methods as being the "industry standard"?

OAuth2 might be appropriate in this case, the official standard is RFC6750.

There's no need to devise your own crpytographic protocol (which is widely regarded to be a bad idea).

EDIT:

For one-time-sharing you could simply use asymmetric encryption. You encrypt the token with the receiver's public key and only the receiver can decrypt it with his private key. Sending an AES256-encrypted token and the decryption key via another channel seems a little bit overkill.


Belkin wifi netcam cloud storage If my net/router turns off with the belkin netcam will i still receive video if the motion sensor is activated? I was considering purchasing one, but if all that needs to be done is simply turning off the wireless router I really do not see the point. Any help is appreciate :)

This isn't the place to ask, but it is a wifi camera and there is no DVR function attached to it, therefore if you do not have a wireless router or if the router/access point turns off then you will not receive the video stream.

NOTE: I do not own the product nor do am I affiliated with Belkin so my answer could potentially be wrong.


What are the best practices for trusting connection sources in open source software? Quite concise, but I'll elaborate with an example:

Lets say I have a simple app written in C# and i want to know how many people a day open the app. the easiest solution would be to simply have a function that that sent the current timestamp to say a php file on a remote server. that server then aggregates the timestamps in a database that can then be easily queried.

However, if the software is open source its a trivial matter for anyone to be able to essentially copy paste your work and send fake timestamps repeatedly, thus throwing off your numbers.

Your main problem is identifying who are your "real" customers. As the code is open, its easy for anyone to emulate a client. So, how can you do it?

You can use asymmetric encryption. As the keys are not inside the code, there is no way they can "emulate" those keys. Each server will have its own keys.
If encryption is too much for the client (and the information send is not that important), then you can simply use some shared key (like a password), which will be sent always along with the the request (something like a session cookie).

Either way, you still need to know who is who through some kind of authorization (e.g. login page). User/pass will be unique per server, so you can be sure that whoever download the keys or the "password", are authorized clients.

In the case your system has no login information (more general software) its more complicated (and that is what I believe is your real question)...

Well, am afraid there is no much you can do. Perhaps you can store some key downloaded from your server during installation (you can give each client an specific product-key). Not 100% safe, but it could help.

Web analytics are not 100% safe either. They can be faked (just google: 'how to fake web traffic'), but companies try their bests to identify real customers from fake ones with their own algorithms. The advantage they have, is that their code is not open, so you don't know what exactly they are taking into account.

I had once the same dilemma as you. In opensource, each server has its own configuration (which is private), and you can use that in order to keep away unwanted people on knowing everything about your service.

If I can think of something else, I will extend my answer, but that is all from now.


Security evaluation terminology I'm learning about Protection Profiles, Security Targets and Target of Evaluations, and these all seem like very abstract ideas to me. Could someone explain with examples how these work in practice? For example, what does it mean to be implementation independent?

Are these things usually done before or after a system or software is created? What's Common Criteria?

I don't get the part about how something can be implementation independent yet still be about a specific product? Also is this more focused on an existing IT product, or software development?

Common Criteria is an international standard for evaluating the security of a software artifact. Depending on the exact level (EAL) of CC that is being used, this can include information about processes used during software development as well as testing of some of the security aspects of the software.

Because software systems are so complex, it is not always possible to validate it in entirety. As such, only a portion of a system may be targeted for evaluation. This portion is called the Target of Evaluation or TOE.

CC only provides general guidelines as to what is important to monitor during development and testing. Each type of software product can have specific requirements. Protection Profiles (PPs) are an agreed upon set of requirements for a specific type of software and EAL. For example, there could be a PP for a web server for EAL 1, 2, 3, etc... For each EAL, it will specify required features, documentation, and testing that the TOE must meet in order to achieve that EAL.

A security target (ST) specifies the expected functionality of the application. For example, if you have a web app, it may be expected to meet some or all of the requirements for a web server PP, a database PP, and some product-specific requirements as well.


Have both my email address and IP been spoofed, or has someone gotten my password, or...? Just examined a spam email sent to me. The header's "originator" has both my email address and my web site's IP address, (my SMTP). My first thought is that someone has obtained my email password since I'm sure that my site's sendmail is secure. Is there some way that this could be a spoof, or what?

Originating email address is quite easy to spoof when SPF is not in the picture. However, given the nature of TCP it's much harder to spoof a source IP address. It is possible your account is compromised if you are seeing this source IP. I would highly recommend changing your password. There is a possibility there is something configured incorrectly with Sendmail, however, that might allow messages to be forged or relayed through you. I am not a Sendmail expert but I know it's notoriously hard to secure properly.


How to check for vulnerability against WPAD / HTTPS attacks? As described at New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica, there is a newly identified attack at wifi hotspots etc that can expose the URLs you use even if they are HTTPS urls.  This is a problem especially when those URLs contain secrets, which happens more often than one might think. It will be described more at the Black Hat security conference in Las Vegas in a talk titled Crippling HTTPS with Unholy PAC.

According to How to Disable WPAD on Your PC So Your HTTPS Traffic Won't Be Vulnerable to the Latest SSL Attack « Null Byte, WPAD is enabled by default with Internet Explorer, but not in Mac OS X or Linux, nor on Safari, Chrome, or Firefox browsers.

That article gives instructions for how to disable WPAD in Windows.  But how can I check whether it has been enabled on other browsers or operating systems in my organization?  And are there other settings to look at, e.g. around PAC?

https://technet.microsoft.com/en-us/library/cc985352.aspx

  You can use the Group Policy settings to manage the default browser settings on your users' computers. For administrators managing users' computers in an Active Directory® environment, the Administrative Templates in Group Policy provide policy settings for locking most configuration settings in Internet Explorer 8 after deployment.

This page may be out of date, but I imagine the capabilities still exist, and should basically solve the concern for IE and perhaps Chrome browsers in your AD domain.  I believe group policy settings will stick for laptops temporarily unconnected to your domain, but it's been a long time since I had to use group policy.

I haven't found clear information on the current state of Chrome and Firefox, but it appears these browsers default to 'no proxy' which doesn't attempt to grab these pac files.  Unfortunately, this doesn't guarantee that these settings weren't imported from older versions or changed by the user, and I'm not aware of a clean way to check them remotely.

You might be able to bind the standard location of the pac files to localhost using the hosts file, or you might detect these machines on your network using an IDS audit.


What risks are involved with installing gems from rubygems.org? Are alternatives safer? Normally, when installing a Ruby gem, I'd ask my system admin to do

sudo gem install gemname

However, there was recently a security breach with the source of gems, http://rubygems.org , and I'm wondering how safe this is, and whether alternatives are safer.

Would the major risks involved with installing from rubygems.org be that

rubygems.org, or one of its mirrors, got hacked, and supplied me with a malicious package instead of the one I wanted.
Someone successfully impersonated a gem author, and uploaded a malicious package.

If I wanted to avoid such risks, would it be safer to clone the git repository of the source code for the gem, and build the gem myself?

One problem with this approach is I'm not that confident about the security of Github, the main source of git repositories for Ruby related projects. Github uses Ruby on Rails, and Github's security record hasn't been flawless - Egor Homakov was able to hack the website and commit to a project without proper credentials.

Would using code from github have less risk than using a gem from rubygems.org?

Also, would not using sudo while installing Ruby gems reduce my risk?

I use Ruby merely for a command line application that analyses data. I don't use Rails or any of its gems, I'm not building a web application, and my application doesn't need to access the internet.

If I wanted to avoid such risks, would it be safer to clone the git
  repository of the source code for the gem, and build the gem myself?

Probably not. More effort is likely to go into releasing (and potentially approving) a gem for inclusion onto rubygems than you will go to when cloning the source, especially for popular gems. Furthermore, there might be particular configuration / build options that are taken care of on your behalf when getting from rubygems which you might not be aware of when cloning from github.

However as Deer Hunter said, if you are going to go to the effort of thoroughly reviewing the code yourself, then cloning it from source is a good way to go.

Note that if the code of the gem in question is hosted on github, then in trusting rubygems you are implicitly trusting github, as any attack on the source there is very likely to also affect the author's gem publishing environment.


How to verify a GPG file signature on Linux and Windows without connecting to the Internet? Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready:
-installation file (eg the .exe file)
-the respective .asc signature file of that installer
-the respective PGP public key number of the developer:

1) For Windows - what are the lines to input in the command line?

2) For Linux - what are the lines to input in the command line?

Thanks

2) For Linux - what are the lines to input in the command line?

On Linux:

gpg --verify file.asc file.exe

You can also use a shorthand:

gpg file.asc

which will aks you which file is the signed file.

In the special case where the signature file is named exactly the same as the signed file, except with .asc appended, this will automatically guess that this is the file to be checked against the signature.

  1) For Windows - what are the lines to input in the command line?

I believe the same commands as used for Linux should work on Windows, provided GPG is installed. I cannot be sure though and I currently lack the ability to check it. I hope this answers proves useful to You either way.


Fresh install of Windows 7 vulnerable? A friend got a new Windows 7 computer.  His plan was to connect it to the internet and download all the Windows updates.

I told him a better strategy would be to download the patches from another system and then install them on his new computer before he connects it to the internet.  My rationale is that his computer would be more susceptible to attacks until the system is patched.

But I started to wonder if my rationale is valid.  Are there known attacks on an unpatched Windows 7 system if it is simply connected to the internet and is just sitting without being used?  The system would have no third-party software, and he would not be using any tools like email or a web browser as he is downloading and installing patches.

It is certainly possible that a fresh install could be infected but remember that it will be connected via a router that won't be allowing inbound connections.

So as long as you only run Windows Update, you will be fine.


How to disallow specific ssh ciphers and/or MACS (blacklist approach) I have a report detailing weak ssh ciphers on a system. How can I dis-allow these specific weak ciphers. The common solution which I am aware of is adding the following lines in sshd_config (which is a white list approach):

Ciphers aes128-ctr,aes192-ctr,aes256-ctr
MACs hmac-sha1,hmac-ripemd160

The solution I am looking for is a config which in theory allows all ciphers and MACs except the weak ones (blacklist approach) as opposed to explicitly define which ciphers are allowed only.

It depends on what OpenSSH version are you using. In versions below 7.5, you have no other option than you already said -- list all the white-listed algorithms.

Since OpenSSH 7.5 you can use - modifier, which will blacklist "bad" algorithms from the default set, such as

Ciphers -arcfour
MACs -hmac-md5


How to bypass mysql_real_escape_string to exploit a SQLi vulnerability? I tried to find some SQL injection exploits that could bypass functions that should prevent sql injection vulnerabilities, for example mysql_real_escape_string. I found an exploit and the author described the vulnerability and posted the vulnerable code:

<?php
 if(isset($_GET['pagename'])){
  $name=$_GET['pagename'];
  $query=sprintf("SELECT* FROM ".PREFIX."page WHERE
  pagename = '%s' AND publish = 'Y'",$xx_con->real_escape_string($name));
}

But he did not describe how to bypass the protection, i.e. the function real_escape_string. Is there a real SQLi vulnerability in the code and how could an attacker exploit it?

Update: see comments below regarding proper implementation.

Original answer, before knowing this was officially documented:

  The use of function real_escape_string with substitution %s within
  an already quoted string '%s' looks highly suspect.

  There could well be a vulnerability if

  if real_escape_string not designed correctly,
  or not used in accordance with its documentation. (mis-used, perhaps with extra quotes ' or something else)

I would highly recommend using a more standard method of solving SQLi
in PHP. One that involves ? substitution is best. However there may
be another sound encoding method available. Such methods usually add
their own quotes internally, in which case adding quotes ' in your
code would be unnecessary.

I did notice one other thing about that code. Where does PREFIX come
from? If this is user-provided then you obviously have an SQLi
vulnerability. On the other hand, if it is simply a hard-coded or
well-sanitized value then you are OK with that one.


Safety of Password Hashing Using bcrypt Done on Client Side I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice.

It is considered safe.

Would sending bcrypt hash to the server for checking be equally safe?

The point of bcrypt is that it is computationally expensive, so that stolen hashes cannot be brute forced (or would take a long time). With the client sending the hash, i think this still holds true.

So, the question is, would this technique compromise my network's security in any way?

-- Edit

I would like to do this because it reduces the computational power the server needs. Doing moderately expensive things on the client is never a bad idea.

The issue is that your hash now essentially becomes your password. If your database of hashes gets stolen, they don't need to worry about brute-forcing any of the hashes, because that's all you need to send now to authenticate.


RSA key recovery using sound - How does it work? A very interesting Debian security advisory was released yesterday.

  Genkin, Shamir and Tromer discovered that RSA key material could
  be extracted by using the sound generated by the computer during the
  decryption of some chosen ciphertexts.

How does this attack work? What are some possible mitigations?

This attack is a form of side-channel attack against RSA. The full details can be found in a paper published by Adi Shamir (one of three authors) of RSA fame.

The attack essentially works because a computer emits different sounds when performing different tasks. Using this information, it is possible to recover information about the RSA key during the process of encryption or decryption. When the same plaintext is encrypted with different RSA keys, the researchers were able to discern which key was used in the encryption process. This is a form of key distinguishing attack.

The interesting part about this is that the researchers were able to pull off the attack using mobile phones. This is troubling because this attack does not require specialized equipment to pull off.

While this attack is strictly theoretical at the moment, it is still interesting as side-channel attacks have been responsible for many of the attacks against RSA in the past.

Mitigation

Like the Debian advisory mentions, this attack is fixed in the newer versions of GPG.

  For the oldstable distribution (squeeze), this problem has been fixed in
  version 1.4.10-4+squeeze4.

  For the stable distribution (wheezy), this problem has been fixed in
  version 1.4.12-7+deb7u3.

  For the unstable distribution (sid), this problem has been fixed in
  version 1.4.15-2.

Better yet, use the GPG 2.x branch which already employs RSA blinding that should protect against side-channel attacks.


Is it possible to forge key files and mount a veracrypt container? If I have a Veracrypt container, and I use a key file with a password, if the key file is too simplistic, is it possible to recreate that key file and open the container?

Suppose if I use a .jpg of a simple image, can an attacker open up MS Paint (or a similar program), and recreate the image, and use it with the password to open the container, or would they need direct access to the original image?

From the Veracrypt documentation, it looks like they are using a hash of the keyfile contents and the password to derive the header key.

Due to the nature of hashes, a change to any single bit of the input will cause a large number of changes to the calculated hash value. This is true for all hash functions by design.

However, they only use the first 1 MB of data from each keyfile. While a person is extremely unlikely to duplicate your image accurately enough to generate the header key (this is virtually impossible), any file with the same 1st MB of content would work. This won't be an issue with JPGs, and I wouldn't expect it to happen under normal circumstances.

So, in summary, it is virtually impossible for them to unlock the volume without that original file---or at least the first MB of it. Be careful where you keep the keyfile, and securely delete it when moving it.


How to write an authentication module for my website? This will sound naive for sure, and it is. Being a recent college graduate, I have been wondering on how do average websites implement their authentication modules. I have been using a table storing username and hash(password) and their roles (for authorization). All I do is string-matching and done! Then install an SSL cert. This sounds too simple in practice !!

Then I look at the enterprise systems which implement JAAS and stuff like that, which sounds too complex for a small-medium business.

How does an average team consider writing an authentication/authorization module ? This is a language/platform agnostic query. I would be obliged to get any suggestions.

Thanks !

You don't. You use the authentication and authorization modules provided by your framework.

My goto web framework is Python's Flask framework. Flask-Login is an excellent module that provides an easy to use API that handles the bulk of the authentication work. Flask-Security is another module that encompasses Flask-Login as well as various other security modules. This isn't unique to Python and Flask. Java for example, has Apache Shiro.

Don't roll your own. There are quite a few gotchas that you have to take note of when writing authentication and authorization code. Use battle-tested frameworks and save yourself the headache.


Preventing users from bypassing root/jailbreak detection measures A pentest was made to our mobile app (Android and iOS version) and we received feedback stating that jailbreak/root detection was ineffective because it was relatively easy to reverse engineer the application and change the return value of the method that checks whether the device is rooted/jailbroken.

Should we apply code obfuscation to our native apps? What's the course of action here?

Pros:
- Proprietary code will stay safer from theft
- This will add an extra layer of security so most attackers will desist, preventing them from modifying the app in malicious ways (other than changing jailbreak/root detection)

Cons:
- Dedicate time to implement obfuscation methods
- Risk of breaking the app

Perhaps in the case of iOS we could "manually" obfuscate the jailbreak detection of the code to make it look more generic / look like something else, so the attacker doesn't know what it is and thus can't modify the code since a jailbroken device is needed to do this. But that would still leave us with the android issue.

Quick note: latest versions of android (or one coming soon?) now have jailbreak protection built-in, and you can specify that you don't want your app installed on any jail-broken devices.

This is a bit outside of my immediate area of expertise, but I think I have a good answer for you anyway.  Like anything else, it's all about the cost/benefit analysis, and unfortunately only you can do that.  We can run through that real quick, but bear in mind that I'm not actually asking you to answer these questions here.  You're welcome to, but I'm just trying to guide you through the sorts of questions I would ask myself to answer your question.

You are attempting to detect jailbreaking for a reason.  Why?  What loss are you seeking to prevent by stopping your app from running on jailbroken devices?  Are you losing revenue from a single customer?  Or are you potentially leaking confidential documents or protected information?
What percentage of your users do you expect to have the technical ability and motivation to reverse-engineer your app so that they can defeat your jailbreaking-detection and run your app on a jailbroken device?

To give two extreme examples: if your app is a game and the potential loss to your company is ad-revenue or in-game currency sales because the person who reverse engineers your app can get everything for free, then this is probably not worth more than 5 minutes to secure on your end.  The reason is because so few people have the technical know-how to accomplish these things, and the loss-per-person is so small, even the time you took to write this question already cost you more than the potential loss.

On the other hand, if your app is a document reader for documents classified as the highest level of secrecy by the NSA, and foreign governments are going to be trying to break into it to steal our most valuable secrets (not that the NSA has any secrets anymore), then code obfuscation is not secure enough.

The answer depends on your own balance of cost/benefit.  Your risk is probably in the middle of these two extreme cases.  Ultimately though, I think only you can answer your question.

Time for a risk assessment

I think that by the time you get to "Should we obfuscate our code to prevent competitors from reverse-engineering our software?" you are past the point of needing a penetration test.  Instead, what you need is a risk assessment.  I think this is now a business question, not a security question, because you are now entering legal territory.  Competitors trying to take a part your systems is a different kind of problem.  Taking some steps on the technical side to discourage such behavior is probably reasonable, but ultimately you might be better served with some intrusion detection and a good set of lawyers.  It sounds like this effort may be forgetting about the flip side of security: some security measures are legitimately not worth the effort, and all security steps must be weight against their cost to the business.  Your business needs to decide where that balance between security and cost of maintenance is in your particular case.


How attackers extract data from cipher text using brute force? Lets take an example.
Plain text: HJOU UT
Cipher text: IKPV VU

Above one just a simple substitution technique. Data is random text. If attackers substitute -1 then they will get GINT TS. Otherwise if attackers do +1 then they will get HJOU UT which is the actual data.

Now, how will they decide with one is the actual data? It is just example. In real life, how data being extracted using brute force?

Entropy of the properly decrypted file is lower than the entropy of the improperly decoded file.

For example, properly decoded JPG file contains header information which may contain string ABCDEF which is low entropy. Also decoded email will contain header with strings (7 bit data is also low entropy).

Entropy can be measured by compressing result. Only header would be sufficient. So compressed header should be smaller than the result, which means the brute-force was successful, otherwise, the compressed result is bigger than original, which means bruteforce was unsuccessful.

Improperly decrypted file is completely random stream of bytes. Compression of it makes it bigger, but if it's correctly decrypted, should be smaller.

To make brute force faster, one can devise some quick entropy level check, however it's not feasible as of now. Currently the minimum encryption standard is AES-128 which is not bruteforcable, and AES-256 is going mainstream which has number of possibilities close to the number of atoms is observable universe. Something like some magnitudes lower than that, but very close.


What's the signature structure in TLS server key exchange message? I'm writing a TLS server. While handling ECDHE-RSA cipher suite, the server key exchange is needed. According to Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)

    select (KeyExchangeAlgorithm) {
        case ec_diffie_hellman:
            ServerECDHParams    params;
            Signature           signed_params;
    } ServerKeyExchange;

NOTE: SignatureAlgorithm is "rsa" for the ECDHE_RSA key exchange
algorithm and "anonymous" for ECDH_anon.  These cases are defined in
TLS [2][3].

[2]   Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
     RFC 2246, January 1999.

[3]   Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS)
     Protocol Version 1.1", RFC 4346, April 2006.

So I checked TLS 1.0 & 1.1, in TLS 1.1

  struct {
      select (KeyExchangeAlgorithm) {
          case diffie_hellman:
              ServerDHParams params;
              Signature signed_params;
          case rsa:
              ServerRSAParams params;
              Signature signed_params;
      };
  } ServerKeyExchange;

  struct {
      select (SignatureAlgorithm) {
          case anonymous: struct { };
          case rsa:
              digitally-signed struct {
                  opaque md5_hash[16];
                  opaque sha_hash[20];
              };
          case dsa:
              digitally-signed struct {
                  opaque sha_hash[20];
              };
          };
      };
  } Signature;

So far as I understand, I should use:

digitally-signed struct {
    opaque md5_hash[16];
    opaque sha_hash[20];
};

And what's this digitally-signed structure? I also saw some examples using sha512, is md5 really necessary?

Thanks.

Digitally-signed struct for RSA signing

  And what's this digitally-signed structure?

It's defined in TLS 1.1's Section 4.7. Cryptographic Attributes:

  In RSA signing, a 36-byte structure of two hashes (one SHA and one MD5) is signed (encrypted with the private key).  It is encoded with PKCS #1 block type 1, as described in [PKCS1A].

MD5 hash in digitally-signed struct

  I also saw some examples using sha512, is md5 really necessary?

Yes, it is set to be this MD5/SHA-1 combination in TLS 1.1. This is something that was only changed in TLS 1.2. There the cipher suite gets to choose the hash.

From TLS 1.2's Section 1.2. Major Differences from TLS 1.1:

  The MD5/SHA-1 combination in the digitally-signed element has been
    replaced with a single hash.  Signed elements now include a field
    that explicitly specifies the hash algorithm used.


In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption? It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's encryption and then transmitted with the message after its own encryption using the recipient's public key, instead of just using the recipient's public key directly on the message? Isn't it the same, as far as security properties go?

RSA is not used directly due to several reasons:

RSA encrypts only messages with a limited size. With a 1024-bit RSA key, RSA (as per PKCS#1) can process only 117 bytes of data. To encrypt more than that, one would have to do some chaining, i.e. split the data to encrypt into several 117-byte blocks and encrypt them separately. This is routinely done for symmetric encryption (this is called "modes of operation") but it is not that easy to do securely, and nobody quite knows how to do a secure mode of operation for RSA.
Hybrid encryption allows for efficient multi-recipient data. You symmetrically encrypt the data with a key K, then you encrypt K with the RSA key of each recipient. When you send a 3 MB file to 10 people, you would prefer to compute and send an encrypted email of size 3.01 MB, rather than ten 3 MB emails...
RSA enlarges your data. With a 1024-bit RSA key, you encrypt at most a 117-byte chunk, but you get 128 bytes on output, so that's a 10% enlargement. On the other hand, symmetric encryption incurs only constant size increase.
RSA encryption and decryption are fast, but not very fast. Doing a lot of RSA could prove problematic in high-bandwidth contexts (it would be fine for emails, with today's machines, not for a VPN).

The fourth reason is the most often quoted, but actually the least compelling of the four.


How to store private keys in browsers after Apple's decision to wipe script-writeable storage? We have a web application that puts a private key in LocalStorage, which enables users to sign off certain messages. It's been working fine until today we saw this announcement from Apple.

The TLDR; version is that now there is a "7-Day Cap on All Script-Writeable Storage". If the user does not interact with your web application for 7 days then everything gets wiped. Everything is,

Client-side cookies
Indexed DB
LocalStorage
Media keys
SessionStorage
Service Worker registrations

We understand that Apple is doing this to curb cross-site tracking, but it kills our use case. Any ideas? We would really like to avoid requiring users install a browser plugin, which we all know isn't very popular right now either due to the same privacy concerns.

It looks like the solution to this problem may be to add the application to the home screen.  It seems that the author of the blog post that you referenced added clarification on this, after it was originally published.  If you scroll down to the section 'A Note On Web Applications Added to the Home Screen', it reads:

  As mentioned, the seven-day cap on script-writable storage is gated on
  “after seven days of Safari use without user interaction on the site.”
  That is the case in Safari. Web applications added to the home screen
  are not part of Safari and thus have their own counter of days of use.
  Their days of use will match actual use of the web application which
  resets the timer. We do not expect the first-party in such a web
  application to have its website data deleted.

  If your web application does experience website data deletion, please
  let us know since we would consider it a serious bug. It is not the
  intention of Intelligent Tracking Prevention to delete website data
  for first parties in web applications.

Related:
Apple: Relax, we're not totally screwing web apps. But yes, third-party cookies are toast
Sure, we'll delete local data after seven days but there's a way to avoid that
https://www.theregister.co.uk/2020/03/26/apple_relax_were_not_totally/

Last but not least, I hope you are using the Web Crypto API to store your private keys securely.  See https://crypto.stackexchange.com/questions/35530/where-and-how-to-store-private-keys-in-web-applications-for-private-messaging-wi/52488#52488 for more info.


Side channel attack on SSD? I know it is possible to obtain the key from some cryptographic schemes by using side channel attack on hard drive such as noise and magnetic fields. I was wondering if it was possible to use side channel attack on solid state drives? I have yet to find a paper on this topic.

The problem with SSDs or other encrypted drives, is side channels attacks are ONLY possible while the device is operating with the key. You need to monitor it doing active encryptions/decryptions WITH the real key.

95% of people wanting to break SSDs have them sitting on the table, without the key. So your "classic" side channel attacks aren't relevant (since if the key is encrypted with another key correctly derived from a password, the drive sitting on the table does not know the real decryption key).

The AES engines in most drives won't be SCA resistant (I imagine), so it's probably possible to do an attack. But again it's only possible to do so while the drive is operating under normal conditions. They could be useful (SCA on a laptop sitting on a desk, you can put a sensor right under the drive?), but I think if you have the ability to get that close to the target computer there is normally better (easier) attacks.


How secure is Intel SSD Encryption? Are there any known flaws in the full disk encryption on Intel 520 series SSD drives?

Specifically, it seems these drives generate an internal AES key automatically, even when no password is set. But is the ATA password (also known as "BIOS HDD password") really used to encrypt the internal AES key, or is that internal key stored in plaintext?

I will try to answer your question as specifically as possible.

I contacted Intel tech support to ask them exactly this question: Is the AES key on the Intel 520 encrypted with the ATA password. After weeks of back and forth, I finally received an explicit confirmation from them. I quote:

  Yes, ATA password is used to encrypt the encryption keys stores on the
  SSD. In other words: The Encryption Keys depends on the ATA password
  to decrypt them. The ATA password is not used in combination with the
  Encryption Keys to encrypt the data.

I also found this Intel white paper http://communities.intel.com/docs/DOC-19512 that claims the following:

  How Self-encrypting drives (SEDs) Work: SEDs, such as the Intel® SSD
  320 Series and Intel® SSD 520 Series, have a drive ... Because the
  disk encryption key is encrypted with the ATA (Advanced Technology
  Attachment) passwords

I summarised most of my findings about SED SSDs in this blog post: http://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hardware-based-full-disk-encryption/


Add a San(Subject Alternative Name) to already existing cert? So we have a system that generates a key for every server signed by the company CA.

I need to add a SAN to it but don't really have access to the CSR. Is there anyway to add a SAN? Maybe generate another cert in the chain so I can use the CA and the provided key/cert.

Any ideas?

There is no way to change an already issued certificate since this would invalidate the signature. You can also not issue a new certificate using the certificate you have since this server certificate has basic constraints CA false, i.e. can only be used as leaf certificate and not to sign other certificates.

In other words: you need to create a fully new CSR with all the information you want to have and let it sign by the CA. That you don't have the old CSR does not matter since the old CSR is incomplete anyway. But, you could in theory re-create the CSR from your existing certificate only it would miss the SAN the same as the old certificate does.


Does all asymmetric encryption schemes rely on a third party? Im thinking of schemes like onion encryption, IBE, ABE, Blind Signatures.

No. Asymmetric encryption works between just two people. A trusted third party is generally used to validate public keys.


SSL certificate to protect spoofing of API server I have a program written in Python that checks the validity of its license key with a remote server. Am I right that an SSL certificate would make it possible to prevent spoofing (host redirects for example) of the remote server? And if so, is there a difference between using an official SSL certificate from an SSL provider, or is it perfectly okay to use a self-signed certificate?

Providing the certificate is pre-installed with the python program, then you are right: only your server will be able to identify itself to the client.

In this setup, from a security perspective, the difference between a self-signed certificate and one signed by a trusted CA is that if your server's private key was to be compromised, someone might identify a fake server as the valid one to the client which would not detect it, and you wouldn't be able to revoke this certificate. Note that this can be a very serious issue as well.


Is it safe to sync private keys between iOS devices using iCloud? My iOS app has to handle storing private keys for the user. Normally I would just use Keychain Services for this as I would a password, but it would be great if I could sync the keys between the user's devices.

Apple's iCloud documentation says not to use iCloud for passwords, but is it safe to use for private keys? Apparently, iCloud data is encrypted in transit and on the server.

Are there any security risks in syncing private keys over the iCloud key-value store?

I'd scrap the direct syncing option and simply allow the user to export their private key to a location of their choice, e.g. iCloud, DropBox, internal storage, etc., in an encrypted format.

On export I'd do something like this:

Ask the user for a password to use. Don't impose any restrictions on them - it's their job to use a good password!
Use a strong key-derivation algorithm such as PBKDF2 to generate a storage key. Use a decent number of rounds.
Prefix the private key blob in memory with four known bytes (a magic number), e.g. 'NATG', to form your plaintext.
Encrypt the plaintext with AES-128 or a similar block cipher, in CBC mode, using the storage key and a randomly generated IV.
Export the ciphertext and IV into a file.

On import:

Extract the ciphertext and IV from the file.
Ask the user for the password and generate the same key using PBKDF2.
Decrypt the ciphertext using the IV and key.
Check that the first four bytes of plaintext match your known bytes. If not, it's the wrong password. If so, we're in the money!
Remove the first four bytes and you've got the private key!

This allows users to quickly and easily sync private keys via the communications service they want, whether it be iCloud or DropBox or even email, with a reasonable level of security. If their account gets broken into, the attacker still has to crack their password. If they've used a decent one, PBKDF2 should do a decent job of making their cracking attempt infeasible.


Will "upgrading" www-data user open up known security issues? On a isolated local test/dev server I have elevated the nature of the www-data user to enable a smooth workflow for using Dropbox in a web/webapp development pipeline.

It has worked quite smoothly in my initial testing, and while I don't plan to move it to a production environment - I'm curious if it would send up any major red flags to the security pros if it were moved onto a production server.

The details:

Immediately upon installing Ubuntu 12.04 I deleted and recreated the www-data user with:

sudo deluser –remove-home www-data
sudo adduser --system --disabled-login --disabled-password --group www-data

This provides me the /home/www-data environment in which Dropbox can be installed and operated with the permissions exactly how Apache/Nginx/PHP/etc expect them to work.

To elaborate, Dropbox operates in the user space with the following configuration:

/home/[USER]/.dropbox-dist - is where the libraries/executables are housed
/home/[USER]/.dropbox - is where it caches data and keeps config data
/home/[USER]/Dropbox - is where it keeps the synchronized data

It's odd, but it is what it is.  Working in this configuration means that all synced data receives the permissions of the user that runs it.  Rather than have to putz around with changing permissions manually or pseudo-automatically at the server every time files on the workstation are updated, I've opted to have www-data just run the daemon itself.

Aside from the obvious concerns of running a proprietary application with network access and a less than conventional operating mentality... does upgrading the www-data user to one with a somewhat higher presence on the machine open up security issues I have not foreseen?

Many thanks.

In general this is a flawed approach to permissions.  You should keep www-data,  and then create a new account "dropbox",  which performs the required dropbox actions on behalf of the web application.  One implementation of this is that a php application could run commands as that user only when needed and perform all other actions as the usual www-data.


Would a password saved on paper written in a personal writing system be decipherable? A while ago I created a small writing system to write personal notes, it was more an experiment to see if I could make one and then memorize it.

Seeing as nobody else knows how it works, I created a random password of about 20 characters, and wrote this down on a piece of paper, then I sent a picture of that piece of paper to a close friend of whom I am sure doesn't ever lose her photos. I also saved one in Google Photos.

I don't trust password managers since KeePass which is (at least used to be) recommended a lot is crack-able.

Would it be possible for anyone to crack that?

I hope this isn't an incredibly dumb question, I personally can't come up with any way it would be possible to crack this, but I want to be sure.

I hope this isn't an incredibly dumb question, I personally can't come up with any way it would be possible to crack this, but I want to be sure.

Being unable to come up with a way to crack your own invention isn't generally seen as an indicator for quality in security circles.

  Would it be possible for anyone to crack that?

That depends very much on how your personal writing system works, and how much additional text in this writing system is available to an attacker.

Your question is basically a cryptography question: You have a script no one except you knows, and you want to know whether it's decipherable. There are some historic parallels; for example, Linear A is an ancient writing system that remains mostly a mystery. And if you visit the British Museum, you'll see the Rosetta stone, without which we might not be able to read Egyptian hieroglyphs today.

Assuming your writing system simply replaces letters, or maybe syllables, with your own symbols, it should be fairly easy to crack given a few pages of text written in it. A simple frequency analysis would probably be enough to crack it.

However, if the only thing your attacker has is the picture of your password in your writing system, and the password is random (e.g. not a known word), then I'd say chances of successful cracking are slim. This is because unknown writing systems and ciphers are often cracked because the people working on it make correct guesses about context, and if there is no context, this doesn't work.

What could be problematic is that because a good writing system is designed to be useful, you might have made an 'e' simpler to write than, say, a 'q'. So it might be possible to make some guesses as to which symbol corresponds to which actual letter, which would reduce the number of password guesses an attacker might need to make (e.g. if he correctly assumed that the fourth letter was an 'e' and the seventh was a 't', maybe based on the shape of your symbols, he'd reduce the time needed to find the correct password by brute force (trying every possible combination of characters) by about three orders of magnitude.


How does UEFI Secure Boot prevent "evil twin" spoofing attacks? I've been learning about UEFI Secure Boot.  It is designed to prevent malware from infecting the boot process and overwriting the bootloader.  It has hardware-level protections to ensure that only a signed, trusted bootloader and OS kernel will be loaded and executed upon boot.

Today, malware can overwrite the Master Boot Record (MBR) with a malicious version, so that every subsequent boots into an evil version of the operating system.  UEFI Secure Boot would prevent that, because your machine will only run the bootloader if it is signed, and the attacker's modified bootloader won't have a valid signature.  In other words, with UEFI Secure Boot, you should be confident that, once you reboot, you're now running a valid and trusted bootloader and OS kernel.  Sometimes people summarize this by saying that UEFI Secure Boot prevents "bootkits".  OK, the basic concept makes sense.

I want to understand what stops the following sort of attack.  Suppose you are running Windows (for example).  Suppose the attacker, who has gotten malware on your machine and wants to ensure he'll stay resident after reboots, modifies the Windows startup configuration to launch a virtual machine (VM).  Inside the VM is a modified Windows image -- just like a standard Windows kernel and OS and image, basically a full copy of what is on your machine, except that the kernel has been modified to plant some malware into it.  When you boot, this VM is automatically launched, and (suppose) it automatically starts up in full-screen mode.

It seems like this attack subverts the intended goals of UEFI Secure Boot.  From the user's perspective, it feels like they are running Windows, in their full desktop environment.  What they don't realize is that their entire environment has been infected with malware.  Sure, the host operating system is trustworthy (thanks to UEFI Secure Boot), but the guest operating system (within the VM) is malicious, and the user has no obvious way to tell that they are interacting with an evil guest rather than with the host.  So, the user will think everything is OK, when actually they are hosed.  Connoisseurs of security concepts will recognize this as an attack on "trusted path": the computer booted a trustworthy kernel, but the user has no way to verify that they are interacting with a trustworthy kernel rather than an entirely untrustworthy "evil twin".

Does anything prevent this attack?  Or, is this attack technically feasible?  If it is feasible, does it violate the security goals or threat model behind UEFI Secure Boot?  (More generally, does anyone have a precise statement of the security goals and threat model underlying UEFI Secure Boot, and exactly what it does and doesn't guarantee?)

The attack you describe sounds more like a "diamond heist" attack of sorts (a bit elaborate for the everyday criminal). Before I address UEFI, I wanted to answer if that is feasable. No, not really. If we are talking about a server running a VM, the end user may not notice a performance issue (given enough physical resources) but more than likely the monitoring software in place would detect a new process running and a system administrator would respond. A good sys admin would hopefully be able to tell once he investigates.

If it were a desktop user, he would most likely notice very quickly when he reboots his machine and it looks a bit different. Assuming the VM could spoof the old desktop, the hardware installed, and not display information about the VM running, he may be fooled.

But I think the question was more about the technology than the individual, so my thought would be yes, it appears this type of attack would work for the reasons you stated: the host OS is trusted and secure boot loaded that OS. The VM process could be hidden inside of another process (svchost, maybe?) and both user and monitoring tools could be fooled (for a time).

Your last question (what it does and doesn't guarantee) I found some information at the home page http://www.uefi.org/home/ for UEFI. The answer to the question, "What is UEFI" states:

  UEFI (Unified Extensible Firmware Interface) will be a specification
  detailing an interface that helps hand off control of the system for
  the pre-boot environment (i.e.: after the system is powered on, but
  before the operating system starts) to an operating system, such as
  Windows* or Linux*. UEFI will provide a clean interface between
  operating systems and platform firmware at boot time, and will support
  an architecture-independent mechanism for initializing add-in cards.

From this answer, I believe you are promised nothing. UEFI is a framework that vendors and coders can implement. I believe it would be up to the vendors and coders to make the guarantees.


What is the use of a client nonce? After reading Part I of Ross Anderson's book, Security Engineering, and clarifying some topics on Wikipedia, I came across the idea of Client Nonce (cnonce). Ross never mentions it in his book and I'm struggling to understand the purpose it serves in user authentication.
A normal nonce is used to avoid replay attacks which involve using an expired response to gain privileges. The server provides the client with a nonce (Number used ONCE) which the client is forced to use to hash its response, the server then hashes the response it expects with the nonce it provided and if the hash of the client matches the hash of the server then the server can verify that the request is valid and fresh. This is all it verifies; valid and fresh.
The explanations I've found for a client nonce however are less straight forward and questionable. The Wikipedia page for digest access authentication and several responses here on Stack Overflow seem to suggest that a client nonce is used to avoid chosen-plaintext attacks. I have several problems with this idea:

If a person can sniff and insert packets, the greatest vulnerability is a man-in-the-middle attack which neither a nonce nor a cnonce can overcome, therefore making both meaningless.
Assuming for a second that the attacker doesn't want to engage in a man-in-the-middle attack and wants to recover the authentication details, how does a cnonce provide additional protection? If the attacker intercepts communication and replies to a request with its own nonce, then the response from the client will be a hash of the nonce, data and cnonce in addition to the cnonce in unencrypted form. Now the attacker has access to the nonce, cnonce and the hash. The attacker can now hash its rainbow tables with the nonce and cnonce and find a match. Therefore the cnonce provides zero additional protection.

So what is the purpose of a cnonce?
I assume there is some part of the equation I'm not understanding but I haven't yet found an explanation for what that part is.
EDIT Some answers have suggested that the client can provide a nonce and it will serve the same purpose. This breaks the challenge-response model however, what are the implications of this?

A nonce is a unique value chosen by an entity in a protocol, and it is used to protect that entity against attacks which fall under the very large umbrella of "replay".

For instance, consider a password-based authentication protocol which goes like this:

server sends a "challenge" (a supposedly random value c) to the client
client shall respond by sending h(c || p) where h is a secure hash function (e.g. SHA-256), p is the user password, and '||' denotes concatenation
server looks up the password in its own database, recomputes the expected client response, and sees if it matches what the client sent

Passwords are secret values which fits in human brains; as such, they cannot be very complex, and it is possible to build a big dictionary which will contain the user password with high probability. By "big" I mean "can be enumerated with a medium-scale cluster in a few weeks". For the current discussion, we accept than an attacker will be able to break a single password by spending a few weeks of computation; this is the security level that we want to achieve.

Imagine a passive attacker: the attacker eavesdrops but does not alter the messages. He sees c and h(c || p), so he can use his cluster to enumerate potential passwords until a match is found. This will be expensive for him. If the attacker wants to attack two passwords then he must do the job twice. The attacker would like to have a bit of cost sharing between the two attack instances, using precomputed tables ("rainbow tables" are just a kind of precomputed table with optimized storage; but building a rainbow table still requires enumerating the complete dictionary and hashing each password). However, the random challenge defeats the attacker: since each instance involves a new challenge, the hash function input will be different for every session, even if the same password is used. Thus, the attacker cannot build useful precomputed tables, in particular rainbow tables.

Now suppose that the attacker becomes active. Instead of simply observing the messages, he will actively alter messages, dropping some, duplicating others, or inserting messages of its own. The attacker can now intercept a connection attempt from the client. The attacker chooses and sends his own challenge (c') and waits for the client response (h(c' || p)). Note that the true server is not contacted; the attacker just drops the connection abruptly immediately after the client response, so as to simulate a benign network error. In this attack model, the attacker has made a big improvement: he still has a challenge c' and the corresponding response, but the challenge is a value that the attacker has chosen as he saw fit. What the attacker will do is always server the same challenge c'. Using the same challenge every time allows the attacker to perform precomputations: he can build precomputed tables (i.e. rainbow tables) which use that special "challenge". Now the attacker can attack several distinct passwords without incurring the dictionary-enumeration cost for each.

A client nonce avoids this issue. The protocol becomes:

server sends a random challenge c
client chooses a nonce n (should be distinct every time)
client sends n || h(c || n || p)
server recomputes h(c || n || p) (using the p from its database) and sees if this value matches what the client sent

Since the client includes a new random value (the "nonce") in the hash function input for each session, the hash function input will be distinct every time, even if the attacker can choose the challenge. This defeats precomputed (rainbow) tables and restores our intended security level.

A crude emulation of a unique nonce is the user name. Two distinct users within the same system will have distinct names. However, the user will keep his name when he changes his password; and two distinct users may have the same name on two distinct systems (e.g. every Unix-like system has a "root" user). So the user name is not a good nonce (but it is still better than having no client nonce at all).

To sum up, the client nonce is about protecting the client from a replay attack (the "server" being in fact an attacker, who will send the same challenge to every client he wishes to attack). This is not needed if the challenge is executed over a channel which includes strong server authentication (such as SSL). Password Authenticated Key Exchange are advanced protocols which ensure mutual password-based authentication between client and server, without needing some a priori trust (the "root certificates" when a SSL client authenticates the SSL server certificate) and protecting against active and passive attackers (including the "cluster-for-two-weeks" attack on a single password, so that's strictly better than the protocol above, nonce or no nonce).


Wordlist generator for known words in passphrase Is there any well-known solution to generate wordlists using (for lack of a better term) wordsets instead of charsets?

I know parts of my old password, but I can't remember the exact order. After much searching, the most popular options only seem to offer static patterns using single-character charsets. What I'm looking for is a tool that allows mangling with the order (or at least make optional) known parts of the passphrase.

Example:

I know my password starts with Aword, followed by a special character. I also know Bword and Cword is in the password, and some special chars are in between. I don't know if Cword or Bword comes first. Also, Dword might be included somewhere, with or without special chars surrounding it, too.

Wordlist (assuming special chars is always "+"):

Aword+Bword+Cword
Aword+Cword+Bword
Aword+Bword+Cword+Dword
Aword+Cword+Bword+Dword
Aword+Bword+Dword+Cword
Aword+Cword+Dword+Bword
Aword+Dword+Bword+Cword
Aword+Dword+Cword+Bword
Aword+Bword+CwordDword
Aword+Cword+BwordDword
Aword+BwordDword+Cword
Aword+CwordDword+Bword
Aword+DwordBword+Cword
Aword+DwordCword+Bword

While not accurate/perfect, I know bash expansion could do that:

echo Aword+{,Bword,Cword,Dword}{,+}[,Bword,Cword,Dword}{,+}{,Bword,Cword,Dword}

This also outputs false candidates like Aword+BwordBwordBword, but this could be filtered out, I assume. My problem with this approach is: Bash eats all my RAM, then dies.

I'm happy with too many / false candidates being generated as well as huge output files, so as long as the generating program doesn't crash.

Using custom rules within john-the-ripper John you can write variations of the password. Using John The Ripper to create variations of a known password.


How do I know which cipher suites can be disabled? I have just performed a test on my personal webiste via SSLlabs.com and I'm apparently supporting some weaker ciphers. I've managed to improve several settings (like CAA), but I'm getting stuck at the ciphers.
I've been looking around a bit, but can't really find a method to determine which can be disabled, and which should remain allowed.

Is there a method I can apply, or some check, or a list of current smart config? I'm assuming I can't just turn of all ciphers marked 'weak' if I want at least a mayority support (It's a private server for some small projects, you may assume modern hard-/software accesses it).

If it helps, this is the list:

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)    ECDH x25519 (eq. 3072 bits RSA)   FS            256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)          ECDH x25519 (eq. 3072 bits RSA)   FS            128
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)          ECDH x25519 (eq. 3072 bits RSA)   FS            256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)              DH 2048 bits   FS                               128
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)              DH 2048 bits   FS                               256

// All below are weak
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)          ECDH x25519 (eq. 3072 bits RSA)   FS   WEAK     128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)          ECDH x25519 (eq. 3072 bits RSA)   FS   WEAK     256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)             ECDH x25519 (eq. 3072 bits RSA)   FS   WEAK     128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)             ECDH x25519 (eq. 3072 bits RSA)   FS   WEAK     256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x67)              DH 2048 bits   FS   WEAK                        128
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33)                 DH 2048 bits   FS   WEAK                        128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x6b)              DH 2048 bits   FS   WEAK                        256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39)                 DH 2048 bits   FS   WEAK                        256
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)   WEAK                                                           128
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)   WEAK                                                           256
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)   WEAK                                                           128
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)   WEAK                                                           256
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)   WEAK                                                              128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)   WEAK                                                              256

The required cipher suites depends entirely on the clients that are expected to use the service. As SSL Server Test from Qualys SSL Labs is designed for testing publicly accessible web servers, we can assume this is a web application. All current versions of major browsers are able to handle TLS 1.2+ with the recommended cipher suites from RFC 7525, 4.2, making it a good starting point for a highly secure configuration:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)

Then, from the SSL Labs report, the Handshake Simulation section is handy tool for detecting the common clients you can't serve with these cipher suites alone:

If you e.g. wish to server older Apple devices with Safari, the best cipher suite available for them is:

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)  ECDH secp256r1 (eq. 3072 bits RSA)   FS  WEAK

From the list that leaves... who is using a Windows 8.1 Phone anyway. ;)

Likewise, if you need additional browsers or devices supported, you could use the browser test for figuring out a suitable cipher suite. Also notice that the variants using (Cipher Block Chaining) CBC mode aren't weak in themselves, but SSL Labs considers them weak because of the many vulnerable implementations.


I see a warning notification "site not verified" Utill yesterday I never saw any warnings on secure sites like twitter and many others but currently I am getting an exclamation in my chrome saying identity not verified but https is indeed used, hence what to do in this situation?

following are the screenshots:

Well it was resolved today

Identity not verified means that the certificates being provided by the server are not able to be verified by Chrome.  Clicking on where the lock symbol would be should give you additional details about why it is failing.  Failure can result because the site's certificate is not signed by a root certificate you trust, it could be due to the certificate being revoked, it could result from your date being off and resulting in the certificate being outside the validity period for the certificate, etc.

Https will connect regardless of the presence of a valid certificate, but it means you have no idea who you are talking to.  It could be an attacker trying to compromise your connection unless the certificate resolves as valid and for the actual site you are trying to talk to.

Update: In this case, the certificate is unable to be audited.  In other words, it does not have the necessary information to be able to go to the CA and check if the certificate has been manually revoked prior to its expiration.  This is generally not a problem unless the site's private key may have been compromised.  It is possible something is blocking your ability to see certificate revocations or it may simply not be configured for that site.  It isn't ideal, but it is the least concerning reason for a certificate to be unable to validate.


Why is the server returning 3 SYN + ACK packets during a SYN scan? When you do a SYN scan against a opened TCP port (not filtered by Firewall), the server normally returns 3 SYN + ACK packets.

So, why 3 of that?

The target server is a Linux machine if relevanted to this question, and the scanner in use is NMAP.

The normal TCP three-way handshake consists in a SYN from client to server, then a ACK+SYN from server to client, then an ACK from client to server. However, TCP has been designed to provide reliable data transport over a medium which is not reliable: stand-alone IP packets can get lost, damaged, duplicated, or transmitted out-of-order. That's why TCP is needed in the first place.

A server who has received a SYN responds with a ACK+SYN, and then expects an ACK as response. However, the server is well aware that packets can get lost, including its own ACK+SYN. So the server sends the ACK+SYN, then waits... and if it does not receive the final ACK from the client, the server assumes that its ACK+SYN might have been lost, so it emits it again. And again. Until the ACK from the client is received (which will not happen when the client is not a true client, but a port scanner which only sends SYN), or the server loses interest and gives up.

Each given operating system is responsible for deciding when, and how many times, a SYN or SYN+ACK or ACK will be repeated. On a Linux system, see the special files in /proc/sys/net/ipv4/ called tcp_syn_retries and tcp_synack_retries: they contain the number of times the kernel would emit SYN (respectively SYN+ACK) on a given connection attempt when being a client (respectively server). On a 3.2.0 kernel, I see that both files contain "5", meaning that a server subject to a port scan will emit five SYN+ACK packets. If you observe only three, then maybe your particular server was configured that way (this is as simple as echo 3 > tcp_synack_retries). Or maybe the server still uses the default value of 5, but your detection system was not patient enough: successive retransmissions use exponential delays, so the last retries can take a substantial number of seconds before being retransmitted.

Note that, to be able to retransmit SYN+ACK packets, the server must necessarily allocate a bit of RAM for that connection attempt, in order to remember this particular proto-client and retransmit the SYN+ACK. Abusing this allocation is the basis of the SYN flood attack. Lowering the maximum number of retransmission will make the server more robust against such attacks. In the extreme case, SYN cookies are a way for the server to not remember anything; as a consequence, when a server uses SYN cookies, it will respond with only a single SYN+ACK upon an incoming SYN. Since you observe that the particular server you are scanning sends the SYN+ACK several times, then you have demonstrated that this server does not employ SYN cookies, and is thus potentially vulnerable to SYN floods.


HTTPS packets filtering I would like to know whether a firewall can scan an HTTPS packet, to verify its source, destination, and data.

Or how to stop a user from sending the file over HTTPS if it contains some unwanted data.

There are two aspects to prevent data loss of the type you are concerned about.

Deep Packet Inspection

For HTTPS which is, of course, encrypted between the source and destination, you need a security service that has, as Mark said, a certificate trusted by your users browsers. It acts as a Man-in-The-Middle and so is able to continue to inspect all of the packets going through, even those that would normally be encrypted.

Any decent system will do this dynamically based on a risk score and will white-list destinations such as personal finance sites so that you can continue to offer users a degree of privacy while ensuring organisational and unknown  traffic is monitored.
Data Loss Prevention

DLP uses rules to identify information that you might consider sensitive. Nationl Insurance numbers, credit card numbers, drivers license ids, etc.

Using a risk scoring system, the DLP will watch for sensitive information leaving (and entering if required) the organisational boundaries and provide alerts when rules are exceeded.

Clearly DLP also requires the ability to intercept encrypted communications but you will probably implement DLP in more places. Certainly in the security boundary but also on organisational computers, especially laptops and desktops. Maybe mobiles too.

DLP is particularly critical in regulated industries such as health and finance.

One thing that I personally believe critical if you plan to implement things like this is to inform all users that their traffic is being monitored. You should make sure that information is baked into any Acceptable Use Policies and Information Governance policies. You should also include it in your Terms and Conditions of Use.

If you don't do that, you open yourself to accusations of intercepting private communications. Note that organisational communications generally get special exemptions from some privacy rules since there is an expectation that corporate communications contain corporate information.

UPDATE: Lest you think this is the realm of the paranoid as @Somone Somewhere seems to, let me assure you that it isn't.

While data can be exfiltrated in a number of ways that would bypass centralised security infrastructure, it would still catch the majority of risks:

Users deliberately sending sensitive data somewhere they shouldn't. This might be for nefarious reasons though more commonly it is to send it to a less protected, non-corporate system (e.g. a home PC) to do something they are not allowed to do at work. While this may seem convenient to them, they may well be breaking the law and they are in danger of leaking the sensitive information (think about patient information, contracts, etc)
Malware. There are plenty of types of malware that attempt to exfiltrate sensitive information. Some targetted at specific industries (health records are particularly valuable) and others at general information such as banking and other finance details. Malware authors are not stupid, most malware comms is encrypted. Patterns of traffic other than genuine HTTPS can often be detected and if HTTPS traffic is identified and cannot be decrypted, that too indicates malware.

Just because a security infrastructure is not 100% effective doesn't mean that it is ineffective.

At the end of the day, your organisation needs to weigh up the risks and costs and decide what level of security is needed. Risks will take into account the value of the data you hold, any legal constraints and how much of a target you are.

When considering the legal constraints, don't forget to take into account that corporate executives may be held personally responsible for sensitive data leaks.


Does Yandex browser have known records of snooping for user data & passwords? I've installed Yandex Browser (Based on Chromium) on Windows 10. I use LastPass for logins so I asked Yandex to not remember passwords.

While I was trying to login to another website, it gave me a pop up saying "You have already used this password for domain1 and hence it is not recommended to use it for domain2" something like that.

If I asked it to not remember password for domain1, then how did it know I was using the same password to login to domain2. This made me suspicious about Yandex like if it was logging my keystrokes or snooping around.

Please let me know if anyone of you have experience with Yandex.
Thanks in advance!

You can see in the documentation how the password feature works:

Yandex Browser Personal Data Protection - Passwords (New)

  After you enter your password on an important website, Yandex.Browser creates a fingerprint (hash) for it and saves it in its database. When you enter passwords on other websites, the browser compares their hashes with the ones in its database. If there is a match, the  icon will appear on the right side of the SmartBox to warn you. The browser will ask you to confirm that you want to use the same password on several websites before sending your password to the server.

Yandex Browser Personal Data Protection - Passwords (Classic)

The best you can do now, is to delete the whole activity in your Yandex Browser and verify each step of the settings, so you could verify that is configured to NOT remember any password that you enter.


What can a zombie computer feasibly install and run? I'm experimenting with a Proof of Work system that tries to force the use of a browser in order to solve the client puzzle. Basically, instead of just handing off the puzzle as hash with a well known algorithm, I'm handing off the puzzle as actual JavaScript code which must be executed to get the solution (and also calls into the browser environment to really try and make sure its a browser). I've been able to script something like PhantomJS to automate an attack, but that's acceptable. It still runs the puzzle very slowly. However, one of the things I was hoping to deter is the ability for an actual botnet to attack and automate solving the puzzle. While I think the effort for that would be large, and unlikely, I was just curious how feasible it would be for a zombie computer to actually install and run something as substantial as PhantomJS (a full headless webkit browser) in order to be able to automate an attack.

From my knowledge of botnets, they mostly rely on much smaller, and often predetermined sets of functionality - keylogging, screenshotting, http calls, running smaller scripts.

Edit - Just to clarify, I know that a compromised computer can install whatever they want, its a question of feasibility. For example, how many botnets download and use a ~7MB tool after the initial payload (like phantomjs)?

To be useful for puzzle-cracking, a zombie node must have network bandwidth (for the one-time download of the Javascript interpreter, and for each puzzle instance to obtain), RAM or disk space (for storing the Javascript interpreter), and spare CPU (to actually run the thing). Typical botnet nodes have all three:

A typical usage for botnets is to send spam; this means sending an awful lot of data. One must assume that typical botnet nodes have bandwidth. Home machines normally have more download bandwidth than upload, and yet spamming uses the upload, so zombie home machines can really download a lot.
Botnet nodes also have storage space by the gigabytes: when was the last time you saw a machine with a filled-up disk ? Actually, since filesystem performance tends to degrade when the disk is more than 80% full (because of fragmentation), there are incentives for keeping some spare room in disks.
Most machines out there are idle most of the time. In general, desktop systems use CPU only when the human user is in front of them (and only when that user does things which use a lot of CPU, like gaming, and unlike Web browsing); servers have spare CPU to deal with peak usage, but peak usage, by definition, occurs relatively rarely.

There are limits to what a botnet node would practically do, but they are much higher than mere 7 megabytes. 7 megabytes will be downloaded in 7 seconds or so; they can fit in RAM. 7 gigabytes might be more challenging for the botnet author; smuggling 7 gigabytes on the hard disk in a discreet way could be relatively uneasy. But mere megabytes ! Piece of cake.


Scrambled database name / unable to retrieve the number of databases with SQLMap I have the results for sqlmap:

./sqlmap.py -u "http://REDACTED/browse?destination_id=12"  --identify-waf --random-agent -v 3  --dbs

GET parameter 'destination_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 60 HTTP(s) requests:

---
Parameter: destination_id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: destination_id=12) AND 2321=2321 AND (9943=9943
    Vector: AND [INFERENCE]

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: destination_id=12) AND SLEEP(5) AND (4055=4055
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])

But when getting database name results, everything is scrambled:

[10:26:50] [ERROR] unable to retrieve the number of databases
[10:26:50] [INFO] falling back to current database
[10:26:50] [INFO] fetching current database
[10:26:50] [INFO] resumed: \x11
[10:26:50] [DEBUG] performed 0 queries in 0.00 seconds
available databases [1]:
[*]

At available databases shows only a Square with 0011 in it.

What are your thoughts?

I think your target has a request filter.
Try typing --tamper between.py.
You have to check what is filtered.
between.py and equaltolike.py tampers may help.


WCF - Is this a good security Architecture? I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users with the client application installed.

Due to the fact that the stored information is highly sensitive, I would obviously like to authenticate and authorize any service requests. So, there will be around 4 service endpoints dedicated to handling a variety of requests. In order to protect these services, I was thinking to authenticate any requests with a token-based system (which is effectively just a GUID). This would mean that unless the client packages their requests with this token they cannot access those services! Right? Now, in order to retrieve a valid token, the client must connect to the security token service, which begins with mutual SSL authentication (to prevent man-in-the-middle-attacks), then the user must provide their login details (encrypted of course), then if the details are valid they are provided with a token. The token is then logged, along with the users details. Now the client can send valid requests to the other services. When one of the other services receives a request, the token and user credentials are checked against the "current user store" and their role is retrieved. If the user's role allows that request, it is then processed.

Sorry if that is all a bit long winded! But basically what I am asking you security gurus is: does this sound like a decent architecture for this system? should I make any improvements? or should I scrap this architecture all together and go for something else? (if so, any guidance would be appreciated!)

I respect the fact that I am not a security wizard, however I am willing to learn! So please be nice ;)

If you know what you're doing, using WCF isn't difficult. If you know what you're doing, using WCF with an STS isn't terribly difficult. If you don't know what you're doing it's all terribly difficult. Who am I kidding, it's WCF, so it's all difficult. :)

Generally speaking your architecture falls into the federated trust category, as you're using the STS to provide authentication. I'm a little confused as to why you say the token is effectively just a GUID. Normally with WCF it's a SAML (wrapped in a WS-Trust container) token, which contains attributes/claims about the given identity. A lot of times the user's roles are contained in the token already. It's up to the STS to provide the roles, and your services just check to see if the incoming identity has the requisite roles (in a simple scenario, anyway).

From a security perspective it all gets a bit messy for a few reasons:

WCF is a PITA
WCF security relies heavily on certs, which introduce their own issues
STS are difficult to build securely so the recommendation is to use pre-build STS
Using pre-built STS rarely do what you want them to do out of the box

If you can work through these issues you can have a reasonably secure implementation of the services, however that's relative to what you're wanting to protect against. What are you wanting to protect against and what aren't you wanting/willing to protect against?

One of the weakest points of a federated system is the crypto. How do you protect the keys such that the STS can use them, but people can't steal them? You said you wanted to use client certs for mutual auth... how are the clients protecting those keys? How are you issuing those keys? You said client certs for SSL mutual auth... does that include certificate-based auth for the STS auth of the users, or are you going to use username/passwords? Are you going to encrypt the token between the STS->client->service, or will it be plaintext? Normally you'd encrypt the token as it contains sensitive information. How do you protect the encryption keys for the services?

A federated trust is a good architecture, but it really depends on the use case. It's usually when you're wanting to decouple the authentication/authorization of users from the services themselves, and centralize them into a single source. Since you've got 4 services, it sounds like it might be a good thing. However there is a huge added overhead with the STS (this now makes it 5 services), as well it's usually hosted in it's own site.

For more information take a look at the Thinktecture.IdentityServer project: http://thinktecture.github.io/Thinktecture.IdentityServer.v2/. It's an open source STS built by people that have worked closely with Microsoft's WCF and WIF team.


How to spoof a cell phone tower (cell site, base station) -- homemade IMSI-Catcher An answer to a recent question has given me an idea for a school project (security CS program).

  Also, an active attacker (with a fake base station) can potentially force a mobile phone to use another variant [of encryption]...

This sounds very cool, and I want to implement this on an at-home basis.

This article talks about a 2010 presentation of just such an experiment.  I've done some limited research, but I have two main questions:

What equipment would I need to buy and how much would it cost (this project is self-funded)?  The article said $1,500, including the laptop (which I already have), but did not give any specific information on the antenna.

What sort of APIs/libraries/etc., if any, exist for the communications protocols?  If none, I can probably try to implement the protocol myself, but this could take a lot of time.

Update:

Conclusion so far: While cell phones can operate in a HAM radio band in the United States, I'm concerned about potential legal implications of spoofing a cell phone tower.  Specifically, I think I would need to identify myself as another carrier in order to perform a MITM attack, which may be a crime.

Some helpful links:

OpenBTS Wiki
Desktop Testing (includes recommended hardware)
Safe Operation Guidelines
OpenBTS Page

Defcon has had a few presentations on this subject.  An active attacker can turn off encryption altogether, never mind just changing it.

Also there is an open source program available just for this.  I will edit this with the link when I find it.

Software: http://openbts.org/
Antennas https://www.ettus.com/product/category/Antennas
RF Daughterboards https://www.ettus.com/product/category/Daughterboards
Video: https://www.youtube.com/watch?v=wjYAAmHvt-g


How does exploit development work for penetration testers? When doing exploit development, the process always relies on memory address from the victim's machine.

As an exploit developer, you will have to setup an environment of attacker\victim machines and try on it.
The main leads for the exploit developer in his journey toward getting a shell from the vulnerable app are the memory address (DLLs and buffer locations mainly) which he gets from attaching the app to a debugger  (usually pointed to by CPU registers such as  EIP , ESP , etc).

This is good if the final goal is to make a proof of concept code to prove that this app is vulnerable.
However,as far as i know, those address are not permanent and can change from machine to machine.
If you're doing black box Penetration Test for a company, you wont be able to attach a debugger to their application in order to get the right addresses to jump to.
And the same applies for public exploits from exploit-db because most of the exploits there need some fixing regarding addresses and offsets.

So my question is: how does a penetration tester benefit from writing such exploits (or downloading one from exploit-db) as a penetration tester not as an exploit developer?

The change of addresses on every boot is called Address Space Layout Randomization (ASLR). Together with Data Execution Prevention (DEP), ASLR is one of the most effective security control against memory corruption exploits. Read the excellent answers at How Do DEP and ASLR Works. However, when buffer overflow exploits are created which targets anything above Windows XP (practically everything nowadays), then ASLR is bypassed using a few techniques. The most common one is to transfer the code execution to a non-ASLR enabled module that is loaded at fixed or predicted address. Majority of the IE exploits that target IE8 and IE9 uses one of the two modules (MSVCR71.dll and HXDS.dll) since both of these are non-ASLR and are loaded in the IE process (either by default or can be triggered easily).

Most of the flash exploits uses a technique where length of the vector array is overwritten and more data is read than intended. When the attacker is able to read arbitrary length data inside the exploited process memory, it can be used to find addresses of common DLLs from which ROP gadgets could be constructed. You can find further details in the excellent paper from Haifei Lei here. If you want to read some code that is able to bypass ASLR, take a look at the exploit code used by Metasploit here.

In short, ASLR together with DEP is an excellent mitigation. However, techniques are there to bypass it in certain cases for reliable exploitation.


Does x509 have an "issued at" timestamp? Can you tell when an x509 certificate was issued? The JWT Spec (RFC 7519) has an issued at field ("iat"). Does x509 have any analogous value? I see a Validity field, but nothing else time related.

X.509 has a Not Before and a Not After field which describes when the certificate is valid to use for the defined purpose. The Not Before usually matches about the time when the certificate was issued but it is not required to do so.


Legitimate use case of man-in-the-middle attack for DPI? I am working on a device that should sit between the end-user and the server, and that will do deep packet inspection. It is basically a parental control node. This device will be sold to the user, so they will have full knowledge of what it is and what it does. Getting this to work over HTTP is fairly straightforward, but for this to be of any real use, it clearly needs to work over HTTPS as well. I have a few questions on this scenario, and I would appreciate your insights:

Do you think this is a legitimate use case for a man-in-the-middle attack? I feel like it is, and that it's technically no longer an attack..
What do you think is the least-friction way of doing this? This should be as easy as possible for the end users to configure. I am thinking of configuring the box as a transparent proxy, and getting the user to accept a root CA in order to forward the traffic. I played around with mitmproxy, which somewhat does this. But the process is somewhat unpredictable. For instance, Firefox can directly accept root certificates in one-click, while Safari on OS X requires you to add the cert to your keychain by putting in your root password. Any thoughts here would be appreciated. Maybe installing through browser add-ons is easier?
How can this device recognize that the end-user has the proper root CA installed? Is there a test to see if the user is accepting our certificate, so that if they aren't we send them to a "installation directions" page, for instance?
I was told that cert pinning would invalidate this process, but I can't find too much info on that. Do you think this is a concern?
There seems to be a proposal in HTTP/2.0 regarding Explicit Trusted Proxies. This sounds like it would fit exactly my use case. However, this proposal also got some very bad rep. What do you think about this proposal? Do you think it will ultimately be beneficial for the end-user?

Thanks!

This is possible technically to achieve but there are some problems with it.  In response to your questions

Some would agree with you that this is a legitimate use of MITM. There are already popular products in the corporate world that implement this approache (e.g. BlueCoat)
The least friction way of doing this would be to get signing cert signed by a known Certificate Authority, and then create legitimate certs as needed.  Unfortunately unless you're the government that's not a likely option.  The standard way to approach this is as you say, get users to install your certificate authority into each device in use.  I don't think browser add-ons would work
I'm not aware of a way of doing this without installing additional software, which would in effect be the same level of effort as installing your cert, so not a lot of point really.
Yep Certificate pinning will cause problems with this and is becoming more common as time goes by.  The way this works is that the browser knows of a specific certificate or set of certificates that it trusts for a given hostname, and it won't base that trust on certificates being issued by a known CA.  I'm not aware of a way past that problem.
I've done a little reading on that proposal and from what I understand of it I'm not a fan.

Another problem for you to think about with the kind of product that you're looking at is, how do you handle invalid certificates when your device encounters them?  Say for the sake of argument your proxy makes a connection to a site and it has an invalid certificate.  Do you

a) issue a certificate to the user that's valid (e.g. signed by your device CA).  At this point what if that site is a phishing site and you've just stopped the user from identifying that the certificate was invalid which could have alerted them to the problem?

b) issue a deliberately invalid certificate from your CA, so that they can see the problem.  Most users (assuming that they're savvy enough to look at certs) will then just assume it's a problem with your device.

c) pass the connection straight through so that the user can make a correct determination that they could be connecting to a malicious site?  At this point that becomes a known way to bypass your device and you also lose the ability to protect the user from malicious content on that site.

or

d) Block access to any sites with certificate errors.  This is probably the best way to solve the problem but still leaves you with a customer perception issue "we installed this thing and it broke access to our site"


How can I test my guest network? I enabled my guest network and put my devices on it so my communications could be separate from the rest of my family on the main network. How can I test this to ensure the guest network really is secure and doesn't interact with any devices on the main network? So far I can tell that my devices are on a new subnet.

I am using a buffalo AC1900 router. I am not sure if they have a good or bad reputation in regards to security. I noticed that the router was secured with WPA-2 AES out of the box and it is secured as default even if you reset the firmware. WPS was enabled but it has a time out function and I could easily disable the WPS option. Wireless guest mode implementation is easily switched on and off and you can enable a second authentication that requires a login to a captive portal before use. One issue I did find is that the login to change settings only allows 8 characters. You can completely disable administration from wireless or wired LAN.

On your non-guest network, Take a computer and setup a shared folder.  Note the computer name and IP address.  Take another device and connect to the guest wifi.  See if you can access the non-guest-computer's share on the guest network.
Is the IP address on your guest machine the same subnet as your non-guest machine.  Can you ping the non-guest machine from the guest-machine?  You did say that "So far I can tell that my devices are on a new subnet." so the ip addresses should be a different IP Scheme.
With the same setup as #1, but on the computer on the guest network, download Wireshark and then start capturing data from your guest wifi.  While the capture is running, go to the non-guest-network computer and do some internet browsing for a minute.  Go back to the Guest computer, and stop the capture.  Remember the IP address from the non-guest computer, and start looking through the capture for that one IP address.  You can setup Filters to do that, such as "ip.addr==[Non.Guest.IP.Address.goes.here]".  Not familiar with that router, but in the Wireshark capture you shouldn't see any stream of "computer" connecting to "google" in your stream.  You might see an ARP request or something of that nature.  When looking through the stream, most things are shown as IP addresses.

Those three things should all give a positive result of:

Can't access the share
Can't ping the non-guest computer, and ip addresses are a different subnet (192.168.1.x for non-guest, and 192.168.55.x for guest as an example)
Can't see any network traffic from the non-guest machine while capturing from the guest machine.

Routers can handle the "guest" network differently than others, and not being familiar with that router, I can only speculate, but these would be the tests I would run if I were testing that out.


Why would malware deactivate itself? According to this Wikipedia article about the Sobig Worm, the worm

  deactivated itself on September 10, 2003

Why would a worm (or any malware for that matter) deactivate itself? Why not stay on a host computer to try to continue to do more damage?

We are developing customized malware for our customers to simulate APT (advanced persistent threats) within professional penetration tests. Disabling malware in our case has an important purpose: To prevent activities (e.g. infections) after the end of a project.

In case of malware in-the-wild the goal might be to prevent further access to other resources like web server. For example if the developer knows that the C&C servers won't be around at that future time anyway.

Highly professional malware with stealth capabilities might deactivate itself to prevent detection or to make a reverse engineering much harder. The attackers might want to get access and then steal a specific set of data or switch to another communication capability. The malware for the initial break-in shall stay unknown because the technique might be very valuable or the approach might reveal something about the source or targets.


How to Survive Iran's Internet Censorship in January 2018? The Iranian government has harshly cracked down the Internet. Aside from denied access to many websites and services, many VPN services are disrupted. Formerly, Cisco AnyConnect Compatible VPN subscription worked very well on Fedora, but now its connection, if any, is as slow as 4 kbps. How do they technically do this?  What is the best way to circumvent such harsh Internet filtering?

It seems that Tor is an answer, but it seems that Tor only allows connecting through its browser, though there are other use cases, for example, updating system software, connecting other software to filtered services, etc.

What should one do in this situation? By the title I mean "protect both one's privacy while having maximum speed in access to Internet resources".

ISPs can detect VPNs through a variety of different means, including DPI, detecting total bandwidth through a single connection, timing comparisons, etc.  It's also possible that they're using known endpoints for VPN providers to produce a blacklist.  (There are many sources for this on the internet.)

Tor provides a general Socks5 proxy, which can proxy any TCP connection -- HTTP and HTTPS traffic are the most common, but you can also perform OS updates, online chatting, etc.  Voice and video may be a problem as Tor is often fairly limited in bandwidth (far more users than exit nodes).  Thanks to Tor's pluggable transports, it's much harder for filtering to detect via DPI and other techniques, and there are nodes specifically designed to make it harder for oppressive regimes to filter the traffic.