I believe my Domain has been hijacked I am not receiving in sales in shopping cart My IP address is 181.224.153.95  Domain: www.ashaybythebay.com

FTP Hostname: m23.siteground.biz

I added private domain servers to my domain name ashaybythebay.com and I see the two IP server addresses listed in my DNS settings. Here they are on the robtex.com report.

ns1.ashaybythebay.com.  600 IN  A   181.224.153.233
ns2.ashaybythebay.com.  600 IN  A   181.224.153.234

The server IP address are listed in Panama.

Yet on my cpanel I see two other DNS server IP addresses and my server is supposed to be located in Chicago.  Here they are:

ns1.m23.siteground.biz (184.154.158.138)
ns2.m23.siteground.biz (181.224.153.102)

My shopping cart states that my server also is 184.154.158.138

Since discovering this I have denied both private DNS IP servers to keep the hackers out.

What do you think is happening?

We had something similar two years ago. Someone hijacked our DNS account at our domain hosting provider. They changed the email DNS for one domain, the one linked to our main Amazon account. We had two-factor authorization, but they convinced Amazon to disable this - probably they had the last digits of our credit card but we are not sure how this happened and Amazon didn't tell us about this. Then they had control over our Amazon account, and they could start and stop instances.

We had two parties involved: the DNS host and Amazon. The DNS host denied that they were hacked, but they helped us actively in blocking all DNS changes to our domains. For some reason Amazon could not throw out the logged in users, so it was a constant battle between us and them to undo their actions. After one day they were automatically logged out and could not login anymore.

For you it's about getting control back over DNS, and with that your DNS hosting provider should help you actively, and they should block any changes to your account for a while without phone contact or something.


Can ISPs replace a website's HTML/JavaScript/HTTP headers with something else? It seems to me that "yes, they can". As I saw it in some countries, entering adult content will simply give a warning message that the site is blocked. Some places even block Facebook similarly.
If yes, then technically, ISPs can steal a website's users data by altering legitimate HTML and JavaScript with bad HTML, JavaScript, HTTP headers, CORS headers to send data in cookie/localstorage to https://somewhereelse.example.com.
Note 1: This is just some imaginary situation
Note 2: HTTPS is used as a standard nowadays.

Your ISP is per definition a MITM (man-in-the-middle) and therefore can serve you any content it desires.
You mentioned HTTPS and this is of course a game changer. Yes, the ISP can server any arbitrary content when you access e.g. Facebook, but it does not have access to the private server certificate of Facebook and your browser will detect that it is not speaking to the correct server.
Now comes the critical part - the user will get a warning and has to decide what to do with it. If the user ignores the warning and tells the browser to load the fake website nevertheless, the browser will comply. A security aware user will realize that something strange is going on, leave the site and maybe even investigate further.
This means, your ISP can serve any content it likes, but as long as you are using state-of-the-art TLS encryption and validate server certificates, you have the ability to detect that some tampering took place.


Are MCUs (Like arduinos) effected by Meltdown? I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I understand the whole speculative execution attack, but I would like to know if this can effect things like  microcontrolers, which are used to drive many IOT devices.

In general, no, for several reasons.

First, Meltdown is an issue with how Intel chose to handle invalid memory accesses during speculative execution.  A couple of ARM designs are vulnerable to a variant of Meltdown, but other than that, it's Intel-only.

Second, Meltdown and Spectre both require that the CPU use a technique called "speculative execution".  This is a great performance boost, but it comes at the cost of a bigger, more expensive, and more power-hungry chip.  Microcontrollers are small, cheap, low-power chips -- exactly the opposite of what would use speculative execution.

Third, Meltdown and Spectre are about getting around memory protection.  The typical microcontroller only runs a single program, so applying memory protection is a waste of time and effort -- any memory a program could read using Meltdown or Spectre, the program could read just by looking at it.


Zip file with two password I used this command to password protect a zip file on Linux :

zip -P 9000 hash.zip hash.py

and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 to 100000, the problem is that program find two password on it, first is: 9000 and the second is: 79095 , and both password unzip the file, is the any security vulnerability in Linux zip command?

Both passwords may decrypt the file,  but only one password will yield the correct plaintext.  The zip encryption format is just checking to see if the padding is correct to verify that the correct key was used.   The password 79095 produced valid padding,  however the resulting message is garbage.


Does a deterministic credit card tokenization conform to pci-dss? I reviewed a couple of e-commerce applications that use the same payment processor. In both cases the merchants store credit card tokens generated by the payment processor, in order to offer a 'remember this credit card' feature.

During the review I noticed that the same token is generated for both merchants for the same test credit card number. So it seems that the token generation is deterministic across different merchants. For me that would be a red flag, as it means the tokens themselves have the same value as the credit card numbers, i.e. if they are stolen from one merchant database they can be reused with other merchants.

Does such a deterministic token generation scheme conform to the pci standard? I've read the Tokenization Guidelines but didn't find any phrasing to explicitly forbid or discourage it.

I definitely think it's a borderline violation of the Tokenization Guidelines. From the Tokenization Overview section in the document you linked:

  For a token to be considered non-sensitive, and thus not require
  any security or protection, the token must have no value to an attacker.

An attacker could use the token from one merchant with another, but there may be other validations in the processor's system that prevents reuse across merchants. i.e. a merchant-specific database that contains a whitelist of authorized tokens for that merchant.

Without understanding more about the whole system, I don't think it's an explicit violation of the PCI-DSS standards, but it definitely raises eyebrows.


How to prove that something happened before some time in a distributed way? To prove that something happened after some time in a distributed way, just refer to something publicly know just before. Is that right? (Though I wonder how to make the time granularity smaller.)

What about to prove that something happened before some time in a distributed way ? How to make it more accurate, for example, an hour, a minute, a second, a milli-second?

Edit: To prove that you survives after a particular time, you just need to take a photo with a sheet of newspaper. It proves that you have lived some day after that newspaper was printed, though it cannot be certain which day.

It is quite distributed since you do not have to go for a notary office, etc., which is much more centralized, and is used widely therefore by those who have to refute rumors without having to go public.

It obsessed me how to do it conversely, that is, to prove that something exists or happens before a particular time. Go for a notary office is a centralized method to timestamp, which is able to prove something happens between two moments.

But to do it in a distributed way, it is best to do it yourself or with strangers anonymously. For example, buying a random newspaper is something that you can do with strangers anonymously.

Okay, let me explain the problem I am trying to solve, and hope you all may figure out if I went to the wrong direction. It is, though, something that is not quite relevant to the question itself, which is just a small, single link inside the chain, and that I didn't intend to talk about before. Here it goes.

I want to allow people to post messages publicly to a certain domain (a distributed storage system, details irrelevant) without further verification and any centralized service provider. (limited, once for all verification in Beta stage of the project is okay). But spamming will occur.

IP examination is not acceptable, since IP should not be collected, and not possible distributedly. I haven't found distributed CAPTCHA solution.

Proof of work won't work, since attackers can gather more CPU, GPU, and RAM, and create much more users and messages than normal people do, as do in bitcoin. Mutual random authentication between users will not work either.

I may limit user generation by introducing to the protocol invitation and collective punishment to the invitor and invitees, and give users quota per year.

So I have to prove that message is posted this very year, and people right now do not use quota from last year, one hundred years ago, or next year.

This has been discussed in more detail here:

Is there any functional distributed timestamp server available? If not what about this homebrew solution?
https://en.wikipedia.org/wiki/Trusted_timestamping

In short, get a digitally-signed timestamp from several Time Stamping Authorities (RFC 3161) or post a hash of the data on a cryptocurrency's blockchain.

If you're talking about a physical event that needs to be timestamped, you have to turn it into data first. For example, you can take a video of the event and timestamp that video using the above methods as soon as possible.


What are the risks of using Tor browser? Are there any risks to using Tor browser? Does it make you more prone to being hacked, since a majority of hacker community is using Tor?

It is almost secure and it doesn't matter hackers are also using TOR for anonymity. Since the traffic is encrypted at every hop your communication will be secure till the exit node of TOR.

EXIT NODE

It is the node where your Traffic leaves the anonymous network and enters into the open Internet. From there your traffic can be monitored. If anyone wants to sniff the traffic then they can sniff at the exit node. If you are browsing service which is not using HTTPS then there will be a problem since the traffic is not encrypted after exiting the exit node of the TOR network.

This is the image I've taken from the Internet to explain.

You can see there is exit node/relay from there your traffic goes out of TOR. There onwards the traffic can be sniffed. If you are browsing Facebook then there is no harm because the traffic is encrypted. So when it will leave the TOR network then it will be encrypted as well.


Is it safe to use a passphrase to seed fernet key generation? I have a cluster deployment that depends on a Fernet Key to secure some data. The deployment script generates the key with:

FERNET_KEY=$(python -c "from cryptography.fernet import Fernet; k = Fernet.generate_key().decode(); print(k)")

But following deployments will run that again and lose the first key, so I need to make that key generation deterministic. On the other hand, the deployment script is mostly stateless so I should avoid trying to read the key if it already exists.

I was thinking of using a passphrase parameter as seed to make the the Fernet key reproducible across deployments, but worried about the security implications. Is it safe to do that? Is there even a safe way to generate that key in a reproducible manner?

No, it's not safe at all. A passphrase would produce a deterministic key, but that would make this key vulnerable to brute-force and dictionary attacks. Besides, Fernet.generate_key() uses a CSPRNG (os.urandom()) which has an OS-specific randomness source and it does not accept a seed.

It is possible to create deterministic but strong keys, using a password-based KDF. Python's built-in hashlib library offers two such functions: pbkdf2_hmac() and scrypt(). Both KDFs introduce a work factor (a good amount of CPU resources must be spent in order to produce a key) which makes brute-force/dictionary attacks practically impossible. I recommend scrypt because it costs CPU, memory and parallelisation resources, while PBKDF2 only consumes CPU resources.

Creating a Fernet compatible key with scrypt:

from hashlib import scrypt
from os import urandom
from base64 import urlsafe_b64encode

salt = urandom(16)
key = scrypt(b'password', salt=salt, n=16384, r=8, p=1, dklen=32)
key_encoded = urlsafe_b64encode(key)

The salt should be long and random; although it's not a secret, it must be unique for each password.
The n, r, and p parameters determine the work factor (n=CPU/memory cost, r=block-size, p=parallelization). Those values can be increased depending on the OS - the key derivation process should take about 100 ms. Only the password is a secret value, the salt and n, r, p values can be stored or transmitted with the key.


Two generals' agreement I am trying to figure an agreement protocol on an unreliable channel. Basically two parties (A and B) have to agree to do something, so it's the two generals' problem.

Since there is no bullet-proof solution, I am trying to do this.

A continuously sends a message with sequence 1
When B receives seq 1 it continuously replies with sequence 2
At this point A receives seq 2 so it starts sending seq 3
...

My question. When can the two parties conclude that they can take the action ? Obviously I can't set a condition: "do it after receiving 10 messages" since the last sender won't have any certainty that message 10 arrived - back to square one.

How about another idea:

Keep communicating like this for a predefined amount of time. At the end of that period both parties have an idea about the reliability of the channel. Would that be acceptable ?

I initially posted this in StackOverflow but someone suggested security might be a better place.

Parties can never fully agree in a situation where a message may or may not be received by either party because there will always be a difference in state between the two parties.

This is also the "girlfriend's cellphone stopped working" conundrum. The best solution is to have an agreed-upon protocol that is followed so that you know the other party is probably doing one of a limited set of reasonable tasks which end in failsafe protocol. As a failsafe, one must make sure that updated failsafes don't create conditions where the previous failsafe doesn't result in a solution.

Also, you can't find an ideal solution because there is an impossibility proof saying that there is no ideal solution. See the bottom part of Two Generals' Problem Wikipedia Entry that you cited and its references. The rabbit hole goes on to include Byzantine fault tolerance and its related articles.


How to prevent XSS from url I found an XSS vulnerability which is exploited by appending attack in the URL parameters.

For eg. the original URL site.com/?s=login&m=forgotten
And     the attack URL   site.com/?s=login&m=forgotten" onload=alert(966) bad="

Now I would like to prevent this attack. Can anybody help me?

Sanitize your input, by escaping HTML special characters.  In PHP this is done with htmlspecialcharacters.  Make sure you do not supply a flag that prevents htmlspecialcharacters from escaping the type of quote you use.

Your problem is your URL is http://example.com/?s=login&m=forgotten" onload=alert(966) bad=", which your PHP code which is probably something like this:

<?php
$var = $_GET['m'];
echo 'something';

but on straight simple substitution with the bad input becomes:

something';

The problem arises from the unescaped ".  The sanitizing PHP function htmlspecialcharacters will change the " to a &quot; so with:

<?php
$var = htmlspecialcharacters($_GET['m']);
echo 'something';

the rendered HTML will be:

something';

which your browser will interpret as one giant link to forgotten&quot; onload=alert(966) bad=&quot;, instead of an html tag containing the onload attribute.

Personally, I'd move away from PHP and to a web framework that starts with security in mind; e.g., automatically HTML escapes all input from database and query parameters in templates (unless specifically marked otherwise), does CSRF checks by default, use query parameters, etc.


Does Fedora 15 still use suid bits? I heard that Fedora 15 will not use suid bits.  Is that true?

Is the suid bit a security design bug?

Correct, see this feature posted by Dan Walsh, the SELinux maintainer for Fedora/Redhat.

Summary: Fedora 15 will not ship with binaries with the setuid flag set on them, preferring instead to set the capabilities these binaries need via POSIX Filesystem Capabilities. setuid etc can still be set on binaries. Anything that absolutely must have setuid can still have it. At this time I can't confirm (my rawhide is dead) what happens with sudo/su - it is possible for an application to use capabilities to get to root via CAP_SETUID but I don't know if they will use this technique or simply have +s set.

"suid bit = security design bug?". Well, I guess that's a matter of opinion; basically it's about giving a program that a low-privilege user uses the abilitity to run, temporarily, a privileged operation. Unfortunately, any vulnerability in that program may allow you to exploit it in order to gain higher privileges i.e. root access. Technically, it isn't a bug or a security threat; software with exploitable bugs is the issue. But writing bug free software is much more difficult than it sounds.

In terms of what posix file system capabilities are, here's a FAQ. Quoting the pertinent parts:

  Then there is something quite
  different called "POSIX capabilities"
  which is what Linux uses.  These
  capabilities are a partitioning of the
  all powerful root privilege into a set
  of distinct privileges (but look at
  securelevel emulation to find out that
  this isn't necessary the whole truth).
  Users familiar with VMS or "Trusted"
  versions of other UNIX variants will
  know this under the name "privileges".
  The name "capabilities" comes from the
  now defunct POSIX draft 1003.1e which
  used this name.

And:

  When a process tries to do a
  privileged operation, the operating
  system will check the appropriate bit
  in the effective set of the process
  (instead of checking whether the
  effective uid of the process is 0 as is
  normally done).  For example, when a
  process tries to set the clock, the
  Linux kernel will check that the
  process has the CAP_SYS_TIME bit
  (which is currently bit 25) set in its
  effective set.

And:

  6) How can I use capabilities to make
  sure Mr. Evil Luser (eluser) can't
  exploit my "suid" programs?

  This is the general outline of how
  this works given filesystem capability
  support exists.  First, you have a PAM
  module that sets the inheritable
  capabilities of the login-shell of
  eluser.  Then for all "suid" programs
  on the system, you decide what
  capabilities they need and set the
  allowed set of the executable to that set of capabilities.  The
  capability rules

  new permitted = forced | (allowed &
  inheritable)

  means that you should be careful about
  setting forced capabilities on
  executables.  In a few cases, this can
  be useful though.  For example the
  login program needs to set the
  inheritable set of the new user and
  therefore needs an almost full
  permitted set.  So if you want eluser
  to be able to run login and log in as
  a different user, you will have to set
  some forced bits on that executable.

In other words, you've got a partitioning effect for root privileges, so a setuid binary has less chance of being exploited for privilege escalation. This is good news, especially where users of Fedora turn SELinux off.

However, in a SELinux system, setuid/setguid bits are largely redundant, since selinux will apply the policy regardless of unix permissions (capabilities or otherwise). I'm going to quote a comment in the kernel source for this one:

* Since setuid only affects the current process, and since the SELinux
* controls are not based on the Linux identity attributes, SELinuxdoes not
* need to control this operation.  However, SELinux does control the use of
* the CAP_SETUID and CAP_SETGID capabilities using the capable hook.

In short, there is no need for SELinux given a properly written policy to control/restrict capability influenced behaviour, but it is used.

I'll rephrase that for clarity. In a system with a properly written SELinux policy, restricting the setting of capabilities is a non-issue since SELinux will block the activity granted by the capability if it is not also allowed in the policy. This applies to setuid/gid bits too - you might well be executing as another user, but the policy ought to stop the program doing anything outside of the defined context anyway.

An example users might be able to better appreciate/reconstruct; take a fedora box and write a basic file upload script that puts data in /var/www/html/uploads. Taking a look at that folder you can run:

$ ls -alZ
drwxrwxrwx. root   root   system_u:object_r:httpd_sys_content_t:s0 uploads

I'm assuming here you've run chmod 777 on said folder. So now try your upload via Apache. You should see an AVC message; if you're running the GUI you'll find it via setroubleshoot. Basically, until you set the context of that folder to httpd_sys_rw_content_t SELinux will deny httpd write access, regardless of the unix permissiosn.

Want an interactive demo? Log in to this guy's machine as root.

However, there exists a concept of permissions stacking too. See this (specifically:

  Add secondary calls in selinux/hooks.c
  to task_setioprio and
    task_setscheduler so that selinux and
  capabilities with file    cap support
  can be stacked).

These discussed features are implemented in the above quoted source code. In other words, setting that directory to chmod 755 yet having httpd_sys_rw_content_t as the context will still deny write. This is because the basic unix level permissions have been denied first and so SELinux context checking is never needed.


Admin change user details / account information in admin interface I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now.
And I'm starting to question what kind of data the admin should be able edit/view on the other registered users.
Should the admin users be able to:

Change the users password?
Send password-reset email to the user?
Change account information on the user (firstname, lastname, email)?

Just to mention this: the users have the possibility to click on forgot password on the login screen to request the password request themselves. They also have the ability to change the account information themselves. Should I still implement some of this functionality on the admin side? Upsides / downsides to this?

It depends on the business context of the application. If these concerns are valid for the business context, perhaps you could split the admin role into two separate roles? Or implement a two man rule?


GPG with Yubikey smart card - smart card doesn't need to be plugged in! I have created an offline MASTER key along with sub keys.  The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'.  The gpg --card-status command correctly identifies the information showing the masterkey id as well as the sub keys.

I want to use this via Windows.  So I downloaded Gpg4win.  It installed a GUI Kleopatra.

In Kleopatra I IMPORTED my PUBLIC key.  However, I am unable to encrypt/sign anything as it states that I am required to import a private key.  I'm a bit confused, isn't that the point of the Yubikey (NOT having the private key on a hard drive that is online)?  Isn't the Yubikey THE PRIVATE KEY, again so that I don't have to have the private key on the hard drive?

I redid this all testing with another Yubikey and imported the private key (that was suppose to be offline) and it works, but it also decrypts WITHOUT REQUIRING THE YUBIKEY.

Ideally what I want to have happen is that it is a REQUIREMENT to have the Yubikey inserted into the machine to be able to encrypt or decrypt a file or clipboard.

I further note that this test one when I imported the private key it asks me for the passphrase rather than inserting the Yubikey.  Once I imported the private key the Yubikey is all but worthless.

Any suggestions specific to gpg for Windows / Kleopatra GUI?

I had this same issue a few days ago. You'll need to export a stub of your private key to your PC. Basically, the stub tells your box that the private key is on a card and it should look for it there, then Kleopatra/GPG4Win will be able to utilize the private key properly.

EDIT:

This answer says it better than I did.

EDIT(2): Seems that link wasn't all I needed to accomplish this, in my setup it won't get stubs from the Yubikey so I had to get them from a machine that already had stubs for those subkeys (the one I created them on). I'll detail my steps here.

Generate PGP master key (using Guybrush Threepwood as the real name)

gpg2 --full-gen-key

Generate subkeys to sign, encrypt, and authenticate.

gpg2 --expert --edit-key Guybrush
addkey (follow prompts, repeat for all subkeys)

Move sub keys to card (still inside --edit-key menu) (Note: this step actually removes the subkeys from your system)

key1
keytocard
key 1
key 2
keytocard
key 2
key 3
keytocard
save

Now that the subkeys are only on your Yubikey, export private key stubs for them.

gpg2 -a -o subkeys.sec.asc --export-secret-subkeys Guybrush

Securely move subkeys.sec.asc from your generating machine to your client machine (scp/sneakernet etc).
From your client machine

gpg --import subkeys.sec.asc

Now Kleopatra ought to show an entry for Guybrush Threepwood as a private key you control, and shouldn't allow you to sign/decrypt as him unless your Yubikey is inserted and PIN entered.

You might also find this Github README useful.

Disclaimer: I'm no expert on this, so if any comments arrive disputing my advice you ought to listen to them.


What are the real risks of enabling unsecure DNS updates on Active Directory intranet domain? Based on my current research, enabling the unsecure DNS updates is a requirement for enabling DHCP Linux clients from registering their names with a FQDN.

While this works fine for Windows machines joined into the domain, the same doesn't work for Linux clients without enabling these unsecure updates.

As far as I know a machine would not be able to takeover another reserved name which would be the only real concern that I now.

Obviously it would be the DDOS but considering that we are talking about intranet here, I doubt this could be a real risk.

Do you have it enable on your domain or not?

Did you ever had to disable it due to having some problems with it?

When you use secure dynamic updates only the domain members can update their entries. This is achieved by using kerberos to authentificate the client towards the DNS-Server. This authentification funcionality does not seem to be implemented in Linux DNS-Clients and this is why you need to enable unsecure dynamic updates.

Unsecure dynamic updates allow one to update its own DNS record without authentification. This is clearly a threat because DNS is a UDP based protocol and the source address can easily be spoofed on a LAN.

On the other hand this is a very bad documented functionality and there are no tools publicly available that could be used to migrate this attack.

I did never migrate this attack but there are some risks I can think of.

Duplicate Names in DNS Server - Will either result in DoS or prevent a correct functionality of resolving the hostname
WPAD redirection. If you name your host wpad and setup a webserver that provides a proxy configuration you can pass a proxy configuration to internet explorer and chrome users. This is part of the WPAD protocol. The worst thing is that you can force the internet explorer to expose the authentificated users password hash by asking for NTLM authentification. I know its unbelivable but this can also be achieved by NBNS and LLMNR Poisoning using the tool Responder.

// This really got my interest when I got time Im going to write a POC tool that uses this vulnerability.


Are "roll your own" crypto implementations really a concern for offline storage? This is a fictional situation and I don't intend to use a custom crypto implementation in anything serious.

I understand why badly written crypto code can be vulnerable to a lot of attacks. So far the examples I've read about all require the attacker to try different inputs and use data such as the time it takes to encrypt to break the key.

The output from the cipher will be the same on good and bad implémentations of said cipher if it's implemented correctly. Assuming offline encryption and cold storage where the attacker will only get a copy of the encrypted data later, are these attacks really a concern ?

Yes. Less of a concern, sure, but what you are describing is a cipher-text-only attack. Absolutely and without a doubt still possible.

I want to split your question into two cases:

1) You write your own implementation of a standardized cipher.

Sure, in this case I agree with you: if you have made an implementation of an algorithm that's faithful to the spec, then your ciphertext by itself will be no easier to break than the ciphertext of any other compliant implementation.

I'd argue you're not really "rolling your own".

Being resistant to side-channel attacks is really more of "hardening" than "rolling your own"; every implementation anywhere could use more hardening. Always.

2) You invent your own cipher or algorithm

Here's where bad things happen. Generally, the attack is frequency analysis - for example if I know that your texts are written in English, then I can start analyzing your ciphertexts looking for patterns that match the distribution of letters in English. If your texts are in XML format, then I can look for the general structure of nested XML blocks, etc.

Never underestimate the cleverness of professional cryptanalysts. Also, never forget Schneier's Law:

  Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.

Just because you can't break it, doesn't mean nobody can.


Restricting a new WiFi device to WPA2 only I am currently in a discussion with some colleagues about the development of a solution that includes WiFi. They say that it is not state of the art if we implement all of the possible WiFi encryption methods, including Open and WEP. So, they want to restrict the device to WPA2 only.

It doesn't seem logical to me because I have never seen this approach in any solution before (for example: phones)

Is it correct to develop a Wifi device that has only WPA2 in it to prevent WiFi vulnerabilities?

Open and WEP are enabled on personal consumer devices because the maker has no control over how the device will be used or what networks it might connect to.

Device manufacturers who can and do control how the device is used will certainly make a risk assessment and a benefits assessment to restrict the device to only the functions that are required and restrict the functions that it simply does not need.

So, the question is not about "state of the art", the question is only about how it will be used and the benefits/risks assessment about which functions it needs to have for the device to accomplish its goal.


Is automatic login with full disk encryption a risk? I use full disk encryption on Linux and wonder whether there is any security risk ob having automatic login on the Linux itself. In case somebody breaks the encryption of the drive, they can read all the data directly, they would not have to log in to my Linux user account on the machine.

So is there any reason I should not use automatic login (into KDE) on a machine with FDE?

No risk at all. A login prompt is only for preventing physical access to the computer. This protection role has been replaced by the FDE and the accompanying PBA (which is much more secure), so any attacker that would break or somehow bypass the FDE could bypass your OS login too.

However, running as a limited user (with autologin on) and having a password-protected administrative account (with autologin off) can be useful, since the account then protects against online-based attacks (virus infections, malicious scripts etc) while the FDE protects against physical (offline-based) attacks.

But remember that anything that your currently logged on account has access to (regardless of password protection), can be accessed by a virus or malicious tool too, so a good idea here could be to also put sensitive data in separate encrypted containers with different passwords. So if you get a infection or a malicious script, then they only get access to whatever you are working with at the moment.

This would mean those containers would be encrypted 2 times on the disk platter, first by FDE and second by the container encryption.


Using an android non-rooted as a wifi adapter I want to use an android phone as a wifi adapter, and I was wondering if it added security to my connection. The phone has a complicated long password, it also have an app store firewall (noroot firewall).

I am not sure if it changes something, but I wanted to find out.

I assume your set up is your phone is connected to the internet somehow (4G/3G/wifi) and then you are using your phone as a wifi hotspot (aka wifi tethering), so other devices can connect to your phone and use your phone's internet connection.

This doesn't increase the network security in any way.  If the network connection your phone is using is compromised (e.g., unencrypted wifi is visible to anyone in your wifi radio range, or encrypted wifi or 3G/4G connection that people nearby can't eavesdrop, though the ISP can eavesdrop) then they can still intercept and/or modify all your traffic from devices tethered to your phone (though they won't be able to decrypt or subtly modify encrypted traffic like via HTTPS).  It doesn't matter if the connection between your phone and the device is strong (e.g., WPA2), the encrypted wifi traffic between your device and your phone gets decrypted at your phone and then is sent over the insecure network (as if it came from your phone instead of a device tethered to your phone).

It potentially does decrease the security, if your phone is connected to a WiFi network with WPA2 and a strong passphrase, but your wifi hotspot uses no encryption or a very weak encryption (e.g., WEP) and a weak passphrase.  This allows an attacker to eavesdrop the connection between your device and your phone, where they wouldn't have been able to eavesdrop the connection between your device and the wifi network with WPA2.

If you are security conscious, you potentially could increase the local network security by routing all your internet traffic on your phone through a VPN.  This would allow you to connect to a weak local network (e.g., wifi with no password in a public place) and encrypt all your traffic between you and your VPN server.  Note your unencrypted traffic (e.g., not HTTPS) will still be visible to an eavesdropper at your VPN server and beyond (that is between the VPN server and the server you are talking to on the internet).  (Granted you could also just make every device connect to your VPN directly as well).

The point of the firewall is to protect your phone from incoming network attacks and/or limit the network ability of malware you may have inadvertently installed.  It doesn't affect the security of your connection.


What does the pgp public key length depend on? What does the pgp public key length depend on? Does a long private key result in a long public key? The longer public key the better; or is it even the private key the crucial factor?

The "length" is a formal characterization of one of the mathematical values that constitute the key pair. Thus, the public and the private key don't have independent lengths per se; the private/public key pair has a length, which, by extension, is also said to be the length of the public key and of the private key.

The length is not the actual bit length of the encoding of either the public or private key, although there are correlations.

For instance, a RSA key pair consists in the following elements:

A prime integer p
Another private integer q
The "modulus" n which is equal to the product of p and q
The "public exponent" e (a usually small integer, often 65537 by Tradition)
The "private exponent" d (a bigger integer, computed such that e*d = 1 modulo p-1 and also modulo q-1)
The value dp = d mod p-1
The value dq = d mod q-1
The value q-1 which is the inverse of q modulo p

The RSA key length is the size of the modulus n: when we say that the key has length "2048 bits", we really mean that 22047 < n < 22048.

The RSA public key consists in n and e. When encoded, it is thus somewhat bigger (in bits) than n, since it must have room for e as well.

The RSA private key consists in p, q, n, e, d, dp, dq and q-1. Thus, it contains the same n as the public key, and therefore has intrinsically the same "length". (Technically, with only n and d, you can do the same operations, but the other values allow for about four times faster processing, and better resistance to side-channel leakage, which is why the standard RSA private keys contain all eight integer values.)

The key strength is somewhat impacted by the length. When n is too small, it is technologically feasible to recover p and q from n (this is known as integer factorization), at which point all the private key elements can be recomputed. Thus, a larger key (meaning, a longer modulus n) makes for better security, up to some point. Indeed, when the key is so large that integer factorization is completely out of question, now and for the foreseeable future, then the key won't be broken, and increasing its length any further does not practically change the security (there is nothing less breakable than unbreakable). On the other hand, larger keys imply higher costs (storage, network bandwidth, CPU) so you don't want to overdo it. 2048-bit RSA keys are fine for now and the next 30 years as well; beyond that, future is not really "foreseeable".

Key length is not the only factor for security; it must be also properly generated and used. Side-channel attacks are, in practice, a much more plausible attack path than upfront integer factorization.

For other algorithms such as ElGamal or ECDSA, the mathematical objects are of a different nature, but the same concepts apply:

The "length" is that of the key pair and relates to one of the mathematical elements that both public and private key share.
Longer keys mean higher security (up to the point of unbreakability), and higher usage costs.


Is there a way to prove authorship in a shared repository? Say, we have a number of people working on some kind of collaborative effort (such as a research paper or a software project) that is committed into a shared repository. However, a certain subset of these people are also conspiring against the rest of the people involved so as to deny them authorship. The motivations could be, for example, taking credit for other people's work, denying others the recognition or money they deserved as contributors, and so on.

The threat model here involves institutions without a fixed control structure and without an effective higher authority located in-house which could resolve such a dispute, as is often the case for hobby projects worked upon by friends, and in certain situations, research papers. (Just to be clear, we do have a judiciary where legal disputes can be brought.)

Timestamps and authorship information in the repository itself does not provide any valid proof, since the conspirators can just as easily recreate another version of the repository which would show that the commits have been made just by them.

Is there a protocol, which, if followed by every person committing to the repository, would allow the victims to prove their authorship should a dispute arise?

You need a trusted 3rd-party to witness and vouch for every commit. For example, if you use an online repository such as GitHub, then there is an online record of each commit. If you are not using a trusted 3rd-party service, then you need to use a notary or similar service. This could be a person who witnesses each commit, or an online notary that performs the work electronically. You could simply mail or email commits to a trusted person (perhaps an attorney).

All of these solutions rely on the trustworthiness of the 3rd-party.

Note that all of these solutions only prove that the work existed at a specific date. They cannot prove whose brain the work originated in. For that you'll need a mind reader.


Comparison of bcrypt and scrypt Is there any comparison of bcrypt versus scrypt? I am particularly interested in how bcrypt(10) bcrypt(20) or even bcrypt(30) scales in comparison to scrypt(1)?

Comparison is complex because scrypt and bcrypt don't play on the same parameters.

For bcrypt, the computation involves doing a lot of operations over a 4 kB array of RAM. The array is accessed in a pseudorandom way, so the only way to make this run at a decent speed is to have an actual block of RAM of at least that size. This is true for normal CPU, that have (typically) about 32 or 64 kB of very fast RAM (called "level 1 cache"). This is not true of GPU, where there is no per-core fast RAM (there is RAM in a GPU, but it is shared). Good FPGA has embedded fast RAM blocks of a few kilobytes; thus, a sophisticated attacker using FPGA will get an edge over the defender (because the defender uses a PC; that's the central assumption).

With scrypt, the operations are somewhat different, and, in particular, there is a much bigger array of RAM (size if configurable but a typical size would use several megabytes). For a CPU, a bigger RAM needs exercising level 2 cache or even main RAM, which is slower than level 1 cache. However, a PC suffers much less than a FPGA when going to big RAM arrays. So the theory is that the best architecture to attack scrypt is, indeed, a PC, just like the one that the defender use. This brings attacker and defender back to strict equality of means, which is the best that we can hope for.

What matters is not the actual speed of either algorithm, but the relative efficiency of different architectures when implementing the algorithm. A password hashing function is "optimal" if the best architecture to crack passwords (the hardware which will allow the highest number of tried passwords per second, for a given budget) is what the defender has to use, i.e., basically, a PC. Therefore, comparing bcrypt with scrypt means trying to measure how well either of them fulfils that ideal characteristic. For instance, with bcrypt, we know that 10000$ worth of FPGA allow for more cracking performance than 10000$ of PC.

We can put figures on these, but these will be extremely sensitive to a lot of architectural and economic parameters. Every year, availability of new hardware, and evolution of hardware prices, considerably alter any figure you could have gathered. Moreover, the RAM size and time budget of scrypt also modify the picture. The original scrypt article uses assumptions which are not necessarily realistic (e.g. that a normal user accepts a 5-second delay for login, and that a busy server has no more than a dozen login attempts per minute); moreover, the estimates were done for 2009 hardware -- what kind of silex did they use at that time ?

Summary: I don't have any reference to any recent comparison, but for the reasons explain above, I can claim that, with high probability, any such comparison that you may find will probably be quite meaningless and inapplicable to your own situation.


mandatory access control for database security For mandatory access control, the following rules, due to Bell and La Padula, are imposed:

User i can retrieve object j only if the clearance level of i is greater than or equal to the classification level of j.
User i can update object j only if the clearance level of i is equal to the classification level of j.

For the second rule, I can understand for the insert case. Such rule is necessary in order to prevent a user with secret classification from copying secret data to a file of lower classification. But why for delete and modify?
Why should not a user from higher class  delete and modify data of the lower class?

Quoting from the SSCP CBK Book, to substantiate your concern, the issue with the Bell-LaPadula architecture is laid out:

  However, it [Bell-La Padula] does not take into consideration the possibility that a subject may add, append or transmit sensitive information to an area of lower sensitivity.

It goes on to say:

  Bell-LaPadula adds another property to counteract this called the star '*' property. The "*" property blocks the channel between different sensitivities such that when a subject has accessed an object for a read operation, then objects at a lower sensitivity level cannot be accessed for create and modify operations ("no write down").

The answer to your question in the simplest sense is the "no write down" rule includes insert, modify and delete because they are all write operations.

Further to that modifying existing records is not much different than inserting data when concerned about data leakages from high clearance objects to lower ones.


How much space is needed? How much memory is needed if I want to generate a dictionary of all possible combination of length 6 with a-z and 0-9 characters? Is it a good idea to go for cracking password if I know password includes no other character then these and length is 6.
I want to know roughly how much space will be need to write these all possible combinations on disk. I am using ubuntu 12.04 platform. And then I want to use it for brute-force approach to crack the password.

That's (26+10)^6  combinations, at 6*16 bits per combination (I'm assuming 16 bit wide ascii because tchar)

((37^6)*(6*16)) bits = ((37^6)*(6*16))/(8*1024^3) Gigabytes = 24 gigs.

You can bring it down to 12 gigs if you use 8 bit wide char instead of 16 bit wide tchar and space is a premium for you.

EDIT: Wait, MEMORY needed? No idea, what software are you using to generate the list? It will take up this much space on your HDD when you save it though.

Also, it actually takes up 1/6th or 2/6ths more space than I originally wrote depending on whether you use 1 or 2 characters to indicate endline (1 on Linux, 2 on Windows, iirc 1 on Mac)


How to manage passwords in a multi-tenant surrounding? I am building a multi-tenant application in a shared database model. I would like to encrypt sensitive data so that only a particular tenant could have access to his data. What is the best mode to keep/provision passwords and where should I keep them in a multi-tenant environment?

Authenticating an user in a multi-tenant application is not fundamentally different from authenticating in a single-tenant one. Before you know who that user is and which permissions or capabilities or roles he has, you don't know which subset of data should be available to him. Once authenticated, you can limit the data exposed to him, using whatever controls your application supports (e.g. filtering, permissions, encryption).

A multi-tenant system has the same needs, except that now the user belongs to an organization, and all the data in you DB is partitioned around that organization. You might want to have stronger protections inter-tenants than intra-tenant, but it's still a matter of discovering who the user is and what data he can access.

The article you linked suggests one approach, using encryption as part of its defence-in-depth:

  When an end user logs on, the application uses impersonation to access the database using the tenant's security context, which grants the application process access to the tenant's private key. The application (still impersonating the tenant, of course) can then use the tenant's private key to decrypt the tenant's symmetric key and use it to read and write data.

But notice that this assumes the user is already logged in (and thus is authenticated with the system); before that happens, there's no way the system can know which tenant he belongs to. Unless of course all users from the same tenant had some sort of shared credentials used first to authenticate the tenant, then use their individual credentials to authenticate themselves, but this opens another can of worms.

So my suggestion would be having a single database table for all users, where an username (or pair tenantname-username) and the associated credentials (password hash, public key, OTP key, etc) authenticates the user and then uses the information "who the user is" and "which tenant he belongs to" to unlock access to the rest of the data. And make sure nobody but the service provider has access to that table's contents.


Is XSS possible with jQuery(location.hash)? Is it possible to exploit XSS in the following code?

jQuery(window.location.hash)

It seems to me that window.location.hash always starts with a hash #, and modern jQuery always interpretes this as an ID selector. Is this correct?

Patches 9521 and 11290 several years ago attempt to mitigate this issue, although does not claim to completely remove the possibility for XSS. I've been running in jQuery 2.x some of the exploits they claim still exist, but they don't seem to be working, so I can't definitely confirm and deny if the code you provided is enough to exploit.

For what it's worth, it's also possible for this exploit to happen if you do something with the jQuery object. Let's say you allowed customers to submit HTML, and a customer submitted the following:

alert('xss');

And for some crazy reason you had the following code on the page that displays this HTML:

eval(jQuery(window.location.hash).text());

A URL hash of #xss would cause an alert to trigger.

So I can confirm this is possible, although it'd be very difficult to exploit this particular way without writing the code specifically to be vulnerable.

I'd recommend doing a validation check on the value of window.location.hash or stripping out special characters before passing it in to jQuery(), and as always be thoughtful of what you do with the jQuery object.


Is it possible to view the cipher suites offered on my behalf by a MITM proxy? I'm trying to discover what cipher suites are being offered by my corporate proxy.  It's set up as a man in the middle so my "secure" connections are to it, and it attempts to create a secure connection to my target.
Specifically, I'm looking to view the list of ciphers presented by the proxy in the ClientHello message of the secure connection negotiation.
I don't have the ability to run a network sniffer on outbound traffic from the proxy.
I appreciate that this is information that might be difficult to obtain since it is sent prior to the establishment of a connection, but thought that there might be a website out there for just such a need that I can't seem to find via search engine. Every other facet of the negotiation seems accessible.
The fallback plan is to expose a server running Apache and run a network sniffer on it, hit said box from the corporate network and sort through the results. There are issues that make this less than desirable.

You don't need to do network sniffing, you just need to run a server that displays its connection parameters in detail. Contact that server from your client.
Some existing servers:

Qualys is best known for their server scanning but they also have a page that reports client information.
How's My SSL reports client information.


Is authentication through proxy sites safer? usually in office or wherever whenever we are blocked with gmail and facebook websites,we used to browse the site with the proxy sites,we used to pass our login data through proxy sites,my question is since we are exploring through proxy servers,is it there any high risks evolve around while using proxy sites?

is it possible for them(sites) to track down my data?If yes how to prevent it?

In terms of increased risks from using proxies, yes there could be.  If you browse a site which sends things like a session token in clear-text, it would be possible for the proxy to see/use that token.  so to an extent you need to trust the proxy server operator not to do that.

If you are using a proxy I'd be especially aware of any SSL errors that might indicate that your session is being intercepted as well.

In terms of whether it's possible for the end-point sites to track you down that depends on a number of factors.

This kind of question has been discussed elsewhere on the site, so I'd take a look at some of the answers like this, and a good list of posts here


LastPass - maintaining security on foreign devices So I've recently started using LastPass to generate and store secure passwords for me (previously, I was using the same password for every service). I am in the process of changing all my passwords to randomly generated ones, which are then stored by LastPass. However, I have thought of two problems that I might have from this approach:

The computers at my university require a login at the very start to allow access to programs, the web, etc. Currently, my university account is set up with a (long) randomly-generated password, which I can't remember. However, I cannot use LastPass to fill the password for me, as that would require me to be logged in first. Is there any way to get around this? Or would I just have to keep this password as a shorter, more memorable and less secure one?
On occasion, I would want to be able to log in to my Google Drive, to be able to share files between computers. Similarly, this is set up with a randomly generated password stored by LastPass. Is there a way that I could safely get LastPass to fill in the password (or otherwise get into my account), without having to compromise password security? If not, is there a more secure way to share files between computers?

Thanks for any advice.

There's a second option also. LastPass have their app for mobile devices.

You can access your password vault by logging into your account on your mobile device, search for your password and type it manually. Some devices also allow to use fingerprint scanner to speed up this process. It is a better option in my opinion than accessing a website on a foreign computer that may be compromised.


How would someone attack a not truly random secret produced by a human? Especially in cryptocurrencies you often hear people say that private key/seeds should not be typed "randomly" by humans, but rather use a truly random number generator. I understand, that humans behave in a certain way, so there must be patterns that would shrink the search space of a brute-force attack significantly.

That's the theory. But in practice, how would someone model such an attack? I know there are researched cognitive biases in perception and production of randomness but are there models, how you would model a search space of a human "randomly" hitting a keyboard?

A simple answer is that a human will tend to hit keys in the middle and/or on the 'home row' of the keyboard more and will tend to hit keys near each other together more often (due to double hits). There may also be more 'non-shifted' special characters and number row characters. Numbers and Special characters can capitals are more likely to be grouped (or just appended to) the main 'random' string.

You will therefore get a higher frequency of asdfghjkltyuivbnm, sequences like sw qd l; etc. and more in the format of oipynKJIU8767@~{&$

These can be consciously avoided, but this could from its own patten or have a too even mix (nearly the same number of each type).: dR%6Ni9)lI&6...

This could weaken things somewhat and give the attacker some assistance, but for a long string it's unlikely to be significant. It would also require the attacker knowing it was human generated to they a modified brute force attack

None of my suggestions on frequency is comprehensive and a bit of effort can produce a very random string.

Personally I often use a password generator then change a couple of items or to remove any link to the pseudo-random seed (a bit paranoid really).


SAM and SYSTEM file copying to another PC Can I copy a SAM file and a SYSTEM file of a laptop and just change my SAM file and SYSTEM file on my own PC? Will my PC then have the password of the laptop? Or is there another way I can copy the password from one computer to another, without knowing the password?

Well, didn't test yet, but I think it's not possible to do it that way.

There are two possible places to store user's password. SAM file and registry (HKEY_LOCAL_MACHINESAM). Both are inaccessible if Windows is running.

Just to understand your question better, why do you want to have the same password in your own PC, if you dont know what it is?

Why don't you run Mimikatz or Pwdump in the laptop, check the cleartext password, and change your own password to the same?


Extract issuer public key from certificate pem file I know that a certificate that's been signed by a CA contains identifiers for both the subject and the issuer's public keys:

$ openssl x509 -in cert.pem -text
X509v3 Subject Key Identifier:
                EC:27: ...
X509v3 Authority Key Identifier:
                keyid:AF:08: ...

I can extract the public key of the subject:

$ openssl x509 -in cert.pem -pubkey
-----BEGIN PUBLIC KEY-----
T5l...
-----END PUBLIC KEY-----

Is it possible to extract the full public key of the issuer? Is a special type of certificate required to do this?

If the .pem file doesn't contain the issuer's public key, then how does validation work - is the identifier sufficient to check that a certificate has been signed by the identifier's corresponding public key?

The issuers public key is not part of a certificate. Only the public key of the subject itself is contained in the certificate. The issuers public key is contained in the issuers certificate (CA certificate) which need to be known by the one validating the subjects certificate.

See SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? for more information.


Bypassing a captive portal with tor I know that NSXTS and Iodine can be used to bypass a captive portal by taking advantage of permissive DNS firewall rules.

What I have found recently is that simply by using Tor, I can also bypass a captive portal without any need for manually configuring a DNS server under my control. Nor do I have to agree to anything, I can simply browse as though I were connected directly to the internet.

How is this possible, and how would I prevent it when setting up a captive portal?

curiousguy is correct that Tor doesn't actually obfuscate the protocol other than HTTPS. Of note, however, is that Tor (using something like Tor Browser or Vidalia) does proxy DNS requests through Tor.

Some captive portals work only by redirecting default DNS to a login portal. If this is the case, the combination of encrypted communication and third-party DNS could subvert the captive portal. That said, changing DNS manually to something like 8.8.8.8 (Google public DNS) and browsing HTTPS pages, using a VPN, SSH tunnel, etc, would also subvert this portal.

Tor isn't doing anything on the protocol level to fool a captive portal, but it's certainly possible that when used in the way you describe that it could allow a way out of the walled garden.

  how would I prevent it when setting up a captive portal?

Most captive portals will not be vulnerable to this type of attack. All you need to do is successfully block all egress requests other than HTTP, which is forwarded to the portal login page; basically, nothing should get through the portal unless it's an authenticated client.


Does anybody know if CentOS have official support for OVAL definitions? I saw it here that CentOS have no official support for OVAL security definitions(patch, vulnerabilities).

Based on what I observe at oval.mitre.org, it looks like they don't even have a vulnerability definition for CentOS 7.x.

Is this true? If so, do we have other options for security management on CentOS systems?

OVAL has transitioned to the Center for Internet Security (CIS) https://oval.cisecurity.org/ . The MITRE OVAL website is in "Archive" status.

Have a look here https://oval.cisecurity.org/repository/download , there you'll find CentOS 7


Preventing uploads of malware to server by changing all extentions to PNG? Ok, so I have my own website, and you can use the file upload quite a bit, and it is very important to the site. However, I've been hearing that clients can still bypass a file extension restrictions (I only allow PNG and JPG), and then they can inject malware into the site.

So, I was thinking of a way to prevent this, however I'm not sure if it would fully work. So, I was thinking that after a file is uploaded, I by default set the extension to a PNG.

Would this stop any code from being executed if there was an upload of a file with malware that bypassed the extension filter?

Uploading a virus won't infect something. Interpreting the virus in the interpreter the virus was meant to exploit will (i.e. Acrobat opening a PDF; the OS launching an x86_64 binary; etc). This is something to think about when you evaluate your threat model.

The importance of extensions

File extensions are only hints to handling instructions. Only Windows has such a strong relationship between the file's extension and the identity of the file.

There are two different issues here:

The file is a virus. They can be named virus.exe or virus.png - it doesn't matter. What matters is:
The file is interpreted by the interpreter the virus is meant to exploit. This means somebody opens a tainted PDF file with Acrobat or a tainted executable file by running it - after possibly renaming it.

Sidenote: "interpreted using the interpreter the virus is meant to exploit" is not a typo. It is a pedantic explanation. For example: the processor is not an application, but it is an interpreter and it can be exploited.

If somebody uploads virus.exe and you replace the extension with virus.png, somebody's computer may go "Hey, that's not a PNG, but it does look like an executable" and executes it anyway, that didn't help.

If somebody uploads virus.png, the same thing can happen.

Obviously it is obviously more likely for somebody's computer to interpret a virus.exe as an executable than it is for it to interpret virus.png as an executable, so there is some validity to this. However, simply renaming things doesn't change very much - it only pisses people off later when they get a 'corrupted' png file.

What should you do?

My suggestion: Have your server run some [trusted] program on every image uploaded and tell that to convert it to a PNG or a JPG. If it fails to do so, then the uploads weren't images. If it succeeds, you also managed to remove any viruses which may have been hidden in the same file.

Another suggestion, which is easier to do immediately but is really more of a first-pass risk mitigation technique: reject uploads which don't end in PNG or JPG - don't just rename them.


Limit information disclosed in AD Anonymous Bind What I am trying to do

For reasons I may not go into, we must allow Anonymous Bind in AD on a private network.  I am fully aware of the risks associated with this.  I have found a myriad of documentation around enabling and disabling anonymous bind.

What I have tried

Nothing.  I have not been able to find anything around limiting what data is exposed in AD in anonymous bind.  Has anyone gone trough the exercise of limiting information that is disclosed when using Anonymous Bind in Active Directory?  I would like to at least minimize what data is provided via anonymous bind queries.

Rather than enabling anonymous AD bind consider using LDAP or perhaps a Read-only domain controller (RODC).

Using either of these should allow you to expose limited information without direct access to the upstream AD.

If you really have to enable Anonymous AD bind then use permissions to specify the access the "Anonymous Logon" user has to objects. Use a whitelist approach to specific objects rather than a blacklist approach.

It's worth mentioning although you're on a "private" network there could be threats on the network from either those malicious users legitimately on the network or from compromised hosts.


Could data be recovered from cut magnetic stripe card? I know all systems accepting magnetic stripe cards (card readers, access systems, etc) would reject a cut one. But could and expert still get the data that was on it?

For the record, I mean "cut in half", as often stated in bank instructions.

As a former developer for one of the biggest Security Card System organizations in the world, I can confirm with you that the answer is resounding YES depending on the manufacturer and the type of the card.

For example, my company used the standard ISO encoding standard for magnetic stripes for Debit cards, and quite frankly there is not much confidential information in magnetic stripes of the sort to begin with. The encoding is ISO standard, and you can actually search for it online. I included a link to Wikipedia , which is obviously unreliable but that generally holds true. As you can see, there is not much confidential information on the magnetic stripes aside from the name or card number – both of which can be read directly from looking at the card. These information are repeated throughout the stripe maybe twice or three times. The start and end sentinels typically appear just once.

At any rate, some institutions (mostly EMV bound ones) request this data to be lightly encrypted based on EMV standards and appear just once – and as you may have noticed, I said EMV (Visa, MasterCard, AMEX) – so you will never find this on debit cards (unless they are Visa/MS debits).  You may or may not be able to extract the data from these types of cards – that would depend on what is lost at the cutoff point. Not all credit cards magnetic stripe info are encrypted – just select ones.


Random File downloaded Okay so I was setting up stuff on my new mac earlier, downloading flash and office. They both downloaded and installed smoothly, but after I noticed a weird new file in my 'downloads' folder:

jed+ZXlW.exe.part

I realize I'm on a mac, that that is an exe, and that it's an incomplete file, but I'm still wondering how it could've gotten there and what it is. It was 'last modified' a minute before the flash player installer, and they (the .exe.part and the flash player installer) are both 959,824 bytes. I tried googling but nothing came up. I went into the 'get info' tab of it to look at the download source but it just says "--".

So basically, what is this, can it harm me or other computers on my network, and is there anything else I should know?

Any and all help is appreciated.

From what I see Googling for 'zxiw' it is associated with websites that are infected with adverts for fake Louis Vuitton bags, Uggs, etcetera. So definitely phishy.

You will not be harmed by that file, because it was only partially downloaded. But if that website managed to deliver something else to you that was Mac-specific you could be in trouble.

Either something was downloaded to your machine through a flaw ('push') or you started the download ('pull). So the prime suspect is the 'Flash player installer' installed. I hope you have removed it already.

And that brings it back to a basic question: is my machine infected? There's no way to tell really. Look for suspicious behaviour and scan your machine with any tool you can use.


Powershell says microsoft's own ps1 script is insecure, should I proceed with running the script? I am trying to update Powershell to version 5.1 which I have downloaded directly from Microsoft's website.  The download's are signed from Microsoft (although the signatures are expired by a few months), but when I try to run the script I am given an error saying that this script is not trusted by my computer, and if I should continue to execute the script?

I am wondering why a script, directly from Microsoft's website, would present an error as being "unsafe."  I am curious if people would recommend me to NOT run the script, or how I should proceed since I have to update to Powershell 5.0+ in order to configure another application (yeah very annoying).

Also to note that there were 2 different pages on Microsoft's site where I could download these scripts and each page had a different download link from the other.  One was from download.microsoft and the other was from go.microsoft (I downloaded from the former link).  I am not sure why there are 2 different links, but not sure if that is a cause for concern.

https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-windows-powershell?view=powershell-6 (this is the page where I downloaded my script)

I can't seem to find the other page with download information though, but this other page also had information on how to upgrade powershell.  The page said to run the script from the powershell console(didn't work for me so I right click and clicked "execute script").  The first link (above) doesn't give any information on what we should do to upgrade.  I have not tried running the MSU file itself either.

Here is some safety information on the 2 files that were downloaded in a zip file from the first link.

https://whitelisting.kaspersky.com/advisor#search/e3142d5fada08ea6a1ba2134e4015a5c
(ps1 file)

https://whitelisting.kaspersky.com/advisor#search/cef5ecbdf9b396fcab5bd73e5c6cb4bf
(msu file)

The first is signed by "Microsoft Code Signing PCA 2011" and the second is signed by "Microsoft Code Signing PCA" not sure that means anything though.  I find it odd that the signing is expired as well and hasn't been updated.

I am wondering if maybe the signature being expired has something to do with this "untrusted" issue or maybe there is something deeper than that?

EDIT:  This is what is says when I run the script.

"Do you want to run software from this untrusted publisher?

File (name) is published by CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US and is not trusted on your system.  Only run scripts from trusted publishers."

then asks if I want to run it.

Thank you all for any help on this matter.

An expired signature should always trigger a warning for signed code, whether it is compiled or interpreted. This is normal and expected.

On top of that, the CA cert used to sign that cert is also expired.

Since the file came directly from the vendor, it is probably safe to use. This is especially true since it was countersigned by their time stamp PCA, which acts as a witness that this file existed at the date specified and was already signed by Microsoft at that point. (Countersignatures are usually done by third parties, but whatever.)

While it is bad form to distribute code signed with expired certs, it is not unheard of. In this case, the signer and the distributor are the same company, so they could simply cease distribution if they believed the file was altered.

Overall, this is bad form, but it is not terribly surprising.


Carve out all scattered pieces of a file from data If a file is scattered in pieces on a hard drive how is it possible to find all parts of it?

Forensically in a file carving situation where one do not have access to a running OS.

Your questions are somewhat disjoint, so let me take them in pieces.

  If a file is scattered in pieces on a hard drive how is it possible
  to find all parts of it?

A fragmented file contains pointers or links to each piece or extent of the file. Exactly how those links are structured varies with the file system, but all file systems use them.

  Forensically in a file carving situation where one do not have access
  to a running OS.

First of all, it's not a question of a "running OS". Whatever software tools you are using is running under your analysis OS, which is unrelated to whatever OS might exist or existed on the disk drive being analyzed. For example you may be running Linux and examining a disk drive taken from a Windows machine.

"Carving" has nothing to do with an OS. Carving comes into play when you are trying to recover "deleted" files.

If the "File System" is intact (such as NTFS or Fat, etc.) then deleted file recovery can vary greatly by file system. If the link Pointers are still present, although deallocated, the fragmented file segments may still be located from the pointers.

If the Link Pointers are gone or the File System is not usable, "carving" comes into play. Note that most carvers require a working file system, only a few can carve raw data without a known File System.

File carvers look for known headers to indicate the beginning of a file. Generally they just grab sequential data blocks until they hit a matching footer, or an allocated block.

Most carvers will not recover fragmented files from raw data. There are a few that do a pretty good job of finding matching Header/Footer contiguous fragments. There are fewer still that will attempt to find lost middle fragments for well structured content like JPGs, but these are mostly experimental and unreliable.


Automatic client executable updating Scenario

I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an assets folder.

My current design logic for 'MyApplication' is;

My question regards the update.exe subroutine, namely;

Problem
My concern is that the process can be boiled down to fetching an executable from a URL. I'm slightly cautious with the security of this as a) any updates are distributed to all clients b) the download is an executable and currently 'assumed' to be untampered.

If my website were hacked, any executable could be pointed to and downloaded, causing untold damage to all clients. I'm not as concerned about authenticating clients, but authenticating the server response as genuine.

Solutions

Is this a concern, as I think it is?
What client and/or server side measures should I implement?

If it is relevant, I have access to 2 (or more) web servers, backend MySQL databases and full control over the client and server side contents.

Thank you for any help, I can clarify aspects if it does not make sense!

You have essentially two issues in your process: providing the update and having it installed.

Server Auth

Firstly, yes you need to authenticate the server. This means that communication to the server must be done on a secure encrypted channel. Make sure to take the time to understand attacks on SSL so you don't use something that's expired. Ship the certificate with your app, and encrypt all the exchanges. Ship an extra public key for verifying signatures, different from the one used to secure the channel.

Update distribution architecture

Secondly, you must ensure that clients can trust what is being served to them. Assuming the worst, your server could indeed be compromised. You can take two steps to mitigate this. Firstly, ensure that the server used for updates is dedicated. Don't go running that API of yours on a Web server that hosts your personal blog. Run only the update API and think carefully about how you maintain this server and connect to it. Keep it updated. Have a penetration tester break it for you.

Secondly, (thanks @Steffen-Ullrich for reminding me of this) ensure that the server only distributes content that you have validated. When you publish a software release, you should sign your release tarball / binary with a private key (the one for which you shipped the public key) and release the signature along with the tarball. So your process involves uploading signature and binary to the update server and then clients retrieving it from the server. If your server is compromised, clients will no longer receive updates but at least they will not receive bogus / malicious executables.

Replacing the binary on the OS

Surprise surprise. This is 2016, you don't just replace executables system-wide on an OS without permission from the user. You'll have to drive your users through a UAC permission dialog every time you want to change the binary. This is of course going to be annoying for them.

If you expect your clients to absolutely need the latest update every time it's released (and assuming you can't get your app to install with a Integrity Level like browser vendors do), it might be more transparent and pleasant for your users to update your app via Microsoft's app store (saying 'might' as I've never shipped an app there and am unsure about that point).


How to secure ubuntu desktop after a hack? I have two ubuntu laptops that were recently compromised. I understand that it's probably a fruitless endeavor to try to find the hacker. I want to know how to secure my ubuntu desktop so that the hacker is kept out in the future. I'd also like to know how to secure my computer against a man in the middle attack on ubuntu and windows.

As Mark says it's an extremely broad topic. People have written entire 500 page books on the subject. However the best advice for someone after a breach is:

Backup all your data and re-install. Do not try to simply clean your system. Root kits can hide very well and you don't want to miss one.
When you do re-install change all your passwords (in case of key loggers etc...) and pick secure ones.[1]
Make sure you keep your software up to date. New vulnerabilities are found all the time and it's important to patch.

Because it's a laptop the other thing I'd add is if someone has physical access then they can do pretty anything unless it's encrypted and even then if it's already switched on and decrypted, encryption may not help much.

[1] I personally like xkcd style passwords and a password safe but what the best practice with passwords is could start a holy war.


Where are certificates used to prove identity and why aren't DNS responsible for the job? I've been reading about how certificates are used to verify the owner of a public key in asymmetric encryption. Right now everything seems really theoretical to me and I'd like to know how this works in practice. For example, do sites you log into such as Facebook (or this one) use asymmetric encryption?

What I don't understand is this: the certificate claims e.g. Facebook is who they say they are, and once verified the public key can be extracted from it. Isn't this more of the roll of the DNS server? A user types in facebook.com and the DNS server is responsible for knowing facebook.com resolves to e.g. 1.2.3.4?

Some connections don't use DNS server you may say. For example a mail client may be setup to connect to a particular IP address. No problem. Then you should already know the IP address is the correct one: if it's not that's like saying you sent a package to the wrong address but are upset that the wrong person received it.

Last question, are the public keys usually not provided by the owner them self and actually the certificate authority (since according to here the public key is extracted from the certificate)? For example when I connect to Facebook is its public key given to me by DigiCert Inc, not actually Facebook?

do sites you log into such as Facebook (or this one) use asymmetric encryption?

Yes. Both actually. Regular TLS uses both asymmetric encryption (for the certificate part and to negotiate a bulk-encryption-key) and symmetric crypto (for the bulk encryption part). This combination is for speed, because the usual symmetric crypto here is about 100 times faster than the asymmetric part.

This combination is known as a Hybrid cryptosystem.

  Isn't this more of the roll of the DNS server?

Yes and no. While you could do it that way, and while there are attempts to store (or at least mark) valid crypto keys directly in DNS, this is not (at least right now) the usual way of doing this.

What does that mean? One of several ways that a CA may check the validity of your claim to a particular domain-name is by sending you e-mail to the admin@-account of your domain.

And if somebody manages to insert themselves between the CA and their DNS server at that precise moment, they can fool the CA. So if someone has hijacked those wires (e.g. bribed employee, e.g. NSA's QUANTUM router exploitation program), then the CA may be fooled into issuing a certificate to them.

If that malicious actor then later uses the same man-in-the-middle-trick when a regular person visits the site with the stolen/misissued certificate they will get the green-lock and won't notice. (Unless extra care has been taken by the site operators against that. E.g. by pre-loading certain browsers with known-good site certificates.)

  are the public keys usually not provided by the owner them self and actually the certificate authority (since [according to here][1] the public key is extracted from the certificate)? For example when I connect to Facebook is its public key given to me by DigiCert Inc, not actually Facebook?

No. While some CAs offer this as a convenience/service it's not required technically that they know both public-part AND private-part of the pubkey/privkey pair. (And I'd run screaming from a CA that made such an offer.)

Instead you send them the pubkey and have them sign (and know) just that.


How to secure a fresh Ubuntu 16.04 install I have a service that's spinning up fresh Ubuntu 16.04 instances onto a VPS (on behalf of users) and would really like to do what I can in terms of putting good privacy and security practices in by default.

This is pre any sort of web server or database install, just the base Ubuntu LTS.

The CIS benchmarks provide very clear instructions on what should be made to secure most known systems.


Is RFC 3161 necessary? As I've been implementing RFC 3161 software components, I got to thinking about running my own TSA and how one really proves the integrity of a time stamp (preferably without violating patents). I researched and considered all of the technical solutions, but then it occurred to me that Facebook and Twitter posts might have been used in legal cases to establish some ordering of events, so I searched and indeed they have.

It would obviously take more than one case to establish general acceptance, but is it possible that we don't have to irrefutably trace the provenance of all time stamps back to an atomic clock, or bury our data inside 50 terawatt-hours worth of blockchain computations? Can we just post a hash to a free social media account or two and trust that the tech companies won't fudge the details?

Probably not. See this for an example of the fragility of such a scheme:

    Did the Twitter account Fifndhs predict the exact World Cup results ahead of time?

  The account tweeted the components of every possible scenario ahead of
  time, then retrospectively deleted all the ones inconsistent with
  reality.

You either need accountability of the authority, verifiability or proof (as in mathematical or cryptographic). I don't think a social network provider has either.

Then again, it might be enough in some contexts.


Firewall Configuration Audits I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the running config.  I am most interested in inspecting Cisco PIX/ASA/FWSM and Juniper NetScreen/JunOS devices, however iptables and WFP are also of interest. What techniques exist for doing this?

I'd recommend nipper for this.  Runs on a wide range of devices, and is targeted at firewall audits, rather than configuration management.

In my experience it's very easy to get working.  Generally, you give it a copy of the config and it runs :)


Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a "dummy", like the one google uses for the server header field?

As I understand it, the user agent was useful in the days browsers were still heavily buggy, and would render very different results. To a certain extent, this is also true today, but certainly has decreased. Is there no other method to know whether a browser sais "I'm mobile" than the user agent? Also, user agents are a mess. The browser vendors tried to trick stupid user agent recognition scripts, because of which the Chrome user agent reads like a list of relevant browsers and rendering engines.

So why aren't they abandoned?

User-agent strings do provide the companies running web servers with useful information.  If they're contemplating introducing web site features or content they want to know if the majority of their user base have browsers that support that technology.  They can look at the user-agent strings logged in the past month or two and get a sense of what browsers are in use.  It can also tell them useful info like whether the user is connecting via a mobile device versus a PC, which can be used to customize the user experience.

Conversely, I'm not aware of any purpose served by web servers revealing their product or version other than to aid third-parties (e.g. Netcraft) who collect and summarize such information.  The user never sees the server type and the browser doesn't act any differently depending on the server banner (that I've ever seen).

Since Internet web servers are always running and publicly accessible that allows attackers to scan them quite easily looking for signs of vulnerability.  A site shouldn't rely only on the obfuscation of what web server and version they are using for security, but it can help to make them a less likely target.  Since it doesn't really disturb anything to disable the server banner it is an easier change to introduce.

While there is risk to the user of disclosing that they're using a specific browser that may be vulnerable to specific attacks, an attacker can't scan the Internet looking for vulnerable browsers.  A user would have to send a request specifically to an attacker controlled server for them to collect this information.  So there can be less risk associated with disclosing this information about a browser.

I'm sure the user-agent could be abandoned in favor of a 'feature string' or some other mechanism for communicating information about what the browser is and can handle to the web servers.  But these too could probably be fingerprinted by attackers who could guess the likely browser based on the supplied feature list.


ssltest: Chain issues - Contains anchor I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")

What does it mean? Should it be fixed? Can it be exploited?

When the server sends its certificate to the client, it actually sends a certificate chain so that the client finds it easier to validate the server certificate (the client is not required to use exactly that chain, but, in practice, most client will use the chain and none other). This is described in the SSL/TLS standard, section 7.4.2, with, in particular, this enlightening excerpt:

  The sender's
        certificate MUST come first in the list.  Each following
        certificate MUST directly certify the one preceding it.  Because
        certificate validation requires that root keys be distributed
        independently, the self-signed certificate that specifies the root
        certificate authority MAY be omitted from the chain, under the
        assumption that the remote end must already possess it in order to
        validate it in any case.

Since that's a "MAY" case (the "MAY", "MUST", "SHOULD"... terminology in RFC has very precise meanings explained in RFC 2119), the server is allowed to include the root certificate (aka "trust anchor") in the chain, or omit it. Some servers include it, others do not. A typical client implementation, intent on using exactly the chain which was sent, will first try to find the chain certificates in its trust store; failing that, it will try to find an issuer for the "last" chain certificate in its trust store. So, either way, this is standards compliant, and it should work.

(There is a minor source of confusion with regards to chain order. In true X.509, the chain is ordered from trust anchor to end-entity certificate. The SSL/TLS "Certificate" message is encoded in reverse order, the end-entity certificate, which qualifies the server itself, coming first. Here, I am using "last" in SSL/TLS terminology, not X.509.)

The only bad thing that can be told about sending the root in the chain is that it uses a bit of network bandwidth needlessly. That's about 1 kB data per connection which includes a full handshake. In a typical session between a client (Web browser) and a server, only one connection will be of that type; the other connections from the client will use "abbreviated handshakes" which build on the initial handshake, and do not use certificates at all. And each connection will be kept alive for many successive HTTP requests. So the network overhead implied by the root-sending is slight.


Personal or computer information stored in a freshly compiled executable I would like to know if there is any information that can identify a computer or a person that compiled a program (let's talk only about c++ on visual studio, windows , with no particular library). How can i say, by looking at an executable, which entity has produced it ?

From an inspection of an executable compiled with Visual Studio 2010, it doesn't appear that the compiler, by default, includes any identifiable information about the user who ran the compilation or the host it was run on.

It may be possible to determine exactly which version of the compiler was used by looking at the executable. The GNU compiler puts the compiler's exact version-string in its output.

For "managed" executables, Visual Studio does allow various metadata like author and copyright to be specified; but it would require some sort of customization or build-script to put build-user or build-host information in the executable.

It's certainly possible to use a build-script and the source-code itself to make sure that such identifying information is in the program.  For example, if you compile the following program with gcc -Wall -D USER=$USER -o build/q203507.exe src/q203507.c, it will include the building user's user ID as a string in the executable:

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#ifndef USER
#error please define USER in compile command
#endif

#define STRINGIFY(x) #x
#define TOSTRING(x) STRINGIFY(x)

const char * sourceFilename = __FILE__ ;
const char * compilingUser  = TOSTRING(USER) ;

int main(int argc, char **argv)
{
  if (fopen(sourceFilename, "r")) {
    printf("%s\n", "You still have the source-code for this program.");
  }
  if (0 == strcmp(getenv("USER"), compilingUser)) {
    printf("%s\n", "You compiled this program.");
  }
  return 0;
}


How does erebus infect Linux systems? Today I read about ransomware called Erebus that supposedly targets Linux servers and encrypts all the data there. What I can't find is any reference to the details of this type of attack, i.e. how the system's security was breached and privilege escalation was performed. Was it a user error? Was it just bad system security (i.e. lack of updates or vulnerable configuration)? I can't find anything about this.

I would guess any decent sysadmin at least puts every Web server in a chroot jail or better, a Container or VM, which aren't watertight, but a lot harder to break out of in any case. Am I being idealistic?

Given the sparsity of details, the SIZE of the company affected, and the fact that they were hit with a $1,000,000 ransom, my guess is that this was a targeted job that required a bit of recon beforehand to discover that they were using an ancient kernel, ancient webserver, and generally hadn't patched anything in a decade.

I expect a remote root exploit was used and coded in along with some tailored version of Erebus to encrypt the files.

I don't think this is a scenario that would necessarily be EASY to replicate. But it COULD be replicated if someone has a system with holes.

Given the target's overall lackadaisical approach to updating and security, we don't know what other kinds of security holes were available for the ramsomware coders to take advantage of.


Same origin policy for CSRF attack? Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that  a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin.

My question is do we need to handle CSRF attack separately with the CSRF token  as SOP is in place. I see almost all websites mitigates it by CSRF token implementation buy why it is required when SOP is in place ?

I see another related cookie “SameSite=strict”  at this blog to prevent CSRF . To me it looks like SOP which is provided by browser
by default. So is it really required ?

The same origin policy does not prevent all authenticated cross site interactions. Specifically, cross origin writes and embeds are generally allowed, while reads are prevented:

  Cross-origin writes are typically allowed. Examples are links, redirects, and form submissions.
  Cross-origin embedding is typically allowed.
  Cross-origin reads are typically disallowed, but read access is often leaked by embedding.

Many of the allowed cases are important for the web to function properly.

Chrome will still soon change to a default samesite=lax, which will eg prevent cross-site POST requests with cookies (and also most embeds such as images or iframes).

It will however not prevent other "write" type actions such as visiting links. So GET-based CSRF remains an option even with samesite=lax (not with samesite=strict though).

Because of this - and because you should not rely on the client having additional security features (users may eg use other browsers than Chrome), CSRF prevention is still necessary to be employed by each site (using samesite=strict may be used as CSRF prevention, though it may break if the site allows users to post/control a sub-set of HTML such as links, forms, images, etc, or if it has other vulnerabilities such as open redirects).


Is accessing by IP address without CA certificate secure? If my server doesn't have a public domain name, and users access it via IP address,  is using a self signed certificate (ignoring the warning) secure enough for https/ sftp?   I am talking only from security standpoint,  I understand the drawbacks of using IP address instead of a domain name.  Related question: Is a MITM attack possible if users access via IP address?

No, that isn't secure.

The IP vs. domain issue is irrelevant, the problem is that you're telling users to click through the certificate warning. This means that an attacker can simply self-sign their own certificate and perform a man-in-the-middle attack, and the user will click through that.

If you control your users' systems, run your own internal CA and install your CA root on the users' systems. This is the industry standard method for implementing secure TLS on internal servers.


How to make a simple file integrity checker I've seen many PHP file checker on the net. Basically they computes the sha hash of a requested file. Your PC queries periodically the script and alerts you if the returned hash changes.

The problem is: if the attacker gets write access to my web folder, then he can change the file checker to return always the old hash, making the file checker completely useless and misleading.

So, how can I check that the file checker script hasn't been altered?

You can place the file checker outside the web directory and deny read/write permissions for the account that is running the web server.  In other words do not allow the account running the web server to modify the file checker or the expected values for the file(s). Furthermore, make sure that the account running the web server does not have permissions to change the permissions of the file checker and expected values.

You could also do this from a remote machine, which runs the script and has the expected values, using either the Windows administrator shared folders (e.g. \PC\D$\www\file.php), or SSH on a Unix based system.

It comes down to permissions, as longest the account running the web server has the least permission required to run, and does not have permission to change the script file and expected values it will not render the file checker useless.

If you are interested on a heavy duty file integrity checker, for free, I recommend OSSEC.


What are the implications of SHA-1 collision for other hash functions like RIPEMD-160? Given that SHA-1 collision was proven, what are the implications for other hash functions using the same digest size, specifically for RIPEMD-160?
It is still relatively safe, or should it be replaced with RIPEMD-256 or SHA-2?

The SHA-1 collision was based on some weakness of the SHA-1 hash. This is what makes it 100,000 faster than the brute force attack.¹ Different hash functions will probably not have the same issue, although I would make plans for replacing them.