Is it safe to put the output of 'strace' online? For debugging purposes, one might be asked to put the output of strace for some process online, i.e. attached to a bug report.

Is this safe in general?  Under what circumstances is this safe or unsafe, and how would I process a strace-logfile to make sure it is safe to put online?

(I suppose it might depend on the application)

strace has the potential to include any data processed by the application.  If reading/writing sensitive data from standard in, a UI, network, or disk, it's possible that that information is included in the strace log.  If at all possible, try to reproduce bugs without processing sensitive data in the process when you're going to post logs.

Since you didn't specify what kind of application you're dealing with, this is about as extensive as an answer that I can give.


Debian missing security features? Debian (stable) is a well respected server Linux distro. I was surprised to see that in their hardening walkthrough (https://wiki.debian.org/HardeningWalkthrough) they do not support position independent executables (and ASLR and a few other useful security flags) in the latest stable build (Wheezy), while most other distro's do support these things.

Since Debian stable has stood the test of time, I am thinking I must have assumed these security features are a lot more important than they actually are in practice.

Can someone explain why Debian is able to get away without having these security features and yet not be hacked to the stone age every day?

I'd say Debian gets away with it for several reasons.

People don't know this security features exist and therefore don't demand them.
People expect Debian to be secure and don't check if it really is.
If your packages are up-to-date and patched for vulnerabilities, PIE and ASLR help very little, except against 0-day exploits.
Most people don't care about high security.

I've been using Debian on my servers for more than 10 years now and because of this lack of security on their part (among other reasons) I'm migrating to CentOS 7 when it's released in a few months.


How to use ESSIV to avoid seeing repeated patterns? I'm trying to implement an encrypted file-system.

The file-system consists of 512-byte sectors. I encrypt/decrypt the contents of a sector as follows:

Compute the SHA256 sum of the user password. This results in a 32-byte User Key.
Compute the ESSIV for a sector by computing the SHA256 sum of User Key and the Sector Number. This results in a 32-byte Sector Key.
XOR Sector Key with the plain sector data to get the cipher data as follows:

sector[0] = sector[0] ^ key[0]
sector[1] = sector[1] ^ key[1]
...
sector[31] = sector[31] ^ key[31]

sector[32] = sector[32] ^ key[0]
sector[33] = sector[33] ^ key[1]
...
sector[63] = sector[63] ^ key[31]

...
sector[511] = sector[511] ^ key[31]

When reading the sector back later, I XOR the Sector Key with the cipher data to get my plain sector data back.

Now, the ESSIV approach is supposed to prevent watermarking attacks. However, when I examine the ciphered sectors corresponding to a very large file (>> 512-bytes) full of only zeroes (0x00)...

I see that no two ciphered sectors of this large file are identical, which is great!
I see repeating patterns (each pattern 32-bytes long) within the same sector, which is not so great! These are obviously coming from by XOR step above.

My question is 2-fold:

Can an adversary break open the above file-system encryption by copying carefully constructed files to this file-system? Or, is the above scheme good enough?
When I copy the above file to a TrueCrypt volume, I see no repeating patterns. (I used AES and RIPEMD-160 as the encryption and hashing algorithms, respectively.) So, other than using AES, what can I do  to achieve a TrueCrypt-like result via some simple and lightweight XOR-like operation?

Your approach is sound (even if we should always remember the first law of cryptography: "don't roll your own"). If I may suggest some slight twists:

Compute the SHA256 checksum of some fixed salt (better if depending on the file system, e.g. a random sequence stored therein) and the user password. This prevents an attacker from having a database of SHA256 checksums of common passwords. The salt will be generated at random when(ever) the file system is formatted, and stored in the file system structure (Password Salt). The attacker has then to regenerate its SHA256 database anew after getting access to the file system (which means he is bruteforcing with zero advantage).
Do not use the User Key for encrypting the disk. Better to use a random 32-byte key, and encrypt this key using the hashed password. Security is the same, but this way, should the user change his password, you don't need to decrypt and re-encrypt the whole file system, only decrypt and re-encrypt the key.
Instead of using what is effectively ECB mode for sector encoding, use the slower but more secure CTR, using yor sector key as IV:

SHA256( SectorNumber, DiskKey ) => IV for this sector

SHA256( IV, 0 ) => XOR key for bytes 0..31

SHA256( IV, 1 ) => XOR key for bytes 32..63

...

SHA256( IV, 15 ) => XOR key for bytes 480..511


How does this test prove my application is vulnerable to clickjacking attacks? I want to know more about clickjacking. I have been reading an article about clickjacking, where the HTML code to test for clickjacking vulnerability was provided. I tried the same as described in that article, and I got the message “You’ve been clickjacked!” at the top of the page, indicating my web application is vulnerable to this type of attack:

  To test whether a site is vulnerable to clickjacking, create an HTML
  page similar to the following, changing the URL highlighted in RED to
  point to your target site:

    <title>Clickjack test page</title>

You’ve been clickjacked!

  If you see the text “You’ve been clickjacked!” at the top of the page,
  your site is vulnerable.

How does that prove my website is vulnerable?

Your webpage allows itself to be put inside an iframe.

An attacker can easily put your site in an iframe on his webpage, cleverly mask most of it, and trick the user into clicking a button there.

Because of CORS and CSRF tokens, usually websites under a different domain cannot spoof requests to your website. However, they can trick the user into clicking buttons (for example, the "logout" button.)

Read this OWASP page to learn how to protect against clickjacking


Can't get dnschef to redirect my target computer to my attacking computer's setoolkit cloned site I'm trying to create a fake DNS server by altering my router's DNS IP and redirect it to a fake facebook page using dnschef v0.2 and setoolkit 7.3. I have 2 machines. The first is the attacking computer. It is running Kali 2016.1 in VirtualBox 5.1.0r108711. I am hardwired into a TP-Link TL-WR840N router. The victim's computer is a Windows8.1 machine that is also hardwired into the router. I can't get my victim's computer to get the fake facebook.com. It just goes to the regular one. I've seen countless tutorials so I know what a working output of dnschef and setoolkit looks like. Below are the steps I took troubleshooting wise. Keep in mind this is a brand new install of Kali with default everything.

First things first, I went into my router and made my Primary DNS: 192.168.0.103 for my Kali local IP. And I made the secondary DNS 8.8.8.8 for Google's DNS.

I ran the command to start...

dnschef --fakeip=192.168.0.103 --fakedomains=facebook.com --interface=192.168.0.103

Looks normal. Then I ran dnschef in a new terminal tab.

Social Engineering>Website Attack Vectors>Credential Harvester Attack>Site Cloner. I used http://www.facebook.com with the IP 192.168.0.103.

I attempted to log into facebook with Internet Explorer on the Windows 8.1 target computer. Nothing happened. I just logged in like normal. I even opened up the harvester file manually. Nothing inside.

Now here's the interesting thing. I go to var/www/html/index.php and when I typed in my username and password, I was able to log the username and password with harvester. It works on my local machine but I can't get my second computer to see it.

When I do nslookup facebook.com on my Kali machine and my Windows machine, it returns my attacker's address as expective with the real IP as the "Non-authoritative answer. Which means it should be working right!?

I typed in 192.168.0.103 on my target computer and it found the fake page.

So I can conclude that my target computer is seeing facebook.com as my attacker's IP and I can also conclude that I can reach my webpage with my target computer manually. Which means it should have every reason to connect. Yet it is not. I am SOOOO CLOSE. What am I doing wrong!? Any of you guys have any ideas?

Ended up using Ettercap. Don't know what the problem was, but I've had nothing but success with various ettercap experiments and starting the apache servers manually.


What are best practices considering the use of Apple data protection? Since iOS 4, Apple data protection supports hardware based encryption of confidential information on the device. I looked around for best practices considering the use of Apple data protection, but found nothing comprehensive. If I understood this article about the limitations of Apple data protection correctly, one of the main elements is using a strong passcode on the mobile device. But how strong is strong enough?

Are there any best practices out there that should be considered when using Apple data protection?

For the passcode, you just need to use something that's not easily guessable by the attacker, who only has 10 attempts before access via passcode is disabled.

So no 0000 or 1234 or the year your kid was born or such like.

As well as this, other best practices would be:

Turn data protection on in the first place.
Protect the backups - this is way more important than protecting the device.
Train your users to report lost/stolen devices immediately so you can remote wipe them ASAP.
Don't assume all apps encrypt their data.


Why is e-voting still a problem? Electronic voting has been considered technical infeasible for a long time. And recently I watched a video from the channel Computerphile on YouTube where they bring up all the problems that come along with e-voting.

But with distributed ledgers and homomorphic encryption in my mind I could find any problem that cannot be solved.
To be fair this video is one and half year old, but still one can guess that this guy has heard of these techniques.

I am not a security expert yet I could imagine a system, that guaranties both anonymity and trust in the result:

Setup a block chain where every node agrees on the voting algorithm.
(Not hard at all and this already solves the problem of trusting the software)
Generate Private and Public encryption key. Give the public key to anybody that is allowed to participate in the vote. Spread the private key among authorities you trust not to collude.
Every participant has an account on the block chain with a private key that signs the voting "transaction". Every account has one vote, which is ensured by the voting software that every node on the block chain agreed on.
Because all the transactions are on a block chain every voter can trace his/her vote and verify it got added to the overall result.
(Which solves another major problem: Ensure every vote is added to the overall result.)
A primitive voting algorithm could look like this: For every party a participant may vote he encrypts a zero or a one together with some salt (so no lookup can be performed) with the election public key. Then he signs his transaction or vote with his block chain public key and his vote gets processed: The zeros and ones are added to each of the party counters. For every vote the sum of the vote is calculated and decrypted. In that way you can tell for sure only one one is added to one of the party counters (sum must be one), but you cant tell which party the participant voted.
Decrypt the final result.

Of course for any decryption the authorities who hold a part of the private key must agree on that decryption.

So what in the world is the problem that cannot be overcome with electronic voting?

Technically, your solution is pretty similar to CGS97 (note the date) which is the base of Helios and its descendants. As a general approach it's very reasonable, but completely lacking wrt to preventing vote-selling and bribery/threats (Receipt Freeness and Coercion Resistance in the literature):

Lack of RF example: Suppose I promise to give you $100 if you vote for my candidate, and show me the randomness you used (i.e. a receipt) to encrypt your vote as proof. This is a known issue with textbook Helios (mentioned in the original paper) which is fixed in various degrees in later works.

Your suggestion to use a blockchain to implement the bulletin board is reasonable but I would argue people active in the area are aware.

There are a few more issues with your solution:

It's trivial to copy other People's votes. This is considered to be bad for privacy. Malleability attacks as well.
Requiring that a person's ballot sums up to one is not adequate. Suppose I give -100 votes to candidate X and +101 votes to candidate Y.
Combining the above, take all posted the votes on the board and add them up. Let's say there are n of them. Invert the sum. That will produce a ballot summing up to -n. Add n+1 votes to your candidate. You now have a ballot that negates all the previous ballots and moves all their votes to your candidate.
Most of the above is solved with Zero Knowledge protocols demonstrating the individual parts of the ballot are 0/1 in addition to summing up to 1, plus some non-malleability requirements.
Having the authorities decrypt a mini-sum for every voter can be inefficient. Also, how do you verify they behaved correctly? If your answer is ZK, why not move that to the voter?
When you talk about salts and encryption, I think you mean IND-CPA. You probably need NM-CPA though (also take a look at IND-CCA, but it's not strictly necessary).

Going back to big picture stuff, we also want to consider voting from compromised PCs, having an verification process that people can and will follow, the fact that elections would attract state-sponsored adversaries, and the fact that a do-over in case of failure would be extremely costly (in terms of public trust as well as $$$).

TL;DR: There is extensive literature in the area (both in-booth and internet), but it's also a very hard problem.


How can I disable execution of programs from Downloads directory in Windows 10? I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable.  I want at least for a landing zone where I can scan files, run hash checks, and so on.

Does this sound right?

  Change the SYSTEM (and my own) permissions on that folder to eliminate
  "READ AND EXECUTE" while leaving READ intact.

I want to have to move files out of there in order to do more.  (The user is always the biggest threat, so let's throw a stumbling block in my -- er "his" way.)

I am not looking for mathematical rigor - I just want a common-sense, easily obtainable LZ, and I would like for it to be the existing Downloads folder that the system recognizes.

Changing permissions on the directory is probably the best way to go, yes. In addition to being relatively easy, it has the perk of acting more like the way most Unix-like systems work, where new (in this case, downloaded) files are not executable by default. Win32 has no equivalent of the umask, but you can fake it using directory inheritance (which Unix mostly doesn't use).

A few things to bear in mind when doing this:

NTFS ACLs support both "allow" and "deny" entries, for both users and groups. They are evaluated in the following order: user deny > user allow > group deny > group allow. In other words, a deny on a specific user always wins, but an allow on a specific user beats a deny on a group the user belongs to, but if the user neither has allow nor deny entries then if any of the user's groups have a deny then this trumps any allows that the user's group has. If neither user nor any of the user's groups have either allow nor deny entries, the default is to not allow (deny).
NTFS supports permission inheritance, where an object (file, directory, reparse point, etc.) can have some permissions inherited from its container (directory). In fact, this is the way most permissions in NTFS are set; relatively few object have explicit ACLs. Note also that an object can disable inheritance (it doesn't get its container's ACLs), an ACL can be non-inheritable (contained objects won't get it, even though they have inheritance enabled), and an ACL can be inherit-only (meaning it doesn't apply to the container, only to those of its contents that allow inherited ACLs).
Following the rule of "specific beats general", an explicit ACL on an object overrides the inherited ACL if there are conflicts. As such, even if the Downloads folder doesn't give its contents the Execute permission (or indeed, denies it), any particular file within Downloads might still gain that permission by explicit ACL.
NTFS, like most file systems, re-uses the Execute permission bit on a file as the Traverse Directory permission bit. As such, removing (or denying) Execute on the Downloads directory would normally prevent you from accessing any of its contents (you could list them, so long as you still had Read permission, but couldn't read or write them, etc.). However, Windows by default ignores Traverse permission checks (you can turn this behavior off, if you want), relying on Read/Write/etc. instead. This behavior means you can have weird things, like a directory structure A\B\C\D.txt where the user has no access at all to A, B, or C, but can read and even edit D.txt so long as the permissions on that file grant such access (and the user knows the exact path). It also means that, for directories, the Execute/Traverse bit basically does nothing except for inheritance purposes.
While the Execute permission on PE-format files (.EXE, .DLL, .SYS, etc.) acts like you'd expect, the default action on many other "executable" file types that are actually executed through some program (.BAT, .JAR, .PY, .JS, possibly even .MSI. etc.) will be ignored by the OS; such files only need Read permissions, and only their interpreters/runtimes/etc. need Execute permissions.

With all that said: setting a Deny permission on Execute/Traverse for the Everyone group on the Downloads directory (and making sure it's an inheritable permission, though by default it should be) should mostly do what you want.


Is it possible to grab all the cookies of different websites by only one XSS attack? I was wondering if it is possible to grab all the cookies for different websites through one XSS attack? For example, assume that twitter has a XSS vulnerability that an attacker exploited. Would the attacker be able to grab all the cookies that are stored in my browser from Facebook, Gmail, Yahoo etc by using the twitter XSS exploit?

No, because XSS means "Cross-Site Scripting".

Normally a site can only access cookies in its own Origin. This restriction is known as the Same Origin Policy.

That is example.org cannot normally access cookies in example.com.

If there is an XSS flaw on example.com though, and the HttpOnly flag is not used on a cookie in example.com, then example.org can steal the cookies from example.com if a user falls victim to the attack.

If this attack then allowed access to all browser cookies then the attacker would not need the XSS flaw at all - they would just write script in their own domain (example.org in this case) if there were no Same Origin Policy restrictions.

An flaw that would allow access to all non-HttpOnly cookies, would be a "Universal XSS" vulnerability. uXSS is a flaw in a web browser or browser extension that allows the Same Origin Policy to be breached.


Logging Penetration Test - What do you use? When performing a penetration test its obviously important to keep a record of what you did. This is important both to be able to replay an attack for demonstration purposes as well as for auditing purposes.

What tool is the most useful in logging this information. Currently, I use a mixture of one-note, word and handwritten notes.

What do you use?

I'm not sure software recommendations are on-topic here, and you'll only get opinion based answers, but my favorite tool is Infobyte's Faraday. It allows me to upload scan results, check off compromised systems, view all the data in beautiful graphs, and even export this data into a usable report.

Mods: If you feel this answer is inappropriate, please delete or let me know and I'll take it down. Disclaimer: I am not affiliated with Infobyte in any way.


ECDSA: Why do ssh-keygen and Java generated public keys have different sizes? I am using ssh-keygen -t ecdsa -b 256
which generates this for the public part:

ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNaHgNjXShzF/hmZOuhTCCsokgpSCyFohETHT4+OQMxW5g+d9nZCYxpDhwivuWbsoXTYpQWlLATXxjbQr2Y3KRY= t0132456@L541918

I need to do the same in Java. I am using BouncyCastle:

ECParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("secp256r1");
KeyPairGenerator g = KeyPairGenerator.getInstance("ECDSA", "BC");
g.initialize(ecSpec, new SecureRandom());
KeyPair pair = g.generateKeyPair();

ECPublicKey publicKey = (ECPublicKey)pair.getPublic();
System.out.println("kpub=" + Base64.toBase64String(publicKey.getEncoded()));

but the public key is smaller and does not start with same header:

kpub=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvHW0nR1hAzy3BuQR8mMkHqgGvvdXLZWAXS29fkFbhshr8y6xybHh0LRDoaUciYgr3w7WGKpfxFSSFqSjdG8bww==

How to be generate the same way ssh-genkey does but in Java?

Sizes are different because the formats are different. The strings you show are both binary values encoded in Base64. In all this message I talk about the binary values, i.e. I suppose that you first decoded the Base64 strings into binary.

Mathematically, an ECDSA public key is a point on an elliptic curve. A point has two coordinates, called X and Y, which are bound to each other through the curve equation (in that case, Y2 = X3 + aX + b for two constants a and b that define the specific curve). Here, you use the NIST P-256 curve, which has been specified to work in a 256-bit field, i.e. X and Y are two 256-bit integers. The ANSI X9.62 standard defines a 65-byte format for representing such X and Y; basically, a first byte of value 0x04, followed by X over exactly 32 bytes (in big-endian notation), then Y over another 32 bytes.

So far so good. Then both Java and SSH wrap that 65-byte value into a structure that also identifies explicitly the curve itself through some symbolic identifiers. They do so differently.

Java follows the ASN.1-based encoding also specified in ANSI X9.62. There are several options, but, in your case, you got a SEQUENCE whose contents are a nested sub-SEQUENCE, then a BIT STRING. The nested sub-SEQUENCE contains two OBJECT IDENTIFIER values, the first one being 1.2.840.10045.2.1 (which means "this is an elliptic curve public key"), and the second is 1.2.840.10045.3.1.7, which designates the NIST P-256 curve. The BIT STRING contents are, exactly, the 65-byte encoding of the curve point. To make the story short: the Java value, when Base64-decoded, yields a value of length 91 bytes, the last 65 bytes of which being the encoding of X and Y.

OpenSSH, on the other hand, is well-known for a chronic allergy to standards, and of course they invented their own format. It has been then documented in RFC 5656, section 3.1. Basically, the encoded key consists in three "strings", one after the other. Each string consists in a 32-bit header (4 bytes, big-endian notation) followed by the string value; the header contains the value length, in bytes. The first string is the ASCII encoding of "ecdsa-sha2-nistp256" (this is identifies the signature algorithm). The second string is the ASCII encoding of "nistp256" (this identifies the curve, redundantly with the first string). The third string has a 65-byte value, and, you guessed it, that's the 65-byte encoding of X and Y. The total length is 104 bytes, and the X and Y encoding uses the last 65 of these 104 bytes.

So basically, in both formats, the interesting part is exactly the last 65 bytes; the rest is just an identifier for the involved curve, in two distinct dialects. If you generate many keys with ssh-keygen, you will notice that they will differ only in their last 65 bytes (there again, after Base64 decoding). Similarly with producing many keys in Java.

Therefore, converting from a Java-produced public key to a SSH-compatible public key is as simply as taking the last 65 bytes of that key (after Base64 decoding, where applicable), and concatenating these after the 39-byte header of a SSH key.


ROP chain on x64, get rid of nulls So I have this ROP chain for x64 architecture:

0x0000000000400b60: pop rdi; ret;
0x482cf5 0x68732f6e69622f ('/bin/sh')
0x401550 <system>

In Payload:

\x60\x0b\40\x00\x00\x00\x00\x00\xf5\x2c\x48\x50\x15\x40

How should I get rid of 0? Since my buffer is overflown with strcpy and it stops on 0.

Any precise answer or general advices?

My effort was to build this ROP chain. Unfortunately, I am beginner, so I got stuck at this point.

Thanks,

Use msfencode: https://www.offensive-security.com/metasploit-unleashed/msfencode/

The 0's you're talking about are null bytes, which are essentially terminators. When ever the program encounters a null byte, the program is terminated. Using msgencode you can use the -b option to avoid the usage of null bytes.

In addition you might want to avoid other characters as well suchs 0x0A and 0x0D which are line breaks.

root@kali:~# msfencode -h

    Usage: /usr/bin/msfencode >options>

OPTIONS:

    -a >opt>  The architecture to encode as
    -b >opt>  The list of characters to avoid: '\x00\xff'
    -c >opt>  The number of times to encode the data
    -d >opt>  Specify the directory in which to look for EXE templates
    -e >opt>  The encoder to use
    -h        Help banner
    -i >opt>  Encode the contents of the supplied file path
    -k        Keep template working; run payload in new thread (use with -x)
    -l        List available encoders
    -m >opt>  Specifies an additional module search path
    -n        Dump encoder information
    -o >opt>  The output file
    -p >opt>  The platform to encode for
    -s >opt>  The maximum size of the encoded data
    -t >opt>  The output format: bash,c,csharp,dw,dword,java,js_be,js_le,num,perl,pl,powershell,ps1,py,python,raw,rb,ruby,sh,vbapplication,vbscript,asp,aspx,aspx-exe,dll,elf,exe,exe-only,exe-service,exe-small,loop-vbs,macho,msi,msi-nouac,psh,psh-net,psh-reflection,vba,vba-exe,vbs,war
    -v        Increase verbosity
    -x >opt>  Specify an alternate executable template


does validating MAC of individual packets validates the integrity of whole file? When transferring a large file over network, its likely that the file is broken into packets and then transferred. The underlying network protocol, lets consider the case of TLS/SSL, it generates MACs for the individual packets, the receiving party compares the MAC and is guaranteed that the MAC of individual pieces are correct. Does this ensure that the complete file on transfer is not corrupt, assuming no packet/chunk is lost on wire?

The MAC in SSL/TLS is computed over the combination of the record payload and a sequence number, thus ensuring that records are all received, with no missing, out-of-order or duplicated record. The connection is also terminated with an explicit close_notify alert, which is itself part of the protected records, thus cannot be faked by attackers.

See the standard, section 6.3.2.1:

   The MAC is generated as:

      MAC(MAC_write_key, seq_num +
                            TLSCompressed.type +
                            TLSCompressed.version +
                            TLSCompressed.length +
                            TLSCompressed.fragment);

   where "+" denotes concatenation.

   seq_num
      The sequence number for this record.


Considering the open ports, is it more insecure to use Outline then buying a VPN from a provider? OS: Lubuntu When using Outline Manager from Alphabet, it asks to allow incoming TCP connections on ports ranging from 1024 to 65535. Could this be a security flow, more exploitable, than buying a VPN from a third party?

Any time a VPN service allows inbound connections to your device, there could be a risk if you are running services on the exposed ports. So if you are worried about having any services exposed, simply don't enable that option.
Note that any VPN provider could allow this option, or maybe could allow malicious users to probe your device due to a misconfiguration on their end.


Is a VPN and Virtual Machine secure enough for running programs that might include malware I am trying to start a business online but don't want viruses from any sketchy software that I will be downloading. I will be using a VM and a VPN but was wondering if I needed any other software so my computer, network etc will not be affected. I understand not to have shared files on and all that but still don't know for sure because some people say some malware can get through Virtual Machines.

Running Malware in a safe environment is called Sandboxing. A virtual machine and VPN Combo is an excellent choice for a Sandbox environment.

The risk comes down to if the attacker can break out of the virtual environment and that comes down to what Virtualization software you are using. Other than that as long as you are careful not to enter sensitive information and you disable the shared clipboard then the risk is very minimal. But remember like everything in the Cyber Security world you are just minimizing risk, there is always a small chance that something can go wrong with any solution.


how to download software without fear of viruses? I've always been afraid of downloading software because of viruses, and that has affected my life as a programmer a lot. So, I want some tips to be able to install and download software without fear of viruses.

Well... It depends...

You didn't specify your operating system, but the way the question is worded I'm guessing you want software for Windows.
You didn't say what software you are looking to download, so I give a few examples for both proprietary software and free/open source software.
If you're looking for free downloads of commercial software, that is illegal unless you get a free license from official sources.

Most important
On Windows, you NEVER go online or run/install new software without active and updated antivirus.
Also important
Preferably stick to:

Official sources
Trusted sources

If those aren't available/applicable you could use:

Well known, reputable sites with curated content.

But NEVER without using a search engine to check if:

That site is recommended/criticized by other sites.
Users have left good/bad reviews somewhere.

Forum threads (if you can find one) usually have back and forth discussion, so they can give a good indicator too.
P2P / Torrenting
Unless the p2p or torrent link is:

Posted on an official site.
AND
File hashes/signatures for verification are available.

Then stay away, because there is no way to know/verify what you're downloading.
Official Sources

For Windows, MS Office, Visual Studio or other Microsoft products.

microsoft.com
office.com

If you need Adobe's Photoshop, Premiere or Creative Suite.

adobe.com

And so on...

Trusted Sources.

OS repository/app store.

Windows 10 App store etc.

Online or in-app stores for games.

gog.com
Steam
Origin

Even TRUSTED sources aren't 100% safe
Steam offer games/software from many sources, and for them to test every update and release of every title would be impossible.
A few titles that came bundled with very invasive "anti-cheat" functionality, that could potentially take control of a computer did slip through to end users.
Other curated sources
These could be less secure, so do some checking.
Until 2/3 years ago I used the following two sources a lot. With no problems.  (Before I switched to Linux)

ninite.com
chocolatey

Great for automatically and easily downloading and installing/updating software.
There are loads of alternatives now, but I have no experience with those.
Other OSes

Mac OS X
GNU/Linux
BSD
etc...

All these come with their own built in software management tools in different flavors. Like App stores and/or package managers.
They are usually very safe. Stick to them when ever possible.


Saving Personal Information (Name, Address, Phone, Email) in MySQL Database I'm going to build a web app for people to sign up and pay for a membership. The transaction information will all be processed through Authorize.NET but we save the rest of the information (Name, Membership Type, Amount, Email, Address, Phone) about the transaction in MySQL so it can be processed through an admin interface.

I'm thinking of using AES_Encrypt to save the information into a secure mysql server and then using AES_Decrypt to output the information through an admin interface for processing.

The idea is that the web server where the gift will occur (secure) will be different than the mysql server where the information will be stored and the admin interface that access the information will be on a different server as well.

My question is - does this seem like a sound approach? Is there something better I should be doing to encrypt this information in case it was compromised?

Sorry to disappoint you, but your security model doesnt work in reality. Let me explain by using an example workflow of a user editing his profile.

The user logs in, browses to his profile page and enters his data to be saved.
When saving, you need your symmetrical key for AES. This can be
either a global password, in use for all private data on your server
or a user-owned password that contains his password at some point (as all other data is publicly available / stored)

2a: Global Password

Using a global password, no matter where you store it, will always be easy to compromise. Lets assume your server requests the global password from a second server (that can be compromised itself too anyways) whenever a user (admin or not) accesses it. This can easily be sniffed as an attacker knows your internal endpoint. If you hardcode it, it can easily be read.

2b: User-owned Password

This has to contain an information so secret no one with access to the server can read it, like the password (as its supposed to be only stored inside a hash). This way the user would be able to read & save his private data but you as an admin, having the same opportunity as an attacker, wouldnt be able to read or edit them.

So what now?

Its as simple as disappointing - an attacker always has the same amount of possibilities as you (the admin) so there is no way to keep the data perfectly save from either one. What should be done instead as a matter of best-practice is the need-to-know concept - only save data you really need for your service to be available at all time like his email, name and birthdate. All other data can be saved and encrypted by a user-owned token and be used at runtime (only!) to decrypt data to offer it to the user like his address for a purchase process. This will reduce your possibilities regarding data analysis by far, but data security and broad analysis never like each other anyways.


Cleanware. What does it do and are there security risks involved? So I get these questions quite a lot recently from friends or family. And I thought this could be a good question for Security Exchange, because I couldn't find this kind of question here.

I recieved questions like:

  Should I install program 'x' promising me to clean files from my
  computer?

A few examples: 'Dr. Cleaner [mac], Cleanmaster [Android], CCleaner [Windows]'

I always advise against, because I feel like there are security risks involved. You give lots of privileges to applications that have no real benefit, since most of this is built into the OS anyway

Am I right in this assumption?

Sure, we have all the possible cases here:

Legitimate software that really try to clean your system without infecting you with malware or any other purpose.
Malware disguised as cleaning software what try to steal information from you or just trojanize your computer to be part of a botnet or other similar "evil" purpose.
"Grey" software that really clean your sytem but in addition have a "side effect". Usually this kind of software is not "real bad malware"... sometimes they only are what we can call "light malware" trying to steal non-sensitive info like banking data, they only steal statistics or general info and that kind of things (anyway is a violation of your privacy).

In my opinion if a computer needs a clean, it depends of the grade of the problem. Sometimes the best choice is to format and reinstall an entire clean system. If is a little problem sometimes there are tools that work very well but you must be pretty sure about that software and its procedence (sometimes is the hardest part).


Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable? I started to use LastPass a few months ago and imported passwords from my browsers.

Apparently, Google Chrome and Opera (based on Chromium) still pop-up the option to store passwords in my browser and probably simultaneously trying to fill in forms automatically.

Recently a conflict occurred on a site while logging in. I think passwords were changed and there was a different password stored in the browser then in LastPass. The auto-fill was not working correctly and maybe both tried to auto-fill the form.

I guess it might make sense to disable browser password storage and browser auto-fill to avoid this conflict. I'd like to be sure about:

What is exactly happening?
What are the pros & cons of having both?
What is recommended to do?

What's happening

Both the built-in and Lastpass password managers are trying to auto fill/auto login and probably the built-in password manager gets precedence over Lastpass.

Pros and cons
Pros:
Your passwords are stored redundantly.

Cons:
Multiple popups to save /override passwords/login when saving new login data.

More efforts in terms of manageability.

Recommendations

Turn off built-in password manager/lastpass (either via browser settings or use the option from Lastpass's settings.

Lastpass allows saving the cross browser& cross platform login info in cloud, so you can access it from any* device using your credentials. I suggest you use it.

*some device features are available only in premium and enterprise versions. Eg: mobile addons.


Would one e breaking PCI compliance in this scenario? First and foremost - I am not planning on going down the road of trying to adhere to PCI compliance myself, It's simply not worth the headache. I am however interested in how some companies manage to do this.

Here's the scenario:

A standard marketplace setup with vendors selling their own items and customers purchasing them.
Storing customer card details upon checkout
Later displaying a customers full card details to vendors who can
then process the transaction via their own methods
All whilst following PCI compliance for this particular setup

Would one be breaking PCI compliance in any way and/or would this be putting the vendors at any sort of risk?

Also, are the any third-party services that would take care of storing the card data to then get via something like a web-hook? (stripe etc only return the last 4 digits)

Yes this should be possible. I know of a level one service provider doing basically as you describe. I think it’s a bad idea myself, since you rely on customers to be security conscious, and I would think it opens their PCI scope to SAQ D (which they probably don’t realise). Having said that it’s likely the customers responsibility to be PCI compliant and use PCI compliance service providers. So technically should be fine but feels like you’re playing with fire.

Try Spreedly, they let you use different gateways and also have a vault, not sure about getting the full PAN though.


Forensics on a SOHO router I am interested in how reliable the information determined from doing forensics on a SOHO router is. Most of these routers don't seem to be very advanced, so I question if it would be possible to detect tampering.

If logfiles had been changed for example, could this be detected? Given that they use flash memory, would there be remnants of previous incarnations of the file to sue as evidence?

If you need to make a case that a SOHO router was tampered with in any way, what steps could you take to establish this and then what would you provide as evidence?

Forensics comes down to how well trained and trustworthy the person doing the forensics is and is unrelated to the design of hardware.

If your router's software is compromised, there's no book of things that can be changed since anything the mind can conceive, can realistically be done. The processors on routers these days can run compilers, interpreters and once you get a shell and root access, they are small computers that always run, have access to all traffic, are connected to the internet and most people don't even think are a security risk.

If you actually want to make a case, get a dis-interested professional to do all the work. Any Judge or defending lawyer would quickly dismiss as biased the input of someone pressing action based on "evidence" they collected themselves. You only have to show how you came to suspect a problem and called in the experts - anything you do past that would probably work against your interests.


Is ignoring share permissions ok? For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according to my desires.  Trying to setup Share and NTFS permissions to match always seemed to cause problems and was a pain due to extra work.

My question is, could this setup result in any security issues such as someone accessing files they shouldn't? Is relying on the NTFS permissions sufficient to secure access to the files?

A couple examples of how things are setup:

\\media-pc\media
This share contains movies, music, etc.  Everyone should be able to read from here, but only I should be able to write/delete.  The share is configured for
full control to everyone.  NTFS permissions grant read to the Users group, and Full Control to my user.
\\work-pc\projects and \\laptop\projects
These shares let me transfer work projects between my desktop and laptop.  Only I should be able to access anything in these folders.  Share permissions are setup for Full Control to everyone.  NTFS permissions grant full control to my account. Other accounts / the users group are not listed.

The network consists of a mix of windows 10 / windows 7 machines and my android phone/tablet.  Password protected sharing is turned off on all the windows machines.

Is ignoring them ok?

No.

Explanation

I'll try to make this simple.  The most restrictive of the two will take precedence.  So, if you have read-only NTFS permissions on a folder inside of a share where you have Full Access share permissions, you'll still only have read-only to that folder inside of the share as the more restrictive of the two (read-only NTFS) will win; vice versa as well.  And it's the same for deny/allow permissions.  Denys always take precedence so remember that.

What To Do

Basically, setting your share to Everyone with full access, and then restricting the actual access to the folders/data inside of the share by using more restrictive NTFS permissions is the way to go.  That is, of course, unless you want to restrict shares even more and only have certain users see the shares, at which point Access-Based Enumeration comes in handy and you'll want to enable it.

What you've set on your example folders above will accomplish what you're looking to accomplish.

See this for more examples and a further in-depth explanation.


Updating Sender-Keys and Key-Management This question is related to an earlier question I had:
Encryption on Mobile Devices - Multiparty Encryption - Key Management

My situation: I have many mobile devices that want to send sensitive information to different clients by passing by the back-office which stores this information for some time. As described in the answer of my question I want to use sender keys to encrypt this sensitive information and make it accessible only for the clients. Since the communication is one-directional I have an easier key-management.

However, I am not sure if my idea of the protocol and the key updating is secure.

For simplicity let's only look at one mobile device A communicating with different clients C1, C2, ..., Cn.

Source : https://signal.org/blog/private-groups/

For the Setup: the back-office B passes the clients' public keys to A. Then, A generates a sender-key sk and encrypts it with each of the Ci's public keys. The Ci can decrypt and retrieve sk.

Then, when A want's to send sensitive information he encrypts it with the symmetric sk and sends it to B that stores it for some time without being able to access the information. Then B sends the encrypted information to the corresponding Ci.

To update the key sk

1st idea: A sends along with the message some update information. If a new member joins the group, we just have to send him the secret key sk encrypted with his public key.
If a member leaves the group, he will not receive the key update-information.

2nd idea: use a similar procedure as in the double-ratchet algorithm. A sends a secret k along with a root-key to the clients (encrypted with their public key). Then, we do a ratchet step deriving a chain-key from the secret k and the root key. Then, for each message a symmetric-key ratchet deriving a symmetric key from the chain key. This way, if a member leaves the group we send a new secret k to all the current members and derive a new chain-key. For a new member we send the current root-key to the new member and a new secret k to all group members.

Questions:
1) How expensive is the setup for many Ci?
2) Can the update information be sent unencrypted?
3) Does it suffice, if a member leaves the group, to just not send him the update information, or do I have to redo a key set-up with all the current members?
4) When we have many mobile devices A, all the clients need to store many secret keys sk. Might this be a problem? Since, if one of the Ci stores the keys insecurely they are corrupted for all the other Ci.

There is a potential man in the middle attack by the server (B) in your model. Server can give mobile (A) its own public key as if it is coming from a client and it can give its own symmetric key (sk) to the clients as if it is coming from you. You need to implement out of band end-to-end authentication for the clients in other to authenticate A where server is not a medium.

If the server is controlled by A itself then end to end encryption becomes optional.

About your 1st idea, that's the way it has to be implemented as WhatsApp group management does. So it's not an option. It's necessary.

There's no problem in using symmetric ratchet except that it only provides perfect forward secrecy and there is no future secrecy. It means if current chain key gets compromised, the entire future chain is now predictable and future messages can now be decrypted. The threat actor just have to compromise one client. This is also a problem with WhatsApp group messaging.

  If a member leaves the group we send a new secret k to all the current members and derive a new chain-key.

You also have to generate a new root key else it is considered compromised when someone leaves. The root key is basically a seed value here.

Why are you using root key to initialise the chain? In symmetric ratchet, the chain can be initialised by first chain key itself using HKDF. Clients only need to know the first chain key sent by you.

You also have to digitally sign the messages to prove that it is indeed you who sent the messages and not a malicious client producing fraudulent messages. Public key to verify the signature can be obtained from B.

It's not really expensive as the actual load is carried by the server. You send one message and the server sends multiple copies of it.
It breaks end to end if you share keys unencrypted.
You and your clients have to clear all the existing keys once a client leaves else they are considered compromised. Both root key and chain key.

  When we have many mobile devices A, all the clients need to store many secret keys sk. If one of the Ci stores the keys insecurely they are corrupted for all the other Ci.

And that's why imposing a group limit in multiparty encryption is important. Group management with large groups become very difficult. One compromised client in your case can expose all the keys along with the future chain attacker needs to know. The key exchange also becomes quite lengthy when someone leaves. For mobile devices A, lengthy key exchange is a problem.

What you can do is to associate limited number of clients with A1 (say 500) where A1 is the admin. Another 500 with A2 and so on. But don't merge them with each other else each client in the network becomes a single point of failure for every other client. Clients can also act malicious so one of them can intentionally release the keys in public but then the group is compromised anyway without involving the outsider.

It's not recommended to roll out your own implementation, see Why is it wrong to implement myself a known, published, widely believed to be secure crypto algorithm? But what you are implementing is already in use. What you need is a proper group management to exchange keys.


TLS 1.2 Handshake: How is the ECDHE public key signed by server? I am dealing with a situation where a cipher option, such as ECDHE-ECDSA-AES128-SHA, is chosen for establishing a TLS connection. In this case, a server, when sending the ServerKeyExchange message to the client, is required to sign the ephemeral (EC) diffie hellman key using its ECDSA private key (associated with the public key certificate). The public key is first hashed before an ECDSA sign operation can be performance.

My question: how is the hashing algorithm determined during the handshake?

RFC 4492 which describes the application of ECC to TLS 1.2 has the following text to indicate how this algorithm is determined:

  "“All ECDSA computations MUST be performed according to ANSI X9.62 [7]
  or its successors.  Data to be signed/verified is hashed, and the
  result run directly through the ECDSA algorithm with no additional
  hashing.  The default hash function is SHA-1 [10], and sha_size
  (see    Sections 5.4 and 5.8) is 20.  However, an alternative hash
  function,    such as one of the new SHA hash functions specified in
  FIPS 180-2    [10], may be used instead if the certificate containing
  the EC public key explicitly      requires use of another hash
  function.  (The mechanism    for specifying the required hash
  function has not been standardized,    but this provision
  anticipates such standardization and obviates the    need to update
  this document in response.  Future PKIX RFCs may    choose, for
  example, to specify the hash function to be used with a    public key
  in the parameters field of subjectPublicKeyInfo.)”

However, if one refers to NIST Suite-B requirements for TLS 1.2 (RFC 5430), it is clear on the use of SHA256 and SHA384 for desired security level (since SHA1 is deprecated by NIST).

So, in TLS handshake, how does one specify the use SHA256 in the above signing procedure ?

Thanks,

Hari Tadepalli

RFC 4492 specifies ECC for TLS1.0 and TLS1.1. It does not cover TLS1.2 because it was written before TLS1.2; notice that 4492 is less than 5246. RFC 5246 TLS1.2 changes the signature structure for all signing algorithms including ECDSA, and also adds a Hello extension to negotiate supported signing algorithms (including hash) more flexibly.
RFC 5246 A.7 Changes to RFC 4492

RFC 4492 [TLSECC] adds Elliptic Curve cipher suites to TLS.  This
document changes some of the structures used in that document.  This
section details the required changes for implementors of both RFC
4492 and TLS 1.2.  Implementors of TLS 1.2 who are not implementing
RFC 4492 do not need to read this section.
This document adds a "signature_algorithm" field to the digitally-
signed element in order to identify the signature and digest
algorithms used to create a signature.  This change applies to
digital signatures formed using ECDSA as well, thus allowing ECDSA
signatures to be used with digest algorithms other than SHA-1,
provided such use is compatible with the certificate and any
restrictions imposed by future revisions of [PKIX].
As described in Sections 7.4.2 and 7.4.6, the restrictions on the
signature algorithms used to sign certificates are no longer tied to
the cipher suite (when used by the server) or the
ClientCertificateType (when used by the client).  Thus, the
restrictions on the algorithm used to sign certificates specified in
Sections 2 and 3 of RFC 4492 are also relaxed.  As in this document,
the restrictions on the keys in the end-entity certificate remain.

In particular RFC 5246 4.7 Cryptographic Attributes

A digitally-signed element is encoded as a struct DigitallySigned:
  struct {
     SignatureAndHashAlgorithm algorithm;
     opaque signature<0..2^16-1>;
  } DigitallySigned;

The algorithm field specifies the algorithm used (see Section
7.4.1.4.1 for the definition of this field).  Note that the
introduction of the algorithm field is a change from previous
versions. .... RSA .... DSA ....

Additional points:

the server signs its ECDHE public key and the curve (which in practice,
especially for Suite B, is named form rather than explicit, thus quite small)
(edit, thanks David) as well as the nonces, with at least the client nonce proving freshness

Suite B requirements are set by NSA not NIST. IIRC Suite B
required SHA256 and SHA384 before NIST "deprecated" SHA1.

RFC 5430 was obsoleted by RFC 6460
which requires TLS1.2 and GCM as well as ECDHE-ECDSA.


Is the BBC’s advice on choosing a password sensible? In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows.

  Step 1: Choose an artist (a recording artist I presume)

Lets choose as an example case study the teen idol and all round bad boy Justin Bieber.*

  Step 2: Choose a song. (The catcher the better)

Next, I need to choose a song from the Biebs vast repertoire of classics. My particular favourite of his, is his insightful look into the dark world of controlling relationships “Boyfriend”.

  Step 3: Choose some lyrics

Now I need some lyrics from “Boyfriend”, I'll go with the slightly menacing chorus. “If I was your boyfriend, I'd never let you go”

  Step 4, 5 and 6: Passwordify the lyric

Now we need to take the Biebs prose and turn into a password. We do this by taking the first letter of each word in the lyric “If I was your boyfriend, I'd never let you go, I'd never let you go”

iiwybinlyg

Make it case sensitive:

iIwyBiNlYg

Turn it into 'leet speak' by changing it up with symbols and numbers:

1Iwy&1NlY9

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability of the total amount of possible passwords that are likely to pop up using this method.

As we are all aware, humans can be very predictable creatures, it wouldn't take a huge amount of effort to generate dictionaries based on certain demographics, music genres, or targeted attacks based on profiling individuals.

My initial thoughts on this was that this would be terrible advice to give out in a business as it would lead to many users using the same formula to develop their passwords, which would only be exacerbated by making the passwords more predictable. On a national scale this could be sound advice, which leads me to my question:

Is the BBC’s advice on how to choose a password sensible, given how predictable we humans are? If so, in what scenarios is this sensible advice?

*Justin Bieber used for humorous reasons only.

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability of the total amount of possible passwords that are likely to pop up using this method.

This is a good question, and I'm going to depart from the norm here, put on my tinfoil hat, and say "no, this is not a good idea." Why? Let's look at it in the context of the Snowden leaks.

Because the GCHQ spies on all traffic on the British internet, and according to the Snowden leaks, your internet traffic is shared with the five eyes. Even if you're using HTTPS, this is a bad idea.

"But Mark Buffalo, you're being a maniac tinfoil hattist again!" Think about it. The time to crack your password was suddenly and significantly reduced. How?

GCHQ takes history of your online searches. They likely know when you signed up for a certain website thanks to XKeyscore.
If they know when you signed up for that website, they'll see you went to Google.com around that time and did a search for song lyrics. Even if you're using HTTPS, the fact that you connected to google.com around that time, and then visited a website that hosts song lyrics, is all they need to begin breaking your password.

Even if they can't view the traffic, they can still see that you connected. Even if you're using HTTPS, this doesn't stop them from hosting lyric websites themselves. This also doesn't stop companies from logging your search results, and it doesn't stop the companies from providing these results to anyone. If they know what kind of songs you like, or don't like, it makes it even easier.

Now they can write an algorithm to crack your passwords much, much easier than brute-forcing every possible combination. Or even better yet, use a ready-made password cracker with a provided dictionary of those results.

But Mark Buffalo, the government isn't monitoring me!

That's all fine and dandy. You generally don't need to worry about them unless you're a criminal. Or you're privacy-conscious. Or you're a security researcher.

There's another important aspect you need to consider, which I think is far worse than the government: advertisement companies, and hackers "But Mark Buffalo, I use NoScript (great) and Ghostery (Ghostery sells your info)!" Most people don't use those. And many people who do, also don't use those tools when they use their smartphone.

There are data trails everywhere, especially if you own a smartphone (android in particular), and there are plenty of evil marketing companies that will sell your data down the river the first chance they get. Or maybe they aren't evil companies, but they get breached by hackers.

Anyone with a "need" could buy that data, and those sophiscated enough could steal it. While this seems like frantic worrying for such a small thing for most people, it gets much worse when you delve into the realm of federal contracting. This is one of the ways security breaches start.

All of the steps listed previously could be done without XKeyscore. They can be done very easily with vast marketing databases.

Stop the tinfoil, Mark.

If I were wearing my tinfoil hat right now, I'd believe this article was made as part of a plan to intentionally weaken standards. I personally believe that weakening standards is a national security risk, especially when federal contractors adopt those weakened standards.

Personally, I would worry more about evil marketing companies and hackers than I would the government. Especially when deliberately-weakened standards are what help potentially-hostile countries gain unauthorized access to critical infrastructure and intellectual property.

But seriously, this makes your password weaker

Now let's talk about numbers, and social engineering.

With a normal brute force of this password, you'd likely need the following characters based on this password policy:

  abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=

That's 76 possible characters. With this password method, assuming most people will use 6-7 words to generate the password, and perhaps add 1 symbol - !@#$%^&*() being the most common - plus a number, you'll need to test - for an 8-character password - 1,127,875,251,287,708 combinations to exhaust the password space. This could take an impossibly long time depending on the hashing algorithm and hardware.

Let's use md5 as an example (it's terrible, but it's computationally cheap. Please don't use md5; I am only using it as an example). To exhaust the character space of an 8 character password, it would take 4 years to crack with a cheap workstation. About 4 years 25 days 7 hours 46 minutes 54 seconds. If you were to up the password length to 9, it would take over 309 years. Keep in mind that processing power is growing rapidly.

Learning extra parameters about the user's password allows you to simplify this. Let's assume that you choose the following song: baby hit me one more time. This is your favorite song, and I know this because I socially-engineered you into telling me. Let's choose a predictable lyric phrase to create a password with:  Hit me baby one more time. This becomes HmBomT. Now let's add some leet with a number. Now we have H@BomT3. Now that we know your favorite song, and your favorite phrase, this is what your password alphabet space becomes:

hHmMbBoOmMtT1234567890!@#$%^&*()-_+=

As you can see, this alphabet space is significantly reduced. It's much, much faster if you know what character the password starts with, but let's assume you don't. Let's further assume it's been randomized. Now you've reduced the time needed to exhaust the password space to 2,901,713,047,668 combinations, it takes 3 days to crack the password with a cheap workstation. Let's upgrade it to 9 characters. Now it takes 137 days 15 hours 47 minutes.

You can calculate this yourself (charset: custom). Also, all of this assumes you don't have a dedicated GPU cluster.

EDIT:

It's come to my attention that there is now evidence of custom hardware solutions dedicated to cracking bcrypt, one of which is a lot less expensive than a 25-GPU array, uses less power, and is vastly superior in every regard. Please read this amazing article if you want to learn more.

But shouldn't we simply increase password length?

Yeah, you could. Truthfully, it greatly increases entropy when you increase the password length.

However, then it becomes annoying to enter - especially for corporate environments that require you to log out every time you leave the computer. On top of that, it's very hard to remember this password.

You might eventually forget it after entering different passwords and being forced to change every few months. Even worse, you could forget it immediately, and be forced to visit the IT help desk to reset your password. This results in costs to the business, and lost productivity.

In fact, a better method would be a xkcd's correct horse battery staple. You could use an upper case somewhere, and a number somewhere else, or you could make it even easier while increasing entropy: something like correct horse battery staple gasoline. It's very easy to remember, very easy to type, and it's very hard for computers to break. Also remember that this should be randomly-generated from a 2048 word list.

For websites, I would recommend a password manager such as KeePass. I would not use LastPass, as it's vulnerable to phishing attacks. Websites can know you have LastPass enabled, because your browser is sending this information to the website if requested! This is part of how browser-fingerprinting works.

For corporate and other logins which you aren't able to use a password manager with, I would recommend a variant of correct horse battery staple with an extra word. Maybe correct horse battery staple gasoline? Much easier to remember.


Does a "Barge-in Attack" exist for unencrypted Bluetooth Low Energy connections? Does what I'm calling a "barge-in attack" exist for Bluetooth Low Energy? This is a type of Man-in-the-Middle attack, I guess, but unlike in most discourse on BLE security, the attacker does not create two connections, one with the Central and one with the Peripheral, and forward packets between the two. The attacker "barges in" on an active, unencrypted connection by jamming certain packets such that one device drops the connection while the other continues communicating with the attacker, believing that it is the original peer.

For BLE, I think this can be done by jamming Device A's transmissions until Device B's supervision timeout elapses. Wouldn't Device A's Link Layer keep re-transmitting, as Device B's packets will be left intact, just with a non-incrementing Next Expected Sequence Number? Eventually, Device B will stop sending packets, and the attacker may substitute their own for the remainder of the connection.

Also, does this attack have a more common name?

Yes, this is possible I think. In a certain way. If you have a bluetooth SIG account:
http://go.bluetooth.com/CRw0070Ut0UB04Qu3G04F02

Also already shown with proof of concept at DEF CON 26

If you search for BtleJack at google, you will also find a ready to use tool which is doing exactly what you are describing.

First step is to do a selective jamming: The response packets from slave to master at the beginning of each connection event are jammed. At master side a connection timeout will occur and the attacker can hijack the connection by spoofing the master.

This is not exactly a man-in-the-middle attack. It is replacing the master by your own device. In practice the master will now maybe try to reconnect and you could create the link from master to your device by spoofing the slave.

So this method is maybe not a "barge-in attack" but enforcing reconnect to the wrong device. Dependent on the scenario this may result in the same.


Creating a semi-anonymous voting system I'm working with a model government simulation for fun over on reddit. I was wondering if there is a way that I could improve anonymity of votes and ensure that all votes are legitimate. This is the way that we currently do things:

A voting form and spreadsheet are created in Google Docs
People vote in the poll (which includes asking for their reddit name) and then post in the reddit comments to let us know that they voted.
We compare the number of votes at the end to the number of comments in the thread and check to make sure that the numbers match and that for each username in the spreadsheet, there is one comment in the thread.

This has some really obvious problems. For one, the spreadsheet has to be owned by a single person and could be manipulated by the spreadsheet owner. Additionally, by having users enter their username into the form, we can verify that they voted, but it basically tosses anonymity out the window since the person who owns the spreadsheet can see how everyone voted. Lastly, verifying that the votes are accurate can take a really long time for longer votes. We don't have a quick and easy way of verifying the results do not have duplicate votes, votes from unverified users who were just given the link to the google docs form. Lastly, we can't audit this process. If they were to release the spreadsheet to verify that the election was done properly, we would just end up having everyones votes released.

Is there a better system to make our voting system more anonymous, but still be able to easily verify votes through their reddit username or other info.

This really boils down to how much programming knowledge that you have as well as whether or not you want to host this onto a database and / or whether you want to to store them into a file, costs may vary with this.
There is, an alternative with using Google spreadsheets and that you can tick the option "Do not capture email addresses" .. This should allow you to do the anonymous entries acceptable. Source: Google - Answers
They basically state that:

You have created the form in Google Apps for your company domain. You should have unchecked the option that e-mail addresses should be captured.
See 1, i.e. "If you use Google Apps, you can choose to record the email addresses of people who fill out your form. To do this, select the checkbox next to 'Automatically collect respondent's yourdomain.com username' while you create the form. Survey recipients will see a message at the top of the form explaining that their username will be collected automatically."

For the duplicate entries, you can use the following formular: =countif(A:A,A1)>1 source: highlight cell if value duplicate in same column for google spreadsheet
This will then hightlight all of the entries that contain duplicate values.
I hope this helps you.
EDIT:
You are probably better to use a database for this task. This could be fairly simple, providing that you have a domain of some sort and just host it on a single page. Essentially, what would happen is:

You would ideally create a single form on a page, asking for the persons
username that they want to vote for.
If you wanted to capture the name of the user, you can, you can also check
for duplicate entries using a small sql query and then ignore any entries
that were made.
At the end of the process, run queries, this can be used to select counts,
distincts etc..

ANOTHER APPROACH:
Carry on using the methods that have been described, through Google Forms / Spreadsheet. At the end of the process, download the data that you have collected into a CSV form, create a local database (sql, mongoDB etc..), import the data into the database and then perform your queries. This will save you time AND if you are tracking their usernames will also allow you to perform distinct queries etc.. This would essentially solve a lot of your problems and make this process more efficient.


Public part of SSH key (*.pub): Keep or destroy? I have set up authentication with a remote system using SSH. I sent the sysadmin the public part of the SSH key (*.pub).

What are the implications of keeping this public key on my machine? Is it good security practice to delete/'shred' this public key?

The whole point of your public key is that you can share it with anyone. It doesn't matter if someone gets it, it doesn't matter if it's on your machine.

It isn't a target for attackers so it would be of no value to anyone in having it on your machine. It does have a benefit in keeping it: you can then easily share it.

(Yes, I know there is a possible attack vector if an attacker had the public key and had a way to impersonate the server you are trying to connect to, but if they are prepared to do that you have greater issues)


What should a Vulnerability Management System scan on a large scale On a large scale (~1500 workstations, ~100 servers, ~50 network routers and switches, etc), what should a vulnerability management system be scanning? Should it scan everything, or just samples?

I know that ideally the VMS have to scan everything, but I'm not sure if that is feasible.

Scan everything; all ports and protocols.

Scan of open TCP ports:

Scanner sends TCP SYN to 1650 targets × 65,536 ports = 108,132,750 160-bit IP headers + 108,132,750 160-bit TCP SYN packets = 34,602,480,000 bits @ 1 Gbit/s = 32.23 seconds; of course, you'll have to go at least twice as slow so that responses from below can use the bandwidth.
1650 targets × 65,535 ports respond with 108,132,750 96-bit ICMP PORT_UNREACH packets or 108,132,750 160-bit IP headers + 160-bit TCP SYN-ACK payload = not more than 34,602,480,000 bits @ 1 Gbit/s = at least 32.23 seconds.
All listening TCP ports on all systems on your network can, theorethically, be discovered in 64.45 seconds if there's no packet loss (OSI layer 2 frame sizes not taken into account).

It's similar for UDP; however, the payload is smaller.

The discovery of all listening TCP and UDP ports on all systems on your network can, theorethically, be completed in 128.90 seconds (OSI layer 2 frame sizes not taken into account).

Other protocols = 1 packet per target in each direction; however, DHCP servers wait on each other, so to discover all of them is a bit more complicated.

I'd say all directly available services on your network can, theorethically, be determined within 180 seconds.

Then you have to scan each directly available service for vulnerabilities. A rough estimate would be that you have 1650 × 5 available servies = 8,250 directly available services. I'd say it would take no more than 10 seconds per directly available service on average. Therefore, all directly avaialble services can, theorethically, be scanned for vulnerabilities within 180 seconds + 8,250 × 10 seconds = 82,680 seconds = 22.97 hours.

Realistically, it will take at least 3 days @ 1 Gbit/s.

Now, just so you know, a hacker could discover all vulnerable standard services on your network within a few hours, if he's a script kiddie, or within an hour, if he's not. That is to say, your entire network can be pwned within 3 hours if there's an entry point and there are vulnerabilities, depending on who's doing it.

That's only IPv4, though; do you have IPv6?


What are the main sources to collect Threat Intelligence Information especially from Dark Web I've identified some OSINT Sources but they are not enough. Can anyone identify other sources to automatically via APIs or other way to collect threat intel information.

The best one I've come across for non-Darkweb OSINT gathering so far is the tool named "Harpoon" written in python3. As you pointed out, there are multiple ways to gather OSINT data but aggregating them is a herculean task for the analysts. Harpoon makes it easier with API integrations to grab different types of OSINT information and it's pretty easy to setup.

Follow the link https://www.randhome.io/blog/2018/02/23/harpoon-an-osint-/-threat-intelligence-tool/ for more information on how to Install and use Harpoon!

With regards to Darkweb, I found this tool really helpful but it's still kind of work in progress and is again written in python3. This tool makes use of Tor and is one of the requirements for it's onion crawler to function.
More at https://github.com/DedSecInside/TorBot

Hope it helps!


"FROM" mail spoofing I just received a mail from my boss saying someone with my mail has send some request for money. I is kinda serious and I know it is easy to spoof a mail, but the mail is myname@mycompany.com. So my question is, does the one spoofing the mail has to have the @mycompany.com user name and password?

TLDR: if someone mimics my company mail, does he need to be part of the company to do so? does he need a company mail

Thank you for reading.

TLDR: if someone mimics my company mail, does he need to be part of the company to do so? does he need a company mail

Maybe.

The question is, is your company mail server configured to reject mail coming in from the outside with From: addresses containing @mycompany.com?  If so, then the attacker needs to be on your company network to spoof email from your boss to you.  If not, then anyone can send that email and tack your boss's name on it.

The more common case is that mail servers are permissive, and do not block email from the outside with a "local" From: address.

You can look at the Received: headers to see what path the mail took to you (bearing in mind the attacker can prepend fake ones, but those starting with your mail server are generally reliable.)


Understanding ANSI/AAMVA encoded data (pdf417 data matrix) on back of NYS ID card Background

I am developing an Android application for work which runs on a Zebra TC51 bar code scanner, which I have been playing around with.. I scanned my NYS drivers license and inspected the output this morning (sanitized output is below).  The output contains 20 lines of data and 1 line of meta data.  The standardization body is AAMVA and ANSI.  I am curious about two lines (labeled ANSI and ZNB).

I scanned my license and the ANSI labeled line had an associated value string similar to 636001010102DL00910228ZN02790040DLDCADJ (this is sanitized, more explained below) and when I googled it it returned a sketchy Pastebin result with NYS Drivers License data dump, but none of the other information matched (name, dob, etc).  So I scanned 10 more NYS ID cards (friends and family) and googled the results.  No hits on Google for them.

Question

I am trying to figure out two things

How is the ANSI value string is (ex: 636001010102DL00910228ZN02790040DLDCADJ) created, what is it used for, and what does it communicate.  I especifically want to figure out if this value string is meant to be unique.
How is the ZNB value string created, what is it used for (it looks like some type of hash/signature), what does it communicate.

Research I have done

I have done a cursory investigation and read the following material.

AAMVA DL/ID Card Design Standard
Truculence Swipe
NYS Changes to the New York State Driver Licenses and Non-Driver Identification  Cards
Oracle DocuMaker PDF417
Random YCombinator post
Random GitHub discussion for Android Vision

I know that the "bar code" is a PDF417 data matrix.  I know (and have labeled) most of the key/value pairs.

ZNB looks like a hash or signature (it reminds me of how you need to sign AWS SQS rest calls.  I have ran all the data prior to ZNB through the following hashes just to see if anything came out that looked right but no hits (I'm not even sure if it is a hash).

SHA-1
SHA-256
MD5

Unfortunately I cannot find any information about these ANSI and ZNB values.  Every other key/value pair is clearly defined in AAMVA DL/ID Card Design Standard except those two.

The data

I sanitized the ANSI valur by swapping numeric characters for other numeric characters but did not change the cardinality of the value string or any of the the alpha characters (the GitHub source said the index of the first DL was important). I left the first 6 digits because another source state that was a significant value as well.

I sanitized ZNB by swapping alpha and numeric characters with other alpha and numeric characters.  I did not modify the capitalization of any alpha character in case it is significant.  I did not modify either the cardinality of the string or the special characters.

@

ANSI 636001010102DL00910228ZN02790040DLDCADJ   (???)
DCB (????)
DCD (organ donor?)
DBA (date of birth)
DCS (Last name)
DCT (first name, possibly with middle initial)
DBD (date issued
DBB (date expired)
DBC (0 or 1 for male for female)
DAY (eye color abbreviated)
DAU (height in footinches)
DAG (address line)
DAI (city)
DAJ (state)
DAK (zip)
DAQ (license number)
DCF (document number)
DCG (country)
ZNZNA(last name)@(first name)@(middle initial)
ZNB Eg3*#c+W^xmj(Ws8@B?]plW_Db;uk&y*V/d9"1=qG

The sample

Sample size of 10
All New York State identification cards
Formatting was nearly identical for all
New Line / Carriage return was encoded (it actually scanned as shown above)
Date of Birth of sample participants range from 1951 to 2000
The sample include a least one of the following identification types

A 2013 model non drivers ID card
A 2013 EDL ID card
A 2013 Standard (not enhanced) drivers ID card(enhanced)
A 2008 Standard drivers ID card

Whats weird is I scanned probably 10 licenses and googled the ANSI string value. Nothing came up for any of them except for mine.  Any help or assistance on this would be greatly appreciated

This is really basic stuff and is addressed in the AAMVA  DL/ID Card Design Standard.   You can find it on AAMVA's website.  I've written a parser in PHP if you would like it.

All the data..starting with ANSI is sort of a table-of-contents.. it shows the IIN (government authority ID#), AAMVA version, how many subrecords are in this record.. the starting position & length of each sub-record..and probably some other stuff i'm forgetting.   the "table of contents" ends when you reach the position of the first sub-record.

Some tags like DAC are/are not used based on what version of AAMVA this record is.  so its important to read the AAMVA version number.. and based on that, look for the tags which were used/defined in that particular version of AAMVA.  Most tags are the same across all versions.. but some tags like first name and last name have changed over the years.

The ZN sub-record is proprietary to the issuing authority..  NYS has publishes what ZNA is.   ZNB is a mystery..probably a hash of the DL# or name or birthdate, etc... or some combination


exploiting CSRF in ajax request via XSS flaw In an application i am testing, there is a stored XSS flaw. Now, I was testing for CSRF and I constructed an HTML page with a javascript that sends the ajax request (XHR). It caused a pre-flight request and then the browser says Cross-origin request blocked as the Access-Control-Allow-Origin is missing.  My question is, if I use stored XSS flaw , then the request will be sent from same domain and CSRF attack would be successful right ?

Thanks in advance.

csrf test

Pre-flight request:

OPTIONS /data/user/ef891d503e1a4c8994fcf81d0fdb6168?details=false HTTP/1.1
Host: www.domain.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:43.0) Gecko/20100101 Firefox/43.0 Iceweasel/43.0.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Access-Control-Request-Method: PATCH
Access-Control-Request-Headers: user-agent
Origin: null
Connection: close

I spoofed the Origin header to the target domain using burp. But I got the same CORS error.

Yes,it will work. The CORS header will avoid external requests from perform actions(eg. a malicious link received by email and clicked by the user).

If you combine a stored XSS flaw and perform a request on the page load to execute some action,it will certainly work. The request comes from the application domain,so the application/browser will have no way to distinguish this request from a forged request.

The OWASP guide provides more information,take a look.

EDIT: I see now your edit. Let's see if I understand what you're trying to do.

Scenario: You have a non-sanitized input, which let you explore the XSS flaw. You put some dirty javascript to perform a action,like alerts or logs,and it works every time that the page is loaded. Fine.

On next step,you have elaborated a XHR to the same application domain,from the application domain. Are you still getting a CORS error?


Where or how can I get list of domain dependencies of top 100 popular sites? For example google.com depends on ssl.gstatic.com, lh3.googleusercontent.com, fonts.gstatic.com.

I need this list for Proxy settings

About dns domain dependencies

Domain dependencies are only registrars. There is nothing else.

But you could ask for:

whois gstatistic.com | grep -A1 Holder

Hmm. nothing? Ok looking for names servers:

whois gstatic.com | grep Name.Server
   Name Server: NS1.GOOGLE.COM
   Name Server: NS2.GOOGLE.COM
   Name Server: NS3.GOOGLE.COM
   Name Server: NS4.GOOGLE.COM

and

whois googleusercontent.com | sed '/Name Server/q;d'
   Name Server: NS1.GOOGLE.COM

Also, building a proxy (meaning web proxy), is a HTTP concern. What you call dependencies are only web links to other repositories where to find some objects.

Web domain dependencies

Web pages depend on a lot of things:

scripts: Libraries could be stored on development site
fonts: Fonts are generally located on fonts servers.
styles: Styles could be linked to scripts, stored on development servers.
videos: Mostly located on stream servers.
map: Geographic maps, stellar maps, oceanographic, human... And other specialised big data systems..
photos, images, others...: Some copyrighted files could only be shown from original site (artist, photograf...),

But web domains strongly depends on

advertiser where links to advertiser host is required for log count and further analisys.
captcha I hate captcha but...
online banks required for web shops.

Where to get such a list

On your web history, cache and mostly on the log of your proxy server...

Unfortunely such a list could not exist, because every web site could be build and modified at any time.

So if you plan to build a strongly restrictive proxy server, you have to keep some hotline up and stay ready to change your rules, adding some new
kind of third party site, at any time.

And finally, about Top 100 popular sites

Answer could only be subjectives...

You could try:

duckduckgo.com
bing.com
google.com
wikipedia

... Then have a look at your proxy logs ;-)

Tip or trick:

Have a look at my answer about How to display the Subject Alternative Name of a certificate?,

Displaying Subject Alternative Name of SSL certificates give some exhaustive list of directly related domains.


Safe to make a VPN connection over coffee shop WIFI? On my work laptop I regularly create a VPN connection that I use to remote desktop to our web server.  Is this safe to do on a coffee shop where random people are connected to the same wifi network?

Yes, a VPN connection encrypts the connection between your computer and the remote VPN host.  The connection would just look like gibberish to anyone sniffing the traffic, either in the coffee shop or on the Internet.  It is worth noting that the same applies to any content sent over HTTPS even if you aren't using a VPN.

It is also worth noting that if you are using the current version of Microsoft Terminal Services (ie remote desktop), the VPN connection isn't even strictly necessary (from a security stand point) as the remote desktop connection itself is also encrypted.  Note that this setting can be optionally reduced by administrative configuration on the network though, so the VPN still isn't a bad idea.


What's the typical approach to caching invalid authentication attempts? Clients (actually software pieces developed by some random dudes all over the Internet) are authenticating on a web server using "basic" authentication scheme and to do so they are passing the username and password with each request. Every time a non-empty username and password is passed the server it has to hash the password and check the username and hash against the database. This puts extra load on the database.

The typical approach to reduce the database load is to cache authentication results in the server memory. It's easy for successful attempts - just cache username, password hash and an internal object representing the user for say 20 seconds. Yes, the user will be able to use the old password for no more than 20 seconds but it doesn't sound like a big deal most of the time.

What about unsuccessful attempts? If I cache them for too long users will see that entering a correct password "doesn't work". Also I'm not sure if I need to cache exactly the pairs of usernames and incorrect passwords (so that altering a password causes a cache miss immediately) or I need to cache just the fact that a specific user failed to authenticate (so that altering a password causes a cache hit and the user cannot authenticate with any password until the cache entry expires).

What's the typical approach to caching incorrect authentication attempts?

The generic approach for a cache is to keep it in sync with the database. Right now you have some system, with RAM, that can decide whether a username+password is correct or not by checking with regards to its RAM contents, letting it flow to the database if the information is not in RAM (or is deemed too old in some way). If you can arrange for password updates to go through the same way, then you can make sure that whenever a password is changed, then the RAM contents are up to date; a simple implementation would look like this:

The RAM cache contains tuples (user, password, ok, age) where "ok" is a boolean value ("true" for: user+password match, "false" for a known mismatch), and "age" is the date at which the information was last used.
When a login attempt for user "Bob" and password "p@ssw0rd1" is made:

If the RAM cache contains a triplet ("Bob", "p@ssw0rd1", z, age) then update age to the current date and time, and return z ("true" on authentication success, "false" on authentication failure)
Otherwise, do the verification with the hash value stored on the database, yielding the result z ("true" or "false"); store ("Bob", "p@assw0rd1", z, now) in the cache, and return z.

When user "Bob" changes his password, remove all tuples ("Bob", *, *, *) from the cache.
The cache has a limited size. If the cache is full and you want to insert a new tuple, remove the oldest one (the one for which the "age" field is farthest in the past). This is called LRU caching (as in "Least Recently Used").

There is no specific reason to treat positive and negative hits differently; either contains an interesting information. Note that there is no need for a time limit here; as long as the cache is updated (or merely flushed) when there is a password change, there is no problem in keeping cache entries for arbitrary amounts of time.

If you cannot update the cache upon password changes, then you need to set a short timeout so that cached information is not used if it is older than, say, 20 seconds (as you envision). There again, positive and negative hits need not be handled differently; in fact, it can be argued that caching negative hits (user+password mismatch) is necessarily safe since, at worst, it keeps users out; caching positive hits can, on the other hand, allow people entry with a password that has been invalidated (though with a 20 seconds timeout, the vulnerability window is quite small).

Summary: caching authentication failures is good, because it is fail-safe (it won't grant entry when it should not). Keep in mind, though, that it won't thwart DDoS: a DDoS-ing attacker will simply send many requests with random passwords, i.e. requests which are never in the cache in any case. Caching authentication failures helps against involuntary DDoS, when a user has entered the wrong password but does not understand it, and clicks on "refresh" repeatedly.


Protecting a document that you sell I have written a short guidebook that I have been selling hardcopy. There is now interest in a digital version. How do I protect this guidebook so only the people who purchase it have access to it? I don't want them to be able to forward it to someone or load onto more than one computer?

In general, this is impossible.  Anything your users can access, they can create an insecure copy of.

That said, this is a problem that people have tried to solve before, and they have come up with some partially effective methods (see iBook or Amazon Kindle, as vcsjones suggested in a comment).  These methods rely in part on punishing violators, so that copying the document, while nowhere near impossible, is difficult and unappealing.


Is automatic E2E encryption possible for chat apps with a backend DB? This question refers to automatic E2E encryption (i.e., the app creates and shares encryption keys, never the user).
Apps such as Discord and Hangouts store messages in a server-side DB thereby allowing users to delete the app without losing messages. Apps such as WhatsApp and Signal store messages on the user's device thereby limiting usage to a single installation of an app at any given time.
In an app where the users create and share encryption keys, the key would be kept constant, and if the user loses the key, previously encrypted messages would be lost. However, in an app which automatically performs E2E encryption, the keys cannot be constant because they can never be stored once per account since that'd void the point of the server not having the key. Is it possible for an app storing messages on a server-side DB to implement automatic E2E encryption?

It is possible, but with downsides.
As always, the security of this depends on your threat model. A possible way to implement it is to generate an asymmetric key pair upon first install of the app, then encrypt the key with a password chosen by the user (which must be different from their normal authentication password). Finally, the encrypted private key and the public key are sent to the server.
This allows users to re-install the application or install the application on multiple devices, since they have access to the private key by decrypting what they receive from the server. Furthermore, the messages sent to other users can be stored on the server in encrypted form.
What are the downsides?
If you don't trust the application developers, then generating a private key using their application or importing a self-generated private key into their application means potential key compromise. In other words, you cannot be certain that their app does not send the private key to the developers for malicious purposes. In fact, it is incredibly difficult next to impossible for developers to write an application which they can prove without a shred of a doubt to not be malicious.
If you are worried about third-parties (hackers, nation state actors, etc.) accessing the server with the encrypted messages, then this approach has downsides in comparison to "plain E2E" as described above. Namely, the attacker has access to all private keys, albeit encrypted, and can work on decrypting each of them. At least some of them are bound to have weak passwords.


Can a PGP private key be deduced if the email text is known? Suppose I send a PGP-encrypted email to person A, and the same email
(same subject line, same message text) unencrypted to person B.
Suppose a secret service intercepts both messages.
The secret service rightly assumes from the identical subject line that both mails
contain identical text.
Does this make it possible for the secret service to deduce my or person A's private key, and decrypt all my subsequent encrypted emails to person A?

No, the private keys are still safe in this case:

Your key, as the sender, is not involved at all in the process. When you encrypt an email to person A, you use A's public key, not your private key. If you use your private key at all, it will be to sign the email you send, which is something quite different.
A's private key is not involved either. You use A's public key for the encryption. If the potential attacker wants to know a message m, and what this message would become if encrypted with A's public key, then... he can do it himself ! A's public key is public, everybody knows it, and everybody can encrypt things with that key.
In the general case of encryption mechanisms, such systems are supposed to resist situations where the attacker can learn several (even many) pairs plaintext/ciphertext. These are called known plaintext attack (attacker learned a plaintext/ciphertext pair), chosen plaintext attack (attacker gets to choose the plaintext, and obtains the corresponding ciphertext), and chosen ciphertext attack (attacker chooses the ciphertext and obtains the plaintext). PGP would be considered quite weak if a single pair, or even one million pairs, would be sufficient to break it.


How to properly protect a private key? I'm a beginner to security, and trying to understand how best to secure a private key. I understand keys should never be stored in plaintext - however, surely encrypting them with another key provides the same problem (but for this new encryption key)...?

The same with key vaults - if you store your key seperately and ping somewhere else which does all your encrypt/decrypt functions, surely an attacker, having gained access to your encrypted data, could simply call the decrypt function and have access to all your decrypted data?

Edit: this is a symmetric key being used to encrypt some data being stored in a database (not passwords, these are being hashed)

Security can actually be splitted in Confidentiality, Integrity, Availability. For the C part, the most secure place is... you brain. If you only have few keys, and they are simple enough to remember (better a phrase with normal spelling than weird spelling on a short word) and you use all of them on a daily base, it is reasonably safe for the two other parts, and you should stay there.

If one of the above conditions is not met, that is is the key is hard to remember (a mere sequence of characters), or if you only seldom use it you should use a password vault like for example Keypass that has good reputation on this site. At the end, they all rely on a master key, but the difference is that you can choose it, and that you only have to remember it. You could think of a simple encrypted file, but password vaults have some goodies (ability to type the password for you, synchronization, etc.) that really worth it.


I can upload any file to an ASP webapp/IIS server but I do not know where (which folder), is this exploitable? I'm able to upload any file to an ASP webapp/IIS server. My first though is to upload an ASP shell but I don't know where the file has been uploaded.

I have written a Python script that beggining with the URLs dumped by ZAP, makes requests to any known folder looking for my ASP file. For example, if I have the following URLs /dashboard and /images and my shell is called myshell.asp my script requests for:

/dashboard/myshell.asp
/dashboard/files/myshell.asp
/dashboard/downloads/myshell.asp
/images/myshall.asp
/images/files/myshall.asp
/images/downloads/myshell.asp

But I was unable to find the file.

I know that there exist certain special files that if present in a subdirectory have special meaning like: .htdocs. But if I don't know the path I don't know how to exploit this.

Is this scenario exploitable? How?

A few things to try:

Brute force a bit harder for directory names, perhaps using Dirbuster
Try to force an error message; this may reveal the path
Is there any way for the user to view an uploaded file? Look at that functionality in detail

If the files are stored outside the web root then this may be non-exploitable. However...

One other thing to look for is local file inclusion. This is where you upload a malicious script, then trick a legitimate script into including your malicious script. This is quite widely seen with PHP sites, but it also works with ASP.