Setting up a secure Ad-Hoc network I am taking my laptop with me on a school bus trip, and I want to use an Ad-Hoc network to host a multiplayer Minecraft server. I have heard, however, that Ad-Hoc networks have a vulnerability that makes it possible for people to access your computer's hard drive. While I doubt that anyone else that will be on the bus with me will know how to do this, I want to be certain that I am protected from this.

I am using Windows 8.1 Pro x64, and I have already verified that in the "Network and Sharing Center", all settings for File Sharing over a network are turned off. (I don't plan to use this with the Ad-Hoc network. If I ever need to share a file, it will be through FTP.)

What could I do to ensure that my network is as safe from this, or any other type of attack?

Note: I do not have a password on my Administrator account. Is this is a concern for protecting my drive from being accessed since I have disabled file sharing?

Ad-Hoc networks are just like regular ones: they are networks hosted by a machine (in this case your computer) that provide some networking functionality. Windows automatically disables wireless methods of file sharing and remote desktop without a password. The only thing bad that could happen (assuming you have a programmer on your trip, which you probably don't) is that your Minecraft server could get overloaded. Make sure you use at least WPA (WPA-2 if your friends' computers support it) so no one else joins it. Just make sure that you don't have a web server installed (if you do, make sure file uploads are disabled, or you might just want to completely turn it off). Just to be sure, I'd recommend using a regular account instead of an administrator account. Also, I regularly poll the Wi-Fi list to ensure no one is making an Evil Twin network (a network with the same name and password that is made to intercept packets). Finally, check the password of your network at howsecureismypassword.net to make sure no one nearby could easily get into your network without spending hours trying to hack into it. If you are going to be sharing files, use SFTP so no one could replace your file with a malicious file. If you have HomeGroup (or whatever it's called) enabled, make sure to disable it.


Anonymity Stack: Home connection -> VPN -> Whonix(Tor) -> Socks5. Few questions on anonymity So let's assume the following:
1. A host machine running a clean BSD-based OS that has no backdoors, malware, spyware or other potentially de-anonymizing harmful software.
2. One home internet connection from an ISP that keeps a close eye on potential Tor usage. The connection is being shared by a couple other devices and people.
3. One solid VPN provider that resides in a non 14 eyes jurisdiction, doesn't have a record of collaborating with intelligence agencies, offers stable servers in a multitude of locations, employs a zero-logs policy running everything from RAM memory and doesn't even ask for account names or emails.Payment was done through bitcoin.
There's no DNS leakage
Internet is blocked in case of connection failure
Traffic monitoring shows that every packet is indeed being routed by the VPN
4. A standard whonix setup(gateway, workstation) running as virtual machines on the host using VirtualBox
5. A list of 1000 socks5 proxies which may or may not have their activity monitored and logged by a potentially hostile 3rd party which will be used at browser-level to access a website

So we have the following schema
Machine -> Home connection/Personal IP -> VPN IP -> Tor -> Firefox ESR with a Socks5 Proxy-> Website

These are my questions:
1. Is there any way in which the ISP can know that we are on Tor and/or using Whonix.
2. Could 'website' ever find out what the originating IP address really was?
3. Is there any way to correlate what happens at the 'website' level with the originating IP address/connection
4. Would using a public internet connection instead make a big difference in the anonymity of the setup?

First, some comments
I'll be frank here. A lot of your setup is poorly thought out or outright dangerous. For example, using a proxy after Tor (it's not TOR) can greatly decrease anonymity as you now have a centralized exit point (even with the use of rotating proxies). This is exacerbated by using a VPN, since now rather than having a protective chain of relays, you have two points, both controlled by individual entities, which can collaborate to fully deanonymize you. But let's look past that for now. Some comments about the assumptions...

One home internet connection from an ISP that keeps a close eye on potential TOR usage. The connection is being shared by a couple other devices and people.

Being shared by multiple people is irrelevant, as TCP/IP fingerprinting is able to distinguish multiple devices coming from a single IP. If you need to reduce the chance of an ISP knowing you are using Tor, you may have to use pluggable transports with a bridge. These are designed to obfuscate the Tor protocol in various ways, though the use of a bridge is only intended if you are being blocked. It is not always sufficient for simply avoiding membership attribution.

One solid VPN provider that resides in a non 14 eyes jurisdiction, doesn't have a record of collaborating with intelligence agencies, offers stable servers in a multitude of locations, employs a zero-logs policy running everything from RAM memory and doesn't even ask for account names or emails.

A VPN being in a non-SSEUR (14-eyes) jurisdiction can actually make anonymity worse, as now rather than going through small ISPs in a "bad place", you are going through the border of a "bad place", complete with all their IXP taps. This can be bad enough that some circuits that go through many topographically distant countries can even lead to complete deanonymization. Furthermore, even if the VPN claims to provide zero logs, their ISP and DC certainly does log, it would be unheard of not to. See this answer which provides an example. I strongly recommend you read it.

Payment was done through bitcoin.

I'm sure you're already aware of this, but bitcoins aren't anonymous. Ensure payment was done with initially anonymously obtained bitcoins.

A standard whonix setup(gateway, workstation) running as virtual machines on the host using VirtualBox

VirtualBox is rather insecure, as are most hypervisors. It can be especially vulnerable to leaking graphics information when hardware acceleration for graphics is used. Whonix is best used with physical hardware isolation, so a simple 0day in the hypervisor will not bring down your whole anonymity system. Using hardware isolation will reduce the attack surface to that of the networking protocols, Tor control port, and SOCKS protocol.

A list of 1000 socks5 proxies which may or may not have their activity monitored and logged by a potentially hostile 3rd party which will be used at browser-level to access a website

This is dangerous, far more dangerous than using plain Tor exit nodes. Chances are a large number, if not all, of these proxies are managed by a single entity. This makes it far more dangerous than Tor, where each exit tends to be operated by a different entity.
Furthermore, there is the risk of the proxies being too close to your guard or VPN topographically (or even on the same subnet!). Tor ensures that none of the three relays in any given circuit are too close, but this guarantee breaks down as soon as you use "extra" proxies. If your VPN or guard and one of the proxies is part of the same DC, it can completely deanonymize you. This goes against "anonymity 101 common sense", but is quite true. There's zero chance that there will be no extensive monitoring between the border of your country and your "safe, non-SSEUR country", but there is a non-zero chance that there will be no monitoring at the junction between two small ISPs in the same country.
In the case of you -> vpn -> node1 -> node2 -> node3 -> proxy -> website, The three nodes are guaranteed not to be too close, topographically. There is no way for Tor to guarantee that vpn and proxy are not right next to each other, blowing your anonymity. This is the same reason using Tor over Tor is a horrible idea.
You may want to read Measuring and mitigating AS-level adversaries against Tor, which explains this phenomenon.

Machine -> Home connection/Personal IP -> VPN IP -> TOR -> Firefox ESR with a Socks5 Proxy-> Website

You should absolutely not be using plain Firefox ESR, even with "privacy" extensions. You should only ever use Tor Browser, or you will be subject to completely accurate fingerprinting (for example, through audiocontext fingerprinting). There are more than a dozen extremely important features which Tor Browser provides which are lacking on Firefox ESR and cannot be implemented in addons, requiring patches to the source code as well (like Tor Browser's reduced timing granularity of javascript.now()). Tor Browser is far more than just Firefox and a few addons.
To answer your questions, though...

Is there any way in which the ISP can know that we are on TOR and/or using Whoenix.

Yes, it can know you are using Tor. A VPN typically uses UDP or TCP for communication, and there is no padding. Tor on the other hand uses its own protocol, where data is sent in groups of cells of 514 bytes each (previously 512). This means that your ISP will see VPN traffic going through in bursts of 514 bytes, indicating use of Tor. There is likely also a way to determine that you are using Whonix with a high likelihood of Whonix makes any unique connection attempts at startup (such as update checks) that could be detected through a type of passive fingerprinting called website fingerprinting.

Could 'website' ever find out what the originating IP address really was?

Potentially, if it was coordinating with an entity that could see both your proxies and your VPN. Other than that, no, not with your first assumption in place, assuming it also extends to 0days and not just backdoors.

Is there any way to correlate what happens at the 'website' level with the originating IP address/connection

See previous answer. This question is basically the same as your second one.

Would using a public internet connection instead make a big difference in the anonymity of the setup?

That depends on many factors. A public internet connection may have more fine-grained logging. It may be subject to attacks on the WiFi protocol. Unlike a hardwired home connection, a public wireless connection allows countless others in close range to determine your unique hardware (MAC address randomization is not enough), and potentially mount website fingerprinting attacks.
Recommendations
Rather than just criticizing this setup, I think some recommendations are in order.

Use Whonix with physical isolation, or Tails.
Use stock Tor Browser with the security slider set to high, without any other changes.
Install open source firmware on your router such as OpenWrt.
Do not use anything extra like a VPN or proxy.
Ensure all your software is up to date, and keep track of disclosed vulnerabilities.
Avoid WiFi because of fingerprinting attacks from a local adversary and insecure WiFi chips.
And as always, be mindful of your OPSEC.


OWASP Client-Side Testing - How To In the OWASP Testing Guide, it has a whole section called "Client-Side Testing." This section has to do with testing for things such as DOM-based XSS, JavaScript execution, HTML injection, Client-Side URL Redirect, etc. The examples in the testing guide for the first four vulnerabilities (the ones I just listed) all include code that access document.location.

My question is, what other ways are there for these kinds of vulnerabilities to be introduced into a web page without accessing document.location (or window.location or just plain location)? In other words, if a page does not ever access document.location, is it definitely free from these vulnerabilities? If not (and I'm sure it's not), could you please provide some other examples of vulnerable code?

I am the current lead of the OWASP Web Security Testing Guide.
What you are asking for are sinks, which are mostly found in DOM XSS attacks.
Version 4.2 of the guide will be released next week. We have mentioned the term sinks, and to help further with your question, I will add references where possible. In versions to come, the team will add more to the topic to make it easier to read and understand, with more information in them.
Sources are the injection points, sinks take that input and manipulate either in a safe manner or in an abusive manner.
For more on what you're asking, the domxsswiki is a great read.
Update: PR related to this matter


Use a Pre-Calculated Hash for Signing a File with GnuPG When using GnuPG to sign a file, one usually uses something along the lines of:

gpg2 --detach-sign --armour <file-to-sign>

Now, let us assume that for some reasons in company X signing of releases is only possible on a remote machine. Signing involves the calculation of a cryptographic hash of the file to be signed and that hash is then encrypted with the private key. In the above company, one would have to transfer the release file to the remote machine, sign it there, delete the file again and publish the signature alongside the release file.

With large releases and slow connections, signature generation can take up hours and company X's boss does not like that, so the employees must find a faster solution.

The fast solution is to calculate the cryptographic hash of the file locally and pass the hash to the remote machine to make a signature using this hash. The idea would be to use something like:

gpg2 --detach-sign --armour --input-is-ALGO-hash <hash-for-signature>

But, how would you do that in a way that makes the resulting .sig file indistinguishable from one generated by GnuPG calculating the hash and signing it? Are there any disadvantages to this security-wise?

I'm pretty sure there's no way to make it indistinguishable with standard GnuPG. GnuPG is open source so you could of course modify it, and it implements an open standard so you could use another implementation (that can get/use the signing key) which is probably easier to modify, such as BouncyCastle at least in the Java version (which I use; I'm not a dotnetter) (although whether you can install Java on a security-significant system may be an argument on its own).

An alternative which is fairly common and accepted IME is to use two stages:

use sha1sum (no longer preferred) or sha256sum or similar to create a (small) file e.g. 'hash' containing the name and (hex) hash of the real file(s); if there are multiple component and/or variant and/or otherwise related files in one logical release, you can put multiple hashes and names into one 'hash' file
PGP detached-sign or clear-sign the small 'hash' file

The recipient correspondingly

PGP verifies the 'hash' file
uses sha256sum -c hash or similar to verify the real file(s) match the hash(es) in the 'hash' file

This allows a recipient who doesn't have a PGP implementation (or can't get or doesn't trust the signing key, but that's less likely) but who can get the 'hash' file securely enough, e.g. from an HTTPS website, to verify the file(s), which would range from hard to impossible with only a PGP signature.

Obviously you need to make sure that the hash value(s) in method A, or the 'hash' file in method B, is transferred from the hashing maching to the signing machine by a channel that can't be blocked or tampered by any adversary, as well as each of them being secure on its own.


How zip symlink works? I've seen lately some bugs that used zip symlink technique , can anyone explain how this vulnerability works , how attackers use it to exploit applications?

Thanks

Symlinks are like shortcuts, so if you create a symlink pointing to /etc/passwd, when you open the symlink your O.S. will open /etc/passwd.

How the attack works?

1) Create a symlink in your computer to /etc/passwd

e.g.: ln -s /etc/passwd ./symlink.jpg

2) Create a zip with the symlink

e.g.: zip —symlinks -r photos.zip ./symlink.jpg

3) Upload the photos.zip to the target server.

Let's say the server unzip the file in the following address: vulnerable.com/user/10000/images/

If you access vulnerable.com/user/10000/images/symlink.jpg you will see the server's /etc/passwd.

Why do you need the zip trick?

If you upload the symlink direct to the target, in this case, you will actually be uploading your own /etc/passwd, so you need the zip (with the -symlink argument) to conserve the characteristics of your symlink.


Was my password copied? I work locally with a WordPress site. When I logged in, it looked like the password was highlighted. It went very fast. Half a second maybe. I found it strange that it looked like it was marked, as in the image below.

The reason I am a bit vigilant is that I have a another site with a special login URL that only the owner of the site and I know about, but sometimes there are unknown login attempts there. Could my PC be hijacked? A trojan? How can I find out?

No, it's not a virus. The following xkcd comic illustrates this well:

CC-BY-NC 2.5: Created by Randall Munroe, xkcd

As you can see, the events you described have nothing to do with a keylogger, a virus, a trojan or what InfoSec professionals generally refer to as "malware". If you really had a malware infection, you would not notice it, and all the security precautions such as "using a secret URL to log in" would be meaningless anyways.

So why was the password marked when you clicked login? God only knows, but malware does not need to "mark" a password to copy it.

As for the invalid login attempts you noticed, this is absolutely normal background noise on the internet.


Reauthenticating a user for sensitive actions using OpenID Normally, when you perform sensitive actions on a website, such as changing your password or enabling two factor authentication, you are required to reenter your password, presumably to protect against session hijacking (either due to interception or someone physically using the computer). However, if a user registered using OpenID or using an OAuth authentication provider such as Google or Facebook, reauthenticating has limited use against someone physically using the computer because the user is still likely to be logged into their Google/Facebook/etc account, so there is no password reprompt. It would still protect against a session ID being stolen and used to add a local password, but if the site operates over HTTPS then this isn't a major concern.

Is there any way to verify the authenticity of the request to, for example, add a local password to an account that has previously only used an external service to authenticate logins, or is it just a risk that has to be taken?

It is reasonable to think that a particular user may have many different privileges on a site, some of greater and some of lesser sensitivity. In OAuth land, the dance delivers a token to the user, and the site against which the token is valid will have defined the privileges that token enshrines.

So the site can decide to just include privileges tied to the specific request the user made that initiated the OAuth dance, which can be narrower than the full set of rights that that same user may have on the site.

Should then the user- whose authorization is embodied in that token- desire to perform some action that is not permitted by the privileges provided by the token, the site can refuse to allow them to perform the action, and can provide the user with another opportunity to re-initiate the OAuth dance, even if that involves the user re-entering their same credentials.

This isn't great for usability, but it is permissable.

That said, the specific cited circumstance- changing a "local" credential- should perhaps not be thought of as a problem to solve. Multiple sources of truth for authentication are often not a good idea.


What is the limit of the number of keys an HSM supports? I am pretty new to HSMs, and I need an HSM that supports a large number of keys (around few hundred thousand at least).

Is there a limit in a number of keys an HSM support? I can't seem to find this information anywhere, I get the performance data (measured in transactions per second which is usually between 1 and 1000 for the 1024 RSA keys).

However, I am unable to find the key storage capacity. What should I search for? Are there any data for certain HSM telling how many keys it supports?

I talked to our HSM expert in house. His answer was:

  Errhmm, that's not what HSMs are designed for.

The use-case that engineers had in mind when designing them is like a root certificate authority key, or high triffic web server TLS key; something where a single key needs to do a large number of signature operations.

HSMs will have a finite number of "slots", and each slot can have a finite number of "objects" (ie keys). On really big HSMs you might get up to 5,000 slots with up to 100 objects each.

Because this is a software limitation, not a hardware one, it would be possible to get one big slot with an unlimited number of keys in it, but you may need to place a custom order with one of the big HSM manufacturers to get customized software.


ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? Misc Situation:

-Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/

-Server password is then changed, hacker can still run script by navigating to their file on the server which will run upon their request (I am assuming?)

Question:

Would a combination of changing the server login password as well as adding a password protected .htaccess file to / stop the hacker in their tracks? Or can an .htaccess still be avoided in terms of rerunning the hacker's script?

I am very new to server security but am eager to learn anything and everything anyone can tell me! I highly appreciate any and all advice. Any  recommended knowledge resources would also be fully utilised!

OUR SITUATION:

Here is the information provided to us by our host.

your Server/Customer with the IP: * has attacked one of
our servers/partners.
The attackers used the method/service: bruteforcelogin  on: Sat, 14
Nov 2015 -exact time provided here-.
The time listed is from the server-time of the Blocklist-user who
submitted the report.
The attack was reported to the Blocklist.de-System on: Sun, 15 Nov
2015 -exact time provided here-

Here is some more:

Lines containing IP-ip here-:
NOT SORTED (from many different Machines)!
DESTINATION-IP:
-ip info here-

DESTINATION-IPs:
-ip info here-

-ip here- - - [14/Nov/2015:-exact time provided here-] "POST wp-login.php
HTTP/1.1" 200 4366 "referer-domain.tld" "Mozilla/5.0 (Windows NT 6.1;
WOW64; rv:40.0) Gecko/20100101 Firefox/40.0"

-ip here- - - [14/Nov/2015:-exact time provided here-] "POST /wp-login.php
.... truncated ....
0"POST wp-login.php HTTP/1.1" 200 4366 "referer-domain.tld"
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101
Firefox/40.0"

-ip here- - - [14/Nov/2015:-exact time provided here-] "POST wp-login.php
HTTP/1.1" 200 5117 "referer-domain.tld" "Mozilla/5.0 (Windows NT 6.1;
WOW64; rv:40.0) Gecko/20100101 Firefox/40.0"

Regards,
Jay.

Changing the server password or .htaccess will very likely not do anything now as the hacker has already gained access and installed malicious software on the system. On a Linux system I would at first check (as root) what sockets are open and what processes are using them:
netstat -anp | less
netstat -anp lists all sockets with the owning process and piping it into "less" allow to scroll through the list.
If the server is a dedicated server you can capture the traffic by using the tcpdump utility and analyse it with for example wireshark. VPSs often do not allow sniffing.
However if the hacker was clever and has covered his/her tracks the system may not display the sockets used by the malicious program. In this case a detailed security check of the entire system is needed.


Broken into my office, HDD/SSD stolen. How secure is Chrome password saving feature? I'm working as a developer in a shared office space, and today when I came to work, my PC no longer booted into windows, only UEFI with error -> couldn't find the primary SSD. I opened up the case on the side, and I saw that my SSD has been removed.

It's the main SSD where I had the Windows 10 installed, all programs, as well as dropbox, documents, and pretty much all important files.

Though everything has been backed up to dropbox, and I am using LastPass chrome extension to save my passwords, I do know that Chrome still has saved several passwords directly, from before I started using LastPass.

Obviously I've already changed all passwords on all my websites, but I am still curious. If someone has full access to my physical SSD now, how hard is it for them to get access to all the saved passwords in Chrome?

Change all passwords now

Most online password stores are all pretty secure at protecting the data over the wire and while it is sitting in the server center ... but if it is sitting in your browser on your physical device it is mediocre at best and terrible at worst.

If chrome starts up with out prompting for your password ... you're toast!  They have them all in plain text.
If chrome requires a login, I believe the passwords are still encrypted and stored on the local computer ... which means they can decrypt them (different than cracking a hash).

Either way, your best bet is to change all your passwords RIGHT NOW.  I would start with the high value ones like Email, Bank, Stocks, and then work towards things that have access to your payment creds like online stores, and then social media which might seem like the most important but is less likely to crush you long term.


Is possible that a TLS server send more than one certificate to the client for the same site? What I'm trying to archive is enable ECDSA and DSS ciphers in my site, but at the same time not depend just of self signed certificates, so I could sent to my client more than one certificate and them could select ECDSA and DSS over RSA if they can verify my self signed certificate, and if not, fall back to a CA signed certificate and refuse ECDSA and DSS.

Strictly speaking, the server can send an arbitrary number of certificates to the client, as part of its Certificate message. However, as the standard says:

  The sender's
        certificate MUST come first in the list.  Each following
        certificate MUST directly certify the one preceding it.

Therefore, a really compliant server cannot send a choice of certificates to the client, and cannot expect clients to use any other certificate than the first one they send.

For signature algorithm support, there is a standard TLS extension specified in section 7.4.1.4.1, by which the client can tell to the server, early in the handshake (in the ClientHello, which is the very first message of the procedure), which hash functions and signature algorithms it supports. This allows a server who owns, for instance, both a RSA-signed certificate and an ECDSA-signed certificate, to send one or the other, depending on what the client supports. This is typical of how things go in TLS: the client suggests, the server chooses.

(In practice, support for this extension is not yet widespread. But, also in practice, everybody uses RSA and supports RSA.)


How to get hold of and use WPA session keys? I'm testing sniffing and decrypting my WPA2 wifi network traffic. But when using airdecap to decrypt the capture file (created by airodump) using my WPA passphrase I only get broadcast traffic. If I understand it correctly (after reading the question below) that's because I have to capture session keys when other users start their sessions. So my question is how do I capture and use session keys to decrypt traffic in the capture file? I know I can force clients to deauthenticate but somehow I guess I have to extract the session keys and use them in e.g. Wireshark.

Any advantage to securing WiFi with a PSK, other than to keep out unauthorized

In Wireshark, filter for "eapol" packets. You can read RFC 4764 to figure out how to derive the encryption key from those packets, or look at the Wireshark decryption source code.

They say this exchange pattern is for the sake of simplicity, though I consider not using a Diffie-Helman exchange to have been foolish (see section 1.1.1).


Is XSS and HTML injection the same? When doing a XSS, we usually put the JavaScript code between the <script> tags.

I have noticed that HTML injections are very similar because you are doing almost the same thing, but using different tags (e.g <h1>, <p>, <span>, etc.)

The result might very different. When doing a XSS attack, you might create the usual popup with alert(), while doing a HTML injection you might put some fancy text onto the webpage.

XSS is the ability to execute javascript code (i.e. alert(1)). HTML injection is the ability to execute HTML (such as <p>, like you said).
Often they go hand in hand.

When <script> tags are deleted by a filter of the web app, attackers can often still achieve to execute javascript (XSS) by leveraging HTML injection through:

<img src='x' onerror=alert(1);>


text with .fyi attachment I occasionally get texts from numbers I don't know.  My standard procedure is to delete and not give it another thought. Lately, I have received texts with attachments that look like this; Tap to load preview fkhlkf.fyi

What is a .fyi attachment and is it potentially dangerous to my phone?

Carol

There are no common file types with the extension ".fyi", but I suspect that the real extension is hidden somehow; it may well be a malicious APK or similar.

As-is they pose no threat to you unless you try to open them.

My advice would be to continue what you're already doing - delete the message and block the number if possible.


Security of using passwords or even passphrases to encrypt files Is it ever appropriate to use real-world passwords to encrypt files to be sent via unsecure means.

By real world, I mean a password that is memorable and memorisable by a mere person?

I am implying that in order to securely encrypt a file you must follow this guidance:

Use a long random password with enough bits of entropy to give a secure symmetric key.
Think carefully about data sensitivity relative to Moore's Law(i.e. what is the impact if this data is read in 10 years from now by the more advanced computers)
Think carefully about how to transmit the password to an authorized party (offline delivery of password)

In the light of this, I would suspect that asymmetric encryption of files are very much better in security terms than symmetric password encryption all other things being equal.

You are thinking of two things:

Kerckhoff's principle. The main idea is that the key needs to be the secret. If any part of your system requires the algorithm to remain unknown, your system is in deep trouble. The term for any system that requires the secrecy of the algorithm is "security by obscurity" and it is derided as terrible, because it is terrible. The national security agencies get away with it because they also ensured that even with classified hardware, Kerckhoff's principle still applies. This is why when John Walker started handing over code strips to the Soviets, they didn't have the hardware, so they convinced the North Koreans to seize the USS Pueblo. The NSA knew that the machinery seized would be worthless without the keying material - not knowing that the Soviets were getting a complete set of code keys for most of the US Navy.
The entropy of your password. Shannon determined that the entropy of English words ranges between 0.6 and 1.3 bits per character. This means that if you need 40 bits worth of entropy for your key, and you pick English words, you'll need pass-phrases between 31 and 67 letters long. This is behind the reason folks ask for upper & lower case letters along with digits and symbols: to increase the entropy.


What is good metric for detecting data exfiltration on covert channel? Considering the scenario when the attacker is able to exfiltrate sensitive data from compromised system to external network or Internet, but there are only limited ways to achieve this because the outbound connection is configured to not allow connection on any application layer protocol based on TCP, so the attacker decided to exfiltrate data via DNS which are allowed by the configuration (Yes! this is the mistake).

In my opinion, there are two ways to detect this kind of exfiltration:

Content-based: the content of transferred data must be inspected to find sensitive data or anything such as file signature, header or file properties.
Volume-based: the amount of data must be compared with data usage baseline. If the current volume of data (in some amount of time) is larger then data usage baseline, then w00t w00t!

These are my questions:

Is there any other effective solution to detect data exfiltration in the scenario like this?
For the volume-based detection, is there any recommendations to calculate data usage baseline? Only average data usage for a month is good enough?

DNS and ICMP are not good examples, because in a well configuration, network access is restricted by use of a proxy to thwart DNS and ICMP right from the start.

But there‘s HTTP(S) still available through the proxy.

Usually, websites are not whitelisted in a proxy, so this should work quite well.

As to the content inspection:

You can not do that in general. Even if you have a HTTPS proxy that is doing a MITM, the request payload might still be encrypted within the transport of HTTPS which cannot be scanned for key words.

Additionally, you may not be allowed to MITM for example banking sites for inspection due to normative regulations.

You can however try and find encrypted payload streams in HTTP(S) traffic and analyze them, in the mean time blacklisting the destination hosts.

While volume based exfiltration detection seems like a good plan for DNS and ICMP, for HTTPS it is not as there might be legitimate traffic exceeding your threshold resulting in a big number of false positives and possibly business disruption.

A combined approach would maybe work, maybe with a white list of domains that are safe to upload data to: if you find a significant amount of data is sent through the proxy, you could blacklist the destination if it’s not on the white list and analyze the traffic manually. If the exfiltrated data is small in size, you might still not get it.

All in all: that’s the problem with covert exfiltration: it’s hidden well.


Can Untrusted Admin decrypt HTTPS traffic in Linux without Server Private key? I have studied how SSL/TLS works when we use HTTPS connection. After authentication stage is over, using Diffie–Hellman  both client and server share secret session key which is used for encryption/decryption.

I have also read using Wireshark or Fiddler one can decrypt HTTPS traffic in case Server private key is known and when Diffie–Hellman is not used for exchange of secret session key .

I have following doubts with respect to my Linux System -

(1) In case my root/admin password is compromised or my admin becomes untrusted, will the Intruder with root permission / untrusted admin can retrieve Secret Session Key used for HTTPS communication (With Known Server private key) and still able to decrypt the HTTPS traffic?

(2) Can I say with 100% confidence that without Server private key, it is not possible to decrypt HTTPS traffic even for an root/admin user? (This is the reason HTTPS is used).

(3) Is it true, when Diffie-Hellman is used to share Secret Shared Key,the connection is 100% secure , means no tools are available to retrieve decrypted HTTPS traffic?

Any help to clear my doubts or relevant links will be highly appreciated. Thank you in advance.

When SSL handshake starts, the first step is, server is authenticated using a private key associated to the server's certificate.

In a 2nd step, client and server exchange a session key used to encrypt the payload of the connection.

The session key is used for one session means when the session is closed the same key can't be used to encrypt the traffic of another session.

Now the problem is SSL often use RSA cipher suites in which the session key is derived from private key. So the session key can be calculated in future if the underlying private is known.

DHE and ECDHE provides Perfect Forward Secrecy(PFS), means session keys are not derived from private key. So the attacker cannot decrypt the traffic even when he has the private key used in the session handshake.Also Session key is not generated by client & nor derived from private key. Session key is not encrypted/decrypted/transmitted


Can you submit a CVE for a closed source not mentioned platform? I noticed that there are a list of Platforms/Vendors for which a CVE can be applied for.

What happens if I find a CVE for a proprietary platform (that is commercially available), is there a way to get a CVE assigned for it?

Different vendors require different steps to be taken in order to get a CVE ID assigned for vulnerabilities.

If you check the MITRE CVE ID Request page here then you can follow the instructions to request an ID after locating the correct CVE Numbering Authority.

If the vendor is not specifically mentioned in any of the tables and a relevant CNA is not listed then you have to contact MITRE directly to request a CVE ID by filling out the form here.


SQL injection on query (MySQL/PHP) First, sorry if my issue is a duplicate! This is an exercise that I can not solve.

It is an authentication, simply. But the problem is that the application does not check both the password and nickname. A code is worth a thousand words:

if ( isset($_POST) && (!empty($_POST['login'])) && (!empty($_POST['password'])) ) {
  $sql = "SELECT password FROM auth WHERE login = '". $_POST["login"] ."'";
  $req = mysql_query($sql) or die(mysql_error());

  if (mysql_num_rows($req) > 0) {
     $data = mysql_fetch_assoc($req);
     if ($_POST["password"] == $data['password']) {
        $_SESSION['logged'] = 1;
    header("location:panel.php");
    die();
   }
  }
}

As regards the scheme of the database, all I know is that it has the LOGIN and PASSWORD field and the password is not hashed.

My initial idea is to cut the SELECT and INSERT to add just after my own admin, because I do not see how overstep the query as usual it could be admin'; #

I have try : admin'; INSERT INTO auth (login, password) VALUES ('admin2', 'test');# But.... doesn't work !
Can you help me ?

Thanks.

You can use UNION SELECT to supply any value as a password:

noone' UNION SELECT 'pwd

The query will become

SELECT password FROM auth WHERE login = 'noone' UNION SELECT 'pwd'

Make sure to submit the same password via POST


Protecting payment mobile app against mobile theft Currently I'm designing a payment app.
It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not sure how to protect the user against a mobile theft.
A thief can reset the password due to the fact that the user usually signed in to the email app, biometric authentication can be easily bypassed due to compatibility and UX requirements, secret questions are usually easy to guess.

Are there any other measures that can be done in order to eliminate damage from mobile theft?

Let us review the basic access control corning stones with their pros and cons relating to your case of device theft:
Something you know
Referring to passwords, passphrases, PIN codes, secret questions.
Pros:
It can be a hard time for the thief to "crack" this factor as is, especially if you enforce a strong policy.
You can mitigate the concern of resetting the password through an email using a challenge (e.g strong secret question, perhaps recent activity based) as a must step for the password reset.
e.g:

Where did you make your recent payment? to whom?

Cons:
This is considered to be the weakest factor among the others I will mention, and indeed in case of theft, it will be easily changed without the abovementioned mechanism.
Something you have
A physical token that your application can scan using RFID, NFC, etc.
Pros:
Provides a higher level of security as long as the token is not near the device itself
Cons:
Pricey, perhaps overkill. User experience might be bad as well.
Something you are
Biometrics; fingerprint, iris scan, voice analysis, behavioral analysis (continuous authentication)
Pros:
Considered to be the strongest factor, industry standard, most of today's devices have this hardware in place for you to utilize.
Cons:
Biometric authentication has its errors; false rejection of the user and acceptance error of an unauthorized entity (e.g: printed picture, looked alike person, etc)
TLDR:
you can enforce a strong secret questionnaire upon sensitive operations (transactions, password reset requests, etc), you can add a physical token or verify the client upon sensitive operations based on biometrics


Why do we keep our keys secret, rather than our algorithms? On almost any website that relates information about cryptography in general there is this common notion that almost all encryption/decryption algorithms should use a key as one of their inputs. The reason behind this is that encryption algorithms that don't use a key are  technically useless.

Because of this I cannot help but wonder how they came to that conclusion. Why is it that the common trend in cryptography is to keep the security key a secret but allow the encryption and decryption algorithms to be public. What if both the encryption and decryption algorithms were the secret? In that case there would be no need for a key anymore and it would simplify things a great deal.

For example: suppose I am a software developer that wants to send textual messages from one computer to another (and back) to allow communication (a simple chat app). Suppose the computers are communicating with each other over an insecure network with the TCP/IP protocol. Suppose that I want to ensure their conversation some privacy and come up with this very basic "encryption" algorithm in which I simply add 10 to each ASCII code for each letter in the plaintext before sending it as raw bytes over the network. As such a message such as "Hello, brother!" would be intercepted by any attacker as "Rovvy6*l|y~ro|+".

How can anyone intercepting the message reconstruct the original plaintext if they had no knowledge of either the encryption or decryption algorithms? What would be the best approach to breaking this cryptosystem? Is it really that easy to somehow break encryption schemes that don't use keys, that they are not viable solutions?

Finally, if you want to say something like "Well....you don't need a genius to figure out that you're just adding 10 to each byte of the plaintext", I did that for simplicity's sake. If you want to make the message even more cryptic then feel free to imagine the mathematical formula being a lot more complex (such as adding 7 then subtracting 10 and then multiplying by 2).

We don't just want secrecy. We want quantifiable secrecy. The point is not only to ensure confidentiality of data, but also to be able to know that we indeed ensured confidentiality of data.

When we have a public algorithm and a secret key, secrecy can be quantified. For instance, if we use AES with a 128-bit key, then we know that an attacker will have to try an average of 2127 possible keys (i.e. way too many to actually do it) to find the right one.

If instead we tried to use a secret algorithm, then we would face three big challenges:

As @Xander explains, making a secure encryption algorithm is awfully hard. The only known method which offers some decent reliability is public design: publish the algorithm, let loose hundreds of cryptographers on it, and see if they can find something wrong in it. If, after a couple of years, none of them found anything bad in the algorithm, then it is probably not too weak. With a secret algorithm, you have to do all that cross-review work yourself, which is not feasible in any decent amount of time.
We do not know how many "decent encryption algorithms" can exist. An attacker may try to enumerate the possible algorithms, were "possible" means "that which the designer may have come up with". Part of the issue is in the realm of psychology, so quantification will be hard.
A secret algorithm still exists as source code on some computer, compiled binaries on some others, and in the head of at least one designer. Unless all the involved development computers and the designer's corpse were dissolved in a big acid cauldron, it is very hard to prevent that "secret algorithm" from leaking everywhere. On the other hand, a secret key is a small element that can be more efficiently managed and kept secret (stored in RAM only, possibly rebuilt from a key exchange algorithm like Diffie-Hellman...).

Since the algorithm will probably leak, you may as well consider it public and rely only on the secrecy of the key. By actually making the algorithm public, you may then benefit from extended review by other people, which is an almost unavoidable precondition for achieving security.


Linux runlevel configuration security I am testing Linux configuration security checking tools recently and I downloaded a tool called lynis. One thing it checks is the default runlevel. However, even after reading some info about runlevel, I still don't understand why checking runlevel is relevant to security.

I read the following source:
Configuring Linux Services and Runlevels.

What can go wrong if I configure the runlevel wrong? And which level could be undesirable?

Runlevels determine what services are started on Unix machines. Usually the higher the level, the more distinct processes are executed. As a general rule level 3 does not include GUI and level 5 does.

There is no right or wrong runlevel. It's about compliance.

The problem might arise when you secure your server assuming it's running without a graphical environment (thus for example you don't harden or patch it), but in reality it does (so the attack surface is larger than you assumed).

The checks are there to make sure the machine is running at the level you expect it to run; and that it runs (only) services you expect it to run at the specified level.

  And which level could be undesirable?

Any level different from the policy specified for each individual server is undesirable.

  What can go wrong if I configure the runlevel wrong?

In such case you cannot claim you have a full control over your systems. You don't know what processes they are running, you can't tell if those processes are secure. You can't tell what can go wrong.


Pickle Shellcode Import Error I'm trying to execute pickle shell-code through a download function on a website but I get the following error:

ERROR: Cannot load file

Pickle Shellcode:

cposix
system
p1
(S'sleep 30'
p2
tRp3

I assume this is a path issue and I also can't import modules by filename. Keep in mind I'm using an LFI vulnerability to call my pickle shell-code.

Example: http://example.com/download?file=../../../pickle.txt

Could this be the cause of the issue?
I should also note this is a CTF, so it should be vulnerable in one way or another. Thanks in advance!

ImportError: No module named posix

Is the problem here. You can either attempt to drop to a bash shell and use

pip install posix

Or the best solution is to just remove

import posix

and replace it with

import os


Why do I need a certificate to pin an SSL connection with AF Networking 2? I am using the AF Networking 2 library and read that I need to include the server's certificate here.

The client should be able to tell that the certificate is valid when it connects to the server, so why do I need to include a copy in my code?

It is specifically because you are doing pinning.  This would allow it to work regardless of if you had a self-signed certificate or a CA signed one.  Basically, you are including the certificate with the application and telling the application specifically "this certificate is valid".

While this does prevent connecting to a different certificate and should allow for use of a self-signed cert, it also complicates revocation of a certificate quite severely since the application would actually have to be updated before you could update the server side certificate.

Personally, I'd avoid using a library that required this.  Even if you wanted to do a self-signed certificate, the better way to do it is to setup your own CA and tell the application to trust the CA root certificate.  Then you can still do normal revocation and change the certificate.

The library you are working with may or may not support this, but that part would be a programing question rather than a security one.


Operating system encryption of a Virtual Machine I am a MacBook Pro user but sometimes I need to manage very sensitive data on Windows Seven. I am running Windows Seven on a virtual machine using Parallels Desktop v10.2.1. This software already has (in the security tab) an encryption option that I already use but, since I haven't found any information on how this method works (and how secure it is), I would like to proceed in another way.

I would like to have my VM encrypted and isolated (no shared files have to be saved on Mac). I tried the Operating System Encryption using Veracrypt from Windows directly but I got stuck when the software asks me to burn a recovery CD because my MacBook doesn't have CD reader/writer.

Any suggestion on how to bypass this problem or solve it in any other secure way?

Thank you in advance!

Depending on the Windows 7 version you have, you could use the built-in Windows BitLocker.

But please notice that this would be an additional encryption within the VM and not from your Mac's point of view.

See here for a more detailed description and a step by step guide for BitLocker


How can I publish data from a private network without adding a bidirectional link to another network I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: Let's say I have a network of devices that controls some kind of critical infrastructure and I don't want anyone to be able to access it except for the people on-site. However, I'd still linke to send diagnostic information without notable delay to a remote server that can be accessed from the internet.

Assumptions about the attacker:

can break into any system that is connected to the internet
does not have physical access to the private network

So we can't just put a server that acts as a firewall between the public and private network, because every software has flaws and the attacker would gain access to the private network as soon as the firewall has been broken (except if we had a firewall where the rules are embedded in hardware or for some other reason impossible to be modified without physical access. Are there such devices?)

What could solve the problem is a device that physically allows only unidirectional communication (in our case from the private to the public network). I don't know if there are any such devices, but I came up with some ideas:

use any kind of write-only media, like CD-ROMs. Issues: high latency and requires specialized hardware to automatically move CDs between machines.
paper printer/scanner setup: Have a printer in your private network that feeds directly into a scanner that is connected to the public network. Latency reduced to just a few seconds, but error-prone due to OCR.
Fiber-optic communication: On the side of the receiver, physically remove the optical transmitter (or remove the receiver on the other side), therefore only unidirectional communication is possible. Probably won't work with Ethernet though (are there any network protocols that properly handle unidirectional communication?)

Before I continue to make a fool out of myself because I've missed the obvious solution, I'd love to hear your comments on this :)

You can use a serial port. By default there are two data lines, one per each direction, plus a ground wire (which is irrelevant here). By disconnecting the appropriate line you can prevent communication in a certain direction.

It's really easy to use it, at the very basic level I think you can run something like echo hello >> /dev/ttyS0 and receive it with cat /dev/ttyS0 at the other side. There is no complicated network stack to work around (which would prevent unidirectional communications as it would treat the lack of response as packet loss) and most languages have easy to use libraries to talk over serial ports.

Here's an example in Python on how to send some JSON over serial:

import serial, json
s = serial.Serial('/dev/ttyUSB0')
data = json.dumps({"status": "OK", "uptime": 60}).encode("utf-8") # make UTF-8 encoded JSON
s.write(data + "\n") # send the JSON over serial with a newline at the end


How does Android prevent me from installing custom system services? I am trying to understand the secure boot process. Lets say the firmware is locked and only does signed installation of an OS image. This "image" is a compressed bundle of all the binaries needed by the system. So once these are installed they are laid down in the filesystem. After that why can't I copy some other binary onto the device. How will the system know that its not part of the original installation?

Does Android have signature verification on individual binaries before they are loaded? Without this I am not sure how it can be done.

Assuming there is no binary signature verification at load time, I can think of this -- The root file system will be mounted read only and only the SU service will be able to remount it in rw mode when doing the SU. And, the 'mount' and 'su' programs will not be part of the install (among other programs). Will this be enough to prevent someone from installing custom binaries into the root partition?

On older versions of Android, this protection didn't exist, and a lot of root exploits for devices used this to their advantage. Newer versions of Android use dm-verity in the kernel to ensure that no part of the system partition has been tampered with, by checking signed hashes of each block. They also have a chain of trust going through the bootloader and back to the SoC to prevent simply removing this feature from the kernel.


End to end encryption with multiple users I'm working on an app where I want to provide end to end encryption on files, where multiple users are able to access these folders. I'd like the encryption to be as transparent and frictionless as possible (I don't want users to have to manage their own keys), so I've been considering ways to do this.

The requirements for this protocol are:

Users do not have to manage their own key
Users must be able to use it from multiple devices
On changing device, users must still have access to their old files

My current thoughts are:

When a user signs up, generate a keypair (client side)
Encrypt their private key with a symmetric key derived from salt + password (client side)
Upload public key, encrypted private key, hash(salt + password) and salt to API
Server side, store public key and encrypted private key. As the users password is used for encrypting their private key, it cannot be transmitted in plaintext to the server, ever. If, instead, a hash is transmitted, their password is not revealed but if an attacker were to breach the database, it would be possible to use the hash to login to their account, but not decrypt files. To fix this, the password hash transmitted is rehashed server-side, and stored.
When a user creates a folder, generate a new symmetric key, and encrypt these files using that key (client side)
Encrypt this symmetric key using the users public key (client side)
When user logs in, download their public and encrypted private key
Decrypt private key, store on device
Use private key to decrypt symmetric key, then decrypt files
To grant folder access owned by A to another user B, user A fetches the public key for user B from the API, decrypts the folder symmetric key using their own private key, then encrypts the symmetric key again using B's public key, before transmitting it back to the API. User B can then fetch the encrypted symmetric key, decrypt it using their private key, and decrypt the folder contents

Does such an approach make sense (from a security and usability perspective)? Are there any caveats or potential pitfalls?

I understand that there are N times protocols for multi-party asymmetrical encryption, however as it's files rather than messages being stored it's not realistic from a bandwidth perspective.

Your approach makes sense as far as using one symmetric key to encrypt the files, and sharing that key among authorized users using public keys to keep it secret.

To address concerns with storing private keys on your server (even though they'd be encrypted), you could just issue a new keypair to a user every time they log in from a new device. This would allow your users to disassociate from any given keypair if a device is lost, app is deleted etc. This would also afford you the flexibility remove individual devices in case of theft, although that would necessitate re-encrypting all files associated with that user with a new symmetric key.


Simple PBKDF2 vs. scrypt question scrypt was designed to use more memory. We can use its parameters to specify (approximately) how much memory we want it to require.

But both scrypt and PBKDF2 allow us to specify the output data size.

So my question is, can't we also make PBKDF2 use a lot of memory by simply asking it for a large output (and taking the bytes we actually need from the end of output, discarding the rest)?

If this is the case, then what's the point of scrypt?

If this is not the case (which is more likely), please tell me what's wrong with my thinking.

Each block of the output of PBKDF2 is derived independently of all the other blocks.  Because of this, computing a large output on a massively parallel system (such as a GPU) is very efficient.  Further, if you only take certain bytes of the output and discard the rest, an attacker only needs to compute the blocks containing those bytes.


How do people in China get past the Great Firewall in practice? I know that China prevents access to many resources/content on the Internet via a "great firewall".

While there are multiple ways of getting past/through this firewall - some are more involved and less practical than others. For example - good luck trying to get reasonable response times for anything interactive via Tor.

My question is: What do Chinese computer users, who might be somewhat tech-savvy but are not programmers or ICT professionals, use in practice to get past the firewall? What methods are the popular ones?

Domain fronting using the Tor Browser is the easiest and hardest for them to block. It's quite popular because of it's effectiveness and ease of setup. Basically, it uses a legit domain like Amazon's CloudFront or Microsoft's Azure as a proxy to Tor. It's like a proxy to a proxy. Because they can't block those legitimate domains, they cannot block this method. This also reduces the risk of detection because alternatives like VPNs can eventually be found and blocked, and the users persecuted.

https://trac.torproject.org/projects/tor/wiki/doc/meek


What is the security concerns of AzureAD? We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and how to test them.

Can I use BloodHound on AzureAD or is there a hack around it to work with it?
Does Azure has a tool-as-a-service already that we can use?
Can you recommend some list to check at least manually?

Thank you

Azure AD is SaaS so Microsoft is responsible for scanning and securing the infrastructure.  It’s important to understand the division of responsibility between you and Microsoft. On-premises, you own the whole stack but as you move to the cloud some responsibilities transfer to Microsoft. The following responsibility matrix shows the areas of the stack in a SaaS, PaaS, and IaaS deployment that you are responsible for and Microsoft is responsible for.

Source

I deal with regulated customers on a daily basis and find it useful for them to review our Customer responsibilities matrix.  This helps them understand what they are still responsible for securing in the cloud and what Microsoft is taking as a cloud provider.  You can find them here:

https://servicetrust.microsoft.com/ViewPage/BlueprintOverview

Can I use BloodHound on AzureAD or is there a hack around it to work with it?

BloodHound is a tool for analyzing the trust relationships in Active Directory (ADDS) environments.  While Azure AD and ADDS have similarities, they are not the same products.

Does Azure has a tool-as-a-service already that we can use?

We have Azure Security Center, Advanced Threat Analytics and Azure Monitor and many more services that are all designed to help monitor and protect your cloud environment.

Can you recommend some list to check at least manually?

We have documented best practices


Clarification on organized cyber crime concept We had a small presentation by my colleagues on 'Organized Cyber Crime' and they presented the topic with a supporting case on The Ashley Madison Hack. Well, I disputed the case presentation by saying that the hack was more of a "targeted attack" rather than an "organized crime" incident. They disputed by saying that the hacker group The Impact Team had the following:

A clear plan in place to execute the hack and breach data
An internal structure of command and control.
Performed a 'cyber crime'.

I do not think that the hack was an 'organized crime' attempt. I link this concept more to the underground illicit activities like money laundering or narcotics or weapons. It should be more of a national issue I think. I want to ask the following questions:

If my colleagues are right.. Then would you call all hacker groups as organized crime groups?
Would one exactly associate 'organized cyber crime' with contexts to hacks like Sony or Ashley Madison, since all of them require co-ordinated efforts and execution?

Thanks for your help.

I have a lot of experience with this subject and it probably meets the requirements of what can be defined as 'organised crime'. I'm going to drop the word 'cyber' as it is implied by the type of crime it is

There is no single legal definition of what that means. But in general the following requirements are usually met; the crime is serious, planned, coordinated and perpetrated by individuals working together in a ongoing basis.

Without knowing all the facts, (no one does) this is probably organised crime, as there appears to be evidence of each of the above requirements.

It will be down to the authority conducting the investigation to produce an evidential case that they can take to court and gain convictions.

Convictions on what, will be down to legal teams and lawyers. This would need to be done before we can really define this as organised crime, even then it could be difficult to define. For example; there have been cases of terror legislation being used against various computer misuse cases in which the perpetrators definitely were not terrorists.

It is a gray area, but for the purposes and standards required for a presentation, I would say on the face of it, the Ashley Madison case passes the test to be labelled organised crime. Even if it does not meet the definition of what many would consider traditional organised crime, which in itself has a morphing and evolving definition.

Regardless it is definitely a serious crime so it will fall under the same/similar remit.


Certificates for autoscaling internal networks? A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client.

How is the same thing typically implemented on private networks, with large numbers of short-lived hosts, such as in an autoscaling cluster? Copying the public key of every host to every other host would not scale well if hosts are frequently being created & destroyed.

Do people usually set up a private CA? Or use a symmetric key approach like Kerberos? Or some other approach? Are there any specific approaches recommended or provided by cloud providers, like AWS, GCP or Azure?

Note: I'm not asking for the technical details of how to set this up. I'm asking what the general approach is.

An internal CA is the usual approach. You can generate certificates for each server with a short renewal time and have the internal CA root installed on your internal client machines (e.g. via group policy). You then set up some certificate management infrastructure to help you generate and deploy certificates.

As an example, Kubernetes maintains a CA per cluster, which allows each component and workload to securely communicate during administration tasks. They utilise CFSSL for doing the heavy lifting, which is the same toolset that allows Cloudflare to automatically deploy and manage certificates at scale.


Can non-malicious faults provoke malicious faults? I am wondering about this for a long time. With the exponential raising of critical cyber-physical systems (CPS) in our all-day-life (cars, metro, UAVs, ships...), how would an attacker be able to exploit non-malicious faults (i.e. due to the ageing of a component or due to cost restriction or incompetence that may lead to memory bloating / leaking, data fragmentation ...) to create malicious faults?

I am trying to find some sources that would go in favor of my question, i.e. is it possible for an attacker to wait for non-malicious faults to occur in order to exploit them to launch an attack?

The example I have in mind is when you deal with both low assurance components (which have a non-malicious fault rate that may be high) and high assurance ones, where the non-malicious fault rate should be very low.

If you have a low assurance component, prone to fault, on the path of a high assurance one, is it possible for an attacker to exploit the natural faults of a low assurance component to break through the high assurance one?

The main sources I am finding are on fault attacks, which are attacks that provoke faults. I would like to know if there exist some sources on attacks provoked by faults, and if it is reasonable to think of this as a possible way for an attacker to break through a system.

edit: to be more clear, is it possible to use faults of a low assurance component to break through a high assurance one?

I may have found an interesting example by combining some references.

Assume that we have a low assurance function that is related to a high assurance one (they share the same memory). This makes sense in a car, where infotainment functions (low assurance) may interact with perception functions (high assurance) to display data to the user.

Because the low assurance function is, well, of low assurance, the designer decided to put a low of security mechanisms for this function, to avoid an attacker to use it to access the memory and then to access the high assurance function.

However, the low assurance function is subject to dangling pointers fault, that is a common fault due to incompetence / not attentive developer.  A dangling pointer appears when an object is destroyed, but the point still references the memory address used by this object. Hence, this pointer may be used to access data that should not be accessed (i.e., privilege escalation).
The attacker has to wait for the dangling pointer to reference a data structure of the high assurance function to break into it.

Consequently, the occurrence of a fault in the low assurance component can lead an attacker to break through the high assurance one.


Is it safe to install Xampp to learn Security and Penetration testing using DVWA? I have heard Xampp is not safe and has a lot of security loopholes. What steps need to be taken to close the loopholes? Is it better if I use a VM instead?
I new to Security Testing and want to learn using DVWA. Kindly provide some feedback...

Is it safe to install Xampp to learn Security and Penetration testing using DVWA?

You can make it safe(r) by:
Configure Apache and MySQL to listen only on 127.0.0.1.

Apache
Edit the file C:\xampp\apache\conf\httpd.conf and change Listen 80 to Listen 127.0.0.1:80

MySQL
Edit the file C:\xampp\mysql\bin\my.ini and make sure that the bind-address is set to 127.0.0.1

Configure the firewall to block TCP port 80
Use the Windows firewall to block incoming requests to TCP port 80.


Check the origin header server-wide in IIS to prevent CSRF through the IIS configuration change Only Could you please let me know how can we check the origin header server-wide in IIS to prevent CSRF through the configuration change only without adding a custom HTTP module in IIS?

get a variable out of 'Host' 'Core'
https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/iis/?view=aspnetcore-3.1

get the cfg domain, from within server
https://stackoverflow.com/questions/40020135/how-to-get-the-current-domain-name-in-startup-cs

I'm unsure how it will look like in code yet. I'm guessing u don't want to add anything to bin directory.

to check client get IP https://stackoverflow.com/questions/735350/how-to-get-a-users-client-ip-address-in-asp-net

New chrome and Firefoxes and Edge will do check for your, but old ones, its up to your Javascript and C# to do the rest I think.


Why do some antivirus programs find infections that others miss? I have Avast Free antivirus on my Windows 7 PC and yesterday I used Bit Defender quick scan addons, which spotted a virus. In rechecking with Avast, it didn't pick it up.

In scanning my system with ESET Online Scanner it shows no virus, but when I scan it with ClamWin it does find it (but with a different name)

Why do they give different results?

Viruses don't identify themselves as such.  In fact, they often try to disguise themselves to make it difficult to detect them.  Virus scanning software uses a variety of different techniques to figure out if a program looks like a known virus, but the exact methods they use and the things they look for vary from program to program.  Since these virus definitions differ, sometime a rule either won't exist or won't detect a particular edge case that another virus scanner will detect.

While some virus scanners are better than others, in general, they are simply different.  Even the best virus scanner (if you could determine a best) would still miss some viruses that the worst one might pick up.


Does SAML 2.0 define how to pass only username from SP to IDP? I am looking at a use case where the service provider will need to capture the user id (not password) to identify the target IDP. In this case, the requirement is to send the user id (that is already captured at service provider end) to IDP, so that IDP can pre-populate the user ID while asking for password to end user.

Is there a standard in SAML how this information can be passed from SP to IDP? I am using SP initiated SAML where SAMLRequest and RelayState will be passed from SP to IDP.

Thank you.

Yes, the SP can send a user id to the Idp as part of the AuthnRequest by including a <saml:Subject> element.


Protect hidden message in image from manipulations I understand that there are techniques that allows me to hide information in an image. In particular, I am interested in what ways I can save a relatively short string in an image, say 30-40 characters. Suppose I have a flow that looks like the following:

Me -> unknown intermediary -> My friend

The problem is that there is a risk that the intermediary will manipulate the file in an undesirable way (e.g. changing the file with lossy compression).

My question

Is there any way for me to ensure that my friend will receive the message, even if the intermediary has manipulated the file? (I realize that I have to assume that these changes do not change the principal appearance of the image.)

I believe that there is some old research (like this or this on lossy-compression tolerant stego, but not I do not know if there are any guarantees provided or real-world implementations. At the end of the day, there are too many possible manipulations and it is unrealistic for a tool to handle all possible image transformations (but I haven't tried this in years).

You may want to pre-empt users compressing your files by using a JPEG-based stego tool that already performs compression. Try Red JPEG XT or StegaMail.

One thing you should handle is that an attacker could intentionally modify your hidden message. You may wish to include an HMAC within your message if all your tool supports is encryption-and-encoding and not message integrity.


Bastion host that allows jailed users to SSH but protects private key Basically, I'm trying to let the user use a private key without having read access to it.

Use case: Employee needs to SSH to a server in the data center. There is 1 private key for all servers, stored on the bastion. How can the employee use the bastion as a jump box while still protecting the private key?

Employee connects (over SSH) to bastion.
Bastion host uses jailed shell to lock down that employee's access.
Employee then SSH connects to an end-server (but didn't touch the private key in the process)

Is there an application/tool/script/method for the bastion to provide SSH access to another server without disclosing the private key to employee?

One thought I had is that there might be a way for a listener on the bastion to trigger its own SSH connection to the end node, and then provide the jailed user a shared 'screen' or shared shell to facilitate the access to the end-node?

Maybe I'm over complicating this and there is a better solution out there. Per-user private keys seem like a nightmare to manage.

A possibility would be to use 'sudo' (or a script / alias relying on it).

Thanks to sudo, you can allow your users to temporarily use another (not necessarily root) in order to execute a very specific command:

Create a new account which will own the private key,
Configure sudo so your users can launch an SSH client using this account and its private key.

By this way your users will be able to run an unprivileged SSH client using a private key, without being allowed to access directly the private key itself.


Are there known incidents of Linux malware coming from unofficial repositories? Often there is a need to use unofficial Linux software repositories (e.g. media codecs, wireless card drivers etc.) and hence the need to decide whether to trust them.

I am trying to figure out how much time I should be spending finding out about yet another repo that I consider using. How common is it for malicious Linux repos to pop up? Has it even ever happened?

Usually what is compromised is the mirror. So the original repo isn't malicious but the mirror on which it is being hosted on is.

That's why it's best to download with package manager so there's gpg signature check. If downloading manually, you can also sometimes verify checksums.

With gpg or checksums checking you are safe from compromised mirrors. The most dangerous thing to do is to download from some mirror without checking.


OWA + AD Lockout Policy: Quite the Mixture Many organizations have webmail exposed to the world.  These sites are often hooked up to AD for user authentication.  Are there any specific security controls OWA (Outlook web app) has that would prevent or degrade an attacker's ability to lock out everyone once the userid pattern is known?

There are a variety of ways that this can be mitigated, but here are a couple.

Two-factor authentication : something you have (a SecurID fob for instance) and something you know (a password)
A PowerShell script to parse logs and add firewall rules based on a number of failed login attempts located in the Event Viewer
A product such as Messageware OWA Guard which will monitor your OWA instance and identify potential risks in real-time (full disclosure : I have no experience with this product and cannot vouch for its effectiveness)


How does a website instantly know if a certain credit card number is wrong? I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, etc), and when I entered the numbers, there was one number that I entered wrong. When I pressed the submit button, the website automatically gave me an error that the card number I entered was invalid. I sense this was done locally in the browser and no data was pushed and checked on a server and a reply sent back.
Is there any sequence of numbers each vendor has? Otherwise, how would the website (locally) know about the wrong number?

Checksums

CC numbers, as well as pretty much any other well designed important numbers (e.g. account numbers in banks) tend to include a checksum to verify integrity of the number. While not a security feature (since it's trivial to calculate), a decent checksum algorithm can guarantee to always fail if (a) a single typo was made or (b) two neighbouring digits are swapped, which are the two most common errors when manually entering long numbers.

http://rosettacode.org/wiki/Luhn_test_of_credit_card_numbers is an example of such a test.

Issuer

If a CC number is technically correct, it may still be not a real CC number. The method for verifying that is simple and complicated at the same time - generally, if you have appropriate access you are able to the look up the issuer institution for each range of card numbers, and then you ask the issuer[s card systems] if they think that this is a valid card. Well, the second part generally happens as a part of making a CC payment, but verifying the issuer is sometimes done before that as an extended test; but not on the client browser.


Using AES to encrypt user data I know next to nothing about cryptography, and I'm basically just looking for someone to look over what I'm doing and tell me if I'm screwing up.

I have the user entering in some sensitive information and a password.  I then use that password as a key for AES to encrypt the information and store the ciphertext.  Later, if the user wants to retrieve the information, they reenter the password and I use AES to decrypt the ciphertext.

Is this secure?  Right now I'm just using the password directly as the encryption key.  I've seen PBKDF2 mentioned a lot in similar contexts, but I'm not sure what the point of it is.  I'm never storing the password anywhere.  If the user forgets their password, the information will just be lost forever.

If possible, I'd like to be able to store the ciphertext in the cookies of a web browser (though this isn't totally necessary), so it's important that the information be secure.

Implementation notes:

I'm using CryptoJS, which I believe randomly generates the salt and IV.  I don't know the details really, it just seems to do everything for me.

Part of the information I'm storing is the user's name, so I don't know if that opens me up to a known plaintext attack or something.

The answer is in the name:  PBKDF is an acronym standing for "Password-Based Key Derivation Function".  Its whole job is to take a password as input and generate an encryption key as output.

The primary reason we need functions like this is that encryption algorithms like AES take a fixed size key.  By definition, AES-128 requires a 128 bit (16-byte) key.  But a user's password is simply a series of bytes - maybe it's 50 bytes, maybe it's only 5 bytes, depending on what the user entered.  Therefore, if you want to use the password to encrypt, you somehow have to embed that password into the exact 16 bytes required by AES.  You're obviously doing something like that already in order to feed your current password into AES, even if you don't recognize it by that name.

A PBKDF is designed to take however many bytes the user inputs, stir them all together using an algorithm (called a hash), and then produce a string of bits suitable for use as a key.  If you need 16 bytes for your AES key, you simply take the first 16 bytes that come out of the PBKDF function.

Think about if you didn't use a PBKDF, but instead required your users to enter at least a 16 byte password.  Without a PBKDF, what happens to everything after the 16th byte?  It becomes meaningless.  If I type a password of security.stackexchange.com, I could also type a password of security.stackexPOSITION@ORG or just security.stackex and any of them would still work.  But because a PBKDF mixes all of those letters together, they all contribute to the key, and the whole password is checked.

The next reason we need PBKDF functions is that passwords have a lot of predictability in them, because English-speaking humans usually only use characters in the ranges of a-z, A-Z, and 0-9.  Despite the fact that there are 8 bits in a byte, a 10 character password will not provide 80 bits of uncertainty in the key; most will provide 47 bits (or less) of uncertainty, and that means it can be easily guessed by a modern attacker.  But because a PBKDF takes all the letters of the password into account, it makes a 20 character password much stronger than a 10 character password, and improves your users' security.

A stronger routine such as PBKDF2 goes one step farther than a simple PBKDF in helping protect against a password guessing attack, by making the operation take a large amount of computing resources.  An attacker who wishes to try guessing every word in the dictionary will need only a few milliseconds to try every word as a decryption key.  An attacker who needs to run through 10,000 hashes with PBKDF2 will take hours or days to try the whole dictionary.


Does Logging out of Windows make my computer much safer than only locking? I recently saw the following security tip on my company's intranet:

  When you are done using a computer, always Log Off, Restart, or Shut
  Down. If you only lock your computer, your account
  becomes an easy target to be hijacked.

This is in an environment where we all use Windows primarily Windows 10.

While it seems plausible that it might be slightly harder to hijack my account if I'm not logged in, my research seems to show that anyone with physical access can do almost whatever they want anyway.

Does logging off provide significant security improvements compared to locking the machine? Why/Why not?

[The question "what could go wrong" is rather broad, so this is not a definitive answer. I am also not a Windows certified security professional, I'm just spitballing.]

@CaffeineAddiction points out that when you leave a computer locked, all your user-level processes are still running. Imagine that an attacker is able to plant a backdoor, like running an FTP server; this would remain running while you're locked, but would the process would get killed when you log out. (That said, this only really stops script kiddies since hacker groups with enough money to buy black market exploits will probably be able to do privilege escalation and run that FTP server as admin).

RAM, cache files and network access: I don't claim to be an expert here, but I would assume that when you log out, Windows clears RAM and tmp files of any processes and data owned by your user. This would thwart a cold boot attack, or any other attack that allows the user to take a dump of your RAM. Windows domains also typically load your Documents folder - and often a user-specific network drive - from a network share. Logging out will close down the connections to these network shares - both preventing an attacker reading your data from the server, or planting viruses to the server.

I do agree with your skepticism though: if an attacker has physical access, why not plant something that will do all of the above the next time you log in? The old trick of crawling under your desk and sticking a malicious USB device in the back, for example.


What are the advantages to OpenPGP "subkeys"? I'm trying to get started with OpenPGP encryption. I understand the concept of keeping your master key safe, and using other keys signed by that key (which can be revoked if stolen) for encryption and other daily use. But I'm confused by the implementation of subkeys specifically. Can't this be done easily without the concept of subkeys? Do subkeys really make it easier? Specifically, the Debian wiki says:

Subkeys are like a separate key pair, but automatically associated
with your main key pair.

As far as I can tell, "associated with" here just means that they're automatically grouped together in the UI, for user convenience, but I could achieve the same security by simply creating additional key pairs separately, and signing them with my first key. Is this correct?
The wiki goes on:

The master key pair is quite
important.... You should keep your private master key very, very safe. However,
keeping all your keys extremely safe is inconvenient...
Subkeys make this easier.... You will use the subkeys for decrypting and
signing messages.... You will need to use the master keys only in exceptional
circumstances.

So... the purpose of subkeys is to encourage the user to create separate keys for separate purposes, and store and use them separately?
But the UI of GnuPG and several key management GUIs I've used does exactly the opposite of this. It groups keys with their subkeys, assumes by default that you want to copy or move them together, and doesn't always make it clear which key in a set is being used. An entirely separate key would be more suited to this purpose than a subkey, wouldn't it?
Am I missing something? Why are subkeys "automatically associated with your main key pair" - and quite strongly associated, at that - if their purpose is to encourage the user to dissociate them from their main key pair?

As far as I can tell, "associated with" here just means that they're automatically grouped together in the UI, for user convenience, but I could achieve the same security by simply creating additional key pairs separately, and signing them with my first key. Is this correct?

Consider an OpenPGP (primary) key an identity, linking together user IDs, subkeys and certifications. If people want to communicate with you, they select this primary key, and will not have to care about any further details.

If you ready the OpenPGP specification closely, you will realize the implementation of the Subkey Binding Signature 0x18 is very close to what you described: you generate another key pair (which for subkeys is designated as such, but otherwise not very different from primary keys), and bind it to the primary key using a signature (but a special one, that is defined as binding the subkey).

By not using multiple primary keys and "normal" signatures, OpenPGP allows you to pretty much hide the details behind subkeys. For normal use, it does not matter whether a subkey changed. If you care, you can have a closer look at the key and its subkeys, but you don't have to.

So yes, you can achieve the same security with separate keys -- but losing much of the convenience and ease of use of subkeys.

  But the UI of GnuPG and several key management GUIs I've used does exactly the opposite of this. It groups keys with their subkeys, assumes by default that you want to copy or move them together, and doesn't always make it clear which key in a set is being used. An entirely separate key would be more suited to this purpose than a subkey, wouldn't it?

Indeed, the user interface often lacks here. But be aware that using offline primary keys is already very advanced usage of OpenPGP/GnuPG, and without some knowledge of OpenPGP and the tools you're using, you'll get into trouble using such keys, anyway.

For creating such a key, you'd usually just move out the whole GnuPG home directory, which you will keep especially safe and offline. Generate subkeys as required, and export those subkeys using gpg --export-secret-subkeys [subkey-id]! (you can also define multiple of them). Be aware of the exclamation mark ! after the key ID, otherwise GnuPG will resolve the key ID to the primary key's ID! Import the exported secret key to your day-to-day GnuPG home directory.

Think of this as a trade between easier key handling for the key's owner (taking advantage of advanced OpenPGP features) and easier key handling for other users (which will often be less confident with the technology in use).


What are some good arguments for having your work send you to e.g. DEFCON or Black Hat What are some good arguments for getting your work to send you to the popular con's? Some of them can involve quite a bit of travel cost thus increasing the need for good arguments for going.

I'd love going to some of the conventions however I am unsure what arguments I should use. My current position is CISO in a small-medium sized business.

In my opinion, being sent to the conference would...

Keep your skills up to date in a fast moving industry
Bring fresh ideas and perspective back to your company
Allow you to network, e.g. scout new hires
Increase the presence/awareness of your brand
Provide a bonding experience with co-workers

To help ensure success...

Find out what the application process is for your company
Find coworkers who have already gone through this process
Ask your manager how they can be convinced
Read sample letters like this one for insight into business babble

For further research, read the the answers to What value to the business is there in sending non marketing people to trade shows? and the question to better understand how business types think and what their concerns might be.


Did someone impersonate my WiFi? TL;DR: An unknown WiFi extender showed up in my DHCP logs and my phone routinely connected through that access point. How badly was my network or traffic at risk?

This morning, while struggling with a slow connection I checked my router and was surprised to see a new, unknown device connected via DHCP. The Host Name was listed as "TL-WA850RE" which turns out to be a form of WiFi signal extender. Since I don't own such a device, I immediately added the MAC address to the exclusion filter.

I kept an eye on the network since then and didn't get any more issues. However, I noticed that my phone suddenly had random problems connecting to the WiFi. I didn't make the connection between the two until I finally got fed up and decided to change my wireless security to use WPA2 instead of the WEP I was using (for a legacy device, it's stupid, I know). Right after, I discovered that my phone suddenly found two different networks with the same SSID but different security settings. After changing and hiding my SSID, the old SSID is now still listed.

All this lead me to the following conclusion: someone broke my WiFi "security" and configured a repeater to extend its signal, thereby impersonating my network by serving as a second access point in a multi-AP network. Because my phone was closer to the repeater than my router, it was going through that access point. Since I had blocked the MAC from accessing my actual network, that connection then no longer worked.

So now my question: is this actually what happened? How worried should I be that someone was listening in on the traffic my phone presumably sent through this unknown access point? Should I take additional measures?

EDIT: I'll see if I can export any logs from the router to check past activity. I ran a port scan on the device which showed an open HTTP port, presumably its management console. I briefly considered trying to access it but while that's morally defensible it's probably also illegal and unlikely to provide any useful information.

EDIT 2: As I feared, it's a Belkin router with as much logging as the Sahara desert.

EDIT 3: As it turns out, a technician apparently installed this particular WiFi extender as part of an installation of a solar panel array. Not to boost the signal but because the extender has an ethernet port which connects to the power converter so it can report usage statistics. Of course they neglected to mention this to the person who's actually in charge of the network. Still, I've found the answers here quite helpful and perhaps this question can be useful to future readers who do have a malicious AP on their network.

Note: I have a fairly good idea of who it was that's been messing around on my network but I wanted to make sure that I understood what happened before confronting people or notifying authorities. Odds are I may do nothing if I can be sure that they only mooched off the wireless and didn't get anything else.

The attacker did not seem to really try to conceal his track :he could have faked an existing MAC address for instance, or used the classical yagi antenna + high power WiFi adapter to silently intercept your communication. Instead it seems he just used a classical home grade WiFi range extender with what seems to be default settings.

So it still seems very possible to me that he just wanted to get a free / pseudo-anonymous Internet access and was actually not interested in your own data.

You can (and should!) still inspect:

If you can determine the usage the attacker made of his access (have you got logs showing he connected end-user devices to browse the web for instance? Or high activity caused by peer-to-peer sharing services?),
If you can detect any abnormal activity on one of the account you were using during this period (mail, websites, etc.).

In all case, while changing the WiFi access security and password was the minimum, as a precaution measure I would also suggest to change the password of the above mentioned accounts.

Note that the direct attacker of your WiFi account may not be your only threat there. If, as I suppose, this attacker used your Internet access to go on dubious websites or freely download pirated material, then chances are that his own machine may be infected by some malware so, for some time, you hosted an infected machine in your network. This may worth a few sanity measures.


How to deal with resistant malware Everytime I visit Gmail, Facebook, YouTube, or Yahoo mail, I get a popup "Please update Internet Explorer" (while I'm using Chrome!). I don't have screenshots but this website describes the problem.

I followed all steps but it had no impact. I also ran a few virus scans using Kaspersky, then uninstalled Chrome and Firefox and re-installed them, but the virus persisted.

I took a backup of all my data and formatted the entire hard drive - including non-system partitions - and re-installed Windows 7 with all the required drivers. I used Internet Explorer but the problem persisted. I have a Kaspersky firewall and antivirus, and MalwareBytes, but neither can detect any malware.

I reformatted and re-installed again, to no avail: the problem is still there. I have no idea what to do. My computer technician basically tried the same things, but he couldn't fix it either.

I'm really stuck and don't know how to proceed.

ok so with the actions you've taken on your local PC it sounds like you've eliminated that as the problem (malware usually can't survive a full reformat/reinstall of windows).  So the next candidate would be your home router.

From this link you can see an example of malware which operates by changing the DNS settings on your router which would then essentially allow an attacker to inject content into your browsing sessions.

So what I'd recommend as a next step would be log into your router and look at the DNS server settings.  You'll want to set them either to ones that your ISP provides or alternatively something like Google DNS (8.8.8.8) or OpenDNS (208.67.222.222).

Can't guarantee that that'll solve the problem but it's likely not a bad next step!


Is Signal a secure and secret way to communicate via voice calls? Signal (former RedPhone) provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in.

But really, how is the probability that a voice conversation is wiretapped still?

And are the contact-details (like phone-nr) concealed to the provider too? Or can the provider build a database of who-knows-who?

Browsing through the source on GitHub, one learns that it uses ZRTP.
From What are the vulnerabilities of VOIP-specific security protocols? :

Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of Voice-over-IP Protocols

We also demonstrate a man-in-the-middle attack on ZRTP which disables authentication and allows the attacker to impersonate a ZRTP user and establish a shared key with another user.

For encryption, it relies on Spongy Castle v.1.46.99.3-UNOFFICIAL-ROBERTO-RELEASE
The upstream of Spongy Castle, Bouncy Castle, has the following CVE against its head:

CVE-2013-1624
Summary: The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Published: 02/08/2013
CVSS Severity: 4.0 (MEDIUM)

The software uses Speex and G.711 codecs as per source. Depending on the codec, not only metadata, but also the language and contents of the dialogue may be inferred because the Speex codec uses Variable Bit Rate (VBR) encoding (combined with Any Activity Detection and Comfort Noise Generation, to be more precise) (see the linked Q&A for details).
I recommend looking through the source yourself, though, instead of relying on strangers...


What function(s) to be used to generate Salt on Windows Mobile 6 I am looking for THE or a real function I can use to generate salt for my mobile app on Windows Mobile. In case I am not abusing in this request but in the future I plan as well the same app for BlackBerry so in case also you can point me out to the BlackBerry function I would be thankful.

RNGCryptoServiceProvider Class

net.rim.device.api.crypto.FIPS186PseudoRandomSource