Secure coding standards and guidelines I was trying to research on available secure coding guidelines of server-side and client-side languages.

There are online documentation from Oracle for Java, Microsoft for asp.net, and w3 for html5 to name a few. There were also third vendor guidelines from SEI, Veracode etc

For secure coding, should non-vendor documentation like Veracode be followed?

Will the parent vendor documentation (like Oracle, Microsoft, etc)
 miss any security guidelines that may be available in third vendor publications like  veracode?

Do all scripts/programming languages have secure coding guidelines available? Is it mandatory for program or framework creators to release secure coding guidelines

Everybody is using OWASP these days or some standard based on it.

https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide

Just to note, most of the security must be done on the server side. I.e. the data validation and sanitation, enforcement of the security of communication channels, authentication, authorization, and many many more. Only trusted libraries should be used and the code written should be reviewed by independent developers to prevent intended back doors.

Regarding the client side, remember to not to operate with the data you don't need on the client side at all (or encrypt them securely on the server side - i.e. session data/view states) and discard any sensitive or confidential data you don't need anymore immediately. If you use some sensitive or confidential data on the client side (and you obviously do, usually it is a session token and some kind of credentials), make sure you use the most secure methods available to store and transfer them but this hardly depends on the technology in use on the client side.

Of course, don't forget to protect the communication channel between client and server with some kind of encryption.

OWASP will tell you more.


Can BitTorrent clients be fingerprinted? As https://panopticlick.eff.org/ demonstrates, web browsers are very prone to fingerprinting, both active and passive (often you can fingerprint a web browser by simply monitoring the wire).

My question is: Is the same possible with BitTorrent clients?

My research so far suggests that DHT "address" may be persistent and/or reveal the list of info hashes the torrent client has, thus making passive fingerprinting trivial, because the lists of info hashes are almost unique. Is this true?

I also recall reading that one can remotely obtain the list of all info hashes currently in the bittorrent client, even if some of them are paused, in most clients. This suggests an active fingerprinting possibility. I could not find the source though.

The client version string also provides some information, although too little to serve as the only source of fingerprint info.

Is flow-based behavioral fingerprinting a threat in case of BitTorrent clients?

Are there any other sources of information that can be used for fingerprinting I'm not aware of?

Once it starts, a BitTorrent client generates a 20-byte identifier called peer_id, it consists of ClientIdentifierClientVersion-RandomNumbers. Granted, ClientIdentifier and ClientVersion don't provide any identification, but the RandomNumbers could be used to identify a client, and there are some things that needs to be understood:

The peer_id could be anything the clients wants so send. The protocol doesn't define how it should be generated, nor it defines how it should be structured.
The client gives its peer_id to whomever asks for it (it's part of the handshake).
Setting the no_peer_id flag allows for the communication to happen without needing to disclose the peer_id.
The peer_id is generated every time the clients is restarted. uTorrent 3.3 even generate a new peer_id while it's running from time to time.

However, BitTorrent's uses a DHT called Kademlia, which is a great news for security researches (AKA stalkers). A while ago, I've analyzed uTorrent and Transmission, they both use encryption for DHT/PEX (if enabled and forced).

When a client enters the DHT "network" it bootstraps by connecting to some bootstrap server. This usually happens the first time you run a new client. But that's not the only thing that happens when bootstrapping Kademlia.

When a client joins the network, it is given a randomly generated identifier called node ID. This node ID is randomly chosen from the same 160-bit space as the BitTorrent 'info hashes'. At any time, you can clear your DHT information and rejoin the network, which would give you a new identifier. Since not many users do that, you can relatively count on it as an identifier.

To get a client's node ID it's enough to send them a DHT ping message, and it will respond with its ID

{"t":"T_ID", "y":"q", "q":"ping", "a":{"id":"THE_SENDER_ID"}}

t is transaction ID, it identifies the message and is sent back with the response
y is the type of the message, and the value "q" means it's a query.
q is the is the type of the query, and here it's a ping query.
a represents the arguments of the query. Here it simply contains the sender's node ID.

A client would respond

Response = {"t":"T_ID", "y":"r", "r": {"id":"MY_ID"}}

the value "r" for y means that this is a response.

Those are mainly the two ways to identify a client provided by the protocol itself.


Is it possible to sniff traffic of a remote network? (With admin access to router) Me and a friend of mine are simulating a widespread scenario where router configurations are untouched (default passwords) and are visible from the internet. Him, acting as the victim, will constantly ping out a packet with a specific content (just a string) to a website, and me, as the bad guy, is supposed to sniff out those packets and tell him the string the next time we meet. Having said my purposes, here are my questions:

Is it possible to sniff out a remote network's traffic, provided that I have admin access over the router/modem? (We thought of exploiting the static routing and forwarding all traffic to a remote server, then said server will forward his traffic to his ISP. We also thought of the same thing, but instead of forwarding directly to the ISP, we somehow return the traffic to the router and let it take care of the ISP business)
How feasible is the attack vector we thought of? (We considered the impact on the network bandwidth, but we will ignore this fact for now.)
----Are there existing services that do exactly this? (act as a sort of man-in-the-middle server)
If it is possible, what other attack methods are available out there? How difficult would this be to implement? (consider the above-average, computer literate, logical Joe)
How detectable would those attacks be? (The ones we thought of are clear as daylight; connection would almost grind to a halt on heavy traffic)

I already read this, but I don't think the user has admin access over the network.
Mirroring is not allowed, as not all routers have this feature (but ours has this).

Update: A few years later, I realized that anything is possible. I was able to root my own router, gain telnet access, then gain ssh access, and finally run a program as root, using an unsanitized input field (diagnostics -> ping) while using a non-privileged account.

The router involved was a TP-Link Archer C2. It was running some sort of Unix on MIPS. The program used was udp2raw compiled specifically for MIPS.

If you can login remotely, then there will be very little that you cannot do.  Once you have a root shell, you can easily run tcpdump.  You can read the local databases that supply encryption keys elsewhere.  If within that shell, you are missing commands; you can write, or simply go find the commands you want.  If you do manage to get in, there is probably a lot of bandwidth; and you might go unnoticed for a while as long as things continue to work.

http://www.tomshardware.com/answers/id-2199813/blocking-backdoor-fios-router.html

However, most people will let the ISP setup the router that connects to the ISP; and that's not going to have the default password and let the world in.  Verizon uses an enormous UUID for the encryption key (written on a sticker on the modem), etc.  There will be misconfigured stuff out there, but it's not like it used to be (with end users going to Best Buy and (mis)configuring it himself).


How do you detect a Memcached DDoS attack on your server? In terms of early detection, how could a sysadmin detect that a Memcached DDoS attack took place?

If you are the one being exploited to carry out the attack, you will see heavy traffic leaving your server from UDP port 11211 and a small amount of incoming traffic from the attacker's machine to said port (with the source IP spoofed to appear to be that of the target). However, it would be best for you simply to configure Memcached so it is not exposed to the internet. This can be done by editing its configuration file and binding it to localhost. If on the other hand you are the target, you will see a large amount of incoming traffic from many servers coming from UDP source port 11211.

If you use Snort, there is a detection rule available for it.


Is XSS a vulnerability or an attack? Why so many people use different defenitions(attack or vulneraibility) for XSS?
I think that XSS is attack, that exploits insufficient filtering vulnerability. Am I right?

The answer for this question should unambiguously explain what is correct definition for XSS, with additional commenting, why people uses different definitions.

XSS is both a vulnerability and an attack.

If we were being very strict about terminology, we would say "my website has an XSS vulnerability" and "we logged an XSS attack at 08:43". Often for shorthand people just say "XSS" and leave you to imply from the context whether they mean a vulnerability or an attack.

I would say that "insufficient filtering" is not a vulnerability itself, it is a category of vulnerabilities, including: SQL injection, XPath injection, path traversal, etc. In fact, I would usually call this category "injection". An XSS vulnerability is an example of an injection vulnerability.


SSL for external micro-services for Tor hidden service I building a Tor hidden service for educational purposes, and I'm trying to make it as secure as I can. The main app is in Rails, and I'll communicate with multiple micro-services.

Due to bandwidth and server performance problems, and a desire to separate essential components from the larger–more vulnerable–mass, I may host the micro-services on different remote locations, far from the main app. Since the data will go out of my local network, should I encrypt the connection to my micro-services? Is this architecture reasonable anyway?

If the main service connects to the micro service via Tor hidden service, you don't really need to do additional encryption, Tor hidden service already encrypts and authenticates the connection.

If your main service connects to the microservices using regular internet, then you really should encrypt this connection. There's really no reason not to, as you can use self signed certificate for this purpose which you can create for free, and when setup correctly, without reducing your user's experience or security.

If you don't encrypt the connections to these helper microservices, a well positioned adversary would be able to see what your service is doing, what your users are doing, and potentially deanonymize them.


Verify software is not harmful before upload to my server? I am writing a web application that allows uploading of software to my server for other users to download (file hosting). How can I verify that a program is not harmful before it is uploaded it to my server?

In the general case, this is impossible.

There is a result from theoretical computer science called the "Halting Problem". It states that you can never write a program that, for any other program, can prove whether it will terminate.

Now, if you can't even prove that a random program will terminate, you certainly can't prove that it is harmless.

The only way to do this is to make sure the programs uploaded are very limited in what they can do. Probably limited beyond the point where they are useful.

You can add virus checks to your service (as is also suggested in thel3l's answer and schroeder's comment). I've seen more hosting services do this, and it will at least protect your downloading users a bit.

However, you will always be in the arms race between malware makers and virus scanners. You cannot guarantee to your users that the software hosted is safe. You can, however, keep out some bad apples - and hopefully, most bad apples.


How secure is changing or adding a single character in your passphrase? I'd wager quite a many people are required to periodically change their passwords for certain applications or even at the office. I'd also wager that a large percentage of these people "change" their password by actually only changing a single character in the password (or just adding a character).

supersecret11 >> supersecret12
sepersecret11 >> sepersecret111

My question is, practically speaking, how much "less" secure is this than changing the entire thing? I recognize mathematically the difference can be compared and significantly less secure than changing the entire thing. My question though is, if someone gains access to a password for an account, and that password fails, is there evidence of attempts to further crack these passphrases or is it more likely that your typical hacker will move on to the next account in his list?

Further, again practically speaking, not strictly mathematically, if we were to change a password from supersecret11 to s.upersecret11, doesn't this effectively accomplish the same thing as changing the entire passphrase? (again, this is asked from a general standpoint, ignoring user-targeted attacks, focusing on "lists of compromised accounts" that hackers may gain access to)

is there evidence of attempts to further crack these passphrases or is it more likely that your typical hacker will move on to the next account in his list?

This depends. If the attacker can guess that your password changing schema is simply to replace a single character (maybe because he got access to your two last passwords or knows how you think) than he will probably try first to change only single characters.

And if your account looks more valuable than other accounts the attacker will try harder to crack your password. It depends just on whatever the best return of investment is.

And as for the "typical hacker": The typical hacker will adapt. There are lots of password leaks out there and these are used to find out which kind of passwords are mostly used and which kind of variations are done. These information then will be used to making the cracking attempts smarter and faster. If new leaks show a change of behavior the algorithms for cracking will be adapted again.

  ... if we were to change a password from supersecret11 to s.upersecret11, doesn't this effectively accomplish the same thing as changing the entire passphrase?

Whatever the schema is you use to derive your next password from the previous one it will always be weaker than just choosing a random new password. This is especially true if the attacker somehow knows the schema you are using (maybe derived from knowing your last passwords) because then he can easily create and check the few variants of the new password.


Get the browser history without using a browser I would like to get the browsing history of a computer in my network (without running that web browser), is it possible?

Your browsing history is basically a file on the computer's disk. Depending on your attack scenario, many things are possible:

For someone who has access to your computer, through a remote-controlled malware or just sitting at your desk while you're away, it is entirely possible to get that history file and read it "without a browser". If, however, you explicitly deleted your browser history, this is not possible.
For someone who is listening in on the network however, it doesn't matter whether you delete your history or not because that person will be able to see all the (unencrypted) sites that you visited (effectively reconstructing your browsing history). It is worth pointing out that a malware or a surveillance tool installed by your employer could very well intercept your traffic locally.


Can unpacking a .zip file be harmful for Unix-like systems? Let’s say there is a .zip file that contains either a virus, malware or something harmful for the computer.

The computer is running a Unix-like OS, e.g. Ubuntu 18.04.

Are there any security implications by only unpacking the contents of the .zip file?

Yes, there can be.

The main risk with unpacking zips is that it overwrites an executable or config file. For example, if the zip contains a .bashrc and you extract it in your home directory then it could overwrite yours and the next time you log in, the attacker's code will run.

For a worst-case scenario, consider a webserver that open zip archives, maybe from user uploads, because unzip will run the the same privilege as the webserver process, likely being able to overwrite executables or config files belonging to the webserver. Hopefully the admin isn't sloppily running the webserver process as root.

There was a recent public vulnerability called Zip Slip which made this even worse: some unzipping tools were allowing filenames to contain .. within a zip archive, which makes this attack even more dangerous because a zip containing the following file will overwrite /bin/ls no matter where in your filesystem you're trying to extract it to:

../../../../../../../../../../../../../../../../../bin/ls

(or any other executable that the extracting process has permission to overwrite)

Proper zip extracting hygiene:

If possible, check the authenticity of the zip archive before you extract it (you got it from somewhere trustworthy, checksum, signature, etc).
If possible, avoid running unzip as root, that way system files can't be overwritten.
If possible, unzip into a new clean directory so that, barring chroot exploits like Zip Slip above, there is nothing in that folder to overwrite.


Annonymity through prepaid mobile plans In my country you can buy a prepaid plan without ID. Lets say I buy two 4G dongles, connect both of them to a Rasperry Pi, pipe my connection trough the first dongle to the second dongle, hide the Pi in a public building ceiling and power it from the AC-line.

Assume that nobody find the Pi, the data is encrypted, no DNS or WebRTC leakage and I'm not using any of my personal accounts (eg. bank). Is there anyway that the ISP or someone else can find out where the data originally came from (IP address etc)?

Summary: Don't do it.

Your question is mainly about anonymity. So I'll address that first:

You are talking about buying three pieces of hardware and two SIM cards. Each of these have an identification, which could possibly be tracked back to time and location of sale. At that point it could possibly be tied back to a CCTV recording or a card used to pay for the purchase.
There is also the possibility of a CCTV catching you in the act of hiding the device.
Finally you would want to communicate with this device. Both the ISP that you use to get in touch with this device as well as the ISP you use to establish connection to the device will likely have records indicating which pair of IP addresses are communicating.
There are plenty of ways in which the association between the two 4G dongles could be established. First of all you might have bought both at the same time, secondly the provider will know the approximate location of both dongles which happen to be the same and hardly ever changing.

As for the legality there are multiple reasons why what you are asking about might be illegal:

You might be violating trespassing laws when installing the device.
Even if you are allowed to be in that location, you might not be allowed to leave any of your personal belongings behind, when you leave that location again.
Hooking into an AC line without permission is almost certainly illegal and could potentially get you electrocuted.
You may be liable for the disruption caused by evacuation of the building and the bomb squad sent in to remove the device if the first person to find it does not have a clue what it is.

The reliability of such a device is unlikely to be good:

There is the possibility of the network access provided by your SIM cards to go through a CGN which means connecting to this device remotely can be difficult or even impossible.
If you were able to hide it in a public place there is the possibility that somebody else could find your device and modify and/or steal it.
If you ever return to the device in order to service it, there is no way of knowing who might be waiting there for you. (But they will probably suspect you to be a terrorist.)
The connectivity of either 4G dongle or the power supply could change in unanticipated ways with no warning.


(Theoretically) intercepting GCHQ's smartphone exploit In the lastest Snowden interview, it was revealed that GCHQ used an exploit sent via SMS to gain access to smartphones, and that this 'exploit' goes unnoticed to the handset user. I was wondering if it might be possible to somehow setup a smartphone as a honeypot to dump raw incomming SMS data before it's processed by the phone, and then set the phone up in such a way that it would attract the attention of GCHQ causing them to send their specially crafted SMS and then reverse engineer the message sent and then craft a patch for this exploit?

First, SMS exploits are not unheard of.  Quite the opposite...Android has recently been beset by the Stagefright exploit and variants that would allow exactly the sort of things described.  So, if in fact this was a real program and not simply wild speculation on Snowden's part, it may in fact have been leveraging Stagefright or something similar, rather than a still unknown zero-day.

As to your specific plan, I see one glaring issue.  Are you familiar with the "Underpants Gnomes" episode of the TV show Southpark?  If not, the episode was about a group of gnomes who stole underpants, and when asked why, it turned out they had a business plan for it.  That plan was this:

Steal underpants
???
Profit.

You see, it's that second step that's the killer, and you have the same problem with your plan.

You have:

Setup a smartphone as a honeypot
Set the phone up in such a way that it would attract the attention of GCHQ causing them to send their specially crafted SMS
Reverse engineer the message sent and then craft a patch

So, how again exactly do you get GCHQ to send you their message?  I don't know, and I doubt you'll find anyone who does, and certainly not with any reliability.  So, while it's a nice theory, and it certainly builds on the honeypot model which does indeed work, the problem is that the specificity of the attack that you need to occur is so incredibly restrictive that it's virtually guaranteed to never happen.  Being struck by lightning begins to look like a refreshingly likely alternative.

So while there's nothing theoretically wrong with the approach, practically, it almost certainly won't work.


Plausible deniability regarding KeepassX files I recently installed Guest Additions in my Windows 7 Virtual Machine because I could not stand working without widescreen and high resolution.
I have read somewhere that this could be a possible vulnerability that an attacker could use to enter the host system but I guess this risk I will take.

I am wondering if I imported my sensitive password safe files into my host system and later overwrite them using Eraser ( >30 Gutmann Passes) what a data forensic could do with the information he finds on my hard drive.

I think he would see that there are some segments on the hard drive that have been overwritten.
I have a second cloud account containing a keepassfile with non sensitive data prepared to feed to those people in that case.

One problem I see is that the size of my keepassfile that I keep on a second cloud account containing non sensitive data is smaller than my sensitive keepassfiles.
Furthermore my sensitive keepassfiles consist more than one file (I could change that of course by compressing them to a zip file or build one keepassfile out of the three).

I don't know if it would be better for me to continue like I do at the moment which means downloading my keepassfiles from a cloud server inside my virtual machine or if I should change my routine to downloading the files from the cloud server into my host system and use the  shared clipboard function of Virtual Box to import each password string into the guest machine.
Security-wise, I came to the conclusion that it would be better to copy and paste the files from the host machine into the virtual machine using a shared clipboard because if a homepage I visit exploits any browser vulnerabilities I would maybe get an alert from my antivirus and could roll the machine back to an earlier state without getting my keepasfiles lying on my host system infected/stolen.

The only problem I see is the plausible deniability factor.

If an adversary with data forensic skills would gain physical access to my machine and finds traces of the files I wiped after a session which differ in size from my "fake files" lying on my second cloud account he could start asking questions.

What I did for some time was reading the password in one virtual machine and typing it in into the virtual machine that I use for browsing but after a while it gets extremely annoying.

What are your thoughts regarding the improvement of security of my setup, and the plausible deniability and security of my keepassfiles?

Regarding the fact that I posted it anonymously I am not too concerned about the fact I did and also the fact that there are billions of people having the need for hiding their files for a lot of different reasons. I just want to know if sizewise the files must be the same if I wipe them with eraser. I am not talking about an NSA kind of threat model because they would maybe just enter my apartment when I am away, put cams and microphones everywhere and just watch me.

I need deniability because the secret keepassfile contains data I don't want anybody to know about. So in case somebody with data forensic skills would ask me I can show him another file that also contains maybe sensitive data but not too sensitive and that guy is fed and happy.

I think you need to decide what your threat model is: things like who your opponent is, what capabilities they've got, what information you need to keep secret, and so on.  It sounds like you're applying security-related techniques you've heard of without understanding what those techniques do or why you should (or shouldn't) use them.

The precautions needed for dealing with a "nosy little brother" threat are different from those for a "foreign intelligence agency" threat.  In the first case, simply keeping your secret information hidden is good enough; in the latter, you need to keep the fact that you have a secret hidden, so they won't be tempted to beat it out of you.


How many rounds should be used to hash card numbers? We want the ability for payments made without logging in using one of their saved payment methods to be associated with the saved payment method. E.g. if they buy a recurring subscription to magazine 1 using credit card 1, then buy another subscription to magazine 2 with credit card 1 (yet again), when they login to their account it should show that both magazines have been purchased using the same payment method. (Not that they both were purchased using two separate cards that just so happen to end in the same last 4 digits.)

As they are not logged in during these two checkouts, there's no way for them to pick their existing payment method to use. Internally, we need to realize that this payment method has been used before and "dedup" them.

My solution to this problem is to use Blowfish to hash the card details:

private static String hashSalt(Long userId) {
    final Long rounds = 10
    String userHash = sha1("$userId" + GLOBAL_SALT).substring(0, 16)
    return "\$2a\$$rounds\$$userHash"
}
private static String mergeCardDetails(String number, String cvv, String expirationMonth, String expirationYear) {
    return "card:$number:$cvv:$expirationMonth:$expirationYear"
}

hash = BCrypt.hashpw(mergeCardDetails("4111111111111111", "123", "05", "22"), hashSalt(userId))

Currently the round count is set to 10. However, I realize this is a very low number as the search space for card numbers is very low.

My question, is how many rounds is appropriate for hashing card numbers, today?

I know that in the future the round count will need to be increased, resulting in duplicate payment methods...

Looks like you are hashing card details along with the CVV. That's bad, very bad. Don't do that. Ever. And there's no way to do the wrong thing on the right way.

  "A man may do a right thing in a wrong way; but he cannot do a wrong  thing in a right way. For there is no right way of doing wrong."src

There are very cheap hash cracking rigs around the world that can try millions of hashes per second. Breaking your hashes can be done very fast, if you take into account that you have a handful of valid banks or issuers, so the first 6 digits are taken from a table, not the full search space. One database leak and all financial data is available on the underground forums.

Don't compromise your security for a little increase in convenience. It's not hard for the client to type the card again, or login at Paypal to pay you, but will be terrible if they receive a mail from you informing that all their card data leaked and they have to cancel and reissue their cards, and keep an eye on their account to find any fraudulent purchase.

Don't store payment information. Let the payment gateway process it. If they mishandle card data, it's on them, not on you.

Don't store card data. Never ever store the CVV, hashed or not, encrypted or plaintext, in clear or base64 or whatever other way.

Just a little math for the cracking time.

The first 6 digits are the issuer identifier. There are way less than a million, so you can look up on a table and get all possible ones, and pick the most common. Bank of America, Citibank, HSBC, Chase. You will have around a hundred for the first 6 digits.

For a MasterCard, the next 9 numbers are the account number, and the last
digit is the verification digit. You can calculate the last one way faster than throwing it at the hash function, so you will have 1,000,000,000 possible account numbers and around 100 possible issuers, totaling for 1011 possible card numbers.

With a hashing rig with 8x Nvidia GTX 1080s, they cracked 105 hundred OpenBSD bcrypt hashes per second, with a work factor of 5. I don't know the parameters you used on your bcrypt calculation, but let's consider you did it as good as OpenBSD developers (and they are quite good at it).

Using this numbers, a single rig can crack this relevant search space in:

100,000,000,000 numbers at 105,000 per second = 950k seconds
950k seconds = 264 hours = around 11 days

An attacker will not crack every single card on your database in 11 days, but will crack all cards from the major issuers in less than 2 weeks. Rent some Ethereum mining rigs from your fellow crypto currency miner, and an attacker can crack this all in a day.


Can a program that doesn't explicitly take user input be hacked? I'm learning about security, and it seems that all of the security problems I have seen come from input from malicious actors.

I was told that it's possible to check for the existence of bugs in a program, but not possible to check that a program doesn't have any bugs. Following from this, this means that it's not possible to prove that a program is 100% secure (correct me if I'm wrong).

So I was thinking, is it possible for a program to be hacked in some way without explicitly taking user input?

And by hack, I mean making the program do something it wasn't designed to do.

For example: somehow forcing a program to take in user input by other means even though the actual program code doesn't take in user input.

Or subverting the execution of a simple Hello World program and making it execute a shell.

Is it possible to craft a program that doesn't explicitly take user input, but can still be hacked?

Short answer: Yes, DLL path highjacking.

Long answer: Though a program may not explicitly ask for user input, the operating system supplies resources for that program to run. So the attacker can target the program, the resources prepared for that program, or the interaction between that program and other necessary components.


Is an updated OS, in general, more secure than its predecessor? I'm updating the OS on several servers before they run out of support. I'd like to say the new OS (Windows Server 2008 R2 to Windows Server 2016) is more secure because it includes all security patches made to date and developers would have had the chance to rewrite code with more knowledge of threats and vulnerabilities.

Then again... new software could expose new vulnerabilities by exposing new functionality.

In general, does the act of patching software decrease or increase risk?

Patching addresses known risks while introducing unknown risks, like new unknown vulnerabilities, bugs, performance issues, etc.

That's why places like banks wait a while to quantify the unknowns before patching.

Patching is not something that should be done without a risk assessment. Do you leave known vulnerabilities in place because you fear availability risks? Do you mitigate the known and test the patch before deploying? You have to answer these questions for yourself.

I advocate having processes in place that patch immediately but also have a quick rollback and mitigate plan in place ("patch, test, rollback" instead of "test, patch"). From experience, the downtime from bad patches and rollbacks is less than the downtime from known exploits hitting a server, but those metrics can change at any time.

You are correct to ask this question, but the answer is far from clear or universally applicable (even with WannaCry experience being so recent).


strange text sent from my phone to a friend A friend received a text from my phone which actually used my husbands name in the text. It was not from me and does not show up in my text message thread. The text does not include a link or any picture.

I also received from a friend a strange text that I know she would not have sent. It was sent in the middle of the night and about Valentine's day card. Again no link or picture.

What is going on?

It sounds like both of the SMS messages that you described were 'spoofed' to make them look like they were sent from a phone number other than the actual phone number that they were sent from.  It's not difficult to do, and it's not uncommon.  See https://en.wikipedia.org/wiki/SMS_spoofing for more info.


How do (CVE patched) package versions relate? Given the real-life example of an announced vulnerability fix, e.g. the latest openssl vulnerability fixes, and a Distro's reported throughput of the fix, e.g. GNU/Linux Debian's response to CVE-2016-6309:

wheezy              1.0.1e-2+deb7u20  fixed
wheezy  (security)  1.0.1t-1+deb7u1   fixed

I have two questions:

Will having installed (a possible future) version 1.0.1e-2+deb7u21 per definition contain the (or better) fix too, it being the younger version (note: I'm using a hypothetical example, u21 does not exist yet, as my question is generic not specific)?
What is the difference between wheezy and wheezy (security) in the specific example (GNU/Linux Debian). Sometimes the "security one" seems to refer to a younger version version, sometimes to an older, I'm lost..

If anyone could shed some light on these one for me.. that would be appreciated!

TL;DR: In principle u20 and any package with a higher number should not be vulnerable (hell, u1 and any higher should not be vulnerable since the upstream version of the package does not change and u1 is not vulnerable).  That is, unless VVV (the upstream version, see below) changes or you change your Debian release, in which case a different numbering is used (see below for an elaborate explanation of version conventions).  That is true in 99.9% of cases, but developers make mistakes and sometimes later changes awaken old vulnerabilities.  Yet, that is quite rare and in such a case a new CVE is raised.
Debian package naming convention
Heh, you will probably find this frustrating but the Debian FAQ explains the version part of the package as:

The VVV component is the version number specified by the upstream developer. There are no standards in place here, so the version number may have formats as different as "19990513" and "1.3.8pre1".
The RRR component is the Debian revision number, and is specified by the Debian developer (or an individual user if he chooses to build the package himself). This number corresponds to the revision level of the Debian package, thus, a new revision level usually signifies changes in the Debian Makefile (debian/rules), the Debian control file (debian/control), the installation or removal scripts (debian/p*), or in the configuration files used with the package.

But wait, what are those VVV and RRR?  The full naming convention is:
foo_VVV-RRR_AAA.deb

AAA is simple, it is the architecture.  VVV comes from the upstream developer, i.e. from the openssl developers in your case (e.g. 1.0.1 or 1.0.1t, see here).
Last comes the RRR which is left to the person packaging the .deb, and it really be anything.  On the other hand Debian packagers normally follow the debian version (deb7 for wheezy, deb8 for jessie) plus some update number.  The update number does not need to be sequential, it just need to be higher than the previous one.  This is likely because a packager will have failed test builds of his packages*.
In summary, there is nothing that links the .deb version string and the CVEs it includes.  You do need to go and read the release notes.  Moreover, often you need to read the release notes of the packager and of the upstream developer (the packager will often include a link to th release notes of the upstream developer).
(security) repositories
What wheezy (security) means instead of plain wheezy is that your Debian has the security repository installed as one of the repositories for apt.  This is normally performed with:
deb http://security.debian.org/ wheezy/updates main contrib

The guys at security.debian.org work on CVEs and produce all those CVE reports in the debian security tracker.  They update packages for old and new Debian versions as needed for the security purposes.  Using your example CVE: openssl in jessie is pretty new, in jessie (security) is newer, in wheezy (security) is new, but wheezy still uses a rather old version.
This allows sysadmins that use wheezy to get security updates without the need to upgrade to jessie.  Debian is incredibly robust and stable, and there are sysadmins that may wish not to update their packages with security updates fearing that code changes will make things fail (they simply do not enable the security repositories).
Now, the security guys will update an older package if it is needed, they prefer backporting the package.  Yet, sometimes it is needed to update VVV, for example the openssl at wheezy (security) is at 1.0.1t whilst on wheezy is at 1.0.1e, likely because of this CVE.
Therefore, we can say that wheezy (security) is more dangerous in terms of backward compatibility then plain wheezy but safer than upgrading to jessie.  As far as I am aware if you use just plain wheezy or plain jessie (you only have the stable repository in sources.list) you will never receive a VVV update through apt, you will only get updates to the RRR part.
Note that thanks to the fact that it is a different set of people that work on the (security) repositories and the normal repositories, funny things happen.  Here is a CVE in which the (security) package is vulnerable but the normal one isn't, in this case it is fine because VVV is the same and RRR of the non-security package is higher and will be selected by apt as the newest update available.
Related / References:

Debian packaging basics (FAQ)
Debian package naming convention on unix.SE

* I cannot tell specifically for Debian but one recent packaging adventure I watched was Vim 8.  The upstream developer patches came very fast and the testing repository of Arch had: vim-8.0.0001 => vim-8.0.0003 => vim-8.0.0005.  The last one, vim-8.0.0005, was moved into the extra public repository. Therefore packagers often jump release numbers because the package is updated before it is allowed to leave the testing package repositories.


How to validate file content in php? We have developed an application with contain file upload functionality. We use that application for internal purpose only. We use core php language.

We already use the below validations:

File extension checks (allow only CSV, txt, SQL).
File size checks (allow only 50 MB). We allow bulk upload as well.
MIME Type.

We are planing to check the file content as well for malicious file upload. How do we do that?

That depends entirely on the file in question.

For example, if you want to enable users to just upload plain text files, then it may be enough to check if there are any unprintable characters in the file.

If you allow users to upload images, you have to make sure that the files are actually images. This is best done with tools like ImageMagick.

This list goes on and on, and depends exactly on what files you want to allow. If you want to allow arbitrary files, then you can't make any file type checks.

What not to do

Never go for file extensions, MIME type or naive magic numbers. File extensions can be changed trivially, even by less experienced users. MIME types can be evaded by any even moderately experienced attacker, just like magic numbers.


Calculate pps for DDoS evaluation I am working on a task where I have to evaluate how much throughput one can generate in packets per second. I know I can send them as fast as possible with hping3 [...] --flood, but is there a way to calculate their number reliably for a single host?

Depends on the attack you want to generate(Attack type), the capacity of your single host (CPU, Memory), and on the network capacity (Bandwidth), and also on the application that is receiving the requests in the case is a L7 attack, and probably more variables to take into consideration.


Would the attacker get a valid CSRF token if the session token is stolen? The CSRF synchronized token makes sense up to certain point. Can someone explain the rest in a childish manner to where I can understand it.

When a user logs in they are given a session ID and a CSRF. The session ID is stored in session cookies and the CSRF token only stored on the page, preferably in a hidden field. When a user submits a request that requires special privileges the CSRF token is sent with it. The server verifies that is the user and commits the action.

Okay here's where I'm having the problem. If a user gets his session id stolen along with any other identification, say from a man-in-the-middle attack, which doesn't need XSS. Wouldn't the malicious user be given the same CSRF token that was given to the session to that user?

Ignoring headers answers for prevention please *

CSRF tokens aren't a defense against other users logging into their account. CSRF tokens are a defense against CSRF attacks only. If anyone logs into an account (including an attacker), then they should get the CSRF token (along with all of the other content that's normally served to the user).


Differences between Cookie vs Session Variable to sensitive data I am doing my own login authentication system, and I want to do a robust system. I want to decide which direction I should take to keep the user logged in. I have put a question for each way, and also what I think the pros/cons are.

Cookie

How safe is it to store a "User" object, with many properties
(including encrypted pass) in a base64 string?

Disadvantage: Must be encrypted so the user can't easily manipulate data
Advantage: Can be set for longer periods of time, and can persist during sessions.

Session Variable

How safe is to store sensitive plain text data?

Disadvantage: Only lasts for the server session.
Advantages: Cookie is automatically encrypted, and simpler to code than cookies.

What are other advantages and disadvantages?

1) how safe is to store an "User" object, with many properties (including encrypted pass) in a base64 string?

You should never store the password anywhere. It does not matter if it is encrypted or not. You should not even store an encrypted copy on the server side. You should use something like bcrypt to create a secure hash of the password that you use for validation.

  2) how safe is to store sensitive plain text data?

A better question would be "how unsafe is it to store sensitive plain text data?" The answer is that it is very unsafe. Of greater concern than the encryption portion is that the question makes me think that you are planning on trusting spoofable data that comes from the client. You must never do this.

If you are to store information used for authentication on the client, it must be done in a secure manner. You sign (eg: with an HMAC) to make sure it isn't tampered with. You encrypt data to keep it secure. And you never store anything but a password hash (eg: with bcrypt) as they are so sensitive that even encryption isn't sufficient for them.

Finally, I strongly recommend that you don't actually use a custom authentication system for anything but playing around. Even the most experienced security developers' authentication systems take lots of help and testing and real life usage before they can be considered secure.


Is using a sqlite with random name file secure? As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and how?

Assuming that i have my own server, not shared host, the database is only accessed throught my web app(PHP)

SQLite is not like a traditional DBMS in that it does not serve the content of the database to a computer network. It is actually kinda like just storing everything in a file. SQLite is will then allow your application to load that file and query it.

As such there is no need or advantage to a user account system as only programs on the same computer can interact with it anyway. The OS's file permission system should provide protection against not authorized reading/writing. Of course the machine on which this system is located needs to be secured as anyone with appropriate access on this machine can read/edit the database.

If you for example want to be able to only read table A but read and write table B then you should use 2 database files, one with only read permissions and the other with read/write permissions. How you do this is OS dependent.


Is it safe to install malware in a VM Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer.

Can I install the malware in a VMWare VM, maybe even without network access, without risking the integrity of my host system?

There is no simple answer to this question. VM software is still software and has vulnerabilities that can be targeted and thus, in theory at least, exploited to do more harm.

Running an infected VM with access to your network also opens up potential attack vectors.

Another interesting point to consider is that sufficiently advanced malware could be VM-aware and modify it's behavior when it detects that it's running inside a VM, masking the actual harm-causing capabilites.


Which protocol could have been likely candidates for leaking a laptop serial number Having read this article, one line in particular caught my attention:

  The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the devices used in the hacking.

The following quote was more in line with what I was expecting to see:

  A mobile phone and hard drive were also seized and the IP address... matched the intrusions into the organisation.

I am aware that TCP/IP packets will contain headers which expose the source IP address and that the IP address could be used to trace back to an individual network (such as the house from which the hack was conducted from).

What I'm more interested in is the first quote. Why would a laptop serial number be present in network packets leaving the machine? Is this a common "feature" used by some well known application or protocol such as SSH?

It was probably likely that by 'serial numbers' they were referring to the MAC addresses of the devices, rather than the physical security numbers of the device.

  A prosecutor told the court: "A mobile phone and hard drive were also seized and the IP address... matched the intrusions into the organisation.

There is a protocol known as ARP, or the Address Resolution Protocol that converts IP addresses to MAC addresses, so that traffic knows which address to send given data to, and is commonly used as an identifier for where attacks originate from, what machines have egressed to a given network, where malware originated from within a company, etc. etc.

But to answer your question, there isn't any need for a physical security number to access a network for two reasons.

MAC addresses serve as individual identifiers
Numbers, like MAC, IP, and hypothetically serial numbers can all be spoofed.

If you need more info on any of these topics leave a comment and ill do my best to answer your questions.


GPG/GnuPG secret key passphrase recovery and/or .gnupg/private-keys-v1.d/ file format Bad news: I forgot a GnuPG secret key passphrase.

Good news: I do know the words it is constructed of.  So, I can easily use john or similar to recover (too many combinations to do it manually, though).

Problem: The secret key is not in the secring.gpg format that john understands, but in some new format, apparently distributed across 2 files, in

~/.gnupg/private-keys-v1.d/0123456789ABCDEF0123456789ABCDEF01234567.key

and

~/.gnupg/private-keys-v1.d/123456789ABCDEF0123456789ABCDEF012345678.key

(files renamed for this question, obviously) created within the timespan of a few seconds - could be pubkey and seckey, if so which one is which?

Could someone please help, maybe by telling me how to extract the (still locked) seckey from these files without a passphrase?  An ASCII armor format would be ideal.

Alternatively, maybe someone knows how to feed these files to john directly?

On a related note: Can I enforce the secring.gpg format in GnuPG? I share /home between systems with different versions of GnuPG and don't want to duplicate key files.

Thanks.

PS: Since I already have files encrypted with the key a revocation and replacement would not be a viable solution.

I'm taking a guess at these, but I have no easy way to test if these are actually possible.

Easiest: Nasty and crackgpg have been designed for this purpose. If one of them has been updated to support this new format, try it.

Harder: The file format is documented in gnupg/agent/keyformat.txt. Can you get something like john to try your wordlist until it gets a ( as the first character?


Apply SSL for domain that I do not own As part of a project that my company is doing, we need to setup a development server.

Let's say our company's main domain is example.com

We need to be able to access the dev server through dev.example.com but unfortunately, company policy does not allow dev servers to have subdomains for the example.com

We need this due to SSO cookie issue.

We worked a way around it by using a hosts file but the problem is that we need to apply SSL.

In this case, can I register and apply a SSL with a common name 'dev.example.com'? I do have access to example.com's registered email address on WHOIS DB.

That answer is most likely. It depends on the verification depth (or lack of) from the issuing certificate authority.

With that being said, it sounds like you will still be breaking policy even if you find a CA that will issue a certificate based on email verification alone.

Are you willing to suffer the repercussions if/when caught?


Removing remnants of a Metasploit exploit Is it possible to remove a Metasploit payload/meterpreter from a compromised system? My question is mainly based on antiforensics (Leaving aside Memory forensics which is probably unavoidable but more advanced).

Does the Kill command take care of that?

Meterpreter never touches the disk. So until you don't do anything deliberately that changes resources on the hard drive and leave evidence, chances are there will be no evidence on the disk. However, this is not so simple. OS can transfer pages from memory to disk when the system is low on memory. Although meterpreter reflective loader code specifically requests the OS not to flush the page to the disk where the meterpreter process is hosted, it's only a process request which can be ignored by the OS.

I am not going to explain the network part since it is out of scope here but a lot of times evidence is gathered from the network logs as well. SSL won't provide any benefit if it is intercepted in the middle (you have the option of certificate pinning in the stager code) but the bottom line is if you are concerned about forensics, make sure you are covered on all sides.


Prevent Chrome extensions from betraying me As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno SoLotions wants to continue developing the extension, only to discover later that the new "developer" actually just wanted to turn the extension into adware or malware. The current users of the extension receive an update that helpfully introduces extra ads into every page you visit, while maybe introducing a few security exploits.

In other words, it's not enough that the developer and extension are trustworthy now. For an extension to be "safe", you have to somehow determine if future versions of the extension will also be safe.

The real solution may be for Google to take more responsibility for its "store", but what can a user do? All I can think of is:

Don't install extensions at all - Seems impractical, along the lines of "never install any software"
Don't allow extensions to install updates - would this be a security risk in itself?
Only install updates from developers who (in addition to being trustworthy) have committed to never sell their extension - I have never seen such a commitment myself
Carefully review changes when an extension asks for new permissions -
This only works for extensions that can't already "read and change your data on any website you visit" already

Is there a better way to be reasonably sure that my extensions will stay faithful? Or is it time to say goodbye now while we're still friends? I just don't want to get hurt again...

Unfortunately, there isn't a good-enough way out of this situation. This logic extends to every piece of software we use on our computers and phones - not just Chrome extensions.

With browser extensions (Chrome & Firefox), I use as less of them as possible, install only those I think I can trust, and keep reviewing this list as often as I can (once a month or so) - whether I can still trust them. Even this has its pitfalls - but I use "my best guess / judgment" to make this decision - knowing full-well that it might not be enough. In effect I use a combination of your options #1 and #4.

But then I can't afford additional due diligence. So that's where it stops.


Website Spam Bots In Google Analytics I had a website URL which was getting around 60 hits a day from typical spam suspects like buttons-for-websites & ***.semalt, etc, etc.  So I decided that when I changed my hosting account I would also change my URL, which I have just recently done.

Thing is, my original URL has been completely offline for well over a week now and when I visited my analytics this morning, there was still a consistent number of hits over the past week from these same sources.

Today I set up an account for my completely new URL and to my surprise, literally within minutes, and before I had even uploaded the website onto the server I was getting visits from these sources again.

This leads me to believe that it is actually the Google Analytics account which is getting hits and not my actual website.  Has anyone else found this and if so, are these spammers/bots even a problem at all?

This is a common problem with Google Analytics and is called ghost spam/referrer spam.

They only send a request to your Google Analytics key (UA_XXXXXXXXXX), and the bots doesn't hit your website at all. They do this using the Measurement Protocol which allows developers to send raw user interaction data directly to Google Analytics servers.

The only real problem you will experience with this is the fact that it's annoying, and without filtering your analytics it may mess up your results, graphs and metrics.

There are multiple guides on how to hide/remove such spam from Google Analytics, for example this.


Is sql injection possible on this websocket? I was testing a websocket when i found an add to cart request like the following

["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"]

I tried to edit the value of the parameter qty to -1 and send the request. In response i received this error:

a["{\"error_msg\":\"Failed to add ITEM[0]: Data truncation: Out of range value for column 'qty' at row 1\",\"http_response_code\":\"500\",[...]"}"]

Out of range value for column 'qty' at row 1

This error should be a MySql error. So i tried to use other sql injection payloads but it doesn't seems to work.

I'm getting @request_type was not defined errors with sql injection payloads.

What payload can i use to verify this websocket is vulnerable to sql injection?

For sql injection to work, you need the program to construct a string.

SELECT * FROM table WHERE itemid = "$VALUE"

So, $VALUE = "-1" will produce:

SELECT * FROM table WHERE itemid = "-1"

$VALUE = "1\" OR itemid is not null and "a" = \"a"

will fill out as:

SELECT * FROM table WHERE itemid = "1\" OR itemid is not null and a = \"a"

Which should return everything......

However, they may be using bind parameters and since -1 and 1 are both integers, the binding logic will simple fill in the value and not let you break out of the quotes.

res = sql.query(q, [$VALUE])

if (res.error) return res.error

in that case, if $VALUE is the injection string, the library will not interpret the other clauses as commands. It will treat the whole value as a single variable. It doesn't do string manipulation, but keeps the command part and the variable part completely separate. It says to mysql:

here is the command: "SELECT * FROM table WHERE itemid = ?"
the command has one variable. here is the first variable: $VALUE

And because it's the server, and it has a ton of logic to figure out what the command part is and the variable parts are, it says ok, thanks for keeping those separate, it makes my job easier and i won't parse the variable as a command. and so the extra "and"s, "or"s, and "="s are not interpreted as commands but as the one value.


Is autocomplete=“off” compatible with all modern browsers? There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers:  I can't seem to find any documentation indicating which browsers support autocomplete="off". Can anyone point me in the right direction of a chart of form attributes and browser compatibility?

Password and Username caching on the browser allows an attacker, if by using sophisticated CSRF attack against the protected storage of the browser, or if by physical access to the victims machine to steal the victims credentials.

As a security consultant who wants to give the best practice and most secure solutions to his clients I want to make sure recommending AutoComplete="off" is the right solution to order the browser not to cache the user's credentials. For this I need to know if there are any browsers that don't apply this rule. If such case exists I need to recommend on another solution.
Pentesters among us might want this information to R&D special attacks against such browsers, and users might be interested in such information to know what browsers not to use.

Exact duplicate of SO question (which is more relevant than here): https://stackoverflow.com/questions/3868299/is-autocomplete-off-compatible-with-all-modern-browsers

Basically, most modern browsers attempt to respect it, though it would be trivial to write an javascript extension to ignore/disable it.  E.g., with jQuery library they could do something like add the following javascript to every page:

$(document).ready(function() {
 $(":input").attr('autocomplete', 'on');
}

which would override the autocomplete settings of the website.  Basically, your best bet is to set autocomplete='off' and additionally set a policy to tell users to never have the browser remember the password for this website.


SQL table column number changes with injection query? A very basic sql injection question here, I found a SQLi on a mysql website with product.php?id=200.

I first tired ORDER BY to figure out the column number of that table by product.php?id=200 order by 13

which turns out to be 12 columns, the error shows on order by 13 is

Error: SELECT * FROM `category` WHERE is_active='1' AND id =200 order by 13

Unknown column '13' in 'order clause'

Everything looks good, so I tried to figure out the table names next,

product.php?id=200 union select table_name,2,3,4,5,6,7,8,9,10,11,12 from
information_schema.tables

and it shows

Error: SELECT * FROM `products` WHERE is_active='1' AND id =200 union select
table_name,2,3,4,5,6,7,8,9,10,11,12 from information_schema.tables

The used SELECT statements have a different number of columns

Regardless how many numbers I put to the select query, it always show the same error, I assume there are some dynamic activities going on in the backend, but I am not sure what, and how should I proceed, any suggestions please? Thank you!

You are injecting into two different queries (one selecting from category, one from products), which select from tables which have a different column count. When you fix one column count, the other one will not match anymore.

You can't at the same time give different column counts - and you likely can't skip one of the queries - , so a simple union injection will not work.

As errors are displayed to you, you can use a simple error-based injection. If errors were not displayed, you could still use timing- and possibly content-based blind injection (see here for examples for all three). In each case, you would likely want to inject into the first query (it depends a bit on how errors are handled).


Use GnuPG to verify if specified user signed file To verify if file is signed correctly we use command:

gpg --verify <file_name>

and the output shows if file is signed correctly. And if it is, then signer name is shown. But is there possibility to specify in command line argument which user I expect to have signed that file?

I am invoking that command from Java and now I get exit code 0 from GPG whichever user have signed that file. I would like to specify which user I expect so GPG would return non-zero code when file was signed by other user. I know that I can compare GPG command output with my username, but I would like to know if I can check that on GPG command level.

I've looked into documentation, but I did not see that there.

You could, perhaps, use a keyring with only that specific key in it, and specify the keyring on the command line (using --no-default-keyring --keyring <file> )

Note that unless you have signed the key used to create the signature, the user name in GnuPG's output is not a good thing to check. Anybody can generate a valid key with a certain user name. Check the key's fingerprint instead.


What question(s) can someone ask an individual to quickly determine their 'hacking ability'? Scenario: You are on Craigslist searching for cheap electronics and come across an add for cheap E-reader. It's a bit of a deal with about 20-40% off the retail price so you contact the seller and all seems normal. You meet up to buy it and while you are discussing the E-reader you want to catch the seller off guard (in an effort to elicit an honest answer/reaction) and ask them a pointed security question (or two) that will gauge whether that person even knows enough to do anything technologically malicious.

What question(s) do you ask?

Let's assume you both are just an average Jack and Diane not cold war spies...

I submit imagine something like this:

  While Jack and Diane are closing the deal Suckin' on chili dogs
  outside the tastee freeze, Diane says...

  Diane - "Hey Jackie, do you know what the hex file signature books on
  this E-reader?"

  Jackie sits back, Reflects his thoughts for the moment, Scratches his
  head...

  Jack - "What's a hex file signature?"

  Diane - "Nevermind baby, You ain't missin' nuth-in."

  Jack - "Oh yeah, life goes on..."

  Two American kids done the best they can and close the deal.

In the above scenario, Diane feels relatively confident that Jack doesnt really know enough to root a device and put malware on it so she can feel safe buying from this football star.

I realise the premise is not the most secure because anyone can lie and depending on how well you can read a poker face you may not be able to discern the truth, but I am just looking for a quasi-security theatre solution. I mean once again, we are assuming you are buying an E-reader to just read 50 shades of grey and not the latest Presidential Intelligence Briefing

Also note that this is not limited to Ebooks, Americans, football stars, or 80's music lovers.

Jack sits back, Reflects his thoughts for the moment, Scratches his head wondering if you mean the magic bytes that would be used by file(1), the signature of the internal fs, the UUID of the device... and how to phrase it to be understood by Diane.

Jack - "What do you mean. What's that?"

  Diane thinks Jack has absolutely no idea and proceeds with the transaction.

Alternatively, suppose you confirm that Jack is a complete noob. However,

... his ex-girlfriend Eve put a trojan horse there before giving it to him.
...he is so incompetent at handling computers that his Desktop got infected and malware spread to the eBook.
... he bought it from Mallory who did something malicious to it.
... he is the lower rank from a criminal gang selling infected ebooks. He only sells them, and has no idea on how they were infected.¹

And all these scenarios assuming Jack is indeed caught off-guard, has an honest reaction and you are able to accurately discern it.

Really, if you are concerned about the device old contents, you should do a factory reset of the device. That will wipe it.

(Not the kind of answer you were expecting, but should serve you better)

¹ Just kidding. If the deal is too good to be true, then the catch is unlikely to be because they infected the ebook reader² (with which goal? to get a copy of 50 shades of grey from you?). I would expect that the device does not exist, is counterfeit, stolen, broken... Those would be easier ways to make money (for a criminal) selling readers.

² I assume you are not Angela Merkel aide.


How wireless routers are turned into a FlyTrap? With reference to WikiLeaks new revelations on CIA firmware CherryBlossom that has been infecting Wi-Fi routers for years. How does an attacker manage to inject an unsigned firmware without being connected to the wifi?

It is feasible for an attacker if the wifi security is open. He just needs to know the known vulnerabilities in the router's firmware. But what if the wi-fi is protected? You first need to break the wi-fi password and then bypass its router's administrative password.

  The wireless device itself is compromized by implanting a customized CherryBlossom firmware on it; some devices allow upgrading their firmware over a wireless link, so no physical access to the device is necessary for a successful infection. Once the new firmware on the device is flashed, the router or access point will become a so-called FlyTrap
  Wikileaks says

Do vendors even sign their firmware before flashing it so that only signed firmware updates can be flashed? In this way if an attacker tries to inject its own signed firmware, that will be discarded due to incorrect signature.

Sources: https://wikileaks.org/vault7/#CherryBlossom

https://arstechnica.com/security/2017/06/advanced-cia-firmware-turns-home-routers-into-covert-listening-posts/

http://securityaffairs.co/wordpress/60095/uncategorized/cia-cherry-blossom-framework.html

I'll tackle your second question first and then go back to the first.

No, firmware is not necessarily signed. Some vendors do, some don't.

  Most hardware makers don't cryptographically sign the firmware embedded in their systems nor include authentication features in their devices that can recognize signed firmware even if they did. [1]

My guess is that, in some cases, it's a matter of cost/benefit for the manufacturers. Adding cryptographic and authentication layers for their hardware just doesn't seem like it's worth the effort, even if considered in their threat model. As you see, it takes a very sophisticated entity to pull this type of exploit. Think about a cheap WLAN card manufacturer, chances are they are not going to go above and beyond to prevent it from being attacked by an entity like the NSA.

Other hardware vendors do care. Apple for example does sign their firmware. Or hardware used in smart grid applications are usually more cryptographically secure. Again, it just depends on how far (think cost) you want to go to protect your device.

Regarding your question about wi-fi open/closed. A password protection on a wi-fi hotspot doesn't make it invulnerable. There can be numerous ways to attack it; it just depends on the type of access that you have to the router (e.g. physical, remote, etc.) and the security protocols in place. In the end it's just a matter of how hard/easy it is going to be. How many individuals actually use strong passwords for their routers and admin controls? Most people don't want to type "3Vaz8d$#2!29bcSASxL%" as their router password, for example, and opt to go for more generic ones such as "we_dem_boys_2017"

Sources and Further Reading

[1] WIRED: Why Firmware is so Vulnerable to
Hacking
[2] WIRED: Hot the NSA Firmware Hacking
Works


What makes Let's Encrypt secure? Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every domain owner with a recognized certificate that can be used for TLS.

In order to prove that you own a domain, you need to install a file with particular (randomly generated) contents at a particular (randomly generated) URL on that domain. The Let's Encrypt server will verify this by accessing the URL, before signing the certificate.

Now, suppose I have some attack which will make the domain awesomebank.example resolve to my server. Suppose I can also MITM some peoples' connections to https://awesomebank.example/. TLS is intended to prevent me from seeing or altering their communications to the server without being detected.

What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for awesomebank.example, and then using it to MITM customers of AwesomeBank without being detected (because I have a valid certificate)? Doesn't the existence of a fully automated CA make the Internet less secure?

Same security as other DV certs

What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for awesomebank.example, and then using it to MITM customers of AwesomeBank without being detected (because I have a valid certificate)?

Nothing. If you own the network, then you own the network. And DV type certs (see below) rely on the network for proof of domain ownership. There are usually no out-of-band checks. (Nobody will call your phone, nobody will check your photo ID, nobody will visit you at the place the company is registered to, etc.)

Doesn't the existence of a fully automated CA make the Internet less secure?

Nope. Same level of security as DV type certs.
There are (currently) three assurance levels for x509 certs:

DV, Domain Validation
OV, Organization Validation
EV, Extended Validation

DV is the cheapest. It basically means "If somebody can answer an email to admin@example.com, then that person gets a certificate for example.com".
There are additional checks for OV, EV.
More info about cert types: GlobalSign.com: What are the different types of SSL Certificates? (Archived here.) Wikipedia: https://en.wikipedia.org/wiki/Public_key_certificate#Validation_levels
And a lot more background info in these slides here: RSAConference2017, Session ID: PDAC-W10, Kirk Hall, 100% Encrypted Web -- New Challenges for TLS
Further reading

Ryan Hurst,  2016-01-06, Understanding risks and avoiding FUD (Archived here.)
Nice blog post by GlobalSign CTO Ryan Hurst on his private blog.
He largely makes the same points as me. But it's a lot more in depth. And it's a bit of a rant against TrendMicro's rhetoric against Let's-Encrypt.
Note that TrendMicro and GlobalSign both sell SSL certificates and are direct competitors. (Also: They both are members of the CAB Forum and members of the CA Security Council.)
Update 2018-03-06: Scott Helme, 2018-03-06, Debunking the fallacy that paid certificates are better than free certificates, and other related nonsense (Archived here.)


What algorithms can be used for device pairing? I am to implement a system where android devices connect to a central server and have to register with different user accounts, so I have decided to create a pairing dance similar to what can be observed in bluetooth pairing, or software like the apple remote pairing with the itunes library. I'm searching information on what encryption algorithms can be used during this communication using a separate communication channel for the encryption key. The algorithm I've thought of would follow these steps:

The device powers on and calls a fixed server to announce itself.
The device shows a few random numbers on the screen (eg. 392582).
The user has to log in on the server with a web browser into his account and type in the number sequence seen on the device (might be done on the android device itself).

During step 1 the client would communicate to the server through SSL. The number shown to the user in step 2 would be part of a longer static predetermined string which would be hashed. The server and client would exchange the hash and verify it is the same. If it is, it means the pairing is OK. Some questions haunting me:

Is this actually sound or paring devices is done in other ways?
Is using MD5 hashing enough for this or should I be using other hashes?
What length and time expiration should the screen code have in order to prevent collisions with other potential users?
What refinements can be done to improve the authenticity of the connection? I've though of replacing the static longer predetermined string to hash with a random string. The client would send the seed of the random number generator during the first step. A man in the middle would still get it, but would this reduce hash collisions with other users?
I lack the technical security jargon, maybe this is a well studied process and tons of wikipedia articles exists on it? The information on wikipedia about bluetooth pairing/bonding doesn't give out too much technical details about implementation. Where should I look?

On reread I think I see what you are trying to accomplish.  User has an account on www.example_business.com and now wants to use example business's new android app.  You have decided you do not want the user to have to give full login through your android app.  Maybe you require two-factor authentication (where the second factor is the phone), or require certificates, or are afraid of carrier-IQ type keyloggers and do not want to do the full login procedure on the phone.

Client opens mobile_app for first time, which asks user for their user_name, and then sends a request to server for token with user_name.  (If user_name doesn't exist; do not communicate to mobile app).
Server generates random_number (say ten digit base36 with 36^10 ~ 10^15 possibilities initial displayed as lowercase to easily distinguish 0 from O) and sends this to the website.  Server sends timestamp + sha256hash(timestamp + user_name + random_number + high_entropy_secret_key_only_known_by_server) to Mobile app and instructions to logon to the website to get the random_number.  The high_entropy secret key should be something like: TQy9p4pDDHpZuS3Fimdag6yCtU9YBCt55PntmPyUPD_oxRMW3f that's kept secret on the server.
Client logs onto website, reads random_number, and types random_number into mobile-app.
Mobile app sends timestamp (from step2), user_name, received hash (from step2) and random_number (from step3) back to server.
Server checks that the timestamp is not too old (say less than a day), has not been blacklisted from too many bad attempts, checks that the hash matches the hash of the received data (does this case-insensitive; e.g., lowers case of random_number), and then sends a token to the mobile app linking the two accounts.

As for blacklisting after too many bad attempts; I'd blacklist usernames+timestamps that have failed three times; you can empty out the blacklist every day (since only day old timestamps work); have mobile app restart process with new timestamp/random_number).

I'd use SSL for all transmissions to prevent eavesdroppers.  Now for a user not having an account but knowing a valid user_name and trying to brute-force the random number, they'd have a 1 in 10^15 (about 20 million times less likely then winning the lottery) chance of guessing correctly per attempt.  But I'd further institute a step where you throttle logins for IP addresses and accounts that are failing syncing attempts too many times.


Ambiguous OCSP response acceptance requirements There are 6 requirements mentioned in RFC 2560 for an OCSP response to consider as a valid OCSP response:

The certificate identified in a received response corresponds to that which was identified in the corresponding request;
The signature on the response is valid;
The identity of the signer matches the intended recipient of the request.
The signer is currently authorized to sign the response.
The time at which the status being indicated is known to be correct (thisUpdate) is sufficiently recent.
When available, the time at or before which newer information will be available about the status of the certificate (nextUpdate) is greater than the current time.

The ambiguation in these requirements is that:

Why we need to check number 3? Is it possible that I send an OCSP request to Comodo CA, and then I receive a response from Iden Trust CA for example?! I mean, isn't it enough to check if the response is signed by one of the trusted CAs in my computers?
Why we need to check number 4? Is there any case which in that case a CA's OSCP responder become unauthorized after a while? If so, why? (I mean which cases)?

The OCSP response does not necessarily have to be signed by the same entity which signed the original certificate, as this responsibility can be delegated explicitly.

This is discussed in section 4.2.2.2 of RFC 2560:

  4.2.2.2  Authorized Responders

  The key that signs a certificate's status information need not be the
     same key that signed the certificate. It is necessary however to
     ensure that the entity signing this information is authorized to do
     so.  Therefore, a certificate's issuer MUST either sign the OCSP
     responses itself or it MUST explicitly designate this authority to
     another entity.  OCSP signing delegation SHALL be designated by the
     inclusion of id-kp-OCSPSigning in an extendedKeyUsage certificate
     extension included in the OCSP response signer's certificate.  This
     certificate MUST be issued directly by the CA that issued the
     certificate in question.

  Systems or applications that rely on OCSP responses MUST be capable
     of detecting and enforcing use of the id-ad-ocspSigning value as
     described above. They MAY provide a means of locally configuring one
     or more OCSP signing authorities, and specifying the set of CAs for
     which each signing authority is trusted. They MUST reject the
     response if the certificate required to validate the signature on the
     response fails to meet at least one of the following criteria:

  Matches a local configuration of OCSP signing authority for the
  certificate in question; or
  Is the certificate of the CA that issued the certificate in
  question; or
  Includes a value of id-ad-ocspSigning in an ExtendedKeyUsage
  extension and is issued by the CA that issued the certificate in
  question.

In regard to this part of your question:

  I mean, isn't it enough to check if the response is signed by one of the trusted CAs in my computers?

It is critical that this is not the case, otherwise any compromised CA could falsify an OCSP response for any certificate, rather than just certificates issued by it (or delegated to it). This is not limited to public CAs; imagine the case where a company's internal CA (e.g. for use with their intranet) is compromised and used to falsify OCSP responses when users visit external websites, thus bypassing HPKP and other stapling.

Subsection 4.2.2.2.1 explains check 4; the OCSP responder must also be checked for revocation to avoid a revoked CA being able to falsify OCSP responses.


How to implement "remember me" with JWT? In my web application I am using JWT. After a user loggs in, they are issued a refresh token and an access token. The refresh token is sent to cookie storage with the HTTP-only flag, while the access token is only saved in the memory of the front-end application. Basically once the browser is closed and re-opened, a new access token has to be requested based on the existing refresh token.
Now I want to implement a "remember me" functionality. I am thinking that if the "remember me" option is not set, only the access token (and not the refresh token) will be sent. Once the browser is closed or the access token expired, the user will have to login again.
Is this method secure? Are there any alternatives to it?

If I understand you correctly, everything will stay the same for a user that uses the "remember me" option? But a user that doesn't will only recieve an acces token? This should not pose any new security problems. All you are doing is giving the user the option to not getting a refresh token, i.e. recieve less access.
One thing, though. For non-remembered users, you plan to expire the session once the access token expires. That will probably either lead to a very annoying user experience where you have to login over and over again, or to long expiration times on the access tokens (which could be a security issue).
To get around that you will need a refresh token for all users, but set a shorter expiration time and perhaps don't store it on clients for as long if the user doesn't use the "remember me" option.


File encryption based on directory table I have a proposed method to encrypt files (I don't know if it is actually applied or discussed).
The way I suggest is to use a sector to sector table in a random manner,
So if a specific sector of the file is  x1 is mapped to y1 according to the sector to sector table.
The sector to sector table is created once at the first time OS is created or expanded as needed.
What is the benefit of this method over full-disk or file-based encryption?
The sector to sector table can be considered as a very large encryption key which makes brute force almost impossible.
The disadvantage needs hardware acceleration to make the sector to sector mapped seamlessly according to encrypted/mapped table,  the second drawback is small file size will not spread too much.
Can this idea be implemented in practice?

This is not encryption. The data on the disk would remain unchanged. An attacker can easily find data, e.g. by pieces of text for plain text files, by headers of binary files.

To you question Can this idea be implemented in practice? You can implement everything you want. You just should understand that it is not quite resistant against attacks.


Remote Private Key for Certificate Authority Background

I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key Infrastructure.

Conceptually, this is similar to using the OpenSSH Agent to sign connection requests for SSH. The key is never exposed to the application that prepared the request.

My interest is primarily academic. I handle RSA keys frequently for work, and just love peeking under the covers at how it all works. But if I can find something that is actually production-ready, I might use it for my day-to-day work with web deployments.

Options I've Explored

Azure KeyVault provides an interface for creating self-signed certificates, but if I want to use the certificates as client certificates with MongoDB (for example), then it would be helpful to have a certificate to use as the root.

I've looked at a number of options to achieve this goal. The one that seemed most promising is to write a custom PKCS11 provider to act as an intermediary to the API-wrapped key. Maybe using libcurl or something like that to make the API call. I'm not that competent a C/C++ programmer, so this wouldn't be a very practical solution for me... though I may be interested in pursuing it for the learning experience.

I could use a third-party solution like Hashicorp Vault PKI or CredHub Certificates. Hashicorp Vault has a storage provider to keep the resulting key in Azure KeyVault. But from the documentation, it appears both these services still leave the Private Key exposed to themselves.

I looked at pyOpenSSL as a higher-level abstraction to sign a CSR, but the API takes a private key as a parameter.

Benefits of Solution

To me, the perceived benefits of using such a solution are that the Private Key is never accessible (even to me). So an exposure of access to the Root CA key is limited to whatever certificates an attacker manages to issue while they have access.

Since access to the Key has an audit log, it would simplify tracking of it's use, and identifying unauthorized access.

The Actual Question

I'm trying to find or develop a solution where the digital signature is processed by a third party, but the logic of constructing the content to sign is handled locally, preferably by known standard solutions like OpenSSL (as library or CLI).

Does a solution exist for processing an x509 CSR into an x509 Certificate where the Private Key and signing algorithms are wrapped in a Web API?

Failing that, is there any good documentation somewhere to use existing libraries to convert a CSR into a Certificate on a low level? Blog posts welcome.

Many cryptographic APIs support network-attached Hardware Security Modules (HSMs), and using those APIs would already seem to qualify for your theoretical construct.

.NET Core has a CertificateRequest class. If you make a custom class which extends RSA to communicate with KeyVault (or use an existing one) then you can create certificates where the signing key lives in KeyVault.

X509SignatureGenerator generator =
    X509SignatureGenerator.CreateForRSA(keyVaultRsa, RSASignaturePadding.Pkcs1);

X509Certificate2 cert =
    request.Create(issuerCert.SubjectName, generator, notBefore, notAfter, serialNumber);

It can write CSRs, but not read them.  So that's only a partial answer, unless you don't actually have need for CSRs in your scenario.


Protecting against spoofed email in alias/phrase field We have fully configured SPF, DKIM and DMARC policies (100% reject) for our email domain (e.g. spoofed.com), which is managed by gmail, but we have recently started seeing spear phishing emails with the following format (our email addresses/names have been sanitised):
From: Bob Smith Bob@spoofed.com <admin@inter-corp.net>
Date: Wed, Aug 26, 2020 at 10:02 AM
Subject: External legal counsel.
To: <tim@spoofed.com>

tim,

I am contacting you regarding a sensitive operation that I have approved and for which I need you to manage it, has Adv.Thomas Legler informed you about this case?

Best Regards,
Bob Smith

Sent from my iPhone

The email From: header is:
From: "Bob Smith Bob@spoofed.com" <admin@inter-corp.net>

So we can see that the Bob@spoofed.com "faked" email address that the phisher is trying to imitate is part of the email alias/phrase field. Such From headers might incorrectly lead recipients to believe the email has genuinely come from Bob@spoofed.com when in fact it's from admin@inter-corp.net.
Are there any further best practice protections we can put in place to avoid spoofed email addresses being included in the email alias in this way?
If any further headers are required please let me know.

DMARC (and SPF and DKIM, though those aren't strong enough to block with without DMARC) key solely on the domain in the address, not the free-form field known as Friendly From or Display Name (or Alias or Phrase). There is no such equivalent for Friendly From spoofing. (BIMI is an attempt at corporate logos, but that's again not Friendly From.)
For mailboxes you control, you can write a filter that kills these. I don't know GMail's options (start by enabling Gmail's advanced anti-phishing and malware settings), but using the F/OSS SpamAssassin software, you can write a rule like this:
header    MF_SPOOFED_SPOOFED_COM  From:name =~ /\@spoofed\.com\b/i
describe  MF_SPOOFED_SPOOFED_COM  https://security.stackexchange.com/a/237604/42391
score     MF_SPOOFED_SPOOFED_COM  10

I'm using the prefix MF_ because your Stack Exchange handle implies those are your initials. It's always good to take credit so you and your peers can troubleshoot what's going on when there's an issue.
For mailboxes you do not control, there's unfortunately nothing you can do to stop forgeries of your domain that do not use your exact domain in the From header address.


apis.google.com has an invalid security certificate. How do I overcome this problem? This is a screenshot of my browser when I tried visiting my public calendar. It shows that apis.google.com has an invalid security certificate:

This means that there is some problem with my DNS right? What do I do to overcome this problem?

The error message says that the certificate is valid for "quicksearch.website". A simple search for this name at google shows you that this is malware. There a lots of information online about this specific malware and how to remove it, like Spyware.QuickSearch - Removal.


How can I securely edit an Office file that I downloaded from the Internet? When I open an Office file such as a Word file that was downloaded from the internet, it warns me that it might not be safe to edit unless I trust the file source, but what if I actually need the file and need to edit it?

Can I remove whatever it is that can make it dangerous?

In what way can I check that the file is not a threat?

While in read-only protected mode, select all text, and copy/paste into a new document.

The text of the document is not the threat but any macros and programming behind the document are threats. So, if you only need the text, copy that.

But, it is often not that simple. Some documents (like Excel) require macros and some programming to make them useful. At that point, you need to either:

open the document in the most up-to-date document reader available
open the document in a reader that is not the most common and targetted reader (something other than MS Office, like LibreOffice)
open and edit the document in on online reader (like Office 365)
open the document in a sandbox (like a Virtual Machine) that can limit the impact if the document is going to do something malicious

These options do not check that there is no threat, but it severely limits what impact the threat may have.


What is the security risk of enabling persistent connection (HTTP Keep-Alive)? By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is enabled for, say 60 seconds, then:
-any client-server communication will take place over the same connection
-any client-server communication after 60 seconds of inactivity will reinitiate the SSL handshake and then proceed with requests and repsonses.

Also, how is this connected to a user's session inactivity timeout?

whether the next packet of communication will be sent over the same connection or not

Nearly but not exactly. There is not "packet" at this level of communication, just a data stream. HTTP-Keep-alive will allow multiple HTTP requests over the same TCP/TLS connection instead of only one by not closing the connection immediately after the HTTP response but instead keeping it open for more requests.

  HTTP Keep-Alive header dictates

No, it dictates nothing. By adding Connection: keep-alive to the query (or implicitly by using HTTP/1.1 instead of HTTP/1.0) the client is asking the server politely to not close the TCP connection after the response is done. The server might agree or it might not.

  any client-server communication will take place over the same connection

Not necessarily. There might be multiple TCP/TLS connections open in parallel between browser and server.

  any client-server communication after 60 seconds of inactivity will reinitiate the SSL handshake and then proceed with requests and repsonses.

Client and server can decide to close the idle connection (i.e. no outstanding response) at any time and both have their independent settings and timers. If the connection is closed and the client wants to make a new request it needs to create a new TCP connection and for HTTPS it needs either to resume an existing SSL session on top of this TCP connection or to do a full TLS handshake for a new SSL session.

  Also, how is this connected to a user's session inactivity timeout?

This is completely unrelated. User sessions are managed at the application level. HTTP keep alive is managed at the HTTP protocol level. You can have multiple user sessions within a single TCP connection (with multiple HTTP requests) and you can also have a user session be kept over multiple TCP connections (both after each other and also parallel connections).

  What is the security risk of enabling persistent connection (HTTP Keep-Alive)?

There is none.


Do you need the internet to verify a TLS Cert? I am making a web app, where one portion is actually made to be run on a local machine for cases where there is no available internet connection. I figured out how I can serve my app over a port and have it available to iPhones over bluetooth. This means the phone needs to connect to something like https://mymachine.local. If the phone has already trusted a root CA from previous browsing, would the phone's browser trust my cert brought through a trusted source?

Root CA certificates are not trusted by the device simply by "browsing".

All browsers have a defined pre-trusted list of Root CA certificates (which is a poor security decision in my opinion). This list changes (certificates are added & removed) whenever the browser vendor wants to.

Chrome uses the OS local keystore as it's pre-trusted list of Root CA certificates, Firefox manages it's own list that differs from the OS.

You should either use a well known CA to sign the app's server certificate, or manage to import the app's Root CA Certificate in the keystore of all devices.

Install Certificate - Using Chrome on Windows

Install Certificate - Using Firefox on Windows

The answer to "Do you need the internet to verify a TLS Cert?" is: It depends. Most devices (Macs, Windows, smartphones) have a keystore with pre-trusted Root CA certificates.


Does WinRAR leave traces of temporarily extracted files? If I have an encrypted RAR file which will only open using a password, and I opened a file directly from within WinRAR by double clicking the file inside WinRAR, I assume that WinRAR will create a temporary version somewhere in the drive (temp folder?) before opening it using the default application assigned by the user in the system.

Does WinRAR make sure to delete all traces of the file once the archive is closed? or will it keep the temp file somewhere in the file system?

Very good question. Yes, by default, WinRAR leaves traces of temporarily extracted files.

WinRAR does indeed create temporary files when opening them directly from the archive. It also performs a normal deletion once WinRAR is closed. However, deleted files do physically stay on the disk after you delete them. Normal delete operations only delete the file from the filesystem index.

Think of it like trying to remove a page from a book by striking its title from the index page - the page stays in the book.

WinRAR has a nice feature that securely wipes (removes the index, and the page itself from the book) temporarily extracted files after WinRAR is closed. By default, this feature is turned off. You can turn it on from the security settings window.

By default, it's set to 'Never', you don't want that. The option 'Always' securely wipes all temporarily extracted files, while the option 'Encrypted only' wipes temporarily extracted files only if they belong to an encrypted archive.

Important notes: WinRAR will also create temporary files when extracting files by dragging them to the destination. However, using the "Extract here" option doesn't create temporary files.

As mentioned below, it's also important to make sure that you don't close WinRAR before closing your file. I've just tested this behavior a Microsoft Word document and a PDF file. The .docx file persisted in the temp folder, while the .pdf file was wiped as soon as WinRAR was closed. So make sure you understand that this behavior isn't very reliable if you close WinRAR or if it crashes.