Signatures for Intrusion Detection What are some good sources (free) to download attack signatures to develop a intrusion detection system over WLAN?

I suspect you may have conflated two things here, as @Steffen Ulrich indicated:

on one hand, you are talking about an IDS, which uses signatures, and could detect attacks. But most IDSes (AFAIK) don't treat WLAN distinctly - on the contrary, most IDS signatures (and certainly those from Emerging Threats) focus on IP and application layer - i.e. they look at traffic coming from connected WLAN clients, and indeed, coming from any network connected device. So an IDS will allow you to build what you want, but will do very little to protect your WLAN as such.
on the other hand, you are talking about detecting wireless intrusion (I assume), which is a completely different thing. Per https://en.wikipedia.org/wiki/Wireless_intrusion_prevention_system:

  In computing, a wireless intrusion prevention system (WIPS) is a network device that monitors the radio spectrum for the presence of unauthorized access points (intrusion detection), and can automatically take countermeasures (intrusion prevention).

In other words, you need to choose:

if you want to detect network 'attacks', an IDS is the correct solution, but doesn't (fundamentally) care about WLAN vs any other network. It is looking for actual 'attacks' as opposed to looking for signs of wireless intrusion. In other words, this is what will help you detect when something on your network does something.
if you want to detect wireless intrusion, you need something that monitor for rogue access points and clients, based not on signatures, but (in essence) on whitelisting. This will help you detect when something is trying to either join your network, or trying to steal clients from your network.

In the long run, both may have their place/use, but you do need to ensure you are picking the right tool for the job you are trying to do.


What remote forensic technique could be used to discover a malware running via process injection A piece of malware is running on a Windows 7 machine via process injection, so it does not show up in a process list. What remote forensic technique could be used to discover the malware is running under the contents of a specific process?

I would definitely use Process Mon from Sys Internals as well.

Link: Process Monitor Download Page

I would also look into AutoRuns as well from the same site. If by chance the malware is persistent, AutoRuns will show you whether or not the process is initiated at boot - as well as other useful information. Good luck!


Relatively simple OTP code generated by SafeNet MobilePass I noticed something peculiar while logging into the VPN of the company I work for.

I generated a one-time passcode from MobilePass, and the code displayed was “010010”. I captured an image of this occurrence, and am considering handing this over to the CISO.

Is it mathematically possible this code could be generated considering the algorithms backing a product such as MobilePass, or does it need to be reported?

0.0064% (that's .2^6) of the numbers in a random 6 digit string will only have 0's and 1's. You got one. No big deal. It's only a problem if those numbers occur more than  0.0064% of the time or you can predict when they will occur.

If you pay attention, and wait long enough, you'll see that 1 in 1,000,000 of the random numbers will be your birth date in the form DDMMYY. You can reduce your expected wait time by half by also looking for your birthday in the form MMDDYY. In general, if you treat enough numbers as significant, you're bound to see them all the time.


AngularJS - Can a response from an $http.post to PHP be modified? I have an angularJS $http.post that sends username/password to a PHP file that then queries my database to verify a successful log in. I then return a JSON object back to angularJS in one of the formats below:

{'success' : 'true', 'userFirstName' : [firstNameFromDatabaseQuery]}

or

{'success' : 'false'}

Once back in angularJS, I check the value of success to determine if the user's credentials were valid, and log in the user if so.

To my question - can this JSON response from PHP be modified by a user to mark their log in as successful, by changing success to 'true'?

I feel it is worth mentioning that I chose this way over using PHP session variables because it was not working well in my angular application, and it also seems to be a lot cleaner code. Additionally, this is a very simple application. No significant personal information will be involved, such as SSNs or bank/credit card info.

Yes, the client could modify the PHP to change the value of success to true. However, it depends on your application logic to determine if that has any security consequences on your application. If the application just uses the success value to load a new UI, but can't pull down any data (because the user doesn't have an authentication cookie, or some other authorization token), then it wouldn't really be a concern.

However, if future requests (say, change password), use the userFirstName as the mechanism of authentication (that is, the back end PHP sees the first name and based only on that) then the application could not only be spoofed by changing success=true but also by setting userFirstName any attacker could become any other person if they know their first name.

Instead, you would return an authentication cookie of some kind. This would most likely be a random session ID that is sent with every future request. The backend PHP would then validate the session ID, and from it, know who the user is that is making the request.

This post has some ideas as to how to use authentication in angularjs applications.


What's the best way to salt a useragent string? What would be the best way to salt a periodically changing useragent string, so as to avert browser fingerprinting?

For example, a useragent string like this:

  Mozilla/5.0 (X11; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0

could be salted by appending some random digits, which would change every few minutes, to the revision number:

  Mozilla/5.0 (X11; Linux x86_64; rv:50.0483) Gecko/20100101 Firefox/50.0

Would this be effective?

Would this be effective?

No. The fact that you append random digits which may or may not be plausible version numbers makes you actually easier to detect.

If you want to use a forged user-agent string, you should choose from the most common ones. (E.g., from this list.) Any custom modifications will rather attract attention than enhance your privacy.
And as @guest lined out, there are also a lot more vectors to identify you than just the UA.

Also, be aware that many pages rely on the user agent for their presentation. With the UA for a different OS and browser you will occasionally encounter broken websites because they serve the wrong scripts or stylesheets.


How does ASIC cryptocoin miners affect the security of scrypt? Is the availability of these miners a reason to favor bcrypt (or something else) over scrypt?

I mean, the goal of a password hash function is to maximize the work needed for an attacker to break a hash through brute force, dictionary or whatever, while minimizing the work needed for legitimite use. If the attacker can calculate hashes at many times the speed of the server, there is a weakness.

ASIC miners for scrypt-based cryptocurrencies are very efficient at calculating scrypt hashes, and most servers don't use cryptocurrency mining hardware to speed up password hashing.

Is it a problem that the attacker has access to good mining hardware?

The theory of password hashing is that the whole problem is an arms race between attacker and defender. The password hashing function (bcrypt, scrypt...) is made deliberately slow, as much as the defender can tolerate on his hardware. We assume that the attacker can buy the same kind of hardware as the defender, so he can always be at least as efficient as the defender. The hope of the attacker is that he can buy or build specialized hardware that will be able to compute more hashes for the same budget.

Machines specialized for mining coins based on scrypt are inherently good news for the attacker, because such machines make sense only if they do more scrypts per second than a basic PC of the same price. However, this does not necessarily translate to an actual attack model, notably because scrypt is a highly configurable function (both RAM usage and CPU cost can be set) and the combinations for which the miners are optimized do not necessarily match what was used to hash passwords on a given server. The crucial property is how much the mining hardware can be re-purposed for other scrypt parameters.

Another important point is that bcrypt is known to be "more easily broken" with FPGA-based hardware (newer FPGA contain embedded RAM blocks that are very interesting for implementing bcrypt -- each bcrypt instance only needs 4 kB of RAM). Thus, even assuming that the mining ASIC can speed up the attacker, it is unclear whether it will speed him up more than what he can get with FPGA against bcrypt.

You have to remember that password hashing is a problem that spans cryptography, engineering and economics. You must take all these aspects into account if you want to reach a decision.

(Also, scrypt was designed and optimized for a rather specific case, namely password-based encryption of hard disks. This is a usage scenario that is quite different from a Web server authenticating users; when hashing the master password for your laptop hard disk, the system can take a few seconds worth of CPU, and may use gigabytes of RAM. Using scrypt on an authentication server implies moving the parameters out of this zone.)


How can caller ID be faked? My late brother was contacted by someone on landline number operated by a carrier in Australia and which displayed on caller ID. I traced the number to a company and though they did call him on a number of occasions from this number over a couple of days, they did not make the particular call in question which occurred in the same time frame.

This has left me asking, is it possible someone could hack in and use their telephone number to phone my brother?

The company is a financial services company and they were set up to make outbound calls using various landline numbers programmed into an auto dialler machine or possibly cloud-based phone system. They have been very cooperative and I am confident they did not make the call in question. I have also established the identity of the person who made the call to my brother, but how on earth did he get one of the company landline numbers to show in caller ID? This has me stumped.

Ars Technica did a superb piece on this a couple of years ago. A woman who is a real estate agent and publishes her cell phone, was inundated with junk calls. What was odd about these was

They were fully automated calls
They never played a message
They used a different number every time

They detailed her nightmare

On the first night, France went to bed, slept for 7.5 hours, and woke up to 225 missed calls, she said. The calls continued at roughly the same pace for the rest of the five-day stretch, putting the number of calls at somewhere around 700 a day.
France installed robocall blocking tools on her phone, but they didn't stop the flood. Unfortunately, anti-robocall services that rely primarily on blacklists of known scam numbers generally don't block calls when the Caller ID has been spoofed to hide the caller's true number.

They included this quote from a security researcher (emphasis mine)

Because it's an old, circuit-switched network, none of the switches along the way need to know who actually is placing the call. I was shocked to find out that the Caller ID is just an optional part of the original address message that gets sent along. You don't need it, and nobody is checking it along the way for authenticity, and, really this means you can put that to be whatever you want. To top it off, there are a lot of online services that allow you to send out phone calls and specify exactly what Caller ID you want them to come from.

I've had to explain this to numerous family and friends. The pinnacle there was my father-in-law, who called me up one day to ask how he got robo-dialed from his own number. I even get random calls sometimes from people saying "I'm returning your call" when I have no idea who they even are, let alone know how to call them.
Caller ID is never verified. That is hard to explain to most people, because their cell phone sends a proper ID and they can't easily spoof it. But the rise of VOIP, combined with the plummeting cost of phone calls in general and turnkey software that makes spoofing a breeze, has made this an incredibly cheap way to spam and scam people, especially from abroad. The FCC is proposing some changes to address this, but those changes are likely years off.


I want to store a large number of relatively short-lived symmetric keys Each encrypted blob will have a well-defined, but different lifetime. Some will be around for 5 minutes, some for a day, some for a week, none for over a month.

I would like to be able to "delete" the file by discarding the key, even if the file is no longer under my control, e.g. on a backup medium somewhere, or stolen by an attacker (oh my!).

On the other hand, I do need each key to persist in the face of a crash until its lifetime expires.

Confidentiality is more important than availability: "It's gone forever" is usually better than "Eve has it".

So I have this crazy idea:

 A 128 GiB file is generated from a secure PRNG. The seed is stored securely offline. (Eve gets the seed = game over)
 When a new key is needed, a random 32-bit number will be generated. (or 31 bits plus a G bit for the current generation.)
 This 32 bit number is an index into this keyfile where the actual key material is stored.

Advantages:
An attacker would have to copy the entire file to be able to decrypt files offline.
4 bytes is potentially easier to atomically store/erase than 32 bytes
The key file could be stored in a raw block device without filesystem layers.
Online key generation might require less entropy.

Disadvantages:
It may be more complex than simply storing a key from /dev/{u,}random in a file as it is generated.
Would the disk seeks expose a side channel?  I plan to run the application exclusively on bare metal, so I'm not extremely worried about this.
The space occupied by the keyfile might be put to other (better) uses.

Would I be wasting my time trying to implement this because there is a well-known better way?

The only security improvement from your scheme (over the situation where you do not apply it) lies on the following:

  An attacker would have to copy the entire file to be able to decrypt files offline.

The rest is just secondary considerations on performance issues. The core of the idea, from a "security" point of view, is that you make it difficult to obtain the whole key file through its sheer size. Indeed, there are two kinds of attacks that you worry about:

Online attacks: the attacker subverts your server, and since the server can decrypt all data files, then the online attacker can do the same as long as he maintains control of the server.
Offline attacks: the attacker grabs some data from the server and uses that to decrypt files after the attacker has been evicted from the server.

Your point is about making like harder for offline attackers, i.e. making them strictly less powerful than online attackers. I would then argue that your idea does not work well. Indeed, it is not true that the attacker would need to "copy the entire file". The attacker would need the whole file in order to be able to decrypt all files; but if he gets only 128 MB out of the whole file, he can still decrypt one file every thousands. Moreover, depending on how the attacker breaks in, "downloading" the entire key file might not be a problem for him. In particular, attackers sometime retrieve old, discarded hard disks from dumpsters: if the electronics of your disk failed, then you cannot easily wipe the contents, but a motivated attacker could recover the disk, replace the electronic board, and read the whole file. 128 GB are no bigger than 128 bytes under these conditions: that's just a disk, which fits in the palm of his hand.

There is a better solution here, which entails using some tamper-resistant hardware, e.g. a smart card or a hardware security module (the latter is much more expensive, but offers much better performance). That device will happily decrypt asymmetrically-encrypted blobs on behalf of your server, but it will never give its private key. In this setup, the device contains an asymmetric key pair (say, RSA); when a file is to be encrypted, a random symmetric key K is generated, and that key is used to encrypt the file with some symmetric encryption algorithm. The symmetric key is also asymmetrically encrypted with the device RSA public key. When a file is to be decrypted, the device is invoked to recover the symmetric key K and decrypt the file. K itself is kept in RAM only for the few milliseconds needed for encryption or decryption of the file data, and each file gets its own K.

By construction, an online attacker can use the device to decrypt files, but once offline, he has nothing left. This is a much more thorough protection system than assumptions on the alleged hardness of downloading some gigabytes from an Internet-connected server.


Why does Chrome tell me this certificate is valid when it can't be verified? Update: Now Chrome rejects this website for me.
It seems the trusting is just cached somewhere?
I guess this question isn't as interesting as I thought, but it'd be nice if someone could clarify it.

Original question:
I've disabled automatic certificate updating, removed the root certificate, and rebooted my computer.
Yet Chrome is still trusting the certificate from this site, even though Windows finds it unverifiable!
Why in the world is this happening? Screenshot:

Looks like a reported bug.  Someone blogged about it.


Creating a dummy account for account verification I recently wanted to do some major changes to my account for an online game. So they wanted to do a thorough account verification.

First they asked me for some character information which can be easily gotten from the account as well as where the account was created. This seems like a great question because you can't see that information when logging into the account.

Then they asked for my current IP address (using a third party site like whatsmyip) and then asked me to create a dummy account. Creating a dummy account only requires an account name and an email address, you don't even need access to the email address.

Question: what is the point of creating a dummy account? What information helpful for account verification to they gain from that?

PS: I'm certain I talked to the actual support of the online game as the changes to my account where made and this could not have been done by a thirty party hacker.

It is possible that the goal is to compare your current ip when you create this dummy account with the one you use for your real account.

However, this system does not seem practical for a user. Normally a confirmation of the current password, a code or a link sent by email is enough.


If all ports are closed, do I need firewall? I often read an article which enables a firewall to secure public Wi-fi.

But I think a firewall may not be needed when (like nmap said) all ports are closed.

If all ports are closed, all packets which are received by attackers are dropped because there are no services attached to the port.

Does my thinking seem correct?

Connection requests to unbound TCP ports will not be DROPped, they will be REJECTed. (And although this requires a little more effort on your PC's behalf, this is also what most firewall configurations do, so it doesn't really matter.) Otherwise, your assumption is good - if no services are listening on any of your incoming ports, you don't need a firewall.

But how do you make sure this is the case?

Do you know of each and every program on your machine that is able to listen on a port? Maybe you have a program that happens to listen on a port for some useful function but it's buggy and it can be exploited. Maybe you have a virus that listens on a port to receive commands. Maybe you forgot to turn off file sharing and all of your family pictures are now on the laptop of the man across you at McDonald's, or worse, deleted.

Firewalls are much more convenient and secure. On a modern operating system, you can't make sure you know each and every process that may put your machine or your data at risk if you allow them on the net. You can easily block these using a firewall. If you configure your firewall well, you can make sure that only the processes you want are allowed to listen, because you need to give permission manually to every one of them.


It it possible to host pre-signed html content so I don't need ever to upload my private key to a server? The question is simple. My private key should only be necessary to resign something if it changes. If I have a static html website, can I use my private key (signed by a CA) to sign all thes html files, send everything except ny private key to the server, and then make nginx deliver them?

I know that in the TLS there is a complex handshake and lots of randomness added to make each session unique but are those dependent on the private key? Is there a TLS method that can do what I want?

If there isn't such a thing, it should exist.

TLS is used for protecting the communication between client and server. The application data are encrypted with keys which are unique for each connection and which are created during the key exchange part in the TLS handshake. The key exchange is constructed in a way that both input from client and server is used to create the keys and thus no side has full control over the encryption keys.

The recommended key exchange method is Diffie-Hellman and this is also the only one which is available in TLS 1.3. No private key of the server is even used during the key exchange and thus the private key of the server does not affect how the data gets encrypted. This also means that there is no way to pre-encrypt the data by somehow using the private key. The private key is only used for authentication, i.e. to make sure that the client is actually taking to the correct server.

And while in the older RSA key exchange method the private key of the server is involved to protect the exchanged key it does not influence which key gets created and thus pre-encrypting the contents is not possible in this case too.

In other words: the main point of the private key is to provide authentication to make sure that the client is talking to the correct server. This authentication is done by signing some kind of challenge with this private key and thus proving ownership of this key. Since this challenge is unique for each TLS session the server must actually somehow have access to the private key and cannot just offer pre-signed content.

Still, you could use a certificate in theory to sign all the static content you have and you could then transport this signed content over plain HTTP. This would not protect the content against sniffing but it would protect it against manipulation. While this kind of protection is outside of TLS you can find something like this for instance in mail (S/MIME or PGP). Still, it needs a client which will verify such signatures but there is currently no such client. But there is actually an internet draft which goes in the direction of what you want: Signing HTTP Messages
                    draft-cavage-http-signatures.


Should security phrases be hashed? I didn't think of this before but today I just realised that in soke sites, pw recovery is possible if you know the answers to security questions like

What is your mother's maiden name?

In this case, should the answers to the security questions be hashed or not?

it depends on how you plan to use the answers.

If you expect to do strict automatic checking then treat them as passwords and apply key-derivation function such as bcrypt/scrypt. (But remember, that BCrypt uses only first 72 characters of string for the hash. is that enough for your case?)

on the other hand, if there is a chance of phone-based support and you want call-operators to interpret users answers you need to store strings as-is

p.s. using plain hash-functions (such as md5,sha) is not the answer to this problem in any case


SSL/TLS in-memory data interception after decryption In a scenario where a client is reading data from a server over SSL/TLS and then encrypts that data using a client-side symmetric key before saving it to the disk, how susceptible is the data to an in-memory attack (e.g., by tools like SSLsnoop)?

Would the client need to do anything extra (e.g., get the data encrypted from the server, irrespective of the SSL/TLS part) to secure the confidentiality of the communication?

Also, are mobile devices anyhow more vulnerable to such attacks?

Any attacker who gains sufficient privileges to inspect the memory of other process is an attacker who has full control over the machine -- at which point anything which happens in that machine can be known to the attacker. This is true of every machine and OS, including mobile devices; however, while multi-user servers with a Unix-like operating system are quite traditional, multi-user iPhones are quite rarer.

If the client can thus be hijacked, then there is no way out of it except making it so that the client never gets the cleartext data in the first place. But then, the client does not have access to the cleartext data, which reduces its functionality (e.g. it cannot show it to the user).

A reduced scenario is about virtual memory. When a computer has data in memory, that data may get copied into swap space by the OS, in an automated fashion. An attacker seizing the machine afterwards may thus get excerpts of sensitive data by looking at the swap space. If an application manages data which is exceptionally sensitive, it can ask the kernel never to write it to swap space; on Linux systems, this is done with mlock(). GnuPG does that, when it has private keys in memory.

A tempting alternative is to disable swap space altogether; modern computers have a lot of RAM, and use programming systems which don't interact well with virtual memory anyway (that's a known issue of garbage collectors). A computer with no swap space will, by definition, never let memory-based data be written to the disk; not that such a computer would not be able to go into prolonged disk-based hibernation mode.

It is worth noting that "mobile devices" (smartphones, tablets...), as a rule, don't have Virtual Memory, because their storage capacity is not up to it anyway. In that sense, mobile devices may be a better bet than traditional computers with "normal" configuration, when it comes to limiting data leaks through persistent storage.


Best ways to keep a website safe without web security and cybersecurity knowledge? What are the best ways to keep a website safe without web security and cybersecurity knowledge? Will a top WAF service (commercial) be sufficient for handling most (of course not for all, more specific 95%) attacking activities?

Thanks for your all comments.

To be more specific: What kinds of tools or services should I use for our cloud-hosted dynamic (vendor-developed CMS with PHP) and ordinary company websites to keep them safe, besides WAF, SSL, immediately updating and secure coding (which is not a practical way since we do not have sufficient secure coding experience)? The practical way to keep our site safe, I figured, would be to use third party tools or service, based on ROI. The vulnerabilities are mostly caused by not-secure coding.

what are best ways to keep a website safe without web security and cybersecurity knowledge?

Shut it down, delete the code.

But since this is not the answer you want to hear, let's take a deeper dive:

Depending on the website we're talking about - Is it a CMS like WordPress? Is it something an intern clicked together in Dreamweaver? Is it a simple index.html only containing an address and a phone number? - it's impossible to give informed recommendations. So try to get a basic understanding of what area you want to improve next and ask a more focused question.

However, as a general rule of thumb you can do the following:

Keep it up to date!
Get a pentest from a reputable source to get your most critical vulnerabilities and fix them ASAP.
If you use a regular CMS you can start by scanning it with a vulnerability scanner like OpenVAS/Nessus
If you coded/customized it yourself (e.g. no off the shelf CMS) you can additionally run it through SAST (static application security testing) and DAST (dynamic application security testing) tools.
OWASP has a plethora of guidelines, checklists, cheat sheets etc. - read them, apply them.
Don't forget about key-, password- and access management to the website and infrastructure. The best website security is useless if you enable unauthenticated SSH to your production server. Same goes for social engineering.
Get another pentest after you fixed your issues to find even more issues (quality management is a cycle for a reason).
Set up secure network segregation between dev, test and prod.
Monitor network traffic with IDS/IPS.
Logging, logging and more logging - log everything: access, failed logins, destinations, successful logins etc. etc. (but beware of GDPR et al).
And most importantly, get educated. Read up on everything web security related. Watch tutorials, read books, news sites, blogs etc.

Or, if you really care about your website's security, hire a professional to guide you through this process. My guess is that this option will be more thorough, more secure and a lot cheaper than trying to fix this on your own.


Does the SSL encryption strength or validation level of a website really matter? When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart.

Immediately there seems to be 4 major options: Cheap certificates, business class certificates (which have the same features as cheap certificates but with support and a bigger grantee), wildcard certificates, and Extended Validation certificates.

Does it really matter in the end which certificate you get? How many people besides paranoid security people check the encryption strength and the level of verification of every HTTPS site before going further in?

Why would sites go for Extended Validation when a cheap certificate or Business certificate will do just fine? Extended validation in this case is 4x as expensive than the Business certificates, and 30x as expensive as a cheap certificate. Is it purely for the tech support and larger grantee's or is there another reason?

The important part in the page you point to is the "guarantee": how much money NetworkSolutions puts at stake. The options all boil down, more or less directly, to that.

Cryptographically speaking, the "encryption strength" will depend on the type and size of your public key (the one you will put in the certificate) and the cipher suites you configure on your SSL server; this is mostly orthogonal to the certificate "category". NetworkSolutions might enforce some requirements on the public key (e.g. requiring a 2048-bit RSA key for the more expensive certificate types); but SSL server configuration is completely out of their reach.


How can I increase /proc/sys/kernel/random/entropy_avail I have access to genuine random numbers - random.org, for example.

I have a number of processes using /dev/random and my value for /proc/sys/kernel/random/entropy_avail is 143, which is pretty low.

I'd like to have a process that monitors /proc/sys/kernel/random/entropy_avail and, when it drops below about 3000, tops it up.

How can I incorporate the random numbers from random.org into /dev/random so that entropy_avail increases?

Do not use an online source of entropy!
If your system currently has insufficient entropy, then it will not be able to make a secure connection to random.org and any material you download from it will not be secret. Furthermore, you should not be using the blocking device anyway. It's perfectly fine to use /dev/urandom, no matter how low the entropy estimate is. If for whatever reason you are using a program that is foolishly using the blocking device, you can keep it topped off by installing haveged, a daemon that attempts to generate random data from memory latency. Please see https://www.2uo.de/myths-about-urandom for more.
If you still want to shoot yourself in the foot, then you can use an IOCTL on the random character device to adjust the entropy estimate. From random(4), the RNDADDENTROPY IOCTL is what you want:

RNDADDENTROPY
       Add some additional entropy to the input pool, incrementing
       the entropy count.  This differs from writing to /dev/random
       or /dev/urandom, which only adds some data but does not incre‐
       ment the entropy count.  The following structure is used:

           struct rand_pool_info {
               int    entropy_count;
               int    buf_size;
               __u32  buf[0];
           };

       Here entropy_count is the value added to (or subtracted from)
       the entropy count, and buf is the buffer of size buf_size
       which gets added to the entropy pool.

This IOCTL requires the CAP_SYS_ADMIN capability to function.

Very related:

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

Feeding /dev/random entropy pool?

Is a rand from /dev/urandom secure for a login key?

Is "always use /dev/urandom" still good advice in an age of containers and isolation?


How to safely show some text on a webpage? I want to display some very sensitive information on a web page and I want to make sure that nobody, except the user in front of the browser, is able to access this information. I'm aware that in general is it not a good idea, but some site manage to do it. For example : LastPass

What are the security risk to consider?

How would you proceed to implement it securely?

Assume that the client computer is not compromised and that it's the client problem to be sure no on else is looking above his shoulder.

Now, if you are going to just reply "NO", just don't. It's clearly possible because some site are doing it or are you saying that they are all unsafe? If this is the case, could you please elaborate?

And, before anyone flag this question as duplicate, I just asked the same thing here but it didn't receive any good answer and the question was put on hold, maybe because I didn't formulate the question correctly.

Also, if anything is not clear in the question, please leave a comment below and I will answer it.

There is no magic way to safely display text on a webpage.  Either it is safe to display or it isn't, and which of those buckets your data falls into depends on your threat model.   What specific threat are you wanting to protect against, and what is the risk of the threat being utilized in an attack?  To counter the risk, what is the value of displaying the data to the user?  Is it important enough that they see the data that the value outweighs the risk?

In the case of LassPass, the entire application is designed to allow you to manage passwords.  Sometimes that means you need to see the passwords in plain-text.  It's an important feature of the app, and thus, worth the risk of a shoulder-surfer discovering the password.  For most other applications, there's not really much value in displaying a plain-text password to the user, so displaying it wouldn't offset even small risks.

So, you have to decide for your use case is the value of displaying the data to the user greater than the risk, or not?

Beyond this, it's worth mentioning that there is a third way.   You could leave it up to the user.   You could ask them (via a checkbox, or a link, for instance)  if they want the data to be displayed.  Then it's up to them to determine if the value of seeing the data outweighs not only the general risk, but the specific risk at that instant.  (They might choose differently if using a computer at home vs. a kiosk in a crowded mall, for instance.)  So you could default to the safer option of not making the data display, but give the user the option to override that default.  Realistically though, there needs to be significant value in displaying the data for you to even display it at all.  Generally in the specific case of displaying a user's password in plain-text, that value simply doesn't exist.


What is a threat tree in threat modeling? The OWASP Application Threat Modeling, quoting step 2 says specifically:

  These threats can be identified further as the roots for threat trees; there is one tree for each threat goal.

what is threat tree and what it has to do with a potential threat goal in threat modeling for web applications?

An attack tree and a threat tree are the same thing.  In a traditional application  threat model, you start with the component that you're building, (be that the entire application, a component or function, a data flow, etc.) and enumerate the  potential threats to that component.

When you're building an attack tree, the development is reversed.  You start with the attacker's end goal, and then enumerate the possible ways you could achieve the end goal, and only then look at the application to find locations where it may be vulnerable to the vectors you've identified.

As Adam Shostack mentioned in his answer, attack trees are generally more suited to more advanced practitioners, and usually as a complement to traditional threat models, not a replacement for them.

Ideologically, attack trees are more a red-team style attacker-centric approach to the problem, which can provide useful additional insight.


Why are downloads of Mac updates redirected to plain HTTP? I am downloading an inbetween version of MacOS necessary to update to High Sierra from an older version of El Capitan from here.

Funny thing is, when I right click and get the download link from Chrome, it gives me an HTTP, not HTTPS. So, I attempted to get it with a browser and using wget and no matter how I try to get it, I get a 302 moved temporarily redirect to an insecure connection.

Try it: https://support.apple.com/downloads/DL1930/en_US/macosupd10.12.6.dmg

That link will redirect to the non-secure version of itself. There is no way to know that the dmg file you get has been altered.

It's common practice to offer large file downloads over plain HTTP and rely on other means to ensure file integrity. Since your MacOS checks signature before installing the update (or anything else) and thereby verifies that the file has not been altered, you don't risk installing malware.

This procedure compromises confidentiality (an eavesdropper can see what you're downloading), but it is somewhat faster since it skips the TLS encryption/decryption parts.

Edit: Turns out we have already discussed this in-depth: Why aren't application downloads routinely done over HTTPS?


jwt in message payload? My background is more onto SOAP, where we can do transport authentication and message authentication together. Basically we use http basic and SAML token in message payload.

Regarding jwt, I have questions:

if jwt uses http heeder authorization, does it mean i cant use http basic(or digest) as first layer security?
is it possible to put jwt in the message payload just like soap does?

Thanks in advance.

Depends how much you can deviate from specification.
As HTTP standard authentication token is being passed in Authorization header. But nothing prevents you from using this token somewhere else.
Recently I worked with application where JWT was inside cookie, so nothing prevents you from delivering token as part of message body.


SHA1 hash encoded with base64 results not consistent? When i take a hash of user input test123+ i get the following base64 result:-
YaddchSU52yztwIMdtHzkg3p1oA=
The results have been obtained using the online sha1 convertor

I m failing to understand how does this work?  When i take just convert test123+ using sha1 i get d478f2a272d7830987e8cd1c732af606.  Now when i do the base64 encoding on this input i get this result ZDQ3OGYyYTI3MmQ3ODMwOTg3ZThjZDFjNzMyYWY2MDY=

Why are two base64 conversion so different?

You've generating the base64 encoding of the ASCII hex string, rather than the raw bytes of the hash function's output.


Hardening ASP.NET against session fixation: Should I change the session ID despite the additional Auth cookie? Situation

I am the responsible developer for an ASP.NET application that uses the "Membership" (username and password) authentication scheme. I am presented with the following report from a WebInspect scan:

  WebInspect has found a session fixation vulnerability on the site. Session fixation allows an attacker to impersonate a user by abusing an authenticated session ID (SID).

Reproduction

I tried to reproduce the typical session fixation attack, using the guide on OWASP:

I retrieve the login page. When inspecting the cookies with Google Chrome's Developer Tools (F12), I get:

ASP.NET_SessionId w4bce3a0e5j4fmxj3b0lqkw2

After authentication on the login page, I get an additional

.ASPXAUTH F0B9C00FC624E3F2C0CD2EC9E5EF7D10D91A6D62A26BAEE67A38D0608198750A2428E1F5D7278DCE6312C32EE2788D6C79E8112EA35B2397DB84FBB2BE1DBDA815A304B12505D2B786B00038B1EB0BE854DBDAF13072AFEDB3A21E36A7BCD7CD0032A0BCE8E90ECEAFA5FF487D6D2E2C
while the session cookie stays the same (as preconditioned for a session fixation attack)

Attack: However, if steal/make up and fix only the ASP.NET_SessionId and inject it into another browser, the request is not authenticated. It is authenticated only after also stealing the .ASPXAUTH cookie, which is only available AFTER login.

Conclusion

I come to the following conclusion:

While the typical precondition for a session fixation attack is met (non-changing session id), an attack will fail because of the missing, required additional .ASPXAUTH cookie, provided only AFTER successful authentication.

Question

So, should I really change the session cookie after login? Will this only satisfy the WebInspect scan or is there a real value here?

Note: I am very likely having the exact scenario as in Session Fixation: A token and an id, but I am not asking whether it is vulnerable, but what I should do with regards to the report.

I think you could ignore the report. Tools automate tasks so you should always review the findings, as in this case.
The tool maybe just checks if the value of the cookieA is equals to the value of cookieA after the authentication and then tells you if your app is vulnerable or not.
Probably it doesn't consider how the new secret the server is giving to the user protects it from the session fixation attack.
The prerequisite of the session fixation attack is that the attacker should be able to know a session id value which doesn't change after the authentication (this would occur using only ASP.NET_SessionId).
In your scenario the attacker can't hijack the session because the handling of the session is not based only on one secret but involves 2 strictly coupled tokens and he can't know the secret set after authentication.


Key length and hash function in PBKDF2 On this page:
http://www.ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/PKCS5.html
they make a statement that strikes me as rather weird:

Key Length
Specifies the length in bytes of the output that will be generated. Typically, the key length should be larger than or equal to the output length of the underlying digest function.

So if we take this seriously, if we are using SHA-512 (64 bytes), we should only obtain key sizes that are more than 64 bytes. This would mean that we cannot (or should not) obtain 32 byte keys for use with AES-256.
But according to this logic, we should instead opt for SHA-1 (20 bytes), since 32 bytes are now larger than the 20 bytes of SHA-1.
What am I missing?

The statement is weird, because it comes from a knee-jerk ritualistic reflex about key lengths.

The full text from the page is:

  Specifies the length in bytes of the output that will be generated. Typically, the key length should be larger than or equal to the output length of the underlying digest function, otherwise an attacker could simply try to brute-force the key. According to PKCS#5, security is limited by the output length of the underlying digest function, i.e. security is not improved if a key length strictly larger than the digest output length is chosen. Therefore, when using PKCS5 for password storage, it suffices to store values equal to the digest output length, nothing is gained by storing larger values.

There's some confusion here, indeed. Let's see the details:

PBKDF2 is a Key Derivation Function: its output can have a configurable length, and is meant to be a "key".
Key for cryptography must not be too small, to avoid being inherently weak. For instance, a DES key, being 56-bit long (ok, 64 bits, but 8 bits are ignored, so 56 "real" bits). However, beyond about 100 bits, exhaustive search is so ludicrously expensive that it ceases to become a threat.
Similarly, PBKDF2 can be "attacked" with an effort of cost 2n if the underlying hash function has an output of n bits. This is totally unfeasible even if using MD5 (128 bits are already enough for that). But, in a certain bureaucratic light, PBKDF2 has "strength n bits".

So the reasoning goes: if you use PBKDF2 to generate a key which is not of at least n bits, then your key is "weaker" than what PBKDF2 could have produced.
Now it would be kind of stupid to refuse to generate a 128-bit key with PBKDF2/SHA-256 because SHA-256 offers "256-bit security". But it makes some kind of twisted sense, if seen through a procedural prism by a frustrated auditor who does not have a clue about what a key actually is.

Summary: ignore that weird passage of the doc. Use PBKDF2 with HMAC/SHA-256 or HMAC/SHA-512, whichever floats your boat (SHA-512 might be slightly stronger against attacker who use GPU as they are sold in early 2013, because current GPU are bad at doing 64-bit arithmetic). Generate the key length that you need for the algorithm at hand. 128 bits are anyway more than enough for symmetric keys.


Hushmails "Secure Forms" & HIPAA I just picked up a job for integrating Hushmail's Secure Web Forms into a medical website. The forms will submit patient's (PHI) data to Hushmail's servers, encrypt the data, and then send it to their Hushmail email account. Routing a form is accomplished by simply changing the form action attribute to https://forms.hush.com/webformname.

This seems like it is lacking security to me. For one, the medical site is not using SSL and nowhere in Hushmail's documentation do they mention SSL being necessary on the websites end for a truly secure transmission. Obviously these form submissions need to be HIPAA compliant. It seems to me that any mediocre hacker could capture the packet before it is sent to Hushmail and encrypted.

Is this secure?
Would using an iframe of the form be more secure? (it is using SSL)
Should I convince them to setup SSL on the site?

I have been trying to read up on HIPAA, but I'm having problems finding anything technical for developers. Any references would be welcomed.

If the action attribute of the form has https://, the data will be encrypted before it is sent to the Hush Secure Forms server.  So the issue here is not the encryption.

There is however an issue with the fact that the hosting medical site does not use SSL.  When an end user views the form, he has no way of knowing whether he is looking at the correct form from the medical site or is instead looking at a form that was rendered by a malicious third party involved in a MITM or phishing attack.  The third party could provide a page which looks just like the medical site but perhaps with a different action on the hush form (e.g. https://HackersServerInNigeria.net).  In this case their private data would be sent not to a Hush Forms server but a server of the hacker's choosing.

Also, mixing secure and non-secure content on the same page may trigger browser warnings.


HMAC + AES to guarantee secrecy and integrity? As an exercise, I am writing some code that accepts a list of possibly secret properties (e.g. user ID, password, IP address), adds a timestamp, encrypts it, and signs it.
Here's a high-level overview of what the code does - does this look correct from the point of view that it should ensure secrecy and integrity?
The main thing I am unsure about is deriving the encryption key and the signing key from the same user-provided secret key, but this seems a little paranoid given that there should be no relationship between the two assuming the strength of the underlying hash function of the key derivation algorithm.
If anyone is interested the source code together with a small test suite, packaged up with setuptools, can be found here.
Implementation
The user supplies a private key and two optional salts which we use to derive encryption and signing keys using PBKDF2. If no salt is provided two are generated using urandom.
Next, the user supplies a list of property strings, ['a', 'b', 'c',...] which is converted to a |-delimited string and to which str(time.time()) is prepended.  This plaintext is padded using PKCS#7 method. An Initialization Vector (IV) is generated using urandom and the plaintext is then encrypted with AES-256 (CBC mode) using the key described above and the IV.
The IV + ciphertext are then signed using Python's native HMAC-MD5 implementation with the signing key derived as described above, and this signature is appended to the message.
The decryption and verification process follow roughly the opposite process as above, with extra care taken in the verification step to use the built-in compare_hash method to prevent vulnerability due to timing attack.

How many iterations of PBKDF2 are you using?

I don't think there is an issue with deriving the encryption and signing key from the same user-provided secret key. As you said, if the hash function is solid and you use a separate salts and enough iterations of PBKDF2 it will be secure.

Using PKCS#7 padding should be fine and if you check the HMAC prior to decryption you're not vulnerable to padding oracle attacks. I must ask though, why HMAC-MD5? While HMAC-MD5 is currently not broken because there are no practical preimage attacks against MD5, but nevertheless MD5 already failed part of it's security requirements due to it's weak Collision Resistence. So why not use a more secure hash function? Attacks on crypto only get better, not worse. I'd strongly recommend you use SHA-2 or SHA-3.


Spying on insulated cables (electromagnetic/induction field) I hope this is the right forum to ask this question. If not, please tell me where to go.

From my understanding most cables have an electromagnetic field around them when data passes through them and I think I remember having unexplainable issues with one of my TVs about 12 years ago where, when watching a VHS, I could still see a pale image of what was currently on TV in the background.
I suspect that this had something to do with the bad insulation of the cables, but it also seems super unlikely that the image could be transmited to flalessly, so I don't know...

How conceivable would it be that, with the tech now available, we could build a device that could receive and process the data that is sent through a cable, without having physical contact with it?

I'm mostly thinking about USB and ethernet cables, but also about cables that have a lot of wires, like HDMI. And what about fiberglas cables?

Could it be possible that the NSA is spying on our ethernet cables without even thouching them?
And could you build a hardware keylogger that doesn't need to touch the keyboard's wires? (I'm obviously not talking about wireless keyboards.)

What would be a conceivable range for something like this to work in a realistic home with TVs, routers and smartphones sending their waves all day long?

How problematic is it that an HDMI cable has 19 wires? Would that interfere and make it inconceivable that someone could reproduce what is sent through the cable?

And what about injecting fake data into a cable? How conceivable is that?

Can This be done?

I would say yes, but with some caveats. Depending on the cable and the data, you would need some very expensive / sensitive equipment to pull this off. To me this is a similar issue to the old Van Eck Phreaking (http://en.wikipedia.org/wiki/Van_Eck_phreaking).

Intel has some tech to circumvent this kind of attack:
http://en.wikipedia.org/wiki/High-bandwidth_Digital_Content_Protection

This whole line of inquiry remind me of a time I was trying to middle some RAM with a logic analyser. Ooops - RAM is way too fast for most logic analysers. Or maybe if I had a fast enough logic analyser? Wouldn't be cheap!

Can the danger be totally avoided?

In most cases yes. Just encrypt absolutely everything. There's no danger of people reading your cables if everything you send is AES256. And you protect your keys well...

Cable by Cable

Fiberglass - Encrypt! You should be doing that anyway.
USB - The attacker would need to be very close. Improve your physical
security. Also Encrypt!
HDMI - Encrypt if you can. I can't see a situation where you would want to send sensitive data ever an HDMI cable.
Routers - You can 802.11? Like wifi? That's it's own security issue. Use HTTPS. Also known as: ENCRYPT
3G/Other cellphone signals - No idea if and when these are encrypted. You may or may not be at the mercy of the telcoms for that one.
Reading the EMF from your cellphone's components - If someone could pull this off, I'd be very amazed. I doubt this is possible from a distance. Maybe if they took apart your cellphone.
Your T.V - If you mean the cable connection, that depends on whether your cable company is encrypting the signal, and whether your cable box encrypts signals sent upstream. Turns out they do: http://en.wikipedia.org/wiki/Television_encryption#Cable_and_early_satellite_television_encryption - but I think it's worth checking out sometime ;)
If you mean the EMF from your T.V Screen, yeah an attacker can grab that. See Van Eck Phreaking above.
USB devices which you wouldn't normally encrypt (like a keyboard) - The keylogging application might be possible. If I were an attacker, I would first look for wireless keyboards and break the protections on that. The thing to overcome here would be signal to noise ratio. I'm not saying it's impossible. However, if you were close enough to actually do this kind of attack (you'd basically have to be within a few feet) then there are other ways. I think you can buy USB cables that are have shielding, so that might mitigate the attack. I personally think there are just better ways to read keystrokes if you are that close. Shoulder surfing ya know?


What are the risks of accepting URL param for automatic redirection? Can anybody name all the risks of the following scenario:

User visits a page, but his session is expired, so he is auto-redirected to login page with his previous page and params added as a single parameter, encoded using PHP's urlencode():

https;//www.example.com/login.php?previous_page=%2Fdashboard.php

When logged in, autoredirect to:

https;//www.example.com/dashboard.php

I am currently aware of two:

Manipulated links that contain external domain names, for example:
https://www.example.com/login.php?previous_page=http%3A%2F%2Fxss.com%2Fmalware.php
Manipulated links that contain scripts, for example: https://www.example.com/login.php?previous_page=%3Cscript%3Ealert(document.cookie)%3B%3C%2Fscript%3E

Currently preventing these by only accepting the value of previous_page param if it starts with %2F (encoded /). Are there more risks to catch?

Someone could pass a link to //xss.com/malware.php, by encoding it as https://www.example.com/login.php?previous_page=%2F%2Fxss.com%2Fmalware.php. To prevent this, you could pass the path from the site root as the parameter, so you would pass only dashboard.php. Then assemble the full link on the server side.


Is creating asymmetric keys dynamically and storing in memory safe? I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in python. It would be deployed on AWS. So I have a authorization-service and an api-service. I want the auth-service to sign the tokens with a private key. But what is the safest way to distribute the public key to the api-service and how would I store the private key?
My idea was that the auth-service creates a key-pair and provides an endpoint that returns the actual public-key. With this I can rotate the key-pair and create for example every day (or hour?) a new key-pair. The private key would be stored in memory using the dict structure or whatever. The api-service would get a request with an access token and checks the signature with the public key returned by the auth-services endpoint. The reason for keeping the private key in memory is, that I wanted to create it dynamically at runtime and rotate it easily. Is this a safe way or are there better ways of handling this kind of situation?
My idea is based on some articles I read about key distribution and rotation but I am not sure if I got it right.

Amazon has a couple of services that target this kind of use-case.
Amazon KMS is a key storage platform that integrates with AWS. You can upload keys to it and have your applications sign stuff via the sign API. This keeps the actual keys off your servers. Another benefit is that it integrates with all of the security monitoring and alerting in the AWS ecosystem (e.g. GuardDuty) so you can catch potential compromises and misuse of those resources.
If you're solely using this for authentication, though, you might want to consider Cognito instead. It supports both OAuth2 and JWT. This saves you the effort and potential security pitfalls of implementing your own integration with KMS.
Regarding key rotation, that's not something you should need to worry about all that much for this use-case, and you definitely don't want to be rotating long-term OAuth or JWT keys on a daily (let alone hourly!) basis. From a cryptographic perspective there's no reason to rotate OAuth2 signing certificates any more frequently than once every few years, as long as you use sufficiently strong keys, just like you would with HTTPS. The usual justification for rotating keys more frequently than that is to minimise the attack window in case of key theft, but if you don't detect the breach then an attacker can simply quietly sit on the server and obtain the new keys every time they are rotated. Automated key rotation also introduces a greater attack surface due to the additional mechanisms required. A better approach is to use existing solutions that have been implemented by and tested by security professionals, spend your time understanding their security properties and controls, and focus on breach detection and monitoring of security-critical resources.


Understanding OWASP 2017 A8 Insecure Deserialization I'm reading up on Insecure Deserialization and remembered a vulnerability that I read about in some JSON Web Token (JWT) implementations at auth0.

https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization

https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

Long story short the "none" algorithm is used, signature is removed and the application believes whatever the user sends is OK. Would this fall under Insecure Deserialization or Using Components with Known Vulnerabilities? The given example could of course be Broken Access Control but given that the user controls the object they could manipulate the system in other ways as well.

https://owasp.org/index.php/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities

{"alg":"HS256","typ":"JWT"}.{ "admin": false, "name": "John Doe", "iat": 1516239022}.signature

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhZG1pbiI6ZmFsc2UsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMn0.lN5mCX6BnfgtoRVHVaTt9hcj3VUcHWAwdnTT-PLca3c

{"alg":"none","typ":"JWT"}.{ "admin": true, "name": "John Doe", "iat": 1516239022}.signature

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJhZG1pbiI6dHJ1ZSwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.

The examples that I find are from PHP, Python and Java and some descriptions indicates that JSON or XML is not a part of the classification.

  However, many programming languages offer a native capability for
  serializing objects. These native formats usually offer more features
  than JSON or XML, including customizability of the serialization
  process. Unfortunately, the features of these native deserialization
  mechanisms can be repurposed for malicious effect when operating on
  untrusted data. Attacks against deserializers have been found to allow
  denial-of-service, access control, and remote code execution attacks.

OWASP Deserialization Cheat Sheet

Yes the vulnerability is more important than the classification but I'm still interested in correct classifications.

Tldr: Clear distinction between vulnerabitily classes ist not always possible.

To look at "insecure serialization" in a different way first:
From the description, Owasps "insecure serialization" is a bit of a foggy mix of (imo) 3 separate problems:

A specific subsection of plain untrusted input values for the very first - who cares about serialization formats. In your code block, the admin:true (and the server believing this value) is the problem, nothing else. If it stands alone, outside of any Json etc., it's still the same problem.
Still untrusted input, but another section: Exchanging code (classes, methods...). If there is some dependency injection going on for a EncryptionAlgorithmInterface, and the available implementations are None, DES, AES256 and so on - what could I do with the serialized object? Changing the algorithm to none and then find a place where I can read the data while send over the internet.
Problems by definition in the serializer itself. What if send a never-ending stream of [[[[[[[[[[[[[[[... to a web service expecting Json (ie. Array of array of array of... and the values and closing ] are never sent)? A simple implementation will quickly reach a stack overflow (error, not website), crashing the server process.

Your Json web token link...

is at least untrusted input.
It also is (Owasps) insecure serialization, but really, who cares - the problem again is not the data format.
After the explanation was written, it also became "running components with known vulnerabilities".
Not in Owasps Top10, but it is also a protocol definition problem.
...

Finally, about the part of native serialization that offers more than Json etc.: Well, partially - but this doesn't make eg. PHPs version secure.

In Java it is possible to take an object, write it's complete state to an byte array (that is, current member variable content (both simple types as well as other objects), but also executable binary code in some situations, etc.) and then recreate everything from this byte array. Access to a serialized Java method that will be executed later is of course very nice for doing bad things. And if there is none, introducing one that will be called because of its name at some point (eg. equals) is easy too.

In PHP, there is not such a straightforward way to save and load executable code parts like the runtime has them in memory, so abusing this is not possible. However, names of other methods to call might still be in there. That's not as convenient, but still nice.


Which security measures does PyPI and similar third-party software repositories take? PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)).

How does PyPI prevent people from uploading malware?
When I am searching for software, how can I be (more) sure that it is not malware?
What can I, as a developer of packages, do to make others feel safer using my packages?
Are there "historic" examples of malware in the repositories? How much harm did they do?

I've asked the question for PyPI, but I'll also be interested in similar repositories like npm (JavaScript) or composer (PHP).

I have asked this question for CTAN (tex) in the tex.SE chat. The answer was there are no security measures. They trust people / developers not to upload malware.

I actually wrote a blog post on this topic recently.

To answer your points:

  How does PyPI prevent people from uploading malware?

It doesn't. Any Python code can be uploaded. Arbitrary code execution is possible during package installation. Audit your dependencies carefully.

  When I am searching for software, how can I be (more) sure that it is not malware?

Download the tarball and look at the code.

  What can I, as a developer of packages, do to make others feel more save using my packages?

If your users trust you, PyPI works perfectly fine. Packages are served over HTTPS and checksums are available to verify against.

  Are there "historic" examples of malware in the repositories? How much harm did they do?

I'm not aware of any historic examples but I can easily upload a demo package. PyPI doesn't do anything to prevent this. It acts as a simple index of Python packages, it is up to the users which developers they trust.


How was Google recaptcha v2 bypassed several times? There are multiple reports of a reᴄᴀᴘᴛᴄʜᴀ v2 bypass. Most of the time, the explanation is neural networks services provided by Google or IBM.

But there is something I am failing to understand: for most CAPTCHA(including reCAPTCHA v1) the manually deciphered text is sent directly to the server inside an ʜᴛᴛᴘ header. But with reCAPTCHA v2, the response/ʜᴛᴛᴘ header sent to the server looks like this:

g-recaptcha-response:03AJpayVEtSKNOXg7TJwMkmxzLA_HrnWMKm6p0ox6W6hhMcw3Bzxab8ariLgg8Q8wXpUcF8HLkhAd1ixXgNvBDde5ggVXidl3NuHSQcnP4QqJkVvWZ2s4_CQ1lHTw6oNEqXyiBuS3CkiHBhoB5akijJ6ld115K_OWZo6mfB4xz_-I2P36fVqT9VzEUz26wrauN9QZuC6lh80mf-fkxqCPmNYSOcMrHxR33Flby05gzo5cD1B-2FucaoFP11p2svvZrWC_vAjz5bGOzW0DufM2kkdtLIlhzl9GBzm_chyirSJItHGdz0bMuxDYZkRKY8c4gXUmzT09VEgivi032zZnNXtrVA04gXF5yE0tAtnGTwi31hMdzumPoc6GdLdIbvfbXgdyndocCLIph-j9T8ePf3JO8Jfcf6BNcmUKT2SrhZjIAPUOZV2Mg7Qua_s4zNHYx1-NE8zoe9SG-VxuPbx2sjR32ce4oapa6VA

even with an audio to text sample. Whatever the method claimed to be used, I am still failing to understand the link between g-recaptcha-response HTTP header and human created data.

Recreating the g-recaptcha-response one time token seems to be a requirement for all bypass methods. So what is the link between the one time token and a deciphered audio text for example since peoples did reverse engineered it ?
The only thing I understood is everything is client side concerning token generation (no server side requests).

Why reverse engineering the code when you can make it work for you?

It would be sufficient to interact with the rendered web page. For example you could develop a browser extension that waits for the web page to be rendered, downloads the challenge (in this case it was the audio), cracks it (in this case it was slightly obfuscated and sent back to google's own speech recognition engine), inserts the solution in the answer field and finally emulates a mouse click that launches Google's JavaScript to compute the final token.

Source: Bleeping Computer

p.s. Google's ReCAPTCHA is not very privacy friendly, I suggest to use something else.


Why does the tool 'codesign' in OS X 10.11 (El Capitan) report every Python process as "code object is not signed at all"? If you start any Python process on OS X 10.11 (10.11.0 or 10.11.1) El Capitan, and run the OS built-in tool 'codesign' to verify the process, you will receive an error saying "code object is not signed at all".

Here's an example:

Open Terminal.app. Type "python". This will start a normal Python REPL console.
Open another terminal window. Run "ps | grep python" to find the process id of the Python REPL process. Let's say it's 555.
Run command "codesign -v 555". codesign will report "555: code object is not signed at all"

However, if you run the following commands, it seems the python executable is properly signed:

$ which python
/usr/bin/python

$ codesign -dvv `which python`
Executable=/usr/bin/python
Identifier=com.apple.pythonw
Format=Mach-O universal (i386 x86_64)
CodeDirectory v=20100 size=226 flags=0x0(none) hashes=6+2 location=embedded
Signature size=4105
Authority=Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=1 size=68

If you use codesign to verify any Perl or Ruby process, they are all fine. Also, in Yosemite, every Python process can be correctly verified by codesign.

What happened?

The executable located at /usr/bin/python does little more than spawn the application /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app. That application bundle doesn't have its own signature, but presumably it piggybacks on the signature of the parent binary.


How do I find the source of network traffic from a specific host? My firewall identifies an unusual amount of traffic to 8.8.4.4 from host 192.168.76.22 (a Mac OS X Server).  Within that server, the network connections are defined with a primary DNS pointing to my ISP's DNS server and the secondary address pointing to the Google Public DNS at 8.8.8.8.  None of the settings in this system have been set to use 8.8.4.4.

Another post at Forensics - trace back DNS query origin on host? suggests that I might have to change the resolver in order to find the guilty processes.

I have checked a similar question for assistance, but found no useful answers there as to checking the source. I have run netstat and not identified any communication to 8.8.4.4 listed on the output.

I am wondering:

1) If there is a system log that would allow me to identify the necessary information

2) If there is an easier method than replacing the system's DNS resolver

3) How to replace the resolver (if this is absolutely necessary)

System Info:

OS: Mac OS X 10.10.5

Server Application Version: 5.0.3

Firewall: Watchguard XTM 505

@schroeder and @Brett Littrell provided the most useful suggestion. They suggested that I run a packet capture on the host machine.

I ran the capture using WireShark and learned the names that were being queried.
The names of the domains suggested that the packets were being forwarded from the DNS server running on the host.
I repeated my inspection of the Network Settings both in the Network Settings panel and the Server settings for the DNS and found that I had made a mistake and overlooked the domain 8.8.4.4 in the permitted forwarding addresses.
Removing the entry in the Server App stopped the unwanted traffic.

Knowing now that the traffic is from a legitimate program performing proper operations, I can safely change the firewall settings to allow more frequent traffic from the affected host to the DNS forwarding servers without worrying about the effect on the safety of the system.


Firefox does not trust Burp Suite's certificates in case of accessing sharepoint online I want to investigate requests/responses between firefox and some private mysite.sharepoint.com site which I could access using my microsoft's email and password.

For this I've configured Burp Suite's Proxy (and Firefox Proxy settings) to

localhost:8085

Tried to configure on Certificates tab:

Use a self-signed certificate

Generate CA-signed per-host certificates
Generate a CA-signed certificate with a specific hostname: myhostname.sharepoint.com

I could get two certificates using openssl s_client -connect grisha.sharepoint.com:443 -showcerts command:

CONNECTED(00000003)
depth=2 C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
verify return:1
depth=1 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = Microsoft IT, CN = Microsoft IT TLS CA 4
verify return:1
depth=0 C = US, ST = WA, L = Redmond, O = Microsoft Corporation, OU = Microsoft Corporation, CN = *.sharepoint.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = WA, L = Redmond, O = Microsoft Corporation, OU = Microsoft Corporation, CN = *.sharepoint.com
   i:C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = Microsoft IT, CN = Microsoft IT TLS CA 4
-----BEGIN CERTIFICATE-----

CERTIFICATE 1 CODE HERE

-----END CERTIFICATE-----
 1 s:C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = Microsoft IT, CN = Microsoft IT TLS CA 4
   i:C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
-----BEGIN CERTIFICATE-----

CERTIFICATE 2 CODE HERE

-----END CERTIFICATE-----
---
Server certificate
subject=C = US, ST = WA, L = Redmond, O = Microsoft Corporation, OU = Microsoft Corporation, CN = *.sharepoint.com

issuer=C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = Microsoft IT, CN = Microsoft IT TLS CA 4

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 4595 bytes and written 471 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: SESSION ID HERE
    Session-ID-ctx:
    Master-Key: MY MASTER-KEY HERE
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 36000 (seconds)
    TLS session ticket:
    TLS SESSION TICKET HERE

    Start Time: 1589794543
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---

Could I somehow tell Burp Suite to use correct certificates in case of access myhostname.sharepoint.com site

Adding hsts false option did not help:

Firefox version: 76.0.1
OS: Ubuntu 20.04

This site uses the Strict-Transport-Security Header. This header normally looks something like that:

Strict-Transport-Security: max-age=31536000

The header instructs the browser that for every future request to this site it must use https and that it should fail in case there is something wrong with the certificate.

So you probably visited that site without burp before.

The following advice does not work anymore:

  You can disable HSTS checking in firefox (but only do that on a dev
  machine that you really do not use to access the web normally):

  Visit about:config and change the setting
  security.mixed_content.use_hsts to false.


How would one go about becoming a Security Researcher Can any Security Researchers/Pentesters/Hackers point me in a direction to learn about becoming a Security Researcher and steps to take?

To become a security researcher (or any kind of researcher) you choose a security topic and master it.  Learn everything about this topic,  and if you explore this topic far enough will find something new.

To get a job as a penetration tester you need to prove that you can in fact break software.  How I did this was by obtaining CVE numbers and putting that on my resume....  But if you don't know how to break software in the first place you can't do the job and you won't be hired.

In the security industry right now web applications are king,  closely followed by mobile applications.  Master the owasp top 10,  hack DVWA and hunt for bugs in open source web applications.  Write exploits for these flaws,  report them to the developer and obtain a CVE number.


Is having Steam installed a security risk? Speaking to one of our security administrators at work, he insists that Steam is a well understood security risk and it shouldn't be installed on work machines.

Saying it's not work related I understand, but is there a genuine security threat from having it installed (and if so broadly what is it), or is this someone providing a fictional reason for not allowing something they just don't want to allow?

(As I say, I'm not disputing their right to say what should and shouldn't be installed, just trying to understand the reasons).

From what I can tell, there have only been two serious public vulnerabilities in Steam.

Markup injection (XSS) from steam:// links
HTTPS man-in-the-middle attack

Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided.

Most likely, he's nit-picking because he doesn't think having Steam installed is appropriate at work, but he doesn't want to be the bad guy.


Why is Linux considered more secure than Windows? Why is Linux considered more secure than Windows? Is there some sort of recent security report that proves it?

I have come to believe that Linux has been safer so far, but now as we have Windows 10, is Linux still better in security?

Linux isn't really more secure than Windows. It's really more a matter of scope than anything. No matter what malware, exploits, and bad users exist EVERYWHERE. One being more secure than the other is nothing more than anecdotal evidence.

Malware exists for *nix, Mac, Windows, Android, iOS, Symbian, Xbox(yes), hard drives, and bios.

No operating system is more secure than any other, the difference is in the number of attacks and scope of attacks. As a point you should look at the number of viruses for Linux and for Windows. You'll see a trend in that Windows has FAR more viruses for it than Linux does and that's purely because it's more lucrative to hack for Windows since you have a greater chance of getting the thing you want. For all we know there might be a critical flaw in Linux that would open the world to pain if discovered. It hasn't been yet, but it could be there.

Really however OS security comes down to usage, habits, behaviour, and users just as much as it does software, hardware, security, and passwords. Your computer can be safe in an infected network as long as you do the following:

Constantly ask yourself "How do I keep MY computer safe?"

Really all you can ever do is work to keep your computer safe. That includes most notably safe computing habits. You could run for years without anti virus* and never get a virus as long as you're safe and you keep your computer safe. I'd still run an anti virus though since you could be safe all you want and make a single mistake.

After all those big data breaches you often hear about aren't usually on computers, but servers running special software, and it's the software itself that gets attacked and exploited to extract the data. What this means is that your computer is as safe as you make it. They didn't make theirs very safe.

Of course even if you make that software as secure as possible, it's all meaningless if someone manages to steal your credentials. In most data breaches an administrator gets phished, and their credentials are used to log in and steal the data. Here you can see that it didn't matter that the computer was safe since the user was attacked.

This really shows that there are two parts to security: The security of others (never trusted) and the security of yourself (only as good as you make it). To that end we all just try to make sure that the security of ourselves is as good as it can be. Herd immunity doesn't really apply to computer, so we have to keep them safe through our habits, usage, software we put on there, and making sure not to let in anything bad.

  The world's most secure computer is turned off, not connected to anything, buried six feet underground, and destroyed.

Notes:
*: Note the same as no security!


Wireshark DNS sniffing : too much junk -> Are there hostname "blacklists" for wireshark? So I'm sniffing my DNS on wireshark. There's way too much junk because the websites include many advertising tools, web tracking, etc. Is there some blacklist that contains all those pesky hostnames, so that I can purify my wireshark a bit?

Current filter (is growing fast) :

dns && ! dns.qry.name matches "ytimg|apple|skype|google|akamai|yt3|arpa|youtube|microsoft|facebook|amazon|twitter|gravatar|instagram|azure|lastpass|trafficjunky|tumblr|gstatic" && ! ip.src_host matches "google"

The list of advertising tools, web tracking, etc. is infinite and changes daily so you could try to use a list like others have provided but it's not a scaleable or reasonable solution. Instead perhaps use the statistics features in wireshark or export and do some analysis to see abnormalities like the nosiest dns entry or the quiet ones or the largest packets or the hosts with changing ip addresses , etc


Facebook messages with a suspicious link, what information can they get if I dont enter any details? I received one of those messages from a Facebook friend where it says something like "Is this really you in this video?" and then send an accompanying link. I clicked this link from within Messenger on my Android phone and it opened a pornography website in my browser. I immediately closed the site but am now worried what information of mine might be compromised.

I have been googling this and many people say that it is a common phishing scam where they can get my Facebook login details and then send the message on to more people. However, I wasn't taken to a fake Facebook website and was never given an opportunity to provide my login details. I think it was just wanting me to sign up to a pornography website.

If they didn't get me to login, how would they get my login details? Could I still be compromised?
And if their intention wasn't to get my details, how did the person that sent it to me get compromised?
Would it be dangerous if I were logged into the mobile Facebook website in a browser (not the app)?
Is it possible that something was downloaded to my Android just bey clicking the link? Is there a way I can check (or scan) effectively?

If they didn't get me to login, how would they get my login details? Could I still be compromised?

Most likely they did not get your credentials. You can change your password just to be on the safe side if you want to, but I would not worry to much about it.

  And if their intention wasn't to get my details, how did the person that sent it to me get compromised?

There are many possible ways. Perhaps he entered his password into a phishing site (either the one you were taken to, or some other site). Maybe he reused the same password on other sites, and one of them got hacked.

(A way things like this spread back in the day was through clickjacking attacks, where the malicious page would load e.g. Facebook in a transparent iframe, and fool you into clicking the invisible facebook buttons. But I am pretty sure Facebook protects against that nowadays.)

  Would it be dangerous if I were logged into the mobile Facebook website in a browser (not the app)?

I don't think it makes a lot of difference. If there was some kind of exploit, it happend in the browser after you clicked the link. And it's the same browser no matter what app you come from.

  Is it possible that something was downloaded to my Android just bey clicking the link? Is there a way I can check (or scan) effectively?

Yes, it is possible to get infected by malware by just visiting a site. But if your browser is up to date and you have Flash and Java disabled by default I would not worry to much about it.

There are plenty of antivirus programs that include support for mobile devices. You could install one and scan your phone. No scan is 100% though.

(I don't know enough to make a specific recommendation, and software recommendations are not on topic here anyway.)


How secure is FileVault 2 while the computer is in sleep mode? How secure is Apples disk encryption FileVault 2 when someone has physical or network access while the computer in sleep mode or is running a screen saver? Are there ways to circumvent FileVault 2 when the computer is not turned off?

Just a quick addition to the previous answers; if you are still worried someone would get the hold of your encryption key from RAM during standby, one could enable a power management feature of OS X called "DestroyFVKeyOnStandby", as mentioned here (same link as Richard Belisle), page 37.

From man pmset:

destroyfvkeyonstandby - Destroy File Vault Key when going to standby mode.
    By default File vault keys are retained even when system goes to standby.
    If the keys are destroyed, user will be prompted to enter the password while
    coming out of standby mode.(value: 1 - Destroy, 0 - Retain)

The full command would be sudo pmset -a destroyfvkeyonstandby 1.

This would enable destruction of the FileVault key during standby for all -a power modes. That is UPS -u, battery -b and charger -c (wall power).


Are there any "real world" implementations of secret-sharing encryption schemes? Imagine something like TrueCrypt where user A can decrypt his files, or any 3 of the 10 directors in his organization can decrypt user A's files. As I understand it this is similar to the way the DNSSEC Root Keys are secured. Obligatory wiki entries. Does anyone know of any commercial or open source implementation of file encryption utilizing secret-sharing?

There are at least two free implementations that are part of Ubuntu linux and implement Shamir's secret splitting and combining:

gfshare: Ubuntu Manpage: gfshare - explanation of Shamir Secret Sharing in gf(2**8) provides both tools for secret sharing (gfsplit and gfcombine) which can split an arbitrary file into shares, as well as a library for use by developers.
The "ssss" package provides the ssss-split program which prompts you for a pass phrase which can't be longer than 128 characters, to split up into a set of phrases to share.  Then the ssss-combine program prompts for enough of the shared phrases and prints out the secret.

gfshare directly works with files, while ssss would be used to split up a pass phrase which can then be used with gpg or openssl or another encryption utility.  So gfshare would seem simpler for your use case.


How does WhatsApp's new group chat protocol work and what security properties does it have? By now everybody has noticed that WhatsApp rolled out full end-to-end encryption recently, for direct communication, for media attachments and for group chats.

I've read their white-paper (PDF) and noticed a difference from Signal's group chats, where Signal sends the group message to all members itself (with a special flag in the encrypted header) and WhatsApp sends the message to the server who distributes it.

Now I'm confused how WhatsApp's group chat protocol works, because it can't use the simple person-to-person protocol (as Signal does) and rather uses a somewhat complicated "ratchet" based key derivation (I think) and what favorable security properties get sacrificed by WhatsApp.

So what security properties does the group chat protocol feature and how does it work (at a high level)?

Because "security properties" is a bit generic, here's a list of the security properties I'm asking for:

Passive security (an eavesdropper can't break the encryption)
Active security (a man-in-the-middle can't break the encryption unnnoticed after the first setup)
Forward secrecy (a compromise of today's secret encryption keys doesn't break the security of past, attacker-recorded messages)
Plausible Deniability (there's no hard proof that a specific message was sent by me as soon as time X went by)
Transcript consistency (there's a "hard" proof that everybody in the group saw / sees the same messages)

Firstly, from their paper

  Messages to WhatsApp groups build on the pairwise encrypted sessions
  outlined above to achieve efficient server-side fan-out for most
  messages sent to groups. This is accomplished using the “Sender Keys”
  component of the Signal Messaging Protocol.

  The first time a WhatsApp group member sends a message to a group:

  The sender generates a random 32-byte Chain Key.
  The sender generates a random Curve25519 Signature Key key pair.
  The sender combines the 32-byte Chain Key and the public key from the Signature Key into a Sender Key message.
  The sender individually encrypts the Sender Key to each member of the group, using the pairwise messaging protocol explained previously.
  For all subsequent messages to the group:
  The sender derives a Message Key from the Chain Key, and updates the Chain Key.
  The sender encrypts the message using AES256 in CBC mode.
  The sender signs the ciphertext using the Signature Key.
  The sender transmits the single ciphertext message to the server, which does server-side fan-out to all group participants. The “hash
  ratchet” of the message sender’s Chain Key provides forward secrecy.
  Whenever a group member leaves, all group participants clear their
  Sender Key and start over.

I would say the key point here is number 4: The sender individually encrypts the Sender Key to each member of the group, using the pairwise messaging protocol explained previously

It's a clever adaptation which builds on top of the one-to-one protocol:  use it to distribute a shared key to each individual member of the group, so then the group can use the server in order to provide efficient "fan-out" (as well as blob storage) without the server being privy to the required private keys.

"So what security properties does the group chat protocol feature and how does it work (at a high level)?"

As to how it works, I think that paper is as much detail as you'll find available for now until someone else does a full (applied) analysis.

As to the features it provides...

Forward secrecy: the ratchet mechanism described provides this (or so they claim)
Passive:  the "Sender Key" distribution method in point 4 makes passive attacks nigh-on impossible: bear in mind that a passive party would have to get through the noise pipes encryption layer (to the WhatsApp servers) for each of the parties in the group and would probably require multiple points of presence which facilitated access to the traffic for each party in the group.... so you can pretty much rule out anybody there unless they're a major backbone provider or NSA.
Active attack: I'd say a side channel attack on one of the devices in the group would be feasible, but if you have that level of invasive access to the device (and therefore most likely its owner!), a pair of pliers and 5 mins with the device owner is likely to be far more fruitful.
Transcript consistency:  all the messages use HMAC to ensure integrity (step 7)
Plausible Deniability: if anything, all the extra security provided by their new implementation makes it very difficult to deny that a particular user sent a message....


A reasonable password strategy? I use a password manager for most of my passwords and they all have roughly 150+ bits of entropy so I feel pretty good about those. :)

But my master password is something I have to remember and whether I use a password or a passphrase, its entropy is much much lower, so that I can realistically remember it. Still, it's in the 65+ bits range and rough calculations on hash cracking with moderately powerful systems would take a dozen years to crack.

So my question is: as long as I change my password more often than it would take to crack my password, can I feel safe with a weaker password?

If I choose passwords that can only reasonably be cracked in 5 years, but I change my password every year, I should be fine, right?

I believe you are trying to ask if you can get effective security from a bad password as long as you rotate it frequently enough.  The answer is no, because password rotation does not help security before a compromise; it can only help after the fact, after a password has been compromised.

Changing your password won't make a difference against a brute force attack on a live authentication system.

Think about an attacker that can brute force all the passwords over a 5 year span.  Let's say he tests all passwords beginning with A-E in year 1, F-J in year 2, K-O in year 3, P-T in year 4, and U-Z in year 5.  If your first year's password begins with K, he won't get it.  But if you rotate passwords and next year you choose one beginning with F, he'll guess it that year.  In other words, if the attacker's guessing pattern is virtually certain to guess your password in five years, each year his chances of guessing it are 1/5, no matter what you've set it to.

Rotating passwords helps if there's a chance your password has been compromised in some way without your notice.  For example, you might want to rotate it if you used it an airport, coffee shop, or other suspiciously public place; if you find a virus or other malware; if you ever mistyped your password into a username field; or if you just have a bad feeling that it might have been stolen. Otherwise, it's a fairly ineffective security practice.


Why can't you and how to take a picture from infected computer? Let's say I know that there is a computer than is heavily infested with viruses (but I do not know which kind of viruses) and needs to be nuked from orbit. And on that computer is a very important picture, png format, that I absolutely must have and can not lose. Which one will give me least chance of catching a virus?

Plug in USB and copy the picture. What would this option do? How can it infect another computer?
Go to Starbucks, connect to wifi and put the picture on cloud storage, let's say Google drive or Dropbox under a throwaway account and go on another computer to retrieve it. Surely Dropbox or Google would scan the image and remove malicious code no? How would this option infect the computer?
Look at the hex of the image, take a picture of hex piece by piece and then use OCR to reconstruct the hex on the other computer. Image hex can not be infected right?

Is there any way to safely retrieve a picture from infected computer?

I would recommend downloading a live Linux distribution (Ubuntu is great for this), create a bootable USB device on a clean computer, and booting your infected computer with this USB drive.

With Linux running, you can copy all pictures to another USB drive, without any Windows malware interfering.

Virus attaching themselves to PNG files are very unusual. Infected PNG files are usually made by hand, not something that gets executed and goes infecting other PNG files.

You don't have to, but if you want to really be sure, open the file manager on Linux, right click on each image, Open With GIMP (or any other image editor on the distribution you are using), save the file in another format, like JPG. But I really don't think you will need to do this.

Now, your methods:

  Plug in USB and copy the picture.

Some malware can copy themselves to any plugged USB drive, and create a copy of itself with the picture of a folder. Opening this "folder" infects the next computer. Other ones rely on bugs to infect the computer when a link is seen (not opened) on Windows Explorer. Improbable, but possible.

  Go to Starbucks, connect to wifi and put the picture on cloud storage

You don't need to go to Starbucks, you can use your own network connection. And I don't think Google/Dropbox/Microsoft would scan a PNG file for you.

  Look at the hex of the image...

What? That would mean typing an encyclopedia by hand... Better pay someone to paint the picture to you on canvas, by hand. It would be faster...