Best practices for notebook anti-theft. Computer tracking I am buying a new Thinkpad with an in-built GPS/Cellular modem. I am thinking what are the best practices for making the notebook secure in case of theft. I am planning to do full disk encryption and use ESET NOD anti-theft tracking option when somebody logs in to Windows in case of theft(don't know how useful that will be since the disk is encrypted but still.). I am thinking whether it is possible to track the computer when the computer is powered off. Would it be possible to keep the GPS module activated all the time as long as the battery is attached?
Are there any other good practices for making the computer more secure in such events?

A GPS receiver uses a non-negligible amount of power; even more so if it also transmits its measured position (source: my smartphone; when the GPS is activated, battery life time drops from about 4 days down to less than 1 day). Making an active tracking device up and running whenever a battery is attached may thus lower the laptop autonomy.

Also, battery removal is quite easy on many laptops. If the thief thinks that a battery-powered GPS tracker is present then he may simply remove the battery.

Anyway, a GPS-based tracking device may deter a thief only if the thief is aware of the feature, and thus decides not to grab the laptop and run. It requires even more: the device is a good deterrent only if police forces follow through, i.e. they really use tracking information to pursue and arrest the thieves. Right now, not enough laptops have such a tracking feature, and most will transmit the data only when actually booting up. A laptop thief who is after the hardware (for its reselling value) will simply reformat the disk, not letting it boot up. A more advanced criminal who is after the data will remove the hard drive and hook it on another computer, thus bypassing the GPS tracker.

It so happens that there are many sloppy amateurs in the laptop-stealing business. Many will grab the hardware opportunistically, and then go straight to their home, and boot up the machine "to see what it contains". In that situation, tracking applications like Prey may help: when the machine starts, it records its location (with the GPS) and sends it automatically. With such apps, you may contain the damage from a laptop theft within reasonable limits -- sometimes you can even recover the laptop.

If your data is valuable, though, you cannot really expect that attackers will be so bad at what they do. Targeted attacks will be performed by people who know what they are after, and who will do things properly:

Wrapping the laptop in tinfoil just after stealing it (apparently it works if you put a dozen layers).
Battery removal (just in case).
Extraction of the hard disk for inspection on another computer.

Hard disk encryption (preferably the whole disk, not just a dedicated partition), with a strong password, will be a much more efficient method to keep the data safe.


SSL cookie without secure flag set situation for "Authorization: Bearer" I am currently reviewing an web application which dose use Cookies (non authentication related) without secure flag set but uses an "background" API to retrieve authenticated data using Authorization: Bearer. For example:

GET /api/v2/admins/me/account
HTTP/1.1 Host: www.example.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/20100101 Firefox/59.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Referer: https://www.example.com/settings/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6InNlZWstand0LTIwMTcwNzIwIn0.ew0KICAiaXNzIjogIkFQSV9HYXRld2F5IiwNCiAgImp0aSI6ICJlNjYyNTgyNy0zOGM3LTRhNzgtYTc2OS01MDg1OTYwZjMzNmIiLA0KICAiZXhwIjogVlayJdLA0KICAiZW52IjogIlByb2R1Y3Rpb24iDQp9.cYEIiaJUFXqTKZyTY3riECci3ZUspyPjZ7P4uflld90OJ9IoP2XuoCM35DEhUMzC1MoFU9CNp4lJPqMSy6JkUBzKVwJrG8F439NxM2T3UMHIIkPOD7n
Cookie: PHPSessionID=a5f9e49b-76f2-43b3-9094-a958bd472925;

Will provide me the following response:

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 517
Connection: close
Cache-Control: no-cache
Content-Security-Policy: block-all-mixed-content
Date: Wed, 18 Apr 2018 21:27:51 GMT
Expires: -1
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=157680000

{"id":38259239, ... something important and relevant}

To my own knowledge in case of SSL cookie without secure flag set situation:

If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain that issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.
To exploit this vulnerability, an attacker must be suitably positioned to eavesdrop on the victim's network traffic.

Would I bee able to intercept through the use of same principle or related type of attack the "Authorization: Bearer" token?

The authorization token here is not a cookie. RFC-7235, which defines the Authorization header, states that:

  The HTTP authentication framework does not define a single mechanism
     for maintaining the confidentiality of credentials; instead, each
     authentication scheme defines how the credentials are encoded prior
     to transmission.

So it depends on the specification of Bearer, which is RFC-6750. It states:

  TLS is mandatory to implement and use with this specification.

Which tells me that it should be possible to retrieve it and more importantly, not using TLS here is a vulnurability.


Bad practice to have a "god" password? Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes?  The password would be stored in a secure manner and would be super complex.  Huge mistake?

This sounds very much like an "Administrator" account, which typically otherwise has unlimited access to the things that it's the administrator of.

The security implications of an admin account are pretty well-understood, as are the best practices. I won't go in to all the details, but your implementation breaks with best-practice on one key feature: traceablity.

You want to be able to tell who did what, especially when it comes to administrators. If an admin can log in to my account using his password, then there's no way for an auditor after-the-fact to determine what was done by me versus what was done by the admin.

But if instead the admin logs in to his OWN account with his super-secure password, then through the access he has through his own account performs some action I could have done as well -- well then now we can have a log telling who did what. This is pretty key when the manure hits the fan. And even more so when one of the admin accounts get compromised (which it will, despite your best efforts).

Also, say the business grows and you need 2 admins. Do they share the superawesome password? NO NO NO. They both get their own admin accounts, with separate tracing and logging and all that. Now you can tell WHICH admin did what. And, most importantly, you can close one of the accounts when you fire one of the admins for stealing the donuts.


Security risks of using MongoDB ID vs a counter in URL? In my Angular app, I use the MongoDB id in the URLs. Are there any security risks to this?

Should I use a counter instead, and then in my DB have some sort of collection that links this counter to the actual ID? So instead of mysite.com/story/56ede7fsdfdsfdsfs2a7283 I would use mysite.com/story/32?

I can't think of any real security risk to exposing the mongoDB id (versus some other counter id), other than exposing creation time according to the server to the users.  Having the mongo primary key vs some other unique key (like a counter) shouldn't make a difference in terms of exposure.

Granted you should be aware, the mongo _id consists of:

  a 4-byte value representing the seconds since the Unix epoch,
  a 3-byte machine identifier,
  a 2-byte process id, and
  a 3-byte counter, starting with a random value.

and possibly you don't want to expose some of this information to your users (like creation time).

So when you have the id 56ede7f0dfdsfdsfs2a7283 (which has a non-hex digit in there s and seems to be missing a hex digit at the end -- it should be 12 bytes or 24 hex (0-9a-f) digits, so I've replaced the 's' with '0'), I can tell from 56ede7f0 that it was created at 2016-03-19T23:59:44.000Z.  (See for example: https://steveridout.github.io/mongo-object-time/ or try: ObjectId("56ede7f0dfd0fd0f20a72830").getTimestamp() in the shell).


How to retrieve the MAC address of a remote IP I have an IP address, and I want to find the corresponding MAC address. The IP address is in the same city, so we're connecting to the same network. How do I find the corresponding MAC address?

MAC addresses are used for physical addressing. Unless you are on the same physical network as the target machine, via something like a switch, hub, or wifi, you are out of luck.


"VPN -> Tor: Go to jail" - What's the logic behind this? The VPN won't see anymore than your ISP already is. So even if the VPN was logging everything you did, shouldn't it just leave you in status quo? How can it ever compromise your identity, that you move your "entry-point" from your ISP to a VPN?

Where did you get the concept that using VPN to connect you to tor will send you to jail?

First of all, you shouldn't be sent to jail (in a decent country) if you don't do anything illegal. I'll take that as a metaphor for someone is able to identify you but you should be precise.

You can connect through a VPN and TOR in two ways:

Connect to Tor, then to VPN

In this way third parties will see the connection as coming from the VPN. This has the downside that your ip will consistently come from the VPN, while tor frequently changes the ips you are exiting from.

The VPN operator will be able to log everything (unencrypted) you did.

I see two reasons for wanting this:

You want to hide your real location to the VPN service. However, the VPN is probably a paid service, and they probably have your name and credit card data already. So it's unlikely to be much useful.
You want to hide from your ISP that you are connecting to the VPN (eg. it's blacklisted). It's not clear that they would be much happier when they find you are connecting to tor (you could use a hidden bridge instead of a public entrypoint, but still it's probably risky).

Finally, you'll need to use TCP mode for the VPNs (as Tor only routes TCP) and the tor project reports that In our experience, establishing VPN connections through Tor is chancy, and requires much tweaking.

Connect to a VPN, then to Tor

In this way the VPN will only see that you are connecting to Tor. While the Tor exit node you get at each time can log everything (unencrypted) you do.

If someone broke the Tor path they would only discover you are using that VPN (for which they may be able to warrant or not, depending on power/jurisdiction), which probably already has your payment details.

On the other hand, it's more likely that they could discover who you are because of something you leaked (eg. a http:// url to something leading to you).

Also take a look at https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN describing the different options and some of the drawbacks.


2FA on Stack Exchange, Where Is It Or What I am Missing? Not sure if this is the right spot to post this, but I have not been able to find how to enable 2FA (such as authy, MS/google authenticator, yubikey etc...) on stack exchange using email authentication. I am aware that I could use SSO through Google or Facebook but would much rather not due to privacy concerns that relate to both companies. The closest I found was this Meta post which recommends SSO which I bet lots of people would not want to use.
Can anyone point me in the right direction?

StackExchange does not natively support MFA
As the answer to the question you linked to suggests, SSO providers like Google and Facebook support MFA.


How to prevent Windows Update from suspending BitLocker encryption? I was quite shocked today to see that a Windows 10 Pro machine that I recently set up with BitLocker (startup PIN + TPM with full disk encryption) suddenly didn't have BitLocker enabled anymore:

And apparently Windows messed with my Bitlocker settings:

Here is a screenshot I took of my settings a week ago (which I haven't manually changed since then):

So Windows must have changed them soemhow.

I have not messed with the registry or installed tools that would do so. I haven't even installed any third party AV software as I only visit websites that you would consider trustworthy (like google.com, youtube.com, amazon.com etc) and only install software that you'd consider trustworthy (like Firefox, Skype etc)...
I suspect Windows Update to be the source of the problem.
And as it turns out other people have reported similar issues with Windows Update suspending their BitLocker.

This is absolutely unacceptable in my opinion! As I use a startup PIN + TPM, there doesn't seem to be an obvious way to prevent this from happening again.

Is there a way I can prevent this? I really don't want to disable Windows Update as I won't get security updates anymore then. And I also don't like the idea of manually installing updates once a week and then afterwards checking if BitLocker is enabled again.

UPDATE: as per comments, this answer does not fully explain the behaviour.

I am not an expert, but I recently encountered something similar.
First, note that there is a difference between "Suspending" BitLocker, and "Turning Off" BitLocker:

From your screenshots, your BitLocker is suspended, not turned off.

According to Microsoft:

The Suspend-BitLocker cmdlet suspends Bitlocker encryption, allowing users to access encrypted data on a volume that uses BitLocker Drive Encryption. This cmdlet makes the encryption key available in the clear.
...
While suspended, BitLocker does not validate system integrity at start up. You might suspend BitLocker protection for firmware upgrades or system updates.

Windows Update has a mechanism where it installs some of the updates now, and the rest on the next reboot. I assume that this is accomplished by booting into some lightweight OS that exists only to install the new files, and then calls the Windows bootloader when it's done.  It looks like Microsoft has decided that they don't want to bundle all the TPM drivers into this lightweight installer, so they disable BitLocker temporarily.
A suspended BitLocker should go back to full protection on the next reboot, so the answer seems to be when Windows Updates asks you to reboot, you should do it promptly. I know it's annoying, but unfortunately, that's how Windows works.


What is the purpose of using different DNS server in nmap? nmap allows the use of different DNS servers (not local). What is the benefit of doing so?

There are all sorts of reasons:

You might not have access to local DNS servers.
You might want to query against a specific non-default DNS server within the organisation, which you suspect may leak more information than their defaults.
You might not want to alert a sysadmin / blue team by performing lots of DNS lookups across the infrastructure, so you might opt for an alternative DNS.
You might not want to use your ISP's DNS servers (or other 3rd party DNS) for legal or contractual reasons.

I'm sure there are other reasons too. These are just a few off the top of my head.


Pin delivery: SMS, mail, or pin mailer? Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists:

Pin mailer (this seems to be standard according to ISO 9564-1)
SMS
Email
Email a unique link, which can be used to view the PIN in the browser

All of them seem pretty insecure (letters, SMS, emails can all be intercepted), but still many banks use one of the above for usability reasons.

Question:

Is any of the four listed above more insecure than the rest, and if so, why?
Do other options exist?

In an ideal world, the PIN would never have to be transmitted to the user; instead, the user would choose it.

Experimentally, for banking cards, I encountered two methods:

The bank chooses the PIN and sends it as a letter, with some printing gimmicks to prevent reading the PIN with a lamp, by abusing the paper transparency.
A temporary PIN is awarded by the bank, given directly to me over the counter by the clerk, and I immediately change it through either a payment terminal (on the counter) or with the ATM (which is in the same room).

This world is not ideal so the situation often forces a remote transmission of a PIN, selected by the organization, and sent to the user. In that case, since there is no really secure channel to communicate with the user, the idea is channel separation: the PIN is transmitted in a way which is distinct from the way the complementing information is sent.

Emails are notoriously poor at security. They are, by default, unauthenticated, and may travel as plain text. They get stored on the reception server, with uncontrolled retention time, and often lots of backups. SMTP servers through which the email transits will also store a copy on some storage medium for amounts of time that are not easily measured, let alone configured. An email is a really bad storage place for a secret value.

SMS are somewhat better. When they go over the air, they get encrypted along with the normal mobile phone mechanisms. When they have been acknowledged by the receiving phone, they are removed from the distribution servers -- the SMS model is built around device-based storage, contrary to emails where the normal resting place of an email is the email server. There still will be a lot of potential for leakage, notably when the phone is synced up with some cloud-based storage system. In fact, the best thing that can be said about SMS, when compared with emails, is that phone malware is still for the moment less prevalent than desktop malware.

You could use a phone call, with an actual human, or a robot system. A voice-based transfer makes it less likely that unwanted copies will be retained on some server. It is also compatible with users who do not have a phone capable of receiving SMS (yes, there are still a few persons in that case).

Paper-based mails are not very secure at all, but intercepting such a letter requires physical presence near the recipient's home. Depending on your context, this may be distinct enough from whatever the PIN is supposed to protect to achieve good security. The bad situation is when the PIN is for a credit card, and the credit card and the PIN are sent as letters. Then, an attacker who can intercept the PIN can also intercept the card. In such a situation, banks are likely to require an explicit activation with a phone call, where the user will be authenticated through the knowledge of "secret values" (birth date, mother's maiden name... high-quality secrets, as you can imagine).

Take care that the security model may vary. Banks, for example, do not try to achieve perfect security for all users; what they want is to make money. Thus, they will strive to achieve the best compromise, i.e. the method that minimizes the overall costs. They can tolerate a bit of fraud, if other safer methods would be more expensive to operate or would alienate a non-negligible proportion of potential customers. It shall be remembered that the bank's security is about protecting the bank, not the user (regardless of what they may claim in their ads).


Trying to get rid of hackers who have access to all my devices What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get emails out to my clients?

(Ive attempted to Explain my story below)

My current solution involves using Deriks boot n nuke for my windows computers to wipe out all of my computers, installing the latest operating systems for my machines + phones then optimizing my network settings, setting up firewalls, and using a less vulnerable email provider for my business.

I began to become suspicious when some of my clients started complaining that they weren't receiving my emails from my business account with AOL. When I had a computer repair place check out my main mac computer they found a large amount of startup programs that were scanning me from multiple sources watching my computer activity. He claimed to have fixed it but it seemed things got worse This continued with all of my other business computers, even new ones I got ahold of, After apples Genius' weren't able to figure out what was going wrong or how to fix it. I've starting to just try to find out ways to fix this on my own. Any suggestions on solutions that will work?? I'm relatively new to any sort of hacking.

First, use a known clean computer (not related to anything you had and not connected to anything you have now) to clear up all your online presence, especially various cloud storage services such as icloud/googledrive/dropbox/onedrive. Close up any unneccessary accounts and get your email in order - it often is the key point that must be secure. Set up two factor authentification where possible - if you believe your phones to be affected, you can get a cheap dumbphone for the 2FA sms'es and such. Don't login to the email from any of "your" systems before your cleaning is done.

Second, disconnect your computers and check up your network infrastructure. If all your devices are affected it may be that you have something like a wifi router that's compromised.

Third, nuke and reinstall the computers. And hope for the best.


Who can see the traffic of others in different kinds of LAN I would like to consider three types of LAN:

a) 2 computers are connected to a Hub, this Hub is connected to a router for e.g. internet access.

b) 2 computers are connected to a Switch, this Switch is connected to a router for e.g. internet access.

c) 2 computers are directly connected to the router (internal switch).

First, I would think b) and c) are the same. My main question is: Am I right, when saying, that the second computer could see all the internet traffic from and to the first computer in case a), but not in cases b) and c)?

Is there any possibility (ARP poisoning/ spoofing etc.) where the second computer can see the traffic of the first one, considering case c) (and b))?

Your assumption is mostly correct but not completely.

As you suspect, cases (b) and (c) are the same because it is of no relevance whether the switch is built in to some other hardware or standalone. So I will call both cases (b).

An ethernet switch will normally optimize the traffic flows so that packets are not sent to ports where they don't need to go. It's done with MAC address leaning and is the reason why the second copmputer will not normally see the traffic between the first computer and the Internet. But it's not a guarantee so you should never count on it. You should view it as an opportunistic performance optimization instead. There are situations where it will not be effective:

Soon after the switch has reset and before it has had a chance to learn MAC addresses.
If the number of MAC addresses that the switch sees exceeds the maximum number of MAC addresses it can learn.
If the layer 2 topology of the network has recently changed, packets might get sent to the port through which a MAC address used to be reached.
etc...

The first two of those situations will result in the switch sending packets to every port, just like with a dumb hub.

Furthermore, broadcast and (sometimes) multicast packets will still be flooded to all ports even when MAC address learning is in use. That won't affect the traffic between the first computer and the Internet directly, but the first computer can still easily leak important information this way through DHCP requests, mDNS advertisements, and so on.

  Is there any possibility (ARP poisoning/ spoofing etc.) where the second computer can see the traffic of the first one, considering case c) (and b))?

Sure. Using a switch instead of a dumb hub generally doesn't prevent such things as ARP poisoning or for example spoofing a DHCP server, unless the switch has specific security features to prevent it (and those features must be turned on, configured correctly, and managed).


Why is an XSS payload in the address bar executed? I was playing with OWASP Mutillidae II and in one page I've found a vulnerability. In the address bar I've  wrote something like this:

127.0.0.1/.../?page=text-file-viewer.php/"><script>alert("test");</script>

The alert box pops up, but I don't understand why? I know what happen if I put this code in an input form, but I don't know what the address bar do! How does the address bar process the string that it gets? Why does my code work if I put it in the address bar?

The address bar doesn't do anything. It's the web application which appearently takes the URL and inserts it right into the HTML markup, leading to a cross-site scripting vulnerability.

This happens either server-side or client-side: Either the PHP script delivers the page with the URL already in it, or there's a piece of JavaScript code which injects the URL after your browser has received the HTML document.


What are factors in evaluating the fitness of a security questions? Attempting to understand the key factors in evaluating the fitness of security questions.

By security questions, I mean for example:

What was the name of your first pet?
In what city was [insert someone] born?
What was [insert someone] maiden name?
What is your preferred internet password?

Security questions are an example of security theatre. You can consider them a very weak form of password at best, and they are often readily guessable.

If you are going to use them, make sure they are ones that have the following characteristics:

they have many possible answers  (city names are terrible for this, especially in countries that have relatively few large cities like Australia)
the answer does not change over time (so favourite anythings are out)
is not easily obtained via social media or other online information

You also need to consider your user base. It is amazing how many things you forget as you get older.


What kinds of encryption are _not_ breakable via Quantum Computers? There's the recent article NSA seeks to build quantum computer that could crack most types of encryption. Now I'm not surprised by the NSA trying anything1, but what slightly baffles me is the word "most" - so, what encryption algorithms are known and sufficiently field-tested that are not severely vulnerable to Quantum Computing?

As usual, journalism talking about technical subjects tends to be fuzzy about details...

Assuming that a true Quantum Computer can be built, then:

RSA, and other algorithms which rely on the hardness of integer factorization (e.g. Rabin), are toast. Shor's algorithm factors big integers very efficiently.
DSA, Diffie-Hellman ElGamal, and other algorithms which rely on the hardness of discrete logarithm, are equally broken. A variant of Shor's algorithm also applies. Note that this is true for every group, so elliptic curve variants of these algorithms fare no better.
Symmetric encryption is weakened; namely, a quantum computer can search through a space of size 2n in time 2n/2. This means that a 128-bit AES key would be demoted back to the strength of a 64-bit key -- however, note that these are 264 quantum-computing operations; you cannot apply figures from studies with FPGA and GPU and blindly assume that if a quantum computer can be built at all, it can be built and operated cheaply.
Similarly, hash function resistance to various kind of attacks would be similarly reduced. Roughly speaking, a hash function with an output of n bits would resist preimages with strength 2n/2 and collisions up to 2n/3 (figures with classical computers being 2n and 2n/2, respectively). SHA-256 would still be as strong against collisions as a 170-bit hash function nowadays, i.e. better than a "perfect SHA-1".

So symmetric cryptography would not be severely damaged if a quantum computer turned out to be built. Even if it could be built very cheaply actual symmetric encryption and hash function algorithms would still offer a very fair bit of resistance. For asymmetric encryption, though, that would mean trouble. We nonetheless know of several asymmetric algorithms for which no efficient QC-based attack is known, in particular algorithms based on lattice reduction (e.g. NTRU), and the venerable McEliece encryption. These algorithms are not very popular nowadays, for a variety of reasons (early versions of NTRU turned out to be weak; there are patents; McEliece's public keys are huge; and so on), but some would still be acceptable.

Study of cryptography under the assumption that efficient quantum computers can be built is called post-quantum cryptography.

Personally I don't believe that a meagre 80 millions dollars budget would get the NSA far. IBM has been working on that subject for decades and spent a lot more than that, and their best prototypes are not amazing. It is highly plausible that NSA has spent some dollars on the idea of quantum computing; after all, that's their job, and it would be a scandal if taxpayer money did not go into that kind of research. But there is a difference between searching and finding...


Buffer overflow, SIGV fault at wrong address I'm trying to understand why my buffer overflow will not work. I've been strugling with this for a few days now, so thought it was about time to ask professionals. I've only recent began to understand the concept of buffer overflow attacks with a NOP sled.

This is for a challange. No spoilers please, but helpfull pointers will be greatly appreciated.

My problem is this:

I am able to run a Perl command like this NOP ... Shellcode ... *mempntr this works like expected when I give it an arbritary pointer.

Where the blue stuff are my NOP's
The Red is my shellcode
The highlighted yellow is my mempntr

Program received signal SIGSEGV, Segmentation fault.
0xaaaaaaaa in ?? ()

That is also as expected.

Try with correct mempntr

Now when I try to change the mempntr to something I want to point it at, like halfway through the NOP sled, for instance the location 0xffffd580 things behave weirdly.

At the breakpoint at leave I verify the saved eip

(gdb) i f
Stack level 0, frame at 0xffffd5c0:
eip = 0x80484b1 in main; saved eip = 0xffffd580
Arglist at 0xffffd5b8, args:
Locals at 0xffffd5b8, Previous frame's sp is 0xffffd5c0
Saved registers:
ebp at 0xffffd5b8, eip at 0xffffd5bc

Yet when I c or continue I have a SEGFUALT at a weird location.

Program received signal SIGSEGV, Segmentation fault.
0xffffd5a7 in ?? ()

I'm looking for an answer that could shed some light on this, or point me to a resource where I can learn what is happening.

That location is not weird, it's right in the middle of your shellcode. First verify that your shellcode is not broken. The disassembly of that code reveals this:

0x00000000: push 0xb
0x00000002: pop eax
0x00000003: cdq
0x00000004: push edx
0x00000005: push 0x702d
0x00000009: mov ecx, esp
0x0000000b: push edx
0x0000000c: push 0x68
0x0000000e: das
0x0000000f: bound esp, qword ptr [ecx + 0x73]
0x00000012: push 0x6e69622f
0x00000017: mov dword ptr [ebp + 0x33], esp
0x0000001a: push edx
0x0000001b: push ecx
0x0000001c: push ebx
0x0000001d: mov ecx, esp
0x0000001f: int 0x80

Are you sure this is what you really want to achieve with your shellcode?

Secondly, make sure any instruction of your shellcode is not overwriting parts of itself. If the stack pointer is right after your shellcode, push instructions might clobber it from its tail, leaving invalid instructions to execute.


What are the shortcomings of the following bank transaction authentication scheme? Here in Germany, authentication of transactions in online banking (beyond the basic log-in password which is and has always been needed as well) has evolved from a list of one-time passwords which are distributed in advance on paper (so-called "TAN" codes, or transaction authentication numbers) to the use of one-time passwords sent on demand to a mobile phone or similar device, in a message which also contains details of the transfer to authenticate the message.  I have been wondering whether it is possible to achieve a similar level of security while still using the older method of distributing a paper list in advance, and in fact came up with a scheme which seems workable to me.  Since I am aware of the general quality of security schemes devised by amateurs (and I am an amateur) I would be interested to hear comment on the shortcomings of my scheme from readers of this site.

The basic idea of the scheme is that a paper list of numbered entries would be distributed to the customer in advance by the bank.  Instead of containing simple passwords though, the list would contain simple numeric tasks, such as:

Enter the sum of figure one and figure four of the account number, followed by the number eight, followed by sixty minus figure three of the bank sort code.
Enter figure three of the account number, followed by figure two and figure seven of the bank sort code, followed by figure two and figure one of the amount to be transfered (ignoring cents).
...

When the customer has to authenticate a transaction, they will be given the number of one of the tasks and asked to enter the solution, using the transaction details.  It seems to me that this scheme fulfils the requirements that the one-time password generation should be initiated by the bank at the time of the transaction, that it is tied to the transaction, that it is non-trivial to work back from the password to the method used to generated and that it involves a second, separated communication channel.  In addition I would hope that it would be manageable for customers (except that it might need a large-ish piece of paper to hold the tasks!), and would actually encourage them to check the transaction details.

I realise that there would need to be requirements on the tasks to keep them usable but still secure, and that they would have to be expressible and parametrisable in a way that the bank's computers can deal with (though new types could be introduced at any time).  Beyond that I would be interested to hear what major holes there are in this scheme that I have missed.

Some thoughts in no particular order.

It requires good math, reading, and reasoning skills; although it
would be great if everyone could perform these tasks we can't (nor should we) expect
that everyone with a bank account will be able to do this. This will result
in false failed logins, decreased usage, and increased support calls.
It requires standardization about how to write the questions.
Ideally these questions should be able to be algorithmically
generated, not written by a human, and verifiably correct and free of ambiguity.
The scheme requires the ability to read the language the questions are written in. A scheme that just has a token card or passcode list does not have this limitation. Bank accounts are mostly numerals which are cross-linguistic.
Given the required standardization above, now we must be able to verify that
it is indeed not trivial to work backward from password to the
generating algorithm. It's not clear from your description that this
is provably true.
The resulting number has to be both long enough to provide
sufficient entropy and short enough to make the calculation step
feasible. E.g. a 10 digit number might have sufficient entropy
depending on the calculation scheme and the rest of the security;
but 10 digits might be too long to expect someone to follow all your
steps.
What problem are you trying to address that you feel current schemes fall short at?


How to execute a custom meterpreter payload? I've hacked a box in an internal network 10.0.0.1 and I want to use 'pass-the-hash attack' on another box 10.0.0.2 but this box has Avira anti-virus installed in, and the common payload windows/meterpreter/reverse_tcp is detectable by Avira.
So I made my own backdoor and it can bypass Avira; how can I let metasploit use it instead of meterpreter?

With a quick google search I found the following questions asked previously on this forum, they are not recent however may provide the answer you are looking for.
In Metasploit, how to use a custom exe as payload?
How can I add modules to a Payload on Metasploit
The following article is also catered specifically to your use case;
https://securityboulevard.com/2020/02/evading-antivirus-with-better-meterpreter-payloads/


Can viewing an email message in Outlook 2013 install malware on my computer? I routinely get spam messages which state "Your account for [Insert game here] has been flagged. If you don't click this link/send us this info/go to this website in the next 72 hours, your account will be banned." I know that mails like this are pure spam, since the usual action the makers of these games do is ban first and ask questions later. I just delete them without clicking any links inside

However, I have the Outlook preview pane open, which shows a preview of the mail next to the list of emails. Can a crafty spam creator somehow hide something in this mail which could have a negative effect on my computer's health? something like a keylogger, a trojan or full-blown malware?

Assuming a fully patched version of Windows, Office 2013 and Norton 360, can someone hide malware in a message without an attachment but with embedded images?

Malware in an email can theoretically compromise your system even if you don't open it. Every mail that comes in is processed to some degree, and vulnerabilities in the email program could be used my embedded malware. This has happened in the past IIRC, several years ago, and I believe it had to do with image processing.

Currently there are no published vulnerabilities in outlook that could lead to a compromise as you describe that haven't had a patch released. That does not mean there are no zero day vulnerabilities that are being used quietly, or have yet to be discovered.


Can we build network topology using passive fingerprinting? Can we use the tools such as P0f, OSSIM and other passive fingerprinting tools to build a comprehensive network topology of how the devices are interconnected ?

or is there a passive finger printing way of building network topology ? without any active probing, traceroute, nmap etc

Passive methods analysing traffic that comes into a single system are unlikely to work for you unless you have a very small network topology. Using tools like P0f or OSSIM you will learn what other subnets exist, but only if they connect to your box. You won't learn where they are in relation to each other, or even necessarily get a full picture of all the subnets in a network.

What you want to capture is the routing protocol traffic. Routers use protocols such as OSPF, EIGRP, and the like to send routing updates to each other. If you can see those you could build at least a partial network topology, how complete depends on the protocol and where your collector is in it. If you are in an OSPF stub area it will be extremely limited, if you are closer to the core it would be much more complete. Your system won't get any of this information unless you are running a span off of a network device because your system isn't participating in the routing protocol's multicast groups.


Can a CVE be removed from NVD database? Normally, CVEs are added to the NVD CVE database and never removed. But can a CVE ID just disappear from the database after being there for a while? (Maybe because the entry was a complete mistake, or by whatever else reason.)

NVD description mentions Rejected mark; obviously in this case the CVE ID still remains in the database.

I need to know whether I should handle this case by software which periodically queries NVD.

No. Numbers would never need to be removed from the database. if they are created and then it appears they were created in error or the vulnerability were a false-positive, they would just be marked 'Rejected' indefinitely - or until proven otherwise. This avoids the possibility of the same vulnerability linking to several CVE numbers for whatever reason.

However, for your purposes... Yes, you should handle the potential for data to be removed from the DB. Regardless of how any site is supposed to function politically, it cannot be guaranteed to function like that technically.


Store tokens in MySQL or use Vault (HashiCorp)? I will get thousands of user's tokens when they authorise to us via OAuth (external provider).

I am trying to find out what the best practices to securely encrypt user's token into a database.

I am considering using libsodium (Halite in PHP) to encrypt the token and then save into MySQL. Encryption key is stored in the .env file.  But what if web server got hacked and they could manage access to .env?

Second option is use Vault (HashiCorp) which is installed on the separate server. The web server would have to access to Vault using API.

Which one do you think is more secure?

There are couple of ways to do this, depending on if the webserver really needs read/write access to the oauth tokens.

I've been using Vault for a while now, and I think this would be the way to go. You can use something like the approle auth backend (vault auth-enable approle) to let your servers write the tokens based on different policies (so they are limited to only writing those tokens).

Since the webserver can only write, you need something that can read the oauth data, and I suggest you have a some queue tool here, with workers that can read and processes whatever you need to do, and preferably not on the webserver (so that read/write access is split on different machines). The worker could use a read/write or read only app-role.

Which secret backend you use for your data storage (consul/file/DB) doesn't matter. Choose what you are comfortable with (I like consul since it's resilient and not depending on mysql or other DB replication), but whatever you choose, vault will ensure that the data is encrypted before it's written.

If the webserver is hacked, well, then it could cannot read the tokens, so the data should be pretty safe (as long as you protect machine/vault/worker communication).


"Web of trust" for self-signed SSL certificates? SSL certificates, generally speaking, use a "chain of trust" model - a trusted certificate authority (CA) gets proof that a company such as Amazon owns amazon.com and issues an SSL certificate.

However, certs can be expensive - and it doesn't make sense to spend that kind of money for example on a personal website. But more and more people have been arguing that web traffic should always be encrypted because computers can handle it and it protects you over public wifi networks e.g. starbucks. So you can use SSL with a "self signed" certificate but users will get a nasty message saying that the certificate is not trusted since it is "self signed" and not by a "trusted" authority. The problem is that there have been numerous cases of the "trusted" authorities making mistakes and giving SSL certs to "bad guys" so to speak. But in reality, a self-signed cert is not significantly less secure than a cert signed by a CA - in the sense that your traffic is encrypted and sent to the web server and decrypted there. It just means that no one "trusted" checked the identity of the webserver in question.

Is there a way to do a "web of trust" model with SSL certificates similar to PGP keys? I.e. if I know someone personally and know that they are the administrator of website www.example.com, and they have a self-signed certificate, I can "sign" the certificate to say that I trust them. Then when users go to a self-signed website it will say that the person can be trusted based on their place in the 'web of trust'.

... But in reality, a self-signed cert is not significantly less secure than a cert signed by a CA - in the sense that your traffic is encrypted and sent to the web server and decrypted there. It just means that no one "trusted" checked the identity of the webserver in question.

This just is a very important part. If you don't verify, that the peer you talk to is the expected peer, than it could just be somebody else. E.g. if Alice wants to talk to Bob and does not check, that it is actually talking to Bob, than it might talk to Mallory claiming to be Bob. Mallory might then relay the messages to Bob and the connection would still look encrypted, but it would be encrypted from Alice to Mallory and again from Mallory to Bob. Mallory would have access to the plain text of the message and could also modify it.

In theory you could do your own web of trust with self-signed certificates. But, I don't think many of the current users of https would understand the concept and its implications, e.g. how to apply trust to another party, how not to trust just some stranger, how trust weakens the longer the trust chain is and how much trust they need when accessing a site (which might be different from site to site).

Which means, that at the end you might get a trust network which is too complex for most people to understand and thus they don't trust it. Or you might get a trust network with some well known and thus trusted players in it which offer to verify you and then add you to the network for some money - which is more or less what you have today.

While nobody really likes a central authority, having such thing greatly simplifies to apply trust in real life. I.e. most people don't put they money into a small bank unless they are known to be backed by a larger bank or insurance etc.

DANE might be a better way to go. It still requires a central trust network, but it does not create a new one just for SSL, but instead reuses the existing one created for DNSSec. This might be both cheaper and easier to understand - and thus more trusted.


Lateral movement while on VPN Now that everyone is working from home using VPN, if infected by any malware, is lateral movement possible?

Yes. Some VPN will place all connected computers on the same net, without client isolation, thus you could jump from one computer of an employee to another (and from those to their home network, too!). Even if you can't do lateral movement between clients, it may be possible between different servers to which those users connect to.


Mifare Desfire symmetric authentication with master key on android I wanted to use the Mifare Desfire chip for product authentication purposes, where the chip would be embedded into products. As such, I am looking for a NFC solution that makes it virtually impossible(or as hard as possible) to clone the chip.

The current solution I had in mind using the Desfire was to use the supported symmetric authentication to have a memory-locked part of the chip where we would store the product information. Then we would create diversified keys, using a master key, UID of the chip, and some metadata and use that diversified key to conduct the symmetric authentication(more information on it can be found here.

Now, the problem lies in the fact that the symmetric authentication has to be done on an android app, meaning we would have to store the master key on the android app or send it over network to a potentially malicious version of the app. So I was wondering if anyone had a suggestion on how to protect the master key or an entirely different authentication solution to prevent chip cloning using the Mifare Desfire or other similar NFC chips.

The key does not need to reside on the app.

When you ask for authentication, you will get a random number, encrypted with the key, back.
This random number, you can send back to the server with the app, and let the server do the authentication with key. The server will then send you a new encrypted packet with a encrypted value, that you just forward to the chip. Then you will get a response from the chip, that you send back to the server.

After that, the cell you are using could contain some product info, "signed" with a MAC. This product info and MAC is also sent to server as a final phase.
Only after all the steps completed successfully, product is genuine.

If you use any libraries to do NFC communication, you must run these in manual mode to be able to authenticate this way.

It is possible to create a rogue app that will read the resulting data and copy the product info inclusive the MAC, and then insert this into a fake DESFire EV1 chip that will accept any authentication. This is why the server must validate the random value that is returned, that this successfully decrypts to the value the server initially selected, but shifted to the left. (read the implementation details on how you do a authentication).

By using keys that cannot write the chip, you also prevent someone from updating a genuine chip to contain information about a product more expensive than the product the chip resides on.

Be also careful that someone may move the chip from a genuine product to a fake product, and then keep the genuine product itself, and sell the fake product. Use tamper-resistant chips for this, that will stop working once they are removed from the product. Or tie the product to a service requiring authentication with the app to work, thus the genuine product that the fraudster have will be useless without the chip.


Is my session-less authentication system secure? So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it that's not usual of a web authentication system.

Basically, I wanted to make it so that authentication could be done without keeping track of each user's session. This means less load on the database, and trivial to scale and cache. Here are the "secrets" kept by the server:

A private-key is kept in the source code of the application
A randomly generated salt is kept for each user

To make it sessionless, but making forging cookies not easy, this is the format of my cookies

expires=expiretimestamp
secret=hash(privatekey + otherinfo + username + hashedpassword + expires)
username=username

(with otherinfo being things like IP address, browser info, etc and with hashedpassword=hash(username + salt + password + privatekey)

My understanding is that forging login cookies (not cracking the passwords) requires:

Source code access to the application, or a way to trick it to spit out the private key
Read-only access to the database to get the salt and hashedpassword

Whereas the traditional session method requires:

Write and read access to the database (to inject the session, or trick the web app into doing it for you)
Possibly source code access depending on how it works

Anyway, does this seem overly insecure to anyone? Are there any ways for me to improve on it and make it more secure(while keeping with the stateless/sessionless model)? Are there any existing authentication systems which use this stateless model?

Also, the hashing method can be basically anything, ranging from SHA256 to Blowfish

Your basic concept is not new: you want to have some state associated with the user, but you do not want to store that state yourself. Instead, you store it on the client (in a cookie). Since you want to protect against alterations of such a state (e.g. a client building a cookie from scratch), you need an integrity check, such as a Message Authentication Code. Your construction with a hash function is a crude MAC. It so happens that it is a weak MAC with the usual hash functions, because of the length extension attack.

If you want a MAC, use a strong one, and that means HMAC. It is standard and widespread.

Of course, storage of the secret key (for MAC computations) is a tricky point. Something embedded in the "source code" of the application exists as a file, which (by nature) the application can read, making it vulnerable to exploits which obtain illegal read access to arbitrary files. It would be better (but harder) to arrange for the MAC key to be obtained dynamically by the application through some local communication protocol (the application contacts a local server, which gives the key only to the application); that way, the key would only exist in the RAM of the application, not as a file readable with the access rights of the application. It would not be absolute protection (if your server gets thoroughly hacked, well, that's it) but it would be stronger in practice.

I see that you include the hashed password in the data which is MACed. This is a bit weird; you already have the MAC as authentication: the MAC proves that the cookie data is genuine, thus there is no need for further authentication.

Blowfish is not a hash function; it is a block cipher (or a type of fish) and, as such, cannot be used for hashing unless it is considerably modified, which would mean homemade cryptography, and that's not a good idea.

If you are offloading state on the client, you might want to offload state which the client himself should not know. This means that you may also need encryption. Combining encryption and MAC securely is not as easy as it seems; there are modes for that. I recommend EAX.

Be warned that not maintaining state makes you inherently weak against replay attacks. That's unavoidable. You can minimize the damage by using short validity ranges (e.g. a cookie expires within 15 minutes).


Should iPhone backups be encrypted? Is this in-scope for Corporate IT if the device is linked to a home pc? iPhone backups may reside on a computer that is outside of IT Policy (Home PC) and therefore doesn't have any Corporate IT protections on it.  If this home PC was stolen or hacked, then the iPhone backup data is vulnerable as well.

Considering that some iPhones support local encryption, and there are ways to prevent what devices can connect via Activesync, does it make sense to enforce that all backups of the device are encrypted?

How would you go about deploying this policy and reporting on compliance?  As far as I know, the Apple deployment tool may help, but may not directly help in reporting.

I certainly think it would be useful to mandate that devices are backed up in an encrypted format, if the reason for using local encryption is that you intend the data to be encrypted ;).

On the iPhone side, you would implement the security policy using Apple's iPhone Configuration Utility to create configuration profiles that control how the device is set up. Part of that configuration profile is that you can mandate encrypted backups. That doesn't mean that it will only back up to encrypted media, it means that the backup is stored in an encrypted form with a supplied password. Interestingly, files encrypted with NSFileProtectionComplete are re-encrypted with a key derived from that password, so you can restore the backup with knowledge of the password not necessarily the hardware key. That's useful if you have to remote-wipe a device or replace it, but still want to restore the data from a backup.


Can anyone help me build a combo file suitable for my problem? I have a router model C1000A
company: CenturyLink Actiontec
I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password is written on the label of the product but some characters have been deleted).

Some characters are well understood, but others can not identify, so I need help building complete combo fits all possible options.

My understanding:
password contain 7 characters, What is not understandable is marked with an asterisk, **7k8*d

Thanks in advance.
maor

It looks like you may be in luck. Given the positioning the smudge for asterisk 2 is almost certainly a 7. Also the 3rd asterisk appears to be a lowercase rounded character. This narrows the password space down to (roughly) 360 passwords.

Below is a short C# program that I wrote. This will output all possible passwords (currently limited to what I think it likely is). You can extend the character sets as need be. To run this you can download LinqPad https://www.linqpad.net/Download.aspx (I used version 4) and run the part contained in the Start LinqPad and End LinqPad comments as a C# statement. Other wise you can run this in Visual Studio Community Edition from Microsoft (A much longer download). Note that these are both Windows programs (If you need Mac or Linux leave a comment).

Code begins here:

using System;
using System.IO;

namespace maorLostPassword
{
    class Program
    {
        static void Main(string[] args)
        {
        //Start LinqPad

        //write out to desktop
        string path = Environment.GetFolderPath(Environment.SpecialFolder.Desktop);

        //Add the character set here a-z, 1-10
        Array CharacterSet0 = ("abcdefghijklmnopqrstuvwxyz0123456789").ToCharArray();
        //This looks to be a 7, however I will leave this here incase it is not.
        Array CharacterSet1 = ("7").ToCharArray();
        //This looks like a lower case rounded letter add in the ones that you think it could be
        Array CharacterSet2 = ("acdeghopqs").ToCharArray();

        //Write this out to a text file
        using (StreamWriter writetext = new StreamWriter(path + "\\passwords.txt"))
        {
            foreach (char i in CharacterSet0)
            {
                foreach (char j in CharacterSet1)
                {
                    foreach (char k in CharacterSet2)
                    {

                        //Reverse order to print in alp order
                        string password = i.ToString() + j.ToString() + "7k8" + k.ToString() + "d";
                        //write it out
                        writetext.WriteLine(password);
                    }
                }
            }
        }

        //end LinqPad
    }
}

}


Is it recommended to patch announced vulnerability for unused services or features? Sometimes vendors announce software upgrade to patch some discovered vulnerability in some feature or service which is not enabled in your system. Is it recommended to upgrade your software although you are theoretically not affected by?

This is a risk assessment and threat modelling style question - rather than a hard yes or no.

Do you want to accept the risk of not patching the service, which could be exploited in the future -  may be someone runs it later on. Or do you not accept the risk of updating your OS/software which could cause adverse affects on running services.

Only your individual situation will be able to answer those, and often there will be different answers depending on the threat landscape and importance of the server/application in which you are assessing.


Is it safe to ignore DoS attacks on my router? There are several entries in my router's log file showing recent DoS attempts on some of its ports. They look like this:

[DoS Attack: ACK Scan] from source: 213.61.245.234, port 80, Friday, November 21,2014 11:37:59
[DoS Attack: ACK Scan] from source: 80.239.159.8, port 443, Friday, November 21,2014 11:18:09
...
[DoS Attack: RST Scan] from source: 195.39.197.142, port 30732, Wednesday, November 19,2014 22:12:35
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:56:38
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:56:33
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:56:06
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:56:01
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:50
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:44
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:38
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:36
[DoS Attack: ACK Scan] from source: 31.13.91.117, port 443, Wednesday, November 19,2014 17:55:36
[DoS Attack: ACK Scan] from source: 88.221.82.74, port 443, Wednesday, November 19,2014 17:55:30
[DoS Attack: RST Scan] from source: 128.199.49.106, port 18668, Wednesday, November 19,2014 15:06:46

Tried scanning my router's public IP for open ports:

sudo nmap <my-public-ip> -Pn --reason --top-ports 10

Starting Nmap 6.47 ( http://nmap.org ) at 2014-11-21 16:02 CET
Nmap scan report for <public-hostname> (<my-public-ip>)
Host is up, received user-set.
PORT     STATE    SERVICE       REASON
21/tcp   filtered ftp           no-response
22/tcp   filtered ssh           no-response
23/tcp   filtered telnet        no-response
25/tcp   filtered smtp          no-response
80/tcp   filtered http          no-response
110/tcp  filtered pop3          no-response
139/tcp  filtered netbios-ssn   no-response
443/tcp  filtered https         no-response
445/tcp  filtered microsoft-ds  no-response
3389/tcp filtered ms-wbt-server no-response

I'm curious, how does my router know that each one is a DoS attack in the first place? Are these cases of using nmap aggressively in some way? And should I be worried about these attacks?

Looking up these IP addresses in Google give the following results:

31.13.91.117 => related to Facebook
88.221.82.74 => related to Akamai

Given the fact that Akamai is a content provider (CDN) which has reportedly been having Facebook as a customer, it seems that this might not be a real DOS attack, and that your router's protection is exaggerating. Is it possible that a lot of your employees/family members use Facebook, which causes a lot of (legitmate) Facebook responses to come in on your router? The router might see this as a DOS-attack, when it is in fact not. This is supported by the fact that the 'scans' come from source port 443, which is the TLS (HTTPS) port. You are connected via HTTPS to Facebook, and they reply to you.

The other IP addresses listed in your question seem a little bit more shifty, but again, this might be a legitimate site which is sending a lot of responses (lots of CSS, JS, etc.). However, the ones that list port 30372 and 18668 are very shifty. These may be part of a massive scan or just a coincidence. I wouldn't worry about them if they don't appear regularly.


XSS in HTML Context without I have a webpage that blindly removes < and > as hardcoded rule. I know XSS doesn't always need < and > since it is not needed in HTML attribute and javascript contexts.

But is it possible to carry out XSS in HTML context without < and >? I saw it is possible in UTF-7(IE) where they can be replaced by other characters to make a valid HTML construct. Is it possible to do in any other way?

Or is it true that for HTML contexts just stripping < and > is sufficient since without them everything is treated as plaintext?

Generally I would not suggest to strip the tags from an input. This won't work sometimes and it would still be possible to generate a valid XSS attack like in your example.
If you want to sanitize your input try using something like htmlspecialchars. This converts all your characters into HTML entities. So they are safe to display. If you want to allow HTML tags on your site I would suggest to use a html purifier so you can allow all tags you want. (Whitelist approach)

Regarding your question:
This would generate a valid XSS on your site without the three mentioned elements:

%253Cscript%253Ealert('XSS')%253C%252Fscript%253E

This type of attack is called double encoding if you want to search for it. If you want more information about XSS try using the cheatsheat from OWASP or Github.


Suspicious established network connection So, while I casually did a netstat -a for an unrelated matter I found this connection open that seemed (at least to my untrained eye) strange:

Where Name was the last name of another current employee of the company in all caps.

Is this something standard to be on a desktop connected to the company's network(as its the only such name appearing, all the other have my last name/firewall's name or no name), or is it something I should worry about? If the latter, how should I further investigate the matter?

If the systems are running Windows 10, it's that feature that allows you to download updates from your peers.

Port 7680 is the listener for the peer service that Windows 10 uses to transmit the update files. If the other employee has their host name set to their last name, that's what will appear on the connection. Windows will locate all of the hosts that are broadcasting themselves, and connect to their host name.

In the event you aren't running Windows 10, it's more suspicious.


Attack vectors for brute-forcing website passwords When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the possible vectors for a brute-force attack?

Entering username/password pairs into the website authentication fields directly is one, but is often mitigated by a timeout or lockout after failed attempts. Carrying out an attack on a stolen database of hashed passwords is another, but assumes the database has been compromised. How else could a brute-force password attack be carried out (assuming we're talking about website accounts, not Unix accounts, services, etc.)?

How else could a brute-force password attack be carried out?

You've covered both bases, and that's really about it.  Either repeatedly submit to whatever web frontend is available, or manage to get a copy of the hashes by cracking the database server, abusing the web software, what have you.

Web frontend cracking is usually more an issue of smart force than brute force, and as a result, it works better than you would assume.  For example, given a web site which had a company directory - first, last, and extension - for about 100 people, I was able to "brute force" 30% of the accounts simply by throwing together some algorithmic guesses with that data.  And the authentication site was Microsoft Exchange, so I stayed below the threshold of NSA recommended lockouts and was fine.  (In fact, this was a pen test and I verified before testing to ensure I wouldn't lock out users, but it was an easy guess to make correctly). Even with the slow rate of guessing, I was done in under a day.


Why is it difficult to catch "Anonymous" or "Lulzsec" (groups)? I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the outrage of Anonymous (hacker group), but as a critical thinker, I'm unable to control my curiosity to dig out how exactly they are doing this? Frankly, this group really scares me.

One thing that I don't understand is how they haven't been caught yet. Their IP addresses should be traceable when they DDOS, even if they spoof it or go through a proxy.

The server with which they are spoofing should have recorded the IPs of these guys in its logs. If the govt. ask the company (which owns the server) don't they give the logs?
Even if it is a private server owned by these guys, doesn't IANA (or whoever the organization is) have the address & credit card details of the guy who bought & registered the server?
Even if they don't have that, can't the ISPs trace back to the place these packets originated?

I know, if it was as simple as I said, the government would have caught them already. So how exactly are they able to escape?

PS: If you feel there are any resources that would enlighten me, I'll be glad to read them.

[Update - this is equally appropriate when referring to the Lulzsec group, so have added a quick link to the Wikipedia page on them]

My answer pokes at the original question. What makes you think that they don't get caught?

The CIA and DoD found Osama bin Laden.

Typical means include OSINT, TECHINT, and HUMINT. Forensics can be done on Tor. Secure deletion tools such as sdelete, BCWipe, and DBAN are not perfect. Encryption tools such as GPG and Truecrypt are not perfect.

Online communications was perhaps Osama bin Laden's biggest strength (he had couriers that traveled to far away cyber-cafes using email on USB flash drives) and Anonymous/LulzSec's biggest weakness. They use unencrypted IRC usually. You think they'd at least be using OTR through Tor with an SSL proxy to the IM communications server(s) instead of a cleartext traffic through an exit node.

Their common use of utilities such as Havij and sqlmap could certainly backfire. Perhaps there is a client-side vulnerability in the Python VM. Perhaps there is a client-side buffer overflow in Havij. Perhaps there are backdoors in either.

Because of the political nature of these groups, there will be internal issues. I saw some news lately that 1 in 4 hackers are informants for the FBI.

It's not "difficult" to "catch" anyone. Another person on these forums suggested that I watch a video from a Defcon presentation where the presenter tracks down a Nigerian scammer using the advanced transform capabilities in Maltego. The OSINT capabilities of Maltego and the i2 Group Analyst's Notebook are fairly limitless. A little hint; a little OPSEC mistake -- and a reversal occurs: the hunter is now being hunted.


What is a cryptographic puzzle? On the wikipedia page on TCP under Denial of Service the following paragraph is found:

  By using a spoofed IP address and repeatedly sending purposely
  assembled SYN packets, attackers can cause the server to consume large
  amounts of resources keeping track of the bogus connections. This is
  known as a SYN flood attack. Proposed solutions to this problem
  include SYN cookies and cryptographic puzzles.

I am interested in learning more about cryptographic puzzles. I assume that it is some task the server can send back to the client before it will proceed with establishing the tcp connection. This task probably has the property that it takes a lot of resources to find the solution, but it is easy to check if a solution is valid (for the server.) Is this correct? (Kind of like what is proposed for spam-mitigation.)

Where can I read more about cryptographic puzzles? Googling the term does not  return anything useful, neither are there any wikipedia pages with that name.

Are there any software libraries readily available for creating and solving these puzzles that I can use?

Your guess is head-on. Proof of Work may be a more useful search term: http://en.wikipedia.org/wiki/Proof-of-work_system

To my knowledge, there are mainly patent issues that prevent these systems from being used in modern Internet protocols like IPsec/IKE/SSL. I also heard from some researchers that in their practical evaluation, there was basically zero gain from deploying such protocols to prevent DoS on a typical key exchange protocol. But it could be that they had other scalability issues. Would be interesting to see some real-world evaluation.


Where is the best way to filter user input? Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the client side or in the server side ?
If the filtering happening on the client side, users can look at filter implementation and then it can easily circumvented. But what's about the server side ?

It depends on what you mean by "the best".
From the security point of view, server should not trust any data received from the client and should validate all the data. Why? Because you don't know who and why sent these data. May be user has modified your JavaScript and forced browser to send to the server the data, that you believed your script should have filtered. Or may be there is an attacker that created an application, that sends data that you have never expected from your script.
From the point of view of good user experience, the application (web site) should inform the user about incorrect input as soon as possible. That's why it makes sense to implement some validation and correction on the client, for instance, validation of telephone number or validation of date. On the server side you should still validate everything, including any data validated on the client.


Masking IP address and port number for Web application I have a Web application running on port 89 ( non-standard port) of a Windows 2012 R2 machine. The login page for this application needs to be accessible through a link on my website - let's call it mydomain-llc.com. I have created a button on the home page which currently explicitly provides the IP address and port number for the web server as such :

</head><frameset rows="100%" scrolling="yes" border="0">
<frame src="http://x.y.z.t:89/">
</frameset></html>

The net result is that when an user clicks the button they are taken to the login form for the web application but the IP address and port number is exposed in the browser address bar as such : http://x.y.z.t:89/

How can I mask the Ip address and have it just display a domain level URL such as :

mydomain.com/loginform.html

I understand that one way to achieve this is to setup a DNS A record at the domain manager level but would it work for an application running on a non-standard port ( port 89 in this case ) ?
Many thanks in advance for your answers.

As you mentioned, you can mask the IP address through DNS.  However, there's nothing you can do to mask the port: the decision to display it or not is entirely up to the user's web browser.

There are no security implications of exposing the address and port, though: it's trivial for a potential attacker to figure them out.


Password Reset URL strategy Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend developers.

Although that's not the point of the question, i appose the flow for a better understanding of the reader.

Request reset for an email (frontend)
Whether the given email is present or not send response OK (backend)
Generate a random reset-hash (if one is not present & not expired, to avoid spam) (backend)
Send the reset link @ user's email (backend)
Redirect to a URL with the password reset form (frontend)

And there is the point that the question kicks in.

What information needs to be send (with the URL) to the frontend, so that the frontend knows what user identifier needs to be sent back?

My first thought is that frontend needs to send back the new user's password alongside the hash from the email, so that server gets the user's info from matching hash with reset-request. Even if somebody bruteforces the hashes, and finds out a password-reset page he will never know for which user he is changing the password for.

Am i missing something here or this is the most secure way to handle the reset-URL, given that 2-factor authentication functionality is not present?

Is this how large corps handle the reset-link functionality?

Thanks in advance!

What information needs to be sent (with the URL) to the frontend, so
  that the frontend knows what user identifier needs to be sent back?

Don't send any information to the front end if possible. Some sites fetch the user name to show greetings but I would avoid that too.

So the complete workflow will be,

  Request reset for an email (frontend)
  Whether the given email is present or not send response OK (backend)
  Generate a random reset-hash (if one is not present & not expired, to avoid spam) (backend)
  Send the reset link @ user's email (backend)

In the landing page from the email link, obtain the hash from the URL and check if the hash is valid
Redirect to an error page in case of expiry, invalid link, etc... (Kindly don't fake an OK response here as you did while obtaining email. Here errors can occur as usually email provider re-route the links through their server and some may remove parameters)
Else, redirect to reset-form, obtain the password from the user and send it along with hash to the backend.
Use the hash to match the user and update the new password.
Show a success screen to the user, send an email and redirect them to the login page.


How to protect a  from XSS? Most sites having a sign in form have the following html element:
<input type="password" />

If I press F12 to open the debugger on chrome and type:
document.getElementByName("password")[0].value

this will retrieve the password.
A hacker could write a XSS in which the password is read and sent to his server
then log in my CMS.
In Bank of America's website, the password's input value is shown as "secret", they have a solution to protect it. The real password is unaccessible, thus protected.
What are some solutions to this?

The only reasonable solution, as commented multiple times, is to protect against XSS on the very beginning. You don't want to focus on the password box.
A successful XSS can do any possible harm to the web page, not limited to sniffing the input box, but also to redirecting the login form to possibly anywhere else, social engineer an official endorsement (BofA detected a security flaw in your browser, hurry and download our extension is a very succesful malvertising).
The browser is software under the user's control, so Developer Tools exist to help the (advanced) user take full ownership of the HTML document which is run on their end.
I believe your approach is wrong for this reason. As soon as your login page cannot be contaminated by XSS, and as soon the user is not installing a keylogger/malware extension into their browser, you have no reason to protect the password box.
Protecting from XSS is a totally different topic.


Can you force your PC or device to use only DNSSec-verified lookup results? Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.)

Well, I certainly understand why anti-spoofing protections for DNS name-to-address resolution lookups are very necessary. And I even understand (roughly, at a basic level) how the cryptographic trust chain mechanisms work, from the DNS root servers and top-level domains down to the lowest-level ISP and internal/corporate nameservers to provide a foundation for the DNSSec role of cryptographically attesting that a given domain name really is linked to one or more given IP addresses.

But my understanding gets hazy at the point where an end-user's device actually takes advantage of the DNSSec system's capabilities to verify that the DNS server the client is dealing with is telling the truth when it says that a certain domain name is legitimately supposed to resolve to a certain IP address. That, for eg., www.example.com really is intended by the people who own it to point to 93.184.216.34, and that 93.184.216.34 isn't just some spoofed, malicious substitute server telling, say, my browser to go to an attacker-controlled web page instead of the genuine one.

Anyway, my actual question here isn't quite "I don't fully understand how DNSSec works at a client/DNS server-level. Please explain that."  I have a more pragmatic concern: Can one actually configure an end-user client PC or device to force it to accept & use only DNS lookup results that are cryptographically-verified under DNSSec? Configuring a PC to use certain specific DNS servers is easy enough, obviously; how does one configure a PC to use only DNS lookup results that are verified as legitimate by the DNSSec infrastructure?  Or can that even be done; is there something I'm missing about how DNSSec works at the client/DNS server level that means my whole question is off-base? Or is something else going on?

( Note: I suppose I'm asking with the picture of a typical Windows client environment in my head, but really I mean to ask in a more general context of "Is there some kind of verification/checking in DNSSec that actually occurs at the client level, or is DNSSec some purely external thing were a client is expected to "just trust" the end-output of some DNS server?" And the latter sounds a lot like it would just have the some of the same issues that make the legacy DNS system problematic.)

Can one actually configure an end-user client PC or device to force it to accept & use only DNS lookup results that are cryptographically-verified under DNSSec?

I don't think it is possible to do directly. What you might could do is to setup a DNS server which throws away any response which is not signed with DNSSec. Then you could setup your local network so that it uses this DNS server. This DNS server could even be run on the same host. I'm not aware of any existing server which can be configured to do this. But it should not be too hard to write such a server for personal use (i.e. no need to scale a lot).

But, since most of the servers on the internet are not using DNSSec yet you will effectively cut yourself this way from most of the internet. Nice for an experiment, but usually not useful in practice.

  or is DNSSec some purely external thing were a client is expected to "just trust" the end-output of some DNS server?"

DNSSec is usually not really integrated into the systems. That means applications on current Windows, Mac or Linux systems are usually not aware if the address they got for a host was retrieved using DNSSec or unprotected DNS. Even if the system resolver would know this, the current API's in the libraries and programming languages mostly do not expose this information to the application or it is unclear how much this information from the API can be trusted itself. For some interesting reading about the complexity of the issue see Support for DNSSEC in the GNU C Library.


Feasibility and scalability of a large biometric system (e.g. Aadhaar) Over the last five years, India has systematically advanced a biometric identification scheme, which now has an enrollment of over 800 million users. To ensure the accuracy of matching for such a large population, the Biometrics Standards Committee proposed collecting all 10 fingerprints where physically possible, presumably to set a larger threshold for identification (e.g. 80% confidence on 3 or more fingers).

A PoC conducted by the Unique Identification Authority of India found that a suitable technique to use for authentication would be to verify "two separate fingers for upto 3 attempts" (details here). This provides an accuracy of 99% which the committee finds reasonable since authentication is 1:1 and not 1:N (an analogy is that the password is only checked for a single username during login). While this process also has tons of privacy and security problems, these are fairly well studied.

However, the process of enrolling a new user is supposed to perform deduplication, and hence is 1:N (a user should not be enrolled if fingerprints match). Assuming that only "the best two fingers are being matched", is it feasible to assume that this deduplication is not being carried out during enrollment, since beyond a certain number of users collisions are probably inevitable? The last report I've seen indicated 34,015 duplicates when 290 million people were enrolled (~ 0.01%)

Is such a system truly feasible and scalable? The birthday paradox seems to indicate that most users should have "doppelgangers" (even assuming 0.01% collision over 800m users). Are there any techniques that could be used to reliably and automatically identify "true duplicates" as opposed to "false duplicates" in such a system? Do biometric systems get progressively worse as users are added?

EDIT/TL;DR Do biometric authentication systems have negative network effects, whereby they get progressively worse (less accurate/precise) as the number of users increase? If no, why not?

Assuming that only "the best two fingers are being matched" doesn't seem to be a reasonable assumption.  Since deduplication is harder, surely evaluating all 10 fingerprints where physically possible would be an obviously more sensible strategy, and likely the one followed.
One of your sources says UIDAI says duplicate enrolments are around 5% and that  UIDAI says it detected 34,015 cases (about 0.1%) where one person has been issued two Aadhaar numbers.  What's unclear to me is how they detected these cases - what techniques were used to identify "true duplicates" as opposed to "false duplicates" in each of these sets.  In other words, once UIDAI cancelled those 34,015 Aadhaar numbers, how many duplicate enrolments were left?  None?  Not necessarily.  How many residents who a valid Aadhaar numbers no longer had one?  None?  Not necessarily.

We don't know the  collision rate among 290 million users is 0.01%.  Given the info presented, I think we don't know the  number of fingerprints being compared, or what else if anything is being compared) to identify the 5%, 0.1%, or (by definition) what % of duplicate enrolments remain undetected.

But can we figure it out / guesstimate?  The report on authentication says the System FAR is set to 1 in 10, 000 (i.e. 1 in 10, 000 authentications will have a false accept error)

If as the report suggests, the FRR – False Reject Rate goes from 6.5% to 2% with one scan and from 3.5% to 0.7% with up to 3 scans when going from 1 best finger to the two best fingers, what would we expect could happen when we go with the maximum # of fingers for 1:1 authentication?  for 1:N identification?  I don't find enough info to offer specifics.  More research needed.

But I can answer the "Do biometric authentication systems have negative network effects, whereby they get progressively worse (less accurate/precise) as the number of users increase?" part of your question. Yes.  They do, categorically.  You have a correct understanding of the problem.  Biometric systems do get progressively more challenged, as users are added, to keep FAR and FRR low.


Does critical SubjectAltName IP:x.x.x.x on an SSL client certificate limit where the certificate can be used from? I have a requirement to limit SSL certificates by source IP.

Would setting a critical SubjectAltName limit this (server side validation is by OpenSSL via nginx)? If not, how could this be implemented?

No. SubjectAltName gives alternative names, so it means that the certificate is good for the Subject name and also for any name listed under SubjectAltName. It does not create an additional requirement to be met, it gives an alternative requirement to be met.

So a server-side certificate with alternative names "www.example.com" and "192.168.1.5" would be considered valid for https://192.168.1.5/ OR https://www.example.com/. Both criteria do not have to be met, only one of them.

However such a certificate would not match url https://test.example.com/ even if the IP address of test.example.com was in fact 192.168.1.5. Only the name as it appears in the URL is checked.

To limit use of a certificate to a particular IP, you need to implement your own restrictions, probably at the application level. I.e. you will have to write code which checks the client IP and the certificate and validates that the rules are complied with, returning a suitable HTTP status code if not.


typical request, what type of encryption is this? so our company's CTO quit, and i replaced him and we need to change the system's passwords, however some passwords are encrypted in our database and i need to know what encryption to use in order to place new ones.

the encryption i am looking for is not base16-32-64. few examples:

12345678: qxha5ZeyN4w0TaEWSDSCNBNNC4Xlb9fg== root: Jxtf5LQJohE= admin: azOwKPoUYP4=

i tried Base encryption/decryption but i did not get the results either way http://online-calculators.appspot.com/base64/

any help is appreciated

thanks

Passwords in databases are rarely encrypted, they're hashed instead. Encryption is a reversible process - you can decrypt content, given that you know the encryption method and password. Hashing on the other hand, isn't a reversible process.

What you're looking at is not an encrypted password, but a hashed one.

On the question of replacing the password in your database - this is easy to do, you'll just need to use the same hashing algorithm, generate your own hashed entry, and store it in the database. Keep in mind also the fact that most hashing algorithms use salt.

I'd suggest posting the product name, or the system you're trying to change the passwords for, then we may be able to let you know how to change these passwords.

One thing is certain - it would be really hard to find out the original passwords from the hash (unless there's no salt, or something that exists in rainbow tables).

I've looked at it, it's most definitely a base64 encoded hash, the hash algorithm most probably being MD5 or similar. What you're doing wrong in your decoding is that you're trying to make sense of text data (which looks like garbage text and doesn't make sense), while you've got to look at the ASCII codes of each character instead. Look at the last text output field of http://www.hcidata.info/base64.htm
You'll see 16 bytes (or 8 bytes) of ASCII hex codes. This is your target. Then look at the output generated by the various hashing algorithms:
http://openwall.info/wiki/john/sample-hashes

Good luck!


Hydra gives wrong passwords I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output of passwords and username that allegedly valid. I saw that some people have asked about the reason for hydra giving wrong passwords and usernames and the answer was that the command should include the PHPSESSID. So I've been trying to use PHPSESSID but nothing changes.

the command:

hydra -L id.txt -P id.txt -s 80 -f 62.239.61.241 http-post-form "/Login/ajax/user-login.php:data=username=^USER^&password=^Pass^&remember=off&returnpath=:Fail :H=Cookie: security=low;PHPSESSID=9adriqaprd8f1qgot3ia1k3"

Any suggestions for the wrong passwords?

The way that Hydra determines if an attempt was successful or not is by comparing strings found in successful and unsuccessful return pages.

in your scenario i am assuming that the application is returning Fail if the attempt is not successful and something else if it is. if the page is blank in both cases that means all the attempts will be considered successful.

you should find a unique string in the return page (or page source) and put it after the :

more information here

http://insidetrust.blogspot.com/2011/08/using-hydra-to-dictionary-attack-web.html


Reporting Credit Card Thieves Someone is using a client's commerce site to check the validity of lots of credit cards.

After dropping IP addresses based on usage whoever is behind it throttled their requests down to 1 request every 20 seconds and only using the same ip for about 15 requests then switching IPs.

So for the last few months or so I have been "pretending" to process these and returning a credit card error to make it look as though it's attempting to process the order, although it is not.

I think I'll implement a captcha and just be done with it.  But before that wondering if there is a benefit to keeping them on the hook, collecting some information and reporting this to credit card company or law enforcement?

Reporting this to local law enforcement sound like the right thing to do. Hopefully they will have access to people who are competent enough to make use of the information you can provide without you getting into trouble.

You should also contact whoever you are using for processing credit card transactions. Ideally they have an API that you can use to report suspected abuse while preserving the same security for the card number as a normal transaction.

Your own logs will obviously contain IP address and time of each abuse attempt. But I would refrain from logging the card numbers, as you could potentially get into trouble yourself, if you did.


Perform man-in-the-middle attack on HTTPS website with same certificate I'm using Cloudflare to serve my GitHub pages website with a custom domain over HTTPS. I noticed that the Cloudflare certificate I received is valid for many domains (according to it's details on Safari). Is is possible for someone else to man-in-the-middle users trying to access my website by redirecting them to another domain for which my certificate is valid?

Also, is it possible to test this locally using Burp Suite?

I'm not familiar with Cloudflare, so this is more general.

In theory, it's possible for someone to change the Cloudflare front-end configuration to point your site at somebody else's server, then redirect back to your server, but it seems unlikely.

You can always test for incoming IP addresses to see if they're the ones you're expecting from Cloudflare. If they're not, the chances are they are coming from another server. In order to MITM, they would have to forward the intercepted traffic to your servers, so you can inspect the IP addresses to see if they're the ones you're expecting.

Other than that, I'm not sure what signals you would look for; the MITM server would try to masquerade as a Cloudflare server (and might actually be one, if the attacker could take over such a server). Burp Suite might be to indicate what a false signature looks like. You could also try a timing probe, browsing to your web site, and seeing if the timing is as you expect, or whether it is longer than expected; the latter might indicate that the connection has been routed through another server.

Of course, for any of this, you'll need baseline data, indicating what the "normal" state of affairs is.


Is it possible for our security administrator to still see our packets from the server side? This question may be confusing by it's title. My main question is, if it's possible for a Security Administrator to view encrypted packets sent to an HTTPS website? In present or past.

I work at a Tech support company and we are Tier 2 techs. Me and my co-worker was dicussing this and he thinks that the security guy can see all his information that's encrypted. I do know that they can see the information when I do Google Searches, but lets say if I go to an encrypted website like SkyDrive and I am logged into skype their via TLS will they be able to see this information?

Just check the issuer of the certificate & any manually-installed 3rd party trusted certificate authorities.

And you can make sure by using Firefox as it uses its own certificate authority repository (Not like IE & Chrome which use Windows repository), which makes it harder for administrator to install the un-trusted certificate authority.

Also, this webpage helps: https://www.grc.com/fingerprints.htm


Retrieved files were corrupted after file carving I have used scalpel to carve files from a memory dump. But some of the image files are incomplete or corrupted . I cannot see an image preview. What will be the reason for this ?

Carved files are almost always going to be at least partially incomplete or corrupted. The purpose of carving is to give you a place to start for manual analysis. You should not expect it to fully retrieve all the files in such a complete form that they can be viewed properly in an image viewer.


Seamless authentication from an iPad to several enterprise apps - what are the options? What are the options for authenticating users of corporate iPads which are MDM managed to access sensitive corporate web apps exposed over the internet?

The issue here is there are several web apps exposed and I do not want users to type in a long password each time. They will eventually all have their password as Password1 or find some other workaround.

I'm looking for the options and recognized architectural patterns for accomplishing this. Eg combinations of reverse proxies, certificates, SSO, FID?

Pretty new to this space so keen to learn and do some reading about proposed options.

Thank you

Some ideas:

For web apps, use SAML SSO. They will need to login to one web app, then other logins will be seamless. There's also OpenID and OAuth which do similar things.
For mobile apps, you could have the user just login once when they install the app, and have a long-lived session token.
You could use client certificates. A pretty decent solution, although not widely used.
iOS has "login with Facebook" pretty well integrated with the OS. It may be possible to plugin custom authentication (or even use Facebook)

In fact this link look good!


How to create your own RBL DNS Blacklist to prevent spam I am getting sick of reporting the same old chinese emails to Spamcop now and would like to make my own small RBL list that I can easily add blocks of IP's to.
I have a spare PC and static IP address ready, just looking for some pointers on the best thing to install on it in order to make an RBL server.

TIA

You can do it with a standard dns server, but I have seen rbldnsd which appears to be made for this purpose - the main feature being that it allows you to blacklist sites very easily by adding them to a mysql database.

Found a quick instruction page here.