Should I be worried by an email which said my account was under attack? So, today I received an email in my Gmail account which landed automatically in the spam folder. This was the email content:

  Hi!

  As you may have noticed, I sent you an email from your account. This
  means that I have full access to your account: At the time of hacking
  your account(d*****@gmail.com) had this password: ******* (not revealed by me intentionally here)

  You can say: this is my, but old password! Or: I can change my
  password at any time!

  Of course! You will be right, but the fact is that when you change the
  password, my malicious code every time saved a new one!

  I've been watching you for a few months now. But the fact is that you
  were infected with malware through an adult site that you visited.

  If you are not familiar with this, I will explain. Trojan Virus gives
  me full access and control over a computer or other device. This means
  that I can see everything on your screen, turn on the camera and
  microphone, but you do not know about it.

  I also have access to all your contacts and all your correspondence
  from e-mail and messengers.

  Why your antivirus did not detect my malware? Answer: My malware uses
  the driver, I update its signatures every 4 hours so that your
  antivirus is silent.

  I made a video showing how you satisfy yourself in the left half of
  the screen, and in the right half you see the video that you watched.
  With one click of the mouse, I can send this video to all your emails
  and contacts on social networks. I can also post access to all your
  e-mail correspondence and messengers that you use.

  If you want to prevent this, transfer the amount of $770 to my bitcoin
  address (if you do not know how to do this, write to Google: "Buy
  Bitcoin").

  My bitcoin address (BTC Wallet) is: 1GB22WpNfFPcAYnad1Sd3qWoVJeDbtN72M

  After receiving the payment, I will delete the video and you will
  never hear me again. I give you 48 hours to pay. I have a notice
  reading this letter, and the timer will work when you see this letter.

  Filing a complaint somewhere does not make sense because this email
  cannot be tracked like my bitcoin address. I do not make any mistakes.

  If I find that you have shared this message with someone else, the
  video will be immediately distributed. Bye!

Now, here are the few things I observed:

under from, my email address was written.
under to, that password (which is mentioned in the email) and my email address mentioned inside angular quotes.

Although that password which was mentioned in the email was my password around 4-5 years ago and I'm also not sure that whether it belongs to my Gmail account or some other account.

Now, my question is what should I do to tackle this situation? Should I simply ignore this email or report to Google or do something else? Please advise as I'm a bit worried on seeing this email.

Edit: I have changed my current account password as a security measure.

No, this is nothing to worry about. They send out these types of emails to hundreds of people at a time, hoping that someone will take the bait and send them bitcoin. They don't actually have any information about you. If it's your current password, then reset it on sites that it's been used on. If it's just an old password, make sure it's not used anywhere else.

Reporting to Google wouldn't be a bad idea as they will start to flag emails like this one as spam to future recipients. Spoofing your from address isn't too hard unfortunately and some email providers don't add protections.

All in all, just make sure that password isn't used anywhere anymore and move on.


Using encrypted data in session key instead of random I am writing a service-oriented (REST) application that is (nearly) totally stateless: it can authenticate by API keys, but for web UI it uses the session where it stores nothing but an authenticated user's ID (int). Session ID is generated randomly as it's usual to see, user ID's are never exposed to the users as users are always referenced by their username

Here's the idea I got. What if instead of assigning random session ID I would generate it in the following fashion:

N1 random bytes not including flag byte + flag byte + user ID + flag byte + N2 random bytes;

or in other words, N random bytes containing a scannable ID somewhere within, all encrypted with server's secret key. It's also possible to use client's IP as a part of the string or as IV, to mitigate session hijacking.

The benefit of this approach is that the need of session is completely eliminated, and for scalability matters it's only required that all nodes use the same secret key (session replication is not required either). With regard to performance I'm not sure whether in-memory decryption (let's say, 128-bit AES) would be faster or slower than reading session data from disk and pruning it time to time. The only attack vector I can think of is attacker creating two accounts in a row (so that ID's are sequential) and bruteforcing their two session ID's to obtain the secret key (which, I believe, would not be feasible if it is effectively long).

What I want to ask is:

What do you think about security of such approach? (I'm concerned since the only recommendations I have seen so far is "use strong random for session ID's", and never read about such encrypted session ID approach — but that might be just people really loving to use session to store data there);
What are the possible ways of cryptoanalysis beyond the described one?
What are the downsides, beyond possibly long session ID?
Is it a known approach (then where is it documented?)

Encryption is the wrong tool, because you need to prevent users from changing the session data, not from reading it. The user ID is not a secret, but it would be a disaster if people could just change it to anything they want.

In other words, you must enforce the integrity and authenticity of the session data. Encryption generally cannot do this. What you want is an HMAC, and frameworks like Ruby on Rails indeed take this approach.

However, an HMAC is much harder to get right than a simple random ID, and client-side sessions have a couple of inherent problems. For example, if your session key is leaked, anybody can forge any session. You also can't just terminate a session. And last but not least, client-side sessions are vulnerable to replay attacks, that is, the user can revert the changes you make to the session data simply by using the old cookie.


How secure are IMEI numbers? I recently had my phone stolen (Galaxy S8) and have done the following:

Wiped it remotely
Reported the theft to network operator, who have allegedly blocked the IMEI

I have tried searching for details on what actually holds this IMEI number, to see whether thieves are changing it, and have found conflicting bits of information:

IMEI number and firmware version are directly encoded in the baseband chip (the only chip due to which you are able to get network). If you even dare to replace the baseband chip, there would be no network, no IMEI number, the firmware number will be visible, and the battery will start to drain faster. (Battery backup would drop to 20–30%.)

and

this jolly video of someone using an aptly named "Best Smart Tools" software to literally type in the new IMEI after clicking on a few buttons.

I am sure this depends on the manufacturer, but what is the state of affairs with the two giants - Samsung and Apple? Is IMEI actually hard-coded into a chip of some sort, or is it changeable without replacing a single bit of hardware?

IMEI are hackable/changeable. There is a company called PhoneSec that does IMEI hacking research on smartphones.
Above all, I suggest that you request the device to be blocked at all the operators of your country. If the operators have an agreement with GSMA,
those blocked IMEI will be shared with the GSMA DB, and the phone won't work in operators that have agreement with GSMA and have access to the GSMA DB.


Can anyone be hacked? I have often heard that if you are the target of a directed hacking campaign by say, a team of government hackers (whether Chinese, NSA, etc.), there is no way to prevent being hacked if they highly value the information they wish to retrieve.

If they're willing to throw their, for these purposes essentially unlimited (is that right?), resources into hacking your server specifically, then you're done. There is nothing you can do to stop them. Even country vs. country it is difficult, since the cost to defend against possible attacks is higher than the cost of developing successful attacks.

So, two questions:

Is it correct that targeted attacks from highly trained and well-funded hacking groups are practically impossible to defend against?
Is there a rule of thumb for what the cost to attack vs. cost to defend against an attack is? Is the cost to defend typically higher?

Is it correct that targeted attacks from highly trained and
  well-funded hacking groups are practically impossible to defend
  against?

For the average person, or even corporation, in my opinion the answer to that question is a resounding YES.

Have you ever seen the types of technology organizations like the NSA have at their disposal? Check out https://nsa.gov1.info/dni/nsa-ant-catalog/

Boom. Mind blown.

  Is there a rule of thumb for what the cost to attack vs. cost to
  defend against an attack is?

Not really.

  Is the cost to defend typically higher?

Defending can cover a very broad base of technologies and a very wide network footprint. It can be easy to fall into the "Jack of All Trades, Master of None" scenario.

An attacker can pinpoint and target specifically what they choose.

Defenders have to be right 100% of the time, attackers only have to be right once.

For these reasons I believe we can all agree that the cost to defend is typically higher.


How to secure CC details and CCV for a small hotel? I got a weird case here, where there is a small hotel using booking.com to receive reservations.

All of the reservations are coming in, through booking.com, but most of them are not book now - pay now. They are sort of book now, pay later.

Booking.com shows that persons credit card information on plain sight for the owner, but the CCV information is only shown once with a press of a button, then it disappears. CCV is also available on booking.com for something like 72 hours after the reservation, it then gets deleted.

The issue with the owner is, that he needs to store the credit card details and the CCV somewhere, to have some sort of security against no-show.

So atm, the owner is taking a note of the CCV and stores it in a paper form.

I was asked to help around with making this process less painful, but really stuck since I got no idea about credit cards and PCI compliance on this specific case.

Any ideas on how I can make my clients life easier? How can we safely store credit card details including CCV until the client has stayed in the hotel and then delete them? Is it even legal? What should I do in this case?

Also this hotel used to do everything in usb sticks etc, I am trying to move them to a dropbox solution, but as soon as I heard about credit card information being stored I had a 2nd thought and said no. Please enlighten me.

How can we safely store credit card details including CCV until the client has stayed in the hotel and then delete them? Is it even legal?

It is not. You cannot purposefully store this information, allowed storage is the few seconds needed for the hotel to forward it to the bank to check its validity.
If he stores the CVV in any way which would let him send it without the cardholder entering it, then that is a violation. Him writing it down as 'insurance' is a violation.

CVV numbers are not needed to process the transaction, they are just another layer of protection against fraud. The hotel owner may only use it to verify the owner of the card. If the hotel owner uses the CVV number in the charge it denies the card owner the ability to successfully charge back an unauthorized transaction since the Credit Card company will deny the chargeback.

What would make his life easier is getting a downpayment that people forefeit if they don't show up.


If P=NP, what is still cryptographically secure? I know, I know - "If P=NP" is a really large, high-impact assumption.

But this is a hypothetical.

I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or would they?  Being solvable in polynomic as opposed to exponential time would be a significant blow to their operation, but could they make use of public/private keys so large (if P=NP, then more efficient prime-number-locators seem likely) that cracking them is still something "difficult?"

Those are mostly just points of discussion.  In terms of raw question: What methods of cryptography don't ultimately rely on P!=NP?

Any classical cryptography scheme is algorithmic in nature i.e. any classical cryptography scheme can be broken (in principle). The upcoming field of quantum information I think can one day be able to make communication secure. If you want to read more about quantum key distribution protocols try searching: BB84 protocol, B92 protocol and eckert protocol.


Apache webserver behind firewall is a victim of proxy abuse and cannot use fail2ban to solve it We have a new client with a webserver that's getting too much proxy abuse.
The access_log is filled with these kind of lines:

64.187.XXX.XXX - - [12/May/2015:10:32:10 -0300] "GET https://ads.exoclick.com:443/ads.js HTTP/1.0" 404 204 "http://www.salefutures.com/?p=1349" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0"

I obviously thought first about fail2ban to ban via IPtables every offending IP, and yep, it worked, but we're receiving so much requests that fail2ban started to eat RAM like crazy.

Besides that fail2ban works OK banning IP's but the problem is that this webserver is a very resource-limited VM and behind it there's a D-Link firewall DFL-2560G.

The thing is that these type of requests are generating in Layer 7 (as HTTP goes in application layer) and it's proving to be very difficult to filter these kind of requests before they reach the webserver. Additionally, this server's app-filtering module need a licence which is not bought by the client, so it leaves me with very few options, and I really don't know where to start.

Can anyone give me some ideas?

Evaluate mod_security - see https://www.modsecurity.org/about.html.

I don't know off the top of my head if there are rules to help with OP's problem - if there are, of course, use them.  If not rules are easily written.  Disable rules that are not applicable to reduce the negative performance impact the module will cause.

An additional benefit would be that of the overall Web Application Firewall framework.  You may find you need additional protections which Fail2Ban may not help fulfill.


Two takes on PHP two way encryption - which one is preferable? I need to encrypt some data and have it decrypted on a later point in time. The data is tied to specific users. I've gathered two possible solutions...

1: The first one is derived from the official docs (example #1 @ http://php.net/manual/en/function.mcrypt-encrypt.php):

function encrypt($toEncrypt)
{
    global $key;
    $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC);
    $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);
    return base64_encode($iv . mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $toEncrypt, MCRYPT_MODE_CBC, $iv));
}

function decrypt($toDecrypt)
{
    global $key;
    $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC);
    $toDecrypt = base64_decode($toDecrypt);
    return rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, substr($toDecrypt, $iv_size), MCRYPT_MODE_CBC, substr($toDecrypt, 0, $iv_size)));
}

The key is generated once using:

pack('H*', bin2hex(openssl_random_pseudo_bytes(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC))));

1.1: I've noticed that the encrypted result always ends in two equal signs ('=='). Why? - Using bin2hex() and hex2bin() in encrypt() and decrypt() instead of base64_encode()/base64_decode() respectively does not yield these results.

1.2: Will using bin2hex()/hex2bin() have any consequence on the outcome (other than length)?

1.3: There seems to be some discussion whether or not to call a trim-function on the return result when decrypting (this applies to the solution below as well). Why would this be necessary?

2: Second solution comes from here, Stackoverflow (https://stackoverflow.com/questions/9262109/php-simplest-two-way-encryption):

function encrypt($key, $toEncrypt)
{
    return base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), $toEncrypt, MCRYPT_MODE_CBC, md5(md5($key))));
}

function decrypt($key, $toDecrypt)
{
    return rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($key), base64_decode($toDecrypt), MCRYPT_MODE_CBC, md5(md5($key))), "\0");
}

I'm aware that both approaches to the key handling is interchangeable, I purposely made them different in that respect in order to highlight possible solutions, please feel free to mix and match.

Personally I feel that the first one offers tighter security since both key and initialization vector is properly randomized. The second solution however, does offer some form of non-predictability since the key is unique for each piece of encrypted data (even though it suffers under the weak randomization of md5()).
The key could for example be the user's name.

3: So, which one is preferable? I'm slightly in the dark since the Stackoverflow answer got a whopping 105 votes. Other thoughts, tips?

4: Bonus question!: I'm not incredibly brainy on server security aspects, but obviously gaining access to the PHP files would expose the key, which as a direct result, would render the encryption useless, assuming the attacker also has access to the DB. Is there any way to obscure the key?

Thank you for reading and have a nice day!

The two encryptions are equivalent. You can add a wrapper to use one approach as a drop-in replacement of the other:

/**
* Uses the one-parameter method as if it was the 2-parameter one.
*/
function buhlencrypt($keya, $data) {
   global $key;
   $key = $keya;
   return encrypt($data);
}

/**
* Uses the two-parameter method as if it was the one-parameter.
*/
function weidencrypt($data) {
   global $key;
   return encrypt($key, $data);
}

The "predictability" of MD5 adds a negligible level if 'insecurity' - 99.99999% of users will have their data hacked because they chose a trivial password or wrote it down in their address book or left it on a yellow sticky note under the keyboard. A professional attack will hack the server and gather all the passwords rather than bruteforcing a MD5 (see below, in answer to question 4).

  1.1: I've noticed that the encrypted result always ends in two equal signs ('=='). Why? - Using bin2hex() and hex2bin() in encrypt() and decrypt() instead of base64_encode()/base64_decode() respectively does not yield these results.

Base64 encoding works by replacing groups of three binary bytes (3 x 8 = 24 bits) with four ASCII-6 characters (4 x 6 = 24 bits). This means that the input text must have a length multiple of three and the output will always have a length multiple of four.

To ensure this, Base64 adds a special padding to its output to signify whether there are one or two "ignoreable" characters. And since Rijndael produces an output that is multiple of 16, the last 16-block is always padded to length 18.

  1.2: Will using bin2hex()/hex2bin() have any consequence on the outcome (other than length)?

None whatsoever.

  1.3: There seems to be some discussion whether or not to call a trim-function on the return result when decrypting

That is because Rijndael also uses a fixed size block, so if you were to encrypt 17 bytes, it would be divided in two 16-byte blocks, giving 32 bytes of which the last 15 are padding. Since Rijndael makes no provision to indicate pad stripping (e.g. it does not store the length of the cleartext), the output will have a zeroed padding that may need removal. In some contexts this may not be necessary since a zero-padding might be ignored no matter what.

  4: Bonus question!: I'm not incredibly brainy on server security aspects, but obviously gaining access to the PHP files would expose the key, which as a direct result, would render the encryption useless, assuming the attacker also has access to the DB. Is there any way to obscure the key?

If you do that symmetrically, then access to the PHP files will also allow removing the obscuration. Verify what level of access might one have once in possession of the PHP files. If his access is near to complete, it makes little sense to obfuscate the key.

However, you can do this, albeit in a roundabout way.

Add to your User model three properties (i.e. two column tables) called UserKey, RootKey and RootKeyOK. Each user gets a triplet.

When an user registers, you generate a random IV, and encrypt it using the user's password, storing it in UserKey. You also store it in the clear in RootKey, and set RootKeyOK to FALSE.

When the user changes the password, you use the old password to decrypt the UserKey and reencrypt it with the new password. You needn't touch the RootKeys at all.

Whenever the admin logs in, it browses the user database for keys not OK; for each of them it encrypts the RootKey with the Admin's password, and sets RootKeyOK to TRUE. This can be done automatically.

Now in your database you have:

HashedPassword --- unusable to an attacker since it's a hash.
UserKey        --- unusable since it's encrypted
RootKey        --- usable, IF still in the clear, but for this user's data only

When the user is logged in and you need to encrypt something only he (and the admin) can read, use his password (he's logged in, so it's in memory) to decrypt the userKey, and use the userKey to encrypt the data.

Of course, if you need to encrypt something when neither the user nor the admin are logged in, this approach won't work - you will have to store it unencrypted with a flag that tells it needs be encrypted, and do it as soon as either the user or the admin log in. While you can do this transparently to both, in truth the data may remain in the clear for long periods on the server, vulnerable to database capture (from remote break-in to hard disk burglary).


multiple hash values in a single malware file Can a malware file have multiple "Hash values"?

If you run a given hash algorithm across a given file you will always get a given value as a result.

The only way you can get multiple hash values for a given file is by using a different algorithm (SHA-2 instead of MD5 for example)

It is common for malware to attempt to avoid detection by adding arbitrary data to the end of copies, making the hash of each copy unique. But note that in this case each copy of the malware will still only have one hash.


Why one may want to get different certificates for different subdomains? I know there are some tricks to play with wildcards to make a certificate to be valid for all the subdomains ( such as here), but my question is what is the design reason that certificates can be issued for subdomains. Why someone may need to get different certificates for subdomains? Does it have any security reason that people get different certificates for different subdomains of a domain?
I appreciate if someone can give some hints on it.

There a few cases for this:

Compromised hosts, say you have a company, company.xyz, a wildcard and have a few machines on there; blog.company.xyz, www.company.xyz, mail.company.xyz, vpn.company.xyz.  If someone compromises your blog, and gets a hold of the private key of that certificate, all your domains are compromised.  Having individual certificates for each subdomain, would not put everything (ssl vpn, mail server) at risk when one of them is compromised.

Service Providers: some cloud providers give sub domains where one can host an application on a "free domain".  Think of Azure's cloudapp.net, Google's appspot.com and Amazon's amazonaws.com.  The fact that several users use the same cloud provider should not take a way the ability to secure it's connections better.


Cracking encrypted SQB databases I've recovered a .SQB SQL database backup file from a backup server and do not have the password.
As I do not have the password available to me, I'm looking to determine what type of encryption is being used and also if it is possible to use any existing programs to crack the password.

Based on this link I believe the database to be encrypted using AES256 or AES128 but given that i'm not even sure where the file originated from, I'm not sure this is the case.

I've examined the top and bottom of the file for any kind of header/footer information but nothing is obvious. The end of the file is all 'FF' hex bytes and the header appears to be entirely random, a chunk of null bytes, then entirely random again.

If there is any way to identify the type of encryption used in this file or any software which supports attacking this type of file any help would be greatly appreciated.

You first need to identify the backup solution used to create the file. Based on the .SQB extension, I suspect it is Red Gate, which based on this looks to be using AES 128 or 256. Searching the non-dark net I did not find any clear documentation for recovering a lost password. Assuming you have a bona fide reason for trying to crack the file, your best bet is to contact Red Gate directly.


Do these mysql and ssh issues mean my rails server was hacked? I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, saying that rails could not authenticate a connection to mysql using username:password. (Sorry this is a little vague; I did not save the error message before reloading the page later.)

At this point I tried to SSH in, but was confronted with an error about how my host key had changed, and this might be a man-in-the-middle attack. I did not attempt to log in by clearing that host's entry in the known hosts file.

I hesitated for a few minutes, but then got another pingdom alert saying my server was up. I was able to load it in the browser.

When I tried to SSH in again, I succeeded without any warning.

Total downtime was about 20 minutes. I checked the logs for rails, apache, mysql, and syslog. Aside from a 20 minute gap in the apache and rails logs, there was nothing interesting. (Several network access attempts blocked by iptables, but no more than usual.) No access to the root directory since 2009 (I use another user with sudo access).

I'm confused about how the first ssh attempt would fail with the wrong host key, but the second one would succeed. Does that make sense?

Does that sound like a successful/attempted attack? I don't know what either of those signs would point to.

I'd appreciate it if anybody could tell me what else I might want to check.

It doesn't sound like you were hacked to me, it sounds more likely that Slicehost had some sort of issue temporarily. The SSH message you got means that the key that was sent by the server was different from the one in your cache. Here are possible reasons that come to mind:
- Another server may have been temporarily assigned the IP address, and then the problem was fixed.
- The ssh service started up before all file systems were available and it responded improperly. Once the server was completely up sshd responded properly
- Slicehost proxy incoming ssh connections somehow, and while the server was unavailable it responded with a default of some kind

I would not associate the symptoms with getting hacked, it sounds much more like a network/server infrastructure problem, so I would start with contacting Slicehost and asking them to correlate your problem with any events. A good company should own up to any issues they may have had at the time. If there were no events then you need to do a thorough check of your system as it is still possible you got hacked.


PostgreSQL injection with basic sanitization I'm trying to figure out if an SQLi for the following PostgreSQL/Java code exists.
public void availableItems(String name) {
  return this.query("SELECT * FROM items WHERE name='"+name+"'");
}

Assuming that in the name is removing apostrophe and semicolon.
Is it possible to make a SQLi work with this restrictions? my gut feeling tell me that I could but I'm a bit lost.

Depending on the PostgreSQL version and configuration, it might have the "standard_conforming_strings" setting off. If it does - this is the legacy behavior - then you can also escape apostrophes using the \ (backslash) character.
IN THE SPECIFIC INSTANCE of the code you presented, this is only a mild problem; an attacker could put a backslash at the end of the "name" parameter, causing the terminating apostrophe to be escaped and thus the DB engine to see the query as containing an unclosed string (which it would reject, probably without any other harm occurring unless that query was important for some security purpose like logging or error detection).
It becomes a huge problem, though, if there are two attacker-controlled insertion points in the same query. Then, the attacker could prevent the first string from ending until reaching the apostrophe that is supposed to start the second string, and the second string would be interpreted as commands instead of data. The attacker could put whatever they want in there, including subqueries or similar to pull arbitrary data from other tables; the only limitation would be the inability to start a string or entirely new query.
Also, you say the apostrophes (and semicolons, even though those are safe within a string) are removed, not escaped, but of course that can cause its own problems - sometimes names of people or things contain apostrophes! - and if the app instead escapes them then that may also be vulnerable. The standard way to escape an apostrophe is with another apostrophe, so "O'Toole's Doodads" becomes "O''Toole''s Doodads", but if the DB allows backslashes for escaping but the application doesn't escape them itself, then you if you supply "bob' OR 1=1 --" will be converted to "bob'' OR 1=1 --" which would produce the following SQL: SELECT * FROM items WHERE name='bob\'' OR 1=1 --', which the DB would interpret as "select all fields from table [items] that have a name of bob' or that satisfy a condition which always evaluates to true, and ignore the last character because it's a comment".
https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS


Can a user login credentials and/or secret questions be considered PII under EU regulations? European Union is one of the most regulated places on how to deal with Personally Identifiable Information.

I was going to answer this question by saying that he had to hash the user password because of EU regulations, but I am not so sure.

So, of the login information/metadata below, what falls under EU PII regulations?

Username (email)
Password
Secret questions and answers
Phone number (for two-factor authentication)
IP addresses the user has logged in from

A password is not considered PII because it's not something that can be used to identify a person. By contrast, all the others you're listing can be used to do that.

Also, notice there are different levels of PII. An email and phone number have a 1:1 relation with an identity, while a pair secret question-answer and a IP address might not be directly linked to a user's identity. These latter are considered so-called "linkable-PII", meaning that can be used to assist in the identification of an identity but can't be used to establish a 1:1 relationship.

In fact, the PII in EU is more complicated than just list what is considered PII and what is not. Although the EU has its "region-wide" regulations, there are also country-specific restrictions. For example, as far as I know, in Germany an IP address is considered as critical as a social security number.


Anomaly based web application Firewall How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation of them.

Check ModSecurity - it's quite decent approach, it does include anomaly as well collective scoring system. You can have a look at Core Rules, there are anomaly entries too. You just load Core Rules to ModSecurity, and there you go, all you need is to test applications and eventually delete, add, modify some rules.

Anomaly entries protect mainly from automated bots or other suspicious clients doing very unsual requests. Without rules made for specific applications (there are rules for popular cmses), what it does prevent is eg requesting web content with non-standard set of headers.

When there are rules for specific applications, it prevents some requests which are not typical for specific application, however how this specifically works and to what level you would need to have a look at Core Rules.

These rules are not some super-specific, but they have more practical approach the way that with no big philosophy they just score anomalies based on rules, and it requires a lot of tuning and changing to get this to work with any specific app, so basically it does what is in the rules, plus what you can do yourself.

They don't protect from bad words, but that's easy to add, they also don't protect from well obfuscated and designed attacks.

Here is a list of protections from Core Rules, which are part of ModSecurity:

HTTP Protection - detecting violations of the HTTP protocol and a locally defined usage policy.
Real-time Blacklist Lookups - utilizes 3rd Party IP Reputation
Web-based Malware Detection - identifies malicious web content by check against the Google Safe Browsing API.
HTTP Denial of Service Protections - defense against HTTP Flooding and Slow HTTP DoS Attacks.
Common Web Attacks Protection - detecting common web application security attack.
Automation Detection - Detecting bots, crawlers, scanners and other surface malicious activity.
Integration with AV Scanning for File Uploads - detects malicious files uploaded through the web application.
Tracking Sensitive Data - Tracks Credit Card usage and blocks leakages.
Trojan Protection - Detecting access to Trojans horses.
Identification of Application Defects - alerts on application misconfigurations.
Error Detection and Hiding - Disguising error messages sent by the server.

ModSecurity is used in vast space of Internet - for example, Akamai, the biggest CDN has this installed on many servers, since they integrated it / or somewhat forked it to their own software. This is because it is cloud friendly - anomaly detection which is collective based - the information comes from several servers, hence it detects anomalies which are geographically distributed between your own servers.


Does recent Intel hardware mitigate Meltdown at the hardware level? Recently a security researcher made the following claim via Twitter (emphasis added):

  If you're running Windows, I'm about to publish a tool that checks if you have the "Variant 3: rogue data cache load (CVE-2017-5754)" aka #Meltdown patches applied, and if you have newer Intel hardware that seems to mitigate at the hardware level. This uses a new undocumented API https://t.co/6sA8tehceg

They also expanded on this a bit to say:

  There’s a new CPUID bit and MSR on models 0x36 and later, looks like.

I'm not sure if/how I can verify this researchers possible discovery, so I don't know if this is true.

Does recent Intel hardware mitigate Meltdown at the hardware level? If so, how and how well, and on what hardware?

Recent Intel CPUs have PCID.  PCID helps a lot with the performance hit because without it, you have to completely separate the kernel TLB from the userspace TLB. (* Ok, not completely, but mostly).  If you have PCID, then the hardware has an extra feature to avoid the performance penalty from the cache misses that would normally happen when you do that.

To answer your main question, PCID does help with the performance issues of the workaround for Meltdown, but it doesn't fix Meltdown itself.  You still need to make sure you have a kernel with KPTI on Linux, or the similar kernel fixes in other operating systems.

References:
https://en.wikipedia.org/wiki/Translation_lookaside_buffer#PCID
https://groups.google.com/forum/#!topic/mechanical-sympathy/L9mHTbeQLNU
https://en.wikipedia.org/wiki/Kernel_page-table_isolation


Can Heartbleed expose a TOR user's IP address? It is interesting to observe, that TOR exit nodes with out-of-date OpenSSL implementations can themselves be affected by the Heartbleed bug.

Can Heartbleed expose a TOR user's IP address merely by exploiting the vulnerable TOR exit node, or would all relay servers in the chain have to be vulnerable as well (and simultaneously exploited), and the entire chain of requests 'decoded' piece by piece to unmask the original user's IP address?

In other words, how robust is TOR anonymity from the Heartbleed bug? (In terms of IP address)

The exit node does not know your IP address -- that's the whole point of onion routing.  Rather, it knows which relay node to contact in order for the data to eventually get back to you.  In order for your IP address to be revealed with certainty, the entire chain needs to be vulnerable; if the entry and exit nodes are both vulnerable, an attacker can make a reasonable guess as to your IP by correlating the use of relay nodes.


Finding new software, checking their security history? I work for a company and we are looking to sign up for a new database/check-in software. As such we have gone through many different software, ranging from basic to very intricate web technologies.

My question is: is there a way to check the company's or the software's history to see if they have been hacked or their data has been breached in the past?

Aside from simply asking them, I have found that it is easy for them to dismiss the issue as we have been solely speaking with the sales/project managers and have had a hard time getting in contact with anyone that's not blowing bubbles.

Check if they have a "security" page describing how they want vulnerabilities to be reported to them. If they are open to responsible disclosure there's a good chance they do security the right way, and it would give you some confidence that should a vulnerability be disclosed they'll quickly fix it.

Also take a look to see if they have any open source code published, if so you could have a read through it and possibly see whether the code conforms to good standards or is an bug-prone mess that can have exploits. It isn't guaranteed, but there's a good chance that if their open-source code is awful, so is their proprietary code you would be using.

Finally see what kind of company they are - are they legitimately making great products and earning money from that, or do they sell outdated, non-interoperable and bug-prone crap on purpose so you have to pay them for consulting? I would immediately run away from such a company.

A bit unrelated to security but I'd like to add anyway - a lot of enterprise/accounting/etc software is marketed to appeal to the people in charge of buying it (you) by an overdose of buzz-words instead of the people who will actually use it. Try to get a demo of their software, give it to the people who will actually use it (your accountants, etc) and see what they think about it. I've seen way too many apps that looked great on paper and management was all excited about it, but the user experience was so poor the software wasn't even worth a cent if you actually wanted to be productive with it.


Is it possible to secure an Android Intent from other calls from apps? I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data.  Think of this as a partitioned dropbox service, where each app saves a file, and if the user configures the app to share data between apps (e.g. photos between app1 and app2) then it's permitted.

Are you aware of any API that will allow me to securely validate the calling application so they they are the only ones that can access their store?

I’m thinking about identifying the calling EXE, and checking that hash but that won't work if the app is updated.

Potentially each app is signed by the same key so I can use that as a unique app-identifying constant.

My main concern is someone gaining binary access to app #1, extracting a key or identifier, an using that to spoof access to my Android Service.

Any alternate solutions are welcome

So this is a really tough problem, and I don't believe there are any APIs out there to achieve what you want.

What you can't do: Custom Permissions

While they sound like a good idea custom permissions are defined in the AndroidManifest.xml.  Checkout this SO answer on how to define/use them, but they look something like this:

<permission
    android:name="com.testpackage.mypermission"
    android:label="my_permission"
    android:protectionLevel="dangerous">
</permission>

To use the permission all another application has to do is put the following in their own AndroidManifest.xml:

<uses-permission android:name="com.testpackage.mypermission"/>

Since Android APKs are trivial to reverse engineer to gain the most basic information about an application; this would fall your fear of someone gaining access to the APK.  Anyone with a rooted phone can pull the APK from their phone.

I do admit that there is likely more to using a custom permission than just that XML line.  But it seems if someone is going through the trouble to begin with, then they can figure it out.

Solution?

This is a tough problem, because at some point you'll need to ask the user to verify that they trust an application to be used with your core app.  If the user verifies that they trust the app then I would probably record the application's signature; which can be found at runtime.  If the signature changes from what you have recorded then it's not the application the user trusted.

This is probably the easiest solution.  Verifying the signature itself should be possible as the META-INF/CERT.RSA contains the signature and public key to verify the signature.  I believe this post on SO shows how this can be done.

Again, you're still relying on the user to verify trust of an application through your core application.  I'm not sure if this is acceptable to you or not.


How curl provided source code that the browser did not? I was playing a CTF and got stuck. When seeing the source code through web browser reveals nothing but when we send the request through curl it reveals out HIDDEN directory. How is it even possible? Does that mean we should now double check the source code by using curl too?

Browsers and curl should provide the same code, unless the server inspects the headers (like for the user-agent string) and sends the different code to different clients that connect.

This is not uncommon when trying to create a complex site that does not render well on older browsers. But in a CTF, it's a simple way to show completely different info to different browsers/clients.


What's the advantage in encrypting data for data masking? I'm in the process of selecting a product for data masking sensitive information in our DB so that developers won't see restricted information while testing production data.

I came across some articles and software that were talking about encrypting this data, and my supervisor seemed interested. I tried to get my head around it for a while but I can only see it as a hassle with no benefit whatsoever: data which needs to be secured is already encrypted and masked data will never be decrypted (if unmasked data is required for some reason, then a request to the responsible DBA will be issued, who then will dump data from the relative production database). From what I understand keys are also discarded.

Am I right or does encrypting has actually some benefit relative to data masking?

If your developers need to work with the data it doesn't make sense to encrypt them, because they will need that data to test the functionality.

If you would AES256 encrypt an address field

it would become binary data which you could base64 encode or store as is. That data would be unusable for the developer, because it doesn't reveal the context.

Example: Cool street 16 => abcdabcdab==

Masking data is the best solution

Example:
Cool street 16 => Abcd street 69

Developers can still work with this data, but it doesn't reveal the sensitive details.


Why does OAuth2 demand client credentials in an authorization header? In section 2.3.1 of the the OAuth 2.0 Authorization Framework it states:

  The authorization server MUST support the HTTP Basic authentication
  scheme for authenticating clients that were issued a client password.

It goes on further to say:

  Including the client credentials in the request-body using the two parameters is NOT RECOMMENDED and SHOULD be limited...

Why is it that including the client credentials in the request-body using the two parameters is not recommended?

I can think of any reason. If it is good enough for user credential to be in plain text in the request body, why isn't it good enough for client credentials? The client credentials are still in plain text despite the encoding required by the basic authorization. Am I missing something?

One possible reason is that the request parameters are generally available to the web application, whereas depending on the platform the password used for basic authentication may be removed by the HTTP server from the HTTP sever variables set to prevent it being available to semi-trusted applications.


What type of probing sends GET /" data " to a server? During monitoring of webserver logs I've stumbled upon those standard probings for wordpress exploits etc, like

No route found for "GET /wp-login.php" (uncaught exception)
No route found for "GET /administrator/" (uncaught exception)
No route found for "GET /admin.php"

which I understand. However sometimes I get GET requests like that one:

No route found for "GET /"   data   ""

that irritates me. What kind of probe is this?
This is not a general approach of probing a webserver's response for a 404 page, isn't it?
Actually while writing this post I realized it could be a known exploit of some software.

Has somebody more information on this request?

A GET / may return a default page or a directory listing which can give a lot of extra information to the caller. A default page, in particular, can be used to work out the exact software versions (OS, HTTP server...), which helps in knowing what known vulnerabilities may apply. A directory listing may, in turn, reveal some juicy sub-directories.


Are smartphones at least as safe as "regular" computers for personal data? Like a lot of people, I pretty much run my life on the Web these days. I use online bill pay, I shop at Internet retailers, I keep in touch with friends electronically, &c. I'm pretty comfortable with the standard home computer security setup for that stuff: physical router, antivirus suite, strong passwords, that sort of thing.

Are smartphones at least as secure at storing sensitive data as a home computer with that standard protection level? I'm thinking of stuff like credit card numbers, passwords, financial information and health records. I don't know if something about their architecture or the fact that they're on cell networks makes them less safe.

In particular, I always look for the green HTTPS indicator in my browser when I need to do something secure-ish on my computer, but I have no idea how apps store the data I punch in, or how to tell whether they use secure/encrypted transmission techniques. I end up not doing anything with my phone that involves money or passwords, which means I'm missing out on a lot of the benefits of what is really a cutting-edge piece of technology.

The best resource I've been able to find so far is Android Guy Weekly: Is Cellular More Secure than WiFi?, which points out some differences between cell and wi-fi systems but doesn't give much advice about what to do about them.

If it helps, assume for simplicity's sake that the phones in question connect to the outside world (i.e. the Internet) via cell only, not wi-fi or Bluetooth or anything else.

Edit:
In retrospect, I should have asked two separate questions: "are cell networks as safe as wi-fi," and "are smartphones/tablets as safe as desktops/laptops." I guess it's too late to try to separate the two now. At least it looks like the former question has sorta-kinda been brought up on this site before, though with mixed results.

I will have to vehemently disagree with the comment that "your mobile phone is more secure against malware". This is a dangerous and very wrong statement of the state of mobile phone "security" - and if it is based on anything, it is based on inappropriately interpreting currently skewed statistics.

As a security enthusiast and a developer on mobile phone platforms I can tell you mobile phones are no more, and probably less secure than other systems, period.

The reason mobile phones statistics may be currently low, is more of an "opportunity" issue - in that unlike computers that CAN BE found on networks, the networks that mobile phones reside on are more, well mobile - therefore ambiguous to directly target.

That said, there is a long history that is building of exploits that are being seen and growing through the, current single points of failure in both IOS and Android - the appStores, as well as browser based attacks that are growing.

New points of exploit injection are growing with aggregation and crowd sourcing apps that are the trend on both genres of devices (I work for a company that provides exactly such type of app).

Do not think that your mobile device is secure. It is not.


how much is AES GCM's security affected when not using unique IV's I've read some articles and tutorials about AES GCM and was using this cipher for one of my java-projects, so let's say I know some basics.

I read that you should use an IV-length of 12 bytes which means that there should be more than enough unique IV's availble because you should never use the same IV again in combination with the same key. For creating a random IV I was using the SecureRandom class in java, so not very surprising.

Now please consider the following: I have to encrypt data which is being sent out through an unsafe network and every packet has to be independent. In numbers: I'm sending 120 packets per second, which are 432000 packets per hour, all using the same key. So this number is not that impressive but if we suppose that this serivce is running the whole day then we will see 10.3 Mio. independent packets and therefore 10.3 Mio IV's which should be unique. Since nobody can guarantee that SecureRandom does not deliver duplicates, it could be that my service is using identical IV's which should be unique.

Now my questions:

How likely is a collision using SecureRandom and how could I avoid it? I mean I could keep track of all used IV's but that wouldn't be efficient as time goes on.

Is it true that someone could reconstruct the key if IV's are not being unique? How could this be done, how much effort would be neccesary to achieve this? Are there any numbers which could demonstrate this? e.g. if a "correct" implementation would need a calculation of 2^128, a wrong one would only need 2^30.

I know that some answers are probably difficult or impossible but I'd like to get a feeling about how much security is being impacted if IV's are not unique, how "easily" AES GCM could be broken under the mentioned circumstances.

Thanks a lot!

If we accept that SecureRandom is a true random then the expected collision for IV is given by the birthday paradox is sqrt(2^96) = 2^48. Your daily message is 2^24 and this will have a very low collision probability. You will have 6.783914×10-16 chance of collision probability for the day. However, once the collision occurs we have IV reuse.

IV reuse is very dangerous for GCM. Internally, GCM uses the CTR mode of operation for encryption and if the key and IV are the same then the two-time pad attack are possible as in OTP.

CTR mode, even, reveals the plaintexts due to IV reuse, doesn't leak the key. The two-time pad attack once successful reveals the keystream generated by the CTR mode. Then the attacker has to execute a known plaintext attack on AES which has known as resistance to this attack. The only applicable attack is the brute force ( other than the side-channel attacks).

Also, IV reuse can leak information about the authentication key;

  In messages up to ℓ blocks long, after a single nonce reuse the adversary can narrow the authentication key down to ℓ possibilities with polynomial root-finding and thereby forge messages with high success probability 1/ℓ.

Instead of selecting randomly, you can choose your IV by applying a monotonic counter, that is usual in practice and recommended in  NIST 800-38d, page 20, 8.2.1 Deterministic Construction.


ISO 27001 failure to comply Say a small company just earned an ISO 27001 accreditation. What happens if during one of the audits it is found that the company didn't follow the ISMS? Is there a certain warning process that company has to go through? I basically want to know if there are instances when an ISO 27001 accreditation gets retracted and how?

I could not find anything about this particular ISO 97001 on the ISO website or any other related sites. But I saw you placed a tag ISO 27000 and that you mentioned ISMS, so I suppose you are talking about ISO 27001 which is Information Security Management System.

Normally, with all ISO certification, once you are accredited the certificate, scheduled surveillance audits will have to take place. Should you have major deficiency, the auditor will give you a certain amount of time to take corrective actions. If, after the given time, you have not successfully implemented those corrective actions or adjusted your processes, a certificate revocation will/can be issued.

The main reason you implement the ISO 27001 is to cover business risks. If you see that you have the ISO 27001 but that you actually don't bother using the controls defined in the framework except when there's an audit, then you have a serious security mentality issue within your company. Also note that if there is a serious incident and it is shown that controls defined in the framework were not followed, you are not covered by the framework/certificate anymore.


What can be done with Blind SSRF? I know SSRF can be exploited with the file:// protocol to read local files (something like path traversal) and also scan ports of hosts from the same network as the web server.
but how Blind SSRF can be exploited ?

What one can achieve with blind server-side request forgery depends heavily on the context of the vulnerability. Port scanning (XSPA) and hitting unauthenticated HTTP endpoints (e.g. /shutdown :P) are possibly the most obvious things you can achieve, however, from my personal experience as a bug bounty hunter, people will attempt to chain blind SSRF with other issues in order to escalate the severity and exploitability as seen in http://www.kernelpicnic.net/2017/05/29/Pivoting-from-blind-SSRF-to-RCE-with-Hashicorp-Consul.html.


How to check the authenticity of the root cert of some CA? Verifying and trusting some root certificate of an unusual CA might present a problem. In fact, to download the root cert of this CA from its corresponding website one should verify and trust first the TLS cert presented by that website. Meaning trusting the root cert of the CA signing the website’s TLS cert. It seems like a chicken-and-the-egg problem. How could one solve that ?

You should never ever trust a new root CA unless you really (and I mean really really) believe that it is fully trustable. Even then you should get the CA certificate in a trusted way, i.e. definitely not by downloading it from a site which certificate is issued by the same yet untrusted CA.

The main problem with explicitly added root CA is that any explicitly added CA is automatically trusted to issue a certificate for any domain. This means even if example.com has usually a certificate signed by InnocentCA the browser will also accept without any notice a certificate signed by MaliciousCA, if you have added MaliciousCA as trusted CA. This makes man in the middle attacks or other kinds of domain impersonation by MaliciousCA easy.
Even certificate pinning (built-in or with HPKP) will not help since pinning is disabled in browsers if the certificate is signed by an explicitly added CA, to make legal SSL interception as used in enterprise firewalls and many desktop antivirus possible.


Does the ARM TrustZone technology support sealing a private key under a code hash? One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a private key which can only be read by a a piece of code that hashes to a certain value.

By using this technology, we can essentially emulate a smart card in software: we can create a private key that can never be read; it's only possible to ask the hardware to sign a message using this key.

To me, this seems to be a huge step forward in IT security. Primarily this seems useful for mobile devices, which are used for payments. Bitcoin wallets, for example, seem like an obvious use for this technology.

ARM chips include a feature called TrustZone. Does this technology allow doing the above -- sealing a private key under a code hash?

Yes and no.
Strictly speaking, TrustZone is only a processor feature that provides isolation between tasks via the MMU and the memory bus. You can think of it as a poor man's virtualization: there's just the hypervisor (the TZ secure world) and the regular operating system (the TZ normal world). This architecture allows sensitive data to be manipulated outside the reach of the regular OS, but there's a major hurdle: TrustZone in itself does not provide any way to store data. So you can create a key in the secure world but not store it anywhere.
All high-end ARM processors (such as found on most smartphones and tablets) have TrustZone (it's part of the core processor architecture), but it takes more to make it useful. Some processors include additional features that make TZ useful, in particular a way to store a key. This can take the form of some write-once memory (e.g. fuses, typically a few hundred bits thereof) that is only accessible to TZ secure world code. With a protected runtime environment plus a cryptographic key that is only known to this environment, you can build a TPM-like framework to store and manipulate confidential data including signature keys. The Trusted Computing Group is working on it.
This has been used in several mobile devices, though information (especially reliable information) is scarce. Microsoft's Surface RT tablet is based on an ARM processor and has no discrete TPM chip, but has a Bitlocker implementation that is based on a firmware-based TPM, apparently using TrustZone. Several Android devices by Motorola have security features that use code in TrustZone (of course, using a protected environment is no help if the code that you put there has security holes). You can find proposals for security architectures leveraging TrustZone both in ARM promotional literature and in academic publications.
So with TrustZone and a bit more, you can indeed build a system architecture where a key can be stored in a way that cannot be extracted through purely software means. Hardware means are another matter (unlike smartcards, smartphone processors are not designed to self-destruct when someone scrapes the wrapping of the package).


What should be OpenSSL .cnf file equivalent of certreq .inf for S/MIME? Currently I'm using certreq to prepare CSRs for S/MIME certificates. I want to move away from it and start using OpenSSL for key/CSR generation.

My .inf file looks like this:

[Version]
Signature="$Windows NT$"

[NewRequest]
RequestType=PKCS10
Subject="CN=$name,O=$org,L=$loc,C=$cc,E=$email"
KeyLength=2048
MachineKeySet=FALSE
UseExistingKeySet=FALSE
Exportable=TRUE
ProviderName="Microsoft Enhanced Cryptographic Provider v1.0"
ProviderType=1
KeySpec=1
KeyUsage=0xe0

[Extensions]
2.5.29.17 = "{text}"
_continue_ = "email=$email&"

I'd like to prepare equivalent OpenSSL .cnf file (so it results in CSR as similar as possible), but I'm kind of lost in myriad config options. Can someone more experienced with OpenSSL help?

The CSR will be used to obtain commercial S/MIME certificate.

This is what I figured so far, I'll update if I make any changes to that:

[ usr_cert ]
basicConstraints = CA:FALSE
authorityKeyIdentifier = keyid
subjectKeyIdentifier = hash
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = critical, emailProtection
subjectAltName = email:copy
authorityKeyIdentifier = keyid
subjectKeyIdentifier = hash

[ req ]
default_bits           = 2048
distinguished_name     = req_distinguished_name
prompt                 = no

[ req_distinguished_name ]
C                      = EX
ST                     = STATE
L                      = LOCATION
O                      = ORGANIZATION
CN                     = NAME
emailAddress           = EMAIL


How can we verify an installer's validity by checking its signature? I'm working on some software that can be self-hosted, and it includes a component that can be downloaded and installed on end user machines (Windows only). The download comes from the self-hosted server, not from a central location, and that cannot change. How can we verify that the .msi the program downloads to update itself is valid? I can figure out the coding, but I don't know how to go about this from a security perspective.
Our installers are always signed by a valid code signing certificate from a trusted CA, so I could verify its validity and hardcode the valid certificate's hash into the software, but what happens when we have to renew the code signing cert? People on old versions of the software wouldn't be able to update to a version of the software whose installer was signed by a new cert because the certificate hash wouldn't match.
What is the correct way to verify our installers?
The thing I'm unsure of is verifying that the installer was actually signed by us. The installer is self-hosted and has auto-update capability, so it's possible that an end user could be pointed to an installer that was signed by someone other than us. We therefore need to verify that a) the .msi is signed with a valid signature, and b) it was signed by us and no one else. The second issue is the one I'm trying to solve.

Usually, a code signature is timestamped.  This way, the signature can be verified using the public key from a trusted certificate - even if the certificate is now expired - as long as the certificate was valid when the signature was made.


how safe is a home NAS with ssh access? I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files.
Some extras include:

ssh, ftp, telnet, mail servers
photo gallery (directly from the NAS!)
mysql/php (can even run a website from there)
and much more

On the specs side it looks awesome as a LAN server but it's possible to access those services also from the Internet. And now, I'm wondering how safe that is, considering you're actually putting multiple servers and, not to forget, all your personal files stored in that device, on the Internet.

I've done a bit a research and ssh access could be hardened using 2-step authentication, but not sure about the other services, unless they all have to go through ssh?

I would appreciate your view on this and other possible ways to make your home NAS secure.

A NAS is a computer. It has a "smaller" CPU (usually an ARM in the 200 MHz range) but it still runs a "normal" operating system (often a Linux derivative) with all its normal software and assorted vulnerabilities. When a SSH server has a buffer overflow, it is vulnerable, even if the outer box does not "look like" a computer.

To be considered secure, a NAS, just like any other computer, must be managed, with prompt installation of security fixes. This is where the problem lies: contrary to what happens with full-fledge desktop computers, NAS vendors rarely distribute security patches on a daily basis. There is an inherent latency which means that when a vulnerability is found, attackers have a few weeks (or months !) of head start before the fix is packaged and installed in the majority of deployed devices. This is a rather big issue. It turns 0-day exploits into 0-month exploits.

My advice would be to refrain from putting such a device "on the Internet" unless you replace the OS with another one which you control, and offers low-latency security updates (and, of course, you do check them and install them with all due alacrity). For instance, you can install Debian on QNAP NAS.


Web-based KeePass-like solution security I am considering creating a web-based KeePass-like solution in Symfony 3 (PHP) to have the password safe with few other functionalities added. I want to make sure there are no major security flaws. Here are the assumptions:

Internal company server, internal service
Website works on HTTPS only
User first needs to log in (LDAP, company's password policy is quite strict)
After logging in, user needs to enter encryption password which will be used as the encryption key after being hashed with SHA256 (hash('sha256', $key, true))
The entered encryption password is checked if valid by comparing a single decrypted value with known expected value
Encryption/decryption methods, used for keeping/retrieving passwords from the DB:

public function encrypt($openText) {
    $ivSize = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC);
    $iv = mcrypt_create_iv($ivSize, MCRYPT_RAND);

    $encryptedPayload = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $this->keyHash, $openText, MCRYPT_MODE_CBC, $iv);

    $encryptedBinary = $iv . $encryptedPayload;

    return $encryptedBinary;
}

public function decrypt($encryptedBinary) {
    $ivSize = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC);
    $iv = substr($encryptedBinary, 0, $ivSize);

    $encryptedPayload = substr($encryptedBinary, $ivSize);

    $openText = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $this->keyHash, $encryptedPayload, MCRYPT_MODE_CBC, $iv), "\x00");

    return $openText;
}

Encryption key hash is kept in user session
User session expires after 120 seconds since last activity
Passwords are not kept in website HTML - they are read from the server every time using AJAX over HTTPS, temporarily put in HTML element's attribute to be copied by JS, and then the attribute gets removed
Passwords are copied to clipboard using clipboard.js
Clipboard is cleared (by copying empty string) after 15 seconds

Do you see any security problems here (considering webapp design, compared to KeePass)? What should I be paying special attention to?

Lots of potential problems here.

First, you're using PHP, and it's hard to do things correctly (like avoiding SQL injection, encrypting securely, etc.) in PHP. It's not impossible, by any means, but it's unreasonably difficult.

Second, as a commenter pointed out, you're hashing a password with SHA256 to generate the key.  This is bad.  Use a proper PBKDF, like bcrypt.

Third, you're using the 256-byte block-size version of Rijndael, which is just odd.  Don't, like so many others have before you, confuse this with AES-256.

Fourth, don't encrypt the data directly with the derived key.  Encrypt it with a data encryption key which is securely randomly generated, and  which then in turn is protected with the user's password derived key.  This way the user can change their master encryption password without you then having to synchronously decrypt all of their passwords with the old key, and re-encrypt them with the new key.   You only need to re-encrypt the data-encryption-key with the key-encryption-key.

Fifth, logging, rate-limited, IDS.  You need to have a system in place to dampen attacks, and let you know when their happening.

That's enough for now. I'm sure there are many more pitfalls...This is just a list from my initial glance.   I would strongly encourage you to abandon this project entirely, and look for an existing, reasonably well proven solution like 1Password for Teams, or something along those lines instead.  Building a system like this is fraught with danger, and the code sample you provided indicates to me that you probably do not yet have the knowledge required to accomplish it with any reasonable level of confidence in its security.  And that's not a knock against you...These are simply incredible difficult systems to build securely, and someone attempting to do it for the first time without guidance beyond what the Internet can provide, won't.


See the traffic from my own Android phone My employer (a Dutch university) gave me an Android phone.
I am not allowed to root it.
Still I want to know what traffic goes through it.
Also I want to protect myself when I am in public places.

First thing I did was to install OpenVPN.
Luckily I have a dedicated Linux server running, so I can help others to attain the same.
Now I have a secure VPN connection from everywhere.

But still I want to know what traffic is going on.
So I installed Whireshark on my server.
It sniffs the packets going over my VPN via tshark, part of Whireshark.
It is fully working, I get a file with the traffic going on through the OpenVPN interface.

Now here comes the real question:
What is my phone really communicating, all packets are encrypted.
Is it the OpenVPN encryption, or what?

I got stuck on this, could somebody please enlighten me?

First all packages are going through the TLS encrypted VPN.
Then all apps could communicate over another encrypted connection (for example https). So these packages are encrypted multiple times.

If you want to sniff, the simplest way doing this is install the sniffer directly on your device and install your own root certificate (this is a high security risk). For example your could use this app https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture (But to sniff TLs connections the app have to install a root certificate on your device!)


Are all cipher suites with rc4 in them intrinsically flawed? I've been wondering lately if RC4 is so flawed in all its forms, why is it that it is still being supported by all major browsers per default? Why does the typical chrome browser prefer ECDHE-ECDSA-RC4128-SHA over ECDHE-ECDSA-AES128-SHA?

RC4 has known biases, which have been measured with great accuracy. Exploiting these biases into an actual attack requires observation of many (millions) of successive connections where some specific secret data (say, a given password) always appears at the same place. Such a scenario can be forced in lab conditions but barely applies to practical, real-life situations. This is why it is usually considered "not urgent" to obsolete RC4.

Some SSL clients prefer RC4 over AES because of all the bad press about the BEAST attack (despite the fact that the same clients are not actually vulnerable to BEAST).


How to capture Wifi 802.11 traffic? I want to capture the wifi traffic from my wireless card, so what i have to do and are there tools for that? I know that there is aircrack-ng and airodump, but these tools need a extra wireless adapter and is their a possibility to capture wifi traffic without buying a extra wifi adapter?

Aircrack-ng, Fern, and other sectools for wifi pen testing are a capture and correlate type application. If you do not need automated correlation and are simply interested in traffic capture out your own Ethernet interface you can capture with wireshark, tcpdump, netcat, ettercap, net hogs, scapy, cloudshark, packetyzer and many many more. They all have the ability to capture wifi traffic on the local interface: see this wiki for tuts on how to capture using shark for Windows:

https://wiki.wireshark.org/CaptureSetup/Loopback

This has details of how to setup capture for LAN out of local device interface and for capture self generated  (local host) non Ethernet traffic from local host. (Use this to test if you are capturing). Hope this helps.


How do RSA fingerprints protect from MITM attacks? I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site.

Like when you do a git push, it shows you an RSA key, then you can go to a webpage and see if the key you got matches the key on their webpage.

But what's to stop someone else from finding out the public RSA key that the site is using, and then replying with that same key, in order to pretend to be that site?

Some good information in the other answers as well, but to answer your question directly:

  But what's to stop someone else from finding out the public RSA key that the site is using, and then replying with that same key, in order to pretend to be that site?

An attacker could do this, and they could trick you into encrypting your data using the public key and sending it to them. However, without the corresponding private key, this information would be useless to them because they would be unable to decrypt it.


Can the TrueCrypt hash be slowed down? I have read that TrueCrypt uses ~2k SHA-1 hashes on the password.

  The iteration count is part of the TrueCrypt specification and is 2000 for SHA1, 2000 for RIPEMD-160 and 1000 for Whirlpool (because Whirlpool is more advanced and computationally heavy than the two others).

I recall from prior testing that my computer could do well over ~400k per second. For brute force, that comes out to 5ms per password. (The problem is probably much worse because SHA1 was just a part of the Java program I was working on.)

So for an upcoming installation of TrueCrypt I will be doing, can I lengthen the hash function? If so, I could increase the brute force cost by 50 times while only adding a quarter second to the end user wait.

If you would point me in the right direction, that would be great!

First of all, TrueCrypt is open-source, so you could get the source and do whatever you want, provided you know how to program. But the TrueCrypt containers (or partitions, etc) would be incompatible with a non-modified TrueCrypt program.

Moving on, the "iteration count" can't be adjusted without programing. It's not a parameter that you can set anywhere in TrueCrypt. So you can't change it in an upcoming installation of TrueCrypt. And those documents you mention are outdated, 'cause the TrueCrypt docs says:

  1000 iterations (or 2000 iterations when HMAC-RIPEMD-160 is used as the underlying hash function) of the key derivation function have to be performed to derive a header key, which increases the time necessary to perform an exhaustive search for passwords (i.e., brute force attack) [7].

So, it's 1000 to SHA-512 or Whirlpool, and 2000 to RIPEMD-160. It doesn't use SHA-1 anymore.

One more point is that the iteration count might seem to be  low, but there's a 512-bit salt with the password. (source: truecrypt pages). That's a very big salt, which prevents rainbow tables (since any pre-computed table would have to begin with 512-bits (64-bytes) passwords).

Of course, salts don't prevent brute-force, since it's not a hidden value. That leaves you with just your password and, perhaps, with a key-file.

--- Edit: the reality about brute-force.

Wikipedia has something about the physical limits on a brute-force attack. If you choose a password that has 128 bits of entropy (that is much more than 16 bytes, since printable characters + numbers + symbols don't use the 256 possible bytes values), problably it won't be breakable before the 4th World War.

XKCD joke is also mandatory about this subject.


Deriving and storing an AES key for SQLite DB on iOS I've read up on various Q&A here on how to manage encryption of a local SQLite database on iOS, and from what I've seen, pretty much everyone agrees that it's bad, BAD idea to store the encryption key in code. So, I decided to not do that.

Now, another, more secure option I liked is to send the encryption key from the server over TLS, and use certificate pinning to help prevent people from MITM'ing. Unfortunately, this creates issues for my situation, since the app I'm building needs to be fully functional without an Internet connection.

A third option I have not seen is a more elaborate method of security through obscurity (i.e., more obscure than hiding the password in plain text in the app). Here are a few options I've been entertaining (but all feel somewhat questionable to me):

Use an unknown, but unguessable value (such as the elapsed time for a certain API request to finish, or the coordinates the user taps on a screen) to derive the key.
Have the user of the app enter a distinct passphrase when data is first downloaded, and derive the key from that.

I know that best practices dictate deleting the derived key (I was planning on using PBKDF2) and keeping the salt + number of rounds around. However, I don't want to ask the user for the password phrase more than once (long story short, they will only provide it after they "authenticate" their device, which only needs to happen one time).

As a result, I think I'd need to store the key locally, in plain text (or in the keychain, but what would that really do?) OR store the password phrase (from 1 or 2 above), salt, and rounds. The app would then manipulate the password phrase before feeding it into the key derivation function. This seems far preferable, since storing the derived key totally undoes all security.

So, what I want to know. Is this dumb? Will someone determined be able to reverse engineer this in an afternoon? Or would it be difficult to figure out how the app is manipulating the key before feeding it into the key derivation function?

Put it in the keychain.   This is exactly what it's there for.  What it does, is to encrypt the keys when they're not being used by your app, and to limit access to them to your app alone.

Simply have the application securely generate a new random key on first use, and store in the keychain for re-use on subsequent launches of the application.  This way you're using systems designed for these purposes, every device has a unique, high-entropy key, and you're not limited by the inherent weaknesses of password-bases systems or the pitfalls of roll-your-own-key-storage mechanisms.


Secure JSON on websocket - encryption I have an websocket connection without SSL certificate (just plain WS, not WSS).

Every message is transferred as JSON (text).

What might be best way to secure communication? Which encryption algorithm should I use?

Most important is to secure integrity of messages, but hiding sent content would be also benefit

I was thinking that user might have it's secret like password It cannot be transferred through wire, as it would be visible on network, but instead it might be private key for connection.

The best way to secure communication is to get an SSL certificate.  Anything else means you're just re-implementing SSL, probably in an insecure fashion.

Specifically, anything you do to secure the data will need to be done in JavaScript.  That JavaScript needs to be transmitted over the Internet, so either it's protected by SSL (meaning you've got a certificate you can apply to your websocket connection), or it's not protected and an attacker can tamper with it, rendering any security it applies to the websocket meaningless.


How is the "WannaCry" Malware spreading and how should users defend themselves from it? There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names.

It seems to be a both a standard phishing/ransomware attack but it's also spreading like a worm once it gets into a target network.

How is this malware compromising people's systems and what's the best way for people to protect themselves from this attack?

WannaCry attacks are initiated using an SMBv1 remote code execution vulnerability in Microsoft Windows OS. The EternalBlue exploit has been patched by Microsoft on March 14 and made publicly available through the "Shadowbrokers dump" on April 14th, 2017. However, many companies and public organizations have not yet installed the patch to their systems. The Microsoft patches for legacy versions of Windows were released last week after the attack.

How to prevent WannaCry infection?

Make sure that all hosts have enabled endpoint anti-malware solutions.
Install the official Windows patch (MS17-010) https://technet.microsoft.com/en-us/library/security/ms17-010.aspx, which closes the SMB Server vulnerability used in this ransomware attack.
Scan all systems. After detecting the malware attack as MEM:Trojan.Win64.EquationDrug.gen, reboot the system. Make sure MS17-010  patches are installed.
Backup all important data to an external hard drive or cloud storage service.

More information here: https://malwareless.com/wannacry-ransomware-massively-attacks-computer-systems-world/


Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA I would like to ask if it is possible to use different CA for the client certificate and the web certificate?

For example, I would use Verisign to sign my web certificate while I use my Self Sign certificate for the client certificate. I am just concerned that I need to pay a CA for each new client certificate that I would want to register.

How do you set that up in Apache server? Is this possible?
Do I need to set the SSLCACertificateFile?

The server certificate is sent by the server, to be validated by the client. The client certificate is sent by the client, to be validated by the server. They live in different worlds and have no need whatsoever to relate to the same certificate authority.

For client certificate validation with Apache, see this documentation. The server will need to validate the client certificate with regards to some trusted CA; you use SSLCACertificateFile or SSLCACertificatePath to configure these CA. It is possible to put a specific client certificate there directly, too (that's called "direct trust"). You will probably want to add a SSLRequire clause: validating a certificate is well and jolly, but often you want to grant access to a specific client, as in "human user", not just to anybody who could obtain a certificate from a given CA. The certificate, once validated, gives you some strong guarantee that the client's identity is really the one specified in the certificate, but it is still up to you to device whether a specific identity is to be accepted or not; and SSLRequire is the main tool for configure that.


How realistic it is to be a target of BGP hijacking? The other day one of my VPS instances got inaccessible, for no apparent reason. Neither could I connect to it via ssh, nor it responded to ping. After several exchanges with the support of the VPS hosting provider (specifically, Vultr), they eventually told me: somebody hijacked an IP range (xxx.xxx.xxx.0/24) that included the IP address of said instance.

The instance got accessible again after three hour downtime, so the damage was not huge, but it left me confused since I never expected to be targeted with BGP hijacking, assuming what they told me was true.

So the question is: BGP hijacking is a real threat even to ordinary users and I have to believe what the VPS provider claimed, that the inaccessibility was not their fault, or the provider is to blame for the downtime and they are just making up an excuse?

BGP hijacks happen all the time. Both by accident (mostly by typos in router configurations by network engineers), but sometimes on purpose to reroute traffic via a specific network to do man-in-the-middle attacks.

It's hard to quantify 'how often'. I'd say it's not that common, but of course it could just be a case of bad luck with a typo.

However, one important thing is you can verify this. For example, RIPE NCC collects historical routing data and offers you a tool called BGPlay to watch back what happened to a specific IP range in time. You could use that to verify if the IP range of your VPS instance is seen with another AS number as source during the downtime you experienced. If RIPE Stat hasn't detected it, there's a fair chance they're making this up.


Restrict privileged users from accessing certain directories on Linux servers with Grsecurity? My question is similar to these:

Protect sensitive data from sysadmin prying eyes
Restrict access to a specific directory on Linux

From those, I understand that SELinux could accomplish my goal. But we do not have the resources to use SELinux, so I want to know if there is another way -- specifically Grsecurity (or AppArmor).

Background: In our small organization, we have a few developers and a junior sysadmin who all have full root access and physical access to the servers. They need to be able to do server maintenance and a variety of other tasks which require fairly unrestricted sudo rights.

However, these privileged users do not have the password to unlock the encrypted filesystem after rebooting. (When the server is running, they currently have full access to all files, of course. Hence my question.)

As in the referenced questions above, my requirement is that these root users not have access to data which is located under certain directories. Can this be accomplished with Grsecurity alone?

Linux Kernel Security (SELinux vs AppArmor vs Grsecurity) - nixCraft indicates that Grsecurity is a MAC (mandatory access control) but then specifies that:

  it is a RBAC implementation using access control lists.

I'm not familiar with what that means. (We do use ACL'S.) I understand that a MAC will allow me to implement a policy limiting access to the directories in question even for users with full sudo rights. So will Grsecurity do this?

I believe the fully encrypted file system will prevent a user from rebooting with a live USB key (or similar) to bypass the running OS and access those locations.

Can we accomplish this goal with only Grsecurity (and ACL's)? That would be ideal. If not, can we accomplish the goal with AppArmor?

From those, I understand that SELinux could accomplish my goal. But we do not have the resources to use SELinux, so I want to know if there is another way -- specifically Grsecurity (or AppArmor).

if you want to pay for software that results in

su to root, or login as root
cd /somewhere_I shouldn't_have_access
permission denied

Then you can.  But you can also cause that to happen for free.  But in either case anyone with root and the knowledge to do so can get around this restriction.  But if this meets your goal then i guess ignorance is bliss...

with linux if you have the root password then you simply have the ability to obtain access to anything under that linux operating system... including any directories under the locally mounted file systems.  And anything else like SELINUX or AppArmor or grsecurity (which are kernel modules) can simply be modified or disabled or uninstalled because it happens under the authority of root in linux.

  we have a few developers and a junior sysadmin who all have full root access and physical access to the servers. They need to be able to do server maintenance and a variety of other tasks which require fairly unrestricted sudo rights

there's yer probrem.  you need to nail all that down specifically.  If a person is not to have access to a folder then they cannot have the root password.  If a person is required to have the root pw for whatever reason then they will have the ability to gain access to anything under the control of the linux operating system if they have the knowledge to do so.  Privileged user also does not mean gets the root password; it means a user has some specific privilege defined in sudoers.

consider this: https://en.wikipedia.org/wiki/Grsecurity

The grsecurity patches have never been submitted for inclusion in the mainline Linux kernel, for the following reasons: Some of the features are never going to be accepted, based on what Linus Torvalds himself thinks about their implementation details and technological foundations per se: https://lkml.org/lkml/2009/1/3/126

  Quite frankly, historically the patches have been a mis-match of

  some sane stuff
  lots of totally insane and very annoying and invasive code.

  an example of the second class is the totally idiotic "emulate NX bit -
  badly - with code segment limits" kind of patches. These kinds of patches
  only add unmaintainable crap that isn't even relevant in the long run, and
  thus any sane maintainer (me) should refuse to take them.

  The apparent inability (and perhaps more importantly - total
  unwillingless) from the PaX team to be able to see what makes sense in a
  long-term general kernel and what does not, and split things up and try to
  push the sensible things up (and know which things are too ugly or too
  specialized to make sense), caused many PaX features to never be merged.

  Much of it did get merged over the years (mostly because some people spent
  the time to separate things out), but no, we're not going to suddenly
  start merging code like that just because the project is in trouble. None
  of the basic issues have been solved.

  Linus


Should one not give path parameters in rest urls to avoid man in the middle attacks? Recently I attended a workshop were the presenter explained securing rest APIs.

One of the things he recommended to avoid man in the middle attacks was to not send IDs in the URLs (i.e. not sending the IDs as path parameters For e.g. Don't do this : GET /orders/{order-id}). This way a malicious hacker will not be able to change the IDs in flight and direct the request to an incorrect resource in the back-end. Better approach would be to put ids in the body and sending the body as the part of the payload of a token. If some one tampers with the token then the signature in the token wont match with the modified content in the payload.

Is this the right approach or the best approach?

... to avoid man in the middle attacks was to not send IDs in the URLs (i.e. not sending the IDs as path parameter ex. Don't do this : GET /orders/{order-id})

A man in the middle can both manipulate the request header (containing the target URL) and the request body too, so the "protection" to move important information into the body will not help.

  ... Better approach would be to use something like tokens and IDs in the body.

I'm not sure what exactly you mean with this. But if for example the order-id given by the server should be save against manipulation by a man in the middle attacker then protecting it with a signature (token) based on the order-id, the current user session and some server side secret would work. It would be irrelevant if this is used in the URL or the request body though.

Anyway, trying to protect against an active man in the middle by somehow protecting fields is  not sufficient since it only protects information provided  and protected by the server but not by the user (i.e. where to ship stuff etc). Protection against man in the middle attacks should be done with encryption by HTTPS instead.

Protecting server-provided information (like order-id) with signatures is instead a way to protect against attacks where some attacker tries to access data from other users. This is not specific for man in the middle attacks though.


XSS in textarea when  are not allowed? I am trying to perform XSS on the injection point marked with XXXX here:

<div>
  <textarea name="billing[something]" id="billing-something" rows="1"
    type="phone" title="something" placeholder="something" cols="80">
XXXX
  </textarea>
</div>

I can reflect any input, except < or >. All characters after those will be removed. Can I perform any kind of XSS?

Example:

If i introduce XXXX>XXXX I will obtain XXXX
XXXX[[>]>/// I will obtain XXXX[[
XXXX[[<]</// I will obtain XXXX[[

In other places in this application I was able to exploit inputs using payloads like
 nsehe"onfocus="alert(1)"autofocus="e2c00 because of <input value=".. fallback.

There are actually a lot of other ways you can use XSS, for example you can convert characters to either their hex or ASCII equivalents, an example is here:

%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%22%48%69%22%29%3b%3c%2f%73%63%72%69%70%74%3e

which is the equivalent of an alert box that says hi

<script>alert("Hi");</script>

EDIT: This blog can be quite useful for bypassing filters: https://alihassanpenetrationtester.blogspot.ie/2013/01/bypassing-xss-filters-advanced-xss.html


My site is asking for authentication username and password Myt site Hoodtrends is requesting for Authentication username and password. Please can someone help me out with this?

That is not a normal wordpress authentication dialogue, but rather a server-level permission request.  There is probably an issue with folder permissions or a mis-configuration with your cPanel.  Your hosting company can probably clean this issue up for you.

Also, is your domain actually https://hoodtrends.com.ng/ and not https://hoodtrends.com or https://hoodtrends.ng?  Often times people will do things like .com.ng to make a credible looking evil twin site to try to steal credentials.  If hoodtrends.com.ng is not your actual domain, then it is possible that your site was compromised and redirected to an evil twin site so that the hacker could then use your admin credentials to steal data from your actual website.


How should I configure a Citrix Netscaler to protect against HTTP, TCP, or UDP flood attacks? I have a Citrix Netscaler and want to configure the appliance appropriately so that it can protect my hosts from a DDOS.  Is this something I can do here, or must I take action on the host itself?

An answer will depend on what you mean by DDoS protection. From your title, you are concentrating on network overload DDoSing:

The further out from your application that you run the protection the better it will do - and the commercial DDoS mitigation services work with your ISP. (Not: they call it mitigation for a reason - if an attacker really wants to DDoS you it is just a case of scaling up the numbers until they succeed)

Running protection at your own border router is next best, so using the Netscaler device in conjunction with alternate routing will also go some way to reducing the load in the event of an attack.

Host protection can also be used, but if you allow a DDoS to get this far, the host will have so many network connections to it, that it may be unable to drop them fast enough.

Have a look at this question on DDoS protection in firewalls and this one regarding application protection.

For NetScaler TCP DDos protection have a look at How to Configuring the Rate Limiting Feature of a NetScaler Appliance to Mitigate a DDoS Attack. There is no mention of UDP capability.


What is the future of exploitations? With the advent of "Safe" languages like Rust, the prevalence of Software Correctness, and improved type checking in existing systems, memory based exploits are very hard if not possible at all, to execute. Technically, Cryptography is in a very advanced stage, and its not feasible for the most to actually break the current standards. Systems like SeL4, are proven to be correct.

Although it is a work in a very positive direction, but then what is the future of the art of Breaking/Hacking of digital computer systems? Is this profession/art coming to an end?

There is whole world of vulnerabilities out there which don't need buffer overflows or bad crypto. Just have a look at  web applications where you have all these web based insecurities like Cross Site Scripting (XSS) or Cross Site Request Forgery (CSRF). Then take a look at code injections like SQL injection or Remote File Inclusion. If this is not enough have a look at the latest Ransomware which makes use the Windows Scripting Host etc. No buffer overflows or bad crypto is needed for all this.

  Is this profession/art coming to an end?

Don't worry. The increasing complexity of current systems combined with security as an afterthought opens enough new attack vectors, even though some older ones might vanish. Just have a look at the whole IoT mess for example.