How mailgun track opened emails? I receive email sent through mailgun.
I open email (no info in mailgun log about opening email)
I allow displaying images ('opened' event in mailgun logs)

But what I do not understand: when I allow images then all requests go to google servers. How mailgun tracks it?

Email tracking is typically accomplished by embedding a transparent, 1x1 image in the body of the email message. The image is hosted externally at a unique URL controlled by Mailgun, so Mailgun can track whether the image has been downloaded.

It doesn't matter whether your browser/email client downloads the image, or whether Google downloads the image and sends it to your browser. In the end, in order to show the image someone has to download it which will trigger the tracking alert.

It is not a foolproof method, since users who disable fetching of remote content and don't opt to show images won't download the image as you've discovered. In the opposite direction, some email providers automatically visit all URLs in an email to scan for malware, so the tracker can trip even if the user has not opened the email.


Is TLS enough to prevent eavesdropping? Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?

TLS can protect against an eavesdropper which has only access to the communication channel between both parties. But it needs to be properly implemented, that is strong ciphers, proper validation of the peer etc.

It will not protect against attacks against the endpoints itself. That is it will not help you if there are bugs in the used TLS stacks (like were in most major stacks in 2014), buffer overflows or bugs in the application logic (like cross-site-scripting). If the attacker manages to compromise the endpoint in some way (s)he will be able to inject itself into the application to get access to the unencrypted data or to the encryption keys.

Thus attacks focus on compromising the implementation or the endpoint itself by subverting the methods and libraries used for encryption (like random generators), compromising the delivery chain to get access to the keys (like with sim cards) or to infect the computer during delivery already. But you don't need such advanced attacks because malware delivery by phishing or malvertising or evil maid attacks are usually enough to compromise a selected endpoint.


Using timeouts to automatically detect blind sql injection exploits I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an issue? In the application DVWA, I attempted the query

' OR 1=1; WAITFOR DELAY '00:00:05';#

in the sql injection box, and it gave me a generic syntax error. I then attempted

'; sleep(5000); #

and that also failed with a similar error. These were the only two sleep methods I found, so how in the world is this attack executed, and would it be a reliable method to say, wait for 20 seconds, and have a timeout of 15?

To know that a SQL exploit worked, you need to be sure that some code you supplied is indeed being executed server side.

One instance of SQL injection could be a query built as

SELECT * FROM users WHERE username='{user}' AND password='{pass}';

By replacing, say, user=squeamish&pass=ossifrage with user=admin&pass=' OR ''=', you make it so that the query executed is

... WHERE username='admin' AND password='' OR ''='';

which has good chances of getting administrator login. This is one query.

If you replace, as you did, with ' OR 1=1; WAITFOR DELAY '00:00:05';#, (actually I believe that # ought to have been --, but maybe both character sequences are valid comment initiators? I forget), you get

... WHERE username='' OR 1=1; WAITFOR DELAY '00:00:05';# other code ignored

and these are two queries. Much more powerful syntax, yes, since you can now execute any query at all as your second one. But several engines do not, or can be configured not to, execute anything beyond the first query. You would then not get any delay, and thus mistakenly conclude that the exploit did not work.

Your second attempt also makes use of the "two query" method.

In order to get a significant delay, you need a function which will take a long time to execute. Depending on the engine, you might do well with:

' OR SLEEP(5)='

This will yield a query of

... WHERE username='admin' AND password='' OR SLEEP(5)='' ...

which, to be evaluated, requires that the engine return the result of a sleep(). The query will most likely fail, but before it does, it will wait five seconds. That's how you can automatically know that a crafted query string would yield better results.

For example in MySQL you get

mysql> select 5=SLEEP(5);
+------------+
| 5=SLEEP(5) |
+------------+
|          0 |
+------------+
1 row in set (5.00 sec) <----


SSL Authenticated SOAP Request works in SoapUI but not through code I am connecting to a SOAP webservice that requires SSL authentication. I (the web service client) have a .pfx file and provided the public certificate for that file to the company whose web service I am accessing. I am able to send a successful SOAP request to their web service through SoapUI (after configuring SoapUI to use the .pfx).

Now I am trying to send the same request through code (VB.NET) but having trouble connecting. The error message I get after invoking the request is: "The request was aborted: Could not create SSL/TLS secure channel."

In code, I have a proxy class for the web service that inherits SoapHttpClientProtocol. The code that sets up the SSL and invokes the request is as follows:

<System.Web.Services.Protocols.SoapDocumentMethodAttribute("UpdateLeadByDMS_v1", Use:=System.Web.Services.Description.SoapBindingUse.Literal, _
        ParameterStyle:=System.Web.Services.Protocols.SoapParameterStyle.Bare), _
        CaptureMessageExtension()>
    Public Function UpdateLeadByDMS_v1(ByVal leadPushRequest As LeadPushRequest) As LeadPushResponse
        Dim store As X509Store = Nothing
        Try
            store = New X509Store(StoreName.My, StoreLocation.LocalMachine)
            store.Open(OpenFlags.OpenExistingOnly Or OpenFlags.ReadOnly)
            Const thumbprint As String = "36C82D8E7BAEEB2E9B88F4748CB60AE6E0A89F64"
            Dim certCollection As X509Certificate2Collection = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, False)
            If certCollection.Count > 0 Then
                Dim cert As X509Certificate2 = certCollection(0)
                Me.ClientCertificates.Add(cert)
            End If
        Finally
            If store IsNot Nothing Then
                store.Close()
            End If
        End Try
        ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls
        Dim results() As Object
        Try
            results = Me.Invoke("UpdateLeadByDMS_v1", New Object() {leadPushRequest})
        Catch ex As Exception
            SendError(New Exception(ex.Message))
            Throw
        End Try

        Return CType(If(results IsNot Nothing, results(0), Nothing), LeadPushResponse)
    End Function

I've tracked both requests in WireShark and seen the following TLS handshake steps:

SoapUI - Works

Code - Fails SSL authentication

Does anybody have an idea of why one would succeed while the other fails? It looks to me like the code is failing during the clients authentication of the server... but I have already tried setting the ServicePointManager.ServerCertificateValidationCallback delegate to return true and that did not change anything.

Thank you for any insight you can provide!

EDIT:
Here is the information from the last TLS packet in the network logs. It is the ServerHello and Certificate handshake parts from the server. There was no errors that I saw.

After that there was only the following communications between the client and server:

I figured it out! The SSL handshake was failing on my (client) side because the client certificate did not have the right permissions for the account that was running the web application. I was able to find this out by looking in 'Windows Event Viewer' under 'Windows Logs --> System'. There I saw an error stating: "A fatal error occurred when attempting to access the SSL client credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10003."

Googling that error state brought me to this forum post (https://social.technet.microsoft.com/Forums/lync/en-US/e70a8dbc-6f48-4fde-a93b-783554344822/a-fatal-error-occurred-when-attempting-to-access-the-ssl-client-credential-private-key?forum=ocscertificates) which said that it was a permissions error. Whatever account was running the application could not access the private key of the certificate. To fix this I simply gave read permission for my client certificate to the correct account through MMC in Windows. This post provides some insight on how to do that: https://stackoverflow.com/questions/2609859/how-to-give-asp-net-access-to-a-private-key-in-a-certificate-in-the-certificate

Hopefully this helps someone in the future! Remember to check your permissions!


Is there a standard for printing a public key as a barcode? Is there a standard for storing a public key printed on paper?
Say, I want to hand out business cards with my public key pre-printed on them
at a key signing party to help build the web of trust.

My understanding is that the standard for storing a public key in a computer file is: store that key as a long string of hex digits in a file in PKCS #12 format.

I suppose I could simply print out out a long string of hex digits on paper
(either the short public key fingerprint used to confirm a public key
from some other source -- see " How should I distribute my public key? " -- or perhaps print the entire full public key).
Then my friends could manually type them in.
But it seems like it might be more convenient and less error-prone if I to print some sort of barcode on my business cards containing the same data,
such as a "Data Matrix code" or an "Aztec Code" or a "QR code".

Is there a standard for printing a public key as a barcode?

Is there a standard for printing a public key fingerprint as a barcode?

One can definitely print a QR code for displaying the public key. The modulus of the RSA Key for example of 1024 bits/128 bytes can be converted to a base64 encoded string and converted to QR code which can be printed on the visiting card.

The challenged which will be faced are:

The base64 encoded data will be around 160 or greater in length; which shall increase the density of the QR code. The size of the bar code will be needed to increased and shall be a challenge to fit it in the visiting card.
The number of mobile devices with QR Code Scanner capable of scanning such high capacity codes will be lesser. Hardware scanner can do but mobile scanners will struggle.

The easier option shall be (if you are using a CA issued certificate) is to encode the certificate serial number and the URL of the CA from where the certificate can be fetched. In this case the data in the QR code will be very less and can be easily scanned by the mobile devices. You can have a computer software which can decode the bar code; hit the URL and install the certificate in the system.


If SSL encrypts urls, then how are https messages routed? I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants to go to IP xxx.xx.xxx.xxxx and then the packets are routed to that IP address across the Internet. But if the URL in an HTTPS message is encrypted then how can the packets be routed?  If a DNS gets a request for an encrypted URL, how do they know where to send the packets?

The DNS server does not look at the URL; the DNS server does not know what a URL could be.

The client browser extracts the intended server name from the URL. In a URL like https://www.example.com/foobar.html, the server name is the part after the https:// but before the next /; i.e., www.example.com in this example. The server name is what is sent to the DNS.

The DNS responds with the IP address for that server. The client then talks with that server, they do their SSL magic, and once the tunnel has been established (and only then), the client sends the URL (specifically, the part after the server name, in my example /foobar.html) to the server. And that one goes in the tunnel, hence encrypted.

This answer is a walk through the SSL protocol.


Placeholders for cshtml --- ASP.NET I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input

@{
    var title = "";
    var genre = "";
    var year = "";
    var movieId = "";

    if(IsPost){
        Validation.RequireField("title", "You must enter a title");
        Validation.RequireField("genre", "Genre is required");
        Validation.RequireField("year", "You haven't entered a year");
        Validation.RequireField("movieid", "No movie ID was submitted!");

        title = Request.Form["title"];
        genre = Request.Form["genre"];
        year = Request.Form["year"];
        movieId = Request.Form["movieId"];

        if(Validation.IsValid()){
            var db = Database.Open("WebPagesMovies");
            var updateCommand = "UPDATE Movies SET Title=@0, Genre=@1, Year=@2 WHERE Id=@3";
            db.Execute(updateCommand, title, genre, year, movieId);
            Response.Redirect("~/Movies");
       }
    }
}

I'm confused. Aren't you still taking in userdata? I am trying to find an example of non-safe code that doesn't use placeholders, but all I get is "validate user input"

Any ideas?

A more common term for this is "parameterized SQL".  You are still taking user data, as you pointed out, but the security lies in the fact that the application knows what is data, and what is executable.

When you build a SQL statement as a string and pass it in it's completed entirety to the database, the application simply has to trust that the SQL command being executed is what you intended, and has not be maliciously modified by user data during construction.

When the user data is passed in separately from the SQL statement as parameters and parameter values, the SQL command can't be directly modified by user input...It's separate.  The application can tell absolutely what is supposed to be executable, and that nothing in the parameter values should be...It's all data, and only data.


Should password recommendations be different for devices, networks, and internet? I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or my phone, which has said password manager installed.

But device level access is a different story. Having super-strong, unique passwords is really annoying and prone to needing to pull out your phone to remember it. (using secure notes to remember the password)

I tried the strong password for windows logon and ended up changing it back to a weak string-digit password after a day.

Due to active directory network access being tied to device logon means that network access is also weak. Thankfully most practice MFA for remote network access so thats good.

Another password that I had to set back to being a weak string-digit is my itunes account due to having to enter it so often at the app store.

With Windows 8 device access being tied to an outlook account, and appstore access being tied to an itunes account, I really don't know how to approach those.

Ideally I would like to both recommend and PRACTICE super-strong internet account passwords, but easily remembered device access passwords.

So I guess my question is, should passwords vary depending on what is being accessed, and if so, whats the best practice for the different types of access?

A good password is a trade-off between several parameters:

Value of that which is protected (this should condition the effort invested by potential attackers).
Cost of brute force (this depends a lot on the target, e.g. some will allow offline attacks on a hash value, while others limit attackers to online attacks only, at some maximum server-enforced rate).
Ease of remembrance.
Ease of entry (e.g. mixed case/digit passwords are difficult to type efficiently on a smartphone).
External constraints (minimum size, maximum size, strict and often misguided rules enforced by an overzealous admin...).
Extent of the password power (e.g. SSO makes passwords applicable to many systems; password reuse too).

Since it is a trade-off, a password will never be generally perfect.

How often you type the password is an important parameter: the more often you type it, the easier it will be to remember it. For a password which is entered on a daily basis, go for a sequence of random letters (chosen uniformly and independently of each other): this will speed up entry because you can reach a very decent entropy level in relatively few characters (with only lowercase letters, 10 characters already get you to 47 bits of entropy).


Man in the middle attack on browser downloads I'm writing this post from chrome. If I go to a HTTPS site after this, the public keys built into the version of chrome I'm using will be used to verify the site's signature (unless I misunderstand). Since I downloaded chrome over the internet, how could I have prevented against a man in the middle attack? For example, suppose an attacker can insert himself in the connection close to the chrome download server. He could insert fake keys into the downloading packages and then send those downstream to the users. Obviously this is very hypothetical, but from a theoretical point of view I guess what I'm asking is how can keys be distributed over an unsafe network? How do you know the person you're downloading the keys from is who they say they are without getting a key from someone else, where you face the same problem?

It's not theoretical at all.  The NSA has a program called Quantum Insert that injects packets into users web sessions, and can redirect downloads to an NSA site that contains whatever the NSA chose to put in the download.  It's certainly possible they could do what you're describing to a browser download.

There's a great essay on how it works at http://www.wired.com/2013/11/this-is-how-the-internet-backbone-has-been-turned-into-a-weapon/

To protect against this kind of attack, you need to make sure you're downloading the browser with https.  As long as the browser you're downloading with isn't compromised, and you're connecting via https (and you check the URL you're downloading from is legit and https), then packet injection like Quantum Insert, or some other form of redirection isn't possible.


Hash/Digest of string; multiple clients and reverse lookup must be impossible Ok so i need a technique (could be a system or just an algorithm) to generate a hash/digest of a string on a client app without me (admin of a server app) being able to determine what the original string was. The twist is that i know the format of the string so it would be quite easy to generate a lookup table of SHA, MD5 etc values and determine the plain text.

The other twist is that each client app is maintained by a separate company, so any key (or salting) based methods obvious to me would need a third party to co-ordinate the keys/salt values without them ever getting back to me.

I'm thinking some sort of setup where each client has/generates a key which will encrypt the string, and i have a key that can tell if the encrypted string would have come from the same plain text value - even though each digest is different - but my key will not actually be able to decrypt the digest.

Now i have a feeling that there is a solution perhaps in the vein of public/private key sort of setup but im a rank rookie when it comes to cryptography so any help in potential solutions or even terminology to search for or help describe this type of problem would help me greatly. I would like to avoid having to have a third party supply and maintain keys also. Cheers :)

(I have a workflow diagram if that will help which i will try and link to clarify the scenario if need be)

Edit: So i think i can post pics now, here's a diagram which illustrates the scenario i need to solve!

The client apps are numerous.  There is no need to authenticate them with the server app; they are fully trusted. The clients have about a second to hash the string with say standard desktop specs. All the server needs is to receive the hash from the client app and store it in a table with a timestamp so i can determine when the same visitor id logs in across any of the client apps.

Thanks for help so far!

You can't know the ID but you MUST uniquely identify him? Then why not just setup another system to provide a secure identity(pubkey pair) for a given ID? That system will be the lookup-DB in case of tampering but also the weak point in the privacy of your system. If you don't need that recovery mechanism, just don't create that lookup-DB in the first place..

Or, if you don't really care which customer uses your service but only that it is SOME valid customer, take a look at anonymous authentication using zero-knowledge proofs. A simple solution might also be to use blind signatures upside down: The server distributes valid signatures to the customer during enrollment and the customer randomizes them before authentication. In that approach the customer can create new aliases by randomizing a signature you gave him, but you can always assure that the signature is one you generated at some point.


How to restrict skype file transfer outside of LAN We are a mobile application development company.

Due to the security of Source Code and other files, we need to restrict Skype file transfer outside of LAN.

How to restrict Skype file transfer outside of LAN?

It's exceedingly difficult to block Skype file transfers at the network level. They've designed it to use common ports (80 / 443) and proprietary encryption (albeit an extension to SSL) along with UPnP NAT holepunching to ensure absolutely minimal conflicts and setup issues. Remote file transfers go through supernodes as part of a P2P architecture, so it's not possible to blacklist a server to prevent the transfer.

You can disable the file transfer ability of Skype entirely, though. It's done via a registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype\Phone

You may need to create this key first. Once you've found / created it, make a value called DisableFileTransfer as a DWORD and set its value to 1. This will completely disable file transfers within Skype. You may need to restart Skype or the whole computer for it to take effect.

After the transfers are disabled, you can use an alternative file sharing mechanism within your LAN, such as shared drives.

Note that you'll need to restrict access to the registry on those computers. Your users should run as limited accounts, and you should use group policy to deny access to administrative tools like regedit.


Burp Suite upstream proxy Is there a way to configure burpsuite's upstream proxy direct the traffic to the local box's proxy configuration? Additionally is there a way to exclude urls from being directed to the upstream proxy.

Upstream proxies can be configured in "User options" -> "Connections".

Excluding URL's works a bit different. You basically tell the upstream proxy what URL's you want to go through that proxy or you enter a URL without an upstream proxy (leave blank)


How safe is RSA generated public-private key pair? If one has been using the same set of public-private key pair for quite sometime now, given his public key(which is public), can't an attacker find the corresponding private key for that public key by bruteforce?
If not bruteforce then what else methods are there to break the rsa encryption?

They can, but bruteforceing these keys takes too much time to actually be a plausible attack. This depends on things like key length, but in general we are talking about on the order of thousands of years (or more!) to bruteforce. And as far as I know, RSA keys aren't subject to key wear, so using a public-private key for a while won't help attackers discover the private key.


Simulate a lot of different IP's hitting a website This may sound like launching a DDOS, but I am testing out GEO-IP location on my applications. I need to gather some data, to check how my graphs look when there is a lot of data.
Are there any tools available where I can paste in an URL and spoof IP adresses?

As the comment said: IP spoofing is not an option if you want to have a working TCP connection. And you probably need this connection because otherwise the connection attempts will fail at the kernel already and your application will not get any requests.

I don't know your application setup but I see the following options:

Some applications take a HTTP header like X-Forwarded-IP as the originating IP address, because these kind of headers are often set by reverse proxies in front of the application. If this is the case you can fake this kind of header and generate the desired HTTP requests with some scripting skills.
If this is not the case you might setup a virtualized network with lots of different IP addresses and then do the requests from the different source IP addresses to your application (which must be on the same virtualized network setup). That's not as simple as the previous option but doable with enough knowledge on how to setup networks.


Remove sync user to harden the system I read a book about linux hardening (Hardening Linux by James Turnbull, 2005). The book suggests to remove the sync user. If I remove the sync user I am not able to call commands like ls and shutdown, because they are not found anymore.

I used the following command to remove the sync user:

userdel -r -f sync

The following error appears after I removed the user:

-bash: shutdown: command not found

why do these commands not work anymore? and is it possible to remove the sync user without any problem?

userdel -r -f sync

With the -r option you are not only removing the user but all data below the users home. On my system the users home is /bin:

$ grep ^sync: /etc/passwd
sync:x:4:65534:sync:/bin:/bin/sync

Only, /bin is the place where lots of essential binaries are stored. Thus, it is not surprising if essential functionality gets lost if you remove /bin.

  The book suggests to remove the sync user

That's an unusual recommendation. The usual recommendation is to disable shell access for system users like sync or daemon and lock these (i.e. no valid password) which usually is already done on common systems.


xml library vulnerabilities, regarding post-exploitation there was some arbitrary code execution that occurred on my os x 10.5 system.
this came as a result of opening an xls file with excel for mac.
the vnc type program that came with office for mac was being used to loot around, but i think the damage was minimized because of needing the admin password for most things.
i noticed the activity but was unsure of how to solve it, ended up leaving a threatening text file on the desktop addressing the individual, who i had done some work for through craigslist (lets just say a background in creative writing comes in handy), and whattya guess, the next morning there were a bunch of xml files in the trash.
i guess he got scared and wanted to make it apparent he was rectifying the situation.
however, i am not so sure that the problem is fixed.
i deleted the programs that allow for vnc type connections, but am still curious if anything could remain.
i am not even sure how xml exploits would translate into real world activity.
what would be a good way of determining if OS X has any kind of remnants of hijackery?

The computer is not yours anymore, it is probably his.

You cannot trust that he did not actually compromise your box further than you currently know about.

He could have compromised the kernel, binaries or virus scanner on your box and you would never know.

I would recommend wiping and re-installing from known good media.

Then scan your current hard drive and all network drives for compromises (but you can never know that your virus/malware scanner will recognise the specific compromise left behind). Then take off the content you must from your old media.

If you wish to contact the police about it, you will need to supply them with your computer (or at the least your hard drive) so think carefully before you do the irrevocable step of wiping the old media or trashing anything else on it.

But I am Not a Lawyer, I only read Groklaw.


What is the most "safest" architecture to run in QEMU? Currently OpenBSD supports these architectures ( http://www.openbsd.org/plat.html ):

alpha   Digital Alpha-based systems
amd64   AMD64-based systems
armish  ARM-based appliances (by Thecus, IO-DATA, and others)
hp300   Hewlett-Packard HP 9000 series 300 and 400 workstations
hppa    Hewlett-Packard Precision Architecture (PA-RISC) systems
i386    Standard PC and clones based on the Intel i386 architecture and compatible processors
landisk     IO-DATA Landisk systems (such as USL-5P) based on the SH4 cpu
loongson    Loongson 2E- and 2F-based systems, such as the Lemote Fuloong and Yeeloong, Gdium Liberty, etc.
luna88k     Omron LUNA-88K and LUNA-88K2 workstations
macppc  Apple New World PowerPC-based machines, from the iMac onwards
mvme68k     Motorola 680x0-based VME systems
mvme88k     Motorola 881x0-based VME systems
sgi     SGI MIPS-based workstations
socppc  Freescale PowerPC SoC-based machines
sparc   Sun sun4, sun4c, sun4e and sun4m class SPARC systems
sparc64     Sun UltraSPARC and Fujitsu SPARC64 systems
vax     Digital VAX-based systems
zaurus  Sharp Zaurus C3x00 PDAs

Currently QEMU supports these architectures ( https://en.wikipedia.org/wiki/QEMU#Emulated_hardware_platforms ) - but FIXME:

IA-32 (x86)
x86-64 PCs
MIPS R4000
Sun's SPARC sun4m
Sun's SPARC sun4u
ARM development boards (Integrator/CP and Versatile/PB)
SH4 SHIX board
PowerPC (PReP and Power Macintosh)
ETRAX CRIS
MicroBlaze architectures.

So combined (what has boths support, but FIXME..):

i386 OR IA-32
amd64 OR x86-64
sun4m (SPARC)
macppc OR PowerPC

Searching google (search string || hits):

site:seclists.org i386 exploit vulnerability || 14600
site:cvedetails.com i386 exploit vulnerability || 24700

site:seclists.org IA-32 exploit vulnerability || 650
site:cvedetails.com IA-32 exploit vulnerability || 3510

site:seclists.org amd64 exploit vulnerability || 11000
site:cvedetails.com amd64 exploit vulnerability || 29900

site:seclists.org x86-64 exploit vulnerability || 540
site:cvedetails.com x86-64 exploit vulnerability || 4970

site:seclists.org x86_64 exploit vulnerability || 6590
site:cvedetails.com x86_64 exploit vulnerability || 36800

site:seclists.org sun4m exploit vulnerability || 17
site:cvedetails.com sun4m exploit vulnerability || 0

site:seclists.org SPARC exploit vulnerability || 7750
site:cvedetails.com SPARC exploit vulnerability || 43800

site:seclists.org macppc exploit vulnerability || 1
site:cvedetails.com macppc exploit vulnerability || 3490

site:seclists.org PowerPC exploit vulnerability || 7130
site:cvedetails.com PowerPC exploit vulnerability || 32000

-->>

http://i.imgur.com/jbsBNj0.png

So I want to run an OpenBSD guest with QEMU on an OpenBSD host. But with different arch then the host OpenBSD has. (For security reasons, if an exploit works on ex.: i386 it's not 100% that it runs on ex.: sun4m).

for first look if I would use i386 or amd64 as host, the guest would need to be: sun4m (? - but SPARC has many hits.. and can QEMU really use sun4m???)

p.s.: yes, I know, searching for historically vulnerabilities isn't the best method, but there aren't any better.. or?

Q: So what would be the most safest architecture to use?

Exploit counting is not helpful here, because the numbers are skewed by non-targetted attacks. If a bad guy doesn't care what machines she gets control of, then she will target Windows on x86, because there's a billion more of those out there than BeOS on PDP-11.

Since you are primarily defending against targeted attacks, your focus should be on hardening the specific instance.

Indeed, there's a case to be made that you should go for x86 on your guest as well. It's probably the most popular port (citation needed), which probably means the most eyeballs are on it looking for bugs.


Blanket blocking SMTP email services for security reasons at work I've read the help pages and other guidance on subjective questions, I am trying to keep this question as objective as possible, so I'm going to ask up front that people stick to backing any response with facts, first-hand experiences or examples.
My work is blocking email services, they claim for security reasons,

At work You are correct, we block SMTP and other email services to unknown servers from the Internal network as a security precaution.
That said we can make exceptions so if you can send me:

The server(s) involved
The ports you need (25,143,110 etc)

What are the main concerns when deciding to whether to allow these services?
My thoughts so far are not very objective, hence why I need some more professional help;

Social engineering? People browsing non-work emails may have poor spam filters and inadvertently click on links to malicious websites, however I don't have any objective evidence that this would be a valid concern for the company... at least any more so than people browsing the web (which is totally unfiltered)

I don't believe it to be an attempt to boost productivity as social media websites are not blocked, much better targets for employee time wasting these days.

They haven't by default made exceptions for the most common email services, suggesting they still mistrust those and want to discourage email use as much as possible.

This is usually a damage limitation procedure, so that if a system within the network gets infected with spam-sending malware (which used to be really common, and is still a fairly common payload for botnets), it doesn't cause reputational damage to the business, or cause the legitimate business email to be classed as spam, due to coming from the same source as junk mail.

For businesses, this may also make it easier to ensure that all outgoing email goes through a known server, to add signatures or legal notices.


MongoIDs and confidentiality Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually natural integers starting from 1. Those IDs are not as safe as UUIDs (for example when pausing artificially the time such as in specs, two MongoIDs can be "sequential") but in a production environment where the time isn't frozen, it's doing better (how better is part of my question)

My question is : to what extent are the IDs generated by MongoDB "safe enough" for use in production (and by safe I mean confidentiality and all the security stuff)?

For example, assume some users are uploading files on the website (for instance in a conversation), and the said file are put on Amazon S3 and identified by a MongoID. How safe is it to make this file available to the public for convenient retrieval ? I understand the safest solution would be to have the backend generate a temporary secure URL, but I can't think of a reasonable scenario where a malicious person could create a hack to find these MongoIDs. The worst case scenario of an attacker that would successfully be able to download the DB is probably too "worse" to even consider this type of problem specifically.

Here's how the MongoDB id is generated: https://docs.mongodb.com/manual/reference/method/ObjectId/

The important bit is:

a 4-byte value representing the seconds since the Unix epoch,
a 5-byte random value, and
a 3-byte counter, starting with a random value.

The seconds since epoch is of course predictable, though there are many, many values to iterate through if you wanted to guess it.  That leaves the 5 byte random value and the 3 byte counter to predict.  That would take a bit of brute forcing, but it's not impossible.

The easiest solution may be to require user login before gaining access to the files.  If that's not possible for some reason, and the files are low value, I wouldn't worry about it, it's likely good enough.
If you want to be extra secure, a short lived generated random URL would be much more secure.


Can someone detect the URL an android app uses? I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret?

I know that the IP address and the port number of that connection can be detected, but what about the exact host name and more importantly the URI and/or the query string?

I don't mean just via router or via some other networking 'hack', but also by using some other android app or by using the eclipse plugin.

The app is native and I know how to obfuscate and hide the URL in the code, so it can't be seen by decompiling the app.

HTTPS (i.e. SSL/TLS) encrypts all HTTP communication including the entire URL. HTTPS does not protect the domain name as this is sent to the DNS in the clear, but it does protect the rest of the URL. Other apps don't have access to your app's SSL/TLS encrypted traffic including URLs. So as long as the SSL/TLS connection is setup securely an attacker won't be able to obtain you URI from the traffic.

But from the last sentence you wrote ("I know how to obfuscate and hide the URL in the code, so it can't be seen by decompiling the app") I understand that you need to protect the URL against an attacker who has full access to the device (e.g. the owner of the device). In this case you can't rely on SSL/TLS connection being secured as it's possible for the atttacker to install his on CA certificate on his device. This completely nullifies the security of SSL/TLS, as the attacker can impersonate your server and perform a man-in-the-middle attack - just like Alexey V. Borodin's hack on Apple in-app purchases. Even if you use a hardcoded SSL certificate the attacker can root the device and modify the O/S to output all SSL/TLS communications in the clear. So HTTPS will not protect your URIs from an attacker running your app on his own device.


Are rich-client apps inherently more secure than webapps? If I'm not mistaken, in webapps there are a lot of potential attack vectors, such as http header spoofing and what not, which are not there in typical rich-client desktop applications, such as WPF applications. To add a bit more motivation to my question, I have the feeling that most security related issues I come across in news and blog articles concern webapps. Me being a desktop developer with 0 experience in web-development, I began to wonder: are rich-client apps inherently more secure than webapps?
For example, can a simple desktop app with a classic login (username + password), a database (that resides on a remote server) that only contains usernames with hashed passwords (and salt), without any other "authentication" process, be considered less vulnerable overall (lets say towards the most common types of attacks) than a webapp that does the same?
Perhaps to make my question more focussed, based on the comments I received: What are some of the main security concerns for each type? Are there any potential vulnerabilities that exist in one but definitely aren't worrysome to the other?
Please note that I am not considering scenarios where one uses technologies of the other. For example, the desktop app should do what it does without any usage of web technologies or protocols (such as HTTP).

It's probably impossible to fully quantify the different threats to each program type. My initial reaction, though, is "No". It's often easier to attack web apps - they're more often exposed and easy to find - but that doesn't mean much to a motivated attacker and most of the most-famous worms and other highly-damaging malware targeted desktop apps or other non-web software.
The following lists are not comprehensive; I just wanted to illustrate some of the many, many factors.
Some security advantages of desktop apps:

Do not necessarily to accept traffic from the Internet directly, although some do. Those that don't usually require some victim actions (like opening a file).
More likely to act as a client (making requests and getting responses) than a site (which is hosted by a server). Assuming the app's server is not malicious, this makes it harder for an attacker to attack the connection.
Unless using a webview, immune to client-side web vulnerabilities such as XSS or CSRF. Even if using a webview, usually the risk is reduced because you don't browse arbitrary sites with the webview.
Many systems support various hardening options (NX/DEP, ASLR, etc.) that make successful exploitation of some attacks hard.
Many systems support customizable sandboxing (including containers, etc.) to allow running the code with the least privileges it needs (unfortunately, this requires developer or possibly user action that is rarely taken).

Some security disadvantages of desktop apps:

Most do not run sandboxed (though sandboxes are becoming more common); compromising one can take over the entire computer and possibly local network, or at least everything on it that the user has access to (think ransomware, etc.).
Much more likely to be written in native code or call into native libraries with attacker-controlled data, which means more risk of memory corruption vulnerabilities (buffer overflow, use-after-free, etc.).
Plenty of room for confusion around the multi-user machine model (what directories or other objects are safe to use, what permissions should be set on privileged components, etc.).

Some security advantages of web apps:

Browsers automatically provide a lot of security features that are not necessarily present elsewhere, like the same-origin policy and sandboxed system access.
Web apps are easy to update when an issue is found, and then everybody immediately gets the patched version.
While a compromised web app might compromise a large number of users, the damage to each user is likely less because each web app is isolated from others so most of your computer use is unaffected (note: this is less true if you share passwords across sites!).
Browsers include support for secure communications (HTTPS) and data parsing (HTML Form formats including MIME, JSON) making it less likely people try to implement their own protocols / parsers and risk messing it up.
Since the server is generally doing only a well-defined list of tasks and does them autonomously, it's relatively easy to restrict access to it (except on TCP 80/443) and sandbox it to limit both its attack surface and blast radius.

Some security disadvantages of web apps:

Common, well-known and easily-weaponized attack patterns (XSS, CSRF, etc.) that are often easy to find by anybody with a browser (so, everybody).
Browser differences in security-relevant behaviors and feature support means mitigations might cover some users but not others (less of a problem now than before, but some people still use IE, even version 10 or older).
Confusing standards (e.g. CORS) and common misconfigurations (bad TLS suites, SAML/OAuth handling, XML entity handling) mean there's a lot you might have to know to set up a web app securely (many potential threats).
High-value targets (compromise one app or service, potentially hit a ton of users and/or get lots of valuable data).


Do I have to block UDP ports when I launch my own server with a public IP? I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".

Then I scanned my server with nmap, and I found out that every UDP port is open. I don't know if I must close these ports, and if UDP ports are dangerous to me.

I just want to provide Web server and SSH.

Could I leave UDP ports open or not?

Why UFW has not close UDP ports at default settings if they are dangerous like TCP ?

Is enough if I block just INCOMING connections?

10/udp open|filtered unknown

In NMAP lingo.

"open" means that a service appears to be running on the port.

"closed" means that the port appears to be unused.

"filtered" means that traffic to the port appears to be being filtered out by a firewall.

For regular TCP scans NMAP can distinguish between all these states because the TCP implementation in the operation system will always respond to a connection attempt either positively or negatively.

For UDP scans the OS will respond to packets sent to closed ports but for open ports the OS will simply pass the packet to the application silently. The application may or may not respond.

So for UDP scans NMAP can't tell the difference between a port that was filtered by the firewall and a port where the packet was delieverd to the application but the application didn't respond. Therefore it reports lack of response as "open|filtered".

  But i do not understand why nmap response "closed" on rule which is "allow" (in the udp port)

Because the packet makes it through the firewall but is rejected by the UDP implementation as no service is listening on that port.


Secure backup encryption with OpenSSL I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to think through a protocol that would work just with OpenSSL's standard tools (i. e. dgst, enc, rsautl & Co) invoked from a POSIX shell.

The scenario includes a more or less trusted system on and from which backups are created - this could e. g. be a mail or file server. Then there's a storage which is not 100% to be trusted (e. g. a cloud storage, or a backup server not entirely under my control). So the purpose of the crypto is to protect confidentiality and integrity of the data while stored on the untrusted storage. This protection should also work in case the trusted system gets compromised - at least for data stored before the trusted system was compromised.

So here's a kind of protocol that should fulfill the aforementioned criteria:

Step 1: RSA Key Pair

This step only needs to be performed once. An RSA key pair is needed. This key pair shall not be created on the "trusted" system, but instead on a really trusted box (e. g. a trusted work station or wherever you'd trust to keep your GPG key ring). Since the private key is only needed for recovery, it shall never enter the realms of either the trusted system or the untrusted storage. Key size needs to be 4096 bits or above (we come to that later). OpenSSL usually offers key generation and separation by those commands:

  EDIT: switched to PKCS#8 for the keys, being probably more resistant to brute force attacks

openssl genpkey -aes-256-cbc -algorithm RSA -pkeyopt 'rsa_keygen_bits:8192' -out private.key
openssl pkey -in private.key -out public.key -pubout

Step 2: Generate Session Secrets

For each encryption process, dedicated secrets (key, initialisation vector and salt) shall be generated:

  EDIT: removed salt as per Ctulhu's comment

key=$(openssl rand -hex 32)
iv=$(openssl rand -hex 16)
hmacpw=$(openssl rand -base64 48)

Please note: I am aware that this will have the secrets unprotected in the trusted machine's memory. However, if an attacker has access to the machine in a way he can skim the backup process' memory, he probably already has access to the data to be protected by these secrets.

Step 3: Compress and Encrypt

Data shall be compressed before encryption. Compression is required anyway, so I consider it a good idea to do it before encrypting the data:

  EDIT: removed salt as per Ctulhu's comment

data-generator | xz -zc | openssl enc -e -aes-256-ctr -K $key -iv $iv -out message.enc

Step 4: Generate HMAC and Pack up Keys

The last step would be to generate a HMAC of the just encrypted data, and pack it up together with the session secrets in an RSA encrypted file, using the public key for encryption:

  EDIT: removed salt as per Ctulhu's comment

hmac=$(openssl dgst -sha512 -hmac $hmacpw -hex message.enc | sed 's/^.*=[[:space:]]//g')
echo "${key}:${iv}:${hmacpw}:${hmac}" | openssl rsautl -inkey public.key -pubin -encrypt -out message.key

And here it becomes obvious why the RSA key had to be that large: hex digits in shell strings are counted as one byte each, not half a byte. Therefore, the size of the key string sums up to (2x32 + 2x16 + 64 + 128 + 5) = 293 Bytes = 2344 Bits.

Again, I'm aware that exposing secrets on a command line is generally a bad idea, but given the circumstances, I do not see how this would compromise confidentiality or integrity of data which are available in plain text on said system, where an attacker could much easier compromise their privacy or integrity. However, if I would really go and implement this, I'd rather use named pipes to avoid having the secrets popping up in the process list.

Now my questions:

What did I miss? Do you see any flaw or potential attack vector I haven't noticed yet?
Would it be more secure to create a signature with openssl dgst -sha512 -sign private.key -out message.sig  message.enc, given that this would require the private key to reside on the more or less trusted system?

For the question about what you could have missed:

At the time you encrypted the data on the server, you can use rsync to securely synchronize the data to the backup.

rsync -aHSv --del --progress ~/<encrypted-data> user@remote-backup-server:/<destination-directory>./ -n

The use of --del is to remove old stuff in the remote destination (you can safely remove that option if you want to keep all the history).

For the question about security:

The advantage of doing things with rsync is that you could secure the backup server firewall to works with only some IP on some ports and use your RSA Keys with ~/.ssh/authorized_keys

OpenSSL or LibreSSL?

I think that point could be interesting to dig as explain on security.stack


Locking an enterprise account from an internet facing application Some corporate applications are most useful when they are accessible from the internet. Outlook Web Access comes to mind.

Those application usually have a user directory (usually LDAP) in the corporate environment that serves other purposes, like desktop authentication or authentication to some other internal only service like an HR portal.

Using the external application, it is often possible to lock an internal account by trying to guess passwords by brute force. A targeted manual attack also works. Mitigating factors include not divulging user names, and unlocking accounts after a few minutes.

Seeing how frequent we see this combination, how can I evaluate the risk of locking an internal account by using an internet facing application? Is the risk small enough, and is the benefit high enough so that everyone can accept this risk?

You could try to implement a captcha on the logging page of the web application after the first try to reduce DoS situations.

Also, banning the IP which has several failed logging attempts could help prevent such situation. fail2ban is commonly used in UNIX environments for this purpose.

Also, using unpredictable usernames could reduce the risks.


Is an outbound firewall connection 'safer' than an inbound We're trying to determine if pushing data through a firewall is more safe than pulling it. The data will be from SSIS to SSIS through the firewall. An advisor here has suggested that pushing the data through the firewall is safer than allowing an external connection in to pull the data out.

Is this so ?

Allowing an inbound connection means opening up a port on your firewall and having a network service listening on that port 24/7 and that creates risk.  If you are the client, you reach out to a remote network listener and pull the data back.  You don't have that 24/7 risk.

There are some things you can do to lower the risk like IP-whitelisting and monitoring, but it doesn't reduce the risk to zero.

In general, I advise people to make the higher security zone the client.  If one side of the connection is more sensitive to you, pull from there.  Increase the risk in the zone that's less valuable.


Is Maltego the best forensic/intelligence solution out there? I am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web.

please recommend me the best software out there ... and if you think you are qualified enough to gather information about import export I can pay top dollar for your time.

By far the best forensic intelligence tool every made is GREP.  Oah don't, forget PCRE,  I can tell you from more than a decade of experience that a regular expression tool will be able to detect any pattern and any violation you could possibly need.

Google is good at "gathering information around the web".


Under what circumstances is my website vulnerable to clickjacking? Most of the examples I have read start with a malicious website. Lets say I am creating a website without malicious intent.  When does the website become vulnerable to clickjacking?  Can this occur without a XSS vulnerability or without my server being compromised? If so, how?

By default, any new website is probably vulnerable to Clickjacking, depending on the webserver defaults.

For defense against it, you should set HTTP-Response-Headers, as the OWASP Clickjacking Defense Cheat Sheet recommends. Another valuable and more concise ressource is Wikipedia:

Disallow embedding: All iframes etc. will be blank, or contain a browser specific error page.

  Content-Security-Policy: frame-ancestors 'none'

  X-Frame-Options: deny

Allow embedding of own content only:

  Content-Security-Policy: frame-ancestors 'self'

  X-Frame-Options: sameorigin

Allow specific origins to embed this content :

  Content-Security-Policy: frame-ancestors www.example.com www.wikipedia.org

  X-Frame-Options: ALLOW-FROM www.example.com www.wikipedia.org

Most examples start with a malicious website, because an attacker will require this malicious website for his attack on your vulnerable website: He can simply create his own evil.com website, containing an iframe of your victim.org.

As long as victim.org does not prevent the attacker from doing so, victim.org will remain vulnerable to Clickjacking.


What is the encryption used here? This is the string:
UVRWUVRsUXRNRGRSUlZBdE9FTllUbGM9

I want to decode it, but I'm not sure what decoder to use.
Thanks :)

you can  try  CyperChef

https://gchq.github.io/CyberChef/

you can easily try different N-bases decryption  & others


How do I ensure that my Ubuntu download has not been tampered with? I am downloading Ubuntu Linux, and would like to make sure that my download has not been tampered with.

Ubuntu has a GPG key, which I could use to make sure that the download is valid -- but how do I validate the key? Unfortunately, the key seems to only be available via hkp -- which is not a secure protocol!

The GPG key is itself signed -- but how do I check those keys?

The Ubuntu instructions for verifying the download are not helpful unless the public key to verify the signatures is available securely. GPG web of trust is not helpful, because mine is currently empty and I don't know where to start building it.

You can find all of the MD5 hashes here:

https://help.ubuntu.com/community/UbuntuHashes

Now all you have to do is compare the MD5 hash of your download with the hash on the page. You can generate an MD5 hash in Ubuntu by using:

md5sum <file>


Are there any known vulnerabilities in libre office password protection for *.odt files? I was looking for a source to determine the safety of password protection in libre office. The thread at ask.libreoffice.org suggest its save to use. However the thread is rather old and it is hosted on a site not primarily concerned with security. So the question is are there any known vulnerabilities in password protection for *.odt files in  libre office 6.2.2.2?

How secure is LibreOffice when using password protect?

According to the OpenDocument Specification, these files use a strong encryption with no known flaws.

...This digest is used to produce a derived key by undergoing key stretching with PBKDF2
...ODF 1.0 and 1.1 use Blowfish in 8-bit cipher feedback mode, while ODF 1.2 considers it a legacy algorithm and allows Triple DES and AES

However, like almost every encryption algorithms, odt files are vulnerable to bruteforce but, according to this post it's not very efficient and if your password is strong enough you should be fine.


How to estimate the number of entropy bits & search space of a signature system like passtouch? Apologies if I'm using the wrong lexicon, I'm just reading up about password systems out of interest.

After seeing the xkcd strip on passphrases and coming across the passtouch system (youtube demo) that uses an abstract signature to login to sites, I just wondered how the company, or anyone might estimate or predict the randomness of the signatures people would use?

Off the top of my head it seemed like something that could have a huge amount of theoretical possibilities (search space?), but due to human psychology actually have a lot of people drawing remarkably limited signatures and so few entropy bits (?).

So how might one go about estimating this (using psychological theory or prior studies or maths or whatever)?

EDIT ********

Ok I realise that without knowing the exact system that passtouch implements we can't know how large the search space is to any accuracy. But theoretically maybe we can give a guess as to what ballpark number of possibilities a similar signature based system could generate?

So imagining that the screen is divided into a 20 x 20 grid, each square is assigned a unique id and as you touch a certain square, that id is added to your "personal passkey".

From any starting square your next move can go up, down, left or right as long as your not on the side or in a corner.
When you move diagonally, I'm assuming you actually touch another square first, so move in an L shape.
You can't immediately backtrack to the same square you just came from, but you can go back later.

From a quick test on my notepad, I estimated a signature to cover approx 40 squares (edit: at least 40 squares as I was originally allowing diagonal moves as well).

So how can we work out the number of unique 40 square long "signatures" on a 20x20 grid?

I did some very rough calculations and got something like 2^113 possibilities (edit: that was allowing diagonal moves) but couldn't work out how to deal with the size limitations of the grid. Still I'm guessing such a system could easily give more than 2^100 possibilities...

Anyone got a better estimate?

Your very rough calculations seem to be a gross overestimate, as the line has to be continuous.  For simplicity let's first neglect curved lines.

Then since it is one continuous line, let's imagine it as a 10x10 continuous grid (my finger widths on an ipad; I doubt it will be more sensitive in rejecting passwords until its more than a half-fingers width of error) over the section covered by the passtouch logo.  A possible password is then a series of points (starting point and each point where it changes direction).  So that all matters is starting location and then travelling to a few points.  For example, dropping the circle at the end of the demo video the demo password there were 5 points.  If the points were randomly chosen (probably a bad assumption as humans are poor random number generators), you'd have ~2^33 possibilities.

Now there's the question of how much entropy does making a curve add?  You could approximate as each new direction of a curve (change in concavity) is equal to an additional new point (the point the curve must go through to go from the start point to the end point) as if you only had a straightline.  So the demo password with the curve at the end counts as 7 points with ~2^46.  This is roughly equal to a password with 8 upper/lower case letters chosen at random.  I personally wouldn't trust encrypting other passwords (I hope it encrypts) by protecting with a key that's this weak.  There's further weakness in that people will probably not randomly choose circle widths; but instead choose width to circle/weave around circles already in the figure.


Can restarting a router result in its software being updated? Articles in the past few days have mentioned the FBI recommending folks restarting their routers to avoid “Russian” malware from affecting some 500,000 routers.

This made me curious; what could restarting the router do to stop malware? Is this because Internet routers typically have software that checks for updates every time you restart them, and the ISPs and/or router manufacturers have issued patches to address a vulnerability, or is there something more interesting going on?

Short answer: It erases the volatile memory, which is where the plug-ins are stored that you're referring to. This was what was doing the heavy-lifting of the malware.

To fully get rid of malware, you are correct that the router's firmware will need to be upgraded or wiped and re-installed, but the malware referenced here  used various plug-ins that lived in and used the volatile parts of memory, similar to the RAM. This means a simple reboot killed whatever plugin was in use, but did not totally disinfect the router.

Check here for a more in-depth explanation. Some important excerpts from the link include:

  Once in place, the malware reports back to a command-and-control infrastructure that can install purpose-built plug-ins, according to the researchers. One plug-in lets the hackers eavesdrop on the victim’s Internet traffic to steal website credentials; another targets a protocol used in industrial control networks, such as those in the electric grid. A third lets the attacker cripple any or all of the infected devices at will.

And:

  That allowed the bureau to identify a key weakness in the malware. If a victim reboots an infected router, the malicious plugins all disappear, and only the core malware code survives.


Is the unauthorized deletion of data considered a breach of integrity or availability? I am in the process of writing a security vulnerabilities report on an application used at my employer, having completed an application audit. One discovered vulnerability can lead to unauthorized deletion / destruction of data.

In the context of the CIA security principles,I associate integrity to be concerned with safeguarding data from unauthorized modification, such as through MITM and availability with safeguarding data from DoS such as through smurf or teardrop attacks.

I am inclined to say that unauthorized deletion of data is an attack on Availability principle given the data can no longer be accessed by legitimate users. However, one of my colleagues disagrees and considers such to be an attack on the Integrity principle, because data was modified by being destroyed without authorization.

Is the unauthorized deletion of data considered a breach of integrity or availability?

However, one of my colleagues disagrees and considers such to be an attack on the Integrity principle, because data was modified by being destroyed without authorization.

Your colleague has a point. Unauthorized data deletion is foremost a breach of integrity since deletion can be considered a special case of modification. This can have an impact on availability, but it doesn't have to. E.g, an attacker who manages to delete all logfiles on a web server probably wouldn't impact the server's uptime. But obviously a breach of integrity often implies impaired availability since a service with corrupted resources will likely not function properly.

I wouldn't always force a vulnerability into one of the three CIA categories, though. The impact of unauthorized data deletion is quite obvious, so I'm not sure categorizing it according to the CIA triad adds any clarification. Also note that there are many alternative models such as the Parkerian hexad that give you a few more options to choose from.


Does UHF RFID implement any security at all? Feel free to correct my below logic.
As far as I can tell, HF RFID tags (specifically I've tested MiFare Classic 1kb) have a 48-bit encryption key (default to 0xFFFFFFFFFFFF or something) to protect their contents. A quick Arduino RFID reader I connected together showed me that indeed the blank cards I had purchased could be read, but an old Marriott key could not be. And in the code on the Arduino it did indeed have a customizable key.
From the limited amount of docs I could find on UHF RFID technology, it seems they do not employ this key system and instead everything relies on the serial number so to speak? Is this correct? I can't seem to find much at all in the name of the specifications for these cards at all - they are relatively new and stupid expensive to buy anything related to them. Or, do they in fact use a security protocol to protect unauthorized readers from interfacing with them.
I understand that "UHF RFID" is quite vast, and so if there's a specific protocol or vendor that's more popular and has information available that would be useful. I will be looking at TransCore tags in particular however I have not determined whether they function with other UHF readers or not.

The most common standard used for UHF RFID is EPC Gen2v2 (or ISO 18000-6C), also known as RAIN RFID. With the latest 'v2' iteration, the standard also includes security features including encryption of communication that are comparable to what you find in HF RFID standards.


what does "Rank" mean in msfvenom? In the screen output below from msfvenom when listing all supported encoders with -l encoders; what does "Rank" mean exactly?

The rank refares to the potential impact on the target and is defined by the author of the module. In the case of the encoders it is carried over from the ranking system used on exploits.
MSFVenom replaced the now deprecated MSFpayload and MSFencofe utilities. However the rank gradings did not change between versions.
In 2011's eighth printing of Metasploit The Penetration Tester's Guide the following paragraph outlines how the ranking system applies to encoders;

"... the x86/shikata_ga_nai encoder, the only encoder with the rank of
Excellent, a measure of reliability and stability of a  module. In the
context of an encoder, an Excellent ranking implies that it is one of
the most versatile encoders and can accommodate a greater degree of
fine tuning than other encoders."

The ranks are described as follows when referring to exploitals:

Every exploit module has been assigned a rank based on its potential
impact to the target system. Users can search, categorize, and
prioritize exploits based on rankings.
Ranking Description
ExcellentRanking  The exploit will never crash the service. This is the case for SQL Injection, CMD execution, RFI, LFI, etc. No typical
memory corruption exploits should be given this ranking unless there
are extraordinary circumstances (WMF Escape()).
GreatRanking  The exploit has a default target AND either auto-detects the appropriate target or uses an application-specific
return address AFTER a version check.
GoodRanking   The exploit has a default target and it is the "common case" for this type of software (English, Windows 7 for a desktop app,
2012 for server, etc).
NormalRanking The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect.
AverageRanking    The exploit is generally unreliable or difficult to
exploit.
LowRanking    The exploit is nearly impossible to exploit (or under 50% success rate) for common platforms.
ManualRanking The exploit is
unstable or difficult to exploit and is basically a DoS. This ranking
is also used when the module has no use unless specifically configured
by the user

GitHub


How to detect infected machines on my wifi? I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. Yesterday, our landlord got a message from the ISP stating that there is "a virus" on the network, and that there have been complaints about lots of spam going out to the Internet from our IP address. If the problem does not get resolved in one week, Internet will be cut off from us. He also said left a message to all of us to scan our systems with AVs and to send him scan logs but if the situation is that bad already, I believe that his approach will be of little help since AVs on these machines already failed to identify malware on the system.. And in case they don't even have any kind of protection, trying to install it now that they are already infected also won't be very useful.

So, I thought of offering my help to the landlord to help in locating machines that are infected and that send all this garbage out to the Internet. I don't have access to our network "infrastructure" at the moment, but I might be able to get it if I offer them my help.

My question is - what could I do to help him detect and locate the infected machines? Are there any tools out there that are made for the purpose of finding infected machines on the network? Should I maybe set up an IDS on my system and then look at what is trying to attack me? I know that I could use a vulnerability scanner to locate some stuff like Conficker for example.. Maybe Nmap? Other ideas?

I would prefer an approach where I could detect these machines from my own computer since our network is made from small home wifi routers and does not have the capability to do anything fancy. I also don't want (and don't have the time) to go to each and every tenant in our building to clean their computers from malware manually. I just want to find out who is infected so he could get taken off the network until he gets his machine cleaned.

One more question - if the solution involves scanning computers on the network, do you think I should ask for a written permission from our landlord that I am allowed to do the scanning?

Any ideas are welcome. Thank you.

edit: Regardless of will I be allowed to do this or not, I would be happy to see some possible solutions to this problem.

You say the ISP has detected large volumes of spam. So the easiest way to find the offending system is to monitor the outgoing line for connections to port 25. If you find a host that does a lot of those, then you've probably found the infected machine.

To do this, you would need to sniff right before or after the last router. You'll need cooperation from the landlord I'm afraid. Depending on the gear in front of the internet trunk, you could put a linux box in between with two network interfaces, that forwards and logs. You could also find other malware trying to spread.

Beware however, IANAL, perhaps you're invading others' privacy of you start poking around in their traffic. If you keep it at netflow data (src ip, dst ip, src port, dst port, time, bytes) however, you should be ok. And that should point out the spammer.


Why is the same origin policy so important? I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves it (like Google Analytics code), which means it can't modify the data or read the data on the domain that "includes the resource".

So if domain a.com is embedding a js file from google.com in its source, that js will run from google.com and it can't access the DOM\cookies\any other element on a.com -- am I right?

Here is a definition for the same origin policy which I can't really understand:

  The same-origin policy is a key mechanism implemented within browsers
  that is designed to keep content that came from different origins from
  interfering with each other. Basically, content received from one
  website is allowed to read and modify other content received from the
  same site but is not allowed to access content received from other
  sites.

What does that really mean? Can you please give me a real life example?

Another question is: what is the purpose of Origin header and how do cross domain requests still exist? Why doesn't it influence the security or the same origin policy?

Why is the same origin policy important?

Assume you are logged into Facebook and visit a malicious website in another browser tab. Without the same origin policy JavaScript on that website could do anything to your Facebook account that you are allowed to do. For example read private messages, post status updates, analyse the HTML DOM-tree after you entered your password before submitting the form.

But of course Facebook wants to use JavaScript to enhance the user experience. So it is important that the browser can detect that this JavaScript is trusted to access Facebook resources. That's where the same origin policy comes into play: If the JavaScript is included from a HTML page on facebook.com, it may access facebook.com resources.

Now replace Facebook with your online banking website, and it will be obvious that this is an issue.

What is the origin?

  I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves it (like google analytics code), which means it can't modify the data or read the data on the domain that "includes the resource".

This is not correct: The origin of a JavaScript file is defined by the domain of the HTML page which includes it. So if you include the Google Analytics code with a <script>-tag, it can do anything to your website but does not have same origin permissions on the Google website.

How does cross domain communication work?

The same origin policy is not enforced for all requests. Among others the <script>- and <img>-tags may fetch resources from any domain. Posting forms and linking to other domains is possible, too. Frames and iframes way display information from other domains but interaction with that content is limited.

There are some approaches to allow XMLHttpRequest (ajax) calls to other domains in a secure way, but they are not well supported by common browsers. The common way to enable communication with another domain is JSONP:

It is based on a <script>-tag. The information, which shall be sent to another domain, is encoded in the URL as parameters. The returned JavaScript consists of a function call with the requested information as parameter:

<script type="text/javascript" src="http://example.com/
     ?some-variable=some-data&jsonp=parseResponse">
</script>

The dynamically generated JavaScript from example.com may look like:

parseResponse({"variable": "value", "variable2": "value2"})

What is Cross Site Scripting?

Cross Site Scripting is a vulnerability that allows an attacker to inject JavaScript code into a website, so that it originates from the attacked website from the browser point of view.

This can happen if user input is not sufficiently sanitised. For example a search function may display the string "Your search results for [userinput]". If [userinput] is not escaped an attacker may search for:

<script>alert(document.cookie)</script>

The browser has no way to detect that this code was not provided by the website owner, so it will execute it. Nowadays cross site scripting is a major issue, so there is work done to prevent this vulnerability. Most notable is the Content Security Policy approach.


How to find the adware that shows pop up ads on my Android phone? If I have internet access, sporadically I see pop-up ads like the one below. I am trying to find the Android app causing them, but the recent button is not showing any app. Any tool I can use to find and remove the adware? I installed Kaspersky and it could not find the adware.

Two possibilities:

A background process (not an app, but started by an app) that is triggering ads. In this case you may not see the app itself in recent / running apps.
More likely, your ISP is triggering the ads. Airtel is known to have done this on and off (I've experienced it first hand), targeting specific circles and specific browsers. In my case, switching browsers solved it for sometime. If the ads are popping up when you're not browsing, you're situation is probably a bit different.


Check HMAC after completing decryption or before? I have written a piece of software that symmetrically encrypts big files (multi-megabyte). Plaintext is encrypted, after the encryption the HMAC is calculated and written into the header of the file. During encryption, I update HMAC continuously, using as input chunks of encrypted data (encrypt then MAC). There are no checksums on each chunk, so the only possibility to check whether encrypted file was compromised is read whole encrypted file, calculate HMAC of the whole file and compare it with the value stored in the header of the encrypted file.

My question: on decryption, is it better to authenticate encrypted data first and then attempt to decrypt, or proceed with decryption and at the end compare HMAC from the file header with actual HMAC of the encrypted data?

Here are my considerations:

1. Calculating HMAC before decryption attempt seems to me, at first glance, more "secure". On the other hand, I have to read whole file first, calculate and compare HMAC, and then read whole file ONCE AGAIN - this time to decrypt plaintext. This decreases performance - especially if input file is big, but we do not store possibly compromised decrypted plaintext on disk (or anywhere else), so if plaintext is compromised, general user can't access it AT ALL.

2. The other option is to decrypt file straight away, write decrypted output on disk, after whole file is processed calculate HMAC - if it is not equal to the HMAC value from file header, return "file corrupted" error and delete decrypted output from disk (since we consider it invalid). This mechanism increases overall speed of decryption process, since we read input file only once. On the other hand, if input file is compromised, we have written decrypted data on disk unnecessary - because, since HMAC comparison failed, they should be (and will be) deleted after HMAC check.

Does writing decrypted data from potentially tampered encrypted file compromises the security? How would it help to an attacker? As we suppose that the attacker know everything except password, he/she would be able to decrypt compromised file as described in option 2. But I am unable to tell whether this would help him somehow.

Otherwise, we suppose that secure, very long randomly generated passwords are used for encryption, the cipher used is also secure, the password authentication is done via KDF (PBKDF2, scrypt, whatever), so, as decribed above, my only concern is how to perform authentication properly.

EDIT: Please, do NOT answer like "you must first encrypt, then HMAC". The question is NOT about this. I always encrypt, then HMAC. The question is - should I HMAC, then decrypt or vice versa?

Thank you for your attention.

Obligatory disclaimer: If at all possible, don't implement your own crypto.

Verifying the validity of the decrypted file first and then decrypting it regardless of whether the MAC matches is the most secure way of doing this. After this, make sure that if any error occurs the same kind of error is always returned.

Disclosing any information on the reason of a failure is a serious security risk. For example if a bad MAC and bad padding in the decrypted file return different error messages a padding oracle attack can be mounted. Some padding oracle attacks, like lucky thirteen, only need to notice a difference in time in order to mount an attack on your crypto. This is why it's safest to always also decrypt the file regardless of MAC mismatch.

Depending on the crypto primitive and the mode of operation you are using different attacks should be considered.


How does stored procedure prevents SQL injection? May be I am not much clear about the stored procedure. Can someone explain me how stored procedure prevents SQL injection with a simple example using MySql.

Stored procedures are a form of parameterised query. The fundamental problem that causes SQL injection is data being treated as query language.

$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

In this example, if I set $password to foo' OR 'x'='x, we get this:

SELECT * FROM users WHERE username = 'blah' AND password = 'foo' OR 'x'='x'

Since the character 'x' is always equal to the character 'x', this query will always return rows regardless of whether the user / pass is correct. The database can't know that you didn't intend this, because it's only being given a string with no context.

In order to prevent this, you have to be able to know the difference between the query and the data. Stored procedures solve this problem by writing the query beforehand, with markers for parameters, so that data can be passed into them later. For example:

SELECT * FROM users WHERE username = ? AND password = ?

The database driver sends the name of this stored procedure (or, in standard parameterised queries, just the query text itself) and a list of parameters, as distinct separate entities in the protocol. This means that the database server can parse the query string as query language safely, and treat parameters solely as data, without any ambiguity.

I also wrote a longer answer a while back that explains all of this in a more verbose way, if that's any use to you.


Blocking Email Attachment download from outside company in Office 365 In Office 365, Emails can accessed from anywhere (within or outside of the company).
Want to block Email attachment download from outside of the company.
Emails should be accessible from outside of the company but attachments should be blocked to download from outside of the company.
This for protection.

You may be able to do this but the capability, I think, isn't available to every license SKU.

Unfortunately, I can't remember off the top of my head, the right part of the toolset but I think you can do this if you have "Enterprise Mobility & Security" which is an add-on license. You should also be able to do it if you manage your corporate devices via the InTune mobile device manager.


Secure a virtual machine during a lab exercise I recently started the Offensive Security AWAE course.
On their connectivity guide page, they warn about the hazards of connecting to their labs:

you will be exposing your computers' VPN IP to other students taking the course with you. Due to the nature of the course (and its participants!), your computer may be subjected to attacks originating from the VPN network. This is true even if you are located behind a NAT device.

I contacted them and asked what I could do to secure my PC (Windows 10 with the VMware VM, running Kali Linux), and their answer was, that I could "separate the IP segment of my VM with the host machine", but they couldn't help me regarding how to achieve that.
Can someone please help me finding information how to achieve that with the VMware VM?
How realistic is the risk that someone 'hacks' into my machine?
Are there other measures I can take to reduce any risks?

It seems you have ignored the very best advice by cutting your citation just before it:

Kali users, please change the default root password!

If there's no known vulnerabilities in the Kali version you are using, it's relatively safe to use – unless you gave access to everyone by using default (or otherwise guessable) credentials. If someone gets into the Kali, it's possible to move laterally to every computer the Kali machine sees, and it also has all the tools required already installed.
So, securing your computer/network from the Offensive Security AWAE course VPN has two sides:

Securing your Kali Linux.

From the Kali's Default Credentials documentation you can see that:

Kali changed to a non-root user policy meaning the installation is asking to create a user with a password and sudo is used instead of the former root:toor default.
Pre-created VMware images use default user kali:kali which should be changed!
If you are using a Vagrant image, the default is vagrant:vagrant and should be changed!

Use strong passwords that can't be easily brute-forced.

Disable SSH logins and use the Kali from the VM console.

Securing your network from the Kali.

If possible, you could dedicate an old computer for your Kali. It's not necessary to use Kali in a VM, if you are afraid someone might break out from the VM and compromise the host.

Use the Kali machine (whether it's a VM or dedicated hardware) on an isolated network segment that won't see other devices on your network at all. Configuring the network like this is out of scope on Information Security SE.


What is the purpose of EICAR? For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places.

Sometimes the AV solution is so far out of date, that its efficacy is basically zero.

  That leads me to question why have support for EICAR at all?  Is this test obsolete, and should it be removed?

To me it seems logical to extend that line of questioning with this:

  Would it be beneficial for EICAR to also test for the freshness of the AV update files?
  Perhaps effectively saying "Only trigger AV alerts if signatures are newer than x/x/x date"?

The purpose of EICAR is to provide a cross vendor file that will be detected as a virus. Why? Well, imagine you are building a web application that allows user uploaded content, for example. Into this solution, because you are security-conscious, you might want to scan the uploaded files and remove those files that are malicious before you spread them to other users in your userbase. Many antivirus vendors provide command-line executables and solutions that can do this; what you then need, as a software engineer, is something to test this construction with, either automatically as part of unit/functionality/UI testing or just plain old "did it work" testing.
Enter the EICAR test file - a file all virus vendors have agreed will produce a positive response. As the intended use page puts it:

Using real viruses for testing in the real world is rather like setting fire to the dustbin in your office to see whether the smoke detector is working. Such a test will give meaningful results, but with unappealing, unacceptable risks.
Since it is unacceptable for you to send out real viruses for test or demonstration purposes, you need a file that can safely be passed around and which is obviously non-viral, but which your anti-virus software will react to as if it were a virus.

My understanding is that you do not use the EICAR test file to audit the status of your antivirus products and how up to date they are; you use them to test, in integration scenarios, a case where malware exists without using real, actual malware.


How can encrypted traffic bypass the Great Firewall of China when it is being blocked? The Great Firewall of China is controlled by the government and has put in place a "learning algorithm" to block unapproved encrypted traffic.  The only way to get encrypted traffic through the firewall is to get it approved from the government.

Here is a link for more information.

What sort of approaches are already out there to circumvent this?

Are there any theoretical approaches that can circumvent this?

You might use low-bandwidth sidechannels. For example, one could set up a site offering pictures, and the site could sport a "thumbnail wall". HTTP protocol allows for requesting those thumbnails in any order, which means that using twenty pictures you can encode up to 20! (i.e., around 60 bits) in the request scheme. There is no way of detecting or blocking such a scheme short of computationally unfeasible statistical analyses, proxying with request order randomization, or HUMINT of course.

A more easily detectable scheme, with more bandwidth, allows encoding information in ETag and Proxy headers.

Then, one could try more cloak-and-dagger schemes: for example one could bounce ICMP packets with faked source address against a trusted (by the government) host. This kind of malicious activity is apparently not (yet) deemed dangerous, and several firewalled hosts will blissfully bounce back the ICMP packet towards the apparent source, thereby penetrating the firewall.

Then again, incredibly, the Great Firewall of China doesn't seem to care about spam. You'd be surprised at the quantity of unsolicited commercial emails, often containing bulky images, reaching the rest of the world from China. Probably, any sufficiently asymmetric traffic towards port 25/tcp is considered symptomatic of the presence of a Chinese criminal, and the firewall has other priorities. Thanks to some helpful spammers in Guangdong, I can confirm that sending back up to 1 Kb encrypted, compressed and base64-encoded error messages has no effect whatsoever, and the incoming connection keeps requesting relay for more and more spam, which is accepted (and discarded). This channel appears to be capable of about 64 kbit bidirectional.

All this requires encapsulating VPN traffic into different protocols, similar to what Haystack did. Other solutions exist - e.g. FreeGate -, but of course the more widely known they are, the faster Golden Shield is going to (try to) bust them. Simpler strategies aimed at defeating a firewall could just entail obfuscating an existing protocol using one-time pad and supplying rapidly changing external endpoints (that's what the ultrasurf utility did), and betting that you can come up with more obfuscations, and quicker, than the GFC people can come up with fixes.

The risk there, though, is that the GFC switch from "blacklist" to "whitelist" operation: first mowing down the traffic to manageable sizes, then actively rewriting rather than rerouting all known protocols, enforcing strong grammar checks and anomaly detection. For example, refusing HTTPS and TLS unless you accept a nonmatching, GFC-generated certificate to allow man-in-the-middle SSL decryption (claiming that this "does not limit responsible citizens", unless "they have something to hide"), and otherwise refusing all packets that it does not fully understand. This is more or less an answer to Ai Weiwei's statement, that the only way to control the Internet is to shut it down. And the answer would be "Well then, how about we do just that".


Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID"

I know that not good to have clear text password in scripts (there is no alternative at the moment). But question

is the username and password transmitted over network securely encrypted?
is the SQL code transmitted over network securely encrypted?
is the Data transmitted over network securely encrypted?

It depends on your configuration. Oracle supports TLS as part of its protocol and data drivers, so it can authenticate and communicate entirely over TLS (SSL).

Whether or not this is enabled by default depends on:

Which version of Oracle DBMS you're using.
Which data driver you're using.
The version of the data driver.

I'm not sure whether it's possible to authenticate via TLS and do the rest of the communication in plaintext, but I doubt it - it wouldn't be very secure.


Where can I find a description list for major vulnerabilities? I'm looking for a description list for major vulnerabilities such as SQLi, XSS etc.

The format should be like this:

  Short Description:
  Description:
  Impact:
  Solution/How to prevent:
  References:

Since you mention SQLi and XSS, this seems to be primarily about web vulnerabilities. In that case, take a look at OWASP.

If you're asking this from a developer's point of view, you will be especially interested in their Cheat Sheets. For example, here is the XSS Cheat Sheet.


Snort, add TCP retransmission rule Can somebody help me with adding rule for packet retransmission.

I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission catches the original packet .

These are the packets for which I am trying to add the rule

This is the rule which suppose to catch the retransmission but also catches the original packets.

alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected"; classtype: attempted0recon; sid: 999999)

Also, just for the sake of comparison, I want to try both rules to be mutual exclusive.

Thank you

Unless you've added a new custom attack class in your classification.config file with the name attempted0recon, there isn't any such class in Snort by default. There is however a class named attempted-recon.

You have also not set any additional filters for which the message "SSH retransmission detected" should be reported, so your example would read as:

  Alert with class attempted0recon and message 'SSH retransmission
  detected' any inbound TCP connection to <destinationAddress> port
  22 originating from any remote address and port.

I didn't write it in exact order, as that would make it utterly unreadable, but the general Snort rules form is:

action proto src_ip src_port direction dst_ip dst_port (options)

Your rule could thus read like this:

alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected";
                                              content:"TCP Retransmission";
                                              nocase;
                                              classtype:attempted-recon;)

for your rule in the example you provided. Since the other (first packet) rule can't depend on any payload contents (as I don't see any in your printout), you could for example use dsize keyword in the options part to identify them by their size and/or other non-payload detections:

alert tcp any any -> <destinationAddress> 22 (msg:"SSH key exchange";
                                              dsize: <518;
                                              classtype:tcp-connection;)

Obviously, you could adopt these to suit your needs better and they are just examples.


Is it possible to take an image of the firmware of HDD and SSD? I suspect that both my HDD and SSD may be infected. Is it possible to take an image of the firmware? How do I go about doing it?

There is a standard to write firmware, the ATA DOWNLOAD_MICROCODE command and the segmented version (transfer protocol 3), but there is no standard for reading the firmware back. As another answer says, some manufacturers may add their own vendor-specific techniques to do so.
There is another reliable way to access firmware, but it cannot be done from software. Opening the drive to see the controller will expose the firmware chip (flash or EEPROM) which can be read directly using specialized hardware designed to interface with the chip, such as a SPI reader. Sometimes, the controller chip has internal flash, meaning there is no external chip to read, which would mean attaching a JTAG probe to the chip is the likely solution to obtaining the firmware.
There are two excellent resources showing what it takes to read the firmware so it can be modified and replaced which I know of. Specifically, an incomplete (?) write-up on HDD firmware-based MBR rootkits from Malwaretech and the classic Linux port to an HDD by SpritesMods. An image from the latter showing the flash chip which you'd need to directly interface with to read is below.


Why fingerprint a browser if a fingerprint can be replayed? I'm facing an issue with rampant scraping and abuse on a website that costs me a good chunk of money to maintain. So, I have been looking to implement a few solutions, and apparently these solutions fingerprint the client in some form.

However, the premise of fingerprinting seems problematic to me. Since fingerprinting involves a series of tests run on the browser which are then submitted to a server, it would be trivial to capture parameters involved with a good fingerprint from a browser, and submit them to the server each time such fingerprinting is attempted, thereby making it nearly useless.

Is there a reason why browser fingerprinting would work to detect a bot when it can be easily subverted?

Passive fingerprinting can easily be faked, and it is trivial to code responses that can pass passive fingerprinting. And yet, it can still work because not every bot includes this feature because not every target fingerprints. It's a pure cost/benefit scenario.

Active fingerprinting takes more complex coding to spoof, and not all bots have the facility (or space) to include this level of deception and do it effectively.

Security controls are based on a concept of risk. You employ a control to bring the risks down to an acceptable level (risks cannot be eliminated entirely). So, given the threats you face and the impact you want to prevent, can the given control reduce the risk? That's the question.

Since the threats (bots, in your case) at this point in time do not often include fingerprint deception, then passive fingerprinting can have a positive effect on your risks. It doesn't matter what the threats could do in the future or what they could be doing now but aren't.

"But what if bots get really good at deception?" Then you need to re-assess the risk at that point. But you cannot then make the leap to conclude that the control has no value now. Controls are effective against specific risks in a threat scenario. Just because they might not be effective in other risk contexts does not make them poor controls. There is no silver bullet.