How long is the information on Facebook stored? I was wondering how long Facebook stores our photos and posts?

I hear two theories, one saying it is around half a year, after which all the data centers are going to erase our data. The other one says never (more conspiracy theory, however maybe not so abstract, there is no guarantee).

So what are the facts, or the most precise approximations?

If your account is active, deactivated or in remembrance mode after your death, it stores all your data indefinitely.
If you delete your account the information should be deleted within 90 days.

  When you delete your account, people won't be able to see it on Facebook. It may take up to 90 days to delete all of the things you've posted, like your photos, status updates or other data stored in backup systems

Although there are some exceptions to this rule.

  Some of the things you do on Facebook aren’t stored in your account. For example, a friend may still have messages from you even after you delete your account. That information remains after you delete your account.

It should be noted however that Facebook isn't the most transparent of companies and they change their terms of service regularly. In addition any data that Facebook hands over to 3rd parties will probably not be covered by any of their own data retention policies.

This artical suggests that pictures will be deleted within 30 days. It is also explains some of the nuances behind Facebooks data retention policies.


can XSS attacks be nullified by prepending a backward slash to all external links? In my website I noticed my developers had set it up so certain form data was past from the URL to the content of the website. E.G

?email="email"

The obvious vulnerability means that I can put ?email="XSS vector" in the domain and XSS Vector would be displayed in the email field.

Another was that when only one form data was present extra data could be added to the end of the url. e.g

?email="email" XSS vector

I told the developer about this vulnerability and they told me that the website was secure as all text is sanitised. For example, if I was to add an external link or file through the url

?email="email"  <script src="https://myscripts.js"></script>

what is rended in html is

<script src="\"https://myscripts.js""></script>

And the link leads to

https://mysite.com/\https://myscripts.js

Which means that the script can only be loaded if it is located on my domain.

However I only know basic HTML, JS. So can't verify myself if this is safe.

I would prefer this not to happen at all but don't have the skills to rectify it myself. But if I do have it like this I need to know it is secure.

No, this is not enough.

An attacker does not necessarily need to call an external script. They can dump the payload directly into the inline script too. Depending on the length restrictions in place, this can become quite tricky, but still manageable.

The main takeaway from this is that custom-made solutions are not very secure. Every now and then I see people trying to ask if their new ingenious solution just stopped all XSS, CSRF, SQL Injections, etc...

The answer to all of these questions is no. XSS Protection is a problem that has been solved already, with proper output encoding and additionally possible input validation.

This means that every output needs to be encoded for its intended destination. Don't do this yourself either, but use a framework or library which provides this for you.

Input validation verifies if input is in the expected format. For example, if you expect an email address, RFC-822 offers a very large regex, which is guaranteed to validate all standard-conform email addresses. Is this overkill and unnecessary? Probably. But for simpler things like numbers, you can implement input validation in addition to output encoding:

if (input.matches("^(0|[1-9]\d*)$"))
{
    // "input" is a valid integer
    return true;
}
else
{
    // "input" is not a valid integer
    return false;
}

This example code would allow all integers without zero-prefixes. Any other input will be rejected.

Summary

Never use your own custom method to implement security! This is the golden rule of security and breaking it will get you hacked.
Use output encoding for the target context! If untrusted data is written into the DOM, then encode it for the DOM. If it's written for an attribute value, then encode it as attribute value. Encoding is the only way to be sure.
Optionally use input validation alongside output encoding! By ensuring that input is what you expect it to be, you can save yourself multiple headaches down the line.


How to convert IBM Domino SSL keys (private key) to the OpenSSL format? I have a customer with an IBM Domino server. They offer a way to export SSL keys but in a weird proprietary format. Any idea on how to convert those to OpenSSL?

Basically I need to upload this key to an intermediate device that will do inspection and security. If I can bring it to OpenSSL, I'm golden.

If you are referring to the .kyr format, you can use a tool thats part of websphere called iKeyman (ftp://ftp.software.ibm.com/software/lotus/tools/Domino/gsk5-ikeyman.zip).

A quick overview of what you need to do can be found here: http://labs.groupwave.be/index.php/2009/08/31/exporting-kyr-certificate-for-apache/


Internet of things is what exactly? I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm?

It is a thing, and its connected to the internet.

The Internet of Things is a pretty vague definition which covers an emerging collection of items that can be assigned an IP address and connected to the internet.

Typically, up to this point, the Internet has consisted of servers, routers to interconnect everything and endpoints such as computers, mobile devices, remote SCADA devices and other business related things you might want interconnected, etc.

The IoT just expands that to refrigerators, remote controlled beer kegs, flashing light displays, cameras and any old thing that you decide to concoct that you want remote access and/or control including your local nuclear plant.

The big issue is that things like remote WiFi connected Barbie Dolls have a certain price level that they can be produced at, and so as is often the case, all attention to security is thrown out the window as an excessive added cost. Something I might add, that you don't want happening when you've included internet connected industrial process control into the IoT.


Understanding how my google mail account was hacked My google account was compromised recently, and I'm trying to go through all details to understand how. Maybe you guys have ideas.

I discovered a few days ago that my gmail account had the following settings:

Filters to automatically delete certain incoming messages
IMAP setup
Application Specific Password (not sure when created, Google does not tell me)

I have a strong password that I use for google kept in a password manager. I also use 2FA on this account. In addition, I access my account through a Linux machine and a windows machine that run Malwarebytes. I have not seen any warnings or notifications of malware on those machines. The browser is Google Chrome, but uses a limited set of addons. I have not installed any new plugins for months.

My theory is that something I did allowed an application specific password to be created in the Google account. I recall about a week ago using single sign on to access a new site that I now think was very sketchy. During this time, I noticed that I should probably not use single sign on for my main account. Instead, I created a temporary fake gmail account to perform the single sign on, and I used that instead. Keep in mind that I maintained the browser session with my main google account, but the permissions were given for the fake account.

Is it possible that using single-sign on (even with a different account) can add an ASP to my main google account just because I had a browser session opened at that time? Are there any vulnerabilities in single-sign on that I need to be aware of here?

Based on the information you've provided I can make the following notes:

  I discovered a few days ago that my gmail account had the following
  settings:
  Application Specific Password (not sure when created, Google does not
  tell me)

Adding an Application Specific Password requires you re-authenticate, even in an existing session. This has me believe that the attacker who made these changes, either had your password, or had access to your machine and just used the password manager to fill in the password fields.

Go to Account Security and check Recent Security Events to review any suspicious activity. This will tell you when that Application Specific Password was created. It will say "Password allowing app to access account created" and the date and location. With that information, you may be able to identify where you were when you were hacked and figure out if your machine could have been vulnerable.

Check also, Third-party apps with account access to see who has access to what.

  I also use 2FA on this account.

The most likely explanation is still that your machine had an existing session open so the attacker would not need to 2FA. Otherwise they would need to have access to your other 2FA device as well.

  I recall about a week ago using single sign on to access a new site
  that I now think was very sketchy....I created a temporary fake gmail
  account to perform the single sign on, and I used that instead....I maintained the browser session with my main google
  account, but the permissions were given for the fake account.

Was there a redirect to Google for the sign in? Can you remember if you verified the url was Googles? Many phishing attempts use a 'real' looking auth page to grab your creds. The url is a giveaway. Your 2FA setup should squash any attempt to login using the creds though (good work having 2FA!)

  Is it possible that using single-sign on (even with a different
  account) can add an ASP to my main google account just because I had a
  browser session opened at that time?

Not likely. It is possible you thought you were authenticating using the fake account but were in fact using the main account. Check your Google activity here:  My Activity and confirm.

  Are there any vulnerabilities in single-sign on that I need to be aware of here?

Not impossible but not the most likely explanation. But no, no known vulnerabilities of Google's Sign In that are relevant here.

Using the resources I pointed to:

https://myaccount.google.com/security
https://myactivity.google.com/myactivity

you should be able to answer a few of your own questions (or it may result in more questions!)


What defines a Secure Audit Log as such and how do you implement it? What features would you expect from a secure audit log?
Is there more than not being able to change it and make sure you know who wrote it?
You do that by hashing the previous entry and signing the log entry?
Do I miss anything here?

We are talking about a server application that should be logging financial data that can not be tampered, so that everything relevant can be reconstructed.

In order to have a secure audit log, think of integrity and availability, two characteristics of security per the security CIA triad.

Integrity of audit log

All data written to the log, once written should be Read Only.. The data should NOT be able to be modified by any user if the log is to be trusted for forensic purposes. Access to the audit logs should be strictly controlled on a need to know basis, per security rule of Least Privilege. Ideally, the audit log is stored in a secure location such as a dedicated logging server. Write access needs to be restricted to only the minimum number of users, such as only users in a certain Active Directory group. Read access should be restricted in a similar fashion.
To detect changes in a log, a cryptographic hash function can be applied to previous log entries, so that any tampering will alter the hash and render impossible tampering not to be detected.

Availability of audit log

Audit log data should be retained for a specified period of time depending on the data sensitivity classification of the underlying source where logs are generated from. Backups of logs should ideally be stored offsite, so that if a disaster strikes, backups of such logs are not destroyed as well.

If logs are stored centrally on a logging server, tools such as client rate limiting, packet filtering can be used to mitigate DOS or DDOS attacks.


Can VeraCrypt encrypted volume be tampered with? Reading on the security of Borg backups and both encryption and authentication is used (Encrypt-then-MAC).
My understanding is authentication is used to prevent tampering which is especially important for backups vulnerable to unauthorized access (cloud storage or safety deposit boxes for example).
Reading on the security of VeraCrypt (which uses XTS), I can’t find anything about authentication.

XTS mode is susceptible to data manipulation and tampering, and applications must employ measures to detect modifications of data if manipulation and tampering is a concern: "...since there are no authentication tags then any ciphertext (original or modified by attacker) will be decrypted as some plaintext and there is no built-in mechanism to detect alterations. The best that can be done is to ensure that any alteration of the ciphertext will completely randomize the plaintext, and rely on the application that uses this transform to include sufficient redundancy in its plaintext to detect and discard such random plaintexts."

Can VeraCrypt encrypted volume be tampered with?

Yes it can.
This is very easy to verify for yourself:

Create a small veracrypt container of 300 KBytes.
Place a known file or files in the container.
Close the container.
Using a hex editor, edit a few bytes of the closed encrypted container (avoiding the header section).
Open the edited container with Veracrypt.

Depending upon the luck of the draw, you may see absolutely nothing upon opening the edited container, or you may see something bizarre. In either case, Veracrypt likely did not complain.


Evaluation board for side channel attacks I have started working on side channel attacks particularly focusing on DPA and DEMA for different cryptographic algorithms; targeting FPGA devices. I want to measure the power and EM radiated out of FPGA while crypto algorithm is running. In order to achieve the purpose, one way is to add circuitry to the existing FPGA boards and other is to work with ready made evaluation board that is already designed for side channel analysis. Definitely that is going to save me time and I can focus on my research thing. I want to go for option 2 without getting into electronics stuff. Now, I have found these; DPA workstation, Inspector, SASEBO (SAkura), FOBOS and Chip Whisperer.I want evaluation board for my student level research project and for obvious reasons, it should not be expensive. Below are my Queries regarding selection of evaluation board for side channel analysis.

I am looking for a cheaper solution that can be used for side channel analysis providing same facilities as SASEBO. I have seen FOBOS and Chip Whisperer. Though I am unable to find proper support for former one while later one has alot of documentation and variety of boards available. If I go for chip whisperer, will the connectivity be smooth for CW1173 ChipWhisperer-Lite and Xilinx Virtex-7 board?
Is there any other such (low cost) side channel analysis specific evaluation board having Virtex-7 for student level project?
If I go for SASEBO(which is quiet expensive), Can I change the crypto algorithms on Kintex of SASEBO GIII(now known as SAKURA-X)? Can it easily be customized according to my requirement?

If looking to use off-the-shelf boards, you can potentially use the H-Field probe solution. See https://wiki.newae.com/H_Probe_Usage for an example of H-Probe usage, there are lots of standard COTS probes/amplifiers around.

We've also got a FPGA target board that "just works" with ChipWhisperer, see https://wiki.newae.com/CW305_Artix_FPGA_Target . It's similar to various other FPGA boards, it's using Artix 7.

Any of the FPGA boards let you customize the crypto, of course though it may be some work to implement your algorithm.


Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure? I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user authenticates at Google login page, my OAuth2 library gets his/her email address from Google's profile API and I use that email address to mark him/her in my application as authenticated (logged in) by sending him/her a signed authentication token for future authorized requests. My question is this model safe and secure? Would it be possible for an attacker to get authorized in my application by tampering the Google response by injecting a custom email address inside the Google Profile response? Is it safe to rely only on the email address obtained by calling Google Profile API? Any additional security measures can be taken?

It should be ok. It sounds like you are implementing OpenID which is built on top of OAuth.

When the user authenticates to Google a token is passed back to your application via a redirect performed by the user's browser. This could be viewed or modified by the user or by anyone who can intercept the request ie a corporate proxy server performing https inspection.

When your application receives this token it sends it on to Google who verify that it was issued to your application and returns the user data you refer to. This can only be intercepted if your connection to Google is man-in-the-middled, something that is a lot less likely.


Will using a self-signed SSL certificate on a mail server hinder communication? According to this ArsTechnica article, using a self-signed certificate on a mail server is a bad idea:

  When we set up a Web server in our previous series, getting SSL/TLS
  working was a recommended but optional step. However, it is most
  definitely not optional for this guide: you must have a valid SSL/TLS
  certificate for your mail server. "Valid" here means "issued by a
  recognized Certificate Authority (CA)," not something self-signed.
  Using self-signed certificates to identify your mail server to other
  mail servers is a great way to get other mail servers to refuse to
  deliver your messages. Then your mail server would be lonely because
  none of the other servers will want to talk to it, and that would be
  sad. You don't want your server to be sad, do you?

Is this actually true? Will other mail servers really refuse to interact with a mail server that uses a self-signed SSL certificate? If so, which ones? Or is this true of almost all common mail servers?

You're fine with a self-signed certificate.

In my experience over several years, I never had any problems with a self-signed certificate on my mail server.  I eventually switched to one signed by StartSSL and there was no discernible difference in interoperability.

See also this post on ServerFault.

The bottom line is, STARTTLS is about encryption, not authentication.  While it can be locked down to perform authentication, the default of most (if not all) SMTP servers is opportunistic encryption.  SMTP is plaintext by default, and needed encryption more than it needed authentication, thus the emphasis.

It is possible to lock down connections - for example, I've seen an Ironport configured to require a valid certificate signed by a known CA it liked (in this case, it liked Entrust but not Comodo, so we ended up changing the cert because it was easier than debugging somebody else's Ironport).  But that's for locking down specific domains which want to ensure partnered encryption, I've never seen someone doing that with opportunistic encryption.


x509 restrict the intermediate CA to sign only end user certificates I am trying to restrict the intermediate CA to sign only end user certificates. However, I am not able to do so.
Man page of x509v3_config says

basicConstraints=critical,CA:TRUE, pathlen:0
A CA certificate must include the basicConstraints value with the CA
field set to TRUE . An end user certificate must either set CA to
FALSE or exclude the extension entirely. Some software may require the
inclusion of basicConstraints with CA set to FALSE for end entity
certificates.
The pathlen parameter indicates the maximum number of CAs that can appear below this one in a chain. So if you have a CA with a pathlen
of zero it can only be used to sign end user certificates and not
further CAs

Step 1: Create a self signed root CA - rootCA.crt

openssl genrsa -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key -sha256 -out rootCA.crt

Step 2: Create a Certificate signing request using below configuration file.

openssl req -new -config extension.conf -out intermediate.csr

[ req ]
 default_bits       = 4096
 default_md         = sha256
 prompt             = no
 encrypt_key        = no
 default_keyfile    = privkey.key
 distinguished_name = req_distinguished_name
 req_extensions     = v3_req

 [ req_distinguished_name ]
 countryName            = DE
 stateOrProvinceName    = Bayern
 localityName           = Munich
 0.organizationName     = Test AG
 organizationalUnitName = Services
 emailAddress           = services.dept@test.de

 [ v3_req ]
 basicConstraints       = critical,CA:true, pathlen:0
 keyUsage               = keyCertSign

The CSR is generated now
Step 3: Now sign the CSR with self-signed root CA with support from extension file

openssl x509 -req -in intermediate.csr -CA rootCA.crt -CAkey
rootCA.key -CAcreateserial -extensions v3_req -extfile file.txt -out
intermediate.crt -sha256

file.txt
[ v3_req ]
 subjectKeyIdentifier   = hash
 authorityKeyIdentifier = keyid:always

Now intermediate certificate is generated.
Step 4: Create one more intermediate certificate and lets call it TEST certificate - using sightly modified configuration file as below:
[ req ]
 default_bits       = 4096
 default_md         = sha256
 prompt             = no
 encrypt_key        = no
 default_keyfile    = privkey.key
 distinguished_name = req_distinguished_name
 req_extensions     = v3_req

 [ req_distinguished_name ]
 countryName            = DE
 stateOrProvinceName    = Berlin
 localityName           = Berlin
 0.organizationName     = Dummy AG
 organizationalUnitName = Product
 emailAddress           = product.dept@dummy.de

 [ v3_req ]
 basicConstraints       = critical,CA:true
 keyUsage               = keyCertSign

Generate the CSR

openssl req -new -config test.conf -out TEST.csr

Sign the CSR with intermediate.crt which should not be possible.

openssl x509 -req -in TEST.csr -CA intermediate.crt -CAkey
privkey.key -CAcreateserial -out TEST.crt -sha256

As per the man page of x509v3_config, signing of the TEST.csr should fail as it is not the end user certificate.
The pathlen is 0 in my intermediate certificate. So I shouldn't be able to sign the TEST.csr. What am I doing wrong here? Can some one please kindly explain?

First, if you look at the cert you created in step 3 with openssl x509 -text <intermediate.crt you'll see it doesn't have any BC extension (nor KU either). This is because creating a cert with openssl x509 -req -CA/CAkey does not use any extensions (more exactly, requested extensions) from the CSR. See Missing X509 extensions with an openssl-generated certificate https://serverfault.com/questions/845806/how-to-issue-ssl-certificate-with-san-extension https://superuser.com/questions/862838/s-mime-for-mac-and-ios .
But even if you fix this, OpenSSL mostly doesn't check the certificate when it does a privatekey operation, except in the SSL/TLS protocol (which requires full checks). (And in one case, smime|cms -encrypt, it apparently doesn't check even on a publickey operation.) The man page might more accurately say a CA cert with pathlen=0 can only validly sign leaf certs, not other sub-CA certs: OpenSSL, with either openssl ca or openssl x509 -req -CA [-CAkey] will actually sign a cert that violates pathlen (or even CA=false!), but if you subsequently use that cert in most cases it will fail validation and be rejected.


smtp port 25 connect failed If I take any host from

https://www.arclab.com/en/kb/email/list-of-smtp-and-pop3-servers-mailserver-list.html

why I'm not able to telnet to any of the specified ports ? I'm getting:

"Connecting To pop.1and1.com...Could not open connection to the host, on port 995
: Connect failed"

When I try to telnet on port 25 to SMTP Server mail.o2online.de  port   25 I can see in Wireshark that the server responds with an RST/ACK packet so the port must be closed, so how can one send e-mails when it is closed?

thanks

My guess is that you are behind some firewall which is blocking the connections. I have no problems in accessing these hosts.

  how can one send e-mails when it is closed?

If you are behind some company firewall you are probably supposed to use the companies internal mail server only which is usually not blocked.


How do apps tell if there is a problem with ssl? Email clients and other software use ssl. But what if someone is doing a mitm with sslstrip? how can i tell?

sslstrip works by changing all https links to http. It is restricted to HTTP but tools for other protocols might exist or at least are easily doable. These kind of tools don't break the TLS connection but instead enforce a downgrade to an insecure unencrypted connection.

How good these kind of tools can work depends a lot on the application and on the protocols used. With IMAP, POP3, SMTP, FTP and probably others there are two ways to use TLS:

Implicit TLS: In this mode the client connects via TCP and then immediately upgrades the connection to TLS. This is done on different ports (i.e. 993 instead of 143 for IMAP) and on these ports only TLS is expected. Thus there is no way for a man in the middle to strip the usage of TLS, all it can do is to deny usage of these ports which might cause some applications to downgrade to explicit TLS.
Explicit TLS: In this mode the client connects via TCP and after some plain text communication it upgrades the existing connection to TLS by issuing a STARTTLS or similar command (STLS with POP3, AUTH TLS with FTP). If there is a man in the middle (s)he might modify the communication so that the client assumes, that TLS is not possible. The behavior then depends on the client and sometimes on its configuration: some clients will silently use the plain text connection while others will throw an error because they expected to use an encrypted connection.

And even if this is outside of your original question: if a downgrade to plain unencrypted communication is not possible the attacker might try to use tools like sslsplit to do a man-in-the-middle attack against TLS itself. There are still lots of applications vulnerable against these kind of attack (see VU#582497) because they fail to validate TLS certificates at all or omit critical parts of the validation like checking the host name. Thus in lots of cases a TLS man-in-the-middle attack is possible without the user detecting it.


Is it possible for someone to send a spoofed text message via iMessage to my iPhone4? After the reports of the SMS spoofing security issue Apple released a statement claiming that the iMessage system was 'secure' and should be used to prevent text spoofing. I have received several harassing SMS spoof text messages recently and yesterday I actually received one of the harassing messages via iMessage from a phone number with area code matching my area.

So, is it possible that they sent a spoof text over the iMessage system or was this particular message sent from a legitimate number and iPhone user?

It would "show up" in your iMessage but as an sms. So the background color would be green/alternative/grey to what it is normally when going through apples servers.


How does hacking work? I am specifically talking about web servers, running Unix. I have always been curious of how hackers get the entry point. I mean I don't see how a hacker can hack into the webpage when the only entry method they have into the server is a URL. I must be missing something, because I see no way how the hacker can get access to the server just by changing the URL.

By entry point I mean the point of access. The way a hacker gets into the server.

Could I get an example of how a hacker would make an entry point into a webserver? Any C language is acceptable. I have absolutely no experience in hacking

A simple example would be appreciated.

Hacks that work just by changing the URL

One legit and one malicious example
Some examples require URL encoding to work (usually done automatically by browser)

SQL Injection
code:
$username = $_POST['username'];
$pw = $_GET['password'];
mysql_query("SELECT * FROM userTable WHERE username = $username AND password = $pw");

exploit (logs in as administrator without knowing password):
example.com/?username=Administrator&password=legalPasswordThatShouldBePostInsteadOfGet
example.com/?username=Administrator&password=password' or 1=1--

Cross Site Scripting (XSS)
code:
$nickname= $_GET['nickname'];
echo "
Your nickname is $nickname
\n";

exploit (registrers visiting user as a zombie in BeEF):
example.com/?nickname=Karrax
example.com/?nickname=


Login system using permanent "random" hashes in URLs I am working with a company and have found the following:

When a user registers, they make a "random" hash.  This "random" hash often has collisions and has to be regenerated to keep the hash unique in the database.

There's also a feature that lets you log in automatically. This works by having the hash be part of the URL. This means the hash is also stored in access logs. This can happen with full access to regular users and even some admin users.

Links are actively used throughout the site to switch between sections of the site, these links are also sent out in emails all the time.

The hash never changes, and once you are in, you can view a person's name, e-mail, DOB, payment history (but not credit card number) and make any change you want to the account. Again, hashes are never invalidated and can be reused an infinite number of times.

Many of the engineers feel this is fine and don't want to change the system because it's too much work, and think that it's secure enough.

I am arguing this is a 10 alarm fire that has to be addressed as soon as possible.

What are your thoughts? Am I overreacting to this?

First things first: That sounds horrible. Seriously.

  When a user registers, they make a "random" hash. This "random" hash
  often has collisions and has to be regenerated to keep the hash unique
  in the database.

How can this even happen? If the hash has collisions on a regular basis you simply don't have the correct hash for the job. What kind of hash is it? And why don't you use just any available hash that is considered secure e.g. something like SHA 256?

  There is a login link that if you access, with the hash placed in the
  url, you are auto logged into the account. This means the hash are
  also stored in access logs. This can happen with full access to
  regular users and even some admin users.

This means that you are actively storing plaintext information in logs and in emails and sending them (likely in plaintext, bc. email) over the network. This is a terrible idea for a number of reasons. And (at least partially) it sounds as if you were recreating some sort of SSO or reinventing sessions using information stored in the users browser.

If it really as it sounds the answer to your question is: Yes. It should be fixed. Better now than later. Also: You might want to think about security design. This clearly sounds as if there has been no proper design of authentication and session-handling. You should address those topics before the first line of code is written.


DoS anomaly-based detection: simplest approach beside simple threshold As I learned, there is this technique in which the number of bytes/packets/frames of aggregated traffic is being checked to see if they deviate from a normal behavior. Then the time slot of that anomaly is searched for if there is any DoS attack within and or for flows that caused the problem (root cause analysis).

Could you suggest a paper that does the first part, to detect anomaly (DoS,..) by checking its deviation from normal behavior.

I know simple threshold would work, but i want to know the next best idiot approach to understand better myself and implement it before heading toward wavelet and kalman filter!

I'd think the next best thing to a simple threshold would be to have some more intelligent resets in your threshold counting.  Certainly things like constantly repeating or nonsensical packets should trigger a warning sooner.  Out side of that, a lot depends on if you are worried about DoS or DDoS.  I don't know that you could do much better than a well defined threshold for simple DoS.  DDoS would require actually comparing normal traffic to current traffic and looking for differences in the patterns they fit.  That gets far too complicated for an answer here really quickly though looking in to things like Baysian filtering might be another possibility in addition to the wavelet and kalman filtering you mentioned.


Checking if apk's contain malicious software Is there a programmatic way to check if a given mobile application executable is malicious through some sort of lookup service?
I have used Virustotal for desktop malware, does it work for mobile malware as well? Are there other standards for this sort of thing?

Virus Total has malicious APKs as well, I'm sure you're aware of how to use their API if you've used them for desktop. You might also use Anubis.

Example:

https://www.virustotal.com/en/file/23a6384fc22e1dc10e49223292415c91cb7fc4540f7feae86c61165420009af7/analysis/

To declare an apk malicious that requires actual analysis. Some good resources to get started there might be Santoku or ARE.


How secure is using your fingerprint for password against opportunist thieves? If someone has access to your fingerprints then using your finger print as a password on your phone or other device is obviously compromised. But assuming they do not have access to your finger prints, are there any known or potential security concerns?

For example:
How unique and complex is a fingerprint compared to a password?
Can an average hacker with full access to your phone try guessing "passwords" that represent your finger print?
Are fingerprints easily recoverable from the cases of phones?

assuming they do not have access to your finger prints

I belive this assumption is wrong. Fingerprints can be extracted from many things you touch or even from photos.

But let's assume "they" can't do that:

A password is digital. It is exact. If your password is "IiL1l", its trivial to check that it isn't "1iLlI".
Fingerprints are not digital. Every device that validates your fingerprint is only able to compare the scan you make to some model how your fingerprint looks.

This sounds like no big deal, but this has huge consequences. For encrypting things, passwords are converted into keys (using something called a key derivation function). If you change just a single letter of your password, a entire different key is derived. The key is never stored on the device. Every time you decrypt something, the key is derived from your password again. The key is not stored anywhere. Because your password is always exactly the same and the key derivation is deterministic, the key is always the same and decryption works.

For fingerprints, that can't work. Fingerprint sensors work differently, but in the end you always get something that resembles a black and white/greyscale image. Try a simpler experiment: put a single sheet of paper on your desk. Take a camera. Take two pictures that are exactly the same. You won't be able to do that, and for a fingerprint this is a lot harder!

Because of that, it isn't possible to derive a key from your fingerprint.
Your fingerprint and the key are stored on the device. The device checks if your fingerprint looks like the stored one and then releases the key already stored on the device.

Because of this, a fingerprint will always be less secure than a strong password.


Where is the best place to get descriptions of malware? I'm looking for a source of descriptions of 1990s to early 2000s malware; I have searched for a very long time yet found very little. I require information such as payload activation dates, files created, files deleted, and similar.

Edit: I've found a few sites that give vague descriptions, such as the following:

https://www.symantec.com/security_response/landing/azlisting.jsp?azid=W - has many malicious programs listed, and gives descriptions of a few, but they aren't enough to determine payloads or activation dates.

https://www.f-secure.com/en/web/labs_global/threat-descriptions - only has recent malware.

http://www.microsoft.com/security/portal/threat/Threats.aspx - has a very large number of malware programs listed, but almost all have extremely generic descriptions

In addition, I found one source that was closer to what I wanted, but it had descriptions for only a very small number of programs: http://www.viriipedia.com/index.php?CN=20&CIE=1

Where does one find this type of historical data?

Try these links:

Timeline of computer viruses and worms
Timeline of computer security hacker history
Securelist - Descriptions
View Recent Malware


Can ISPs log IP connections? I know most, if not all, ISPs log the IPs you had tied to your network, but do ISPs keep logs of the IPs you have tried to connect to? For example, let's say I went to google.com, would the ISP be able to go through their logs and find whether I have ever connected to that site?

I cannot give a source nor which ISP this concerns since someone accidentally crossed their NDA by telling me this, but I think it should be known that there are ISPs that, at least in the Netherlands, log all DNS requests. This would mean that any hostname you ever looked up will be logged, including google.com, regardless of whether you really connected to the associated IP addresses. It is very reasonable to assume that a judge might find it convincing evidence that you really did visit the website. (Sidenote: DNS traffic that was merely passing through, not actually directed at the ISP's own DNS servers, was probably not logged, though this is not certain.)

The ISP in question tried to log as little as possible simply because it costs them money, but they are required to do this in order to comply with the law in the Netherlands. They (nor any other ISP) don't mention anything at all about what kind of data they log, they merely tell you in the terms of service that they log "as much as required by law".

I never thought they would log each and every DNS request, and I'm fairly sure that people here also wouldn't like it if they knew that they are indiscriminately being tapped 24/7. On Google I can't find any mention of that ISP doing that, nor any other Dutch ISP, so I'm not sure this information is public. I myself knew such information had to be logged about phones, the law is very clear in that sense (it mentions exactly which data needs to be logged), but logging DNS goes further in my opinion. Anyhow, this discussion gets political very fast.

More to the point, yes your ISP can do this and might even be required to do this by law, regardless of whether the police (or intelligence agency) placed a tap on your connection. In the Netherlands ISPs are required to store the logs for 6 months, but this may vary per country.

They can also, though probably not legally or without telling you, tap your connection's contents. This means not only which domains you looked up or which IPs you connected to, but also the data that was sent to them. This usually only happens in the event of a tap, or possibly when they themselves detect some sort of abuse. It might also be that they automatically process all data in search for keywords or certain protocols, such as bittorrent handshakes or Tor traffic. However legal or not, they have the technical capability to do this without anyone knowing.


Browsing file/directory structure of a website I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?

Can you? Yes and No.

Yes if the website is either compromised, badly secured or the owner wants the site structure to be browseable.

No in other cases.

So the right question would be: why a website's directory structure must not be browsable?

For this last question, you may read the good answers to this question: PHP files browsable: is this a vulnerability?


Is plugging my computer directly into a college network a security risk? I've been living in a dorm for the last week. When I arrived I basically set up my laptop and plugged in the ethernet cable directly into the socket in the wall (without a router in between). During the last days I've noticed that the internet is really slow and unstable. This got me thinking that I'm under attack since the router provides a basic firewall if I'm correct, and without it I'm vulnerable.

I'm using Windows 8 with the standard Windows firewall turned on, and I've scanned with malwarebytes without finding anything. Am I at risk?  What should I do now? I've been using my bank, Facebook, email etc.

TL;DR

Get good AV, use a firewall, and be skeptical of things you download and links you click on.

  I'm using Windows 8 with the standard Windows firewall turned on, and
  I've scanned with malwarebytes without finding anything. Am I at risk?

Anytime you connect to a network with other users, there's always a risk. That risk is decreased with the use of firewalls, AV, and a generally skeptical mindset regarding all sites you visit and things you download. To quote the X-Files... Trust No One. Don't click on suspicious links, or download unknown files from the Internet or email. If you do download anything, scan it with a well-known AV. Alternatively, you can upload it to Virus Total to see what other AVs have identified in that file.

  What should I do now? I've been using my bank, Facebook, email etc.

The reality is the Internet can be appear to be slow at times. Think about where you are. At a college when everyone is coming back to school. Bandwidth may experience congestion and appear slow at times -that's probably normal. If you really want to test it, go to a local coffee shop or Internet Cafe when there's low traffic, or test the school network at a time when there should be low usage (i.e., 6am). If your computer functions as expected, chalk the slowness up to congestion.


I clicked on a grabify link and I don't know if it installed a virus I was in a discord recently and someone sent a grabify link. I clicked on it and it led me to a soundcloud page. I think my firewall on my router is alright, is that enough to prevent them from doing anything with my ip?
Furthermore, could they have somehow installed a virus with only the grabify link even though it led to soundcloud, a safe website?

Links don't install viruses. The website you land on does. However, the site you end up landing on might be just the last site in a chain. It is possible that you passed through multiple sites to get to the last one and each one might have tried to do, well, anything.
Whether or not a virus was installed depends on your browser and any weaknesses it might have.


Exploits inevitably "cost of doing business on the Internet"? After yet another exploit of and malware injection into his website, host Leo Laporte of the Twit network has recently asserted/been told by his security expert that falling victim to such attacks is simply the cost of doing business on the Internet, and that the best one could do about it is to react quickly, remove the malware and fix whatever exploit was used, if possible. The biggest blame for this was laid at the feet of PHP, which is "inherently insecure" with its execute-files-in-any-folder architecture.

This assertion simply blew my mind. Is this the best advice a security expert can offer? While it's certainly true that PHP isn't exactly the tightest language out there, and that there are almost inevitably exploits somewhere, especially if you use a lot of drop-in, pre-fab packages, the biggest blame should still be laid on incompetent programmers and server administrators. No?

Is it really an insurmountable task for a security conscious developer who knows what he's doing to develop an exploit-free moderately complex website in a reasonable amount of time? While I'm sure that the systems I have developed aren't 100% bug free, I do take great care with anything that may enable an attacker to modify my server in any way; and so far I have not had to deal with malware injection. Is the state of web development really such that the only solution to code injection is to constantly clean up after the bad guys? Is there any real-world data on this issue?

I'd say that it's not so much that exploits are inevitable but that the security industry for a long time focused more or less exclusively on the idea of preventing exploits and didn't put enough effort into detecting or reacting to problems when they occur.

Unfortunately what's transpiring is that preventative efforts (in a lot of cases) aren't good enough, which is down to a number of factors like poor understanding of what "secure" means in a given setup, lacking economic incentives to invest properly in good development security practices, the prevalence of "snake-oil" in security product sales ("Here buy this black-box and you'll be "secure"!"), etc, etc.

The result is that a lot of companies are now getting compromised, as attackers are moving faster than defenders in many cases, and the defenders have years of security debt built up due to under-investment.

So I'd say that it is sensible advice for companies to realise that it's likely they'll suffer a breach and plan accordingly.

If you want more information on the state of play, I'd recommend the Verizon Data Breach reports, the Mandiant M-Trends reports and the Veracode state of software security reports amongst others.


How secure is hardware Full disk encryption (FDE) for SSD's Is there any research as to how secure hardware encryption of SSD's is - for example Samsung EVO 850? Or at least any articles that explain how it works?

TL;DR: Do not use hardware encryption on any storage medium no matter whether it's a thumb drive, an HDD, or an SSD! That's a really, really bad idea!

Hardware manufacturers are know to have included back doors or just bee very, very stupid about encrypting the data. This goes as far as them just using the same key for all their devices or them letting the encryption keys lay around unencrypted and hoping that no one will change the firmware in a way that allows someone to access them without knowing the password. I've heard and read this a lot and can't possibly show you my actual sources but here is an article confirming what I just claimed.

Hardware manufacturers are also known to have been forced to lower the level of encryption. Same way I know this as above and this article confirms it.

Just picture what's happening when you use hardware encryption. You buy that magical device from someone who claims that only people who know the password can access the data stored on this. That person does not show you how it works. They may also lie to you (see article linked in the previous paragraph) with you having very little chance of ever finding out. You have no way of verifying or disproving those claims.

Of course, don't trust software encryption by hardware manufacturers either. I bought a USB stick about 5 years ago from SanDisk (still have it and last used it an hour ago) which came with an "encryption software". I never used that encryption software, not only because it's against all standards one should uphold about encryption (see last paragraph) but also because after very little research I found that that software (which only worked for MS Windows which itself is another very good reason to never use it) writes 1 or 2 characters (I forgot whether it was 1 or 2 but that doesn't matter) into a file which it created in the Windows user folder if the correct password has been entered. Those 1 or 2 characters showed the application that the user had permission to access the files. If you simply wrote the correct content to the file (which is the same for everyone using that software), you could access the data stored on the thumb drive without knowing the password. So don't use that either.

Software encryption is much better because you as the user control which software is used. You can take a look at, pay someone to take a look at it, if it's commonly used (And it should be!), others will have a look at it anyways, and if it's openly developed, there are people publicly arguing about how it should be to be as secure as possible and those people don't trust each other.

Furthermore, you have an easier time switching out the software used for encryption. If you use hardware encryption, once you have the hardware, you use the specific encryption that hardware provides. You'll be reluctant to spend a lot of money to buy new hardware and throw the old hardware away, even if it's revealed that there are security issues because "It's not that bad." and "No one will attack me, anyways." whereas you would've thrown out a software with similar flaws and exchanged it for a different one within one day.

Only use encryption software if it is free and widely accepted to be secure. That it is free requires that you can get hold of its source code if you don't know that. (Not that it being open source is necessary, not sufficient.) If you are denied access to the source code, never trust the application! This of course includes not trusting it about protecting your data from unauthorized access. If it isn't widely accepted to be secure, it's very likely that the people who created it made mistakes (one can make an awful lot of mistakes about encryption and has to do a very good job in order to make encryption secure) or even maliciously made it insecure which can include not encrypting anything at all.


How to defend against SSL-Exhaustion attacks? The problem of SSL-Exhaustion attacks is well known for years, but nobody really cared until THC released their exploit-tool recently. THC talks about counter measurements in their release:

No real solutions exists. The following steps can mitigate (but not solve) the problem:

1. Disable SSL-Renegotiation

2. Invest into SSL Accelerator

Either of these countermeasures can be circumventing by modifying THC-SSL-DOS. A better solution is desirable. Somebody should fix this.

Idea 1 simply doesn't work because the core of the problem is not based on SSL-Renegotiation. I am not sure about idea 2, SSL Accelerators. How many dedicated systems for SSL Acceleration would you need to prevent a big SSL-Exhaustion attack? Does this make sense for an average SSL-Server?

So what I am asking here is, what can we do to prevent such attacks until a solution to the core problem is available? How can we protect our servers that rely on encryption?

"SSL exhaustion" is a mean looking expression for a more generic attack known as "not playing nice". In broad terms, it goes like this: a server is offering a network service, which, on the server, is not free: when a client comes, the server must invest some of its precious CPU cycles into responding to that client. The "attacker" is then someone who mimics many needy clients, overburdening the server. In the case of SSL, the investment is substantial because of the involved cryptography; but the concept also works when the server effort is the meagre amount of CPU and RAM needed to simply establish a TCP connection (that's called SYN flood, but, from a high level point of view, this is the same thing).

A possible countermeasure (not possible in the case of SSL as it is, but it could be added as part of a modification of the protocol) is to require a "proof of work" from the client. In SSL, it is easy to mimic the initial steps of a client connection without doing any of the hard cryptographic work (simply send random junk instead of the expected RSA-encrypted pre-master key, or the client Diffie-Hellman public key): this is what should be changed. There are some pointers on the Wikipedia page on that subject.

For SSL as currently specified and deployed, you have no choice but to:

try to identify offenders early enough, e.g. too many repeated connection requests from the same IP (this means that you block DoS which is not DDoS -- in simple words, the attacker will need to hire underlings / zombies);
select cipher suites which are "cheap" for the server (don't use oversized keys ! 1536 bits are enough)(try RSA instead of DHE_RSA);
counter the attacker by putting more muscle in it, e.g. hardware accelerators, or more PC (PC may be cheaper, but use more hosting space, and load balancing requires some additional system administration).


Concerns and Gotcha with Secure Programming Standards Development I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of requirements that correspond to our Sensitive Information Classification levels.

What kinds of issues should I expect to see as the standards gets developed and what have you found, after the fact, didn't actually work?

A few issues I found developing a team's secure programming guide recently:

How will the guidelines be enforced or encouraged? Who will be responsible for ensuring that products developed in accordance with your guidelines? You need to ensure that this person can:

see whether the guides are being adhered. This means they need to look into code reviews and testing results. And that means that the code reviews and tests need to exist and be performed :).
"throw an exception" in the development process. They need the authority to say no, this build isn't secure, it can't go out.
inspire the team to take security seriously. It sounds like annoying management-speak toss, because it is, but you don't want your developers doing security begrudgingly (not least because they then become disgruntled employees, and you double your security headaches). This is particularly important if the "owner" of the app's security is an outsider to the development team, e.g. if you have a cross-cutting security team who get seconded to dev projects.

Related to the above, how will management be seen to be taking security seriously? If they aren't then it's a social hint that the employees don't need to either. What are the rewards for committing to the standards?
What feedback will you get on how the guidelines are working? You really want to understand:

What vulnerabilities were discovered during release
What vulnerabilities remained in the product, and why
The hard bit: what time was spent doing things that meant adhering to the guidelines but didn't impact the security of the product sufficiently to justify their cost? The closest measurable quantity I've found is "are we spending time on mitigating things that aren't in the threat model?", though spending lots of time on low risk items compared with higher risks is another red flag.

How will such feedback be acted upon? Can the developers make changes themselves if they find an issue, or does it need to be escalated?


Can motion sensors be disabled by lasers without triggering the alarm? I remember when I was a kid and was waiting for someone in a long hall, there was a motion sensor and security panel by the door. To kill time, I would go away from the door, then try to move so slowly the sensor couldn't detect me differentially (I figured out it works that way) - aiming to stealth walk to the door, pretending I would disable the security then. When I made a mistake, I could see corresponding LED light go on on the control panel.

Now later on I was thinking about the slow movement. What I would pick a laser, infrared I assume, and slowly - just as I moved slowly when playing - increase the power to the point where the sensors on the detector reach saturation (they couldn't measure any higher value)? My expectation is that if I mounted such laser safely and disable the sensors this way, I could then just walk around the place without disturbing the alarm.

After my evil deed was done, I could even re-enable the alarm the same way, leaving quite a mystery for the investigators.

Is my expectation correct? I know there are other motion sensors than infrared ones, but they really aren't that common. So this is about active and passive IR sensors only (if anyone didn't get it from the text above).

I wrote the security technical advisor to the movie Sneakers, Mr John Strauchs. Sneakers includes a scene where intruders increase the ambient temperature of the room in order to defeat the IR motion sensors. John wrote the technical details of that scene (including the purposeful errors).

John is a former operations officer at the CIA, and designs security systems for major locations around the world. This is a synopsis of what he had to say.

There are a couple factors to consider in your IR laser scenario.

First, is the complexity of the sensor itself. Top-of-the-line sensor units are a cluster of multiple sensors (up to 16) that create different zones to monitor. If you want to blind this type of unit, you would need to blind all 16 sensors. Cheap sensor units have only one sensor, and manufacturers break up the field into zones using physical means. One need only blind the one sensor in a cheap model.

Second, is the nature of the IR laser itself. It would have to mimic the IR signature of the thermal energy in the sensor zone it was in when you first turned it on. The IR signature would have to match everything between the sensor and the barrier in that zone. You could obtain this with an IR camera and some fancy math to program the laser, but it would be tricky, if not impossible, assuming you could get the IR laser to even produce a signature something close to the thermal equivalent to room temperature. To have this level of control this would require a near-weaponized level of complexity in an IR laser. In short, using a laser would be the easiest way to trip the sensor, not blind it.

John says that this is unnecessary, though, if you have close physical access to the sensor when it was off. A simple silicone spray will blind the sensor, and is invisible to the naked eye. It leaves a trace, but it might not be discovered until much later, if at all. Alternatively, you could place glass in front of the sensor when it was off, which would do the same thing. Glass and silicone sprays block the IR wavelength bodies emit.

That last piece of advice is the kicker for defenders. PIR sensors need to be inspected regularly, and even opened to see if glass or plastic was inserted inside the unit. Sometimes contractors will "tune" the unit by putting plastic inside to make the unit less sensitive. Always test PIR units by doing boundary tests, not by waving your hand right in front of it.

TL;DR:

It depends on the sensor manufacturer, and you would need a weaponized IR laser to even attempt this. Inspect your PIRs frequently for glass, plastic, and coatings, and test frequently using boundary tests, not waving your arms in front of it. You get what you pay for in sensor units.


Recover Server 2008 R2 Domain Admin Password So I did the ultimate silly thing: I lost my domain admin password for my Server 2008 R2 box.

Sure, I could just re-install but that's going to be a huge pain. I tried rebooting with the Windows Install DVD and replacing utilman.exe with cmd.exe, but switching to C: displayed no files.

I can still log into the machine as a regular user, though.

And I see there's been some local privilege escalation vulnerabilities patched in the last couple months (specifically MS13-046 looks promising). And it's been a little while since I've logged in to apply MSFT patches (which oddly enough was what I was trying to log in to do).

Are there any publicly available exploits for these bugs? I don't see any in Metasploit. Or is there just a better way altogether? I full physical access to the machine, but I think BitLocker is enabled (which is why I think replacing utilman.exe failed).

If you've got a local account but not a domain admin, IIRC you could try metasploit with the psexec payload to put meterpreter down on the server and then use the getsystem command to try and get admin on the box.

EDIT Per @void_in this won't work with W2K8 and UAC, to you'd need to use an exploit to elevate privileges, e.g. the MS12-042 one linked in comments

if that's succcessful you can dump the domain password hashes and try and crack them (this will be easier if you can remember anything about the password like length or character set that you did/did not include).

What I'm not sure about, but which might work is, if you can use getsystem on the domain controller whether you can then use meterpreters add user commands to add a new domain admin, may be worth a try :)


Setting up a honeypot to detect malicious network activity So in the world of networks, people try to gain access to the client machine and perform lateral movement. Honeypots are often used to give them an easy access point and show them an unfavorable or fake environment so they leave before doing any real harm, the intrusion gets logged, and the network is safe. At least in theory this is how a honeypot should work, from my understanding. However, recently I've been tasked with setting one up and while I see a couple that exists, I'm curious what it is that a honeypot does to actually keep your network safe?

IF they gain access to the honeypot, isn't lateral movement still able to be achieved or does the honeypot have some sort of software to make this a living nightmare for the attacker?

It depends of the honeypot you are using. If you are using a low or medium interaction honeypot that only emulates some services, than the chances are very low that the attacker can break out of the honeypot (except if he finds a bug in the honeypot itself).

If you are using full interaction honeypots, like a real Windows machine, that the chances are high that the attacker could use the honeypot as a starting point for attacking other machines (on your network or on the internet). Therefore you must put a so called honeywall between the honeypot and the rest of your network which will basically block malicious traffic that tries to leave the honeypot. The honeywall is basically a combination of IPS/firewall/WAF of your choice.

Even if using a honeywall, you cannot be 100% sure that the attacker cannot break out of the honeypot. That is because you must allow certain traffic to leave the honeypot in order for the attacker to receive feedback from his attack, but you must prevent malicious traffic that could damage other machines outside of the honeypot to leave it. Finding the right balance is quite hard, and a risk always remains.


How safe is to leave a open port on router without anything listening to it? I'm using plex remote, and I have a double-NAT on my local network, so I need to open ports on the two routers.

As far I know, I have made secure connections to be required. And I don't plan to leave plex open all the time on my PC anyway. Just when I know I'll need it probably....

Is there any risk to leave those ports open ?

You should check out this question including the accepted answer:

A port isn't open if something isn't listening for a connection on it.
The reason it is bad form to have all ports open to everywhere is that it exposes those services that are listening on those ports to exploits. That is why firewalls exist, to limit what is allowed to connect to certain ports, to reduce the surface area exposed by services.

To answer your question: There is no risk in opening ports if no services are listening on the port.


Force a connection via SSL3 to detect POODLE vulnerability I have been reading up on the POODLE vulnerability.  From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server.

The server I am currently running defaults to TLS 1.0 in the browsers I have tested but I am not certain if the connection will downgrade to SSL 3.0 if the client asked for it.

Is there a way in Chrome or any other browser to force the use SSL 3.0.  I merely want to test if my site(s) permit connection via SSL 3.0 or not.

It doesn't necessarily matter what your server uses by default - most servers and clients are configured to negotiate the highest protocol available. A major aspect of the POODLE attack is that an attacker can cause connection failures in a higher (non-vulnerable) protocol, and downgrade the victim to SSL3. Then they can exploit the vulnerability in SSL 3.

Source: http://googleonlinesecurity.blogspot.co.uk/2014/10/this-poodle-bites-exploiting-ssl-30.html

So the client doesn't need to ask for the connection to be downgraded - an attacker with access to network traffic can do this. Any client that supports SSL 3 is potentially vulnerable (if the server does as well and SCSV isn't enabled both ends).

But yes, most of the browsers allow you to disable SSL/TLS versions, and in some cases you could choose to disable newer protocols.

In Internet Explorer, you can disable SSL/TLS protocols from Internet Options > Advanced.
In FireFox, you can set the security.tls.version.max and security.tls.version.min FireFox preferences to select a specific version.
In Google Chrome, you can use the --ssl-version-max and --ssl-version-min command line flags to select a specific protocol verison. The accepted values are: "ssl3", "tls1", "tls1.1", or "tls1.2". How to set command line flags on Chrome.

It should go without saying that you should typically only use such methods to disable old insecure protocols (like SSL 2 and 3 currently).


What bad coding practices makes a browser extension vulnerable? I'm trying to scan JavaScript files for vulnerabilities using JSHint. Specifically, I'm scanning the JavaScript files of browser extensions. To look for possible vulnerabilities I'm looking for bad JavaScript coding practices such as the use of eval. (JSHint has option to detect the use of eval.)

I'm currently scanning benign extensions and I'll be looking into vulnerabilities that could compromise the security of the user in some way (may be trivial). However, I don't know what more things (other than the use of eval, unused and undefined variables) that I should be looking for.

Could anybody suggest what I should be looking for?

In browser extensions, the impact of a vulnerability highly depend on the context and the requested permissions. Static tools (JSHint, AMO validator) to check code exist, but none of them are 100% reliable, especially for obfuscated code.

So, I'm not going to show a magic regular expression which tells you whether some code is vulnerable or not, but give a brief overview on how extensions work, and a small list of potential extension-specific issues.

Existing tools

Mozilla's static code analysis tool, used on addons.mozilla.org is publicly available as AMO Validator. This tool works for all Jetpack-based add-ons. First, it identifies (by hash) and excludes all whitelisted JS libraries. Then, it runs these test cases on the remaining content of the XPI archive.

None of the other vendors have published such a tool. Fortunately, extensions (not plug-ins) for Chrome / Safari / Opera cannot get as much privileges as Firefox add-ons.

Extracting

Firefox (xpi) and Opera (oex) add-ons are zip files with a different extension.
Chrome (crx) extensions are zip files with a preceding CRX header.
Safari (safariextz) extensions are signed xar archives.

7-zip is capable of extracting all of these archives.

Permissions

Chrome, Safari and Opera require the extension developer to declare permissions to access certain origins or features. These declarations can be found at:

Chrome: /manifest.json. See match patterns and permission warnings
Safari: /<extension-name>.safariextension/Info.plist. See Access and permissions.
Opera: /config.xml. See config.xml.

Origin access cannot be configured in Firefox add-ons.

Content scripts / Injected scripts

All extension environments support execution of code on pages which match a pre-defined URL pattern. These are called Content scripts in Chrome / Firefox, and Injected scripts in Opera / Safari. These scripts have direct access to the page's DOM, but no direct access to the page's JavaScript variables, because the execution contexts differ.

Background pages

These pages are the most privileged part of an extension.

Vulnerabilities

I'm not going to mention obvious mistakes such as using setTimeout with strings (these are already mentioned in bobince's answer), or far-fetched methods which are unlikely to be accidental, such as an extension which grabs credentials from a page and sends it to a rogue web service.

Using .innerHTML or jQuery to parse external HTML (see this question on Stack Overflow):

// Example 1:
var heading = $(xhr.responseText).find('h1').text();
// Example 2:
document.body.innerHTML += '';
// For: <img src="bogus" onerror="do_something_evil_with_privileges()">

Use of the window.onmessage event without validating the data or checking event.origin. In the following example, any third-party can use window.open and postMessage to send a message to Gmail, and abuse the unintentionally leaked features:

// Content script running on https://mail.google.com/mail/
addEventListener('message', function(event) {
    if (event.data.type === 'send-mail') doSomething();
    // or:
    notifyBackgroundPage(event.data);
});

Loading external (JS) code (worse: loading external code over http). If the external source is compromised, all users will be susceptible to abuse.
Use of cross-browser extension frameworks such as Crossrider and Kango. These are convenient to developers, but the generated extensions request an unnecessary number of permissions.
Not sufficiently restricting the influence of an extension API. An extreme example: Removing the httpOnly cookie flag for all sites, instead of just the relevant site. This also includes running content scripts on too many pages.
Privacy issues:

Use of services like Google Analytics (search for _gaq.push)
Loading external assets, such as social media buttons.

Most of the regular vectors are also relevant for extensions. Use the cheatsheets on https://www.owasp.org/ or take a look at http://html5sec.org/.


Why is scanning considered a pre-attack and not reconnaissance? I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading.

In the CEH book, it states that:

We can scan for a target using network tools  (e.g. tarcert, nslookup and etc)..
Scanning happens in the footprinting process.

But I did a test in gocertify that states that scanning is pre-attack and not reconnaissance.

The question is: Which one is correct? I tried googling, but I'm still confused.

In an attempt to clear up your confusion, if you think of reconnaissance (or footprinting as you have here) as non-invasive - that is using tools that will contribute to your stock of information about your target without directly communicating with it (and potentially tipping your hand of your interest in the target). Tools that may fall into this category are Google, Bing, Shodan, dig, nslookup, theHarvester, etc.

Scanning is generally an activity that will interact directly with your target - and whilst maybe not informing the target immediately of your interest (if they're not looking), will potentially log your activity on their perimeter or web logs etc., depending on how the logging is configured. Tools that may fall into this category - with varying degrees of noisiness - are nmap, Nessus, Burp Suite, etc.

Scanning is a process that could be argued to bridge the pre-attack reconnaissance phase (i.e. non-interactive) and the more active attack phase (interactive), as it could fall into both. Example - you simply scan a target to find out what ports are listening (which would contribute to your information about the target but interacts, yet still may not trigger any logging alerts) but later on in the test you may scan/probe some of the ports more aggressively which may tell you what version of SQL is listening which may trigger an alert on the target.

To summarise, personally I prefer to define non-interactive and interactive information gathering as logically separate in an engagement, which will hopefully make things clearer for you.

As @eckes mentioned below, the more generally accepted terms for non-interactive and interactive are passive and active respectively.


Is it possible to sabotage google bots? Consider the following theoretical webserver:

  On any request, produce an html response that consists of 2 links,
  which are each randomly chosen strings followed by ".html".

When the google bot attempts to crawl this site it will be presented with 2 more links. In the interest of mapping the site, it will attempt to navigate to them, each returning 2 more links. This will obviously happen infinitely(surely can come up with a solution that never gives the same page name twice).

My question is, do the bots have a mechanism to detect this? If so, what is it? If not, what kind of detection methods would be possible for this situation?

Not entirely sure if this was the right SE site to post this.

No. The number of pages Google (and any major search bot) is willing to crawl on your domain (or indeed whether they are willing to crawl it at all) is based on how relevant they think your domain is.

There are plenty of sites with an infinite number of pages. This problem was solved decades ago.


Best practices for securing open APIs from quota theft I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. Google Maps API could be one such example of these APIs. Including the appKey inside the clients (browser application, mobile clients) make them vulnerable to appKey theft.

For the reference, here are Google's recommendations: https://support.google.com/cloud/answer/6310037

It could be a wrong assessment, but is OAuth 2.0 Client Credentials flow with a proxy server suitable in such scenarios? Are there any real-world cases?

If you cannot setup user accounts or any other way of identification, which is best practice for every API, you are left with the following:

Collecting metrics of number of requests per IP, Subnet, AS, Country
Throttling proportionally to the usage while trying best effort not to compromise users who do not abuse the system and providing enough quota to the subnet, AS, country etc. This is because without user identification you will always be unfair when trying to limit by network addresses, as this bit is not identifying any user.

You might need to know what the limits should be by looking at the total number of requests from the country and also on the subnets from the same country, same for AS, subnets etc. This is to provide the best quality service by taking into account these metrics.
However this is bad method.

ps. You should really do this per user account. If the account is stolen, you put the policy on the accounts to make it not happen again. Use encryption and so on.


No single quotes is allowed, Is this SQL Injection point still exploitable? The SQL phrase looks like this,

"SELECT * from XX where id = '" + id + "'"

The id variable comes directly from the GET parameter named id.

And the Java web app explicitly disallowed single quote. If a single quote was found in that parameter, the server stop processing it immediately and returns an error.

So, is this still exploitable? With postgresql and tomcat environment.

You may want to take a look at this paper (wayback machine link). It details some methods of bypassing such filters.

For example,  some SQL filters replace all single quotes with a pair of single quotes. However, feeding them an input containing \' can bypass this.

Also, there is Unicode smuggling, where you use a Unicode character that Java (PHP/Ruby/Python/whatever) understands as being different from a quote, but the database doesn't.

Unless you have a really, really good reason, I recommend you use the built-in escaping.


Why not fix Android root exploit? I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks.

Why don't Android developers fix vulnerabilities that result in root access to a phone?

Android Isn't Android
Android rooting is tough to fix due to the nature of Android.  Because Android is open source, each manufacturer (Samsung, Motorola, Nokia, etc) takes the base Android OS and modifies it:

Drivers to work with specific hardware
Custom messaging, call, or system apps
GUI changes to make their phones unique
System backup mechanisms

Then the manufacturer gives it to the Vendor (Spring, Verizon, T-Mobile, etc), and the vendor will make their modifications:

Voice mail
Other backup mechanisms
Over the air update services

By the time you get your phone the original Android OS is twisted into something, almost entirely different than Android.  Take a friend's phone from a different network or provider.  I guarantee the Settings app is different, and there are different GUI changes to it.
Root Exploits
So how does this affect rooting?  Every time Android is added to introduces new attack vectors for vulnerabilities.  If you look up "How to Root Android" you'll find that not every phone is supported by every rooting procedure.  And by "supported" they mean "vulnerable".  A Samsung Galaxy S3 might be rooted with one program, and a Motorola Razr is rooted with another.
Some root exploits work across platforms, some work across Android versions (each version of Android that's released adds new attack vectors).  The Android team most likely fixes root vulnerabilities (this is speculation).  But do those changes get propagated to the manufacturer and/or vendor?  The manufacturer adds so much driver  and GUI code that if a vulnerability is found at that level there's nothing the Android team can do about it.  It would be up to Samsung, for example, to fix it.  Then it would have to push the patch to each Vendor.  It could be a year before the users see the patch, and by then most people have new phones with new software.
Rinse and repeat.
Now too be clear, I'm sure that when Android pushes out a security patch the vendors and manufacturers take it seriously.  Those changes most likely make it in to their final build.  The point I'm trying to make is that there is not a lot of transparency between these stages, and I don't know for sure what actually happens for a patch/version release.

Universal Rooting Procedure for Nexus 7 and Motorola Razr HD by XDA Developers.  Notice how this "Universal" procedure only applies to two devices?


Is identification with NFC bank cards feasible? Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards for that purpose, e.g. with the following flow (note: this does not perform any transactions, as it does not go to any card issuer gateway):

User is supposed to have a specific smartphone app installed
User requests to log in in a website
User is asked to present the contactless card to the phone with the app open (or app automatically gets opened upon NFC contact)
User presents the card, and is aksed for PIN, which he types in the app
The app has obtained a one-time challenge from the server, which it sends to the card
The card signs the challenge
The signed challenge, and a transformed (e.g. using bcrypt) credit card number are sent to the server
The server matches the transformed number (which serves as identifier) to the user that has requested login from a browser, verifies the signed challenge using the public key of the card, and lets the user in.

If that doesn't sound too absurd, some follow-up questions:

Is the key size of bank cards big enough?
Does the EMV protocol allow for signing of a challenge in such a way (I know it does as part of a transaction flow, but there might be some caveats)
Can a general-purpose app (android/iOS) be created, or cards have significant variations in their EMV implementations
Do EMV keypairs have corresponding X.509 certificates issued by some CA? And can revoked certificates be checked?

The only thing available to you via a contactless bank card is an ID number (of the card). To get more, you have to follow the appropriate guidelines and security of the contactless cards.

This means that, while you can get the ID of the card, you cannot make further assumptions. It certainly doesn't provide a lot of security.

Having said that, there are plenty of applications that do use this method. The most common being "follow-me" printing and room booking systems (the ones that have screens outside the rooms). Both of these types of system common use the minimal data from the card. You register your card against your user id. This is fine since the risks of compromise are very low.

As always, this comes down to a risk analysis.


Unable to Spoof DNS in Kali I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did.

Tampered ip_forward to 1 in /proc/sys/net/ipv4
Started a credential Harvester and cloned site.
Set the POST payback to my own IP address.
In etter.dns, added the following.

http://www.facebook.com
https://www.facebook.com
*facebook.com
www.facebook.com

Ran the following command

ettercap -T -q -i eth0 -d dns_spoof -M arp ///`

Problem

When I type the IP of kali machine, I am able to get the cloned facebook.com page. But When I type, facebook.com on browser, I get ERR_CONNECTION_REFUSED. How can I let it access the fake page, I have created.

P.S Though, I am able to catch all the SNMP packets, my router has been sending to the victim. (So, I suppose, ARP spoofing is correctly done.)

Depending on the browser you're using, you may be falling victim to preloaded HSTS lists - Facebook and other well known sites use certificate pinning which is built into the browser (see Chrome source - the same list is used by Firefox) and won't load if the certificate signer doesn't match the expected one.

In order to defeat that, you would need to get a certificate signed by one of the CAs referenced in that file under Facebook - "SymantecClass3EVG3", "DigiCertECCSecureServerCA", "DigiCertEVRoot", or "FacebookBackup". You'd need to get an EV certificate based on the names, in order to have the right CA chain, which you shouldn't be able to do, unless you are actually a registered company called Facebook. It's almost exactly what it's designed to protect against.

You would probably be able to spoof a site which isn't on the HSTS preload lists with the settings you have.


Encrypt data using PBKDF2, but still provide password reset feature In my application I would like to encrypt user data in such a way that I do not have access to it. To do this I will follow the following steps:

Generate 256-bit key
Encrypt data with key
Derive second key from password (PBKDF2)
Encrypt 1st key, destroy plain text key
Store hashed+salted password and encrypted key

Now my issue is this: I still need to provide a way to reset the password when it is forgotten.

I realise that following this trust-no-one style scheme directly counters the ability to provide a password reset feature but I am hoping for a solution that can help maintain the spirit of the scheme through a healthy compromise, without requiring a second secret from the user like answers to security questions or a trusted third party.

My ideas:

Storing a copy of the per-user encryption key with a key my application controls as a backup, ready to be re-encrypted with their new (reset) password for daily operations. To be clear, I am fine with having access to the data myself - instead I am aiming to limit the potential data a successful hacker could access.
On signup, sending a password reset link to thier email that contains a key in the link used to encrypt a backup version of the encrypted key, ready for re-encryption using the new password.

All the data that was encrypted by the data encryption key will be lost in this case, because as you said, the password was forgotten. Now if the password was merely changed, but not forgotten, then you could unwrap the data encryption key with the password-derived key upon initial login, store that previously-wrapped key in the session, then re-wrap and store the data encryption key again when the user changes their password. So that's not a problem. It's just that if the password is ever forgotten, then so is the data that depends on that password in order to unwrap the data encryption key. There's no other secure way around this, unless you have some sort of backup scheme, maybe protected by site-wide encryption with keys protected by, say, a KMS. But in that case, why wouldn't you just ditch password-based encryption to begin with, and use the KMS instead?


Storing encrypted data for offline use A user downloads a file from a server. I want to store that file locally on the user's machine so they can view offline. For protection, it should be encrypted while not being viewed.

My theory is that you could generate a key to encrypt with using the user's password as input to a KDF so that the key can be created when the user wants to view the file without needing online access and we won't have to store a key locally somewhere.

I am concerned that this now presents an attacker with a possible offline attack to crack a user's password since they can try to generate keys until it decrypts the file. In a world where user's cannot be expected to use good enough passwords to generate strong keys, I suspect this method won't work well in practice.

Is this logic correct? Is there another way to handle this problem?

I think that you are trying to fix a problem that doesn't really exist?

Typically, individual files would be encrypted using either a stand alone tool such as WinZip or an integrated tool such as Bitlocker. In the former case, the encryption key IS based on a passcode but one that the person encrypting sets and then shares. In the later case, the file will be encrypted locally when stored in a filing system controlled by the application. Then the user sets the passcode. Each has benefits and disadvantages. You can, of course, combine both approaches.

There are other, more complex approaches to this problem but they require a degree of cooperation and trust between the originating and the receiving systems. Microsoft Azure Rights Management is a good example of this.


Prevent DOS against RSA authentication In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set up a symmetric encryption key and sends back the unencrypted nonce + an encrypted response.

Unfortunately, this makes the server wide open to both deliberate and accidental DOS attacks.

As an example of the latter, let's say a server is taken down and the clients all try to reconnect. That will means 100-1000 (non-malicious) connects/s from different ips.

What are my options aside from reducing RSA key size?

Edit

What about any of these strategies:

Move the authentication to a separate server, which securely hands out encryption keys with an expiry date. When logging in to a server, the client presents an identifier that the server can use to retrieve the encryption key to use.
Put RSA decryption in an unbounded queue with sufficiently low thread priority. When a client logs in, it will either automatically get logged in (if there are sufficient resources), or put in a login queue. Until the decryption is scheduled, the client will get updated information about how close they are to get their login completed.
Put RSA decryption in a bounded queued queue with sufficiently low thread priority. If the queue is full, then the connection is refused with a message that the login queue limit is reached and the client can retry later.

You could switch to a faster algorithm. RSA is fine, but Elliptic Curve Diffie-Hellman is faster. Let's take my current machine, a laptop with an AMD A8-4555M CPU (1.6 GHz, not a very fast processor):

$ openssl speed rsa2048 ecdhp256
Doing 2048 bit private rsa's for 10s: 1468 2048 bit private RSA's in 9.99s
Doing 2048 bit public rsa's for 10s: 47384 2048 bit public RSA's in 9.98s
Doing 256 bit  ecdh's for 10s: 5847 256-bit ECDH ops in 9.99s
OpenSSL 1.0.1c 10 May 2012
built on: Tue Mar 19 19:10:34 UTC 2013
options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)
compiler: cc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,--noexecstack -Wall -DOPENSSL_NO_TLS1_2_CLIENT -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 -DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
                  sign    verify    sign/s verify/s
rsa 2048 bits 0.006805s 0.000211s    146.9   4747.9
                              op      op/s
 256 bit ecdh (nistp256)   0.0017s    585.3

So 256-bit ECDH, arguably stronger (or at least as strong) as 2048-bit RSA, is also about four times faster. This performance is for one core; since that specific CPU is quadri-core, it could handle two thousands connections per second. A server processor would probably do substantially better.

Among other possible mitigation techniques, you can implement some client-side delays. In your "accidental DoS" scenario, all the client try to reconnect simultaneously. Possibly, you could make the clients wait a random time before reconnecting, when the connection is lost (instead of connecting immediately, make them wait a random time between 0 and 60 seconds, then try again). This will help spread the load.

You could also buy more servers. Hardware is cheap.


Secure data transmission and storage We currently have an application that we deploy via the web, users access it by connecting to a link which opens an executable file. This file was compiled with visual foxpro.

My question is - is this setup secure? Are my transactions, data transmission to and from the server secured? Or is it better to develop a web application in PHP for this?

I'm using mysql database on ubuntu server.

Hopefully this is clear enough for you.

EDIT

Man-in-the-middle attacks - The site uses HTTP only and is not using SSL/TLS encryption.

Access control - Only our in-house programmers are authorized to upload new versions of the application. The new version will be evaluated first on a pre-production system before replacing the current version.

Server Security - We are using SSH for remote administrative access. The server is also hosting samba for internal network file server, and there are also those who access the same server for secure file transfer.

Software security - Although we have very competent developers, I am not sure if they are trained in secure software development or use static analysis tools.

I may have to suggest a change on our current system due to some security lapses. I would leave this thread open for a few more days to seek for more advice from professionals like you. Systems (data, network, server) security is new to me and I am really interested in learning more, I'd appreciate it if you can give me a few sources to start learning from.

The best way to answer your question is probably going to be to hire a security consultant to perform a security assessment of your approach.  It sounds like you don't have a lot of security knowledge yourself, so you're probably not going to be in an ideal position to answer the question on your own.
You probably haven't provided us enough information for us to perform a thorough security assessment for you.  The security risks of your approach are going to depend heavily on all the details of how your system works and how it is configured and deployed.  There are a lot of details you don't mention, but which are relevant to security.
Here are some examples of security risks that might be relevant to you, depending upon your specific situation:

Social engineering. Asking users to download and run an executable program is a dubious idea, from a security perspective.  It trains users to run executables from untrusted web sites, i.e., it trains them to behave in an insecure way.  You may not intend to ever serve them a malicious program from your site, but what if the users go to some other site and download and run a program?  If you are asking users to routinely do this every time they want to use your application, you are teaching them that this practice is OK.

Man-in-the-middle attacks. You don't say whether your site uses HTTP or HTTPS (i.e., whether it uses SSL/TLS encryption).  If it is accessed over HTTP, then it is vulnerable to man-in-the-middle attacks, such as those that are possible over open Wifi.
The best defense is to ensure that your site uses SSL sitewide (it should be accessible only via HTTPS; any attempt to visit via HTTP should immediately redirect to the HTTPS site, or else your server should never respond via HTTP).  You should also enable HTTP Strict Transport Security on your server, so clients know they should only connect via HTTPS.

Access control.  You haven't told us how you limit who is able to upload new versions of the application to your site.  Obviously, the security of the site is only as good as the protection for that functionality.

Server security. If someone can hack into your server, they can breach the security of your site and your clients.  Therefore, you should lock down the server, so it is not running any other services beyond what is needed for this one application.  You should enable a firewall to ensure that no one from the public Internet can reach any service other than the web service, and possibly a well-secured SSH server for administrative access.  (For SSH, I recommend allowing public-key access only, and disabling authentication via password.)

Software security. You will need to ensure that there are no vulnerabilities in your custom software.  This means that it is important that the developers be trained in secure software development.  They might also want to use static analysis tools or other support to help catch any remaining security bugs that might slip through.

Updates. You should make sure to keep your software updated with all the latest security updates and patches.  One way to do this is to configure Ubuntu to auto-update its software, e.g., checking for and automatically installing updates once a day or once a week.

Generally speaking, it is not likely that you are going to get a definitive answer that "you are secure", just as there is no guarantee the next time you cross the street that you won't get hit by a car.  Instead, security professionals identify possible risks/threats, assess the mitigations/defenses you have put in place, evaluate whether your system reduces the risk to an acceptable level, and identify for you some possible steps you could take to reduce the risk if you so choose.


High-Risk Intrusion Detected I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails.

wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

They have been attacking random domain that is hosted on my server. Most of my website is using a .NET based framework, only a few websites are running on Wordpress. And all the Wordpress ones do not use this revslider_show_image plugin.

I don't know the definition for this attack (maybe DoS?), but would like some advice on how to fix this issues.

Currently, I just block the IP address using this method, but I'm not sure it will help.

This is a reply from Symantec, that doesn't really help much:

  You will see that many of these URLs end with "../wp-config.php". This
  appears to be a Wordpress exploit of some kind.

  I think you should take the following actions:

  Run a full scan on each machine and submit any results to our site http://www.symantec.com/security_response/submitsamples.jsp
  If you are using Wordpress, have a look at these articles:

  http://blogvault.net/wordpress-security-1-securing-wp-config-php/
  http://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/
  http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html

What you're seeing is automated probing for security holes in your website.  Currently, attacks that try to retrieve the contents of wp-config.php are the big thing; other popular targets are phpMyAdmin and php-cgi.

For probes like these, either you're vulnerable (and have probably already been successfully attacked) or you're not vulnerable (and have nothing to worry about).  In your case, since you're not running "revslider_show_image", you fall into the "not vulnerable" group.

You can block the IP addresses the probes are coming from, but it won't do much good: the computers involved are almost certainly part of a botnet, and the real attacker has tens of thousands of these machines to work with.  The best thing you can do is remove unneeded software and make sure the rest of it is kept up-to-date.