How to define audit controls responsibility? @ SIEM I'm assigned to write procedural documentation for the SIEM use cases for the IT asset owners. For example, the procedures for selecting events indicating unauthorized access to user-mail box. I have researched the problem and found corresponding Events Id associated with this event.

This is the easy part, but my friends in my team argue that I would be also responsible against ensuring audit trail requirements e.g change in security audit policy (removing from auditing) by disgruntled admins to cover tracks for illegal / unauthorized actions.

I believe that system owners are responsible for audit control implementation and review of the resulting audit logs.  Auditors are responsible for identifying gaps in implementation.

The most I can do is to specify the requirements (e.g log all events with an event id between 1001-5 for source ms-exchange store, category(logon,access request,object moved etc) and the required logging level.

I want to know who is responsible that audit configuration is as per requirement stated by us (the operations team)?

UPDATE

If i rephrase my question I would ask something like this..."who is best suited to maintain audit trails of user action?" Auditors or owners

In the past I performed the function of an auditor. (for legal reasons, I cannot call myself an auditor, but the fundamental function of an auditor is to compare expected behavior with actual behavior, and that's what I did).   @Iszi is correct that different institutions will have different understandings of RACI.  If I were an auditor visiting your facility the first finding would be that your management hasn't described that responsibility matrix. In traditional auditing, one does not hold people responsible where there is no policy. (Modern risk based auditing can operate a bit differently, but I think that's outside the scope of this question).

Based on the evidence presented, I believe you are correct.  The procedural document should describe the procedure for system auditing, including the events to be audited, and the procedure for reviewing the audit logs.    If the goal is merely to comply with an audit regime, that is sufficient.

If the goal is to improve security, reduce the organization's exposure to risk, decrease the number of incidents and decrease the damage done in any individual incident, then your organization needs to go further.  Your system audit procedures are based on assumptions about the assets your protecting, and the threats to that asset.  Threats and assets change more frequently than eventid's.  Your management should have a mechanism to update the audit procedures.  Audit review is not an end; it is a tool to reduce risk, reduce incident frequency and severity.  Management should establish a periodic review of audit activities and to adjust those audit activities to better support the organization's business goals.

(I recognize that I've used the term "audit" in two contexts, and that it could be confusing. I'm assuming that you are writing procedures for capturing and analyzing system event logs (system audit).  This is separate from external audit and review, which might be called independent audit)

As @Iszi says, each organziation will differ, but I believe that in the general case:
System Aministrators/SOC staff are responsible for daily/continuous review of audit logs as described in the procedural document you're writing.

System Owners/System Management is Accountable for the results of audit (generally measured as the time to detect  an incident, the % of incidents detected on internal vs external evidence, and the average time to resolve an incident).   Management is also responsible and accountable for managing the audit process, which includes ensuring that the audit procedures are updated to match business needs.

This gets a little more complicated if we outsource security monitoring to a SOC; the system manager/owner should still be accountable, but they have delegated responsibility.  If I were reviewing such an arrangement, I'd look for an SLA for Security that included the RACI you're looking for.


What questions would the Joel test for Infosec professionals consist of? See Server Fault and the original test. In other words what are some good questions that an information security professional should ask of a prospective employer? These questions might also lend themselves to helping to improve an existing work environment and enable an employer to attract the best and brightest in information security.

One which seems to impact security teams significantly would be:

Do you have a CISO or equivalent
sponsoring security at board level
and development of security skills
and expertise

Without it, teams very rapidly become disillusioned at their lack of influence and will move to organisations with a more mature outlook on security.

Also, in order to attract individuals who are looking to secure their long term career

Do you have a security competency
framework, such as the one developed
by the Institute of Information
Security Professionals covering the whole career from
graduate entry to retirement?


Can my WIFI Home router be brought down to cause me to connect to a fake AP? I am wondering if this scenario may happen - described from the users point of view: Being connected to my home router, the connection suddenly breaks. So I go to the wireless network adapters drop down menu, select my well known device to connect. But instead of connecting silently as normal, it asks me for the PSK. After typing the PSK the connection is accomplished. I am wondering what may have happend, but as I am back again online, I am not concerned.

The same scenario from the attackers perspective: The attacker (may be sitting in his car in front of my house) has set up a fake AP with my home routers name. Then he disconnects my PC and brings my home router down. When reconnecting, I actually connect to the fake AP, which accepts any PSK, not to my own router.

Is that possible? In detail:
- is it possible to disconnect me from my home router?
- is it possible to bring my router down or make it invisible?

If this is possible, any of those WIFI attacks that are described for public (fake) hotspots would also work with private and secured WIFI routers, be it at home or in the office! How would I protect myself than?

No, if you are using WPA2, even though they may be able to deauth you from your router using one of the mentioned exploits, since your original question had to do with a PSK protected network, assuming you are using a WPA2 connection, the four way handshake will require that the AP prove itself to your system.  A rogue AP would be unable to do this as it would be unaware of the pre-shared key and the connection would be aborted.


wordpress remote user authentication I am having multiple wordpress sites with multiple users working on those.

Therefore I would like to centeralize the user management, by having one authentication server, storing the username, password and website this user can access. This way i can easily e.g. reset passwords in one place instead of having to go through all websites one by one

**Each website will get a wordpress plugin which works the following way:
a user logs in ->  plugin intercepts the login and sends a curl request via tls to the authentication server -> this server checks the authentication and authorization and returns true or false.

The authentication server will have a common WAF and only the known servers whitelisted in iptables. Additionally, when installing the plugins, there is a pair of keys generated which have to be inserted on the wordpress end. Using the key the communication between wordpress and authentication server is additionally encrypted (in case there is a man in the middle despite the tls)**

With a setup like this, are there any obvious vulnerabilites that i have overseen ?

Thanks for any input

Create a LDAP server for setting up the users and then use one of the multiple wordpress ldap plugins to handle the authentication.


How to approach creating a Linux app that requires root privilege? I'm working on an indicator for Ubuntu, and one of the tasks it's supposed to perform is chmod -x and chmod +x a specific root-owned binary (/usr/lib/x86_64-linux-gnu/notify-osd to be precise). As far as I understand, my options are:

run command with pkexec  each time ( which I kind of want to avoid for the sake of user experience );
since the indicator is in python, I could have a binary with setuid bit set written in C. However, I've been told this approach is frowned upon;
start a "proxy" which will run as root and only perform that one specific task , and the indicator will communicate with that "proxy"

My question really is , which approach would be best in terms of security AND user experience ? How should I approach implementing an app that needs one, very specific task to be done as root , and the rest - as regular user.

There's not really one correct answer to this question. It's a trade off between security and usability.

  run command with pkexec each time ( which I kind of want to avoid for the sake of user experience );

If the intended audience does not have "CLIphobia", sudo could be really great here if "each time" is within 15 minutes.

But from a security point of view, I'd recommend pkexec.  I assume it can be trusted as it comes pre-installed with the distro, unlike some quickly hacked up setuid wrapper or daemon.

  since the indicator is in python, I could have a binary with setuid bit set written in C. However, I've been told this approach is frowned upon;

The only problem I have heard of with setuid wrappers is that they can overwrite themselves with a trojan if they exploited, but this is not relevant for setuid-to-/root/ binaries as any exploit on a process running as root means you're screwed anyway.

The only problem I have experienced does not apply to setuid-to-/root/ binaries either, it was so that I did not understand all of unix user ids and forgot to set the real user ID, saved user ID and their group ID equivalents, this meant that a program that /drops/ privileges can still gain them back.

There could be other reasons why setuid wrappers are frowned upon, but I haven't heard of any. If no one else can find reasons why setuid wrappers are frowned upon, a setuid wrapper will be a really good choice.

  start a "proxy" which will run as root and only perform that one specific task , and the indicator will communicate with that "proxy"

If you create a daemon to do the task, keep it as simple as possible and make sure that unauthorized users don't get to communicate with it.

I can think of two options: (1) use a password that an authorized client would know, the daemon does know and an unauthorized client does not know. The password would have to be stored in a file chmoded 400 and owned by root.

(2) use unix permissions on the socket to prevent any other local user to even try to (ab)use the daemon.
https://stackoverflow.com/questions/20171747/how-to-create-unix-domain-socket-with-a-specific-permissions

Option two can be considered less secure and more inconsistent at UX.  The user might not understand why it won't work when they're logged in as a different user which is really bad when it does happen.


My Mom's Flash Player So I am slightly more than a dilettante when it comes to security but hardly an expert. I have been reading up on the recent Adobe Flash issues and I wanted to ask a couple of questions:

My Mom uses Mozilla on her computer and they have all but completely disavowed Flash. Flash is still used on most ticket buying sites and my mom still likes buying tickets to things. If I disable Flash permanently is there a workaround for her to still be able to use these sites?

What exactly are the vulnerabilities in Flash? I keep seeing references to "zero day hacks almost being a feature" but no one seems to be saying what can be exploited in the package?

This really all stems from a problem that I am sure you are all familiar with: My Mom (or in your case friend, dad, grandparent) assuming that since you code you can fix all technology problems ever. Thanks.

Flash has been a high-value target for exploit developers for years, particularly because of its near-ubiquitous installation base and the fact that (historically) it will generally run automatically whenever a page with Flash content is loaded. This makes it very easy for a large number of systems to be targeted and compromised with a single exploit.

As it turns out, Flash apparently has a lot of flaws for those developers to discover as well. This has resulted in dozens upon dozens of Flash-related CVE entries every year, with many of them starting off as zero-day exploits. Flash Player is currently #16 on CVE Details' Top 50 most vulnerable products list, with a total of 510 vulnerabilities discovered since 2005. The last year in which there were less than 50 vulnerabilities discovered for Flash Player was 2009, and there's already been 132 discovered this year!

Flash Player Vulnerability Statistics

The vulnerabilities that have been cropping up aren't trivial things, either. Nearly 84% of Flash Player vulnerabilities discovered to date are usable for code execution, and about 80% of all Flash Player vulnerabilities are rated with a CVSS score of 9 or higher!

So, what can happen if you keep Flash enabled while indiscriminately browsing the web? Very bad things.

What should you do if you use some sites that still require flash? Find a different provider for those services, if possible, who doesn't require Flash for their site. All major browser vendors are abandoning plugins in general, so it's just a matter of time before you'll have to start using some obscure specialty (and/or outdated, and therefore even more vulnerable) browsers if you need Flash.

If you absolutely have no other choice but to use Flash, Chrome currently has a built-in Flash Player that gets automatically updated along with the browser. IE 10 and later, on Windows 8 and later, also has built-in Flash but Chrome is preferred for its (generally) better security and background updates.

Another thing you could try is to just disable Flash and see what happens. Many sites will say they require things like Flash and JavaScript, while their most critical functions actually do not depend upon them. Often times, the Flash/JavaScript used on those sites just enables some features that offer added convenience or non-critical functionality. In a number of other cases, you'll find that the only thing that breaks with Flash/JavaScript disabled is the ads!


Can an ISP detect or log specific devices connected to ISP-provided home routers? Let's say I’m using a Dell Inspiron Laptop. Does my ISP have a log of this or can they detect what devices are connected to my router?

The Possibilities

If you are using a modem and router provided by your ISP, then they can potentially have full access to data about your connected devices.  This is because if you are using their device, then you don't really have a network of your own - your house is just an extension of their network.  Some ISPs may use off-the-shelf hardware, in which case they may not take advantage of their access to your home.  However, since they provided the hardware, they also have an opportunity to customize the firmware (the software running on the router) to do whatever they want.  The router certainly knows about all the devices connected to it, and it would be very easy for them to customize the device to send them data about what devices are connected and when.  It wouldn't surprise me if many companies do this for general data collection purposes or to look for violations of their terms of service.  In many jurisdictions (especially the US), I'm sure doing so would be completely legal. Whether or not any particular ISP is actually doing this is another question, and difficult for us to answer.

Regardless of whether or not An ISP tracks your devices through your router, they can still see all of your network traffic of course.  This means they can read any traffic that goes across in plain text (which primarily, but not exclusively, means HTTP).  If you use their DNS servers (which will be the case unless you change it yourself) then they can also tell what sites you visit, even if over HTTPS.  Lots of information about your devices can be gathered from your traffic, so they probably wouldn't have any trouble tracking connected devices exclusively through your HTTP traffic, as long as the devices are actively fetching data from the internet.

Actionable Steps

If you are concerned about the possibility, then the simplest solution is to use your own modem or router.  Some ISPs effectively require use of their modem (for instance, I'm still using the modem provided by my ISP because it is difficult to find modems compatible with their network).  Fortunately, using a different router is the important part.  If you plug your own router into their modem and connect your devices only to your router, then you will make it much harder for your ISP to keep track of which devices are connected.  After all, the only device they will directly "see" is your router.

Once you are using your own modem you can configure it to use a public DNS service (opendns or cloudflare for example).  There is a lot of information hiding in your DNS queries, so this is an important step for the privacy-conscious.

If you really want to hide info from them though you'll mainly want to setup a VPN service 24/7.  They must be properly configured to make sure you don't leak data though, so it helps to know what you're doing when setting one up.  Personally I don't think that step would be worth it for the average user, but that's a decision for each person to make on their own, especially given recent news coverage about regulatory changes (at least in the US) that may give ISPs more rights to sell the data they collect about you.

https://www.forbes.com/sites/thomasbrewster/2017/03/30/fcc-privacy-rules-how-isps-will-actually-sell-your-data/#5825ab6021d1


How to make information unrecoverable? I manage a company's equipment and the manager has used a piece of equipment for the last 3 years. He told me, that he will give that equipment to one of the employees. However, he has told me to please make sure that the information on it is deleted so that it is unrecoverable.

I like this subject and don't know much about it, so I deleted the information with the linux "rm" command. I know that it is still possible to recover it with forensic techniques. The information on the device was critical, e.g. customer information and information about upcoming projects to be released.

The questions are:

Should I format several times to make the information
unrecoverable and overwrite the data? 0's and 1's?
I deleted the information first and the partition was not
encrypted. What happens if I encrypt the partition now? If the
computer is stolen, could the information be recoverable?
Do programs like BCWIPE work?
What recommendation would you give me so that no one could
recover that information that I already deleted with "rm"?

The root disk is SDD and the partition that is not encrypted is HDD. Currently the system is with the Manjaro distribution.

This is a recurring question, and it comes with a bunch of caveats.

Threat level is a factor. If this is government classified data the official answer is "Destroy the Drives!"

That said, in the commercial world there is a lot more tolerance.

Running DBAN or dd with zeroes against the entire drive will sufficiently wipe it. You should of course VERIFY that the wipe actually took place by looking at the drive contents and confirming zeroes. Zeroes are easier to confirm than random.

You don't need to perform multiple wipe passes to defend against magnetic force microscope attacks. This was a laboratory curiosity more than two decades ago against MFM disk drives that are no longer used and against drives that measured in MEGAbytes. Even then, they could only extract a handful of bytes. A single pass of zeroes will defeat any Earth based forensic facility.

True, bad sectors and hidden disk overlays won't be wiped. If this is a realistic concern for you, fall back to the DoD standard of destruction.

Trotting out wear leveling for solid state drives is also a bugaboo of little reality. Yes, it's technically possible to perform chip-off removal, bypass the on-chip wear processing and find data that survived wiping. However this data is tiny discontinuous snippets and bits that are nearly impossible to reconstruct context from. This is beyond all standard forensics labs and would cost millions of dollars in the specialty labs to even attempt it and would likely yield little to nothing for the effort.

Again, if this is a realistic concern for you, fall back to the DoD standard of destruction.

The drive costs are likely no more than a couple/few $100 bucks, act accordingly.


Break encryption by applying accidental-overwrite techniques I read that there are ways, at least on mechanical drives, to sometimes recover data that was overwritten (not just deleted).

Now I was wondering if it was theoretically possible to break a fresh encryption of a partition that already held data (so no wiping or anything done) by applying the same (probably expensive) approach - treating the encryption as an accidental overwrite.

I'm only using encryption to protect my self against losing my notebook, not to protect my data against dedicated experts with lots of funds at their disposal (they'll just steal my passphrase anyway), but I was just wondering if the described way is feasible.

No one has ever actually demonstrated successful recovery of overwritten data on  a modern hard drive. It's an urban legend stemming from the days of hard drives with capacities orders of magnitude lower, which had enough inefficiency in their data storage that it was potentially an issue. See this Wikipedia article and its references.


How do I discern the authenticity of the website? I'm sure you've heard of gatt.org being the fake website for the WTO. What I'd like to know is, when I'm on the Net, how do I discern the authenticity of the website? I was thinking something like Alexa, but where I don't have to pay to get extra details.

It doesn't seem like you are asking how to determine if a site is posing as the 'real' site, which would be phishing, but what you are really asking is how to validate the content of a site, which is more of a philosophical question than a technical one. How does one determine, for instance, that The Onion is not a real news site?

We can check the 'whois' information for the domain to see if it makes sense, but even then, there might not be enough data to go on. SSL certs might help to provide extra data, if one is used and not faked.

We can use Google searches to search for likely 'true' sites and compare, but that has its own obvious limitations.

How, then, can you determine that an otherwise legitimate site is offering valid and true information? You need to validate. Just ask wikipedia. They hope that with enough eyes and hands, the truth should bubble to the surface, but that is only marginally effective.

This goes back to the very first advice handed out when websites started to become popular: use your head and don't believe everything you hear.


Microsoft email servers "require remote control of Android device security features" Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (outgoing). So I set it up like I always do with a new account, but at the very end I was presented with an alarming ultimatum:

Unusual. But okay, sure.

Slightly concerning, but it's probably nothing.

???

I'm not usually one to freak out about smartphone app permissions, but this is different. This is directly from a Microsoft server. This is crazy. I just want to check my email. Why does that require me to surrender these remote administration capabilities to Microsoft? What is going on? Is it normal? Is it safe? Is it ridiculous; or is it nothing?

Thankfully, you don't surrender remote admin capabilities to Microsoft.  However, you do surrender them to the e-mail system's administrator or some other IT admin there.

Generally this is kind of security done at a corporate level.  Corporations are as a whole concerned about loss of their intellectual property or privileged information (such as customer financial data or medical records).  As such, when they manage phones, they have to be able to remotely wipe a phone in the event of theft or loss to protect their reputation, their intellectual property, and their customers' privacy.

Is it safe?  Generally, although there are cases of admins getting something wrong and wiping the wrong phone.  Thankfully Android allows you to sync your data up to Google, so you generally don't lose anything, including purchases made through the application store.

I'm not a big fan of doing this for a university setting where you are a student.  You shouldn't have access to privileged or confidential data.  However, given the sex scandals that seem to crop up regularly, I suppose that they need to be able to wipe a phone where video of an assault is being distributed or stored.   For a university employee, OTOH, it makes perfect sense to me.

This is an enrollment in a Mobile Device Management solution as part of viewing email on the device.  Technically it's not being managed by the email servers.


Intricate fraud attempt on eBay I would like the community's input on an event that took place recently, that I honestly don't know what do make of:

When trying to watch an item on eBay, a warning notice said my account had been compromised and that the account was locked to prevent abuse.
I wrote an email to eBay and got a response from customerhelp@ebay.com saying:

I must call them by telephone to reopen my account.
The call would take 10+ minutes.
The call would be handled by a person in a specified Asian country.
The email was full of phrases like "Your obedience is important to us".

There's been an explosion of phone fraud where I live lately, and the details above obviously scream "fraud" (confirmed after writing an e-mail to spoof@ebay.com), but what I don't get is:

How did they manage to trigger a "Your account has been locked" message on eBay in the first place? (This warning appeared on two occasions, but seems to have disappeared now.)
More importantly, how did they ever manage to take control over customerhelp@ebay.com? (My email was quoted in their response, which proves their access to this inbox.)

Furthermore, spoof@ebay.com were not very helpful in explaining what had happened or anything. I'm not even sure if I should trust their response...

Update: spoof@ebay.com does not provide any explanation to the incident, despite several requests. customerhelp@ebay.com is still responding in their customary fashion, as if just waiting for me to take the bait. Maybe I should just close my account. It's been years since I bought anything from this ageing dinosaur who haven't changed their design since the nineties and evidently have no control or interest in their security or customers. (PS! A week after writing this paragraph, eBay shows a link to switch to a modernised design. This issue has now entered the twilight zone.)

Below is an extract of the email headers. It also contains a couple of DKIM entries.

From: customerhelp@ebay.com
Received: from mxphxpool1032.ebay.com ([66.211.185.135])
Received: from mxphxpool1004.ebay.com (phxlb238-ext-snat01.phx.ebay.com [10.4.13.31])
Received: from phx8b02c-f396.stratus.phx.ebay.com (phx8b02c-f396.stratus.phx.ebay.com [10.193.75.168])
Message-ID: <***.JavaMail.cronusapp@phx8b02c-f396.stratus.phx.ebay.com>

Update: I just noticed that the communication with eBay is actually shown in "My messages" on ebay.com! Is this eBay communicating after all?? But what kind of customer service writes stuff like "Your obedience is important to us" to their users and needs a long International phone call to verify accounts? Outsourced customer service? Or even, outsourced customer service gone rogue dashed off with bad English and cultural references incomprehensible to the western world.

  It’s been half of the Year, a Blessed day to you and your family!

  Thanks for getting back to eBay Customer Service. I know it wonders
  you how long will the Identity Confirmation take. My name is Lester(*),
  don’t worry, I will do my best to help you today and give helpful tips
  when reaching us over the phone.

  First off, I want you to know that it makes me happy personally that
  you have lent us time by talking to us over the phone and for being
  open-minded. Your obedience and resourcefulness are really important
  for us.

  We are located in the Philippines at
  the same time I have to tell you honestly that we will not be able to
  disclose the exact location of any of our representatives. This is due
  to security measures and practices.

  And I believe that ATO calls will take less than 12 minutes. This is
  as long as the questions that needs to answered will consistently
  delivered.

(*) - The name changes for every email.

You have taken a sensible set of steps to resolve the matter yourself. Kudos for not getting stung.

However the main indicators of an issue you are reporting here seem to be related to the content rather than the technology.

  a warning notice said my account had been compromised and that the account was locked

That may have come from eBay as a result of an attackers actions or it might be part of the attackers ploy. Did you check you were using HTTPS? Did you take a note of the details on the certificate? Did you compare them with the details when you log in from elsewhere? What browser were you using?

  I wrote an email to eBay and got a response from customerhelp@ebay.com

What email client did you use (subsequently answered partially in comments)? Where did you get the address you sent the email to? Was the address you sent the email to the same as the From/Reply-to address on the response? You did say the response quoted your original email which is significant. Including the full headers from the response here might have been useful.

  I must call them by telephone to reopen my account.

Was it a toll-free number? Did you try to verify the number appeared on the eBay site using a different computer elsewhere? Did you try googling the number (again, on a device elsewhere) to see if anyone else had come across this?

  fraud [...] confirmed after writing an e-mail to spoof@ebay.com

I hope your correspondence with spoof@ebay was initiated from a different device. In this instance it would appear that your email to them was not diverted, but if you suspect that an attacker might be able to subvert one @ebay.com account, then its reasonable to assume that all the correspondence to that domain may compromised.

  How did they manage to trigger a "Your account has been locked" message on eBay

I have no idea. I think its more likely that they found a method of triggering this behaviuour at ebay rather than a MITM/MITB attack against your HTTP session. Organizations tend not to publish the secret sauce recipe by which they identify fraud. But it may have been as simple as typing in the wrong password lots of times.

  how did they ever manage to take control over customerhelp@ebay.com?

They don't need to.

It might be sufficient to control any of your device, your router, the router at your ISP, the mail server at your ISP, the DNS server at your ISP. It is also possible that the ebay mail service has been compromised. Many large organizations outsource their support to the cheapest call centre. So even when you are corresponding with the designated eBay support people, you might not be corresponding with people employed by eBay. So in addition to the servers/routers at eBay, and the servers/routers at the call centre, I think its reasonable to include actions by rogue agents currently or formerly employed by the call centre as potential candidates.

While the DKIM and partial headers suggest that the fraudulent responses were routed via eBay's servers, there is not enough information here to prove that is the case. There is enough information in the original email to prove if this is true.


Cisco EPC3928 router unknown host I have a Cisco EPC3928 router on my home network. While scanning my network, I found an unknown Linux host.

Host details

Linux 2.6.9 - 2.6.30
192.168.0.13, no IPv6 address
mac 00:11:E6:DE:AD:07 (Scientific Atlanta/Cisco)
Last boot same with router
open ports
80 tcp http-proxy sslstrip (empty page, OWASP ZAP receives 400 response code)
139 tcp netbios-ssn Samba smbd 3.X
445 tcp netbios-ssn Samba smbd 3.X
2468 tcp unknown
4321 tcp http-proxy sslstrip (empty page)

I cannot filter or block it from the LAN, I don't believe it's likely able to access the Internet, but I cannot be sure.

I was able to find a few posts related to the MAC address and the case seems to be connected to Cisco EPC3928 routers. There is also Github code (FM-SmartLink), where the same MAC address is used. (I don't have enough reputation to post all links)

Possible Cisco Router Hack?
Strange linux machine

Is anyone familiar with this kind of case? What might cause it?

TL;DR - There is nothing to worry about, appears to be caused by something running in the background of the OS.

This is a very common "issue" with "Cisco" EPC products and it appears to be an underlying OS "feature" that causes this "issue".

The problem comes from the fact that "Cisco EPC" products are not actually Cisco at all, they're Linksys products which have been rebranded as Cisco products. If you were unaware since 2003 until 2013 Cisco was the parent organisation of Linksys, all products that Linksys had developed or had been developing were sold as Cisco products not Linksys ones. The problem with that is Cisco never redeveloped these products, nor did they care to they simply just sold & marketed them as Cisco products but the truth remains - they aren't.

You may be wondering why that's a problem? Well it's not a problem as such it's more a thing you need to take into consideration, as these are not Cisco products they do not run the "real" Cisco IOS whilst I cannot provide you with a data-sheet for this information (As Cisco have since retired the product, removed all data from the website with the exception of forum threads and EOL'd it) what I can provide is an example of another product with the same commonality.

If you're familiar with Cisco equipment you will have probably heard of the SF & SG family, these are "Cisco" switches, like the EPC line they're not actually Cisco switches, they are in-fact Linksys switches this is evident when interacting with the CLI - one example would be when trying to use the backspace key, on a "real" Cisco product backspacing works as you would expect but on an SF or SG switch it doesn't - you must hold shift in order to use the backspace key. Another example is the following command boot system image-1 that command doesn't work on a "real" Cisco switch, take the 2960 family for example that command would actually be boot system flash:filename

The overall point is these products aren't running Cisco IOS (Which isn't Linux) what they're actually running is another OS based on Linux which tries to mimic Cisco IOS as closely as possible (Hence my examples). This explains why the OS shows as "Linux", this also explains why the MAC is a Cisco MAC because it is technically a Cisco product it's just not made by them. However, you shouldn't be worried about this, it's not causing harm to the network at all, it just appears to be something that runs in the back-end of whatever OS these EPC devices use.

As I said at the start Cisco haven't and probably will never release a statement on this partly because of the products being EOL'd and partly because of the fact that it's not something which is affecting you, it's just built into the OS to run in the background for an unknown reason which we'll probably never know.

If you read this you will see the device directly supports Samba server (Which I believe you already know) this will be whats going on, as the post you linked said switching it off should "fix" it.

Disclaimer - I am not directly affiliated with Cisco, I do not work for Cisco, I do however work for a Cisco partner. Anything in this answer is not the word of Cisco it is the word of my own as an individual based on research I've carried out. Please do not take this answer to be the official answer to the problem as Cisco have not and probably will not ever release an official statement on the issue.


Is a QEMU live session less secure than a proper VM? I often test malware in QEMU VMs, and after I have tested some malware in a VM, I delete the VM for security reasons as well as the fact that if I want to test more malware, a clean environment to start with would be preferred.

However installing a new OS in a VM takes quite some time, especially Ubuntu and Fedora, so an easier option would just be to boot directly from the ISO and use a live session for one of those OSs.

But I would like to know, is running a live session from an ISO where data may be written back to it and kept there less secure than installing it properly to a Virtual Hard Disk? Is there actually any difference? Is the live session at all less secure than a proper one? Or are they the same and equally safe for malware testing?

My host is Arch Linux.

Testing from a "live" session VM might be slightly more secure, but considerably less thorough.

Live sessions use a RAM-based file system like SquashFS, aufs or UnionFS to simulate write access to the primary partition.  Malware can propagate by writing worms into the master boot record of the volume, which can be simulated (and scrutinized) from a qcow volume or raw disk image, but is completely absent in an ISO-9660 optical filesystem.

If I were you I would consider making a "starter" images of vanilla Ubuntu / Fedora, then make copies of those to test your malware.

If you're extra paranoid that the malware might "break out" of its VM, you could make sure you are running QEMU as an unprivileged user.


Safe harbor in USA, EU, and Russia I am doing research on Google's Blogger service and its privacy protection features.
They say that Google complies with the U.S.-EU Safe Harbor Framework and the U.S.-Swiss Safe Harbor Framework. I've read EU Safe Harbor on website.
The first sentence says

  The European Commission’s Directive on Data Protection went into
  effect in October of 1998, and would prohibit the transfer of personal
  data to non-European Union countries that do not meet the European
  Union (EU) “adequacy” standard for privacy protection.

So can someone explain me what second part of this sentence really means? For example Russian user registers a blog on blogger.com platform and writes notes. Basically user transfers his private information (mobile number, real name, email, address) to Google.

Am I right that next case is the point of quoted paragraph?

After some time someone (government for example) wants to get user's private data. EU commission must consider it "adequate" as they say and if it is, commission should enforce Google to give away private data.

Google has its own mechanism and policy for handling this kind of requests, but I want to discuss Safe Harbor, not Google. Google's policy should correspond to quoted paragraph since Google says that they compile with Safe Harbor, am I right?

Now, EU (or US) committee must decide whether requesting side is "adequate" or not. And here comes third question: where lies that line between adequate or not-adequate government standarts? There is a list of adequate countries? :) Or not-adequate? Or decision about country's adequacy in terms of privacy protection should be discussed in court? Which court then, russian, european or american?

I fail to see connection between these points. Please explain.

I found this paper on the internet: Internet data protection and privacy law, but seems that it doesn't have legal status. It says

  Although there are over forty Russian laws that in some way address
  personal or sensitive data, Russia has neither bureaucracies nor
  tailored judicial procedures to enforce its web of privacy rules.
  Violations, and privately held databases of private information, are
  said to be common.

So is russian privacy protection adequate or not? What about case I provided? Should Google give away users privacy information to Russian government or not?

I know that in this case can be a lot of different gradations, but can someone explain situation in general?

Google has complied with 1% of requests for user data from Russian authorities, according to Google's Transparency Report.

Russian authorities can also make such requests via other countries who regularly break their own laws, like E.U. countries or the U.S.


Where can I use BLE/NFC U2F device? Can BLE U2F security keys be used on Chrome for macOS/Windows for any site supporting U2F USB keys as a second factor?
What sites/apps can I use NFC/BLE U2F keys for on NFC-(and BLE-)supporting Android smartphone?

Specifically interested in using these devices: 1 and 2.

Now = March 14th, 2017

For now : No. Perhaps in the future if/when Chrome (for Desktop) offer support for FIDO U2F over BLE (now only FIDO U2F over USB is supported).
For now, U2F over BLE support is in beta stage. U2F over NFC is more stable, officially supported by Chrome on Android but not widely adopted. This requires Google authenticator - not for the usual OTP part - (this requirement should disappear in the near future). You should be able to use U2F over NFC on GitHub and Facebook (through web/chrome not through apps).

The devices by Feitian you referenced are the first products of their kind (I already tested them) and you may use them with a beta apk Android application provided by Feitian. This application may offer more compatibility with online services (always through Chrome), but you will still experience issues. Problems are not only related to Feitian parts but to the official Google support too, this should be fixed in the next few months)

To summarize (March, 2017):

U2F over USB is stable and already adopted by many web services
U2F over NFC recently became stable, adoption is starting
U2F over BLE is being finalized (non-official beta support stage, with Google accounts on Android being one example already deployed first adoptions with few issues


Store password using sha1 I've been using the sha1() function to hash password before inserting it into my database. But I have this procedure so that it just won't be the password to be hashed.

My page would register a user along with their password. After submission, it would enter first the username into the database, then get the unique ID of that username. Then the system will combine it with the password.

$password = $userid.$password;

Then use sha1() to hash the password:

$password = sha1($password);

Then update the password in the database with that ID.

I used the user id like a salt.

Question

Is this a good technique? Though the only users of the system are the other department of our company, I think that it is enough for them in my opinion.

And what if I have a major project in the future that would required better security of password, will this be enough? Thanks!

No a salt should not be derrived from other known parameters, a salt should be globally unique. So the best you can do is to generate a really random salt for each password. Todays operating systems have a "random source", on a deterministic computer it is the best you can do to read form this random source (DEV_URANDOM).

Beside this, the SHA-* hash family is not appropriate to hash passwords, because this algorithms are ways too fast and therefore can be brute-forced too easily (3Giga SHA1/s). Instead you should use a slow key-derivation function with a cost factor, like BCrypt, PBKDF2 or SCrypt.

For PHP there exists a dedicated function to hash passwords, it is designed in a way, so it can change the algorithm in future if necessary, but can still verify old hashes:

// Hash a new password for storing in the database.
// The function automatically generates a cryptographically safe salt.
$hashToStoreInDb = password_hash($password, PASSWORD_DEFAULT);

// Check if the hash of the entered login password, matches the stored hash.
// The salt and the cost factor will be extracted from $existingHashFromDb.
$isPasswordCorrect = password_verify($password, $existingHashFromDb);

// This way you can define a cost factor (by default 10). Increasing the
// cost factor by 1, doubles the needed time to calculate the hash value.
$hashToStoreInDb = password_hash($password, PASSWORD_BCRYPT, array("cost" => 11));


Having trouble with learning Buffer Overflows So I have this program in C that I'm trying to exploit which has a vulnerability in a function, namely it's using gets. I'm trying to overflow and change the return address so the program returns one or both of the two functions that are not called.
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void half_win()
{
  printf("Well done, you got half the score\n");
}

void complete_win(){
  printf("FULL SCORE\n");
}
void vuln_func(){
  char buffer[36];
  gets(buffer);
  printf("You have entered: %s\n",buffer);
}

int main(int argc,char**argv){
  vuln_func();
}

So I overflow the buffer, I go to check the esp to calculate the offset by subtracting the address where the buffer starts from the esp's address but what's strange is that the buffer seems to overwrite the esp.
(gdb) x/24wx $esp
0xffffd0c8: 0x41414141  0x41414141  0x41414141  0xffffd100
0xffffd0d8: 0xffffd16c  0xffffd0f4  0x00000001  0xffffd164
0xffffd0e8: 0xf7fac000  0xf7fe574a  0xffffd160  0x00000000
0xffffd0f8: 0xf7fac000  0x00000000  0x00000000  0x98862ada
0xffffd108: 0xdada4cca  0x00000000  0x00000000  0x00000000
0xffffd118: 0x00000040  0xf7ffd024  0x00000000  0x00000000

So both their addresses are the same so the offset value is 0. I can't figure out what I'm doing wrong here. If any could give some guidance you'd be really saving me.
It's running on Ubuntu by the way.

This is a document I wrote, and will be presenting at BSides Tokyo tomorrow. Will probably help, since it looks like the same type of simple overflow.
http://sysrisk.com/files/WhyBufferOverflowsMatter.pdf
Add 8 bytes and that should overwrite EIP. Peda tools should be added to GDB to make all that offset calculation easier.


How to implement a secure web service? I want to make a web service where we can Login in this system with username and password. After the user select a file from his computer and send this file on server. I want encrypt this file to a group of users (I want use ABE cryptography). Now what are the steps to make them ?

My idea is:
Login to the system with basic username and password. I store the username and password to my database in a table.

After with ABE cryptography where can I save the Master Private Key and the Master Public Key ? In my database ?

After login, the system make a secret key of the user. I save my secret key in my database. After I use the Master Public Key to encrypt the file (I recovery it from a SQL query) and upload it on my server and when I recover the file, I decrypt it with my secret key (I recover it with SQL query).

Is this approch correct ? Is there an approch more correctly ?

First, your approach for usernames/passwords - it shows that you are a novice to security, which is fine, but means you likely ought not be designing a secure file store.  However, here goes with some more constructive feedback :

1) You NEVER store user passwords. Full stop. What you do is store a salted and hashed version of their password.  When they attempt to login, salt and hash, compare with the stored hash.  From OWASP : https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

2) There's no reason to use asymmetric encryption here - you can simply encrypt and decrypt from your data store.  Store your key (and IV) in a secure location - traditionally, this is a file only accessible to your application on the server, where you ensure your application is running as an isolated user.  However, more modern systems for key storage include HSMs (hardware modules, very expensive) or systems like Keywhiz or Hashicorp's Vault - complicated, but cheap.  This is better if you want key rotation (good!) and redundancy in application servers.

Seriously, if this is a real application, these are things that need experts beyond random ones on the internet - there are a lot of subtle errors you can make that will devalue all the other security measures you take.  You need to do everything right - get some professional help.


Is it possible to have an RSA authentication subkey with a DSA master key? My key setup is as follows:

sec  dsa3072/CA72E53A
     created: 2013-05-12  expires: never       usage: SCA
     trust: ultimate      validity: ultimate
The following key was revoked on 2016-01-13 by DSA key CA72E53A
ssb  elg4096/ADBBBE42
     created: 2013-05-12  revoked: 2016-01-13  usage: E
ssb  rsa4096/6A743003
     created: 2016-01-13  expires: 2018-01-12  usage: E
ssb  rsa4096/A57F2B30
     created: 2016-01-13  expires: 2018-01-12  usage: S

I am trying to transition to RSA subkeys as I want to use a Yubikey for my keys, but started out with a DSA/Elgamal key.

But when adding new subkeys I don't get the option to add an RSA (or DSA) key with custom parameters. Is this a result of having a DSA master key?

gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
Your selection?

A workaround I am considering is genereting a new keypair just for authentication purposes (RSA/RSA), not publishing the public key and uploading that authentication key onto the yubikey, but I don't know if that is supported by the Yubikey and if it has other downsides.

Is it possible to have an RSA authentication subkey with a DSA master key or am I trying to do something silly and should I just bite the bullet and transition to a new RSA master key?

I am using GnuPG version 2.1.9.

You need to activate the --expert mode to select arbitrary combinations of algorithms and capabilities (inside given technical limitations, DSA keys will never be able to have signing capability).

$ gpg --expert --edit-key [key-id]
[snip, key-listing]
gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)

Your selection?

Enter 8 to create an RSA key.

Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection?

Now, one after the other, enter e, s and a to disable encryption and signing and enable authentication capabilities. Finally select the key size:

RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)

Continue as usual.


PCI DSS and Memcached If I store cardholder details (PAN, Expiry etc.) in a Memcached data bucket, is that something to worry about in terms of PCI DSS compliance?

Our database is in a data center and is encrypted. Our web server is also in this data center. If I cache cardholder details on a Memcached server node which is running on the same box as the web server, or on a different machine on the same subnet as the web server, do I need to obfuscate or encrypt this cached data?

My initial thought is 'no' because we aren't persisting the data; it's all temporary storage.

edit: our current architecture is PCI-DSS compliant; we were deemed compliant a few months ago. Now it's a matter of remaining that way.

It's persistent enough to be retrieved.  There's no reason to keep any personally identifiable data unencrypted.  If you can access it without a key so can an intruder.

Make it secure, and it will be compliant.  Don't try and make it compliant by adding security later.

Being compliant (by passing your ROC) doesn't mean much to be honest.  Companies that perform that activity are of varying skill, and often are selected based on the subject companies likelihood to get a pass.  That is not how you protect your companies brand.

If you want ammo for the highers up, what about Massachusetts privacy law?  How are you complying with your data requirements there?  What about the EU   http://en.wikipedia.org/wiki/Data_Protection_Directive and the third party transfer clause?

Encrypt PII/PAN data whenever it's sitting, setup appropriate key management, and use proven crypto-systems to do it.  Be smart about protecting your customers data and your companies brand image and you will be compliant.


Are there any solutions available which conform to AAA protocol? According to Wikipedia (http://en.wikipedia.org/wiki/AAA_protocol)

  In computer security, AAA commonly stands for authentication, authorization and accounting. It refers to a security architecture for distributed systems, which enables control over which users are allowed access to which services, and how much of the resources they have used.

Did anybody have heard of any software implementation to the above protocol?

Thanks,

AAA is a concept and an actual software implementation of AAA is in the RADIUS protocol.

  Remote Authentication Dial In User Service (RADIUS) is a networking
  protocol that provides centralized Authentication, Authorization, and
  Accounting (AAA) management for computers to connect and use a network
  service. RADIUS was developed by Livingston Enterprises, Inc., in 1991
  as an access server authentication and accounting protocol and later
  brought into the Internet Engineering Task Force (IETF) standards

FreeRADIUS is the most widely deployed RADIUS server in the world. It is the basis for multiple commercial offerings. It supplies the AAA needs of many Fortune-500 companies and Tier 1 ISPs. It is also widely used in the academic community, including eduroam. The server is fast, feature-rich, modular, and scalable.

TekRADIUS runs on Windows and offers a GUI. The basic features are offered for free; additional versions can be purchased. The TekRADIUS Enterprise version ($149) adds support for EAP-TLS, dynamic self-signed certificate creation for PEAP sessions, NTLM authentication for MS-CHAP authentication methods and regular expression based attribute matching. Then the TekRADIUS SP version ($449) gives you VoIP billing in addition to the enterprise features.

ZeroShell is a router OS, but it is open source and completely free. It also includes a built-in RADIUS server among the usual router functionalities: NAT firewall, VPN, and so on. ZeroShell is offered as a live CD, so it doesn't have to be installed and requires only a small drive to save the configuration.

Here is how to configure and run a RADIUS server on Linux.


How to know the time of compilation I've read that a malware found by kaspersky was compiled at the moscow time zone. How they know the time of compilation ?

It is possible to get the compilation/linking date/time, for instance from the COFFHeader.TimeDateStamp field. But that doesn't give you the time zone as the field is just "the number of seconds elapsed since midnight (00:00:00), January 1, 1970, UTC". I presume Kaspersky concluded a Moscow TZ by looking at the compile date/time of multiple different versions and seeing most are between 4AM UTC (8AM Moscow) and 2PM UTC (6PM Moscow) (similar to an analysis FireEye did in their Apt28 report, page 27).


Is it secure to have public access to the file on S3 with `secret` url? For example https://s3-eu-west-2.amazonaws.com/mybucket/620f5cb4132cf1b4619503ece569599e

This is a private file, I send to the web-browser through https link to that private file - but this file is publically accessible by this link. Should I add auth using header information that S3 will read? But I think that if somebody will take this link from memory - attacker also can steal a header too.

Name of file - md5 of content that was generated for that client. Also after one day this file will be automatically deleted.

UPDATE: in the normal workflow user will neither see nor operate in any way with this links - but can find them in developer tools of the browser.

UPDATE 2: thank you for related links, I read them, yes this questions quite relative, but specific of this question: 1) public files on Amazon S3 2) User do not see urls.

UPDATE 3: reading related questions I found possible scenarious:

1) Browser crash can send url to the third-party server (I am not sure but sound realistic).

2) User install some anti[virus]/proxy that send all HTTP call endpoints to the third-party servier (not sure about this too).

If it's intended to be a private file - it is not a good idea to leave it open to unauthenticated public access.

While the design of the public URL generation itself may make it impractical to discover it, depending on how you share it with your target audience, the links could be shortened - and the shortened links could be discovered much more easily not only through bruteforcing but also through insecure methods of sharing.

There was a research done less than a year ago (I need to look it up again for references) - where researchers found that bruteforced shortened links often resulted in files of this nature - open for unauthenticated public access, depending on obscurity.


Sending session cookie inside the HTTP response body It's known that the secure practice of setting a session cookie is using Set-Cookie header with Secure and HttpOnly flags. But is there any security issues with sending cookie inside the HTTP response (and request) body? For instance, like this:

HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 09:23:37 GMT
.........
.........
.........

sessioncookie=abcdefgh

And what if I set cookie using Set-cookie AND also send in the HTTP response body in the same HTTP response, would that lower security somehow?

Setting cookies in the body

You cannot set cookies in the response body (browsers don't look there for cookies), nor can your browser present cookies in the request body (the server won't look there).  Cookies by definition are carried in the HTTP header (see RFC 6265).

Putting secure data in the body

You can certainly send other session data or tokens in the request or response body (e.g. it is common to pass a CSRF token in the body), but if you do so they are not cookies. Whether this is a good idea is a different question.

Most data is OK in the body, after all that is the only part that the user can see and sometimes the user needs to be shown sensitive data.

However, some data is not OK in the body.  Anything that you wish to make unavailable to an XSS attack, for example, must not be in the body, and should only be contained in an Http-only cookie so that it cannot be read from the DOM.

That being said, some data is better off in the body!  For example, anything that you don't want to show up default IIS logs should be placed in the body.  Anything you do not want included in a session riding forged request (a.k.a. CSRF) should be included in the body and not as a cookie.

Setting data in both

It is not necessarily a security problem to set a token in both a cookie and the body.  In fact this is exactly the pattern required by the Double Submit Cookie CSRF mitigation.

On the other hand, if you are just passing the session ID in the body for the heck of it, and it is a duplicate of an HttpOnly cookie, then you have just nullified any benefit of using the HttpOnly flag, since the same value can be read from the DOM.

Also, here's something really fun: If the site sets an HttpOnly cookie from the server side, and the same cookie value is passed via the page body and set via client script, your browser will end up with two cookies with the same name!  This condition should be avoided because there is no HTTP specification that states which cookie should be presented in this case, and browser behavior will vary.


DSA Generates different signatures with the same data I'm using the example given in msdn  article about the DSACryptoServiceProvider Class. The problem is that I get a different signature each time I run the code. I tried OpenSSL and didn't get this problem but I need to work with System.Security.Cryptography this time.

This is some source code:
this is the hashed value to be signed

byte[] HashValue =
        {
            59, 4, 248, 102, 77, 97, 142, 201,
            210, 12, 224, 93, 25, 41, 100, 197,
            213, 134, 130, 135
        };

and this is where the problem lies

 // The value to hold the signed value.
        byte[] SignedHashValue1 = DSASignHash(HashValue, privateKeyInfo, "SHA1");
        byte[] SignedHashValue2 = DSASignHash(HashValue, privateKeyInfo, "SHA1");

I used the debugger to figure out the SignedHashValue1 doesn't equal SignedHashValue2

Traditional implementations of DSA choose a random nonce for each signature operation. This leads to a different signature, even when signing the same data. The problem is not that the signature is different each time, it's your wrong expectation that it should be the same.

Check Wikipedia on DSA for details:

  Signing

  Generate a random per-message k
  Calculate r from k
  Calculate s from r and the private key
  The signature is (r,s)

Since k differs for each message, the signature is different as well. This random k is essential to the security of DSA.

A nice alternative to a random $k$ is deriving it from the private key and the message hash via hashing. This behaves like a random value from an attacker's point of view, but prevents catastrophic failure when generating a signature using a weak PRNG. This approach will result in the same signature when signing the same data. RFC6979 - Deterministic Usage of the Digital Signature Algorithm (DSA) and
           Elliptic Curve Digital Signature Algorithm (ECDSA) specifies a way for doing this.

You shouldn't try to verify a DSA signature by signing again and comparing. You should use the specialized verification operation using the public key. Signatures are useful because you don't need the private key in order to verify a signature.

If you can use the same key for signing and verification, you should consider using a MAC instead of a signature. HMAC-SHA-2 is the one I recommend.


Does this case fit the definition of a replay attack? I read the definition of a replay attack on Wikipedia. However I don't know if the following case fits the description:
An attacker captures a HTTP request sent to a web server, modifies the request parameters and sends the request to the web server.

Is this a replay attack even if the request sent is not the same as the original?

A replay attack is sending the same packet more than once. Ie: charging your visa 10 times or resending authentication from a different source. What you describe is session hijacking or more specifically "sidejacking".


Are zip codes considered to be personal identifying information? A public website of a financial firm (falls under SEC) has a HTML 5 map of the US where each point on the map is the 5 digit zip code of their clients.  These points are generated from a CSV file that is pulled from the server into the browser so you can actually download the CSV file yourself.  The CSV file contains the City, Zip, and Latitude/Longitude of the zip code itself, not the client's street address.

I was wondering, are zip codes alone considered personal identifying information?

Netflix once planned to have a contest (to improve movie recommendations) where they would release movie rental history, movie reviews along their birth dates, gender, and five-digit zip code.  That combination is personally identifying information and could do things like out someone's private sexual identity if that could be inferred from their rental history.

A famous study found that with the date of birth, gender, and five-digit zip code you can uniquely identify about 87% of Americans.  It also found that you could uniquely identify about 100,000 Americans (0.04%) by the combination of year of birth, gender, and zip code.

For medical de-identification of protected health information (PHI), the US Dept of Health and Human Services suggests to truncate the last two digits of the five-digit zip code off, except for 17 rare zip codes starters (where less than 20,000 people share these three initial digits according to the US Census) (specifically 036, 059, 063, 102, 203, 556, 692, 790, 821, 823, 830, 831, 878, 879, 884, 890, 893) in which case you should replace the zip code with all zeros.

Similarly, you should be mindful of fields like age in exceptional cases are rare (e.g., there's only one American with an age of 116) so HHS recommends grouping these exceptional ages into one category (e.g., 90+).  It's also probably better to group other users into age categories (like 50-55) to help anonymize them further.


How to find out the email host of a vanity email address? Assuming a person gets his own domain address, say, theperson.com.

He then goes on to create a vanity email address with that domain. e.g. me@theperson.com.

me@theperson.com may be hosted by the person's own mail server, or somewhere else that offers vanity email services, such as Gmail, Yahoo mail etc.

To the uninitiated, using a commercial email service is useful as the service is already set up and running, and provides a more secure and stable environment compared to setting up a personal mail server from scratch.

So for an outsider, how do we find out which email service a person is using? Can I find out that me@theperson.com is actually hosted by Yahoo, or some other service?

Check the MX DNS record associated with the domain name.

e.g (under Windows, for @stackexchange.com):

O:\>nslookup
Default Server:  **********
Address:  **********

> set type=mx
> stackexchange.com
Server:  **********
Address:  **********

Non-authoritative answer:
stackexchange.com       MX preference = 1, mail exchanger = aspmx.l.google.com
stackexchange.com       MX preference = 5, mail exchanger = alt1.aspmx.l.google.com
stackexchange.com       MX preference = 5, mail exchanger = alt2.aspmx.l.google.com
stackexchange.com       MX preference = 10, mail exchanger = aspmx2.googlemail.com
stackexchange.com       MX preference = 10, mail exchanger = aspmx3.googlemail.com

aspmx.l.google.com      internet address = 74.125.136.27
aspmx.l.google.com      AAAA IPv6 address = 2a00:1450:4013:c01::1a
alt1.aspmx.l.google.com internet address = 74.125.143.27
alt1.aspmx.l.google.com AAAA IPv6 address = 2a00:1450:4010:c03::1a
alt2.aspmx.l.google.com internet address = 74.125.25.27
alt2.aspmx.l.google.com AAAA IPv6 address = 2607:f8b0:400e:c03::1b
aspmx2.googlemail.com   internet address = 74.125.143.27
aspmx2.googlemail.com   AAAA IPv6 address = 2a00:1450:4010:c03::1b
aspmx3.googlemail.com   internet address = 74.125.25.27
aspmx3.googlemail.com   AAAA IPv6 address = 2607:f8b0:400e:c03::1b
>

-> Google


Does ISO 27001 allow a company to use FTP? On a project I had to use unsecured FTP to connect to the hosting provider - not SFTP, not FTPS. The hosting provider proudly claims it's ISO 27001 certified. Somehow this all seemed quite wrong to me.

  Is it possible that a company gets ISO 27001 certification while still heavily making use of insecure protocols like FTP?

I'm not on this project anymore, I didn't get a proper answer when I asked in the past and I will definitely not get an answer if I ask the service provider about this now.

I'm mainly interested in knowing of how this works out in relation to ISO 27001 - and consequently to how much value I can place in this certification.

Is whoever gives out these certifications indifferent to an organization using FTP? Or is it more likely that the service provider kept this information away from the certifier?

Personally I don't trust any internet service provider that still uses FTP for anything. Let alone providing it as the primary option to their clients.

(I know the difference between FTP, SFTP and FTPS - well the difference between the latter 2 a bit less but that's beyond this question.)

Related but not duplicate:

Why do we trust organizations that certificate ISO 27001?

UPDATE: Unsecured data WAS transmitted over an insecure channel. With a man in the middle attack skilled attackers would have easily been able to gain access to the internal network of the institution (I won't provide details here, but wow... I could've probably done it myself - and I'm not a pentest pro by any means). The service provider must have been aware of this.

ISO 27001 does not specify which protocols should be used and how they should be used, it specifies how an organization should structure its information security apparatus. An ISO 27001 certified organization must have policies in place and procedures to make sure the policies are adhered to.

ISO 27001 also has a scope which is defined by the organization which can make an enormous difference on the impact of the certification. A certification which covers the network enabled coffee machine is a bit different from one which covers the entire business. The ISO 27001 certification in the case of your question may not have the FTP server in scope.

FTP is perfectly acceptable to use in cases where the data transferred is public, or there are other controls in place to protect the data. If the data is encrypted before transit and there is a good verification system to ensure the data is not tampered with then sending it over a non-encrypted channel is ok. From an ISO 27001 perspective if the organization has performed a risk assessment and gone through a process to mitigate the risk then it's done what it is supposed to do.


What's the worst security issue what can happen by using eval() in Android WebView? I've come across a hybrid Android app - meaning most of its UI is implemented in a WebView using HTML and JavaScript technologies. The app itself is connecting to the server and one of the possible responses can include evaluate field, which is then directly executed via JavaScript's eval() command.

Is this a security issue? What kind of attacks can attacker do via this attack vector?

meh. eval might be scary or downright dangerous in the hands of the naive, but script tags are actually worse from a capability perspective, yet needed. Hybrid apps need scripts to run and can't do anything without them. Just like in a normal webapp, content will be fetched from a server, and some of that content needs to execute to drive the app.

The developers could put most/all of the JS into the client app instead of loading it from the server, but that gets stale quickly, or gets annoying by posing constant updates, while changing a server response is instant and invisible to the user. If the app uses a modular system and has a formal communication mechanism in place, it probably makes sense to deliver code using the same "pipeline to home" as the data. This offers the opportunity to sign, validate, restrict, isolate, and reject tampered code.

In terms of security issues, consider that all apps are a security issue. The app itself can do a LOT more than sandboxed JS running in a webview can. There's also ways to restrict capabilities when evaluating manually-fetched code, aside from code inspection, by running in a different context, like those in node.js, webworkers, empty frames, official (ES20xx) modules, etc.

While I obviously don't know the detail of the app's code-handling, I wouldn't assume that the fetched code runs top-level (indirect eval) with access to "everything". Nor would I assume that user-created-content is accidentally shipped inside these response fields. Nor would I assume that the OS's web-view sandbox is being broken out of, or that the OS's app isolation measures are failing. Nor would I assume the app even has enough permissions to stitch all the requisite mistakes together in a way that permits anything more sinister than a run of the mill money-making app that doesn't use hybrid views. The "worst that can happen" (omitting zero-days) is whatever the apps permissions allow, same as always.

In short; your observations reveal how this app works, not that it's doing anything inherently misguided or especially risky.


Encryption software trustworthy? If you are downloading and using  an encryption software, e. g. Veracrypt or Diskcryptor, how do you know if this software is not a fake one? Backdoored or other security holes? Assuming that such programs are not coded within a rainy sunday afternoon by a nitwit, manpower is required, but they are free! Even if it is open source, most users have neither knowledge nor time to check the code.
What is your way to be sure  to be on the right track?
Thank you very much for your advice and suggestions!

When the software is popular, security-relevant and open source (like Veracrypt), then there will often be people who will audit it and report vulnerabilities. VeraCrypt is based on TrueCrypt 7.1, which got a comprehensive audit a while ago. Many open source projects also got public bugtrackers where known bugs are reported.

But when you download your copy of the program from an untrusted mirror, you can not be sure that it is compiled from the original sourcedcode. That's why many projects publish cryptographic checksums or PGP signatures to verify that the files served by the mirrors are identical to the official builds. When you look at the download site from VeraCrypt, for example, you will notice that they have a public PGP key and a PGP signature for each of their downloads. You can use GnuPG to verify these files.

But when the sourcecode of a software is not available, then all proof you have that it does not have vulnerabilities (whether intentional or unintentional) is the word of the developer (and maybe that of any 3rd parties they gave the sourcecode to for review). That's why some security professionals do not recommend to use closed source security products.


Are six digit temporary numerical pins secure enough for online accounts? There is a popular money transfer service built by Square, cash.me, that uses a peculiar login system:

Enter your email address or phone number on the website.
Receive a six digit numeric temporary pin via email or phone number
Enter pin on website
If pin is correct, the user is logged in

After this, the user can view transaction history. If the user knows the CCV code for the saved debit card, they can even send money to another user (limited at a few hundred dollars).

While they have pretty aggressive rate limiting, this appears to be vulnerable to a distributed attack. While they claim that they will cover unauthorized charges, it seems like users' account information is not very secure. For a modern product released in 2011, does this make any sense, compared to a more traditional password-based approach?

Depends on the attack vector

Some examples:

Hackers steal 45 million passwords.  The six-digit PIN mechanism is immune to this sort of attack, because the PINs are generated on the fly and presumably have a short lifespan.  There is nothing to steal.

How I'd hack your weak password.  The six-digit PIN mechanism is immune to this sort of attack, because the user does not choose them, and they cannot be inferred from demographic information.

Brute force cracking.  The six-digit PIN mechanism is not immune to this sort of attack, but the hacker only has a 1 in 1,000,000 chance of getting it right.  Depending on the lockout mechanism that it uses, the hacker may have 3-5 chances, which still offers very poor odds.

On the other hand, you are in a less comfortable position if

A hacker steals your email password
A hacker steals your mobile phone
A hacker is able to intercept your email because it was not sent securely
A hacker is able to intercept your SMS, somehow....

There may be other, hidden security mechanisms

Payment processors tend to have additional security mechanisms that you can't even see.  For example, your payment may end up going through a risk engine and will get blocked or sent to escalated auditing if it appears fraudulent (i.e. if someone is sending a lot of small transactions to one place, or if the IP address is in Syria, for example).

Who is at risk?

It may ease your mind to know that the security mechanisms in payment processors' sites are not so much there to protect you as they are to protect them.  They are the ones who have to come up with the money if any of your funds are stolen.  Your personal liability is limited to $50.


How to control program permissions and resources in Windows Is it possible to set specific restrictions/permissions for a program(s) by using any software/feature on Windows? Preferably set before launch and preferably set using a single software/interface, like how android handles permissions

For instance, deny program XYZ access to the internet, but not read/write files except in folder ABC. It would be great if it was also possible to set restrictions on resource usage as well (not more than 50% of total CPU, etc)

Task Manager's process priorities is pretty good but not quite what I'm looking for

The security model of mobile and desktop OS are very different and so you typically have very different levels of control.

Typically, on a desktop OS, you would restrict access based on the security principal associated with the security context (this typically means: the user and the user's session) while on a Mobile OS, you restrict the programs themselves.

This means that it's typically hard to prevent some specific program running under windows to do things that are allowed for your user account: if you have the right to write to a file, any program you run from your user session will have that same capability. (This is not completely true since things process integrity level can restrict access further but it's close enough for this answer).

Using a modern version of Windows, you can control the following (non-exhaustive list):

Per user access securable resources (files, folders, registry and a slew of other more specialized objects).
Per process and per user access to IP network resources based on IP address, IP protocol, TCP/UDP port number (and a few other things like ICMP message type).
In addition to all this, you can (somewhat) restrict which which user can run what program both by restricting ACLs to the program's executables and through AppLocker.

(limiting access to CPU resources is possible but delicate. you usually need third party software to do so if adjusting the process priority isn't enough for your need).

There are several mechanism that can improve on that but they all have various requirements and capabilities so which one you might decide to investigate will depends on your exact requirements. Some can be combined together to better tailor the solution to your needs:

Running a program in a VM will isolate it from the host OS almost completely. It is, however, quite resource intensive and could be complex to implement.
Running the program in a sandbox can provide some limited isolation from your "main" OS session as well, although far less than using a full VM.
Adding a proxy or firewall to your network stack and forcing all access through it will provide you with the ability to limit what network resources you can access. Tailoring that access control by process is, however, delicate: under windows you can create firewall rules per process but it is basically limited to filtering IP protocols and TCP/UDP port number. Some firewall/proxy are able to perform much more complex filtering but they typically work at a global level and cannot easily be adjusted based on the process itself.


How to make sure certifi python package is up to date In python's requests module documentation, I find this important recommendation:

  For the sake of security we recommend upgrading certifi frequently!

Q: How can I make sure that my system's certifi is up to date?

Upgrading certifi installed by pip3 can be done using the following

pip3 install certifi --upgrade

Requests just uses the installed certificate module.


How to hide the sensitive data from the developer of the application and the DBA of the database I have simple situation, we are in IT center and I need to develop a simple one form 4 fields that  contains a salary field, I need the programmer of our IT center could not know the salaries of other employees when he checks the database and the application he created

You have different options, consider that depending on the regulations what you want to do may be mandatory (i.e: Spain).

This is as simple as creating a database with fake info but with the very same structure.
Change the names of the employees in the database (and other ids), let them develop and then change them back.
Make the developer and the dba sign a non-disclosure agreement and let them work with the original db.

I believe that the first option is the best, populating a database is an easy thing using an script or similar and they don't need to access the real information. The third option, if you are afraid only about regulations, is the easiest.

--- After the clarification I add:

You can use any method to store the data in the database, I believe that the easiest way is not using public/private encryption but using a normal password with bcrypt or similar (this will have less complexity and will prevent you from managing keys).

The problem using a password is that the data will be crypted with just one password and all application users may have to share it.

I believe that encrypting the information inside the database is not a good solution since it has many implications, what I would do is limiting and logging the access to that database and choosing a dba for it in which I can trust.

The developer, simply, doesn't need to access the real data, you can build your own database for tests and development.


How to calculate the risk rating of a feature? I'm working on a threat modeling/architectural risk analysis (ARA) methodology for the organization I work for. Our business consists of one major product (developed by ~500 developers over a decade). The product contains hundreds of features, most of which are far from the attack surface and work with data of little consequence.

In order to optimize our ARA I wish to implement a feature risk rating method which will allow software architects (which are not security-savvy) to easily assess the impact of the feature they are producing. Based on their score they will either do a lightweight version of ARA, a more detailed version or even consult with the security team (if it is a high impact feature).

Can you recommend any such methodology? The only thing that comes to my mind is a questionnaire where the architect will fill information about the assets with which his/her feature interacts (based on our asset inventory) and, based on the asset impact and a simple formula, the architect calculates the feature impact.

Do you guys have any better ideas?

I would abstract out the 'impact' rating for your users of this rating system. The resulting system needs to be clear, simple, and unambiguous. It also needs to result in an auditable output (something someone else can check).

I have done this by reducing the complexity of analysis to the data and the data systems the feature interacts with. Use your existing data classification and data risk model to define the characteristics of the various data types you have (personal, financial, payment card, health, sensitive, etc.) and define what protections those data should have (encrypted, certain access levels, etc.). You probably already have some level of understanding of the impacts of the various data you have, so just borrow it instead of re-inventing the wheel.

Then you can classify the protection/risk level of the data that the feature touches, either directly or via calls to other features/systems.

Example:

The data the feature processes has:

* names or personal identifiers
* payment card data, bank details
* health information
* internal financial information
* internal configuration
* passwords, crypto keys
* ...

The feature interacts with:

* users
* Database A
* Database B
* 3rd party service C
* payment processors
* external researchers
* ...

The result is simple: the dev checks the characteristics of the data the new feature processes and the systems it interacts with, and your checklist should return the classification of the feature. Auditors/peers just need to review that the data indeed has those data characteristics.

All in all, the resulting system is fast, simple, and easy to understand. What makes it work is all the work done previously in identifying the risks and protections required by certain types of data (either by internal risk ratings, laws, regulations, etc.)

If you do not already have a data classification and data risk understanding, it would actually be simpler to create that first, rather than re-inventing that wheel every time you have a new feature to assess. It would also make it easier to update this rating system when things change, like laws or the risk tolerance of the company (three cheers for abstraction and encapsulation!)

An added bonus to the data characteristics inventory approach: if a regulation changes you have a pre-built inventory of data characteristics, so you know the flow of that data through your systems. It's like an up-to-date, organic data flow diagram.


What are the consequences of not upgrading to the latest version of java? Suppose I need to convince someone to upgrade to the latest SDK version of Java? I have heard there are many security vulnerabilities with old versions of java but can't find anything that concretely convinces me that this is the case? What are some hard consequences or security exploits that exist for old versions of java?

There are a number of them, including those that allow arbitrary code execution.

From Qualys, on January 20 (last week as of this writing):

  Java: 19 vulnerabilities addressed in Java 8 and Java 7, 13 are remotely exploitable with highest score CVSS 10. This should be high on your list for your patching efforts, at least on the desktop where most of the vulnerabilities are aimed at. Only four vulnerabilities also apply to servers.

CVSS 10 means:

  they can be used to take control over the targeted machine, working remotely through a network and without requiring credentials

Precisely how these recently-patched vulnerabilities can be exploited, and their official names, isn't mentioned - assuming they have official names, as Qualys suggest they may include 0-day exploits. Oracle isn't giving many specifics.

Another, older vulnerability from 2013 also allows arbitrary code execution, via an Applet:

https://www.us-cert.gov/ncas/alerts/TA13-051A

So, the big risk is complete control of the target machine.
For end users, arbitrary code execution on their machine may result from loading a malicious Applet.


What are the requirements of becoming a WHOIS Proxy or Privacy service (not a registrar)? This question was put on hold as off-topic at Webmasters, so I'm hoping it's ok to ask here.

I've read up on the (outrageous) costs of becoming, maintaining and operating a registrar, but I cannot find any useful information about the nature of the third-party companies who offer whois privacy or proxy services, how they are set up and function.

When I click the web proxy link on http://en.wikipedia.org/wiki/Domain_privacy, it forwards to a page describing proxies as in the alternative to VPN, there is not one mention of WHOIS.

What does it take to become a provider of a whois proxy or privacy service—-financially, legally, and what hardware is required? I've been a web designer for 15 years, but actually know very little about networking and infrastructure. If this is not the correct SE to ask this is, please let me know. Thanks in advance.

The ICANN says:

There are two general types of these services:

A Privacy Service lists alternative, reliable contact information, like an address or phone number, in WHOIS while keeping the domain name registered to its beneficial user as the registrant.
A Proxy Service registers the domain name itself and licenses use of the domain name to its customer. The contact information of the service provider is displayed rather than the customer’s contact information. The Proxy Service provider maintains all rights as a registrant (such as to manage, renew, transfer and delete the domain name), and assumes all responsibility for the domain name and its manner of use.

As well as:

Proxy and privacy services are among the least developed of the WHOIS policy areas. Until the adoption of the 2013 RAA, there were few ICANN rules or policies applicable to these types of services, which at times resulted in unpredictable outcomes for stakeholders affected by these services. The 2013 RAA includes an Interim Specification that describes a minimum set of requirements for privacy and proxy services offered by a Registrar or its affiliates. These requirements were adopted on a temporary basis (expiring on 1/1/2017), to allow for the GNSO to recommend appropriate policies to apply to the provision of these services. In conjunction with these policy development activities, ICANN is committed to establishing an accreditation program for privacy and proxy service providers to establish a contractual framework for enforcing these new rules and policies on a consistent basis, across all commercial providers of these services. For information on how to participate in these policy development activities applicable to privacy and proxy services, please visit the Get Involved section of the site.


What can people do about Tor's weaknesses? I read Tor's Wikipedia page and found out it has 12 weaknesses. What can people or The Tor Project do about those weaknesses? If they don't anything about it, wouldn't it compromise Tor users' anonymity?

No anonymizing service is foolproof. To prevent yourself from being deanonymized by the abuse of tor weaknesses you should do the following:
Maintain good OPSEC.
Use security focused OS like tails or whonix.
Finally chain multiple anonymizing services over relying on just one service like tor alone.


How safe is it to use Fingerprint-based authentication on unencrypted Android devices? Since I needed root permissions for several apps on my Samsung Galaxy S8+ (SM-G955F) device, I followed a guide that showed how to install a superuser binary on the device's Android 7.

There was a caveat: such procedure requires encryption to be disabled for the device to be bootable; Samsung devices will in fact refuse to decrypt their storage upon startup if they detect a modified boot partition. So I just went on with it and removed encryption features from my device.

Now, what I wonder is: since I have several apps (e.g. KeePassDroid, Solid Explorer, Google Play Store) that can ease user authentication by storing passwords in such a way that they can be accessed by simply scanning a fingerprint on the sensor, will the fact that my device's main storage is decrypted mean that the saved copies of the passwords can be read in plaintext by anyone who can access the root filesystem of my device?

For instance, say I lose my phone, someone stumbles upon it, connects it to their machine and boots TWRP recovery, which gives them root access to the Android file system. Is there a directory in which they find clear or easily-decryptable passwords secured via fingerprint authentication? Or is there some other, maybe hardware-based, encryption system?

We can't answer this for all possible cases(you can't account for human stupidity) but I will try to give a relevant answer.

  Now, what I wonder is: since I have several apps (e.g. KeePassDroid, Solid Explorer, Google Play Store) that can ease user authentication by storing passwords in such a way that they can be accessed by simply scanning a fingerprint on the sensor, will the fact that my device's main storage is decrypted mean that the saved copies of the passwords can be read in plaintext by anyone who can access the root filesystem of my device?

I believe that developers of trusted, reputed security software would not depend on the device being encrypted to protect their data. If that were the case, then any privileged file explorer software would be able to show your files in plaintext.

  For instance, say I lose my phone, someone stumbles upon it, connects it to their machine and boots TWRP recovery, which gives them root access to the Android file system. Is there a directory in which they find clear or easily-decryptable passwords secured via fingerprint authentication? Or is there some other, maybe hardware-based, encryption system?

Like in the previous paragraph, if you use trusted and reputed software, you should not have to worry about this. Fingerprint authentication is just a mode of authentication and should not have anything to do with how you encrypt your app's data. Same goes for device encryption. Ideally it would not make a difference to app developers.


Understand how dionaea honeypot emulated services work I'm trying to understand Dionaea honeypot and the information flow.
    I understand that it emulates some services, like SMB, ftp, tftp, try to
    responde with these, then gets the shellcode and analyzes it with libemu.
    My question is how emulated services works, and how can be exploited.
  Ok, let's say that the attacker will use an ftp vulnerability. What will he send?
What are the responeses of honeypot?
At what OSI level are all happening?

At OSI lvl. 3 it is captured AND handled lvl 4-7 in a sandboxes, that are making the analysis and emulation in secured environment.

UPDATE: In case of FTP, it listens for a packets coming to FTP port, captures them, after that libemu takes its part and the process begins : it creates layer7-to-layer4 "thing" that acts like a FTP server. The "thing" is actually a honeypot - it replies as ordered, giving an attacker feeling that there's some information that can be stolen or a shell code can be executed - the sweets for a hacker, or the honey. Of course it is just a scripted trap, that can record everything the attacker does/attempts to do.


When does OAuth re-authenticate users? I assume OAuth protocol being something like this:

user registers to Gitlab using Facebook (for example)
Facebook asks if user accepts sharing profile info with Gitlab
user accepts
Gitlab receives user profile
user asks Gitlab for a private resource
?? HOW GITLAB KNOWS IT STILL CAN TRUST THE USER ??
Gitlab sends private resource to user

At first I assumed that Gitlab might just check if the user is logged through Facebook: if yes, then it's him. However, if I login to Gitlab using Facebook, but then decide to logout from Facbook... I still can operate on Gitlab.

So I guess there is another workflow to RE-authenticate the user even if facebook is logged off, but I can't seem to find how ?

OAuth is a delegation protocol that helps with authorization decisions (source). In fact, it doesn't really provide authentication, and it likely doesn't know or care whether you are still authenticated or not at the identity provider (Facebook).

If you look into how OAuth works, all that really happens is that an access token is generated by the identity provider, and is given to the client website (GitLab). This token will have authorization to access the Facebook Graph API on your behalf. Once GitLab has pulled the necessary information from the API, it doesn't really need to access it anymore. Thus, GitLab doesn't keep checking whether or not you are still logged into Facebook. The token itself is probably still valid as well until it expires.

TL;DR: Facebook Connect (which uses OAuth) grants GitLab access to query information about the user from Facebook. GitLab uses this to identify the user and that's it.


is it possible to sniff email content inside network? I am working in a IT company. I am using LAN for all internet activities. I send some email from my personal gmail account. My network administrator sniffed all email I send from LAN and he shows the email to me.

I am sure no software installed my system and I used https to send email. How did the network administrator sniff my email? How can I prevent this?

Your case is common in the corporate world, it is usually described as corporate MiTM. When you connect to the Internet from inside your network, you're likely connecting to a gateway/router the belongs to your company first. That router can simply hand you public key in a "fake" certificate whenever you connect to an SSL-enabled site and fool your browser into thinking it is the real website. Thus, making your SSL connection completely transparent.

Of course, when that happens, your browser should give you a warning that you're being handed a fake certificate. BUT, in a cooperate environment, you're likely given a company-owned computer and/or connecting to the company's Domain Controller, which gives the sysadmins enough access to install the company's fake certificate to the trusted root certificate store in your computer, which will suppress the browser's warnings.

Removing the certificate will likely disconnect you from other company services (the mail server, intranet websites, etc.). However, using an addon called Certificate Patrol, you'll be at least notified when that happens (somebody MiTMing your SSL connection), but it can't do anything about the attack.

You could VPN/SSH to your home network and use that to connect to the Internet, but chances are that they intercept that as well. There's really nothing you can do about it. They give you the Internet access, they can do whatever they want.

Bottom line is: Do work stuff at work, and personal stuff outside