How can SEC_ERROR_REVOKED_CERTIFICATE in firefox be further examined? A https website, which is not under my control, leads to an error message SEC_ERROR_REVOKED_CERTIFICATE in Firefox 51.
The CRL (url embedded in the certificate) does not distrust the sites certificate.
openssl s_client has no objections, neither do other TLS capable clients (Firefox 50, MS Edge).

Q: What would be a canonical way to figure out what happened here, just  making firefox tell me what the problem is? (workarounds see below)

General Troubleshooting:

https://www.ssllabs.com/ssltest/
May or may not include a statement about the trust store status of the certificates in the chain.

Cheating:

Manually check the news & figure out that the certificate authority that created the certificate was distrusted by mozilla starting with the Firefox version in question. In my case, it was StartCom/WoSign.

https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/

Manual checking:

Manually extract the mozilla trusted certificates of each channel from hg.mozilla.org e.g. using
https://github.com/curl/curl/blob/master/lib/mk-ca-bundle.pl
openssl verfiy -verbose -CAfile ca-bundle-channel-xyz.pem
compare result for different channels mozilla-release / mozilla-beta

Note: This only helps for completely removed roots - however mozilla has a special rule about the notBefore date in place for StartCom, which will not be visible this way.


Is it secure to login to your online banking through a third party? In South Africa there's this payment method called SiD which may be used to pay for things like flights. SiD is an assisted method where you fill in a third party form with your internet banking login details and they aid you in the online banking payment process by filling in certain numbers for you (amount, reference, etc).

Here's what it looks like:

These are the login fields for my internet banking in a 3rd party form. The page in the background (the red) is recognised as my internet banking page.

On the help page, it says they don't store details but may store bank account number for refund purposes.

  SID may store your bank account number for refund purposes. However,
  no third party can access or operate your Internet Banking facilities
  based on this information, or any other information retained by SID.

This is getting used in a number of places here as a payment option and my understanding is that to give my login details to a 3rd party is a very bad idea. They could easily store the numbers I put in their form and use them later.

Since this is becoming popular, is it possible that I'm just being paranoid. Is this method - supplying my login information to a 3rd party form - secure?

We can't determine whether or not it's secure without doing a full audit (not just of SiD, but your bank). Is it any less secure than not using it? Hard to say, since we don't know how secure the system is without it.

However, what we can say is that you're introducing another entity you need to trust. If you're passing your bank data into SiD, then they have the possibility to use it for fraud. You are trusting them to not.

This isn't unprecedented; I store this information in my password manager, which means I trust it to not intentionally or unintentionally allow bad things to happen to those secrets.

You will have to determine for yourself what level of trust is necessary for you to feel comfortable with SiD.


What are the realistic chances of email being intercepted via SMTP/TCP-IP? Dear SMTP and TCP/IP network security gurus: I'm curious about what is the realistic risk of sensitive information (such as a email pdf attachment) being intercepted/read by a hostile party from a regular unsecured SMTP mail message AFTER the mail is transmitted from a US-based outbound SMTP mail host to an outside relay and BEFORE the mail reaches a US-based inbound mail host.

Again, I'm only specifically interested in the transit between the outbound and inbound mail server. The sender/receiving organization context is outside the scope of this question

Many thanks in advance for any efforts to answer this question and my apologies for my initial question reading like an RFP. I'm having a bored day!

Highly likely that it can and is being done (please note that caveat at the end of the post), the NSA has already done this before (we are talking pre-PRISM era). The operation was named Room 641A. Where they eavesdropped all traffic. Consider that AT&T is a tier 1 provider and thus operates a large part of the internet.

Another instance which could be probable is abusing the backbone protocol of the internet BGP (Border Gateway Protocol). The protocol is meant to perform policy based routing before taking cost into account. This can, for instance, impede traffic from certain geographical area's reaching another Autonomous System. In practice it has been abused several times to re-route parts of the internet (if you actually manage to do this it's highly likely you are interested in the passing traffic). Refer  to this article on Arstechnica.

  "This year, that potential has become reality," Renesys researcher Jim
  Cowie wrote. "We have actually observed live man-in-the-middle (MitM)
  hijacks on more than 60 days so far this year. About 1,500 individual
  IP blocks have been hijacked, in events lasting from minutes to days,
  by attackers working from various countries."

  At least one unidentified voice-over-IP provider has also been
  targeted. In all, data destined for 150 cities have been intercepted.
  The attacks are serious because they affect the Internet equivalents
  of a US interstate that can carry data for hundreds of thousands or
  even millions of people. And unlike the typical BGP glitches that
  arise from time to time, the attacks observed by Renesys provide few
  outward signs to users that anything is amiss.

  "The recipient, perhaps sitting at home in a pleasant Virginia suburb
  drinking his morning coffee, has no idea that someone in Minsk has the
  ability to watch him surf the Web," Cowie wrote. "Even if he ran his
  own traceroute to verify connectivity to the world, the paths he'd see
  would be the usual ones. The reverse path, carrying content back to
  him from all over the world, has been invisibly tampered with."

caveat:

Nobody being capable of re-routing parts of the internet is interested in what you write in an email. Most of the time they are interested in specific targets. So if you are to make a formula, it would depend on the complexity of setup and the estimated information value.


Is this PHP RNG safe? I need to generate a 20 character long random string free from any vowels, and thus far I have the following function to carry out the task.

function random_str()
{
    $i = 1;
    $secret = '';

    while($i==1){
        $str = bin2hex(random_bytes(10));

        $str = preg_replace('/[aeiouAEIOU]|\W+/', '', sha1(microtime() . mt_rand() . $str ));
        $secret .= $str;
        if(strlen($secret) >= 20){
            $i = 0;
        }
    }

    return substr($secret, 0, 20);
}

Is this secure? Is there any way it could be improved?

This isn't used in anything live as of yet, but will be used to generate keys for both resetting passwords and for viewing certain parts of a system that normally requires a user to be logged in.

A clean up of your code

This is the same as what you are doing, but written a bit more elegantly:

function random_str()
{
    $secret = '';
    while(strlen($secret) >= 20) {
       $str = bin2hex(random_bytes(10));
       $str = preg_replace('/[aeiouAEIOU]|\W+/', '', sha1(microtime() . mt_rand() . $str));
       $secret .= $str;
    }
    return substr($secret, 0, 20);
}

Notice I have removed the unnecesary $i variable. (I know, not a security issue, but anyway.)

Is it safe?

The code is very convoluted, and takes a rather odd path to solve a not so hard problem. Some issues:

You use the hash sha1(microtime() . mt_rand() . $str) when just relying on $str would be enough. Thats where you get the input from a CSPRNG. Adding some non secure randomness (mt_rand) and the time and then hashing it does not improve it.
Since you remove vowels from a hex string you end up only using the character 0123456789bcdf. Thats just fourteen - not a lot.
It is a bit strange to first generate a string containing characters you don't want and then throw them away, when you could just only generate the ones you want.

In the end, the result is cryptoghraphically secure, since it relies on random_bytes(), that is a CSPRNG. But the quirks of your code and your lack of understanding of it leads to insecurity, e.g. in this case you might end up with less entropy per character than what you would have expected.

A better way to do it

Use the PHP funciton random_int to pick a character from a fixed alphabet at random:

function random_string($length, $alphabet) {
    $result = ''; //Initialize an empty string.
    $max = strlen($alphabet) - 1; //The maximum random number we want to generate.
    for($i = 0; $i < $length; $i++) { //Do once for every character in the string.
        $result .= $alphabet[random_int(0, $max)]; //Add a random letter from the alphabet.
    }
    return $result;
}

The performance could probably be improved by eliminating the string concatenation in the loop, but it is probably not a big issue.


Does sandboxie "grab" all the system calls? Sandboxie: http://www.sandboxie.com

Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?

As a quick starter for 10, see this page:

The driver component of Sandboxie could not complete initialization. This message indicates that Sandboxie asked the system to provide notifications when processes (applications) start and stop, but the system was not able to accomodate this request.
In technical terms, Sandboxie is asking to register a process notification routine, and this request has failed.

The call in question is PsSetCreateProcessNotifyRoutine
Then this page

The driver component of Sandboxie could not complete initialization. This message indicates that Sandboxie could not intercept and extend some system service.

So the answer is this package is installing a kernel level driver to hook system calls, or rather respond to kernel events and alter the outcome. My knowledge of kernel-mode programming is limited, but I suspect functions such as IoRegisterContainerNotification can be used to create hooks into IO activity and determine what to allow and what to block.
I should advise you - this level of operation is different from a rootkit only in terms of intent and install method, i.e. that you are consensually letting this driver be installed and that you trust it. This software appears entirely innocent but you should be careful when deciding whether or not to install software that does this sort of thing, so evaluate solutions like this carefully.
Edit Just for interests' sake I ran dumpbin /IMPORTS SbieDrv.sys. This driver imports functions from FLTMGR.SYS, the Microsoft File Filter Manager. It also imports amongst many other things PsSetCreateProcessNotifyRoutine from ntoskrnl.exe, the Windows kernel. Just to confirm the above.


Is indirect access to a computer as bad as direct? I'm deploying a web-based ERP system for a customer, such that both the server and the client machines will be inside the customer's intranet. I was advised not to allow the server machine to connect to the internet, but the clients won't have this restriction. However, I need access to both to provide support, so I'm planning to use TeamViewer to access the client (to assist users directly upon request) and SSH from the client machine to the server machine (to perform updates, for instance).

[my machine] ---TeamViewer---> [customer's client] ---SSH---> [customer's server]

My question is: is this setup as bad as just accessing the server directly through SSH? I see some advantages in the indirect connection (it will only be accessible when a customer's employee opens TeamViewer, he'll be sitting there seeing everything that happens and can even type the passwords for me, so they don't get transmitted through the internet ever), but I wonder if there are drawbacks I can't foresee.

If both approaches are equally (in)secure, I'll just allow direct SSH to the server, since it's simpler. And if, for any reason, this indirect setup makes everything less secure, I can go a step further and advise the customer to block SSH access from the machine(s) where TeamViewer is installed.

Update: seeing the answers/comments below, I think I need to clarify myself a bit. My goal here is to make the server more secure than the clients. The exact setup is my customer's responsibility, not mine, but since I'm deploying my product in their network - and I need to remotely access it to provide maintenance - I have to advise them in the pros and cons of each configuration. They worry that an internet-facing server will be more vulnerable than one only (directly) accessible from their internal network, but I suspected (and the feedback below confirms it) that it's not always the case.

I can't properly secure the clients, they will be running a variety of programs outside my control - including a mandatory remote desktop, TeamViewer or other - so the "natural" choice would be disallow SSH connections between clients and server. OTOH, a compromised client does not automatically give access to the server, since you'd still need to authenticate to it (for instance, using key authentication and storing the key offline, in a USB flash drive). But I agree it's not a good idea.

Another option would be setting up a very secure client and using it as a proxy to the server (disallowing everyone else). However, my original question pops up again: isn't it pointless to do so, instead of just having an internet-facing server?

If the the customer's client is security critical do not setup TeamView to connect to it. If breaching the customer's intranet puts the eclient's server at greater risk, then do not user TeamView.

A cursory reading shows that TeamView can use UPnP (Universal Plug and Play).

There are *29 CVE*s (Common Vulnerabilities and Exposures listed for uPnP!

If you do not know exactly how the authentication and routing of a product works, do not use it for security critical activities or infrastructure.

Anything that is more complex has the risk of having more bugs, issues, and vulnerabilities. So when you mentioned that ssh was simpler you had the right idea.

If you are using ssh to access security critical infrastructure please use key authentication instead of password authentication.


How can normal files hide a virus? How can normal files supported in the Windows operating system hide a virus?

Sometimes opening a .txt , .jpg or .docx files leads to running a virus. How is this possible?

This is possible thanks to OLE (Object Linking and Embedding) technique. It  is intended to share information between applications that run on  Microsoft Windows operating system. Mainly, it allows to embed objects in documents.
Official Microsoft Documentation explains the benifits of OLE. But as any other concept, it could be used for a neferaious intention.

Maybe the easiest way to explain this is the figure below: by dragging  and dropping the executable icon of Notepad on an opened Wordpad file and saving, the double-click on the Wordpad file will lead to open the Notepad application. The figure below explains better the idea:

You can save the document in .txt format. It will look as a normal benign file. However, if you check its properties, you will find its real extension is SHS. You can imagine adding any commands to the file: such as formatting some disk partitions.


Windows Firewall netsh equivalent of iptables u32 module I have looked everywhere and I can't seem to find a netsh equivalent of the u32 module for iptables. I want to create a rule to Drop a packet that starts with a specific set of bytes.
Similar to:

# Block rules
iptables -t filter -A INPUT  -p tcp --dport 443  -m u32 --u32 \
"52=0x18030000:0x1803FFFF" -j DROP

Is this possible with netsh ?

I think you have to write your own callout driver to accomplish this. You can't inspect packets in user mode Windows Filtering Platform (WFP).

See Windows Filtering Platform Callout Drivers on MSDN.


symmetric keys during mutual TLS I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server.
Between the client and the server, a handshake is utilized in order the two parties authenticate with each other.
In the normal TLS handshake procedure, the client sents a symmetric key to the server
In my case does this is necessary? Or after the authentication part has completed the handshake can be finished?

In the normal TLS handshake procedure, the client sents a symmetric key to the server

No. What you describe kind of resembles  RSA key exchange, where the premaster secret is set by the client and sent encrypted to the server. They symmetric key and other keys are the derived from this. But RSA key exchange is considered obsolete and with Diffie-Hellman key exchange both parties compute a key together.
There is absolutely no difference in key exchange when client certificates are involved, no matter if RSA of DH key exchanged is used.


Can ISP use MITM attack to "break" encrypted traffic? Use connection of A and B as an example.
Their communications were encrypted by Public Key Encryption.
Before they exchange their public key, ISP MITM attacked.
A got "B"'s public key (ISP generated)
B got "A"'s public key (ISP generated)

A send message X to B.

A->"B"'s public( (A's private(X) )->ISP

When ISP got that ciphertext(C), ISP decrypt it by "B"'s private( (A's public(C)) )
Then, ISP got the message.

After that, ISP encrypt message X for B.

ISP->B's public( "A"'s private(X) )->B

Then B decrypt ciphertext(C) by B's private( "A"'s public(C))

Then B got message X and they don't know ISP got the message.

Is it possible?
Sorry for my poor English and explanation.

When you connect to a site over HTTPS, your browser checks that the certificate was issued by a certificate authority that you trust (typically built into your OS or web browser) and that the certificate matches the domain of the website you are visiting.

So if your ISP can get you to install a certificate corresponding to fraudulent certificate authority they control OR compromises a certificate authority OR somehow obtains the secret private key of a random website, then yes they could surreptitiously do a MITM attack.

There is plenty of incentive for certificate authorities not to issue fraudulent certificates.  If any fraudulent certificates are seen in the wild (which is easily verifiable as only the certificate authority can sign a fake certificate), the certificate authority would lose its trust and quickly go out of business.

Furthermore, for some sites and some web browsers there's the notion of certificate pinning, where the site can only be visited via HTTPS (using accomplished through HSTS) and only with a certificate issued by a pinned certificate authority.


What is the security of one time login with SMS code? I am writing a web application and I want to let my users to login by sending one time code to a given number. The code will be received by a GSM module within certain time after it's generation and will be sent to the server for authentication.

Is this method vulnerable to SMS spoofing easily? Is SMS spoofing very easy? Or what kind of other threats could be possible for this method.

I am avoiding to send message to the user's number because Pakistan Telecommunication Authority blocks the sim card if we send messages above a certain amount.

SMS spoofing is certainly possible. However, SMS spoofing doesn't make your security verification any less secure. All spoofing does is allow an attacker to send your user a different code. The code will obviously be wrong, and may confuse the user, but it doesn't hurt anything, in the sense that an attacker can't gain access to someone's account by spoofing texts. What would be a problem is SMS interception. If an attacker can intercept the message then they would be able to login to someone else's account if they also somehow already know that account's username and password.


Is it normal for a payment procedure to ask for third party cookies to be turned on? I was trying to pay for mobile phone credit online from a service provider. I selected the amount to pay and clicked next to continues. The following page asked me to turn on third party cookies if I wanted to proceed. I thought that this wasn't acceptable so I didn't go through with the purchase. Is it normal for a payment procedure to be exposed to third party cookies or am I being paranoid?

A common reason for having third-party cookies on payment pages is analytics.  Payment events are usually the most important ones to track because they are the actual measure of success and most analytics is done with third-party cookies.

Other reasons can be CDNs and third-party payment providers.

It would seem unlikely for an active attack to use third-party cookies at all, let alone interrupt the process to request that you switch them on.  An attacker would find a different way to exfiltrate the sensitive data without drawing attention to the attack.


Hotmail address compromised? This evening I received an email from Microsoft saying my account had been compromised.

I changed the password and looked at the activity log. This is what I saw three days ago on the 16th of Feburary

  Protocol: IMAP  IP: 111.110.153.191  Account alias:  email address
  Time:2/16/2017 8:37 AM  Approximate location: Japan  Type: Successful
  sync Blockquote

I've changed all passwords and created a new email address for some websites which used the compromised Hotmail address.

I'm pretty worried if I'm honest. This address was hooked up to Amazon, Steam, eBay (not PayPal) and pretty much everywhere. What kind of damage am I looking at?

I've contacted Microsoft who of course were no help what so ever.

I would look for unknown activity. I would cancel your Ebay and amazon account you can get quite a bit of information from that if its not to late.


Sharing wifi ,browsing My neighbor gave me his WiFi password to use. He doesn't know much about computers, but he knows 'the basics'. Can he see in his browser history what sites I'm browsing, or my passwords?

If you browse websites that start with http, he could view the websites and its subpages you visit, what you post (e.g. facebook posts, google search queries, images) on these websites and that also includes the passwords you use for these websites. This requires more than "basic" knowledge, so even in this scenario, you should be pretty safe. Additionally, almost all reputable websites force you to use https (see below), so you should be safe in general.
If you browse websites that start with https (often browser add a padlock symbol left of your address bar to denote that), he can see which websites you visit (e.g. facebook or google), but not what you do on these websites. For example, he can see that you're browsing Google, but he couldn't see what you're actually searching. He also would not be able read your passwords or any other data you enter or receive there. Note: If one of the websites you click in Google results uses http, he would be able to see everything you do with the website as mentioned above.
Programs that you install on your computer, e.g. Microsoft Word or Dropbox that access the Internet will usually also use encrypted connections, like https. However, there isn't a simple way to ensure that they do. Again, reputable programs will use encryption, and then all he could tell is as outlined above.

If your browser suddenly warns you about an "unstrusted connection" or "invalid certificates", you should be careful about visiting sensitive pages or entering sensitive data (i.e. passwords). This is because those two warnings might indicate that someone is trying to tamper with your connection to the Internet in order to steal your data.


How to test against DDoS in a controlled enviroment? Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?

Since DDoS is not really a specific attack, on a specific vulnerability, testing for it is kinda pointless, especially since there's not much you can do about it anyway, except for scaling out more. (See my answer here for explanation why).

What you should be doing, is doing load testing - if you can handle 100K legitimate clients, you know thats how much you can scale against DDoS... and a DDoSer would need to scale up his botnet that much in order to succeed in attacking you. If you can't - well, then DDoS isn't really your issue, is it? (Of course, replace 100K with any number that makes sense for your site, given your business, risk, availability requirements, exposure, etc).

If you're just looking for a way to simulate that, the best way I can think of is some form of "cloud" based systems, e.g. throw up a large pile of virtualized machines on Amazon's systems and have them all go to your system. Of course, these would all come from similiar IPs, and DDoS come from all over - so maybe in addition to Amazon, you also want Azure, and also etc etc.....


Data recovery from TRIMmed SSDs Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM:
If the drive is formatted, or has had its files erased, will the data be unrecoverable after the drive's firmware has performed its full garbage collection cycle? For example, 24 hours after the fact?
I know that TRIM was initially introduced to flag blocks for later erasure to speed up writes to the underlying flash memory. However, I'm wondering if this erasure means that the data is actually unreadable, even when a user is able to put the drive in factory access mode, or has access to the physical flash chips. I've read that the data is zeroed-out (DZAT) or some other deterministic value (DRAT) when accessed sector-by-sector through the typical SAS/SATA interface, for example when using the dd command in Linux, but that only covers blocks mapped by the FTL and of course does not necessarily mean the physical memory is erased.
Are fully TRIMmed blocks truly, completely erased, or only presented as such to the OS?

If you want to use regular drive electronics, the answer is, there's absolutely no way to recover the erased data blocks from flash storage like SSDs, USB sticks, SD cards, etc.
See https://www.silicon-power.com/blog/index.php/guides/nand-flash-memory-technology-basics/ for some info on how flash memory storage works.
The tricky part of securely erasing an SSD comes from knowing that the data blocks you want to erase, have actually been erased, and are not just in the garbage collection queue, or in the reserve space area, or in some other special SSD controller area of storage.
There is also the possibility of some data still in blocks that are left over on the bad block list, that the drive is unable to erase any more times and has remapped those addresses to still working areas.
Something a lot of people seem to ignore, is that the SSD controller is continuously trying to maximise the number of erased data blocks. This is to maximise the drive performance. If the OS tells the drive to delete and TRIM (or UNMAP) all of the usable data areas then, giving the drive has long enough to complete the task, it should also cycle through the reserved space too. If the drive has zero remapped or bad blocks, then 100% of your data is unrecoverable, even by data recovery businesses.


How to prevent BadUSB attacks on Linux desktop? What can I do to protect my Linux laptop from BadUSB attacks as described by ArsTechnica here?

Perhaps writing an appropriate AppArmor profile would help?

The BadUSB attack is based on the fact that computers allow and enable HID devices on all usb ports. Faked network adapters are no real danger.
My answer tries to describe how to use udev to temporarily disable the addition of new HID devices. I'm no udev expert, but I've tested my approach, and it works for me.

For preparation, create a file /etc/udev/rules.d/10-usbblock.rules with the content:

#ACTION=="add", ATTR{bInterfaceClass}=="03" RUN+="/bin/sh -c 'echo 0 >/sys$DEVPATH/../authorized'"

If you want to block other classes too, then look up the class number, and copy the line, and change the class.

Now you can block all new HID devices using the command

sed -i 's/#//' /etc/udev/rules.d/10-usbblock.rules; udevadm control --reload-rules

and unblock with:

sed -i 's/^/#/' /etc/udev/rules.d/10-usbblock.rules; udevadm control --reload-rules

Before you shut down, always unblock, as the setting is persistent, and your "good" HID devices would be rejected on reboot.

I don't know whether you can edit the temporary rules directory, but if changes there affect the behaviour, you should edit that instead, as then you don't need to unblock before shutdown.


Using a smartphone off the grid I am planning to use a smartphone as a media player and maybe to read the occasional ebook or pdf.

If I were to turn off all connectivity, e.g., bluetooth, wifi, gps, then remove the sim card and/or put it in airplane mode, is there still a way the phone can be tracked?
Is a phone with no sim card in or in airplane mode still visible to cell towers/IMSI catchers?

I'm aware that GPS receivers can only receive and do not send data. How does a smartphone use the GPS data received to track a user's location. I would like to know because after having turned off or disabled all unnecessary background apps, I found that I am unable to permanently force stop or disable some location and bluetooth apps that run in the background.

Would switching to something like LineageOS or Replicant (without reinstalling Play Store or any Google apps) help fix this?
How free are OS' like these from Google's code/data-collecting?

If I were to use wifi with no other connectivity enabled and routed the internet traffic to tor through a transparent proxy, should that be enough for anonymous casual browsing?

The answer will depend on the manufacturer, OS, hardware, and applications
It is hard to give a complete answer and you can't control any of the previous 3 in a normal phone.

GSM protocol does not require a SIM card to be able to execute an emergency call.
Any malicious application in the mobile can disclose your relative positioning using this strategy.

Another possibility, for example, is with Android OS, it uses the Google play store to provide accurate info to apps on positioning and other data.

Google play store or any app can be constantly collecting info on your phone about your wireless profile and surrounding networks.

Even if you are offline it can still track you by the GPS or the wireless SSID networks that are near you, and when online again synchronize the information.
I would not trust much airplane mode as it is based on software and not hardware.

My way of being off the grid,
I would buy a Raspberry Pi and a 7" touchscreen and install Linux with one of those power sources to recharge the phones you will have power for around 5 hours.
If you need a network to connect USB WiFi, if you need GPS to connect USB GPS... if you require 3G then connect a USB 3G stick, etc...
You own the OS so you can decide what you keep or allow to be collected.

Your tablet will not be small but it will work and keep you safer as you control almost everything...


Semantic URL Attack Mitigation I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks

Example

updateprofile.php?uid=1

I can change to

updateprofile.php?uid=2

I can update the second user's profile without logging in into his or her account.

So how I can prevent this type of attacks? By  using Session variables? Encrypting the data through the URL?

I am sure sessions are vulnerable to XSS or Session Hijacking Attacks.

So what is the best approach for this? Coding approach etc.

updateprofile.php?uid=1  I can change to

  updateprofile.php?uid=2

If you can change the uid parameter and then tweak other persons profile that would mean the backend application has no checks as to determine if a user is eligible to perform an action.

This attack can be a combination or any of the following including (bad session management,url tampering,indirect object reference,parameter tampering)

  So how I can prevent this type of attacks? By using Session variables?
  Encrypting the data through the URL?

Yes,SESSIONS combined with logical checks are the way to solve such attacks.

  I am sure sessions are vulnerable to XSS or Session Hijacking Attacks.

SESSIONS have nothing to do with XSS.

  So what is the best approach for this? Coding approach etc.

The coding approach is to use SESSION Token to uniquely identify a user.Then perform server side checks to determine if a user is authorised to perform an action such as editing a profile.If he isn't simply don't allow him.


Can my cell phone company access videos and other documents on my old cell phone? I have my old smartphone with me, with the old sim card still inside. When I received that phone 4 years ago, it was locked by my cell phone company. However, I am not using it at the present moment, since I got a newer cell phone (with a new sim card) with the same company.

I turned off the wifi on the old cell phone; also, it is not on the network anymore since my number was transferred onto the new cell phone. So, is it possible for my company to actually access data since it was a locked phone?

For example, if I took a video with my old cell phone, would the company (or anyone else) have any way of tracking or getting a hold of my videos (among other things)? In other words, could anyone ever get a hold of the content of my old cell phone remotely?

Generally speaking your cell provider can access data that flows over their network, but not things that only live on your devices.

Probably the most likely breach of this principle is that most people buy their cell phones from their providers (and receive updates from them as well), which means their providers have control over the root-level software installed on the phone. That in turn means they can do pretty much anything, although it would certainly be news if they were found to be exfiltrating users' files without their permission.


How to check if a list of domains contains any WordPress installation? Does any software or any other way to detect if a website contains any WordPress installation?

For example lets say we have the website example.com which is not a WordPress site, but we have a WordPress site in the path example.com/blog and example.com/blog2.

So far I have use burp suit to crawl the website and then check for a WordPress file like license.txt, but in this way is very time consuming so I want to know if there is any other automated tool that I can use in order to check this.

By the directory structue, like: /wp-admin, /wp-json...
You can also see through the url of images: wp-content/themes/<theme>/.
See:

    [dir] wp-admin
    [dir] wp-includes
    index.php
    license.txt
    readme.html
    wp-activate.php
    wp-blog-header.php
    wp-comments-post.php
    wp-config-sample.php
    wp-cron.php
    wp-links-opml.php
    wp-load.php
    wp-login.php
    wp-mail.php
    wp-settings.php
    wp-signup.php
    wp-trackback.php
    xmlrpc.php


Bruteforce App login forms on Android I was wondering if there is any way (app or something) to bruteforce app login forms on Android?

Yes. You definitely can do this, but it would be easier to bruteforce the actual service. For example programmatically generating login requests and send them manually to the authentication service to which the app is communicating.

Bruteforcing login forms of android apps directly would be much slower, but still be possible. You probably need to get higher privileges on the app performing the bruteforce to automate the UI interaction events from another app.


Could a desktop application disclose location even if a VPN is used? When using a proper VPN to access a remote server, the server should not be able to resolve your country of origin using your IP address because the IP provided in the request will be the one of the proxy.

Now let's talk about a desktop application able to run system commands: even if you use a proxy to hide your origin country, could the malicious application perform a traceroute and provide the output to the remote server, allowing it to resolve your origin country?

Traceroute was the first example coming to my mind. Any other tool/technique proving the point could be used to answer the question (except locales about languages/keyboards/etc...)

As you noted, "languages/keyboards" may help.

But it can be improved with "TimeZone"

Also, if the application has enough privilege, it may:

Ask the operating system what is the location
Ask the list of Wifi in range and if any one of them have a known location
If it can read your personal files it may - for example - reads pictures location metadata.

More complicated but feasible:
- If it can reads the host file, it may use domains with known geoip DNS to detect where the computer was before using the VPN

Recent example - on android: an application without the "location" privilege (nor the "picture" one, but irrelevant here) could take a picture and reads it's metadata to locate the user. So a VPN would be useless if the phone OS had register an accurate position using GPS or Wifi: https://www.checkmarx.com/blog/how-attackers-could-hijack-your-android-camera


Extract pre-master keys from an OpenSSL application Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA private key is also available, but since a DHE cipher suite is in use, this cannot be used to decrypt the packet capture using Wireshark.

Thomas suggests in this post that it is possible to extract keys from RAM. How could this be done for OpenSSL? Assume that the address of the SSL data structure is known and TLS 1.0 is in use.

Note: as of OpenSSL 1.1.1 (unreleased), it will be possible to set a callback function that receives the key log lines. See the SSL_CTX_set_keylog_callback(3) manual for details. This can be injected as usual using a debugger or a LD_PRELOAD hook. Read on if you are stuck with an older OpenSSL version.

For a walkthrough of the LD_PRELOAD approach for Apache on Debian Stretch, see my post to Extracting openssl pre-master secret from apache2. Technical details follow below.

If you have just gdb access to the live process or a core dump, you could read data from data structures. It is also possible to use an interposing library.

In the following text, the basic idea of key extraction using GDB is described, then an automated script is given to perform the capture.

Using GDB (basic idea)

Based on this Stackoverflow post, I was able to construct a function that could print a line suitable for Wireshark's key logfile. This is especially useful while analyzing core dumps. In GDB, execute:

python
def read_as_hex(name, size):
    addr = gdb.parse_and_eval(name).address
    data = gdb.selected_inferior().read_memory(addr, size)
    return ''.join('%02X' % ord(x) for x in data)

def pm(ssl='s'):
    mk = read_as_hex('%s->session->master_key' % ssl, 48)
    cr = read_as_hex('%s->s3->client_random' % ssl, 32)
    print('CLIENT_RANDOM %s %s' % (cr, mk))
end

Then later on, after you step upwards in the stack until you get a SSL structure, invoke the python pm() command. Example:

(gdb) bt
#0  0x00007fba7d3623bd in read () at ../sysdeps/unix/syscall-template.S:81
#1  0x00007fba7b40572b in read (__nbytes=5, __buf=0x7fba5006cbc3, __fd=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/unistd.h:44
#2  sock_read (b=0x7fba60191600, out=0x7fba5006cbc3 "\027\003\001\001\220T", outl=5) at bss_sock.c:142
#3  0x00007fba7b40374b in BIO_read (b=0x7fba60191600, out=0x7fba5006cbc3, outl=5) at bio_lib.c:212
#4  0x00007fba7b721a34 in ssl3_read_n (s=0x7fba60010a60, n=5, max=5, extend=<optimized out>) at s3_pkt.c:240
#5  0x00007fba7b722bf5 in ssl3_get_record (s=0x7fba60010a60) at s3_pkt.c:507
#6  ssl3_read_bytes (s=0x7fba60010a60, type=23, buf=0x7fba5c024e00 "Z", len=16384, peek=0) at s3_pkt.c:1011
#7  0x00007fba7b720054 in ssl3_read_internal (s=0x7fba60010a60, buf=0x7fba5c024e00, len=16384, peek=0) at s3_lib.c:4247
...
(gdb) frame
#4  0x00007fba7b721a34 in ssl3_read_n (s=0x7fba60010a60, n=5, max=5, extend=<optimized out>) at s3_pkt.c:240
240     in s3_pkt.c
(gdb) python pm()
CLIENT_RANDOM 9E7EFAC51DBFFF84FCB9...81796EBEA5B15E75FF71EBE 6ED2EA80181...

Note: do not forget to install OpenSSL with debugging symbols! On Debian derivatives it would be named something like libssl1.0.0-dbg, Fedora/RHEL call it openssl-debuginfo, etc.

Using GDB (improved, automated approach)

The basic idea which is described above works for small, manual tests. For bulk extraction of keys (from a SSL server for example), it would be nicer to automate extraction of these keys.

This is done by this Python script for GDB: https://git.lekensteyn.nl/peter/wireshark-notes/tree/src/sslkeylog.py (see its headers for installation and usage instructions). It basically works like this:

Install breakpoints on several functions where new pre-master keys can arise.
Wait for the function to finish and write these keys (if not known before) to a file (which follows the SSLKEYLOGFILE format from NSS).

Paired with Wireshark, you perform a live capture from a remote server by running these commands:

# Start logging SSL keys to file premaster.txt. Be careful *not* to
# press Ctrl-C in gdb, these are passed to the application. Use
# kill -TERM $PID_OF_GDB (or -9 instead of -TERM if that did not work).
(server) SSLKEYLOGFILE=premaster.txt gdb -batch -ex skl-batch -p `pidof nginx`
# Read SSL keys from the remote server, flushing after each written line
(local) ssh user@host stdbuf -oL tailf premaster.txt > premaster.txt
# Capture from the remote side and immediately pass the pcap to Wireshark
(local) ssh user@host 'tcpdump -w - -U "tcp port 443"' |
    wireshark -k -i - -o ssl.keylog_file:premaster.txt

Using LD_PRELOAD

SSL/TLS can only negotiate keys at the SSL handshake steps. By interposing the library interfaces of OpenSSL (libssl.so) that performs said actions you will be able to read the pre-master key.

For clients, you need to interpose SSL_connect. For servers you need to interpose SSL_do_handshake or SSL_accept (depending on the application). To support renegotiation, you will also have to intercept SSL_read and SSL_write.

Once these functions are intercepted using a LD_PRELOAD library, you can use dlsym(RTLD_NEXT, "SSL_...") to lookup the "real" symbol from the SSL library. Call this function, extract the keys and pass the return value.

An implementation of this functionality is available at https://git.lekensteyn.nl/peter/wireshark-notes/tree/src/sslkeylog.c.

Note that different OpenSSL versions (1.0.2, 1.1.0, 1.1.1) are all incompatible with each other. If you have multiple OpenSSL versions installed and need to build an older version, you might have to override the header and library paths:

make -B CFLAGS='-I/usr/include/openssl-1.0 -DOPENSSL_SONAME=\"libssl.so.1.0.0\"'


Can a piece of malware/virus inject itself into an ISO Let's say that I have an infected PC. I download a copy of the Windows ISO(obviously clean) and burn it to an USB. Is it possible that the malware on my computer can inject itself in this process/ISO and somehow land itself onto my bootable USB such that even if I reinstall Windows, my PC remains infected?

It is technically possible to write some malware that intercepts the ISO extraction process and then writes a boot sector to the media in order to run some malware before the normal boot sequence to hinder detection.

I do not know whether there are any current occurrences of this type of malware in the wild however. It is probably not worth worrying about unless you would be the target of such an attack because it is not a commonly used technique. Most viruses propagate because they use common attack vectors that are known to succeed on a large scale, and such an attack would be technically harder to achieve (both ISO interception and the installation of a bootloader to launch in memory persistence) so these things are unlikely outside of a targeted attack.


How disable "last password you remember" of Google, after knowing that someone has my password? I have received this email from Google:

Someone just used your password to try to sign in to your Google Account xxxxxx@gmail.com.
Details:
     Sunday, July 9, 2017 11:27 AM (France Time)
     ******, France
Google stopped this sign-in attempt, but you should review your recently used devices

Google was right! Someone has my password and tried to login to my account.

I changed my password, but I wonder whether the attacker can use "Enter the last password you remember" option of the Google to regain her access to my account? Can I disable this option for my account?

To reset the password there are several ways. But at the end google send a SMS message to confirm the reset.

If you have the correct phone number in your google profile, the attacker can't access to your account with the old password.

To add another security you can activate the 2 Factor Authentication


Is a rootkit not an exploit? I once referred to the bluepill rootkit from 2006 as an exploit. I was corrected and told that rootkits aren't exploits. Is this true? I thought an exploit included any software that was used to attack a system.

Wikipedia seems to refer to exploit in this way:

https://en.m.wikipedia.org/wiki/Exploit_(computer_security)

  An exploit (from the English verb to exploit, meaning "using something to one’s own advantage") is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized)

I think this is off-topic, but here is what you are looking for.
RootKit
A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) while at the same time masking its existence or the existence of other software. - you might use it for keeping your access to a compromised system after exiting or logging out from that system by having a port set for giving you shell and access or whatsoever else again. Meanwhile once an attacker gains root privilege, it becomes a cakewalk|backdoor for him to exploit (used as verb) your system. BTW, there is a slight difference between RootKit and BackDoor.
Exploit
In computing, an exploit is an attack on a computer system, especially one that takes advantage of a particular vulnerability that the system offers to intruders. Used as a verb, the term refers to the act of successfully making such an attack.
Conclusion
It is easy to juxtapose terms which are somehow related to one another. It is best to learn the precise meaning of certain words. Although this is more work than not using those words correctly, doing so allows us to communicate to others more clearly.
RootKit: Software that hides itself on a system so it is not easy to detect. Often used as a way to maintain long term control or access to a system that the system user is unaware of. A rootkit may use exploits to either gain initial access or complete control of the system.
Exploit: An unpatched vulnerability in a system (in hardware, OS, or application code) that can be used by an attacker to gain access to, control of, or escalate privileges on that system.


Is it unsafe to use /etc/hosts file as a website blocker in the following manner? I'm a linux noob, and while looking for a simple OS-level website blocking technique, I came upon the solution of using the linux hosts file like so:

127.0.0.1 websiteiwanttoblock.com
127.0.0.1 anotherone.com
...

This is nice and simple - perfect for my purposes, but here's my question: If I often use 127.0.0.1 for web development purposes, is this dangerous?

It seems that, at the very least it could mess up the web dev project I'm currently working on? For example, if Chrome/Firefox makes a request to websiteiwanttoblock.com/api/blah, then would that make a request 127.0.0.1/api/blah and potentially mess with my project's api?

If this is dangerous in that regard, is there a safer "null" ip address that I could redirect blocked sites to? I know it's probably not good practice to use the hosts file like this, but I just love the simplicity of editing a text file rather than downloading a package or whatever.

Edit: Oh, and I often use port 3000 for dev stuff, but let's assume that I sometimes use 80, or any other available port number.

Short Answer
Is it safe to use the /etc/hosts file as a website blocking "null" address?
I would argue the answer should be: No.
If for no other reason than the requests are not actually "nulled".  They are still active requests.  And as the OP indicates, since the requests are for legitimate Internet hosts, this sort of short cut method of redirecting requests to localhost may interfere with testing networking code in a development environment.
Perhaps a better method of blocking traffic to and from certain Internet hosts, is to utilize iptables which is the interface to the Linux kernel's firewall.  iptables is the default networking rule table for most GNU/Linux systems.  Some distros use ufw as a front-end to iptables.
If you want to use iptables, here's a simple script which will DROP all incoming and outgoing packets for a list of IP addresses or hostnames with one address or hostname per line contained in a plain text file called ~/blocking.txt
## Block every IP address in ~/blocking.txt
## DROP incoming packets to avoid information leak about your hosts firewall
## (HT to Conor Mancone) REJECT outgoing packets to avoid browser wait
for i in $(cat ~/blocking.txt); do
    echo "Blocking all traffic to and from $i"
    /sbin/iptables -I INPUT -s $i -j DROP
    /sbin/iptables -I OUTPUT -d $i -j REJECT
done

Sample ~/blocking.txt
websiteiwanttoblock.com
anotherone.com
ip.add.of.net/mask

Do not place your localhost IP addresses in this file.
Longer Answer
While reassigning Internet hosts to localhost in the /etc/hosts file is a common short cut technique to block unwanted Internet hosts, this method has some serious security drawbacks.
Incoming requests
Incoming requests which were not purposefully initiated via a specific user request.  The most common example is ads on webpages.  Let's follow the incoming packets...
First, I start up wireshark.  Then I place the biggest Internet ad company in my /etc/hosts file with this line:
127.0.0.1   google.com

And then disable all ad blockers in my browser, navigate to youtube and play any random video.
If I filter my packets, broadly including Google's IP address space:
ip.addr==172.217.0.0/16

I am still receiving packets from Google.
What does this mean?
It means that there is a possibility of a malicious server inserting malware which may be able to attack my computing platform via packets that are still arriving and sent to localhost.  The use of /etc/hosts rather than dropping or rejecting the packets via the firewall rules, is a poor security measure.  It does not block incoming packets from possible malicious hosts, nor does it provide effective feedback for trouble shooting purposes.
Outgoing requests
Outgoing requests which are sent to localhost rather than being rejected or dropped by the firwall rules are still being processed by the kernel.  There are a few undesirable actions that occur when /etc/hosts is used rather than the firewall:

Extra processing is occurring when the outgoing packet hits localhost.  For example, if a webserver is running on the host, the packet sent to localhost may be processed by the webserver.

The feedback from outgoing requests may become confusing if the /etc/hosts is populated with certain domains.

iptables can handle lots of rules
According to some:
ServerFault: How many rules can iptables support
A possible theoretical limit on a 32-bit machine is 38 million rules.  However, as noted in the referenced post, as the iptables rule list expands so does the needed kernel memory.


Overwriting hard drive to securely delete a file? I am working on a computer that I am not allowed to install new software on. It does not have secure delete software installed. Suppose I have a file (or files) that are sensitive that I'd like to delete and prevent (or make it very difficult) to recovery. If after deleting the file(s) I filled up the hard-drive with other non-confidential files and then deleted those (repeating this process a few times) would this essentially do the same thing as a secure delete utility that wipes the drive?

If you use sdelete from Microsoft (http://technet.microsoft.com/en-us/sysinternals/bb897443.aspx)  you don't have to install anything. It has an option to fill the unused disk space with zeroes too. If you already deleted the files this is what I'd just to make sure that nothing remains of the original file.


Why does SSL Labs say that POODLE is mitigated if a server chooses RC4? I always thought that if a server supports SSLv3 and CBC ciphers, then it is vulnerable to POODLE. But it looks like that is not the case.

For example, for Google.com, SSL Labs says that the SSL POODLE attack is mitigated even though it supports CBC ciphers with SSLv3. On further investigation, I found that if SSL Labs detects that a server prefers RC4 over CBC (SSL 3: 0x5 is mentioned next to SSL POODLE result).

Now MITM can only provide CBC ciphers to Google.com, then it will only choose CBC (out of what I provide), and it will still be vulnerable to POODLE. But then why does SSL Labs says it is not?

Ivan Ristic explains this in a blog post:

  In the short term, it’s possible to mitigate POODLE by avoiding using CBC suites with SSL 3, but that involves relying on a certain insecure stream cipher whose name no one wants to mention. I don’t recommend this approach.

And that insecure stream cipher (suite) is this:

TLS_RSA_WITH_RC4_128_SHA (0x5)


Is this exploit on household appliances really as bad as it sounds? CNN article link.

The article claims that a household appliance can be hacked by reprogramming the circuits inside of it to release electromagnetic waves that could release system information, but exactly how credible is the threat, or is it as bad as it sounds?

Is it possible?  Yes.  Varying the electromagnetic noise of a device's circuits to transmit data has been used both in and out of laboratory settings.  (For example, somebody figured out how to modulate the Raspberry Pi's GPIO pins to turn it into an FM radio transmitter, with the side effect of trashing a wide band of the radio spectrum.)

Is it practical?  No.  Even the Pi, with its relatively high-powered unshielded electronics, didn't have a range of more than a hundred meters or so.


How secure are most FDE implementations? I'm applying disk encryption to my local machine and I'm storing the key on a usb drive. This means I need the usb drive to be able to boot. This got me wondering, I've heard about different osses providing encryption, Ubuntu, OS X, Windows. From what I understand, people don't need to authenticate pre-boot, they only need to 'log in', everything appears to happen automagically. They don't need to enter an extra passphrase or supply a keyfile.

Doesn't this mean that either:
a) the encryption key is stored (unencrypted) on disk, effectively rendering the disk encryption useless or
b) the encryption passphrase is the same as the user's password

In the first case, what stops me from pulling the disk, hooking it up to another machine, and using the key to decrypt the disk?

In the second case I don't see how this can be FDE as the os already booted (unless the user's files are on a separate disk). Anyway, what stops me from recovering the user's password (with tools like ophcrack or John)? And will this be enough to decrypt the user's data?

I'm really starting to have some doubts about disk encryption implementations on Ubuntu, OS X, Windows, Android. So, how secure are these actually? And how do these work with such little user interaction?

To be clear; I'm only asking about offline attacks, cold boot attacks or DMA stuff are off the table.

The FDE scheme varies between vendors, but the general idea is that there is a security chip on the device itself that combines data with the PIN/password in order to form the final encryption key. This means that even if you know the PIN or password, but you move the storage medium to a new device, it won't work. The data is not only locked to a specific PIN, but also to a specific computing device.

Offline attacks are infeasible, because even if you know the PIN, you're still forced to brute-force a key that's stored in the TPM or security chip. For example, on many Intel/AMD motherboards, the TPM uses a 2048-bit key derived from the user's PIN. You must brute-force this 2048-bit key in order to get the key to decrypt the storage medium. If you're lucky, the volume encryption key will only be AES 128-bit encrypted, which means you might be able to brute force you way through the key in about a century or so; Bit Locker also allows for AES 256 to be used instead.

Android, Apple, Linux, etc use similar protection schemes based on hardware chips, which are nearly impossible to tamper with (but not actually impossible) when available. You'd want to check the manual for specifics. On older devices without security chips, it might be possible to hack through FDE, but almost all devices put out in recent history will have some sort of on-board encryption chip.

These should be considered essentially uncrackable to any average attacker (state actors with nearly unlimited resources might find a way to get at the chip's keys, but it's still risky if the chip is tamper-resistant). If the original device is destroyed or disabled, such that the key can't be recovered, the data on the storage medium would be considered irretrievable.


Is a One Time Password Scheme based on Diceware viable and secure? I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that does this be considered secure?

Use a strong random number generator to create an initial seed
Generate a new random number from a CSPRNG
Create a diceware password from the lower 15 bits (for 5 dice, 18 for 6 dice, etc)
Store the seed securely

Generating lists of passwords can obviously be done provided you have the starting seed, and you can always generate new passwords by changing the initial seed. Seems simple enough, and diceware's wordlist is > 3 times the size of S/KEY's which seems to make it more secure... However, such a simple scheme seems likely to be insecure due to something I'm missing. Has this scheme been studied before? Is it viable?

Edit: I realized my step 3 is flawed. We need multiple random numbers to extract 15 bits for each word output from diceware. In other words, we need 60 bits for 5 words, and 120 bits for 8 words. But, the point remains the same.

The problem is that a random number generator is not cryptographically secure.  Someone could look at the progression of passwords and potentially work backward through the algorithm to determine the seed being used.  At this point, your key would be broken.

The method you describe is actually very similar to the way most two factor token devices work however.  Basically, they store an encryption key securely.  They then use that encryption key to encrypt a timestamp based on an internal clock.  The server also knows the key and knows what the encrypted value should be.  They then hash it down to a value that can be easily entered by the user.  If both values match, you are given access.

Drift correction for the token's clock is done by looking for slow drift and adjusting the time offset for the token on the server.  (For example, if you consistently start putting in codes that are about to be valid, then it knows that the clock on the token is running fast and can adjust accordingly.

The server also stores the most recently used timestamp and will not accept any codes that precede it.  (Though they wouldn't be accepted outside about a 1 minute window anyway, but this is to prevent a quick replay after making it appear a code was denied.)


How to create combinations of a password I don't remember my password, I can't remember exactly the variation.

How can I brute force all the permutations of a word knowing the following conditions:

Idea of the word (in my mind).
Lower and/or upper case.
Substitution of vowels with(out) numbers.

For example the following sound stackoverflow is a concept, can be written in password by the following combinations (having in mind the before rules):

stackoverflow
Stackoverflow
sTackoverflow
...
ST4CK0V35FL0W

Thanks in advance.

The easy way i know is by using a python script to generate a password based on characters you remember.

for example

#!/usr/bin/python
import sys
import datetime
import os
import string, random
import itertools

info = '''

######################################################
                By ACT Group inc
######################################################

    Alex
    Clairic
    Thuli
    The Pukiisefu Family
    http://actgroupinc.com

    Note: We Feel Proud To Be Who We are
######################################################

#######################################################################
# High Speed Word list Generator : Compatible To All Operating Systems #
#######################################################################
+++The little indemise Rose that grew on concrete++++
######################################################
'''

print info
chrs = list('STACKOVERFLOWstackoverflow1234567890')
l=6
k = l
j= 10
n= j-1
for i in xrange(k,n):
  for xs in itertools.product(chrs, repeat=i):
    sys.stdout.write(''.join(xs)+ '\n')
    sys.stdout.flush()
print '''
\t***************************************************
\t*       Successfully created thanks for using     *
\t***************************************************

'''
raw_input("[*] Press Enter For Exit")

you just need to change the minimum and maximum length here

min

l=6

max

j= 10

Note: you need python 27 installed in your system plus you may modify the code to save the words in a txt file


How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it? I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little confused as to how this could be possible.

Sure, I understand fairly well (I think) the idea of encryption, and that without knowing the encryption key people would have a hard time breaking the encryption. However, my understanding is that when an HTTPS connection is established, the encryption key is "discussed" between the various computers involved before the encrypted connection is established. There may be many factors involved in choosing an encryption key, and I know it has to do with an SSL certificate which may come from some other server. I do not know the exact mechanism.

However, it seems to me that if the encryption key must be negotiated between the server and the client before the encryption process can begin, then any attacker with access to the network traffic would also be able to monitor the negotiation for the key, and would therefore know the key used to establish the encryption. This would make the encryption useless if it were true.

It's obvious that this isn't the case, because HTTPS would have no value if it were, and it's widely accepted that HTTPS is a fairly effective security measure. However, I don't get why it isn't true. In short: how is it possible for a client and server to establish an encrypted connection over HTTPS without revealing the encryption key to any observers?

It is the magic of public-key cryptography. Mathematics are involved.

The asymmetric key exchange scheme which is easiest to understand is asymmetric encryption with RSA. Here is an oversimplified description:

Let n be a big integer (say 300 digits); n is chosen such that it is a product of two prime numbers of similar sizes (let's call them p and q). We will then compute things "modulo n": this means that whenever we add or multiply together two integers, we divide the result by n and we keep the remainder (which is between 0 and n-1, necessarily).

Given x, computing x3 modulo n is easy: you multiply x with x and then again with x, and then you divide by n and keep the remainder. Everybody can do that. On the other hand, given x3 modulo n, recovering x seems overly difficult (the best known methods being far too expensive for existing technology) -- unless you know p and q, in which case it becomes easy again. But computing p and q from n seems hard, too (it is the problem known as integer factorization).

So here is what the server and client do:

The server has a n and knows the corresponding p and q (it generated them). The server sends n to the client.
The client chooses a random x and computes x3 modulo n.
The client sends x3 modulo n to the server.
The server uses its knowledge of p and q to recover x.

At that point, both client and server know x. But an eavesdropper saw only n and x3 modulo n; he cannot recompute p, q and/or x from that information. So x is a shared secret between the client and the server. After that this is pretty straightforward symmetric encryption, using x as key.

The certificate is a vessel for the server public key (n). It is used to thwart active attackers who would want to impersonate the server: such an attacker intercepts the communication and sends its value n instead of the server's n. The certificate is signed by a certification authority, so that the client may know that a given n is really the genuine n from the server he wants to talk with. Digital signatures also use asymmetric cryptography, although in a distinct way (for instance, there is also a variant of RSA for digital signatures).


Can a HTTPS connection be compromised because of a rogue DNS server If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an attack on the DNS service)?

I'm thinking about e.g.: the CA's site (to check the HTTPS connection) is resolved by my nameserver (the compromised one)?

In order to connect to any website, through https or not, you need the ip address of the site, and you ask your DNS server for it using the domain name of your site. If your DNS server has not cached the answer, it will try to resolve your request by asking a whole series of DNS servers (the root dns server, the top level domain handler ... until the dns server that is authorative for the domain).

An attacker that controls any of those servers can respond to you with a fake IP address for that website, and this is what your browser will try to visit. This IP address in the general case will have a replica of the website hosted, to make it look the same as the original one, or just act as a silent forwarder of your connection to the correct site after capturing what it needs.

Now on to more details: If the website is HTTPS protected there will be many pitfalls. The normal website will have a certificate issued that binds details of the domain name to the website, but this is done using assymetric encryption.

What this means is that through the process of SSL handshake, the website has to prove that it has knowledge of the private key that is associated with the public key in the certificate. Now, the malicious party can very well serve you the original certificate of the website when you try to access the wrong IP under the correct hostname, but he will not have knowledge of the private key so the SSL handshake will never complete.

But there are ways for the interceptor to make the whole thing work, I can think of four:

1) The simplest solution is to serve you a self-signed certificate instead of a normal one. This will be issued by the attacker itself. Normally your browser will warn you about that, and if you run a recent browser version the warnings will be all over the place, but users tend to click-through that kind of stuff..

2) Another approach, used in the Stuxnet attacks, is to steal the private keys used for a valid certificate from the organization that you want to impersonate.

3) Another solution, that has happened in a couple of cases (we are not talking about the average attacker here) is that he exploits some fault in the registration procedure that certificate authorities (or registration authorities) use, and manages to issue a certificate for a website that does not belong to him. There have been cases that RAs simply did not do enough checks and issued certificates for google.com ..

4) Similar to the above: A competent attacker 'hacks' a certificate or registration authority and manages to issue some certificates under whatever name he wants. It happened in May of 2011 (the famous comodo-hack) and July of 2011 (the DigiNotar hack).  See more details at How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove? - IT Security.

5) Finally the most scary tecnique is the one that three letter agencies and similar parties can use: If a government controls a Certificate Authority, in theory it can force it to issue certificates at will, for whatever site. Now think that Certificate Authorities are spread throughout the world, some being in countries where this can seem very possible.  An example to watch here is the CA operated by the Emirates Telecommunications Corporation (Etisalat), 60% owned by the United Arab Emirates (UAE) government.  Etisalat once rolled out an innocuous looking BlackBerry patch that inserted spyware into RIM devices, enabling monitoring of e-mail.

In addition, if the client still supports the old SSL 2.0 protocol, a MITM can downgrade the SSL connection and use either a weaker symmetric encryption algorithm or a weaker key exchange.

So to sum up, if the attacker controls the DNS server he can do very malicious things, but for intercepting SSL encrypted traffic he needs something more than that.

And to answer your last question: The CA's site does not need to be resolved each time you visit a site: The website usually serves you the public certificate it uses itself, but it is possible that you get it from the CA instead. This does not change any of the mentioned things above though.


How should I document my Public Key Infrastructure? I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert.

I suppose the audience could be broken up into the following roles

People who request certificates
Administrators who approve certificates
Technical PKI administrators who replace me in the future

There could be more roles, but I don't want to create any unnecessary work for myself.  No-one is asking for this information per-se, but I know this body of knowledge I've gathered needs to be stored somewhere.

Question

What audiences should a PKI administrator generate documentation for?
What technical facts should be in the respective documentation?
What should be out of scope (too detailed, or too simple) in each document?

This type of question comes from 1998 thinking as an MCSE where Microsoft had template documentation and checklists for various aspects of Windows.  If other vendors (Entrust, etc) have relevant sample documentation that would be useful to structure my thinking.

You at least need :

documents to describe processes involved in certificates life cycles :

*request for a new certificate

*certificate revocation

*certificate renewal

both for administrators and users (probably two different documents for each process)

a general architecture document, describing CA levels and their purpose

That's in my opinion the bare minimum. Depending on who manages certificates and what their expertise level is, various tutorial documents with screenshots and so could be useful.


Minimum set of TLS features for an embedded device I am reviewing the security of an embedded system, specifically how it uses the TLS or DTLS protocol to communicate securely. The system implements as few features of the protocol as it can get away with. It doesn't deviate from the protocol as such, but it may not always be strictly compliant with all applicable RFC. My objective is to determine whether the choice of security parameters are safe.

I will have to do this again for other similar systems, hence my question is somewhat general rather than being about a specific system.

The security objectives of using (D)TLS are the usual one: an attacker could intercept network traffic (active man-in-the-middle). We want to ensure that the client is talking to the server it thinks it's talking to and that a third party cannot obtain or modify transmitted data (confidentiality and integrity of traffic on the connection). Client authentication is sometimes desired as well.

These are embedded (IoT) systems with very few resources, and usually interacting in controlled ecosystems. At least, we control the legitimate peers, so compatibility with diverse antique clients and servers is not an issue — the concerns are very different from using TLS on the web. A typical endpoint client only speaks one or two ciphersuites (“classic” signature-based server authentication, pre-shared key, or one of each). Depending on the scenario, the PKI may or may not be a closed system: some devices live in a world where we can trust CAs to only deliver certificates of a certain form, while others may trust a “public web” CA.

These are devices with stringent constraints on available computing power, RAM size and code size. So they're generally running stripped down TLS libraries with as few features as possible. I'm talking microcontroller with 128–512kB of RAM, not higher-end devices running Linux.

Are there (D)TLS or X.509 extensions that are important? I'm not concerned with the choice of ciphersuites (nobody uses DES, RC4 or MD5 in my world, or ciphersuites without server authentication) or with key sizes. What I'm worried about is, for example, an implementation that skips checks on certificates (e.g. key usage restriction) which would allow a certificate to be misused. Or a missing check during the handshake that allow some kind of downgrade attack (an endpoint device usually only speaks a single protocol version, but the servers it talks to may support multiple versions). Or a missing extension that allows an active MitM to convince the two parties to settle on mismatched security parameters, or to renegotiate insecurely.

What should I be looking for when reviewing the TLS configuration on a small embedded device?

It's unclear whether you're only looking at the TLS client, or whether you're reviewing both client and server implementation. I'll assume both.

I recently completed a security review of WolfSSL (which comes with a recommendation by the way), and various proprietary TLS stuff, so this is fresh on my mind. Here is a thoroughly incomplete list of things I look for:

X.509 Stuff

Make sure the client is checking that the CN of the DN matches the domain of the URL it requested.
Use your judgement that cert validation makes sense in the closed-system context. You may need to make some lists of what the possible use-cases are, given the constrained environment, and make sure they're met. Also do some head-scratching that the absence of checks for the use-cases you're leaving out can't be abused.
Can certificates get revoked in this environment? If so, what mechanism? CRL? OCSP? There could be additional extensions you need to support here.

How does the client behave if it can't retrieve revocation data? Is that reasonable given the use-case?

Are there intermediate CAs, or are all certs issued directly by the pinned root?

Is root cert pinning / trust management being done in an intelligent way?
If intermediates, do those expect you to fetch data from the AIA extension? (if there are "public web CAs" involved, then this is almost certainly a Yes).
If intermediates, then you probably need to enforce basicConstraints for path length and cA to make sure jokers aren't issuing certs off an end-entity cert.

TLS Stuff

State machine: all the SMACK-TLS related vulns (SKIP, FREAK) are caused by the attacker abusing TLS engine's state machine, so make sure it's enforcing from each state, what the valid possible next states are. More scrutiny on the server, but relevant to both.
Cipher Suites: check client configuration, and check that server combines the client's preference order with its own in some intelligent way. (btw TLS 1.3 has some changes here, so if you need to support that, beware.)
The usual array of buffer size handling, pointer nullity, and memory-management checks. Bad things usually show up near the socket recv calls.

I could go on, but I may need to ask for compensation :P


Preventing unvalidated redirects and forwards Suppose you have a redirect page where the client is redirected to a URL from the query string:

http://victim/redirect.aspx?url=http://evil/

You really need to be able to redirect to a another page or URL, how can you prevent this functionality from being exploited?

OWASP says:

  It is recommended that any such destination input be mapped to a value, rather than the actual URL or portion of the URL, and that server side code translate this value to the target URL.

Could somebody explain this with an example please?

Don't provide the actual URL as an argument to the script. Instead, provide some ID which you can translate into a URL in the redirector script.

For example use redirect.aspx?url=1 instead, and in the script, translate ID 1 to some URL using a map, database lookup, or whatever you find useful.

This way, only a fixed set of trusted URLs can be redirected to.


See the contents of https/ssl data weeks after leaving the wfi I just recently broke up with my ex boyfriend, I am  not computer smart but he is, scary computer smart and can basically do anything, with lots of schooling and whatever it is he does for work...

I was staying at his place for about 3 or 4 months and would use his WIFI. We had a messy break up, and I wonder if he has all my information, like bank account numbers and all that stuff since I used his WIFI for my time being there. Most things were over HTTPS and im pretty sure the padlock was always there so I don’t think he was using SSL strip. Aside from that is there any other way that he could get my information if I’m only using HTTPS?

I see questions about if workplaces can see it, but not much if there was somebody in a non corporate setting, possibly willing to do illegal and more questionable things.

If everything checks out now and he most likely was not watching my data while I was staying there, what about now? If he was recording and monitoring everything I was doing but not able to see the exact data, is there any way that he could go back through and see it now? From what I understand is its all encypted and gibberish, but could he do anything to see my data anyways, like do ssl strip on a browsing session that ended when I left a few weeks ago, or what I understand is a downgrade attack to see all my data even on an browsing session that ended a few weeks ago, if im not currently connected to the wifi? Or do all attacks need me to be present, currently connected and in the browsing session? ( are attacks on Https or my data and whattnot only possible when it’s occuring, or can you go back and attack/ strip an old browsing session?)

No, he cannot have recorded your traffic then decrypt it later. That takes an incredible amount of power and time.

As for "downgrade attacks", those require an active connection. You manipulate the negotiation of the security between the server and the client and force a weaker level of security. That's obviously not possible when there is no connection or on recorded traffic.

Could he have been able to see your traffic while you were there? Yes, using the methods you read about in the workplace questions you mentioned. Primarily by installing a certificate on your devices so that the lock would be there, but he was logging all the details because the lock was to him and not to the site you were browsing.


cookie issue with same domain same path but different port I have two web app running on same host on same path but on different port

http://somedomain.com/

and

https://somedomain.com/

now when I visit first app it serves the cookie say with name abc, and now my browser has this abc, now if I open another tab and goto app2 (https one), browser sends the cookie abc in request (because of same domain, same path) and this app sets the secure flag true because its running on https,

so now in my browser abc is overriden by secureflag = true, so if I make request to app1 (which is running on http), it doesn't send abc because of secure flag and it makes me logout because abc is session cookie

what is the secure way to overcome this,

both of the apps are mine so cookie hijacking from another app is not the case

I tried setting app2 at some other path /foo

so now its

http://somedomain.com

and

https://somedomain.com/foo

if my browser has the cookie from foo first then everything goes ok, but if I hit app1 first then it still sends the cookie to /foo

The easiest and clearest solution is simply using differently named cookies (in addition to setting secureflag=true on the secure site cookie), eg. abc and abc_secure. This also makes development and debugging much much easier.


Security of picking unique passwords for users I am learning more about security in web design so I can build more robust sites. As I see it password security is one of the main concerns, if a database is hacked then chances are passwords will be on the list of the attackers. I understand that you should not store 'plain text' passwords and instead hash/salt; storing that instead. But, on a site I have been working on, we have 'site only' passwords, ie the passwords are generated automatically by the website for the user site access. These are for admin and the site's course access and consist of the website name followed by numerous random characters. So the passwords even if accessed in plain text format would not be of any use, because the passwords are unique to that site only. As I understand normally the hackers are looking for 'common' passwords, which can be used to access other sites.

This system was put in place by an experienced programmer. But I am wondering if the general consensus is that using this method of unique site passwords is a much safer option and if so then why do most sites generally request user set passwords in the first place; which are more vulnerable (even though they are perhaps easier to remember)?

Forcing the user to pick a password you generated is an efficient way to prevent password reuse. That means both (a) that your passwords will not be usable on an other site if an attacker steals them, and (b) your users accounts will not be breached even if they were all on LinkedIn, MySpace, Sony and Ashley Madison.

On the other hand, it will wake them way harder to remember. Users are therefore more likely to write them down on a post it next to the screen or in an email sent to themself - not very secure practices. They are also more likely to be annoyed at you and don't use your site. If you try to counteract this by generating passwords with less entropy, you might end up making users who would prefer to use a password manager to generate long, unique passwords substantially less secure.

Finally, to the question if there really is any need to hash the passwords: Yes, you should hash them. If your database is leaked (SQLi, lost backup, etc) you do not want the attacker to have all the passwords and be able to login as an administrator.

For how to securely hash passwords, see this question.


External websites in logs I have a website, let's call it www.good.com.

I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site performance issues. I'm running a .NET solution on IIS for reference.

I have a logger that is constantly picking up 404 errors for external hosts. Below are examples of some of the log data:

Original URL: http://open.tracker.thepiratebay.org/announce?info_hash=%9D%E7%E6%10%911%1Eh%8D%BAX%02%27%C3x5%F0%18%DF%E8&peer_id=%2DSD0100%2D%E6%B2%15Ql%C0%14%5D%3Dx%20%8C&ip=192.168.2.23&port=8956&uploaded=1019809319&downloaded=1019809319&left=192985&numwant=200&key=9135&compact=1
Request URL: http://open.tracker.thepiratebay.org/announce?info_hash=%9D%E7%E6 %911 h%8D%BAX '%C3x5%F0 %DF%E8&peer_id=-SD0100-%E6%B2 Ql%C0 ]=x %8C&ip=192.168.2.23&port=8956&uploaded=1019809319&downloaded=1019809319&left=192985&numwant=200&key=9135&compact=1
Request Path: /announce
Referrer URL: None
User host address: 222.210.108.246
Server: WWW-GOOD-COM-SERVER
User:
IsAuthenticated: False
Authentication Type:
Thread account name: NT AUTHORITY\NETWORK SERVICE
User Agent: Bittorrent

I also see other weird requests from all kinds of other domains, like

vl.ff.avast.com
graph.facebook.com
eztv.tracker.thepiratebay.org
trackhub.appspot.com

Almost always the IP involved is from outside the US.

What I don't understand, is why my server is trying to fulfill requests for any of these urls when it is obviously not the host.

I need to know:

Why could this be happening?
Is this dangerous?
How can I prevent it, if possible?

When you type the URL in your browser, the browser will mainly do two things with it:

Resolve the host name to get the associated IP address to be contacted, this allow the browser to send the request to the right server,
Put the host name which has been actually typed in the Host HTTP header, this allows the server to send an appropriate reply in case several websites are hosted (each website will be identified thanks to this header).

However, what must be understood is that this Host header is just a plain-text header. A simple test:

Initiate a telnet connection toward you web server:

  telnet example.com 80

Request a web page using such commands:

  GET /my-fake-page HTTP/1.0

  Host: my-fake-host.fake

Then you need type enter two times to validate the end of your input.

Then in your logs you should see an incoming request for the URL http://my-fake-host.fake/my-fake-page.

As per the root cause of the issue, the same problem seem to affect other people with no clearly defined root cause, maybe a DNS server issue somewhere in China possibly related to their national firewall, maybe a DDoS botnet, but there does not seem to be any confirmation.

These requests are not dangerous by themselves. However, in the mentioned thread some people were reporting a significant impact on the performance due to the increased load, possibly causing a denial of service. For some other it was just part of the "Internet noise" appearing in the logs.

As i went through the mentioned discussion, in case of load issue a few solutions were proposed, the one mainly applied being blocking source IP based on the originating country.


How does one typically monitor their privileged admins encrypted SSH & RDP sessions? From a compliance (& perhaps just for pure due-diligence) standpoint, what do IT departments typically deploy to keep an eye on their privileged administrator's remote access sessions?   Also what's the standard when it comes to security procedures for third party devs that manage backend dev/prod environments via SSH?

Check out Gartner's Guide for privilege access management. There are large number of vendors in this field that provide capability to monitor "Privileged session". Due to significant maturity of this space, I have not seen any large company rolling out a custom solution.

It is pretty rare for third party devs to have access to prod environment. In most of the places that I have been involved with, the access to developer (including third party) is limited to dev boxes. The UAT and production boxes are only accessible to system administrators. In UAT and in very rare scenario in production, developers may have read only privilege to specific directories to allow them to review logs and configuration files. In most of the prod servers, a privilege session management solution records all the keystrokes and depending on the sensitivity of servers, these keystrokes may need to be approved by a manager on daily basis.


Where do I get "Mercury" by MWR InfoSecurity? Mercury is a really great tool for android pen-testing as well as android forensics. However, they stopped its development and now I get redirected to some product called drozer. Does anyone know where can I find mercury? I have googled for it but I didn't get any good results. I need to install Androguard, as Mercury is one of its dependencies.

According to MWR InfoSecurity:

  Drozer (formerly Mercury) is an open source software, maintained by
  MWR InfoSecurity

Also if you take a closer look at their logs, Drozer is what they were always headed for and Mercury was just a pre-name for (maybe) the incomplete version of what they intended to release. I don't know if you are specifically looking for an older release of Drozer (which is Mercury v2.2.1) or not but when you say:

  now I get redirected to some product called drozer.

It seems like you are unaware of the facts I mentioned above.
Hope this helps :-)


Should I enforce a password policy on a web site? For a commercial web site, is it important to impose some restriction on passwords  to access the system?

Eg. special $char, Upper and lower case, numbers, at least a minimum length...

Can a CAPTCHA system be sufficient to substitute password restrictions?

CAPTCHA systems are in no way a replacement for a good password policy. They aren't tackling the same problems.

CAPTCHA systems only help when someone is attempting an online attack against your system. If your application has some hole that allows an attacker to dump a database full of password hashes, placing a CAPTCHA on every page won't do anything.

Have strong, but reasonable password policies to restrict users from using hilariously weak passwords.


Copyright issues with encryption algorithms I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms DES/AES/BlowFish/TwoFish and so on. My intention is to develop application which is free of commercial copyright issues. So the question is:

If I will use built-in Java
encryption API's (e.g. DES/AES)- does
it mean that I will be free from
possible commercial interests of
DES/AES alike copyright holders?

Any other thoughts, meanings will be helpful also.

There is no copyright on algorithms. Algorithms are like ideas; the kind of intellectual property which applies to them is patents, not copyrights. There are some cryptographic algorithms which are patented, but most are not and some used to be patented (but patents ultimately expire). Neither DES, AES, Blowfish or Twofish is patented. An example of patented symmetric encryption system is IDEA (US patent will expire in 2012). The RSA algorithm (asymmetric encryption and digital signatures) was patented, but the patent expired ten years ago. Basically, if a cryptographic algorithm is made available through an already installed Java VM, then it probably is not patented (anymore, or at all).

There can be copyrights on implementations. Using an implementation which is already there is not impacted by the copyright (it is a copyright, not a useright). You have to worry about copyright when you include external code into your application, not when you use external code provided by the installed Java VM through its published API.

Software systems can further be controlled by licenses. One could imagine a specific license which prohibits using some of the software depending on usage context or just any arbitrary condition. One could imagine such a software license on the implementation of a cryptographic algorithm. This would be the problem of whoever uses your software, not your problem. The Java VM license is the one which applies here. But, as far as I know, there is no usage restriction on the Java VM components, be they cryptographic or not. The VM vendor usually does not wish to restrict usage of his API.

Local laws may apply, especially on the matter of encryption. Depending on the country, laws may limit usage, distribution, export and/or import of software using cryptographic algorithms. The Java VM (at least, the one from Sun/Oracle) includes a relatively complex system of permissions and security rules which determines which algorithms are available, and with which key lengths. Thus, it can be assumed that whatever algorithm is made available to applications by the VM has already been tuned with regards to key lengths in order to comply with local laws. There can always be exceptions in some situations (if you are a North-Korean agent hard at work building a nuclear bomb somewhere in South Dakota, then using cryptographic algorithms, even if legally provided by the installed Java VM, might imply a few extra years of jail when the FBI gets you). In practical terms, you should check the export laws of your country if you distribute software which provides some kind of encryption service, notably if you put it on a Web site.

Summary: there is no intellectual property related worry to have about using cryptographic algorithms provided by the Java VM. You should make some inquiries about regulations on cryptographic software distribution and export. You can begin by the Wikipedia pages on crypto export and import.


Why disable JavaScript in Tor? Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's identity?

I do not know where you got that information but wherever you got it, the official documentation is more reliable:

  We configure NoScript to allow JavaScript by default in Tor Browser
  because many websites will not work with JavaScript disabled.

  If you disable JavaScript by default but then allow a few websites to
  run scripts (the way most people use NoScript), then your choice of
  whitelisted websites acts as a sort of cookie that makes you
  recognizable (and distinguishable), thus harming your anonymity.

But unlike Firefox and Chrome, Tor browser  have not implemented WebRTC that allows requests to STUN servers be made that will return the local and public IP addresses for the user.