How secure is http communication between AWS ELB and EC2 Instances We have a VPC with security group set between AWS ELB and EC2 instances.  However, when a request is forwarded to EC2 instances, we forward it via http, not https.  Http being not encrypted and given that security group is correctly set, I wonder if anyone can eavesdrop the communication?

If there is any resources talking about this topic, that would be great as well.

Thank you in advance...

In general, if traffic between two servers is sent using http instead of https, then anyone with the ability to inspect traffic anywhere along the path could eavesdrop.

In this case, it sounds like that would probably be limited to you and Amazon network admins.


What is the impact of the reported weak IV in 7 Zip? It has been reported that 7 Zip generates IVs in a weak manner.

What is the actual impact of this? I'm asking about historical Zip files that I've sent. I've no plans to use 7 Zip going forward until this is fixed.

If I understand correctly, 7 Zip uses AES-CBC and this would not have a major impact. Even if a user repeatedly used the same password, the small amount of randomness in the IV would be enough to prevent cryptographic attacks.

In CBC mode, the Initialization Vector (IV) has to meet two properties:

Uniqueness: Here the IV is very likely unique because of time(NULL) and gettimeofday() which are basically the current time of your system. It's even more likely on Windows platform since the CPU cycle is involved.
Unpredictability: This property is mandatory if the user can choose the message to encrypt, which is not the case here.

Note that the IV does not have to be secret. As a matter of fact, it is often appended at the beginning of the ciphertext, as clear text. The fact that an attacker can recover the IV is not a vulnerability: the IV is assumed to be public after the encryption is done. Only the two properties listed above are mandatory.

The IV generation is definitely not good (mostly for the size of the IV), but the reaction of OP is exaggerated, the impact isn't that big. It's actually pretty small.

The bigger impact would be that an attacker would be able to recognize two ciphertexts encrypting the same plaintext only if they've been encrypted within the same microsecond, using the same key. Even in this conditions, on a Windows platform, the CPU cycle are very unlikely the same, so the IV will be different.

To give answer to your concerns: No, this vulnerability doesn't have a big impact in this particular case.


Ipsec Native VPN on Windows 8 or 10 I have a Cisco PIX, and have been using the Cisco VPN client on windows however I would like to enable this to work with the native Windows 8/10 VPN client. It works fine with the native clients for Android (using IPsec Xauth PSK) and iOS (IPsec). However there is no place in the Windows client for me to put the Group Id.

Is this authentication method simply not supported on windows?

Is this authentication method simply not supported on windows?

Correct.  The Windows VPN client simply does not support using Group Security in an IPSec VPN.  Additionally, the Cisco IPSec VPN client is EoL, so they don't really support it anymore (preferring customers to pay for AnyConnect SSL VPN licenses).

There are some free alternatives out there, as well as a number of ways to get the old Cisco VPN client installed on Windows 10, (it installs fin on 8 and 8.1) but frankly, all the options for this type of VPN on newer versions of Windows leave a lot to be desired.


Generate wordlist using non-default rules (John The Ripper) If I want to create a wordlist, using JTR to mangle a source list by applying its default rules to them I can do this like so:

# john -rules --stdout --wordlist=/usr/share/wordlists/rockyou.txt | head
Press 'q' or Ctrl-C to abort, almost any other key for status
123456
12345
123456789
password
iloveyou
princess
1234567
rockyou
12345678
abc123

However, if I want to apply non-default rules to the wordlist, John doesn't like it:

# john --rules=Jumbo --stdout --wordlist=/usr/share/wordlists/rockyou.txt | head
Extra parameter for option: "--rules=Jumbo"

This ruleset works fine when cracking hashes:

john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt --rules=Jumbo

Why can't John apply the rules to the wordlist and output a list rather than only being able to crack using a rulesset such as Jumbo?

Or am I missing something?

I just tried it and it works fine for me.  Make sure you have a new JtR.  I'm using 1.8.0-jumbo

sample output:

./john -rules:Jumbo -w:password.lst --stdout | head
Press 'q' or Ctrl-C to abort, almost any other key for status
123456789
password


Preventing Users from Using QR Code Password and Scanner for Authentication A user was discovered using a QR code to log into a PC. Apparently, the password was put into a QR code generator and printed. The user:

Provides their username
Scans the QR code with a handheld scanner and is granted access

Our company utilizes handheld scanners for a variety of reasons so it is not feasible to use endpoint protection USB device control to block all scanners or brands of scanners. This user also uses handheld scanners for everyday work duties. We are curious of a creative way to prevent this technically. We also plan on addressing this administratively through policy. One idea was floated that if possible (through GPO):

Having a startup script to disable scanners
A log off script to disable scanners
A login script to re-enable the scanner

The handheld scanner apparently shows as a generic HID keyboard in device manager. Does anyone know of a feasible way to block this or perhaps an alternative solution to the problem (blocking the device at login)? Thank you!

This is not really a technical problem but a usability problem. If you have a password policy which requires unique and unguessable passwords and maybe regular changes then users need to find a way to somehow remember the current password. A typical way is to write this down and put under the keyboard or something like this. Using a QR code is just another incarnation of this pattern.

If you make it impossible to use a QR scanner then users will find other ways to remember the password which are likely not safer in any way. Instead you should provide ways so that users can actually both safely and easily handle authentication and don't need to work around broken password policies. Depending on your environment that might be biometric elements like fingerprint, physical elements like smartcards or tokens etc.


What is Windows Watchdog and what do we know about it? Today I came across this term "Watchdog", and something about "DPC_WATCHDOG VIOLATION" errors in Windows. I tried googling around but I only found posts on how to fix Watchdog errors, but nothing on what Watchdog really is or how it works. So, what is Watchdog exactly? Is it some kind of mitigation like DEP or CFI? Does it have some kind of security implications?

The existence of a watchdog timer (software or hardware) has no security implications.

A watchdog is a timer that is used to detect hardware or software lockups. A watchdog timer counts down and, if it ever reaches zero, it will assume the system has frozen and will take corrective action (such as by rebooting the computer). In order to prevent this from happening, a process will periodically reset the watchdog, usually once every few seconds. In the case that this process ever stops functioning (for example due to the computer locking up), the watchdog will keep ticking down until it eventually reaches zero and causes a reboot. The amount of time that must lapse varies from milliseconds to full minutes, depending on how fast the system must respond to a malfunction.

A software watchdog is designed to detect userspace (user programs) freezing or otherwise becoming unresponsive. It's only capable of working if the kernel (the core of the OS) is still functional. A hardware watchdog is usually built into the motherboard and will detect a system lock up no matter what, as a frozen or crashed computer will stop resetting it, causing it to force the system to restart.

See Watchdog timer on Wikipedia for more information.


Why is Windows auditing svchost by default? I would like to know why, by default, Windows set an audit rules on svchost.exe ?
While it's used only when auditing is active, i don't understand why there's a special treatment for this file since auditing is disabled by default anyway.

It seams that other files and folders are also audited by default (explorer.exe , \Windows\Boot, \Windows\SystemResources...).
It becomes a problem when Remote Desktop is used by many users, the log grows a lot.


Preditrend spam, how did they get my friend contact list? Today I had a malware reunion with a friend which name was used in the From field of a spam.

I don't know if I should warn her about a potential security breach on her computer. Here is the situation. The apparent emitter of the email is a fabricated email address first name . last name @ some boring domain.sg, but the other 19 recipients are people in her contact list. Has she necessary been compromised, either by having her email password stole/guessed or a local malware, OR is there a way that her contact could have been rebuilt another way (maybe using one of those contacts compromised host). How is this usually done ? This eventually leads to some sketchy binary option / trading website, localized for my country. And this also poses as a "Sent from my iPhone" email.

The question is, where do all those recipients (and you) appear together? The "compromised" site (where "compromised" may simply mean "publicly readable") is perforce among that list.

But it might be a long list. Its index is itself a list:

participants of the same mailing list
public pages where the addresses appear together
signatories to some Web petition (saw that happen)
participants in a forum/newsgroup/other
members of the same club

But if the only thing those people have in common is that they're on your friend's contact list - i.e., they don't all also know each other - then yes, the list contains only your friend's account, and chances are that it has been compromised:

online (password guessing / social engineering / brute forcing)
"offline" (malware downloaded on your friend's PC).


Process.Start() Command Injection How to exploit a program that has this line:
Process.Start(user_input + "calc.exe")

It's a .NET function and nothing has worked so far ("mal.exe &&", "mal.exe;", ...)
Any ideas?

https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.process.start?view=net-5.0 Process.Start is more akin to, in terms of POSIX functions, execvp than to system—Process.Start doesn't launch a shell (where your && tricks would work great), but rather directly invoke the given filename.
However, prepending a prefix to a filename can rewrite it to arbitrary places, because you can do something like:

../../../evilcalc.exe (user_input is ../../../evil (ascending ancestor directories from the current working directory)
C:\somewhere\evilcalc.exe (user_input is C:\somewhere\evil) (Windows absolute file path)
/somewhere/evilcalc.exe (user_input is /somewhere/evil) (Unix absolute file path)

I don't think you can run something that doesn't end in calc.exe though—your mal.exe needs to be named something else (although I do question how you got it there at all, yet can't select its name—is it a builtin OS service or already-installed application you want to inconveniently trigger?).


Is it safe to log into a virtual private server not owned by me? What are the dangers of using a virtual private server (VPS) that I do not own?

Someone on a mail list offered to let me host my website on his Linux VPS for free, and gave me non-root ssh access through ssh key.

What is the worst case scenario? What steps can I take to avoid that?

So far, I only ssh into a Heroku app, and then ssh into the VPS from Heroku with the ssh key. I only view the files on the VPS with Lynx web browser on the VPS.

Thank you.

There is always a risk when connecting to a server with any client software. Suppose that the client (ie OpenSSH or PuTTY) holds data from the server in a buffer with poor bounds checking... it might then be possible for the server to remotely execute code on the client machine.

All software has errors, so it is not impossible to think that an exploitable vulnerability exists in your client. For this reason it is wise to be very careful connecting to machines that you actively distrust.

Sever software tends to be at a greater risk since anyone can try to attack it any time. Client software is still software though, and connecting outwards provides an opportunity for the server to attack the client.

Mitigations like using ASLR and the DEP on your SSH client and always keeping the client machine up to date on software patches are probably sufficient to prevent casual attacks. Disabling privacy eroding features like agent forwarding is pretty smart. X11 is disgustingly bloated and insecure... so do not use X forwarding under any circumstance.

PS. Regarding using a disposable middle man computer to connect to the VPS: maybe try using a different SSH client on each, like PuTTY to connect the Heroku app, then OpenSSH to the VPS. What are the odds both clients have an exploitable bug that the attacker knows about?

PSS. One of the answers to this question mentions a real attack on the OpenSSH cleint: Connecting to a compromised server


What is the difference between certificates held by intermediate CAs and those issued by them? Given that one CA can issue another a certificate so that they can go on and do the same, what would stop someone from using the certificate for their website to issue certificates and become an intermediate authority?

I assume there is a difference in the certificates issued to CAs and those issued by CAs: if I am wrong, what stops someone from abusing their web certificate to incorrectly issue other certificates?

Given that one CA can issue another a certificate so that they can go on and do the same

The Basic Constraints extension can indicate that a CA cert is not allowed to issue any other CA certs, so not all CAs can create additional CAs.

  what would stop someone from using the certificate for their website to issue certificates and become an intermediate authority

The main purpose of the Basic Constraints extension is to indicate something is, or isn't, a CA (absent a Basic Constraints extension the answer is "well, it's a CA if it's self-signed"). Additionally, the issuing CA shouldn't give an end-entity certificate the KeyCertSign usage in the Key Usage extension, which is required for a CA.

RFC 3280: Basic Constraints Extension
RFC 3280: Chain building section 4

Specifically, points k, m, and n.


Spoofing IP address as being local over the Internet I know it is trivial to spoof your IP address with UDP: simply change the value of the source address in the IP header and the recipient has no idea where the packet actually came from.

My question is whether I can put a local value in this header field (e.g. 192.168.1.1 or even 127.0.0.1) and still expect the packet to arrive over the Internet. Do routers (either from your ISP, other Internet routers, or the recipient's routers) filter it out?

Any router that routes from/to WAN should filter out any packets with local addresses, but the question is whether that actually commonly happens. For example I'd also expect ISPs to filter out source addresses that aren't in a range they own (e.g. they own 1.1.1.1/24 so then packets that seemingly originate from 1.2.1.1 should never leave the network), but nobody seems to implement that.

Yes you can put an RFC1918 IP address as your IP source address.
You can even use a valid IP address within the targeted network you send your packet to.

Correctly configured router of Internet connection should block such a packet coming from the outside with an IP address from the inside. This is what is called Ingress filtering.

ISP routers don't implement Ingress filtering since they don't know in advance which IP addresses are valid inside a given network target.


Transferring Microsoft SmartScreen reputation to renewed certificate I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning:

Windows Defender SmartScreen prevented an unrecognized app from starting

The warning goes away only after the certificate builds a reputation:
Smart-Screen filter still complains, despite I signed the executable, why?

But we are signing our software (WinSCP) with DigiCert code signing certificate for years. It is a plain certificate, no Extended Validation (EV).
As our certificate is expiring soon, we have renewed it. But now, signed with the renewed certificate, our software triggers the SmartScreen warning.
Is that expected? Is the reputation really not transferred to the renewed certificate? If not, what does it take to build the reputation again? The new (beta) version of our software (signed with the renewed certificate) is out for few days already, and it has tens of thousands of installations, but it still triggers the warning. Or is there a way to help the reputation to transfer somehow?
We have tried to submit the files for malware analysis to Microsoft. Although the binaries passed the tests, it did not have visible effect on the SmartScreen check.

To complement the comment by @JozefIzso: The binary became trusted after about one month. While the further release become trusted after about 10 days only, third release did not become trusted for weeks again.

It does not look like a standard code signing certificate can be used nowadays. We gave up and went for EV certificate.


What does -Pn option mean in nmap? I am trying to do a nmap scan on a machine in  my home network. When I do the regular scan (using nmap 192.168.2.10 or nmap -sP 192.168.2.10), the results say host is down. However, when I use the option -Pn, I get the result saying host is up. What does this mean? I tried reading what the -Pn option does at nmap's website but I didn't understand it. It says that -Pn option disables host discovery. How does that affect my scan?

Don't know really how to explain it differently as I think the nmap page explains it ok, but basically...

Some hosts respond to pings if they are online (I.e. ping www.google.com and you get a reply.)

Nmap tries pinging them, if they respond nmap continues scanning and you get your result. If it gets no response it says 'hmm they must be down, well no point wasting time scanning someone who doesn't exist' and exits.

Now some hosts are alive, but configured not to answer to pings. Under normal circumstances this means nmap would simply not scan them thinking they were down. If you specify -Pn it skips this initial stage of checking if the host is up and basically says 'well I've been told to scan no matter what, so even if I think it's down* my stupid human operator is making me do it anyway'. It then tries to scan and actually gets results because in reality the host is alive.

*saying it thinks its down is slightly incorrect - if simply ignores the check in the first place.

Summary - skips checking if the host is alive which may sometimes cause a false positive and stop the scan.


LibTomCrypt weird ECC Keys I recently started working with the LibTomCrypt Library because it claimed to be a well documented C Library to get started with Elliptic Curve Cryptography.

In my first little program I created an ECC key which I afterwards tried to print out. Therefore I used ecc_make_key and the ecc_export function.

unsigned char buf[4][4096]

// I do this for the private and public Key
ecc_export(keyBufPriv[0]  /*keyBufPublic[0]*/, &x, PK_PRIVATE /* PK_PUBLIC */, &keyA)
for (int i = 0; i < x; i++) {
    printf(" %d ", keyBuf[0][i]);
}

Printing them out I wondered why the public Key and the private Key seem to be very similar. There are a some test programs delivered with the library which show the same behavior. I added some printf lines similar to those above in the test program.

output from my program :

output from testprogram :

Due to the similarity between the private and public Key I am asking myself if everything of the libtomcryp library runs as it should to make a secure ECC-Crypto.

As you can see from https://github.com/libtom/libtomcrypt/blob/develop/src/pk/ecc/ecc_export.c it's ASN.1/DER encoded data you're printing, which contains the same data besides the 'k' parameter.

So yes, it's normal that private and public key look similar.

To decode this you can install dumpasn1 which can parse and display the ASN.1 data.

If you want more information on how to use the ecc API, you can have a look at https://github.com/DCIT/perl-CryptX/blob/master/lib/CryptX_PK_ECC.xs.inc

It's not very obvious AND it's not the exact same API as not all of karel's changes are merged into main libtomcrypt (yet), but it should give you an idea.


Are compiler options relevant to C# security? If so, which options? It is normal to list some extra-secure compiler options to prevent attacks on C and C++. However, I have not found any similar recommendations for C#. Are compiler options simply not relevant to C# security? Or, are there some options which might improve the security of the executable?

Also: I could see how this might be better on Stack Overflow. Comment me if you think this is the case.

First off, C# and .NET can't do deterministic builds.  See the official response here.

Post compile you may want to obfuscate your code or encrypt it.

PDB files mean your exe can be debugged. Follow these directions to prevent PDBs from being created when in release mode.

Note that deploying in Release is different than debug, and run time debuggers may have a hard time reading it (a good thing)

Consider signing your code with Authenticode

Consider loading only strong named assemblies


Vulnerable web sockets application for training WebSockets have some potential new vulnerabilities, such as Cross-Site WebSocket Hijacking.

Is there a vulnerable app (like Damn Vulnerable Web App, HackMeBank) that demonstrates WebSocket vulnerabilities?

I think this is what you are looking for: Analysing, Testing and Fuzzing WebSocket Implementations with IronWASP. Looks like it has a nice set of tools for training and getting started with Web Socket Security. I stumbled upon this a few days ago but didn't get a chance to actually try their demo out. Just to give a summary of that blog post -- the author has added 5 new tools to IronWASP (an Open Source Advanced Web Security Testing Platform) dedicated to Web Socket testing:

  1) WebSocket Message Analyzer: An utility to analyse complex WebSocket
  implementations in a simple way. Check out this report of of our
  WebSocket Demo Application.

  2) Online Cross-Site WebSocket Hijacking Tester: An online tool to
  easily check for CSWSH issues. Check it out here. To understand more
  about Cross-Site WebSocket Hijacking check out this post on
  NotSoSecure

  3) WebSocket Client: Versatile WebSocket client that lets you send
  store and send multiple messages along with setting custom Origin and
  Cookie headers. Perfect for checking Cross-Site WebSocket Hijacking
  and other WebSocket issues.

  4) WebSocket Scripting API for Python and Ruby: To automated checks and
  write custom fuzzers for WebSocket implementations. Generic fuzzers
  don't work for asynchronous protocols like WebSockets.

  5) WebSocket Demo App: A sample vulnerable application that is built to
  use WebSockets heavily. Good test bed to test and learn WebSocket
  security testing.

Again, I haven't had a chance to try these out yet, but this one looked interesting.

Please feel free to share any other resources you guys may have in comments, answers or even by adding them to my post. It'd be nice to have a comprehensive list of resources for training purpose. Here are some other resources on Web Socket Security:

Nice intro to WebSocket and its Security
Heroku's Dev Center - WebSocket Security


Is there a way to tell, when looking at a packet, that an aircrack-ng attack happened? I'm trying to understand how to find these attacks when using a packet sniffer (specifically using Omnipeek). Is there a way to look at a packet and know that this type attack happened? I want to find various aircrack-ng attacks.

What kind of attack are you talking about? DoS attack? If yes, you should look for deauth frames on your sniffer captured data. Here there is an interesting link about how to filter on wireshark to look for deauth frames: https://packetwrangling.com/2017/11/02/weathering-a-deauth-storm-with-wireshark/

Other kind of attacks like bruteforce against your WPA/WPA2 network are not detectable because they are done offline. The attacker capture the Handshake and then try to crack it offline by bruteforce, dictionary attacks or however. So, there is no trace about this cracking attempts.


How to test the security of a hardened Web Browser? I want to actually test the security of a sandboxed and hardened web browser after I implemented 3rd party security tools that claim to harden the browser.

So how can I or what approach should I follow to test the security of a web browser?

Edit: Specifically I want to test the sandbox capabilities of the 3rd party tools I installed. Do they really prohibit a malware from spreading all across the PC? Malware attack vector would be a drive-by download from a (simulated) infected website.

If you want to test the sandbox capabilities you need something like a real exploit which will try to do something an attacker would do. But I think it is not really possible for you to get a exploit for a current browser. So you have the following options:

Test the sandbox with a custom executable by creating a executable which use the sandbox techniques and will try to execute a payload. The results could be comparable if your browser does not use sandbox techniques by itself.
Test your sandbox with an older version of your browser and a public available exploit.
Simulate an exploit attempt by introducing custom code in your browser like system("wget http://127.0.0.1/t.elf; chmod +x ./elf; ./elf"); If your browser is open source you could for example create a custom version of your browser and add the custom code in a code region where also a real vulnerability would be.


What to do after falling victim to a remote access technical support scam? A common scam involves fake technical support tricking the victim into calling them, downloading remote access software, and allowing the scammer access to their computer.
Suppose the victim recognises the attack part way through and shuts down their computer. What should they do next?
Here's what I guess should be done
Secure device

Ensure computer is not connected to the internet
Switch it on
Uninstall remote desktop software
Change user password used to log in to windows (or other OS)

Inspect the damage

Look for any new files by looking in likely locations (Desktop, Downloads, Documents etc), ordering by date created/modified, and inspecting for anything new and suspicious
Look for any files that may have been deleted (unlikely a scammer would bother with this, but best to be sure). Check the recycle bin / trash for deleted files.
Take an inventory of the files on your computer and be aware that the scammer could have copied any/all of them.
If any files contained plaintext passwords, change those passwords immediately (on all websites/apps that use the same password).
Be aware that any data stolen could be used as blackmail or identity theft.

Thing I don't know

Should the victim reinstall their operating system?
If the devise had multiple users, should other uses change their passwords or just the victim?
Could the scammer have installed software that could cause future harm, and if so, what should be done about this?
Is there anything else to be aware of?

The best way is to reset your whole pc, this is going to wipe all the things in your computer. This is the best way which you can follow even when any malware is present in your system.


Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking? Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?

For example, with OpenBSD's pf:

block in  all # default deny
block out all
pass in  on dc0 from 10.0.0.0/8 to 10.1.1.1

Can IP source routing of TCP/IP packets over dc0 be used to circumnavigate (so to speak) the firewall rules and communicate with 10.1.1.1 from a network other than 10/8?

Even if possible, is such circumnavigation a viable or plausible attack if dc0 is public-facing? If so, can this be prevented?

I don't know specifically whether it can bypass these particular firewalls, but my superficial impression is that most firewalls block source routing, specifically because of these kinds of threats.


Difference between ISO/IEC 27001 and CISSP CBK Sorry to ask this, I am quite new to Security area. Recently I am trying to introduce some security standards.

After some searching I found this out in this doc

  Among them, ISO is the best-known standard for ISMS, which helps to establish and maintain an effective information management system via a continuous improvement approach.

And this statement in this site

  One of the most in-demand IT certification is CISSP®, for Certified Information Systems Security Professionals.

I want to check the domains one by one to try my best to ensure the security management is well established based on worldwide sophisticated standards.

But as you can see, there are different domains in these standards.

Here are the domain comparisons among them I just drafted up based on ISO/IEC 27002 and CBK.

Which one should I turn to? To persuade my boss to apply?

By the way, to me the CBK is more like a examination stuff and quite unpractical.

I can see your confusion surrounding this topic.

To start off, the reason why you have the dilemma is because ISO 27001, ISO 27002 and CISSP CBK are all different from each other.

ISO 27001 is an organization-focused standard and provides requirements for your company's ISMS that can be audited.

ISO 27002 focuses on best practices on an individual level (code of practice for use by individuals within a company).

CISSP CBK is a comprehensive framework of all the relevant subjects a security professional should be familiar with (it's not a company standard you can certify your ISMS with).

That being said, if you want official recognition (certification) for your company's ISMS, then choose  ISO 27001. ISO 27002 and CISSP CBK relate to security best practices for INDIVIDUALS within the company.


What are the basic points to check during a systems audit? I work in the petroleum industry and I am 'the young geek'. As such, I am often tasked with writing VBA macros, a bit of JS for data visualization and so on.

Lately, I have been assigned the task of 'conducting systems audits'.

A few words of context:

The firm's information system (ie. 'office network') is under the responsibility of the IT division, which I am not a part of.
However, the 'industrial' systems (ie. Control Systems, Manufacturing Execution Systems, etc.) are under the responsibility of the industrial teams. A firewall separates these two worlds, managed by corporate IT. It is considered that this firewall isolates the industrial network from the office network, and a fortiori, from the Internet. Those industrial networks are the scope of the audit.
I am not by far a security expert. But it is clear for everyone (in particular my managers) that the 'security audits' are just a way to use buzzwords in newsletters, and that any serious audits would be handled by professionals.

This being said, I would like to use this as an opportunity to learn, and to have the plant's technicians learn as well.

What are the basic points I should check in a 'systems audit', that would be a good pretext to discuss about the basics of Information Security, and would allow me to catch the most obvious weaknesses?

I have on my list so far:

Checking if inputs (USB ports, floppy drives [old plants...], etc.) are disabled
Look out for admin passwords on a post-it on the screen
Check out is OSs used are still supported (I expect to see some pre-Windows XP systems), and if they are up-to-date.

What are you auditing against?  Audits are checks that systems are compliant with something.  So, first of all, I'd try to find out what requirements exist for your systems.  If those don't exist, your audit will basically consist of your deciding the standard and then determining if the systems follow your standards.  That puts you in a losing position.

If your management insists on going with your "audit", I'd ask them what you are auditing against.  Best Practice?  ISO standards?  I doubt that you have patient, corporate financial, or payment data on your industrial systems so that frees you from HIPAA, SOX, and PCI standards.  That should be your first focus: get agreement on what your auditing against.  Otherwise you're just filling out a checkbox.

Also, when completing the audit: who is responsible for remediating the variances you discover?  (Hint: it isn't you.  You're the auditor, not the system owner.)  How will management support remediating those variances?  Who will be held accountable?

This doesn't completely answer your question, but I think it's even more important than the questions you ask.


Verification methods of IDP in SAML2 IDP initiated login What are the methods we can use to verify Identity Provider in Identity Provider initiated login in SAML2 Single sign on (SAML2 SSO)? Can any one who has access to IDP private key are able to create a trusted connection to SP ?

The IDP is typically verified by a a cryptographic signature on the messages it sends to the SP. These are produced using the IPD private key. If the private key is lost anyone could predent to be the IDP.


Is it safe to expose port 22 on a database VM? I have seen many answers to this question in different scenarios but I am still unsure of the actual answer.
I have a VM in the cloud (Azure), which will be hosting my production database. Is it safe to have port 22 open for my SSH connection? it also has a public IP address, is this safe too?
This is my first time having to concern myself with these types of questions so apologies for the lack of understanding.

I have a VM in the cloud (Azure), which will be hosting my production
database. Is it safe to have port 22 open for my SSH connection?

No, it is not safe.
While I'm not sure why you'd need this in the first place, this allows for anyone on the public Internet to connect to your database. Even if you have certificate-based, multi-factor authentication in place it is still not safe. There is no need to needlessly expose your database. You should configure a bastion host (or Azure equivalent), or ideally a VPN connection to your network for management and allow port 22 between those two servers.

it also has a public IP address, is this safe too?

It's safe for some servers, but not your production database. The reasons for this are the same as exposing port 22 because the concept is the same regardless of port exposed when it's your production database you're talking about.
The overall idea here is to create a secure architecture -- the best way to do that is limiting interaction with your database. Especially direct access. See multi-tiered architecture. That's the Google Image Search for it since pictures explain it much better than text. But here's the Wiki on it.
If this is for a personal project, ask away and experiment. If you leave port 22 open to the world I guarantee you'll have people trying to break into your system in <24hrs, but you can always restore to a snapshot or tear it down and build a new VM entirely.
If this is for a true production database for a company and you are tasked with building out the architecture, you need to hire a consultant. I don't say that as an insult, but there are a thousand ways this can go wrong and it would be best to hire an expert.


Does Facebook store plain-text passwords? I was about to reset my Facebook password and got this error:

  Your new password is too similar to your current password. Please try another password.

I assumed that Facebook stores only password hashes, but if so, how can they measure passwords similarity? This should be impossible with good hashing function, right?

Question is - how is this possible and what are the implications?

Thanks in advance.

UPDATE

I didn't make it clear - I was not asked to provide old and new password. It was the "reset password" procedure, where I only provide a new password, so most of answers of suggested duplicate are not applicable.

UPDATE2

mystery solved - see comment (from Facebook engineer)

Let's hope and assume that Facebook stores only hashes of current password (and potentially previous passwords).

Here is what they can do:

user sets first password to "first" and fb stores hash("first").
later on, users resets password and is asked to provide new password "First2"
Facebook can generate bunch of passwords (similar to the new one): ["First2", "fIrst2", "firSt2", ... "first2", ... "first", ... ] and and then compare hash of each with the stored hash.

This is the only solution that comes to my mind. Any other?


Combinations of key exchange and signature algorithm in TLS Let's say that one does not trust ECC a lot, and values confidentiality over authenticity (perhaps simply for the reason that MitM is more difficult than passive eavesdropping and decryption later on). In this case one might use classical DHE for key exchanges, and ECDSA for signatures.

Is there anything problematic in doing so? In order to have high encryption strength, one would use large DH params (16k perhaps) since the classical DHE key exchange is not computationally expensive, and faster ECDSA signatures on the exchanged DHE keys. Further, this combination is not part of the TLS specification (as far as I know), why not?

EDIT:
Just to clarify, it appears this is indeed not part of the specification, but I am seeking answers as to why not, or if this would be a bad idea from a security perspective.

In order to have high encryption strength, one would use large DH params (16k perhaps) since the classical DHE key exchange is not computationally expensive,

I can't give you hard numbers for the speed. The openssl speed command does not seem to offer the benchmark for regular (finite field) Diffie-Hellman.

This answer offers guidance on practical DH-parameter sizes:

Thomas Pornin. Answer to: Is this prime number large enough / too large for a Diffie-Hellman for AES-256?

  this combination is not part of the TLS specification (as far as I know)

Correct. There is no combination of _DHE_ and _ECDSA in the current cipher suite assignments.

$ wget https://www.iana.org/assignments/tls-parameters/tls-parameters.txt
$ cat tls-parameters.txt | grep -i _ecdsa_  | awk '{print $2}' | cut -d _ -f2 | sort | uniq -c
     17 ECDH
     21 ECDHE


Why does the finance industry uses 2TDEA instead of 3TDEA? Why does the finance industry uses 2TDEA instead of 3TDEA?
Is there any historical reason or technical limitations like the support by HSMs used in the industry?
The paper referred to here says simply that the financial industry has not considered 3TDEA as it does not offer extra security.

Triple-DES, noted as 3DES from here on, uses 2 keys, chosen
independently at random, to DES encrypt a message multiple times.
There are also ways to use 3DES with 3 different keys, but these
schemes do not give a significant amount of extra security in theory
and are not considered in financial systems.

3TDEA is supposed to be very secure (I am not a cryptanalyst, but I want to be one), but why has it not been considered?
I think I am missing something big/fundamental here. Can you please help?
P.S: this is not my homework or anything.

It seems to me like they do not see a need for it. It seems as if their idea is its not needed so let's not do it. The way they see it. If you are trying to keep people from opening a box and you shoot that box into space on a rocket does it matter if it lands on Mars or Pluto? While yes it's harder to reach Pluto and takes longer nobody on mars is opening your box anyway. Once people are able to reach mars maybe then they'll start thinking about Pluto but that's a bridge they'll cross when they come to it.

IMO: Banks don't like change. Updating takes time and money. More things the bank doesn't like to use. Any changes that doesn't bring profit are usually only done when they have to be. Also I'm not sure if this is the definate reason. If I am off I'll delete the answer.


How is my microsoft account compromised? I have had my Microsoft account ever since Hotmail boomed, and I've had the same super weak six character password up until this year, but it was when one of my google accounts got compromised a few months ago that I decided to check my Microsoft account activity. I was surprised to see that it had registered activity that preceded from 2015 from countries I've never been in, so it was that moment when I made some changes.

I changed the password of every single account on every platform that I used to super lengthy ones with different kinds of character, and after reading on strong passwords, all of them focused on being especially lengthy. I also upped every security measure, adding recovery emails for my most important accounts and phone notifications to nearly all of them.

Then this morning happened. This morning I got a text and an email from Microsoft saying that someone else MAY be using my account and a link to review my activity. I was at work so I left the notification there to check it out later, but about half an hour later I got another text and email saying that my password has been compromised and a link to change my password. I didn't click it right away, I instead tried logging in to check my activity and it made me change my password and offered me to update my security info, which I did, and then I was prompted to log in again, and when I did it asked me to choose between sending a code to my recovery email or sending it through a text (like always after I upped my security).

After I logged in successfully I confirmed that there was unusual activity, as apparently an automatic sync (I don't ever use Microsoft apps, or any app for that matter, only web, even on my phone) from Russia. I refreshed the page because this activity was showing above my last activity (even though it's supposed to show chronologically) and after it was shown correctly I clicked on the arrow beside the activity to see the details again and was I again for a surprise.

The details showed activity from different dates from a small array of different countries none of which are where I live and all of them were automatic syncs. I double checked the rest of the activity and all of them were successful logins all made by me. All of these syncs were successful according to the details and the first one was from late July (last month).

Here's the data, skip if you want:

Protocol: POP3
IP: 185.31.162.106
Account alias:
Time: 3 hours ago
Approximate location: Russia
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: IMAP
IP: 84.238.84.12
Account alias:
---@hotmail.com
Time: 8/13/2017 2:22 AM
Approximate location: Denmark
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: POP3
IP: 39.54.232.237
Account alias:
---@hotmail.com
Time: 8/12/2017 11:00 AM
Approximate location: Pakistan
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: IMAP
IP: 177.142.187.49
Account alias:
---@hotmail.com
Time: 7/27/2017 12:12 AM
Approximate location: Brazil
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.

How was my account compromised? Who was at fault for this breach? Me or Microsoft? I have my phone on 24/7 and email notifications at all times, how could this happen without my notice? Am I missing something or is this a vulnerability on Microsoft's system? How can I prevent this from happening again?

Changing a password does not typically revoke existing access. I'm not familiar enough with a Microsoft account, so I'll provide a general suggestion that many modern websites use.

Twitter has a section in your profile settings that list all connected applications to your account. This can be other twitter clients, or other services that use your twitter data some way. Once connected, this access usually persists through password changes. See if MS has a similar settings page and if so, revoke every application you see and then if something breaks on your end, add that access back.

So how was your account compromised after the password change? It likely wasn't. The user has an authorization token that hasn't been revoked yet. That would be my guess.


Should I continue using this (potentially dangerous) website? As a part of my project I had to scrape some motivational pictures, so I considered using the gallery section of the website, "Quotes Cover" -  "https://quotescover.com/category/quotes-gallery". Kaspersky's green tick, the HTTPS protocol and the general look of the website made me assume it would be safe.

However, when I inspected the elements and tried to find the source of the pictures, they were all under [don't open this link] "https://quotescover.com/wp-content/uploads/". What I saw was a flickering website and a heading saying "Asalama Allaikum" (something like that). Terrified, I quickly shut it.

When I re-type that URL in the address bar, Chrome gives me a text, "_Tuan2Fay_". I type that in Google Images and I see a lot of "Your computer has been hacked" images. What's strange is that VirusTotal and Kaspersky URL checker say the site is completely safe. I have now submitted that site for a closer review to Kaspersky.

My question is, could this be that the pictures are safe but that site is some sort of a trick by the developer to scare me away from using this part of their site, or is this site actually malicious and I should not use Quotes Cover at all?

These does NOT tell the site is safe:

Kaspersky's green tick. It merely tells the site hasn't marked as a known harmful site.
HTTPS protocol, even with a trusted certificate, only tells your connection to the site is encrypted. This only means that the connection between your browser and the server is secured from 3rd parties. It has nothing to do with the content:

TLS protected sites can have vulnerabilities that can be used for modifying the contents. The site mentioned in your question is actually a good example of this.
Bad guys can buy or create free certificates for their web sites, too.

General look of the website. Most of the actually bad things happens when you don't notice. The longer you can hide, the more information you can steal.

A flickering website does NOT tell the site is malicious. It might look scary, but it's not a direct sign of anything else happening in the background. You'd have to look at the source code. This page had obfuscated JavaScript, but it was easy to deobfuscate. Most of the code was simply for creating the contents and the effects. It tries to load more JavaScript from external sources, but as they are all http:// resources on a https:// page, the browser refuses to load them.

The /wp-content/uploads/ is a standard directory for uploaded content. The site allows its users to upload own content, so probably some of such feature or other vulnerability was used to upload an index.php to that directory. The administrators of the site should be informed of such activities.


SHA-512 unix passwords. How secure are those hashes, really? I came across this very alarming sounding thread which indicates a GPU with about half the compute capacity of the GPU currently powering the monitor I type this on is capable of 11.5k c/s.

I'm not sure what a c is in this jargon. Does it stand for "crack"?

Does this mean 11.5 thousand passwords tested per second? So if my password uses 5000 round SHA-512, and is a weak enough password that comes in at #11,500 in the attacker's dictionary, I'm pwned in as little as 1.0 second?

the quote is 11.5k c/s at rounds=5000 which is the default number of rounds. I guess it's not too terribly alarming if the password is lengthy and "random" enough as it really should require extraordinary luck to hit upon it in the first several million attempts; however with a small GPU farm you can crunch through several million within a short time. It's bound to get cracked eventually.

Surely the c/s cannot stand for rounds/sec as indicated here; my 500,000 round SHA-512 $6$rounds=500000$... password gets verified by the machine within about 1 second; that amounts to 500K rounds/sec roughly.

To do a little scribbling on the back of an envelope calc.exe:

11,500 * 5000 = 57,500,000 rounds/s

This is an over 100 fold increase compared to my estimated CPU verification speed in rounds/s. I might be able to believe that my GPU can pull that off. It sure can do so with pixels.

Or does it mean on average, 11,500 user accounts can be cracked per second? Now that would be truly impressive.

I'm gonna go update my password now. The root password that I intend on distributing to my VM's through a kickstart script which necessarily happens over HTTP.

The figures you quote are about the number of tried passwords per second. Since this password hashing function is salted, attackers cannot attack more than one hashed password at a time; similarly, they won't be able to build and reuse precomputed tables ("rainbow tables"). Moreover, the function is configurable with a number of iterations ("rounds") so that you can adjust it to a trade-off between the amount of CPU you are willing to spend on each password verification, and the amount of CPU you want the attacker to spend on each cracking attempt. If you double the number of rounds, you make the job twice harder for everybody, you included.

The default number of rounds (5000) was meant to be bearable on average computers of that time; recent PC are faster and increasing that number of rounds for your machine would be a good idea.

Nevertheless, attackers can use special purpose hardware, in particular GPU, to get a boost. The boost depends on how the function is internally computed. SHA-512 consists in a lot of 64-bit arithmetic operations, and GPU are not utterly comfortable with that, so the boost obtained with a GPU (compared with generic CPU, under the same budget) is not as high as it would be with SHA-256 (which uses only 32-bit operations). However, it is expected that a GPU will be a few dozen times faster than a CPU at trying to crack passwords. Exact figures depend a lot on the CPU and the GPU used, but yeah, a 100x speedup is conceivable (I suspect you underestimate your CPU, though: it is multicore, and, furthermore, it has some inherent parallel computation abilities with SSE2 or AVX registers).

Other functions rely on more memory-access operations which make the task harder for a GPU, e.g. bcrypt and scrypt. See this answer for a lot of information on password hashing, and that one for a specific treatment of bcrypt vs PBKDF2 (for the purpose of the discussion here, PBKDF2 is quite comparable to the Unix crypt() function we are talking about).

Anyway, the correct defence is not to have a weak password. If your password is #11500 in the attacker's list, then it is very weak. A reasonable password has at least 30 bits of entropy, so on average the attacker will have to try 500 millions of them before cracking it. At 11500 per second, you have a few hours before you. With a little more memory effort, you can get more than 40 bits of entropy, and transform this "a few hours" into "several years".

See this question for discussions on password entropy. Also, remember that password hashing is a second line of defence which enters into action only when a partial breach has already occurred: in a Unix context, /etc/shadow is not supposed to be readable by non-root users, let alone external clients. So don't get too much worried about password hashing, and concentrate on not allowing SQL injection or buffer overflows.


CISSP Cert: can an IT sales pro pursue CISSP? I am a sales and product professional who has a total of 9 years experience in IT; related to selling products indirectly or directly. I started my career working as a product manager for hardware vendors like Dell and HP. But was not selling directly.

Later I joined another hardware manufacturer and there was managing sales of its products (notebooks, peripherals and desktops) by appointing distributors. Now recently I started taking interest in selling Cisco and Sonicwall firewall and Fortinet products and did Sales Certification of these products in security.
I have a four years BS in Computer Science, but I never worked as a hardcore techy. Please advice me is CISSP the right path for me, as I want to leave the "Sales Dept". I have been jobless because of it recently and already have a lot of stress.

At the same time I don't have a technical work experience nor a sound knowledge, but I can try to learn.

If I should go for CISSP, will I get a waiver of 1 year as I have 9 years sales experience and 4 years BS in CS degree also.

The CISSP is certainly useful to have.  You may have to apprentice under somebody in order to meet the experience requirements.  You can do the course and pass the exam, but make sure you are within 9 months of the experience requirement so you can get your endorsement when you meet that.

Companies, particularly start-ups, should be willing to hire security interested, but uncertified people for this kind of work.  It will come at a discount base pay wise, but if you can afford that it's a good stepping stone.

Another alternative would be to join a security-products or services company as a technical sales person or product manager and make a point of getting technically involved to bridge the experience gap.

You could also start security consulting for small businesses without certification on the side if you have time.  You can build experience there.


HTTP API request body encryption I am building a Web API for a simple game. The API is SSL-only and uses limited-time tokens for user authentication. I would like to encrypt the contents of a specific request to prevent cheating.

I understand that to do that I will need to make available some encryption keys to the client application (to which the user has full access), so the solution will not be 100% secure against reverse engineering.

Still, I feel that something is better than nothing and am wondering what the best approach would be.

I have come up with a couple of alternatives:

Hardcode a shared secret in the application source code.
Use the user's current session token in combination with some obfuscation algorithm and use the result as the encryption key.

I don't particularly like either of these so I wanted to check if there is a better way. Any ideas?

As you correctly stated, if the user has control over her device, it is not possible to stop cheating. She can monitor the GPS input, reverse-engine the code, identify encryption (if any) and send the request accordingly.

Obfuscation is questionable, it may slow down (but wont stop) the attacker. You will hurt your own debugging capabilities and clean design.

The proper design is the following: send the request in clear text for your API, but sign it. Your API should reject all requests which is signed incorrectly. Just add one more parameter field to your api, which contains the signature.

You can use your own PKI or simple hash generation (if performance is an issue). Of course, the attacker can still reverse-engine the signature algo, but let's suppose she hasn't got the skill.

Edit: I suggest you to include timestamp to the API to prevent replay attack. (Of course the timestamp should be digitally signed along with the rest of the data). This way your users can not save location URL strings and manually replay it when they are not at that area. Without timestamps they could do that regardless of the use of encryption.


Can my identity be revealed through WiFi access? Assuming I am using a WiFi connection on my Android phone, can somebody also on the network know the particular sites I visit?

I believe they will get to know my MAC ID, but will they get to know other things through my phone that could identify me?

Knowing your identity, John Doe, and your device information are two separate things. They will likely know your IP address (that was assigned you), and your device/MAC address but that doesn't necessarily translate to John Doe unless there is some other information to connect the dots.

If you are connecting to a wifi that you had to sign up for (and say, accept a Terms of Service), then there will likely be a log in their system of who you said you were when you signed up and will tie that back to the IP address that was assigned your device when you connected.

That's not to say that there aren't ways of correlating & collecting more info that would aid in determining identity but we don't know enough about the network in question to say.


PHP filter_input() not protecting from eval() I was updating some PHP code following the advice of not using $_GET and $_POST anymore but instead to switch to the safer filter_input() functions.

I was thinking that function would save me in this stupid case:

<?php

eval($_GET["var"]);

?>

which when called as localhost/test.php?var=phpinfo(); spits the whole PHP info page. So I changed it to:

<?php

eval(filter_input(INPUT_GET, "var", FILTER_SANITIZE_STRING));

?>

However it seems that the above is still vulnerable to the same attack.
Which should be the correct way of securing the eval() in the case above?

Which should be the correct way of securing the eval() in the case above?

There is no way to secure input to eval. Just don't use eval on any user-generated data.


Can Emule MD4 hashes and file sizes be faked? Please excuse me if I don't use proper terminology, I'm a lawyer and trying to get more information about something my son has pointed out to me.

In Germany, law enforcement agencies use enhanced versions of Emule to search for kiddyporn uploaders. Basically, they're looking for the IPs of people offering files having file sizes and hashes that correspond to known illegal movies, and if they find those, they have the provider match the IP address to the customer to conduct house searches etc. They say the probability of a different file having the same hash is very much lower than the probability of two fingerprints being identical, so it's unnecessary to download the whole file and check if it is indeed the correct one.

(Please note that this alone isn't sufficient for a conviction if the house search results in nothing, but the search, seizure of computers and other hardware etc. along with the psychological pressure is still not something you'd want to experience.)

When I discussed this with my son to understand the details, he told me this line of thought was flawed. He said that Emule uses MD4 hashes, which are considered insecure. So, to stay in the fingerprint analogy, just like you can craft a latex glove having the fingerprints you want/need, you could easily take a harmless file (think cute cat picture), inflate its size in a way that the additional bytes cause it to have a specific MD4 hash, give it to the neighbor you hate, and if the neighbor shares that file on Emule, he'd be in for a very nasty surprise.

Googling for "MD4 insecure" yields a lot of answers which I honestly don't understand, that's why I'm asking here.

Is it possible at all to create a fake file in the way described above?
Are there tools out there that would allow a non-technical person to create such a file without much effort?
If there are no such tools, how long would it take a dedicated, skilled person to create one?
Are there any records that this has, ever, been attempted, successfully or unsuccessfully?

There are different levels of insecurity in hashes.

The first is a collision attack where you can create two different files that result in the same hash. In order to use this in the attack you describe, the attacker would need to create two files which share the same hash: one which contains the illegal content and another which contains harmless content. The attacker could then somehow distribute the file with the illegal content in the hope that it will be tracked by law enforcement and then distribute the innocent file to the neighbor in the hope that he shares it and then get blamed by law enforcement.

Creating a collision for MD4 can be done very fast according to Wikipedia.

The other and harder attack is a pre-image attack. In this case, the attacker only knows the hash (or maybe has a file with the hash) and then tries to create a new file which results in the same hash. This is much harder than creating a collision (where the resulting hash value does not matter, it only needs to be the same for both inputs) but it is still feasible with MD4 as shown already in 2008. But the computation power needed for this is not trivial and an attack shown in 2010 has a complexity of about 295 which is not in reach of the average attacker.

Apart from that the attacker is further limited since the MD4 is for a fixed-size chunk of the file so the attacker must stay within this limit when creating the attack.

Because of this, I don't think that a preimage attack can be used to blame an innocent neighbor since it is too costly for the attacker to execute. But it is probably doable in theory. A hash collision attack is more likely but in this case, the attacker needs to "seed" law enforcement with some specifically prepared illegal content first.


Getting Loads of Emails 'linking' my account to Gmail accounts I know nothing about I have just come out of hospital and have in the region of 30 e-mails from gmail over the past few days 'linking' a gmail account to my (hotmail) email address.  I have not done this once never mind 30 times!

the supposed gmail accounts are made up of random letters and numbers eg vvcxzzx.comvcxzdfgh.com@gmail.com

How do I stop this?  Surely someone like google should not be allowing this to happen?

Thanks in advance for any advice :)

You can create a random gmail address and then link it to an existing email address for password recovery. You can fill in any address there I believe, and you don't have to be logged into that address, which is not relevant anyway if it's not a gmail address.

So I don't know how you can stop this, but you can contact Google and ask them if they can stop it.


Is it feasible/possible to have encrypted data that looks unencrypted/innocuous? i.e., could I send "Let's rob the store at 9 tonight" so that it is impossible to see what I'm saying, but it doesn't look like gibberish and obviously encrypted?

I would guess what you want is actually steganography.

The drawbacks of this approach includes:

Some kind of shared secrete is needed between the sender and the receiver;
The "encrypted data" will be much bigger than the secret message itself.


How to backup database to comply with UK data protection act? Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server.

Is there a cost effective solution that would allow them to comply with UK Data Protection Act?

Currently I think about encrypted version stored at Dropbox.

Dropbox is compliant with the Data Protection Act, the main worry is point 8 of the Act:

  Personal data shall not be transferred to a country or territory
  outside the European Economic Area unless that country or territory
  ensures an adequate level of protection for the rights and freedoms of
  data subjects in relation to the processing of personal data.

If a company is outside the EU and in the USA then there is a 'Safe Harbor' list maintained of companies that fulfil the the level of protection clause.

Here's a blog post from Dropbox saying they are now Safe Harbor certified and a link to the Safe Harbor site so you can check for yourself, might also be worth checking for other companies you're considering.

Dropbox Blog: http://blog.dropbox.com/?p=972

Safe Harbor List: http://safeharbor.export.gov/list.aspx


Can morse code be called steganography? Steganography means "hidden writing", where we send messages in hidden ways. Does this mean that something only experts can understand is called steganography?

No. For it to be steganography, the message must be hidden in something (an image, a file, etc). When someone looks at that something, they should not be able to suspect that it contains a hidden message.

This isn't the case for morse code at all. There is no carrier that hides a message, there is just the message itself.


Can a WiFi access point operator tell that I'm streaming video to my phone? I work at an office typing numbers into a computer. It gets quite boring sometimes, so I go on Netflix while using their WiFi on my phone.

Can they tell what apps I'm using, based on network traffic?

Short answer is yes.  If there is any logging on their WiFi router they might not be able to see exact apps, but they'll be able to see the server domain/hostnames that you're connecting to.

You can also look at these question and answers:

Is there a way for my ISP or LAN admin to learn my Gmail address?
Can an employer see cellular network traffic routed through company-owned device?

Long Answer

Secure WiFi only encrypts traffic up to the Access Point.  It's decrypted, and the traffic can be monitored.  If it's an enterprise router it's more than capable of logging specific types of traffic.  If your work has a firewall in their network then it's even more likely that your employer has the capability to monitor traffic.  These do have to be configured, and your employer has to care, but it's very possible.

Domain Name Server (DNS) requests contain the domain hostname that you're trying to reach, and these requests are sent before an SSL/TLS channel can be established and secure.

Source

If you're using SSL/TLS it's possible to see the hostname of the server that you're connecting to in two ways.  First is the server's certificate.  The common name generally needs to match the domain name that you're browsing to.

Can they link this back to you?  This really depends on a lot of factors.  If they're really adamant they'll be able to track down the MAC address of your device, IMEI, and other mobile phone identifiers.  This is a lot of work, and in the end still might not link you to the traffic.

In all honesty, if they care it's just easier to block the traffic than it is to try and track you down.


Debugging and DLL-Injection Hi,
I am currently reading Gray Hat Python to learn about Debugging and various interesting techniques for binary analysis.

So far I have learned an amazing amount of stuff (just read about DLL-Injection).
Two questions though:

When two processes are running with the same  (non-administrative) user:

Can process A simply do kernel32.OpenProcess, kernel32.WriteMemory on process B or is that only possible for a process A that runs with higher priviliges as B (i.e my debugger running as admin).
Why would you ever allow something like kernel32.CreateRemoteThread?

From the MSDN documentation for OpenProcess

  dwDesiredAccess [in]

The access to the process object. This access right is checked against
the security descriptor for the process. This parameter can be
one or more of the process access rights.

If the caller has enabled the SeDebugPrivilege privilege, the
requested access is granted regardless of the contents of the security
descriptor.

And then if you look at the process access rights documentation you'll see that one of the access rights you can request is PROCESS_VM_WRITE which is needed to call WriteProcessMemory.

Again from the MSDN documentation for CreateRemoteThread

  A common use of this function is to inject a thread into a process
  that is being debugged to issue a break. However, this use is not
  recommended, because the extra thread is confusing to the person
  debugging the application and there are several side effects to using
  this technique:

It converts single-threaded applications into multithreaded applications.
It changes the timing and memory layout of the process.
It results in a call to the entry point of each DLL in the process.

  Another common use of this function is to inject a thread into a
  process to query heap or other process information. This can cause the
  same side effects mentioned in the previous paragraph. Also, the
  application can deadlock if the thread attempts to obtain ownership of
  locks that another thread is using.

Even though the documentation recommends against it.  I've most often seen CreateRemoteThread used in debuggers or other types of profiling/api logging applications.


What reliable methods are available for tracing the source of an ARP poisoning attack? If an attacker on the network attempts to use ARP poisoning (spoofing) in order to redirect traffic to his own machine, what mechanisms and techniques are available for tracking the spoofed ARP messages to their source?

Are these techniques effective even when the attacking machine is using a spoofed MAC address (a likely scenario)?

According to my research on the subject, and running tests there are no quick fixes for tracking the source individual perpetrating this type of attack because of the nature of it. Meaning tracking, but not filtering/blocking. The attack method itself is basically easy to do compared to the scale of other types of attacks out there due to fundamental flaws in network hardware. There are however methods of blocking or tracking (in part) and ways to narrow down the search for an attacker.

One such tool called arpwatch (http://www.securityfocus.com/tools/142) that scans for changes in IP and MAC address then delivers an alert when found. There is a SUSE article on using the tool here: https://www.suse.com/communities/conversations/detecting-arp-poisoning-attacks/

The check into DHCP Snooping and DAI (Dynamic ARP Inspection): http://packetlife.net/blog/2010/aug/18/dhcp-snooping-and-dynamic-arp-inspection/

http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0_4_s_v_1_3/security/configuration/guide/n1000v_security/n1000v_security_12dhcpsnoop.html

Izam is right, it is much easier to detect ARP poisoning than it is to target the attacker. The methods used most often find it when it occurs, or are focused on prevention. Wireshark describes a method of finding a starting point 'for investigation': http://searchsecurity.techtarget.com/video/How-to-use-Wireshark-to-detect-and-prevent-ARP-spoofing

ArpPoisoning.com offers a couple of scripts you run when you log into a server you have concern may be a target. http://www.arppoisoning.com/best-practices-for-defending-against-arp-poisoning-2/ One for linux: https://github.com/alan-reed/ARP-Defense and one for Windows based machines: https://github.com/alan-reed/ARP-Defense/blob/master/defendAPR.bat

The 2 scripts attempt to track the ARP table and compare it live as you are connected, and attempt to repair the ARP table as it is happening.

Another step would be to attempt triangulation (or trilateration) to target the attacker's physical location between multiple access points.

If you have multiple access points, then you have the opportunity when you find the one that is getting the highest level of ARP request traffic, and then by checking the signal strength pinpoint the location of an originating machine.

A security application by Aruba Networks uses triangulation to attempt to locate problems on the network as 'interference sources'. Interestingly enough, they have the same trick in reverse, using ARP poisoning as a defensive weapon: if an 'interference source' is detected it attempts to poison the ARP of the port of the switch used by it and kill its access to the network (page 19 here): http://www.arubanetworks.com/pdf/technology/TB_ProtectTheAir.pdf

Granted I do not have access to a network protected by this automated and multifaceted defensive structure but I would be interested to see how well and how quickly it takes out threats like ARP attacks. Being that it defends against specific points as they are compromised, an assertion could be made that it would give a good general direction in the real environment to look for a physical attacker.

For small networks, it would be better to filter out bad ARP requests and set fixed IP & MAC connections where possible. Then it is much easier to track with fewer connections.


Is there such a thing as a modern cable modem without an onboard operating system? Is there such a thing as a modern cable modem without an onboard operating system? I’m looking for examples of specific models, in particular.

Every modem I’ve looked at has a Web interface (e.g., the Arris SB6141 and the Netgear CM1000), which suggests to me that they all have an onboard Linux operating system installed that can be hacked and reconfigured to maliciously route traffic like a router.

(I imagine that all modems are going to involve some kind of firmware, but I also imagine that it doesn’t need to be a whole operating system.)

I think you have some X/Y conflicts in your reasoning behind the question.

Modems do not need an operating system. What you are calling a modem (with a web interface) is far more than a modem, which requires an "operating system".
The operating system you are supposing is not a "whole operating system" but an embedded form of an operating system (likely with a custom kernel) to supply the necessary functions.
The operating system is not "hacked" in your threat scenario, but rather the externally-facing services are.

So, with these reframing points in mind: There have been many different cable modems without the extra features like the ones you listed. The problem is that they only allow a single device to connect to it, so they have not been a popular product since adding a hub, WiFi, and NAT functionality have become the norm.

That last point is the practical one. If you were able to find a dumb cable modem, you would need to attach a multi-function WiFi access point, router, hub, and a means to manage these features. So, what do you do? You chain the modem (basically a layer 1/2 device) to the router (layers 2+). Now you have exactly the same threats as you did before, but you now need to buy an extra device for the privilege.

Want to limit your risk with your existing modem? Turn off all services to the Internet, put in a very long admin password, and turn on the highest security for the Wifi.


Diffie–Hellman key exchange in TLS 1.3 I am reading about the Diffie–Hellman key exchange in TLS 1.3. So the first step here is that the two parts  Alice and Bob t agree on a large prime p and a nonzero integer g modulo p. Then Alice and Bob make the values of p and g public knowledge.
How the values p and g get public as we are before the client and server hello messages?
Also, the private and public keys that get generated here are the same keys that the server or/and the client use in order to acquire a cc.509 certificate (via a certificate signing request to a trusted certificate authority)?

For TLS 1.3, you are limited to a few pre-selected named groups (RFC 7919) and you include the identifier of the group with your key share. See sections of the RFC.
In previous versions of the protocol like TLS 1.2, the server sent the p and g together with the key share in ServerKeyExchange, again see the RFC. The server had to pick some values, either from Oakley group RFCs (RFC 3526) or a random value the server generated in advance using something like openssl dhparam 2048.
To the second part of your question, absolutely not and they have nothing to do with each other. The key exchange part performed by DHE or ECDHE and the authentication part performed by RSA or ECDSA (or theoretically EdDSA) do not share keys. Note how they often use different cryptographic primitives in the same handshake (most popular on the internet now is ECDHE with RSA certificates)!
The fact that the a and b in DH are called "private keys" and g^a mod p is called a "public key" is true, but a little confusing in the context of TLS. These are ephemeral, meaning single use, short term keys. They are the opposite of long term "identity" keys that you would use for authentication.
When you as a client connect to a server, the server has just created a new DHE key when you connected to it. Nobody has ever seen this key before, and when the handshake is over, it will be deleted. How would you use it for authentication? Who will you ask to confirm it?
Static-DH certificates used to exist (at least in theory) a long time ago. They don't exist anymore and are not allowed. They used long term DH keys for authentication and included the public key share in the certificate, but the certificate was signed by the CA using RSA. The key exchange performed ephemeral-static DH to confirm the server. This did not provide PFS and died out in favor of RSA key exchange (which also did not provide PFS) and then ECDHE+aRSA, which finally provided PFS.
Outside the context of TLS, protocols like those based on the Noise Protocol Framework, like WireGuard, use long term ECDH keys for authentication, together with different ephemeral ECDH keys used for key exchange, thus reusing code (less code to review). TLS doesn't do that because you need to confirm the validity of the certificate chain, and for that you need offline signature validation, which you can't do with Noise (as far as I understand, please someone correct me if I'm wrong).


Does SSH support DSA with 2048 bit keys? In FIPS 186-1 and 186-2 L could be any number between 512 and 1024 (inclusive) that was a multiple of 64. N was fixed at 160.

FIPS 186-3 changed it so that L and N could be any combination of the following:

L = 1024, N = 160
L = 2048, N = 224
L = 2048, N = 256
L = 3072, N = 256

RFC 4253 (SSH Transport Layer Protocol) says the following:

   The resulting signature is encoded as follows:

      string    "ssh-dss"
      string    dss_signature_blob

   The value for 'dss_signature_blob' is encoded as a string containing
   r, followed by s (which are 160-bit integers, without lengths or
   padding, unsigned, and in network byte order).

So I take it this means SSH does not support 2048-bit DSA? Are there no RFCs that add support for them? No vendor extensions?

For the hash: Crossdupe https://crypto.stackexchange.com/questions/15051/why-does-openssh-use-only-sha1-for-signing-and-verifying-of-digital-signatures and https://crypto.stackexchange.com/questions/39983/which-hash-function-is-used-for-signatures-ssh-rsa-and-ssh-dss
but probably better here.

A recent answer there links to https://www.openssh.com/txt/release-7.2 (of 2016-02-28) which refers to now-expired https://tools.ietf.org/html/draft-rsa-dsa-sha2-256-03 which despite the name only upgrades RSA to SHA2, with section 6 explaining that DSA was dropped, as does its still-draft replacement https://tools.ietf.org/html/draft-ietf-curdle-rsa-sha2-02 .

You can easily confirm no other RFC has changed this in the IANA registry for SSH.

And OpenSSH since 7.0 has deprecated and disabled by default (all) DSA. There were numerous Qs here and related stacks late last year about this e.g.:
Why OpenSSH deprecated DSA keys
https://unix.stackexchange.com/questions/247612/ssh-keeps-skipping-my-pubkey
https://superuser.com/questions/962918/pubkeyacceptedkeytypes-and-ssh-dsa-key-type
So they aren't likely to implement improvements to DSA, and anyone else who pushes something incompatible with OpenSSH usually finds it unused.

"Sorry, Charlie."

FWIW although FIPS 186-3 up encourages you to use a hash matching the DSA subgroup size (i.e. N) it doesn't actually require it. OpenSSH ssh-keygen won't generate a DSA key bigger than 1024, but if you generate such a key by other means (such as OpenSSL 1.0.0 up as of 2010, or Java 8 up as of 2014) OpenSSH ssh and sshd will use it (in 7.0 up once you undo the default disabling). But they use it with SHA1 as per the RFC, which basically discards the security benefit the new 186-3 sizes are intended to provide. (Accept no substitutes. OpenSSL 0.9.8 could generate a DSA key with then-nonstandard N=2048 or 3072 -- but still L=160.)


Is it bad to trust PHP's $_SERVER information? I want to know if is bad to trust the PHP's global variable $_SERVER values.
I have a scenario that I change between developer and production site, and I have a config.php file. On this file, I check $_SERVER['SERVER_NAME'] value, to determine which group of constants I should use. If I'm on production environment I use a list A of constants, if I'm on developer environment I use another list of constants.
Does this make my PHP project vulnerable in any way?

A: yes... from the perspective of the trailing question, "Does this make my PHP project vulnerable in any way?"
I'll assume that in the config file you have salt/pepper, database credentials, and other parameters that you might find in an ownCloud or Wordpress config.php file, the sort of which would hold value for an adversary.
If your config.php is exposed in your lower environment, you are making production-environment configuration parameters available in this file. Just about anything can happen in a dev environment, where as hopefully your production environment is a little more locked down. The potential for exposure is greater by having all the configuration parameters in the one file.
And for the rigid interpretation of your question...
A: no
Your config.php file would not in any way be less safe if you had an if/else or other branching conditional and the logic was correct. The potential for the contents of this file to be exposed under normal php and web server operation is no different than if you had separate files per environment. With respect to safe, see the other answer that @mti2935 linked to (in a comments against this question) that discusses the safety of the variables in the $_SERVER dict, ie. which parameters can be influenced by the user.
Another observation - with a branching conditional, you're relying on correct implementation of the web server and php interpreter to prevent the user influencing the contents of the $_SERVER dict. I don't have time at the moment to find an example, but there's a large number of vulnerability records to wade through: https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=%24_SERVER&queryType=phrase&search_type=last3years


Correct way of encrypting user passwords I have a scenario where user entered passwords need to be stored for later use. I cannot use hashing because I need to get the original password for later use.

For example, consider an email sender app where a user would initially enter a password for his email account and the application would store it in encrypted form and when the application needs to send an email it would decrypt the password and use it to send the mail.

Now, here is what I am doing:

The application stores a master key (generated using RNGCryptoServiceProvider) in the database
Both the Key and IV for AES are derived from the master key using Rfc2898DeriveBytes (password=masterkey and salt=user_id for Rfc2898DeriveBytes)

// the initial, one time masterkey generation, which will be used for all passwords
byte[] masterKeyBytes = new byte[32];
new RNGCryptoServiceProvider().GetBytes(masterKeyBytes);
// masterkey is saved in database
string masterKey = Convert.ToBase64String(masterKeyBytes);

// password encryption of a user's password
var derivative = new Rfc2898DeriveBytes(masterKey, 128_bit_guid_of_user_id, numberOfIterations)
var aes = new AesCryptoServiceProvider();
aes.Key = derivative.GetBytes(32);
aes.IV = derivative.GetBytes(16);
var encryptor = aes.CreateEncryptor(aes.Key, aes.IV);
// get the encrypted password from encryptor
.....
.....

Am I doing this the right way? Are there any corrections to be made?
Also, are the sizes being used (for key size, masterkeysize, etc.) good enough?

Few more questions(just for the sake of knowing more):

Is deriving keys(seperate AES key for each user) from a high entropy master key considered not worthy(or worse)? (i.e using just the master key as AES key is more than enough). If so, why?, my argument is - should someone deduce the AES key for a particular user, he/she will still not be able to deduce the master key, so other users are safe. I came across - 'Key Diversification' which is used in some smart card apps where they derive a seperate AES key from a master key for each instance(does the same not apply here?)
Can we just use PBKDF to derive keys in this scenario, or should we use a KBKDF? if so, could you mention a library(preferably from .NET framework) that offers KBKDF? I know that RfcDerivativeBytes uses a PBKDF to derive a key, but i couldnt find out how to derive a key using KBKDF.

When you encrypt passwords, it is because you fear eavesdropping; you envision an attacker who could get a look at your database contents. Encryption is the right tool for that, but if you put the encryption key in the same database, then you just did the equivalent of hiding your door key under the doormat. An attacker who can get a glimpse at the database may usually also obtain the key that way. Usually, when database contents leak, it is through a method that impacts the complete database (most successful SQL injection attacks allow arbitrary data extraction; the same applies, naturally, to lost/purloined database backups). Thus, it would make more sense to store the master key in a place distinct from the database, to limit the risk of exposure of both the key and the encrypted password.

Since you are apparently using C# and .NET, I infer a Windows system, and thus you may want to use DPAPI, through the ProtectedData class.

Deriving the actual encryption key and the IV from the same master key, combined with an instance-specific value, is a good thing, provided that you use a proper Key Derivation Function. However, the extra "randomization" value you use is a user-specific identifier; this means that if you change the encrypted data for a given user (say, the user changes his password), then both the old and the new passwords will be encrypted with the same key and the same IV. For most encryption systems, IV reuse is a sin.

Instead, you should use a random value that you regenerates whenever you encrypt a new piece of data, and store along with the encrypted value. There can be several methods for that; the simplest is to use the "master key" as the actual encryption key for AES, and generate a random IV every time you want to encrypt something; the encrypted result will then be the concatenation of the IV and the encrypted data, in that order.

Remember that the IV is not meant to be a secret; otherwise, we would call it a key. Thus it is not a problem if it is made available to attackers. However, each encryption system has its own requirements about the IV; in particular, a block cipher (such as AES) in CBC mode needs the IV to be randomly generated with a strong random source (AesCryptoServiceProvider defaults to CBC). Therefore, generate the IV with a RNGCryptoServiceProvider instance.

Speaking of the KDF, you use Rfc2898DeriveBytes, which is overkill. That class implements PBKDF2, which is a password-based KDF. "Passwords" are special because they are compatible with human brains, and this implies an inherent weakness. Brute force attacks work against passwords (we then call them "dictionary attacks"). To improve the resistance, password-based KDF are made slow with many repeated iterations. Unfortunately, this also makes the KDF expensive to use.

Since your master secret is not a password, but an appropriately long and random key generated with a strong source of randomness, then it is not vulnerable to brute forces. The cost of PBKDF2 is thus a waste of CPU cycles. If you still want to use PBKDF2 to derive encryption keys and/or IV, you should set the number of iterations to 1. Alternatively, as explained above, don't use a KDF at all: encrypt the data with the master key "as is", but with an instance-specific random IV that you store along the encryption result.

AesCryptoServiceProvider relies on the underlying native code implementation. RijndaelManaged is written in "pure .NET". For encrypting short elements, RijndaelManaged may actually be more efficient; it will also lower the risk of handle leakage if you forget to call the Dispose() method where necessary. Usually, performance doesn't actually matter (the encryption and decryption time will be negligible with regards to the rest of what your server does), but if it does in your case, then remember that you have several options for the implementation.

A 32-byte (256 bits) key for AES is a bit overkill, but it won't harm much. A 256-bit key implies a +40% CPU cost for encryption and decryption, compared with a 128-bit key, but for encrypted small elements it should be negligible.


HTTP Basic Authentication - password missing I am trying to retrieve a username and password send over the network. I was able to capture the following using Wireshark:

GET /rcp_tunnel HTTP/1.0
Host: ***.***.***.***
Authorization: Basic dXNlcjo=

.......0...............%...0............4cd465f6567a1ff0....^...1...........J.....8....
.
.
F   .+user:4cd465f6567a1ff0:243a7d22820e68e7ff51588b1df80dd1+.......1...................&...1......................
.
.
F   ........0...................1.......................0.................
    .0................  ..0................
F.0...............(
..0...................................(

Looking at the header, it looks like Basic Authentication is used, however, when decoding dXNlcjo= from base64 to ascii I only get the username and colons, user:.

I am unsure about the remaining data that was send. It looks like that,

+user:4cd465f6567a1ff0:243a7d22820e68e7ff51588b1df80dd1+

could be a combination of username and the password.

I have tried to find an explanation, however, without success. Has anyone seen this authentication process before and could tell me how username and passwords are send?

The request you captured indicates that the username user with an empty password was used for HTTP authentication.

As you stated correctly, the Basic authentication scheme works by base64-encoding <username>:<password> in the Authorization header. So the rest of your capture likely doesn't belong to the HTTP request or the authentication protocol. In general, GET requests are very uncommon to contain a message body - which had to be signaled by a Content-Length or Transfer-Encoding header in the first place.

That said, it is hard to draw conclusions from the rest of your dump because all bytes without an ASCII representation are displayed as dots. A hexdump might be more informative.


Where precisely are client X509 certificates stored? Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter where I search.

Please indulge me in the following scenario so that there is no ambiguity to what I mean by "client."

Suppose company A has an application on its intranet. This app is hosted on a web server, which its ten employees access from their work stations. Company B has a web service that company A would like to consume. Company B's service, however, requires both server and client certificates. Therefore company A will need to present a client X509 certificate when when making the TLS connection.

So an employee at company A thus accesses company B's service by making a request from their personal client to company A's server, which then makes a request to company B's service.

Here's the confusion: Once A's server makes the request to B's service, A's server is now a client from the point of view of B. So the question is, where does company A store its client certificate to use B's service? On A's server, or is there a copy on each individual client workstation at A? If the former, is it stored on A's web server or domain controller? If the latter, does each individual workstation download a copy from A's server?

I've seen a bit of X509 used in back end code to make a call to a REST service out on the internet, so I'm assuming the answer is "Company A stores its client certificate on its server." Maybe that's obvious to most people, but as someone new to networking I feel it's a valid question to ask given the inherent ambiguity in functional terms like "client" and "server."

Also, company A may have server certificates it uses to authenticate clients from some company C. Are A's server certificates stored in the same place it stores its client certificates. Can they be the same certificate?

Thanks for any clarification.

You have to distinguish the certificate from the private key of the certificate. The certificate itself can be distributed anywhere. The certificate is akin to saying "This is who I am" and the private key is used to prove it.

To demonstrate this, look at the address bar of your browser. You will see the certificate for this website, and it'll state that it is issued to *.stackexchange.com. You can save this certificate, send it to friends and have it tattooed on your back (if you want that).

However, the certificate alone isn't enough to prove any identity. What proves the identity is possession of the private key, which is mathematically associated with the certificate. As you see in our example, you (probably) don't possess the private key to the certificate. Only the administrators of the Stack Exchange network do.

Likewise in your example, the employee at Alice Corp. possesses the private key. In order for the Server of Alice Corp. to make sure that the employee is who they claim to be, the employee has to prove that they are in possession of the private key. The simplest way to do it is to create something that only someone in possession of the private key could, like a message signed with the private key1. To make sure that the message is actually from the employee and not copied from someone else who actually possesses the private key, the server can pick a random message and ask it to be signed. If this is done, the server can be reasonably sure that the employee actually possesses the private key.

So how does it work then when the employee connects to the Server at Alice Corp., which then connects to the server at Bob Industries? A simple way would be for the server at Alice Corp. to act as a proxy. The Server at Bob Industries picks a random number and asks the server at Alice Corp. to sign it. The Alice Corp. Server then asks the employee to sign it, which they do. The signed number is then sent to the Server at Alice Corp., which then replies to the Server of Bob Industries. The private key never leaves the computer of the employee.

1 Of course, the actual details are different. This serves as an illustration, rather than as a technical document.


What is the difference between artifact and evidence I am reading about the incident response. I cannot able to understand exactly the terms artifact and evidence. When i searched in google so many resources are using these terms generally. How can i find out standard definitions for these two terms? and what is the difference between them?

Artifact: A piece of data that may or may not be relevant to the investigation / response. Examples include registry keys, files, time stamps, and event logs.  You can see many defined in the ForensicArtifacts project on github.

Evidence: A piece of data (artifact) that is relevant to your investigation because it supports or refutes a hypothesis.

With our incident response software, we talk about collecting artifacts from remote hosts and analyzing them to determine if they are evidence.


If I'm using a SSL proxy, can the owner of that server decrypt and read my packets when I'm connected to a HTTPS website? (Password and etc) So basically can they use some sort of man in the middle attack and decrypt and read my packets?

I use their own app to use their SSL proxy and i tried scanning it with Kaspersky and it found no malware, so am i fine? do i need to worry?

basically what I'm asking is can they even do any sort of man in the middle attack and decrypt my packets even when chrome says the https connection is secure?

and if they can, will my Kaspersky notice it and stop it? because i heard kaspersky does some tricky stuff with the https certificates (I'm using internet security version)

Usually an Anti-Virus Software will create and install a Root CA certificate at your computer, which is capable of creating arbitrary certificates. These will be considered "trusted" by your computer, as the CA which signed them is trusted (the Anti-Virus CA).

At the time of you requesting a website, this will usually happen.

You request google.com
Your AV software will proxy the request
Your AV establishes the connection and validates the original google.com certificate
Your AV gives a forged certificate (which is signed by said Root CA) to your browser
Browser consideres is "trusted" as the root CA is trusted
Your AV has the key(s) to the Root CA and its certificated so it can read and re-encrypt all traffic

Otherwise, your AV software would have to somehow manipulate your system in an even worse way, as it is not capable of decrypting the HTTPS content (only the browser can (and anybody ripping the keys from its RAM)). Chrome recently implemented measures against AV software manipulating its code, as AV software is known to implement their own little bugs while trying to protect you (it's software nonetheless and therefore has bugs and attack surface).

Is AV Software capable of spying at you? Absolutely. It runs as a very privileged process as thus can manipulate a lot of things.

Will it protect you? If it detected the malicious content, yes. However, AV software can fail at detecting attacks, especially new ones, so don't rely on it alone as safety measure.