Access from external network safely to raspberry I am implementing a home alarm system with raspberry and I need to access it from the external network. The initial idea was to use cascade VPN and ssh (in my university to connect to the cluster I had to first connect to the University network and then use ssh). But if via VPN I connect to the raspberry address then I cannot give commands via ssh because I'm in 'local', no? ... So I should either use ssh more fail2ban or use VPN. But could I be calm with one of these two methods? Can I use ACL somewhere? It would not be nice if someone could open the gate or access the cameras...

I will assume you mentioned a university as a point of the environment and are not considering censorship. But an OpenSSH server will work well here. While not advisable I assume you will use the root user, do ensure a respectable password is used, this goes for any user allowed for SSH login. If concerns that password authentication (interactive-keyboard) is not for you, look at public key authentication, using ED25519 521-bits or RSA 4096-bits.

Regarding /etc/ssh/sshd_config harden the following:

  Port 30000
  LogLevel VERBOSE
  LoginGraceTime 120
  PermitRootLogin yes
  PermitEmptyPasswords no
  # Ideal session timeout
  ClientAliveInterval 600
  ClientAliveCountMax 0
  # Enhanced Authentication
  KexAlgorithms diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp521
  Ciphers aes256-ctr,aes128-ctr
  MACs hmac-sha2-512,hmac-sha2-256
  AllowUsers root

I make a point to mention, CTR is preferred over CBC for OpenSSH exclusive, see: 'Plaintext Recovery Attacks Against SSH'. The port used for the SSH is your choice if exposed to the Internet use a non-standard port, because of botnets.

Fail2Ban is a viable choice for brute force protection. Consider the following configuration:

[ssh]
enabled = true
filter = sshd
port    = 3000
bantime = 600
findtime = 120
maxretry = 5
logpath = /var/log/auth.log

Of course adjust based on your needs, as I long bantimes can be a problem if you accidentally lock yourself out. Furthermore, I would advise keeping Fail2Ban enabled if public key authentication is enabled. As it will reduce traffic in the event of a botnet brute force, and hence CPU consumption.

Test your configuration with $ hydra -l root -P /root/rockyou.txt 192.168.1.100 -t 4 ssh where rockyou.txt is a wordlist. This is to ensure brute force protection is working properly. You can generate a wordlist with john or crunch or download one. Also, using nmap ensure the only open ports are those you desire to be exposed to your network interface.

While I won't expand on it, OpenVPN is another viable option, but I only consider this over SSH when I need censorship circumvention.


Can I store secrets in localStorage? Will malware have access to it? If a Windows user downloaded and ran a pirated computer game that contained malware and is granted administrative privileges, will it have access to localStorage or browser cookies?

On PC's the browsers local storage and cookie storage is not specifically protected. This means that any process running with the same or higher privileges as the browser will be able to read and manipulate this storage. Thus, if you run the game as a different and low privilege user it will only be able to access the browser storage if it manages to elevate its privileges by using a security bug. But if you run the game as the same user as you run the browser no such exploit is needed.


How to protect Authentication API from a DDoS attacks? After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? I guess we can use ip address as one of the hint to detect attack, but what are other options available? Thanks!

Just use a CDN to deliver the webiste, that will be the best protection against a Distributed DOS attack.


What tools can be use for Security Auditing for Redhat Are there any good tools that can be used for Security auditing of Redhat Linux.
That can audit all the critical areas of System and provide the detailed output of all the audited sections.

Free automated assessment tools are notoriously missing. Historically we had Bastille, which was reasonably not terrible, it also hasn't been updated since 2008 and doesn't support any of the EL releases of RedHat. Currently we do have Tiger, which requires a fair bit of configuration to be properly useful. It is also infrequently updated, the current release being from 2010, but it does provide some baseline usefulness.

In any event, in order to audit a system, you must first know what you're going to audit against. So pick a standard that fits for your environment (both technically and business process) and start using it. Depending on which standard you pick there may be assessment tools available. For example, if you are a CIS member then you can use the CIS-CAT tool to audit systems against their standards. If you are a Nessus Pro Feed customer then you can use their auditing system to test a system against a number of standards including CIS and DISA STIGS.

Configuration auditing isn't necessarily easy, and will likely require some capital outlay, but it is a necessary step if you're going to claim to use a standard.

If you are unable, or unwilling, to lay out money for an automated tool the next best step is to perform a manual assessment. I wouldn't recommend if, but if you do, I would start with these steps:

Pick a standard.
Thoroughly read the standard and compare it against your environment and business needs.
Throw out the changes that are unnecessary or aren't worth implementing (for whatever reason).
Convert the remaining items to a checklist.
For each checklist item determine a testing method to determine if the particular item has been completed.
Compare your system against the checklist and make sure everything has been addressed.


How can I find websites owned by a particular company? I wanted to know how can I get info on what sites are owned by a certain company. I need it for bug bounty programs.

For example, how can I find what sites are owned by PayPal, like what sites have PayPal in it's web address etc...

I find BGP Toolkit from Hurricane Electrics Internet Services quite useful for providing insight into any CIDR range, registrants, Who-Is info, IP and DNS info, IRR, assigned IPv4 and IPv6 CIDR ranges for individual ASNs, you name it. All data presented is also nicely linked to each-other for our convenience.

For example, searching by term PayPal will result in this table:

AS17012            PayPal, Inc.
64.4.248.0/22      PayPal, Inc.
64.4.246.0/24      PayPal, Inc.
64.4.244.0/22      PayPal, Inc.
64.4.240.0/22      PayPal, Inc.
216.136.236.0/22   PayPal, Inc.
173.0.94.0/23      PayPal, Inc.
173.0.88.0/22      PayPal, Inc.
173.0.84.0/22      PayPal, Inc.
173.0.80.0/22      PayPal, Inc.
173.0.80.0/20      PayPal, Inc.

which gives you a single ASN and a few assigned CIDR ranges that are registered to PayPal, Inc. These items in the list link to their individual info pages. Following the AS17012, for example, displays all kinds of information pertaining to this ASN, among others the list of Prefixes (in our case IPv4 CIDR ranges).

What is HE?

HE is one of the largest Internet backbone providers and can thus collate loads of infrastructure related information like the ones mentioned. You can search their database by registrant names, CIDR ranges, ASNs, IP addresses, and so on, all through the same input box and it will display either a list of possible matches, ordered by relevance and network range, or display a single match details when only one record is found. They also include a lot of various network related reports and statistics.

This is from their About page:

  Hurricane Electric operates its own global IPv4 and IPv6 network and
  is considered the largest IPv6 backbone in the world as measured by
  number of networks connected... (and so on)

Also interesting (and relevant) to read is the page about their network. It gives a bit of insight into how they can collect all the data available through their search.

Of course, I'm not saying that HE is the only place to go. There are lots of other tools available, some paid and some more or less free to use and query. HE's one is however one I most frequently rely upon and I thought you might find it useful as well.

What do I use this information for:

I mostly use this information to compile blacklists and other network filters for my services. I find it especially useful to track down hosting companies and their CIDR ranges to include in content-theft, malware, spyware, and related policy blocks (in essence bad neighborhoods) when blocking by reverse DNS look-ups (and/or matching rDNS results with forward DNS look-up tables) wouldn't cut it.

Usage example:

To answer your example directly, collating information from HE gives us this list of A record domains operated by PayPal, Inc:

64.4.248.105    icppharm.com
173.0.84.191    paypal.fi, paypal.de, paypal.pt
173.0.88.180    paypal.mobi
173.0.89.113    www.paypal.de
173.0.89.161    www.paypal.com.pt
173.0.82.143    www.paypal-labs.com
173.0.82.144    www.paypallabs.com
173.0.82.145    www.thepaypalblog.com
173.0.82.156    paypal.me
173.0.82.157    paypal-portal.com

(limited to include only A records otherwise the list would stretch several pages long. This page alone, from one of several CIDR records, lists hundreds of domains.)

All relevant DNS records for our example can be found on pages 64.4.248.0/22, 173.0.94.0/23, 173.0.88.0/22, 173.0.84.0/22, 173.0.80.0/22, and 173.0.80.0/22

Some pages duplicate information from others as they're providing information on a sub-range of a larger range (smaller mask), like for example an IP range 173.0.80.0/22 would already be included in a 173.0.80.0/20 IP range.

What sites have 'paypal' in it's web address?

I'm going to make an attempt on answering this part of your question, however (as you probably can imagine) my answer can't be as straight-forward, because there isn't a single list of all registered domain names available to public, at least not that I'm aware of. Here's what I'd do:

The www.who.is website provides a bit difficult to navigate or search through domains index. Where do they collate all this information from is beyond my knowledge, I can only suspect they query individual registrars' databases on a regular basis.

Anyway, if you navigate their pages a bit you'll soon discover that the lists are organized in alphabetical order and then by page numbers (static URLs to individual pages). I guess you (or a CP savvy friend) could write a small utility crawler that would parse all this information into a single table and then do your search on it. If that's agreeable to the website operators and within their TOS isn't something I've researched. Honestly, probably not and your crawler could be banned sooner than it would be able to crawl all relevant pages. You would still end up having larger data set than any publicly available ones (that I know of) and that can be easily searched through by a common expression.

If you did this, you would soon discover tens of thousands (educated guess) of registered domain names that include 'paypal' keyword in it. Most, I gather, are actually parked domains, expired domains, and the most awful of the bunch - phishing locations trying to lure unsuspecting Internet users to their addresses by mimicking official PayPal domain names. For example, take a look at this page and search for 'paypal' in it. 1883 matches in a single page, and only God knows how many pages are actually relevant to our search without resorting to crawling and collating data of each individual index page. They can't possibly be all registered by PayPal, Inc.!

I hope that at least partially answers also your 'other' question.

Cheers!


Collision attacks on OCB? I've been looking into the OCB cipher mode and everything I hear sounds good.  I was planning on implementing it.

Everything except for this lone voice, that is:  Collision attacks on OCB:

  We show that collision attacks are quite effective on the OCB block
  cipher mode. When a collision occurs OCB loses its authentication
  capability. To keep adequate authentication security OCB has to be
  limited in the amount of data it processes. This restriction is relevant
  to real-life applications, and casts doubt on the wisdom of using OCB.

Does this mean that I should definitely stay away from OCB?  I did read the paper but I'm not experienced enough to be sure how serious this really is.

Those attacks are theoretical and unlikely to be of much practical relevance to all but a tiny number of uses (if any).  Don't let the paper scare you.  It is a useful piece of research that will be of interest to researchers, by a reputable and talented cryptographer, but in my opinion it doesn't threaten practical use of OCB.

The kind of collision attacks that Ferguson is talking about require about 268 bytes of data to be encrypted under OCB (all with a single key) before they are likely to occur.  That is a lot of data.  No typical application is ever going to encrypt that much data under a single key.

You have to keep these things in perspective.  If this is the biggest weakness in your system, you have done a fantastically, unbelievably outstanding job of building a security system.  I doubt I have ever in my life seen a security system where OCB would be the weakest link.  In practice, usability problems, implementation vulnerabilities, misconfiguration, and the like are far greater risks.  It's far more likely that a user will choose a poor password, or fall for a social engineering attack, or that your software will have a SQL injection vulnerability, etc.  With modern cryptography, attackers usually don't try to break the cryptomath; instead, they bypass it.


Network Defense- White listing IPs/Ports If I had a typical home user machine (google, email, youtube, no ssh/ftp, etc...) that had a dynamic iptables white-list that was dynamically updated with IP addresses that have been legitimately been launched and blocked all others...would this be practical?

For example, unless I have connected to IP: x.x.x.x on Port YY, then any incoming communication with x.x.x.x is automatically blocked?

Assuming that your side initiates every communication, then yes, blocking every connection to your machine from IP addresses you didn't connect to is a good idea.

But note that this is firewall basics. Most client-side firewalls don't allow any incoming connections initiated from a remote machine unless you specificallly allow them. They do more than you imagine, too - they keep track of active tcp sessions and only allow packets from ips that are in an active session with you. Once the session ends, packets from that IP will be blocked again.

If you're talking about a home network, then the firewall should run either on or right behind your internet router, eg the box providing you with internet access. If you don't allow any connection initiated from the outside, the devices on your home network are much better isolated from the internet.

Usually broadband internet providers give you a box which has such firewalling capabilities. They might or might not be enabled, but it's usually trivial to configure.


Determine if compressed or encrypted I have a bunch of network data and I would like to determine if it is either 1) encrypted or 2) compressed. I doubt it is both, but the potential exists. If I am assuming that the traditional compression headers are stripped (preventing me from simply running file on the data), then how would you determine whether the data I am looking at is either compressed or encrypted, if it had to be one?

The reason I would think that the compression headers are stripped is because it would be unnecessary information considering both the client and the server know the exact method to compress and decompress the data.

Examples of the application-layer data is posted on http://pastebin.com/0VdR8XQ4
and http://pastebin.com/cF81RTkj

In theory, this can be difficult because both encryption and compression seek to produce high entropy data.  Practical results depend on the specific compression algorithm used; for example, a writeup on /dev/ttys0 claims success in using certain statistical techniques (Chi-Square or Monte Carlo pi approximation) to differentiate certain compression/encryption techniques.


Metasploit Meterpreter Persistence Script Alternatives These days I am testing various type of client hacking techniques, and in all scenarios I am using Meterpreter/reverse_tcp as payload. Now I can bypass Anti-Virus and Firewalls easily, but when i run persistence module Anti Virus and IPS always detect Meterpreter payloads used for persistence and they delete the file also same problem with meterpreter bypass_UAC script.

As you know meterpreter session always easily dies because of various things like internet connection disconnected or rebooting system and etc.

Is there any better way than Meterpreter persistence script that can persistence my sessions and bypasses Anti Viruses and Firewall too?

Is there any way that meterpreter persistence script uses my self-crafted payload instead of automatic generated payloads by metasploit that easily will cought by antiviruses?

Justin Warner provides an argument on his blog that is important to summarize before continuing a discussion about persistence:

  Is Reboot Persistence a Requirement

  I would argue that a backdoor does not have to be reboot persistent.
  In its very nature, a backdoor is simply a method of gaining access to
  some targeted resource. Backdoors often have a persistent component
  but I would say that is a decision best left to the context and
  scenario of what you are trying to accomplish. In very simple network
  scenarios or penetration tests that have little focus from network
  defenders, run-of-the-mill persistence might be applicable and useful.
  Things like run keys, service executables, or App Init DLLs come in
  quite handy for this situation.

  In more sophisticated or tough network environments, I often try to
  operate 95% memory only and only resort to reboot persistence in areas
  that seem to be key-terrain. This might be more paranoid than
  necessary but by doing this, I help to avoid issues with host based
  IDS and prevent leaving artifacts on the hosts. In the places I choose
  to do reboot persistence, I prefer methods that do not utilize a file
  on disk such as registry storage of payloads.

Let's take real-world attacks such as the Kovter malware as an example of the tradecraft possible in 2016 -- https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/

  Thanks to the techniques employed by Kovter, no executable needs to be
  dropped on the disk – that’s why is known as “fileless” [...]
  scattered into several layers, but also obfuscated at every stage and
  containing tricks that slow down the analysis process

Kovter uses a combination of persistent registry entries and PowerShell (others often use or suggest remote registry, PS Remoting, and/or WMI event consumers) to perform this fileless persistence. Some blogs have talked at length about autostart persistence locations based on these, services, autoruns, et al.

In meterpreter, one can access fileless techniques (as described by Justin Warner's blog post at the top of this answer) via PowerShell's PowerPick and ReflectivePick techniques, which don't require execution (or visible process listing) of any powershell.exe. Darkoperator covers the powershell extension and ability to use the powershell_import command to pull in a PowerShell pipeline. One can then use the PowerSploit persistence capabilities, but these may not always be clearly-defined. Of course, instead of meterpreter, one could use PowerShellEmpire agents to deliver the persistence/elevated/wmi module. What I'm suggesting, and which will likely solve your problem directly, is to just source Persistence.psm1 to perform the WMI permanent event subscription via powershell_import while inside meterpreter. This will provide the AV, IPS, and firewall/UTM bypasses you'll need -- but it may be easy to cleanup if the responders search for multiple instances of this one technique.

Which brings me to the next conversation piece that Justin Warner alludes to. Each machine you want to persist against in a network should have a different persistence technique (some perhaps no strategy at all -- e.g., servers with high uptime can have memory-resident backdoors for months, maybe years at a time). Often, you can use the system-administration infrastructure against the target -- leveraging it for evil instead of good, so to speak. There are ways to take control of COM handlers, WSUS, AD GPO, BITSadmin, DSC, SCCM, and many other packages and features to maintain persistence.

Also -- system persistence may be completely different than reliable transports. I highly suggest that you check out the Meterpreter documentation:

https://github.com/rapid7/metasploit-framework/wiki/Meterpreter-Reliable-Network-Communication
https://github.com/rapid7/metasploit-framework/wiki/Meterpreter-Transport-Control

You must understand the transport architecture in order to maintain reliable network connectivity. One of the best ways to ensure network reliability that the above does not cover, however, is to combine transport with Metasploit AutoRunScript -- such as covered in the this other answer in order to get AutoRunScript working in the context of meterpreter. mubix covers transports more in detail in this metasploit minute from Hak5.


Question about the public key in the CSR I am trying to understand the CSR generation process. I create a private key using Openssl tool. Then use the private key in a command to create a CSR. I know that CSR will contain a public key. What I don't understand is, how is the public key created? or is it actually derived from the private key which was generated?
For example, I am creating a CSR from a server (doesn't give out the private key). I get it signed from a CA. Now, when I import the certificate in the server, I get a public key mismatch. What could be the reason?

... or is it actually derived from the private key which was generated?

You can get the public key from the file which contains the private key since all information are in this file. See Can I get a public key from an RSA private key? for more information.

  ... Now, when I import the certificate in the server, I get a public key mismatch. What could be the reason?

My guess is that you've something messed up, i.e. did not use the same private key for the server as you've used when generating the CSR. There might be other reasons like CA not using the given key but creating a new key. But, given that the exact details are not known how you've created the CSR, how you've got your certificate and how you configured the server it is all speculation.


Is the law the only thing stopping many sites from being hacked/cracked? There are so many common vulnerabilities out there, so how is it that every Wordpress blog, for example, isn't hacked into often?

It seems like the security community is overly paranoid, unless the law is the only thing deterring skilled hackers.

Which one is it?

From a purely objective view, I don't think there is any evidence showing that cyberlaws are having a large impact on computers not being cracked.  It's too easy to avoid prosecution (jurisdiction) and it's too easy to automate mass cracking.

On a more subjective view, I think the cyberlaws do keep the highly skilled security professionals honest, because the risk isn't worth it compared to their careers.  You could argue that the laws are limiting the pool of people that might launch sophisticated attacks, making it easier put enough defense in place to stop the most likely attacker.


Recommendations for a Certificate Management tool for Linux A client is looking to roll out OpenVPN to all its mobile employees and will use certificates on both the server and all clients.

This creates a new challenge to manage all these certificates and handle certificate revocations and renewals.

Any recommendations on a Linux GUI tool to manage hundreds of certificates?

I have done testing using the CLI, but that is going to become a nightmare as the number of certificates increases into the hundreds.

You may want to try EJBCA. It is free, opensource, graphical, and runs on Linux.

Note that proper certificate management is 95% procedures; software can only get you so far.


What is end-to-end encryption and how to do it (correctly / securely)? //update 1 - there came some good replies (sadly mostly as comments instead of direct answers) - look further down for additional edit

I know this is a hot topic for the past few years, and although I would say I know quite some stuff about transport encryption (from the client to the server) I didn't yet got what's all about this "end-to-end" stuff. From as far as I could dig up information it's about securing the communication channel between the communication endpoints - maybe over several other connections - and maybe not in real time.
Although TLS and S/MIME are topics I'm well familiar with I couldn't get my head around end-to-end.

So, please correct me if I'm wrong - I don't fully understand it yet:

"end - to - end" means securing the channel between two communication end points - this means if I have Alice and Bob (as often used in crypto) Alice and Bob are not necessary only linked by one connection like a client using TLS to connect to a server but maybe by several links like Alice connected to server A - which then is linked to server B to which Bob is connected (pretty much like IRC with multiple servers). In this case e2e means that Alice and Bob communicate over the IRC network without any of the servers being able to read the message unlike the case if Alice and Bob would only use transport encryption from their clients to the server but not e2e.

Ok, so when I stick to IRC: When both are online at the same time they could just do a TLS handshake over IRC (and spam others with their encrypted messages) - and although this shouldn't be possible by other security protections - how could Alice prove to Bob she's the real Alice and how could Bob prove to Alice he's the real Bob (prevent MITM)? Some rogue entity sitting between them at any point could just do a simple MITM. I read about this Alice and Bob sharing fingerprints out of band (so, in the IRC example: maybe by e-mail - if both know the correct e-mail-address of the other). Or maybe meeting in person and exchange fingerprints by scanning QR codes on their phones. But how to do it without out-of-band (if possible at all)?

And how about when both are offline? How would they establish a handshake to share a common secret (and some authentication data to prove the messages)?
I'm lost about this topic and although tried to search for information I couldn't find any specific example showing how it's done (in any way - couldn't find any about doing it securely). Any help appreciated.

//edit 1: So, over time I got a better understanding about end-to-end and possible ways to implement it.
First of all I learned that E2E is more of a concept rather than some specific protocol or such. Guess that's an important lesson to learn about that topic instead of just TLS wich is a clear defined protocol with known implementations.
Next I learned that one has to think a bit out of band when it comes to verify that the one who I want to exchange messages with really is the one and not someone else. If you can't meet in person (one of the main verifications in weboftrust and pgp/gnupg) one (or both) can share their keys (and/or fingerprints) over several ways like random mailing lists, random comments on random blogs. An attacker would need to either controll all of them (unlikely) or successfully MITM the connection of at least one of the participants and by this break TLS' countermeasures to prevent exactly that. A possibility I didn't thought of before as it seems I was (and maybe still am) a bit to single-minded towards "I want some trusted instance like a CA" - if I want to get deeper into e2e I have to let lose that one.

We call communication e2e encrypted if one side encrypts the message and it remains encrypted on the whole way to the other side, so that only the other side can decrypt it.

Fir instance, Alice encrypts an Email, so that only Bob can decrypt it. Bob sends messages ecncrypting them so that only Alice can decrypt it. The email can be relayed via multiple servers and the whole time remains encrypted. The can use pre-shared key and symmetric encryption, or one time pad (it can be hard to implement in real life, but still it is a valid option), or - much more often - they can use PKI, for instance they both can obtain S/MIME certificates issued by some trusted Certification Authority and use public key of each other to encrypt messages. The same is applicable for messengers.

You are asking about offline. It does not matter, if one side is online or offline. When Alice is encrypting a message to Bob, Bob doesn't have to be online. In case they use PKI she has to know the public key of Bob. Alice uses his public key to encrypt a message to Bob and sends it to him. When Bob comes online, he receives the message and decrypts it.

To handshake: We speak about handshake in case of TLS. Here is direct connection between both sides is needed. That's why TLS is normally use only when at leas one of both sides has a fixed IP or fixed domain name. When two people communicate (e.g. via messenger) they are in most cases in the networks of their internet providers and have neither fixed IP nor fixed domain name. Means, Alice does not know how she can reach Bob to establish a connection with him. And Bob doesn't know how he can reach Alice. In such case they just cannot establish a TLS connection to each other. They can do that only if they are in the same network which happens rarely.

In many messengers users establish connection with the server, because the server has a fixed domain name and at any time it is known how to reach the server. Alice and Bob both establish connection to server, and the server forwards messages from Alice to Bob and vice versa. One handshake happens between Alice and server, the other one between Bob and server, but no handshake between Alice and Bob.

If Alice and Bob use their public keys to encrypt messages to each other, then the server cannot decrypt them. But many messengers don't support that and only have encryption between ALice and server and between Bob and server. Server obtains an encrypted message from Alice, decrypts it into plain form, encrypts it for Bob and sends it. This is of course not e2e encryption.


Creating sub CA signed with Let's Encrypt certificate I have a certificate issued from Let's Encrypt.

Can I create a key and certificate for my own purpose (i.e. an OpenVPN server, or web server with internal domain name/IP address) and sign it with the Let's Encrypt certificate?

Usually no, only certificates marked as being a CA can issue certificates. (or, more accurately, you can do that, but no vpn client or web browser will trust it.)

To see if your certificate is a CA, open it and look at the Basic Constraints field; a CA will look like this

while an End Entity will look like this:

End Entities are not allowed to issue certs, and good luck getting Let's Encrypt to give you a CA cert...


What is Shikata Ga Nai I came across this payload named "Shikata Ga Nai" (in Japanese it means nothing can be done about it). Some exe file was generated and when it is executed, a reverse shell can be obtained. But this can be done by many payloads on Metasploit. Is there anything unique about this encoder?

Edited: As mentioned by Micheal, it is not a payload but an encoder.

Shikata Ga Nai is an encoder included in the Metasploit framework for the x86 architecture. From the available source code:

  This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering.  Registers are also selected dynamically.

An academic paper describing techniques to extract encoded payloads offers the following explanation:

  This encoder offers three features that provide advanced protection when combined.

  First, the decoder stub generator uses metamorphic techniques, through code reordering and substitution, to produce different output each time it is used, in an effort to avoid signature recognition.
  Second, it uses a chained self modifying key through additive feedback. This means that if the decoding input or keys are incorrect at any iteration then all subsequent output will be incorrect.
  Third, the decoder stub is itself partially obfuscated via self-modifying of the current basic block as well as armored against emulation using FPU instructions.


Can a TPM's EK's public key (hash) be used to fingerprint a device? The question How to use TPM to perform platform authentication is basically asking if the TPM's EK can be used to "authenticate" a host/device.  And one of the answers says

  The Endorsement Key (EK) is not directly accessible as this would be
  privacy issue - we could track a system using this unique identifier.

But the EK's public key hash (and public key too, I guess) is publicly available (if you have access to the machine), e.g.,

PS C:\windows\system32> get-tpmendorsementkeyinfo -hash "Sha256"

IsPresent                : True
PublicKey                : System.Security.Cryptography.AsnEncodedData
PublicKeyHash            : 18e3b568aeb17b4e75f3838d7b01ffe63c52d976950943a10968761b5bfe3f4d
ManufacturerCertificates : {[Subject]
                             TPMVersion=id:0808, TPMModel=ST19NP18PVMT, TPMManufacturer=id:53544D20

                           [Issuer]
                             CN=STM TPM EK Intermediate CA 01, O=STMicroelectronics NV, C=CH

...

Why isn't the EK's public key hash sufficient to identify a unique host/device?  (Assuming all you want is a "fingerprint" and not to encrypt/decrypt with it.)

And in fact, this is sort of suggested by the other answer to the question which suggests generating an AIK and using its public key.  (But why do you need the extra step of generating an AIK when you can just use the EK's public key?)

Update:  @Andre, in a comment below, says that the EK can be reset and regenerated by the device.  I didn't know this, thanks! Microsoft says "The endorsement key is an encryption key that is permanently embedded in the Trusted Platform Module (TPM) security hardware, generally at the time of manufacture." in technet, here - but generally of course means "not always".  This result from the book "Trusted Computing Platforms: TCPA Technology in Context" (page 124) talks about how originally the private endorsement key was generated on the device - but that was later relaxed because it caused manufacturing problems, and now the manufacturer generates the EK off the device and injects it into the device.  Finally, the book "A Practical Guide to TPM 2.0: Using the Trusted Platform Module in the New Age of Security" agrees with an important caveat: The EK can be reset but if you do long-living certificates (including some the TPM chip manufacturer is holding that are used in some attestation scenarios) are all invalidated.

So, for purposes of this question:  Let's say the fingerprint needn't be absolutely permanent so that you will always get the same fingerprint for the device for all time.  Rather, let's say the fingerprint needs to be unique, so that you'll never confuse this device with another device (though you might lose the relationship of this device to itself earlier).  With that interpretation: Can the EK's public key (hash) be used to uniquely fingerprint the device?

EK cannot be reset. It is this certificate that identifies the TPM as being real/trustworthy (e.g. not software-based) and TCG compliant.

The statement about EK being private refers to a 3rd party in the context of remote attestation - not someone already on the local machine which as many other means to fingerprint the device.

In other words, if you were to do remote attestation via the EK directly, you would always expose the same identity. With AIK, you can have as many identities as you want and only the CA knows your real identity (public EK).

So the answer is NO in the context of remote attestation and YES in the context of someone already on your system.


Why are there no software or services that detect Phishing Emails? I tried Googling, but did not get a definitive answer. I'm looking for software or services that detect Phishing Emails. I read that some software like Norton, Kaspersky, etc. detect phishing websites, but do they detect Phishing Emails? How do you find software or services that detect Phishing Emails? Basically I want a software which can take emails as an input and tell whether an email is phishing or not. If I develop a system (algorithm) to detect phishing emails and test it with a large dataset of emails, I want to compare it with the performance of existing system.

Most email services can and do detect malware and often times phishing emails in the form of a Junk Mail service.  There are standalone Exchange based services like McAfee Security for Microsoft Exchange (MSME) that you can custom tune for your environment to detect known phishing site links, etc.

However, you have to understand that anyone can create a simple site that grabs information from people when they enter the site at the drop of a hat.  There is no way to easily detect these "zero day-like" sites that popup constantly.  Your best defense against phishing scams is not so much in the product based solution as it is in the education of those you are trying to protect.  Teach people not to click on suspicious email links.  Disable JavaScript from auto-running on websites.  Disable the ability for people to run executables from websites allowing the system's AV to do it's job better.  Also disable auto-running of anything.

I'm guessing this isn't exactly the answer you were wanting, but unfortunately when it comes to security, this is the most appropriate approach.  But again, nearly all enterprise solutions either already provide some form of this security or you can install products like MSME to help weed out as much as you can.


Should internal security tools use self signed certificates? I know of a company who has many internal security tools use for different functions within the company. Most if not all of the tools are using self signed certificates, and not certificates signed by a CA. Either they are internal or generated by the tool itself.

My questions is, is there an argument for getting valid certs for these internal security tools?

If the certificates are invalid, users using the system will likely become accustomed to selecting proceed anyway on their browser warning which isn't advisable from a security perspective. Anything could be proxying the traffic and intercepting system credentials. If the credentials are integrated with a corporate authentication system, the credentials could be pretty useful. If the credentials are limited to a log system for example, someone could selectively clear logs while logged in as another individual.

You can install the system certificate, install other corporate certificates or install certificates from recognised CAs. People shouldn't be encouraged to ignore security warnings.


RemoveFromCRL and DeltaCRL I have a question about DeltaCRL with an entry which contains RemoveFromCRL reason.
At the start, PKI has revoked the certificate with certificateHold reason.

And create next CRL:

Last Update: May 28 13:14:09 2015 GMT
Next Update: Jun 27 13:14:09 2015 GMT
Revoked Certificates:
    Serial Number: 12
    Revocation Date: Aug 14 14:44:00 2014 GMT
    CRL entry extensions:
            X509v3 CRL Reason Code:
                certificateHold

Later, our PKI unrevoked the certificate,  removed the certificate from CRL and created next Delta CRL:

Last Update: May 30 12:51:40 2015 GMT
    Next Update: May 30 15:00:00 2015 GMT
    Revoked Certificates:
        Serial Number: 12
        Revocation Date: May 30 12:51:40 2015 GMT
        CRL entry extensions:
                X509v3 CRL Reason Code:
                    RemoveFromCRL

What value  can I use for RevocationDate for DeltaCRL and why?
I should use current time or revocationDate from first revocation?

The 'removeFromCRL' reason code indicates that the certificate is, in fact, not revoked. The idea behind 'certificateHold' is to make a suspension, not a revocation: the PKI declares that the certificate should not be used until more information is made available (in a subsequent delta or full CRL), while not fully revoking the certificate, because revocation is a one-way trip. In that sense, the certificate was never revoked, and thus was not "unrevoked" either.

This implies that the "revocation date" for a 'removeFromCRL' code is completely ignored. That date qualifies the instant from which the certificate should be considered as revoked, until the end of times; the 'removeFromCRL' code cancels that.

If you look at RFC 5280, you will see that the revocation date is not used at all in the validation algorithm. Its main purpose is to support past validation, when you want to know whether a given certificate was valid at some past date (this is used in some signature formats, in conjunction with time stamps). When a CRL lists that a certificate has been revoked at date T, this means that after date T the certificate must not be considered as valid, but also that before date T is was fine. For instance, if the certificate was on a smart card that has been lost, then the "revocation date" should be the last time at which the smart card was last seen by its owner, since at any ulterior date the card might be in the wrong hands. For the certificateHold/removeFromCRL pair, the point is that the private key was never compromised and the certificate never revoked, so there is no "revocation date".

(Arguably, the 'certificateHold' and 'removeFromCRL' reason codes are a hack which encourages PKI owners to use revocation as an emergency suspension mechanism, i.e. a substitute for authorization, and that is a bad idea. Revocation is, by nature, an asynchronous mechanism, and does not work well for that. When a situation arises where you would want to put a certificate "on hold", the sane thing to do is to revoke the certificate and issue a new one.)


What prevents a man in the middle from requesting a certificate for your server? Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online).

First of all, how can they ensure that you really are an admin of shop.example.com? Perhaps it was an attacker who requested this certificate to be able to perform a man-in-the-middle attack.
And secondly, let's say it really was you, and you got that certificate. What prevents the same attacker requesting a certificate for the same domain from some other CA?
Is there a common storage of all requests so that CAs can detect such duplicates easily? Or is there some other means of preventing it?
Can someone also easily get a certificate for shop.example.net and hope for some mistyping users?

A CA is supposed to make sure that the certificates it issues contain only truthful information. How they do that is their business; serious CA are supposed to publish detailed "Certification Practice Statements" that document their procedures.

In practice, when you want to buy a certificate for a www.myshop.com domain, the CA "challenges" you, so that you demonstrate that you indeed have control of that domain. Some classic methods include:

The CA sends you a piece of random data, to include as a host name in the domain. You thus demonstrate your control of the DNS related to the domain.
The CA sends you a piece of random data that you must put for download (over plain HTTP) from the www.myshop.com site. You thus show that you control the main server that corresponds to the domain.
The CA sends that piece of random data over an email sent to admin@myshop.com. You return back that data to them, thereby demonstrating that you can read the emails sent to the administrator of the domain.

None of these mechanisms is really strong; and, moreover, it suffices for an attacker to succeed in fooling one CA among the hundred or so that are trusted by default by usual Web browsers. Nevertheless, fraudulent certificates appear to be a rarity (say, once or twice per year, worldwide), so one has to admit that these authentication mechanisms, however flimsy they look, must be good enough for the job.

As for mistyped domain, it is a very classic method which is commonly handled by either buying those mistyped domains, or unleashing your lawyers on whoever tries to buy a domain that seems to be "too close" to your own domain.


Suspicious login alerts vs customer privacy I would like to implement a "Login from a suspicious location" email for my users.
The first thing that came to my mind was to use a GeoIP Latitude Longitude and a k-d tree to compare the distance
between the current login and the geographically closest prior login for a threshold.
The problem I'm seeing is that to achieve this, I would need to store the latitude and longitude of all the prior logins
attached to the user. This is a problem because even though I'm taking maximum precautions, I try to assume everything
in my SQL database may be public knowledge someday after a breach. I don't want to be storing information that could be
upsetting to users following a breach.
Is there a strategy I can follow to determine if a login is from an atypical location? I can only see two theoretical
ways to achieve this, but I haven't been able to come up with a suitable solution to either.

Keeping the accurate location, but use a hypothetical one-way-function to anonymize ownership.
Determine the distance between two or more locations without ever knowing the real world locations

Has anyone else tackled this problem in a privacy conscious way?

You have several options:
1. Give users a choice
Ask users if they would like to enable a feature which alerts them when there is a login attempt from a location that is far away from their previous login attempts; and inform them that in order to do so, you will need to save data from where they have logged in.
By disabling this feature by default, you show that you care about your user's privacy and if a user wishes to trade in a potential loss in privacy for potentially higher security, that is their explicit choice.
2. Just use the data you already have
It is not universally agreed on whether IP addresses are personal data or not, so depending on where you are operating, storing a user's previous IP addresses may be possible. However, even under GDPR, you can require users to consent to storing the IP addresses they have used to log into the service.
You can then use the IP addresses to look up which geographic region they belong to. While the level of detail varies somewhere between "this country" or "this part of this city", it's good enough for your purposes. If you know the user keeps logging in from Switzerland, and suddenly you have a login attempt from China, then that is suspicious. It really doesn't matter where exactly in Switzerland, or where exactly in China.
I'm sure there are more options, but I can't really think of any right now that aren't just re-hashes of these ideas.


2 step authentication hybrid I'm all forward on 2 step authentication. I understand how it is way more secure than a simple password. However I'm always afraid to start using it because I believe that in some cases I could be "left out" my account.

Google (for example) provides a lot of ways to avoid that (SMS, calls, several phone numbers, offline, printed codes, etc). However I can't stop thinking in the "what if ... and I can't login when I need it".

So I thought of an hybrid authentication process that I believe it could work and I want to know if you see in flaws in it or you think it would be safe. It would be using 2 step authentication but being able to set up one (or several) just-in-case passwords. If, for some reason you can't access the second-step-device you can use one of those passwords (without the second authentication factor). Then, that password would be disabled until you access the account using the 2 step authentication and you can decide to either delete it or re-enable it (according the environment where you used it).

What do you think?

I believe that would defeat the purpose of two-factor authentication.  The point of two-factor is to have two forms of verification: 1) one that you are responsible to generate yourself and know and 2) one that you don't generate and know.

Creating codes generated by the service does the same thing as far as having a second code you can physically keep and know, but at least you didn't generate it yourself.


Can an iOS/android app encrypt data without the user entering a password? I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password.
Is it even possible that the app encrypts the data in a useful way?
I do need see what difference it makes if I try to access the data or someone else if there is no password.

I can imagine that data is send over the network encrypted with a random local stored key. But for local storage, the key would have to be stored at the same place as the data making the encryption useless. Is that correct?

Essentially, yes. However newer devices have a key built into the device that can't be read, only used (the 'Secret Enclave').

Based on that, IOS provides something called the Data Protection API (DPAPI) to apps. You can only crack that if you jailbreak the device and know the device's passcode.

Edit - I said "essentially yes" because I'm a bit cynical about the passcodes people choose - a 6 character alphanumeric passcode would (says Apple) require >5 years to crack, but 0000 or 1234 will be quickly guessed of course


Infinite one time pads, brute force multiple pads? So based on my understanding using the same key for encrypting
two completely random plain texts when using an otp cipher will still retain  perfectly secret. This is based on the answers on this question.

The answers to those questions also say that using that data couldn't then
be used to encrypt more messages.
My understanding is that if the messages have been transmitted securely using
2-time pad cipher. This should be equal to handing them off at a physical location.

What I  am wondering is why not be able to send new one time pads?
If the message are perfectly secure an enemy wouldn't be able to determine
what the secrets are?
How would you brute force crack the messages since they hold perfect secrecy?

Quite simply, it's exactly the same as a two-time pad with one extra step.

So, as you know the problem with re-using a one time pad is that it leaks information.

If we encrypt m1 and m2 with pad1, that gives us:

m1 xor pad1 = c1
and
m2 xor pad1 = c2

So if we capture c1 and c2, we can then:

c1 xor c2 to get m1 xor m2

If however, we re-use pad1 to transmit pad2, and then use pad2 to encrypt m2, we get the following:

m1 xor pad1 = c1
pad2 xor pad1 = c2
m2 xor pad2 = c3

So now, as long as I capture c1, c2, and c3, I can do the following:

c1 xor c2 = m1 xor pad2

Which effectively gives me the ciphertext I would have if I had used pad2 on m1 directly. So now I effectively have the ciphertexts for:

m1 xor pad2 and m2 xor pad2

Which when xor'ed then gives me:

m1 xor m2

Voila.


How does a Man In the Middle attack happen in reality I am trying to improve the MITM protection of an iOS app I am responsible for, so I want to understand exactly how it happens. I have set up Charles to act as a proxy which required setting the proxy on the phone and installing the Charles certificate. I am now able to read the TLS data sent back and fourth.

In reality most people don't install certificates (at least not the way the Charles certificate is installed) and don't set proxy servers in their network settings.

Presuming I am staying in a hotel and using their WIFI to access my server, how would they go about performing a MITM attack on me?

One way that an attacker can pull-off a MITM attack in a place where public wifi is available (like a hotel) it to create a fake wifi hotspot, which uplinks to the hotel's wifi.  Then, the attacker can use a tool like sslsniff to intercept SSL connections.

Edit:
To protect against a MITM attack, the client should check that the server's certificate (or the CA that signed the certificate) is one that is trusted.  This can be done by way of certificate pinning.


Diceware as a passphrase for online accounts I'm reading about Diceware and cryptography in general and I know how secure Diceware can be. I stumble upon this part on The Intercept about Diceware and it says:

"You don’t so much need them for logging into a website or something
else on the internet. In those situations, you get less benefit from
using a high-entropy passphrase. Attackers will never be able to guess
a trillion times per second if each guess requires communicating with
a server on the internet. In some cases, attackers will own or take
over the remote server — in which case they can grab the passphrase as
soon you log in and send it, regardless of how strong or weak it is
cryptographically."

So the question is, is it overkill to use Diceware on accounts like Facebook, Twitter, etc.? Should I rely on a password manager generating a random string of characters for these accounts and reserve my Diceware passphrase as a "master password" or a secret PGP key?

The reason why you need a strong password for an online service is in case their database is compromised, and the attacker gets hold of the password hashes. Then the attacker can indeed make a trillion attempts per second (if the hashing algorithm is weak and the attacker has good hardware) against your hash. A database compromise won’t necessarily also give the attacker complete access to the front-end servers and network to be able to capture actual passwords as they’re entered.


What are the key elements of a good security requirement? What does a good security requirement for an application look like? I am talking about functional as well as non-functional security requirements here.

For traceability reasons I consider it important that the requirement is fully testable. I also want it to be technology-independent. What else is considered important for a good security requirement?

Testability is the key, and certainly helps get the QA teams buy-in if they have something to test to.

I have a slightly twisted viewpoint on requirements, as I like the idea of anti-requirements.  Most requirements state what the system shall/can/may do.  Anti-requirements specifically state things that the system should not do, and sometimes it is useful to think that way and capture those.

e.g. there tends to be requirements along the lines of
The system shall have a mechanism for expiring passwords after a period of time.

Though there is rarely the anti-requirement
The system shall not be accessible through the use of an expired password.

but it is implied in the first.


Running Ophcrack against Windows 10 I'm putting together a demo of Ophcrack for my team here.  It's been a while since I used it, like 7-10 years.  Booting up into either the Ophcrack live CD or using it in Kali, I'm seeing samdump2 and pwdump showing the same SID/hash for all users of the machine (running in a VM) and Ophcrack says all accounts have an empty password.  Any idea what's going on?  Can Ophcrack/JTR be used against Windows 10?

The Vista/7 Ophcrack will work on Windows 10 hashes. I've run it myself, against both NTLM and LM hashes.

The only time that I've seen aad3b435b51404eeaad3b435b51404ee and 31d6cfe0d16ae931b73c59d7e0c089c0 is when the passwords are actually unset/empty/disabled. These are explicitly detected and marked as "empty" by Ophcrack:

It really does look as though the hashes that you found are classic empty hashes.

Once you get some non-empty hashes, Ophcrack should work fine.

(Side note: but it will only run the wordlists/tables that you feed it, which is somewhat limiting compared to modern capabilities. On modern systems with GPU, you can cover a lot more ground and have overall higher success rates with a full cracking suite like John the Ripper or hashcat. I would suggest demos of those also, to supplement your demo.)


How to bypass backslash escaping xss? I'm trying to bypass some XSS filtering. Every time I insert a single quote I get a backslash, so I wrote this payload:

 \';alert(1);\'

In the source code it looks like this:

<script>
a = '\';alert(1);\''
</script>

but I still can't get an alert box. What is wrong?

It is impossible to know for sure without seeing the code that the server runs, but we can make some educated guesses:

Looks like there is a template looking something like this:

a = '{escape(input)}';

You say ' gets replaced by \'.
From your example, it seems that \' being unaffected is an exception to the above rule (probably to prevent the very attack you were trying). This is a bit surprising - the normal thing to do would be to replace the \ with \\, so you would get \\\'.
There might be multiple other defences built in that you just haven't noticed yet because you haven't managed to bypass  the first.

It is important to understand the context you want to escape from. In this case it is a JavaScript string literal (or Rule #3 in the OWASP cheat sheet). To get out of it, you have two options:

Switch to a general JavaScript context. I think this can only be done by getting an unescaped ' in there. If \' is always unaffected no matter context, try \\'. If you are lucky, nothing is done about the first backslash. While you are at it, try different numbers of backslashes, just in case.
End the script block to get into an HTML context. Try something like this:

</script><script> alert(1); </script><script>

Most likely the < will be escaped to &lt;, but it is worth a try.

See also this related question.


Unescaped PHP DateTime, security risks? Is there any security risks involved if using below code?

$val = $_GET['date'];
$date = new DateTime($val);

If your question is: "are there currently known security issues with PHP that can exploit this?" ... consider the scenario where unexpected input could:

make DateTime give out an error or cause an exception that your program isn't handling further down; it could cause wrong output or worse, an HTTP 5xx.
someone maintaining this code after you could use the input in ways you didn't do (yes, this can lead to debates about poor programmers / inattention, but hey it happens more often than you think).

There are security risks every time you use untrusted external input in your code directly. Nasty bugs have a way of turning up at most inconvenient times

Buffer overflows, especially in widely used software like PHP shouldn't be common, but rarer things have happened.
Context escapes could be possible

These don't have to happen with the current version of PHP that you are using / testing with. Where all will your code be deployed? Will older versions or different PHP engines / libraries be used? Will a newer version / engine have an undiscovered bug?

So finally the question will boil down to: What is the compelling reason for you to take this risk - especially when the safer alternative is not expensive (effort or resource-wise)?


Can I decrypt my SD card as phone died The mainboard of my s7 passed away and i need to decrypt my SD card. Does Samsung store the keys in their cloud? Is there any way to decrypt the card? I can't believe that once the phone dies (mb, whatever), the user loose immediately their data on the whole SD card.

There was some discussion without any solution.
Can I decrypt my SD card with another phone?

Thank you.

The mainboard of my s7 passed away and i need to decrypt my SD card.
  Does Samsung store the keys in their cloud?

I do not think Samsung stores the keys in their cloud as it would expose them to law enforcement agencies asking for them.

  Is there any way to decrypt the card?

There are ways, however, none of them are practical:

You could try and crack the key, this would probably take years.
Locate the chip where the key is stored and read it with specialized
equipment; this might NOT be possible.

  I can't believe that once the phone dies (mb, whatever), the user
  loose immediately their data on the whole SD card.

The whole point of this feature is twofold:

Prevent people who have stolen your phone from accessing the data
Prevent you from tinkering with the Android system. An encrypted SD
card can hold apps, if the feature is enabled in the OS.

You have also lost the data on the phone. If you do not make regular backups, and backups of backups (I have three), then the data you hold is not important enough for you.

A lesson you have learned the hard way today.


How to deal with a hacked laptop that's being remotely monitored One of friends hacked my laptop and now whenever I come online he can tell what tabs are opened in my browser, so I think he is remotely monitoring me. I don't know how he did this, since I didn't take anything from him.

I use Ubuntu, the firewall is enabled, remote connections are switched off, so how can he see what I'm doing?  I can't even access my router on 192.168.1.1 any more.

You are probably infected by a trojan. The first thing you should do is to change all your personal passwords (mail, facebook, gmail, etc) from another machine !

You can use the terminal to see what are the established connections :

netstat -anp --tcp --udp | grep LISTEN

See what are the processes loaded on boot and eliminate the useless ones.
You can use Wireshark to monitor the ingoing/outgoing traffic.

You can install Clamav :

sudo apt-get install clamav

and scan your hole system :

clamscan -r --remove /


Solution to block email sending to domains with typo error I'm trying to find a solution to block the sending of emails to domains with typo errors in it, for example gmai.com or outlok.com.

I am working for a client who uses Office 365 that would like to make sure the address is correct for some specific domains they share private information with via email so they don't end up sending important stuff to a catchall mailbox on a parked domain.

I've implemented this before for the same exact issue because there is no "simple fix" for typo's here's how to cleanly handle it.

First a company policy needs to be written and employees need to read and sign that they acknowledge it and SANS has some good boilerplate's that can be used. The policy must state that all sensitive emails MUST be sent by using a global address book which is centrally managed. Here you put in all the correct email addresses and also confirm that they are correct before telling the users to use them and showing them how to access them. The policy needs to be very clear that ONLY the Global Access List (GAL) is to be used for sensitive emails and that if not followed may take action against the employee for disciplinary action.

Second, either completely disable autocomplete or train the users how to remove invalid addresses one at a time.

Third, train the employees of the new policy and it will only happen when they intentionally do not select the users from the GAL.

Lastly, if information is truly sensitive like patient information, credit cards, etc. then a 3rd party email encryption product should be used. If you are in a regulated industry like in medical with HIPAA and HITECH then encryption systems like this MUST be used or they can be fined or they can stick with only faxing while the recipient is waiting to receive or use SFTP/FTPS but that's a whole other conversation.


nmap not scanning for host nmap keeps showing different and wrong results whenever I perform a scan to see how many hosts are up on my subnet. See the following scan reports.

The first scan I made was not with super user privilege. The second scan was made to see if it makes any difference if I had super user privilege. The third scan I made was specific for a particular IP address(which was up during first 2 scans as well but was not reported by it). Any Idea?

papagolf@Sierra ~ % nmap -sn 192.168.1.1-255

Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2016-10-31 18:50 IST
Nmap scan report for www.netis.cc (192.168.1.1)
Host is up (0.0048s latency).
Nmap scan report for 192.168.1.4
Host is up (0.00014s latency).
Nmap done: 255 IP addresses (2 hosts up) scanned in 19.31 seconds
papagolf@Sierra ~ % sudo nmap -sn 192.168.1.1-255
[sudo] password for papagolf:

Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2016-10-31 18:51 IST
Nmap scan report for 192.168.1.4
Host is up.
Nmap done: 255 IP addresses (1 host up) scanned in 26.98 seconds
papagolf@Sierra ~ % sudo nmap -sn 192.168.1.3

Starting Nmap 7.25BETA2 ( https://nmap.org ) at 2016-10-31 18:52 IST
Nmap scan report for 192.168.1.3
Host is up (0.0030s latency).
MAC Address: B0:47:BF:AC:A6:C4 (Samsung Electronics)
Nmap done: 1 IP address (1 host up) scanned in 16.78 seconds

First of all, I don't think Nmap is showing "wrong" results to you. You are getting different results as expected, because you are doing different scans, even if you don't know that. Using Nmap is not like using a magic option combination that will give you straight away a definitive result. There exist different techniques because different devices in the network behave differently (routers, firewalls, different OS...), and also you might want to be more or less "invisible". Herein, the beauty of Nmap is its flexibility, that allows you to conduct many different scans to find what you need. Imagine it as a mapping tool that will give you X results with some options and Z results with some others. Then, it is your brain who should interpret them and come to conclusions. You only ran the basic command with all the default options, and there is much more to explore.

[1] You are doing only a ping scan, which by default will do the following:

Send an ICMP echo request
Send a TCP ACK packet to port 80

NOTE: Newer Nmap versions (I believe yours included) also send a TCP SYN packet to port 443 and an ICMP timestamp request.

[2] If you are in the same network (and you are a super user), which in your case means the computer running Nmap has an IP like 192.168.1.X, an ARP request will be used instead. If you use Wireshark you can see the ARP packet exchanges.

[3] Lastly, the default behaviour of [1] uses RAW packets for the ICMP echo and the TCP ACK, so when you use an unprivileged user then Nmap cannot use this technique. Instead, Nmap will send a TCP SYN packet to port 80, by using connect as your normal user applications will do.

If you understand how Nmap is working ([1], [2] and [3]) then you can see why you are getting different results.

In your first scan, both computers (192.168.1.1 and 192.168.1.4) accepted the TCP connection. This used to be a very noisy scan, because applications will log the fact that you have accessed them. But you got what you wanted: seeing they were alive. Note that you can configure this type of scan when running Nmap as a super user (so even when you are a super user you can use [3] instead of [1] or [2]) and you will have obtained exactly the same result.

Your second scan sent an ACK to port 80 and an ICMP echo, and 192.168.1.1 ignored it. This could mean that it has a firewall in place. On the other hand, 192.168.1.4 responded either to the ACK or the ICMP echo. If you were in the same network (192.168.1.0), then ARP would have been used instead (see [2])... but if that was the case, for some reason 192.168.1.1 would have not responded to your ARP request, which I find unusual. Therefore, I would guess that you were not in the same network.

In your third scan, in my opinion 192.168.1.3 should have given you the same results as it did in the second scan. The fact that 192.168.1.3 did not show up in the second scan might respond to different facts - perhaps it was connected through wifi and it was down? It happens to my phone sometimes when it disconnects automatically to save power. Did you get these results consistently? You should run more verbose scans to see why exactly Nmap is interpreting network hints the way it does.

Finally, if you are serious about learning the tool, I strongly recommend you to get Fyodor's Nmap book. It is great not only to understand how Nmap works, but also some computer networks behaviour and other tricks. For example, you could use -n to skip reverse DNS lookups and speed up your test. You could also try different ping ports (from the default 80) and different types of ping.


How to encrypt or store data so that only a pool of processes can share it on Windows? I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely.
The issue i am facing is that i don't want my symmetric key to be stored in memory as in that case any other process can take a snapshot of memory and access my keys.
I have looked at many possible similar questions:

CryptProtectMemory/CryptProtectdata

But the issue with this is that it has two different options -

CRYPTPROTECTMEMORY_SAME_PROCESS or CRYPTPROTECTMEMORY_CROSS_PROCESS

The problem with CRYPTPROTECTMEMORY_SAME_PROCESS is that it restricts the access to a particular process (and my app has a seperate UI process which could also access the database) and the problem with CRYPTPROTECTMEMORY_CROSS_PROCESS is that it allows all the processes of the logged in user to access this data which kind of defeats the purpose

So what I want is an API where i can specify only a pool of processes that can access my data/key

I looked at similar options but nothing is applicable in my case:

Using DPAPI - This ties the encryption key to your admin login but the problem is that i don't trust the currently logged user. In fact, I want to hide this from anyone but T1 and my UI process.I understand that i can add secondary entropy, to restrict the currently logged user from accessing the data.However, I need to store this secret data on the machine. How do I protect that... Appears to be recursive problem.
External hardware or storing the key at a remote server - As the app will be deployed at many commercial endpoints(which may not have the specific hardware) and it needs to work in offline mode also(the server may not be accessible).
Store the key in the database - I need to secure the database, which is kind of recursive in my case again.

If your threat model means your code has to run on a computer you can't trust, there is no way to protect your data: it simply isn't possible.

No matter what you do, the decryption key MUST be present in the memory of the system performing the decryption in order to access the data. This means that the only possible way to protect the key is to move that processing on some trusted hardware. Note that this doesn't really protect the data: as soon as it reaches the untrusted system in clear, it can be compromised. It only protects the encryption key.

You'll have to change your threat model by accepting the possible loss and simply making it as difficult as possible to access that data.


Log in with email is more secure than a username? Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or email, and which is more secure?

With the current members table design, I have this setup:

The member ID is randomized out of 8 digits.
They have a nickname to display when they are welcomed. E.g. Welcome, $nickname.
Passwords are encrypted using bCrypt.

On top of the security which I have added into the design of the web application, which is more secure? A username and password or email and password?

Also, I do know the new standards are to the email and password, as I am seeing more of.

Give them a choice. For example, my e-mail address is fairly long whilst I usually pick short usernames; you can develop your login form to accept both.

Usernames aren't for securing accounts, passwords are. It isn't for no reason that the username is visible when entered in the browser, whilst the password is hidden. Also, users often re-use usernames, which, in contrast with password re-use, should not be a problem. And, of course, e-mail addresses were and are never meant not to be shared with anyone.

But the main problem: you don't store usernames or e-mail addresses hashed / encrypted, because you want to use them for other purposes than logging in. If someone steals the database with your hashed passwords, they will also have the usernames and e-mail-addresses. Gone is the “security benefit”!

So, forcing users to log in using only the e-mail address (and the password) or only the username (and the password) makes no sense.

Your defense should be enforcing strong passwords, and making sure you encrypt them with a strong password hashing function. Don't forget to set the cost high enough.

Additionally, to prevent an attacker that did not steal your database from renting a bot net and brute-forcing weak user passwords, restrict the number of login attempts per hour per IP address. Also, if you encounter a lot of login attempts for an acccount, block login attempts from any IP address from which no successful login for the account has been done in the past.


Can a KVM switch be vulnerable through a VGA port? I have one KVM switch that has a VGA port to connect monitor.  I want to know how to test that the KVM switch has no vulnerabilities by this port (using DDC)?

There are I2C lines in the VGA port, that are used to identify which display is connected (maximum resolutions, etc) and to control it if it supports DDC. Thus, bidirectional digital communication is possible.

On the computer side, there could be vulnerabilities in how it parses the EDID sent by the device connected to the VGA port. That could be used to execute malicious code.

On the display device/KVM side, it depends whether a smart device like the main CPU is connected to the I2C bus or if it's just a dumb one like an EEPROM (you can get away with connecting an off the shelf I2C EEPROM with the EDID data in it). In the former case, there is software that interprets the data sent by the computer over I2C - this software could have vulnerabilities and once you can achieve code execution on the KVM you are free to rewrite its firmware to persist. In the latter case, there is no smart device to compromise and you can write a malicious EDID that exploits bugs in connected computers and hope a vulnerable computer is connected.


How do we know that input to TPMs actually comes from the measured code? Suppose we're using secure boot and remote attestation to prove to a server what client software is talking to it.

What stops an attacker from doing this:

Start a legitimate copy of the client software on machine A.
Get a remote attestation challenge from the server using a modified copy on machine B.
Send TPM_Quote to machine A's TPM and forward the signature back via B.

I understand that if the attacker had code running on machine A, the PCR values would be wrong. But is code running on machine A really the only way to talk to its TPM? With physical access, can't he put his own signals on the lines between machine A's CPU and TPM?

Or even simpler, disconnect it from machine A's board and send it arbitrary input from his own hardware, just imitating or replaying a legitimate boot? How do we know that the measurements given to TPM_Extend are actually the software that's sending the messages vs. e.g. replay of something I observed with a logic analyzer?

You don't. A TPM only protects against “mild” physical attacks. For example, it does protect against plugging in an alternate hard disk and booting from that. If the disk is encrypted with a key in the TPM, it protects against taking the hard disk out and plugging it into another machine. But it doesn't protect against an attacker who can inject data into the bus between the CPU and the TPM.

Remote attestation answers the questions “am I talking with the computer I think I am?” and “is this computer running the software I think it is?”. If “the computer” is not some monolithic entity and an attacker might have tampered inside it, remote attestation isn't enough, you need local anti-tampering protection.


Public/private key auth and VPN If a server uses public/private key authentication to access SSH, will there be any advantage of restricting the access of SSH over VPN? This link describes both approaches to solve brute force attacks but would one have an advantage against the other (Security-wise) and would the combination of both have any advantage or would it just add useless complexity?

SSH and VPN provides basically the same encryption mechanisms.
Let’s imagine they both provide the same security, and you configured them well. If an attacker is able to decrypt your VPN communication in a reasonable time, it probably means that he can do the same thing for SSH in roughly the same time.

So, you did doubled your defence, but at a relatively high cost (you could have done better using a longer key for example).

Defence in depth is a good thing ; but I think that here it would be trying to double your defence at the same level, so my advice would be to focus on one of the solution (probably SSH if your are remotely login to one server only, VPN you want to connect to a network) to know and configure it well. A good defence in depth may consist in a firewall, fai2ban (as mentioned in the article)…


Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically? To communicate over a public channel, it seems often that 2 parties first use some asymmetric-encryption way to exchange a symmetric key. And then use the symmetric key for subsequent communication. The details are:

Bob generates a public/private key pair.
Bob upload his public key to a key server.
Alice download Bob's public key from the key server.
Alice chooses a symmetric key, uses Bob's public key to encrypt the symmetric key, and sends it to Bob.
Bob decrypts Alice's symmetric key.
Bob and Alice communicate with the symmetric key.

In step 4, it seems only Alice can decide the symmetric key. And it must be Alice to send it to Bob. Because if Bob chose and sent the symmetric key to Alice, any eavesdropper can decrypt it.

Is this right?

In your very specific scenario this is true. Asymmetric encryption is used in a lot of cases primarily to secure a key transfer because it is really slow in comparision to symmetric encryption.

The problem with symmetric encryption on the other hand is that the key exchange cannot be protected in an automated way when only using symmetric encryption. In your case the only person with a assymetric keypair is bob so if one wanted to send a key in a secure way, the only recipient can be bob.


Why can't the police/government shut down black market websites? I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy explanation as to why they can't get shut down.

I'm talking here about websites such as Silk Road on Tor.

So why can't the government just have these shut down?

There are a few issues:

Resources: You have to have the technical skills to track down these resources, you need to collect evidence, deal with legal issues (judge, subpoenas, chain of evidence), you may have to actual get in and do some trades to make evidence, this may require physical receipt of items (if its all just talk - is it even real? Is it all hearsay?  You need to have time, available specialists, and it has to be prioritized with other cases, some of which have a greater chance of success.

Jurisdiction: Even if you manage to track down international criminals, if they are operating across borders there may be jurisdiction issues, you may need to collaborate with various departments (which could be difficult logistically), there may be language issues, etc. International law may also make this difficult - extradition, etc. Is this even a priority in the country where it's going on?

Let's take the simple case of a very amateurish website hosted on some cheap hosting provider. This might be easy to shutdown because its in a clearly identifiable place, and the hosting provider can just turn it off if they want, which they probably would just do if a government asked - your small monthly fee isn't worth having the government hassle them.

However, let's say its hosted in a distributed manner, mirrored all over the world. There is lots of encryption, they use weird code words, a lot of the actual criminal transactions actual take place over email, icq, or something else. They use encryption, they move IPs, they host the servers in countries where the government or the ISPs don't care. It's going to be pretty hard to get access just by stumbling upon such a site. These things are often communities suspicious of outsiders (and suspicious of even their friends). So it may be very hard to prove it's worth turning off and in reality, there is no magic single-point of failure you can just turn off. Even if you took down a website, they could make another one, or use fancy peer-to-peer systems to distribute and encrypt what they are doing.


Management of server keys I plan to put an SSH server on micro-controller devices. There shall be many devices distributed in a wide range.

The identity of the server is checked with the server key. The server needs to store the private key to allow the authentication. When I copy the private key to all micro-controllers I have to generate the private key elsewhere (e.g. at my PC). This copy of the private key can be thieved.

It would be more secure when the server generates a key pair and the private key will never be copied from the micro-controller.

How can I check that I am connected to a server and not to a man in the middle?
How should I distribute this information to all clients?

The server should work standalone without a hierarchical trust infrastructure.

Edit: The microcontroller has a one-time programmable storage for one public key and built-in routines to verify a signature. There could be added a trusted platform module for private keys. But if the devices share a common private key it would be necessary to replace the key pair in all devices when the private key gets compromized. Since there is no obviously visible way to update the private key using a connection "secured" with a compromized private key it should be avoided to share the private key.

It's impossible to create a PKI when the server cannot be trusted somehow. You can generate the asymmetric key pair on the server, but you would still have to trust the public key of the key pair. Otherwise the private key may be secure, but you wouldn't know what private key to trust.

So what you should do is to create separate key pairs for each trusted device. Then you should trust the public key of the key pair. This should be performed in a secure environment. You should not distribute the private key to multiple devices as you suggest in your question.


What are the security implications of invalid free()? CVE-2009-5030

OpenJPEG: Heap memory corruption leading to invalid free

  The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5
  allows remote attackers to cause a denial of service (memory
  corruption) and possibly execute arbitrary code via crafted tile
  information in a Gray16 TIFF image, which causes insufficient memory
  to be allocated and leads to an "invalid free".

What are the security implications of the invalid free? How might it be abused or exploited in a security context?

My interest in information security eventually led to an interest in computer science in general, not the other way around: always being less interested in cause than effect.

I recently began trying my hand at writing C code. It's going alright, but still amateur at best. Many of the lower level programming concepts (e.g. heap, memory management, etc.) continue to elude me to a certain extent.

I'm not particularly interested in the specific example provided above. It's just the most recent example (although patched long ago) to inadvertently come across my desk. Anyway, it's a term I'm all too familiar with, from reading and writing reports, yet I have no more than a vague or abstract understanding of what it really implies. Despite the frequency of occurrence, it seems considerably neglected in the common literature. The reports for the CVE above mention remote arbitrary code execution, but it seems to be in addition to the invalid free – the relationship is unclear.

Similar Terms

Double Free
Use After Free

It is suggesting the call to free() would cause memory corruption, the application would crash, and open the system to a buffer overflow attack.


Should I store data on my computer Over the few months I have used two piece of software on my computer

Microsoft Office
Google Chrome

I can access all my files on OneDrive through Microsoft office without having to save anything on my desktop.
My question is, from a security perspective, is it better to solely rely on cloud storage of my data, or is it better to have a copy on my hard-drive too, even if there is no practical benefit in my day-to-day life
Thanks

I would recommend putting the data on both.
If you're worried about data theft, you're probably just as likely to have malware steal your files as you are to have malware steal your Microsoft account password (or have someone find your password in a leak somewhere because you reused it) and take your files from OneDrive.
The main reason to store it on both is for backups. If you get ransomware, or just a hardware failure, you've got a copy on OneDrive as a backup. I can tell you from experience that you're much more likely to lose your data to a disk failure than you are from malware. Backups are extremely  important.
My recommendation would be to enable two-factor authentication (2FA) on your Microsoft account, in order to help protect it, and use a password manager such as KeePass so that you can have random passwords everywhere instead of re-using the same password in a bunch of places, which is a major risk.