What -sn -Pn does in Nmap? -sn: It tells the nmap not to do any Port Scan.

-Pn:  It tells the nmap not to do any Ping Scan.

Now when I use both together like this, nmap -sn -Pn host.com.

What I saw in the terminal is Nmap is only showing that the "Host is Up".

So, my question is how it tells that the host is UP while I give the flag not to ping any host (-Pn)?. I just only want to understand what was happened behind the results

As you stated, the -Pn flag assumes the host is already 'up' and sends no packets to confirm, while the -sn flag disables port scans entirely.

In summary, what you are doing with a scan like this is attempting a reverse DNS resolution of the host, which attempts to enumerate the name of the host (in this case taking the IP and searching to see if it resolves to a domain name), as it already assumes the host is 'up' and is further instructed to not perform any port scanning.

The reverse DNS resolution is generally attempted to be determined with the help of your resolv.conf file (Unix) or the Registry (Win32).

Further information about this type of scan can be gleaned by either running Wireshark or tcpdump and monitoring the traffic generated from the scan, as well as by passing the -v and --reason flags. Both of these flags will provide additional verbosity and aim to provide more clarity about the output.

The below links are great resources for understanding the anatomy of an Nmap scan.

Sources:

https://nmap.org/book/nmap-phases.html
https://nmap.org/book/man-host-discovery.html


what harm can a malicious ca do? If ca's act in the interests of an eavesdropper, what is the worst they cold do?

I guess they can decrypt traffic not using perfect forward secrecy and impersonate the server. Is this the case?

I suppose you are talking about a SSL context: rogue CA is trusted by some client to validate the certificate issued to a SSL server.

The rogue CA can create a fake certificate and private key, to be used to impersonate the server. The client will believe that it talks to the genuine server, but in fact it talks to the impersonator. If the impersonator, simultaneously, connects to the true sever as if he was the client, this becomes a Man-in-the-Middle attack. Client and server notice nothing, but the attacker sees everything, and can alter data at will.

Data decryption and forward secrecy are relatively unrelated to that point. In a PKI, the CA does not normally see the servers' private keys. When a server owner wishes to obtain an "SSL certificate" for his server, he generates a new key pair locally and sends only the public key to the CA. Since the CA never sees the private key, it cannot use it to decrypt recorded connections, regardless of whether the cipher suite enables forward secrecy (i.e. a "DHE" cipher suite) or not. The role of the CA is to guarantee the ownership of public keys; if the client really uses the true server's public key, then the cryptography protects the connection, rogue CA or not rogue CA.

However, there are existing CA who are on the habit of generating servers' private keys themselves. They send to their customers the certificate and the private key together (usually as a PKCS#12 archive -- aka "pfx file"). They do that because it is simpler: many server administrators, with limited competence at what they do, have trouble handling private keys and certificates when the key pair was generated within their Web browser, on their desktop machine (not on their server). When the CA is rogue and generates the private key for the server, then it can keep a copy of the private key and use it to try to decrypt the data. In that case, forward secrecy will be a problem for that eavesdropping rogue CA: use of a DHE cipher suite will force the rogue CA to go to the trouble of running a fake server.

Since MitM attacks are still quite feasible, a rogue CA is a huge problem, and use of forward secrecy is not an adequate mitigation.


Secure browsing on any device without limiting the browser The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation.

Employees depend on an open internet for research purposes (adblockers are a no-no), however, I can't allow the possibility of browser-spread malware within the organizational network. Employees must be able to use either their own device or their office workstations and browse the internet freely via our network.

What kind of solution would work best here to isolate the act of browsing from my internal network? browsing via VMs? sandboxing? containers? Has anyone had any experience with implementing such a solution?

You are ok with the endpoints getting infected, but you don't want the infections to spread. This has been done before in a variety of ways.

Network segmentation:

personal devices (uncontrolled devices) do not get access to anything within the network except for the internet
if personal devices need access to company resources, they do so from a public portal
all internal, controlled devices that can browse the internet can only access certain resources within the network
have reinforced network infection detection and rapid response procedures to isolate affected endpoints

I work with a lot of universities and we do this because we do not have control over what everyone does/can do on the network.

Application segmentation:

No internet browsing is allowed in any form from any device (blocking ports/protocols on the perimeter)
Browsing can only be done through remote desktops/virtual application servers, which are themselves segmented off from the network
The remote/virtual environments are rebuilt as soon as the person exits

I have done this at a financial services company. This makes it possible to allow for BYOD, because the user just logs into the remote server if they want to browse. It's an annoying extra step, but far more secure. Virtual application servers can make this far more user-friendly (the desktop icon is a link to a remote virtual sandbox), but only if you have control over the endpoint (not so easy on BYOD).

VMs, sandboxing:

Sandboxing and VMs require that you can enforce those things even on personal devices, which is not going to be easy, and it is easy to have gaps in protection unless you also end up doing one of the above.


Check Expired Token (after a visit) I'm implementing a model which I'll have to reupdate the users, so I want to deliver a unique link to the users and after confirmed the update, I expire that link, so I prevent reusing that link.
How do I generate a random secure token for that?
The performance of checking if the token was already visited isn't a problem, it will not affect a huge number of users.

You have to update something in the user database, otherwise the whole operation makes no sense.
So, it makes sense to use a token that encodes that information. This way, the token automatically expires itself.
For example let us say that I want those users that have no valid birth date archived to update their birth date (or credit card expiration or whatever). I can set the birth date field to NULL or to a special date such as 0000-00-00 00:00:00, or to the existing, invalid, date (I have some way of determining it's invalid; it's the same way I determined which uses to send the token to).
Then I can generate a token from the user, the birth date, and a secret:
token := user.userId+':'+Crypto.SHA512(user.UserId + user.BirthDate.toLocaleDate() + 'S33kr1t')

So my token would be 31337:10952b847b3c5be46bdbb9c67b2f050f92f59f87cd1af5baf459012593d4ff1639c38a60c2010ee9adeb727d4025897ad9fb25a4d4f46ab8f22f0a64e13f8c94 (okay, maybe SHA-512 is a bit of an overkill).
Users send me the token and I authenticate them for the purpose of updating the information (I might require also to enter their password just to be sure). I can first verify that the token is still valid by retrieving the user info and re-calculating the token. If the supplied token and the regenerated one are the same, the token is valid.
When they update the information, the token is automatically invalidated because it will now be generated from different data.
You can also introduce a time factor by adding the timestamp in the token and in the hash:
31337:202103041715:f3dafa6e87a23baf56ed7e6bc...

Now you can first determine if the token is "too old" (reject immediately with a very low cost, no database check required).


How to obfuscate a assemblies binary compiled with .NET framework? How to obfuscate a binary compile with .NET framework? Tools such as Ebowla and Pecloak.py will encrypt it but the program won't run. Even UPX can't pack it. Wondering are there any ways to obfuscate it?

There are many obfuscators around, free ones too, just google for ".NET obfuscators". Visual Studio, the IDE from Microsoft, has one integrated, too. If you want to start out, I would try this one first.

Typically these obfuscators take the IL (Intermediate language), rename variables, create obscure control structures, and use more functions to make things complicated to read.

However, the code will still be easily "decompileable" with the respective tools, it will just be less readable by humans. General consensus is, AFAIK, not to obfuscate, as this is something like "Security by obscurity".


Does accidentally pasting password into browser URL field send it over the network? Suppose you type or paste some text from the clipboard into the url bar in Chrome browser (but you don't press ENTER).  After deleting the text and changing your password, just to be safe, you wonder -

Did that information get sent to Google?

In most browsers, yes. This happens because the browser sends the address bar text to a predictive service (commonly Google's) for search suggestions. Some browsers (eg, Firefox) ask before doing this (just the first time).

How dangerous is this?

Depends on where your browser is sending this suggestion text and how paranoid you are. Eg, Google should use:

https://www.google.com/complete/search?client=chrome&q=%s

And you note that this uses HTTPS, so no one else on the network can see your password. I can't imagine that any browser would be configured by default to use a suggestion service that doesn't use HTTPS, but if any did, you'd have to worry about your password thus being visible to anyone listening on your network.

But even with HTTPS, your password can certainly appear in server logs at Google and employees could potentially see it. That said, realistically, there's not a great deal of risk. Google's got far too high of a volume of requests to pay attention to any in particular, nor is there any way to know that any given query is a password. So it's very understandable that you might pass it off as so low risk that it's not worth changing your password (although it is a non-zero level of risk). I talk about Google here specifically, but the same applies to other major search engines, too.


Securing RFID membership cards Let's say I issue RFID-enabled membership cards for events. People can have their credit cards, personal ID, etc tied to this membership card. When they come to my events, they can use this card to pay for things, verify age, etc.

From what I understand, RFID cards are fairly trivial to duplicate and thus steal remotely.

What are reasonable things I could do to protect against this?

An idea I had - record a changing nonce on the RFID card. Every time we scan the card, we check if the nonce matches what we have in the database. If it doesn't match, that card is marked as compromised. If it does match, then we authorize the transaction, overwrite a new nonce to the card, and save that to the database. (in addition to things like checking that the card doesn't look counterfeited)

You can issue shielded containers for the cards. These are plastic sleeves that feature a thin sheet of metal on either side of the sleeve, making it impossible to scan the card. When the user needs to authenticate or verify, they can simply take the card out. There are more luxurious shielded containers that separate the plate from the card when pinched together, making the process easier and quicker.

Of course, this does not offer any protection to users willfully allowing their card to be duplicated.

The problem with your suggested solution is that when a counterfeit card is used before the legitimate one, the counterfeit will maintain functionality while the legitimate card will be marked counterfeit. At best this will serve as an indicator the card being offered is either copied or a copy.

I'm afraid that is as much as you can do to protect a static token.


EAPOL messages in different WPA handshakes I have a pcap file with two captured packets only.

Time            Protocol    Info
0.000000        EAPOL       Key (Message 3 of 4)
2934.200222     EAPOL       Key (Message 2 of 4)

I already know, messages 2 and 3 are sufficient to launch a password recovery attack. I'm still confused about the order: Message 3 was captured long time before message 2. These messages seem to appear in different handshakes. Nevertheless aircrack found a valid
handshake.

Encryption

WPA (1 handshake)

I thought EAPOL messages must appear in same handshake because of exchange of nonce values.

Edit: I have SSID and MAC addresses as well.

Let's recap, what is necessary information to retrieve the psk:

Nonce of AP (included in EAPOL 1 and 3)
Nonce of station (included in EAPOL 2)
MAC address of AP
MAC address of station
MIC (included in EAPOL 2)
SSID

This means you need to have at least

EAPOL 1 and 2 or
EAPOL 2 and 3

of one handshake to be able to find the psk with a dictionary attack.

In my opinion this has to be a bug in aircrack-ng to report the two packets in your capture as one handshake.

Although aircrack-ng reports them as one handshake, it will not work, even if you give the correct passphrase, because the nonce from EAPOL3 was not the one used in the calculation of the MIC transferred in EAPOL2.


How can I handle user authentication and sessions in my app? I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. Everything with AngularJS is client side, so I was wondering how to set the user ID without anyone being able to just change it and pretend they're someone else.

The way I'm thinking of doing this is that when a user logs in on my app, I create a random string on my server and hash it. I then send it to the app and store it both in the app's local storage and in the database on my server, and I have the app include it with all requests. This way, when someone makes a request I can just check that string they send is the one in my database; when a user logs out, I clear local storage and remove the string from my database. I create a new string when they next log in.

Is this a good idea? Maybe this is the normal way to go, but I couldn't find any free authentication solutions on the Internet. Since this app will probably have a lot of traffic, I'm not willing to pay for every connection to my server.

The system you're describing sounds a lot like standard cookie based authentication/session management systems, in that you authenticate the user and then provide a session token to them which allows you to identify requests from that user for the duration of their session.

Whilst you could implement this manually, I would recommend against it, as there are quite a few potential pitfalls and things to know about getting session management correct and it would be easy to get it wrong and leave your application vulnerable to common session management attacks.

you haven't said what you're using to provide server-side logic for your application but for example if you're using something like Node.JS, then there are session management modules available in npm (for example Mozilla Client Sessions).

In general if you search for 'session management (your server-side framework)' I'd expect you'll find a number of modules which implement the needed functionality


Can my employer see my browsing history with work account on my personal device I was using Edge on my personal device at home browsing stuff and realised I was logged in on Bing.com with my Microsoft work account. I cleared my browser's browsing history and also Bing's browsing history for my work account. I am sure I saw some ads while I was browsing in some websites.

I am using Microsoft products (Word, PPT, Excel and...) on my personal laptop with my work account. In my PC's Setting under Accounts my work account was connected as well as under Email & accounts at the time. Under Privacy > Activity history the "Store my activity history on this device" and "Send my activity history to Microsoft" was ticked and my work account was under Show activity from these accounts and it was On.

I also had my personal account in the Edge browser and the Sync was on. I removed my work account on my personal laptop before using my work laptop.

I don't use my personal laptop often and I had no Idea my work account was everywhere. Does my work know about my browsing history? Thanks.

If its a personal laptop, they cant get your browsing history. Also, even if your are signed in to your work account, your search history on bing cannot be shared as confirmed by Microsoft.

"Your specific work search history isn't shared with your company or other companies, including Microsoft."

Reference:
https://support.microsoft.com/en-us/office/how-microsoft-search-in-bing-helps-keep-your-info-secure-cbce46ae-bb1f-4d0e-86f1-5984f4589113?ui=en-US&rs=en-US&ad=US


How can a scammer scan your data if you're redirected from their fake website to the legitimate website? Coming from this comment from this question at Travel StackExchange.

My question is: How can the scammer still scan a user's data when the user registers their account on the legitimate site, after being redirected from the fake site?

So, suppose I go to homeaway-eu.com. I'm then redirected to homeaway.com. Now I search for a house and book it, after entering my data. How can the scammer get this information that I entered, such as my payment details and contact infos?

Edit: I think the answers below are coming from the point of view of the question that I linked above. My question is about the supposition that I wrote, not the exact case from Travel StackExchange.

If I understand that comment and question correctly, the scenario is:

There is a legitimate domain, homeaway.com
There is a site registered by a presumably malicious party, homeaway-eu.com
At the time of the question, homeaway-eu was simply a redirect to homeaway.com
You are asking specifically about how opening a browser and going to "homeaway-eu.com" could help an attacker, considering that in doing so, you immediately end up at the legitimate homeaway.com.

You are correct that any information you enter on the legitimate howeaway.com should not be accessible to an attacker. Having a redirect to the legitimate site does not allow any shenigans on data entered on the legitimate site. However:

If in the future an attacker Eve sets up a data entry form on homeaway-eu.com, when then submits the data to homeaway.com, she can collect the data. Since the evil domain submits to the real domain a user might not even notice, especially if the user is accustomed to going to homeaway-eu.com instead of the real site.
As the comment you linked points out, Eve could start sending mail as eve@homeaway-eu.com. A user might not be suspicious since going to howeaway-eu.com goes to the expected site. There is no address spoofing involved so this will basically be impossible to detect. As far as email providers are concerned, Eve has a legitimate domain which she owns, it just happens to be similar (to humans) to a completely different domain. This can aid in social engineering and phishing.
If Eve knows about an exploitable brower bug, she could easily set up a "drive by" attack on a user who visits her site, prior to redirecting to the real site. The user would be none the wiser as they end up on the correct site.
If Eve is only collecting IP addresses for future attacks (or subpoenas, if Eve is working for a government agency, and it turns out the "legitimate" website is questionable itself) then the redirect webpage is all she really needs to accomplish this task, with no further action required.
Perhaps the redirect site reacts to specific IP addresses or ranges, or perhaps it looks for specific tracking cookies, and does something different based on that.

There is probably more I missed. In general, going to an attacker-owned webpage is not a good idea no matter how benign it may appear.


Preventing outgoing Portscan/SYN/UDP Floods in the datacenter We are a VPS hosting company that have servers housed in a datacenter in Germany. Currently we are receiving multiple take-down requests because customers are ports scanning or attacking servers outside our network and we are looking for a way to prevent this, our old DC just blocked the IPs automatically on their end so we could take action but the new DC doesn't do this.

We took a look at the following options:

Nodewatch, unfortunately that only works with OpenVZ and we use KVM.
UTM Firewalls might do the job but I can't find what we are looking for in the manuals (and I'm not sure what it's called)
A Linux firewall distribution, same thing as a hardware firewall. Can't find the right naming.

What is the right way to prevent outgoing attacks since most firewalls only offer protection for incoming attacks?

What is the right way to prevent outgoing attacks since most firewalls
  only offer protection for incoming attacks?

To throttle or drop traffic burst I've tried different modules in iptables. The best of which was hashlimit module. I use it in FORWARD chain.

For example, to prevent outgoing TCP SYN traffic burst and limit it to 60 request a minutes use:

iptables -I FORWARD -p tcp --syn -s 192.168.1.1/24 -j DROP
iptables -I FORWARD -p tcp --syn -s 192.168.1.1/24 -m state --state NEW -m hashlimit --hashlimit 60/minute --hashlimit-mode srcip --hashlimit-burst 10 --hashlimit-name portscan -j ACCEPT

The order of commands is important. This will slow down the connections outgoing TCP SYN packets. To see how hashlimit operates in action, run:

while sleep 1 ; do cat /proc/net/ipt_hashlimit/tablename; done

The other way is to use tc.

Disclamer: I haven't tested the exact above command and it is just for a sample.


Decrypt from cipher text encrypted using RSA I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is

Public Key:

MIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgHfIm5pYrEMUuJUevmED6bUFx8p9G/5vF+ia+Qnrn8OeMpIJ/KS2nqDLxXx/ezNKlFArWK1Wer4diwQJ2cdiCqNorubAgnOXMV+/FsiATQjMT2E2lI9xUWqqNq+PfgyCPILRliNHT/j2qOvAOHmf3a1dP8lcpvw3x3FBBKpqtzqJAgMBAAE=

Private Key:

MIICWAIBAAKBgHfIm5pYrEMUuJUevmED6bUFx8p9G/5vF+ia+Qnrn8OeMpIJ/KS2nqDLxXx/ezNKlFArWK1Wer4diwQJ2cdiCqNorubAgnOXMV+/FsiATQjMT2E2lI9xUWqqNq+PfgyCPILRliNHT/j2qOvAOHmf3a1dP8lcpvw3x3FBBKpqtzqJAgMBAAECgYAJ1ykxXOeJ+0HOvl/ViITCol7ve6e5F1dXfKPI9NqDL5Pn+3oN7hLKEvN+btqoNBBLJcR7OQeMZtDs3AJQJvXIqN4UJUBf6fUshhdf9Y5MSpSqAjlqLjted2uw8xuL8gDmOYWV0yjeivvb4Qf7Vl7jAJSBwnlVsGCKmmBXDn+EoQJA63MnjKX1kWVb44HmXX+IDmgTQE6Ezpqzxbjf7ySdxYLb4yfZR+i5oEE+xtqEO5xR4vkEV5s1MuXjNdJHTkc2XwJAgj0HsrIGFw2DgyWF2Rc1w5BbtXH0+GrLTP6+kOuLw1eAZbDjQghzRGmhtdrl38ZtYZMdsrxE2HXDihsdjj2oFwJAl6470FQp+1z88XgB3EIIeJ97p3XuANuQ7NPJD9ra+R7wYUqOo9C9pQvjUV/8yBpQdpRNw9JtVzjaQxYQcdFWqQJAALclG64uqmHAny/NlGu0N+bLGiwOFG9BvqKHmXQxyFjqs6RNG0fAmleaM82IBbqpTyfnudue5TGAaXnMp8Ne8QJAKx/zf5AKPTkqZ7hBQ3IYfx7EbS2f6lelf8BNC+A/iz4dxLgx7AupPtoaKZC0Z6FWpm2s0HNvYhleU3FcAfKRig==

Encrypted string:

MpTF1+cqa23PdxQ6EoG9E77jfRJGYjORc4omawTg/g8jtUDZNNEeEr3waadTSLjQAfmJO94fpaA145yanoU9khrzCd/nAGIIAVwMC67UnsX+XY6dOEZMo41Z0dU1n42rUtkdXgldHXR1SQXaeDyjRnMj/mMMreNdykl8b4vNVPk=

I am able to retrieve all the keys, But I am not able to  view encrypted content. Help me to decrypt with procedures.

Start with saving the three parts respectively to pub.b64, priv.b64 and blob.b64:

$ base64 -d < pub.b64 | openssl asn1parse -inform DER -i

    0:d=0  hl=3 l= 158 cons: SEQUENCE
    3:d=1  hl=2 l=  13 cons:  SEQUENCE
    5:d=2  hl=2 l=   9 prim:   OBJECT            :rsaEncryption
   16:d=2  hl=2 l=   0 prim:   NULL
   18:d=1  hl=3 l= 140 prim:  BIT STRING

Clearly not an X.509v3 certificate. No matter, we don't need that to decrypt. openssl dumpasn1 isn't up to the heavy lifting here, try Peter Gutmann's dumpasn1 to peek inside the bit string:

$ base64 -d < pub.b64 > pub.der
$ dumpasn1 -al pub.der

   0  158: SEQUENCE {
   3   13:   SEQUENCE {
   5    9:     OBJECT IDENTIFIER rsaEncryption (1 2 840 113549 1 1 1)
         :       (PKCS #1)
  16    0:     NULL
         :     }
  18  140:   BIT STRING, encapsulates {
  22  136:     SEQUENCE {
  25  128:       INTEGER
         :         77 C8 9B 9A 58 AC 43 14 B8 95 1E BE 61 03 E9 B5
         :         05 C7 CA 7D 1B FE 6F 17 E8 9A F9 09 EB 9F C3 9E
         :         32 92 09 FC A4 B6 9E A0 CB C5 7C 7F 7B 33 4A 94
         :         50 2B 58 AD 56 7A BE 1D 8B 04 09 D9 C7 62 0A A3
         :         68 AE E6 C0 82 73 97 31 5F BF 16 C8 80 4D 08 CC
         :         4F 61 36 94 8F 71 51 6A AA 36 AF 8F 7E 0C 82 3C
         :         82 D1 96 23 47 4F F8 F6 A8 EB C0 38 79 9F DD AD
         :         5D 3F C9 5C A6 FC 37 C7 71 41 04 AA 6A B7 3A 89
 156    3:       INTEGER 65537
         :       }
         :     }
         :   }

That's more like it, we have what appears to be a 1024-bit modulus, and a likely public exponent of 65537.

The key is a base64 encoded normal RSA key in DER (binary) format:

$ base64 -d priv.b64 | openssl rsa -inform DER > out.key
writing RSA key
$ cat out.key
-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgHfIm5pYrEMUuJUevmED6bUFx8p9G/5vF+ia+Qnrn8OeMpIJ/KS2
nqDLxXx/ezNKlFArWK1Wer4diwQJ2cdiCqNorubAgnOXMV+/FsiATQjMT2E2lI9x
UWqqNq+PfgyCPILRliNHT/j2qOvAOHmf3a1dP8lcpvw3x3FBBKpqtzqJAgMBAAEC
gYAJ1ykxXOeJ+0HOvl/ViITCol7ve6e5F1dXfKPI9NqDL5Pn+3oN7hLKEvN+btqo
NBBLJcR7OQeMZtDs3AJQJvXIqN4UJUBf6fUshhdf9Y5MSpSqAjlqLjted2uw8xuL
8gDmOYWV0yjeivvb4Qf7Vl7jAJSBwnlVsGCKmmBXDn+EoQJBAOtzJ4yl9ZFlW+OB
5l1/iA5oE0BOhM6as8W43+8kncWC2+Mn2UfouaBBPsbahDucUeL5BFebNTLl4zXS
R05HNl8CQQCCPQeysgYXDYODJYXZFzXDkFu1cfT4astM/r6Q64vDV4BlsONCCHNE
aaG12uXfxm1hkx2yvETYdcOKGx2OPagXAkEAl6470FQp+1z88XgB3EIIeJ97p3Xu
ANuQ7NPJD9ra+R7wYUqOo9C9pQvjUV/8yBpQdpRNw9JtVzjaQxYQcdFWqQJAALcl
G64uqmHAny/NlGu0N+bLGiwOFG9BvqKHmXQxyFjqs6RNG0fAmleaM82IBbqpTyfn
udue5TGAaXnMp8Ne8QJAKx/zf5AKPTkqZ7hBQ3IYfx7EbS2f6lelf8BNC+A/iz4d
xLgx7AupPtoaKZC0Z6FWpm2s0HNvYhleU3FcAfKRig==
-----END RSA PRIVATE KEY-----

If you decode that key:

$ openssl asn1parse  < out.key
    0:d=0  hl=4 l= 600 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim: INTEGER           :00
    7:d=1  hl=3 l= 128 prim: INTEGER
                      :77C89B9A58AC4314B8951EBE6103E9B505C7CA7D1BFE6F17E89AF9
                       09EB9FC39E329209FCA4B69EA0CBC57C7F7B334A94502B58AD567A
                       BE1D8B0409D9C7620AA368AEE6C0827397315FBF16C8804D08CC4F
                       6136948F71516AAA36AF8F7E0C823C82D19623474FF8F6A8EBC038
                       799FDDAD5D3FC95CA6FC37C7714104AA6AB73A89
  138:d=1  hl=2 l=   3 prim: INTEGER           :010001
  [...snip...]

and compare with the dumpasn1 decoding of the public key, you can see that they share a 1024 bit modulus and exponent, so it looks like the public and private key match. Good.

So, decode your encrypted data:

$ base64 -d blob.b64 > blob

and decrypt it:

$ openssl rsautl -decrypt -inkey out.key < blob > decrypted
$ hexdump decrypted
0000000 0355 1739 575b 5434 ccc5 bec7 e70a 0d44
0000010 a4a9 11d4 166c 3423 4e36 e657 2fea ef53

That's 32 bytes (256 bits), quite likely a key used in a symmetric cipher to encrypt more data, since you can only encrypt relatively small amounts of data with RSA

Good luck with the next part ;-)


Digital signature: How do I know what I'm signing? Suppose I have to sign a PDF form. If I'm using (say) Acrobat Reader and a hardware security token, at some point I will be prompted for a PIN to authorize the token to sign the document.

  How can I be sure that the document which is being sent for signature
  to the token is the same document that is being displayed to me?

If my copy of Reader, or some part of the communication channel between Reader and the token is compromised, it seems to me that I might end up signing anything at all.

It seems to me that for not to be spoofed in this way I need a whole system, including the OS and the document display client to be trustable. A general purpose computer will not do.

I would appreciate any pointers towards actually existing devices or research towards solving this problem

In general, you (or anybody else with your public key) can verify a signature on another machine, which is generally good enough to ensure that the data being signed wasn't tampered with. You could also try calling the signing code directly, passing a byte buffer that you control, and making sure that it verifies the way you'd expect.

I don't know exactly how PDFs store digital signatures, so I'm not sure how you'd go about creating or verifying one manually (without using the software that you don't trust). However, there are definitely multiple PDF programs, so maybe you can use them to get some degree of additional trust.

With all that said, exploiting something like this would be very difficult. An attacker would need:

A document (or possibly other data blob) that they want you to sign.
A way to get this data onto your computer, and compromise your signing tool so it gets substituted for the data you meant to sign.
A document that you will (attempt to) sign, but that will accept the invalid signature.
A way to get the spoofed signature back from you so they can add it to the maliciously-chosen data.

This is all possible, but it's not generally going to be a significant threat. If you want to be sure, verifying the signatures on your data, using a different computer and ideally a different program.


Which Cryptography algorithm is used in WhatsApp end-to-end security? I have a presentation to make on Social Network Security. I have been doing some research regarding this.

I did a lot of searching, but was unable to find the Crypto Algorithm used by WhatsApp for end-to-end Encryption.

WhatsApp partnered with Open Whisper Systems for the cryptographic portions of messaging. The process involves a variation of Off the Record (OTR), Perfect Forward Secrecy (PFS), and the Double Ratchet Algorithm (DRA).

Open Whisper Systems has blog posts on cryptographic ratcheting, and their Signal Protocol Integration for WhatsApp.


Can I use 2 factor authentication for shared accounts? Is it possible to use SecurID 2FA for Highly Privileged shared accounts? I am currently using CyberArk to vault passwords for privileged accounts. when I checkout a password, I would like to make sure that this account has to 2FA to the endpoint. the problem that I see is that all of my admins share these accounts. To me, that means that they also have to share a token. this is not possible, because they are distributed across the country, and a bad practice anyway.  Can their individual tokens be mapped to other vaulted accounts so that they can 2FA to the endpoints? is there any other solution?

Shared accounts are themselves a bad practice, because you cannot know who is actually doing the access. Each "administrator" should have his own account, to which you would grant administrator privileges.

2FA is about using two authentication methods concurrently, working over two distinct categories. The categories are: "something you know", "something you own" and "something you are". Knowledge can be shared (i.e. two different persons may know the same password -- a bad practice, as I said above, but still feasible). The two other factors are intrinsically bound to physical individuals; for instance, if using a physical token ("something you own"), then that token can be in the hands of only one person at a time, which is the whole point.

Therefore, if you use two authentication factors, then at least one of them cannot be shared. It follows that 2FA is intrinsically incompatible, at a conceptual level, with a shared account. The consequence is that if you succeed in having a shared account, then you are not using 2FA (you might get a cheap plastic imitation of 2FA, but not the real thing).

Don't use shared accounts. Shared accounts are evil.


What's the difference between an application-level and circuit-level gateway? From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic.

But I don’t really see the difference--beyond the obvious fact that application-level gateways seem to operate on a higher level of the network protocol stack. Can someone flesh out the key differences?

Good question. Let's think about it this way:

You're going to take a basic maths exam and the sign on the door says

  "No Masters-level students. No calculators allowed."

A normal inspector (firewall) would ask you for a student ID to make sure you're not an Masters student, then they'd let you in. A Masters student who looks just like you comes to the door, the firewall would remember that he checked him a couple of minutes ago and he'd let him in, therefor breaking the exam's security.

After checking your identity, a circuit-level gateway would've given you a watermarked paper that says you've been checked, so when your doppelgänger has to show the watermarked paper or else he'd have to go through an ID check, and his true identity as a Masters student will be revealed.

An application-level gateway, however, would've frisked you (DPI) looking for a calculator. As a calculator (application-specific command) isn't part of your identity, so it's something that sits on a higher level that the circuit-level gateway doesn't understand.

An application-level gateway understands all the protocols it supports, it doesn't care if your IP is whitelisted on the circuit-level, it can read your FTP traffic and figure out when you use the delete command and drop that exact packet. It can dissect your HTTP traffic and stop you from sending POST requests.


How to read certificate chains in OpenSSL I'm trying to understand how to read the output of OpenSSL commands.

Currently, I am trying to understand how Certificate Chains work.

When I give the command (using a standard ca bundle)

openssl s_client -connect www.google.com:443 -CAfile ca-bundle.crt

I get

CONNECTED(00000003)IzJZ5dQUbs0pjW3tAgTAMBgNVHRMBAf8EAjAAMB8GA1Ud
depth=3 /C=US/O=Equifax/OU=Equifax Secure Certificate AuthorityW
verify return:1BAgIwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3BraS5nb29n
depth=2 /C=US/O=GeoTrust Inc./CN=GeoTrust Global CAyd2eyQKKxh3vJ
verify return:11cY/EIksH6hXF6EFnS+8vWZs8Ka8FyQi76cUOSqk2ed2DvOeT
depth=1 /C=US/O=Google Inc/CN=Google Internet Authority G2Bii82d
verify return:1UuiFeti7EjUXr0E58NMnBw39Zv6nZaSbppvlLR/jRBKCRB7jB
depth=0 /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
verify return:1sfjYdq1K94yLkfe6mUR7Go6JUkD/eB/Aq9KKoSJbJEvvjGIiJ
---MkQ==
Certificate chainATE-----
 0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.comcom
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---
Server certificateCipher is AES128-SHA
-----BEGIN CERTIFICATE-----it
MIIEgDCCA2igAwIBAgIIMPM39zVrKUkwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE
BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
cm5ldCBBdXRob3JpdHkgRzIw....
.....

My question is in regard to the Certificate Chain section.

Which is the Root Certificate? The first one listed or the last? Why are they all reported? Isn't one validation enough to move on with?

0 s:/C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
   i:/C=US/O=Google Inc/CN=Google Internet Authority G2
 1 s:/C=US/O=Google Inc/CN=Google Internet Authority G2
   i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
 2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
   i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority

  ...
  Which is the Root Certificate? The first one listed or the last?

None of these. It only shows which certificates are sent by the server, i.e. the leaf certificate and the intermediate (chain) certificates. The root certificate is usually not sent (and would be ignored if sent) since the whole idea of trusted path validation is that the root is trusted because it is locally known.

In this case the trust path can be validated if the user has the certificate for 'Equifax Secure Certificate Authority' as a local trusted certificate and if this certificate can be used to validate the signature of certificate#2 (GeoTrust Global CA), then certificate#2 can be used to verify signature of certificate#1 and certificate#1 to verify signature of certificate#0. Note that trust path is only one part of the certificate validation. You also need to add validation of the subject (i.e. matches the subject www.google.com the URL you've tried you access) and checks for expiration and revocation.


How do I convince others of the importance of password management? I just got married, and my wife and I are in the midst of combining finances, etc.

We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character password with LastPass.

  No, don't do that! How can I access it if you use LastPass? Just make it something simple to remember!

We compromised on that one - I generated a password that we both agreed on that's reasonably long with a mix of characters, and yet it's something that she can remember off the top of her head. (Never mind that with LastPass you can share passwords to various accounts, without either person actually even knowing the password!)

My wife definitely fits into the "average user" category as opposed to the "power user" category. I've been able to convince her to turn on two-factor auth whenever possible, but for the most part she is unwilling to trade convenience for security.

Obviously, it doesn't need to be this way. I use LastPass religiously, and she sees me use it regularly to generate and use passwords. I'm in her ear fairly regularly about the importance of password security (see various institutions getting hacked - which I don't really believe were anything sophisticated, just poor IT infrastructure because of management thinking IT is not "value-added"), etc. She (and a lot of my other friends) are quite content with having the standard 4 passwords for all their websites. They don't really see what the point is of having more difficult passwords. For my wife, it's "I'll set up LastPass some other time, it's not really that important anyway." I think everyone on this SE would think that it truly is that important.

I really don't understand what the hang-up is with using a password manager, but then again it's so obvious to me why nobody should leave home without one. How can we computer-savvy folks educate/convince/etc the non-computer-savvy ones we care about to take their own security seriously?

Your wife is not using LastPass because she has better things to do, not because she's incapable of realising its utility.

You would think that once people properly understand the risks they're exposed to (which requires a serious amount of education), they would automatically start to comply with whatever security advice is thrown their way. Well, this assumption has been proven wrong multiple times. See Herley's 'So long and no thanks for the externalities', which has a couple of examples of wasteful security, and Beautement and Sasse's 'Compliance Budget' for a general theory of how humans behave with regard to security.

In economics of information security, there are several examples of people willingly taking risks because it saves time they need for other tasks, or because they perceive potentially negative side-effects to complying (such as being locked out, or embarrassed in front of someone else).

Hence, rather than insisting on your wife doing what you think is good for her, identify her needs, her priorities, her worries and her actual problems. Then, deploy a tool that does work for her (if there's any) and work with her to make sure she knows how to use it and perceives its utility and limitations properly.

For instance, I don't use password managers because I use some of my accounts on so many devices that I have to know the passwords, because I have some passwords that have to comply to such silly policies and be changed every other day (and I hate having to resync my passwords on each device), I don't trust online password stores the least in the world, and because some of my devices are targeted often enough that I don't want them storing many passwords. Most of these problems I have are probably addressable one way or another, but I don't want to lose a day of work setting up processes that go against my habits. And yet, I'm a security engineer. In conclusion, most users will prefer appropriateness and value to security in most decision-making situations.


Why is SHA1 considered less secure than often necessary? Of course 'often' is pretty subjective, but I've seen a lot of reports/articles that describe SHA1 as something, typically, not secure enough for use in the storage of passwords. An example:

  If it’s just SHA1, there is no window… If it’s bcrypt, you have time to run away and change all your passwords.

The only time I've seen a successful SHA1 'hack' is when the password is trivial to run through a dictionary (e.g. password123).

What's unsecure about SHA1?

I agree with @KanekiDev and would like to highlight that #1 holds even now, let alone in the near future.
According to ArsTechnica, a single person using equipment worth less than 30,000 dollars managed to recover 85% of the passwords leaked in the Linkedin breach in a day. We are talking about millions of SHA-1 hashed passwords found in a single day.

Using a single Sagitta HPC Brutalis packed with eight Nvidia GTX Titan X graphics cards, I managed to recover 85 percent of the passwords on the first day, despite the fact that I was cracking so many passwords so quickly that the whole system slowed to a crawl.
Working with the rest of the Hashcat development team, we managed to reach 88 percent by the end of the third day, and we crossed the 90-percent threshold on the fourth day. This all happened a full two days faster than when working with the first LinkedIn dump, which contained only a small fraction of the number of hashes. On the sixth day, we teamed up with rival password cracking team CynoSure Prime to close out the effort at a solid 98 percent, cracking a total of 173.7 million passwords.

Source
If you think that only researchers can afford that hardware, you're wrong. Think about a team of crackers spending 30,000 dollars on that setup just for finding these passwords. In a week, they find 100 million passwords, which they can sell for $0.01 each. 100 million passwords * $0.01/password= 1 million dollars. That's a pretty good ROI (return on investment), isn't it?
You may say that those were weak passwords. That's probably true, but as @Matthew pointed out,

Unfortunately, most users do pick weak passwords which will appear in dictionaries, so this is a viable attack method.


Requirements Placed on a User of a FIPS 140-2 Validated System Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be done with Approved algorithms.

FIPS 140-2 places very stringent requirements on the cryptographic module, and it places a very stringent test process on that cryptographic module.

What is unclear to me is when those Approved algorithms must actually be used.

For example, I cannot telnet into the device; I must use SSH. This makes perfect sense.

Similarly, I am forbidden from using HTTP to access the device's web interface. I must use HTTPS. Again, this makes perfect sense.

There are restrictions on the way I can perform remote authentication when logging into the switch. And so on and so forth...

On the other hand, when I configure syslog on the device, it is not forcing authentication and encryption upon the traffic it sends out to the collectors / relays.

Likewise with SNMP. The only thing it requires of me is that I disable SET operations. You can read from the device or receive traps all you want with no authentication or encryption. I don't even have to use SNMPv3 (which makes authentication and encryption available). It's perfectly happy to allow a read using SNMPv1 with the plaintext "public" community string.

If one wants to operate a FIPS 140-2 validated device in a FIPS-compliant manner, how do you know when you must use the Approved cryptographic algorithms the device makes available?

Every FIPS 140-2 device must have a publicly available non-proprietary Security Policy document which is obtainable from the FIPS 140 program web site (CMVP - http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm).  Although some Security Policies are far better written than others, there is a minimum requirement for these documents that should explain how to get a module into a FIPS approved mode of operation and what cryptographic services are available while in this mode of operation.


Search on email domains using the Have I Been Pwned API? Using the HIBP API, is it possible to search for email domains? I know that HIBP has around 5 billion email records. All I want is a count of gmail.com or yahoo.com records.

I know that I can check my own email id and it seems my email id has endured around seven data breaches. I did check out on my own using the Python API, but when I use the string wildcard *, the API returns an empty result.

You cannot do this. You can only get all breaches for an entire e-mail.
If you want to get all e-mails from eg. Gmail you can download some breaches and just grep it.


SSL for only parts of a website... How does it work? I understand that CAs issue certificates based on common names (CNs) like www.amazon.com and that certs are not based on URLs like www.amazon.com/stuff.

How is it that when I go to www.amazon.com, it is not secured and when I press Log In, the connection is now SSL-secured?  I could understand if the login link redirected me to a site like login.amazon.com where there was an SSL cert for the sub-domain... But the login page on Amazon starts with www.amazon.com which is not secured when you go to it without logging in.

This is the exact login link:

https://www.amazon.com/ap/signin/186-8075346-0703735?_encoding=UTF8&openid.assoc_handle=usflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fgp%2Fyourstore%2Fhome%3Fie%3DUTF8%26ref_%3Dnav_signin

When you access http://www.amazon.com and click Login, it redirects you to https://www.amazon.com which is secure.

Note: This is susceptible to sslstrip and they should be forcing SSL/TLS using HSTS.


Public guest user for PostgreSQL? I manage an open-source software project that relies on data that I am happy to share with the public. The software is hosted on github.com, but the dataset is too large to host there. It is easiest to keep the dataset in the form of a relational database, currently stored on a PostgreSQL server in my university lab. I'm assuming it would be considered bad practice to create a read-only "guest" user account on my PostgreSQL server and publish the credentials along with the software. Is that true? If so, why? And can you suggest a secure way to share a relational database with the public?

My alternative is probably to setup an HTTP server that either delivers standardized results from particular RESTful endpoints, or accepts ad hoc queries for the database (I assume the latter is also a bad idea). But I'd like to get a good idea of why I should do that before going down that path.

You already mentioned some of the problems:

misconfiguration is easy,
privilege escalation bugs could put you at risk,
offering raw, more or less uncontrolled access to the data can lead to DOS situations.

But there are some additional problems with your idea:

This means that your university will be bound to offer the service as long as the product is in use by anyone. Continuity is a problem; if one of your users decides to clone the whole database over that connection, it might become unresponsive for others. Additionally, there might be people that want that software to run without an internet connection.

While an http-API is the way to go to let people use your database relatively safely in general, in this particular case, the best way - from my point of view - would be to use good compression on a database dump and host that file for download on your university server if it’s too big for github.

This way, you do not needlessly introduce a single point of failure for the application to work and put yourself to less risk, let alone spare yourself some tedious, possibly vulnerability-introducing work.


SIP Provider stores credentials, is it required for some SIP phones? My SIP provider stores my SIP call time password  as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a pre-calculated hash 'string1'.

string HA1=MD5(username:realm:password)

and then during authentication calculate.

HA2=MD5(method:digestURI)

response=MD5(HA1:nonce:HA2)

See Digest access authentication

The provider, however, says that some clients make it impossible to calculate string HA1 because the realm value changes.

Is it indeed common practice to store a SIP call time password encrypted?
I thought that the SIP server determines the realm. Are there indeed SIP-server setups that cannot predict/determine the realm for call time later on?

Usually you have a constant realm and in this case HA1=MD5(username:realm:password) could be stored instead of the password. But, if the password is only used for the SIP account, it actually does not matter if within a attack against the provider username and password get seized or HA1 instead, because the latter is all it needs to authenticate as the user. The storage method only matters if the account is used for other things or if the password is used for other accounts.


How does a zip file detect a correct password? When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file.

How does an encrypted ZIP detect when the user has given the correct password?

Obviously it does not connect with some backend service, and it doesn't contain the actual password to compare against. So how exactly does it check? Is there some hash of the original password included in the archive? Is it easy to find this hash?

The Cyclic Redundancy Check (CRC) field is used to determine whether or not the file is decrypted correctly. Quoted from the original ZIP format specification:

  After the header is decrypted,  the last 1 or 2 bytes in Buffer SHOULD be the high-order word/byte of the CRC for the file being decrypted, stored in Intel low-byte/high-byte order.  Versions of PKZIP prior to 2.0 used a 2 byte CRC check; a 1 byte CRC check is used on versions after 2.0.  This can be used to test if the password supplied is correct or not.

Update: As can be seen from Info-ZIP's unzip source code, the CRC value is used to check if the password is correct:

https://github.com/LuaDist/unzip/blob/master/crypt.c#L617

#ifdef ZIP10 /* check two bytes */
    c = hh[RAND_HEAD_LEN-2], b = hh[RAND_HEAD_LEN-1];
    Trace((stdout,
      "  (c | (b<<8)) = %04x  (crc >> 16) = %04x  lrec.time = %04x\n",
      (ush)(c | (b<<8)), (ush)(GLOBAL(lrec.crc32) >> 16),
      ((ush)GLOBAL(lrec.last_mod_dos_datetime) & 0xffff))));
    if ((ush)(c | (b<<8)) != (GLOBAL(pInfo->ExtLocHdr) ?
                           ((ush)GLOBAL(lrec.last_mod_dos_datetime) & 0xffff) :
                           (ush)(GLOBAL(lrec.crc32) >> 16)))
        return -1;  /* bad */
#else
    b = hh[RAND_HEAD_LEN-1];
    Trace((stdout, "  b = %02x  (crc >> 24) = %02x  (lrec.time >> 8) = %02x\n",
      b, (ush)(GLOBAL(lrec.crc32) >> 24),
      ((ush)GLOBAL(lrec.last_mod_dos_datetime) >> 8) & 0xff));
    if (b != (GLOBAL(pInfo->ExtLocHdr) ?
        ((ush)GLOBAL(lrec.last_mod_dos_datetime) >> 8) & 0xff :
        (ush)(GLOBAL(lrec.crc32) >> 24)))
        return -1;  /* bad */
#endif
    /* password OK:  decrypt current buffer contents before leaving */
    for (n = (long)GLOBAL(incnt) > GLOBAL(csize) ?
             (int)GLOBAL(csize) : GLOBAL(incnt),
         p = GLOBAL(inptr); n--; p++)
        zdecode(*p);
    return 0;       /* OK */


OAuth implicit flow and confused deputy problem I'm reading about Google OAuth and implicit flow. In Google docs it says that the access token received using the implicit flow must be validated otherwise the application might be vulnerable to "confused deputy problem." (https://developers.google.com/accounts/docs/OAuth2UserAgent#validatetoken)

I was wondering if someone could come up with an example which would demonstrate the vulnerability? Let's say we have Alice who is a regular user. If some adversary presents his own token (assuming that this token can only access adversary's service - i.e. Google Drive) I don't see how adversary could cause any damage. His own token will only work with his Gdrive - so Alice's files could not be affected with this.

I'm sure there's a good reason for verification but can't think of one... Ideas?

I believe that the following example demonstrates the problem (based on the accepted answer from https://stackoverflow.com/questions/17241771/how-and-why-is-google-oauth-token-validation-performed)

All of this assumes the use of the OAuth Implicit Flow

Alice connects her browser to GoodApp.com
GoodApp.com obtains an OAuth access token authorized by Alice.

A) This access token is tied to Alice’s identity at the Authorization Server.

B) The access token is either used by GoodApp.com to authenticate Alice or to access
   some OAuth resource on behalf of Alice.
Alice connects her browser to BadApp.com (for whatever reason; let’s say that BadApp.com
"offers games that look kind of fun")
BadApp.com obtains an OAuth access token authorized by Alice.
BadGuy (who controls BadApp.com) then connect’s his browser to BadApp.com, and gets
BadApp.com to redirect BadGuy’s browser to GoodApp.com with a spoofed OAuth
authorization response that includes the access token that BadApp.com has for Alice.
If GoodApp.com accepts the spoofed response, then BadGuy can act as Alice as follows.

A) If the access token is used by GoodApp.com to authenticate Alice, then BadGuy can do
   anything Alice could do at GoodApp.com

B) If the access token is used by GoodApp.com to access some OAuth resource, then BadGuy
   can cause GoodApp.com to do anything within the “scope” of the access token, all on
   behalf of Alice.

Therefore, if GoodApp.com verifies that any received access token was indeed intended for itself, then it can avoid the bad things as described in the example above.

Note that I believe an OAuth Client's proper use of the "state" parameter for cross site request forgery can also mitigate this problem, independently from access token validation.


How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores? Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?

You might for example have an open source application with developers located in multiple jurisdictions who cooperate by publishing the SHA for every version distributed by the App Store operators.

Is anyone doing this for any ssh clients, off-the-record messaging, etc. clients distributed through App Stores?

Are there any App Store for which this is known to be impossible, i.e. they often modify the source without revealing the changes to the original author?

There are of course closed source programs like Covert Browser for which no verification is possible except by the authors.

The developer of the application can check, if they wish, simply by downloading and installing the application themselves and confirming that what they get matches what they uploaded.

Random users of the markets cannot check for themselves that applications they download have not been modified by the app market.  But we can probably count on developers to complain publicly if they detect this kind of misbehavior with their own app.  The fact that we have not seen any public complaints of this sort suggests that it is probably either non-existent or relatively rare; it is hard to imagine Google or Apple are doing this on a large scale, as it would be too easy for someone to detect this and spread the news.

Note that, in major app markets (like the Android Market and the iPhone App STore) the connection between the app market and the user's phone is secured using SSL, so eavesdroppers and men-in-the-middle cannot modify the application while it is in transit.  So it's really just Google and Apple that we have to trust.

So, in the grand scheme of things, this threat probably is not worth worrying about too much.  Google and Apple have plenty of incentive not to tamper with apps that are served through their store.  You should worry more about the threat of rogue, sleazy, or unsavory apps that are crafted that way by the developer.


Piping crunch into hydra Is it possible to pipe the output from crunch into hydra ?

I tried this, but it doesn't work:

crunch 1 6 123456 --stdout | hydra -S -l ---------@gmail.com -v -V -e nsr -s 465 smtp.gmail.com smtp

I think, after a few searches, that it's not possible as hydra doesn't read stdin by design, and there are no options to use in order to achieve this.

But it can be a great improvement indeed.


What information is in a gpg cleartext signature? What information does a gpg2 signature contain?

If you clearsign an empty file, the signature looks like this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

jQIcBAEBCAAGBJaPoTMAoJEMEJof2E4sLl4hgP/355iZSmAWcgF8ADUMcL85Wa
...
KyugtYr0DewOPPA83kd7BCBpi1Cen9ltAJfK47RVsPPKqlxn+yNUt+YOBpYdNC
mKhDc/j156f4S1vxB/LI
=wkGU
-----END PGP SIGNATURE-----

For example with S/MIME, you would

$openssl enc -base64 -d < signature > signature.dec

and

$der2ascii -i signature.dec

which would print out more information. How can you do something equivalent with gpg-signatures?

Here's an example.

Create a key:

gpg --full-gen-key
...
pub   rsa3072 2017-12-23 [SC]
      9727B646039D8D463EE2394531EA459B1AA5A792
uid                      tester (Delete Me) <tester@tester>
sub   rsa3072 2017-12-23 [E]

Create an empty file:

touch empty

Create a detached signature:

gpg --detach-sign --default-key 9727B646039D8D463EE2394531EA459B1AA5A792 empty
gpg: using "9727B646039D8D463EE2394531EA459B1AA5A792" as default secret key for signing

Examine signature:

gpg --list-packets empty.sig
# off=0 ctb=89 tag=2 hlen=3 plen=435
:signature packet: algo 1, keyid 31EA459B1AA5A792
    version 4, created 1514055133, md5len 0, sigclass 0x00  digest algo 10, begin of digest 05 74
hashed subpkt 33 len 21 (issuer fpr v4 9727B646039D8D463EE2394531EA459B1AA5A792)
hashed subpkt 2 len 4 (sig created 2017-12-23)
subpkt 16 len 8 (issuer key ID 31EA459B1AA5A792)
data: [3072 bits]

UPDATE:

  Where is the message digest?

As can be seen from the output of --list-packets the message digest, in my example, is algorithm 10 and begins with the hexidecimal byte pattern of 05 74.  According to RFC4880 Section 9.4, algorithm 10 is SHA-512.

For this part, we'll need to look at the hexidecimal representation of the signature packet:

00000000:  89 01 b3 04 00 01 0a 00  1d 16 21 04 97 27 b6 46  ..........!..'.F
00000010:  03 9d 8d 46 3e e2 39 45  31 ea 45 9b 1a a5 a7 92  ...F>.9E1.E.....
00000020:  05 02 5a 3e a5 dd 00 0a  09 10 31 ea 45 9b 1a a5  ..Z>......1.E...
*00000030:  a7 92 05 74 0c 00 a7 b5  50 c7 26 98 b9 48 7c df  ...t....P.&..H|.*
00000040:  68 e4 8e 4f 07 82 5a 5f  78 a1 c6 30 93 05 9b dd  h..O..Z_x..0....
00000050:  aa 36 ec 89 72 20 4f 06  75 6e 1b 89 ff 2c 2b d5  .6..r O.un...,+.
00000060:  1a af 73 82 a6 e0 85 50  be 59 8a 05 13 d7 ca 2c  ..s....P.Y.....,
00000070:  cd 61 f0 f1 52 c5 47 c2  f9 f0 cd 69 a9 8c 54 8e  .a..R.G....i..T.
00000080:  79 a6 82 b2 1b 15 c0 cf  96 0a c7 88 a9 6e 54 31  y............nT1
00000090:  3d e0 96 62 14 94 6e aa  6b 7d c4 9c 4b c1 14 c8  =..b..n.k}..K...
000000a0:  bb ce ce 22 44 9c 3b df  64 cd ad f5 71 80 e0 d0  ..."D.;.d...q...
000000b0:  63 71 00 df 74 8e cd 82  bc 94 46 26 42 97 85 af  cq..t.....F&B...
000000c0:  84 ea e7 e7 39 2d 45 70  f0 8e 42 65 a2 57 2b ca  ....9-Ep..Be.W+.
000000d0:  75 95 e1 7e cd 2d ab c0  a5 7f 7a 8a e1 e7 7a 65  u..~.-....z...ze
000000e0:  d2 b1 83 46 e0 0a b3 ac  83 66 f9 45 2a a5 b0 7c  ...F.....f.E*..|
000000f0:  8a 64 d7 28 30 68 ee 2f  8f 3a 1c 1e b9 09 ca 92  .d.(0h./.:......
00000100:  27 85 6e 11 da 0a a0 1d  99 b5 e5 04 66 cf 2d 0b  '.n.........f.-.
00000110:  22 57 5d ab 56 70 75 28  81 06 a9 ba 06 92 8d 89  "W].Vpu(........
00000120:  f3 fa 3f 11 45 9e 9c 58  28 a2 6d 54 45 86 a8 19  ..?.E..X(.mTE...
00000130:  5d b4 b3 50 ee c0 ca d3  16 8c 45 be 9d fa b2 40  ]..P......E....@
00000140:  dc c2 1e 0d c1 a8 48 e5  80 61 d8 b9 b6 54 96 78  ......H..a...T.x
00000150:  6b 60 83 ed 63 20 64 6c  ee eb 33 b1 ee fd f1 34  k`..c dl..3....4
00000160:  ab c8 c7 46 1b 20 c8 1e  b6 70 2a c2 2c b4 4c c4  ...F. ...p*.,.L.
00000170:  5d 58 a3 16 e2 73 19 c1  35 6c da 4f dc 67 fa 25  ]X...s..5l.O.g.%
00000180:  1a 99 31 6a 69 21 c5 ca  f1 d7 24 d7 d1 51 ff bb  ..1ji!....$..Q..
00000190:  34 fe a8 b9 fd 2c 4a 68  26 44 cb df 8f 61 7a 24  4....,Jh&D...az$
000001a0:  13 4f 63 26 c5 41 6a 19  7b 9b 24 3d 5a 5c fd 62  .Oc&.Aj.{.$=Z\.b
000001b0:  7a 39 37 1f 5f bd -- --  -- -- -- -- -- -- -- --  z97._.----------

You can see that this byte pattern occurs on the highlighted line.  Since the hash type is known to be SHA-512, the length must be 64 bytes. So, in my example, the message digest is:

05740c00a7b550c72698b9487cdf68e48e4f07825a5f78a1c63093059bddaa36ec8972204f06756e1b89ff2c2bd51aaf7382a6e08550be598a0513d7ca2ccd61

It's important to note that a PGP signature message hash is not only a hash of the signed file or text.  There are several variables including the time of signature which are hashed together.  So, the hash of the file or text is not retrievable from the signature.

It's easy to demonstrate that the message hash changes.... simply create two signatures separated by a few moments in time.

$gpg --list-packets empty1.sig
# off=0 ctb=89 tag=2 hlen=3 plen=435
:signature packet: algo 1, keyid 31EA459B1AA5A792
    version 4, created 1514138633, md5len 0, sigclass 0x00
        digest algo 10, begin of digest b3 66
    hashed subpkt 33 len 21 (issuer fpr v4 9727B646039D8D463EE2394531EA459B1AA5A792)
    hashed subpkt 2 len 4 (sig created 2017-12-24)
    subpkt 16 len 8 (issuer key ID 31EA459B1AA5A792)
    data: [3070 bits]

$ gpg --list-packets empty2.sig
# off=0 ctb=89 tag=2 hlen=3 plen=435
:signature packet: algo 1, keyid 31EA459B1AA5A792
    version 4, created 1514138639, md5len 0, sigclass 0x00
    digest algo 10, begin of digest 04 0c
    hashed subpkt 33 len 21 (issuer fpr v4 9727B646039D8D463EE2394531EA459B1AA5A792)
    hashed subpkt 2 len 4 (sig created 2017-12-24)
    subpkt 16 len 8 (issuer key ID 31EA459B1AA5A792)
    data: [3069 bits]

You can clearly see that the message hash has changed, since the two beginning bytes have changed.  So, even though the signed document is the same and the keys are the same, the signatures are not identical.


5ghz monitor mode airodump-ng I am a beginner in pen-testing, and I am interested in learning, but I seem to run into a brick wall when trying to do so. I have an AP which broadcasts in 2.4ghz and 5ghz. Pretty standard. I am using an alfa AWUS051NH as my network card for the testing, so I am certain the problem is not with the adapter. My problem is that when I put the card into monitor mode and regularly run airdump-ng to list the AP's and users, I only see 2.4ghz networks, despite the 5ghz capabilities. I am running the latest distro of kali linux, and I have seen the -C flag in my googling, but it constantly returns the error of Done, frequency not supported or something like that. Here is specifically what I enter when I run airodump;

Put card in monitor mode:

sudo airmon-ng start wlan0

start airodump-ng:

airodump-ng wlan0mon

Is there a way to sniff for 5ghz AP's too? All help is appreciated greatly. Happy hacking!

You need to make sure your capture card is capable of every flavor of signal modulation that the target devices can use. Your AWUS051NH is a a/b/g/n device. If your target AP and client (the devices whose traffic you want to capture) are 802.11a-, 802.11n-, or 802.11ac-capable devices, your a/b/g/n card won't be able to capture their traffic.

Even just looking for, say, "802.11ac" isn't enough, as there are variations of 802.11ac that not all devices support: 2, 3, 4 and more spatial streams; 80MHz, 80+80, and 160MHz-wide channels; MCS 8 and 9 (256-QAM), various channels that are legal/illegal in different countries, that equipment designed for different countries may or may not support, and more.

You must also make sure your capture device is positioned "in between" the target AP and the target client. That is, where it can receive transmissions from the target AP at least as well as the target client can, and where it can receive transmissions from the target client at least as well as the target AP can.

You also need to make sure your interface is in both monitor mode and promiscuous mode (those two settings can be orthogonal; don't assume that monitor mode implies promiscuous mode on your hardware/driver), but it sounds like you already took care of that.

Uncertain if this will help or is entirely correct but after some google searching this is what I arrived at.


Improving magnetic stripe card security with a "magnetic noise" hash? I was reading the wiki on magnetic stripe cards when I stumbled across this sentence: "Magnetic stripe cloning can be detected by the implementation of magnetic card reader heads and firmware that can read a signature of magnetic noise permanently embedded in all magnetic stripes during the card production process." (wiki cites this page)

In an ideal case, a new card would be made and its magnetic fingerprint (or a hash of some kind) would be uploaded to a database. So let's say CC 4224 9450 9930 2192 has a hash of 2ca52df6. The hash 2ca52df6 could easily be stored on the remote computer that a card uses to check its balance. The integrity of the card would be verified by quickly creating a hash of the card's magnetic noise and then transmitting that, along with the CC info, to the remote server for verification. Since magnetic noise is so unique to each card, the chances of the hashes of a legitimate CC matching a cloned CC are slim to none.

This seems pretty straightforward, which leads me to think I am missing something. Granted, credit cards have long outlived their life span, but why has a feature like that not been implemented in the 40-50 years magnetic stripe technology has been around?

Definitely sounds fragile as Henderson mentioned - but if you can reduce that (perhaps by using say, fuzzy-matching or some sort) it may have some merit as essentially a longer string for track data.

If track data is being stolen somewhere, being able to marry up the exact strings might actually be useful in identifying where trackdata leaked since it is unlikely that that a card in normal use would have the same hash as time goes on. If you begin to see a variance in hashes, for example the 2ca52df6 hash deteriorates to 1cc32342 but you still see 2ca52df6 in places, it can be an indicator that there are two copies of a card around.


Is this a serious vulnerability? Semi Information Disclosure I was registering on an e-commerce website (no, I'm not gonna name it), when, due to my pentest nature, I captured the GET request for resending a confirmation email.

Kinda like: http://www.example.com/resend?email=someguy%40domain.com

What I noticed was, when I entered a registered email (on the website, my friend's account) as the GET request, I saw a blank page. When I entered an unregistered but existent email (my alternate email), i got redirected to the homepage, i.e. ecommerce.com

Is this a serious vulnerability? All it can tell is if someone is registered or not, but then again, a python script and you could process it all quite fast.

Should I report this?

You are right in that is an information disclosure, someone can easily discover valid usernames and then try and crack their security. If I was the site owner I'd like to know about it. Ideally you would notify the site owner, they may have an email address for that or a contact us link you could use.

The one caveat is that some places have misguided anti-hacking laws which make even ethical hacking illegal. Germany is an example although in practice they don't seem to be chasing people for performing helpful acts. It's highly unlikely that any negatives would come from this, and who knows, they may even send you a t-shirt or pay your a bug bounty.


Difference Between MD4 and MD5 encryption During coding, I have used both MD4 and MD5 encryption techniques. But there hasn't been any noticeable security difference between either of them. And yet, most of them prefer MD5, in fact specify it. MD5 :

System.Text.UTF8Encoding UTF8 = new System.Text.UTF8Encoding();
MD5CryptoServiceProvider HashProvider = new MD5CryptoServiceProvider();

byte[] TDESKey = null;

TDESKey = HashProvider.ComputeHash(UTF8.GetBytes("CXPUB001"));  // ASYNC PRIVATE KEY CODE FOR DATA ENCRYPTION

//DATA ENCRYPTION
TripleDESCryptoServiceProvider TDESAlgorithm = new TripleDESCryptoServiceProvider();
TDESAlgorithm.Key = TDESKey; //SENDER KEY APPENDED
TDESAlgorithm.Mode = CipherMode.ECB;
TDESAlgorithm.Padding = PaddingMode.PKCS7;
byte[] DataToEncrypt = UTF8.GetBytes(Message);

So, what is the difference, security wise, between using MD4 and MD5 ?

MD4 and MD5 are not encryption algorithms. They are one-way hash function designed for cryptography. It is important you understand the difference.

MD5 is a slightly modified version of MD4 that improves its security somewhat.

Another thing that is important to understand is that neither of these function are considered safe for use in cryptography: MD4 has been considered very insecure since the beginning of the 90's and MD5 is known to be insecure since the beginning of the 2000's.

Unless you really have to use these function for compatibility reasons, do not use them in your code, especially MD4.

If you can, use one of the SHA-2 variants (the .NET Framework implements all of them) or, if you can't, at least use SHA-1 temporarily, which is theoretically vulnerable but for which there is no practical attack yet. However, you need to understand that support for SHA-1 is going away in many systems pretty soon as well.


How to operate a honeypot in the cloud? Just finished reading "Honeypot on home network to help me learn", and the top-voted/selected answer that suggest deploying a honeypot to the cloud, but the answer does not say how to do it; also, read all the other answers too, and none appear to state how to do this.

I'm interested in knowing how to do this, and more importantly the possible legal issues that might arise from using a cloud based deployment.

I can imagine doing a build on a service like linode which allows you to do system builds from a web-based interface, but this sounds to me to present legal issues that might rapidly grow out of control; though this is in part, because I've never thought about deploying a honeypot to the cloud.

I'm able to think of a number of legal issues and methods of operation, but that's just me guessing, and I'd rather see answers to the question.

UPDATE 1:
Here's a case study, "Building Cloud Based Honeypots and Intrusion Detection Systems" - though the build based on my reading of it is only using the cloud to store and process results from honeypots that are not in the cloud.

UPDATE 2: Here's one person's view on Honeypots: Are They Illegal? - any additional information, or issues noticed within this some what dated article, are still requested.   NOTE: This article originally appeared on SecurityFocus.com and was dated "2003-06-12", though Symantec is redirecting the article to this page which dates the article as "2010-11-02".

DISCLAIMER: If you are looking for definitive legal answers, as always seek the advice of a legal professional, there is no legal advice represented via this question, possible answers, or 3rd party information referenced.

Design a machine image that is capable of running a virtual server inside of it. Your domain image is there to provide security and monitoring. Primarily, it is needed to keep anything sufficiently ugly from flowing OUT of your honeypot. Also, packet captures!

Stick the honeypot inside it, and you can turn them on and off at your heart's content.

Legal issues? At the base of it, you have taken reasonable steps to prevent your machine from doing damage, but somebody beat you on it. I know of no cases where somebody is found liable for an infected machine before. If you're particularly concerned beyond that, I offer the following two options:

Get a lawyer.
Get a gift card with cash and use TOR.


Does KASUMI (A5/3) Related Key attack apply to 3G or other mobile providers? The KASUMI is a block cipher used to encrypt UMTS, GPRS, and GSM SMS messages.   The references section in Wikipedia says that a related key attack is possible in 3G systems.

Q:  Has it been proven that the related key attack may (or may not) apply to a given mobile provider? If so which ones are (not)affected?

To the best of my knowledge, the related-key attack on KASUMI is not relevant to the security of 3G, UMTS, GPRS, GSM, or any other cellular system I am familiar with.  To the best of knowledge, it poses no danger to the security of those systems.

Related-key attacks on a block cipher are only a problem if the block cipher is used in a way that allows an attacker to gain partial control over the key to the block cipher (in a certain very specific way).  Normally, well-designed protocols and systems do not use block ciphers in a way that would allow related-key attacks.  As far as I can tell, cellular systems do not seem to use KASUMI in a way that would allow an attacker to mount a related-key attack on KASUMI.  Therefore, the existence of related-key attacks on KASUMI seems to be irrelevant to the security of 3G, GSM, or other cellular systems.

The authors of the related-key attack on KASUMI (Dunkelman, Keller, and Shamir) make no claim that their attack poses any danger to deployed cellular systems.

Unfortunately, the media got this all wrong, as far as I can tell.  I remember seeing a bunch of stories in the press saying that this was an embarrassment for the cellular industry and means you shouldn't trust 3G systems.  Neither of those conclusions was warranted, as far as I can tell.

See also sniffing/recording GSM 3G signals.

Disclaimer: I have not analyzed the 3G, UMTS, GPRS, GSM, or other cellular standards in depth and cannot guarantee that they are free of security risks.  I can only say that I am not aware of any way that the related-key attack on KASUMI might endanger deployed cellular systems.  I don't mean to disparage the research of Dunkelman, Keller, and Shamir in any way.  It is good research; I just want to help folks understand its practical implications.


How sharing location via web actually works? (It gets my exact house address) I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com.
As I know, getting the IP address of someone can get you the close location, maybe state, country - all that. My browser just asked if I want to share my location, and I accepted.

THE MAP JUST POINTED TO MY EXACT HOUSE LOCATION.

How is this possible only with my address or does my computer or browser transfer other data than my IP. Or does my laptop have GPS and I dont even know?

I would like to know how this works.

I think @neil-smithline is right, when I go to the What's my IP address page I don't get asked for my location, but there is a button which says "Location not accurate? Update your IP location" which then does ask for the browsers geolocation.

As for how your browser knows your location when you don't have a GPS in your laptop, from the article @neil-smithline linked to:

  By default, Firefox uses Google Location Services to determine your location by sending:

  Your computer’s IP address,
  information about the nearby wireless access points, and
  a random client identifier, which is assigned by Google, that expires every 2 weeks.

The important part is the "information about the nearby wireless access points" bit. Google has a database of wireless networks that include the BSSID and the location. It is kept up to date in a number of ways, for example Google Street View cars recording WiFi, or people's phones with GPS enabled reporting back which WiFi networks are in the area, I believe Ingress reports that information back to Google as well (but I could be wrong).

Just using a list of near by wireless access points you can get a location to within a few meters. There is a public database called WiGLE that provides a similar service for example.


What factors should I consider when choosing the key for encryption and decryption? We have an application that uses cookies to transmit employee personal data over from the front end to the server. We have planned to use TLS 1.2 for the encryption in transit. However once the java code receives this and stores it in the database, we are planning to encrypt the personal data fields and then store it on the Database. For enabling quicker computing, we have planned to use AES-128.

Now what do I consider to use as the key to encrypt and decrypt the personal data. Can I use the employee's password itself as the key? Would this be sufficient, or should I consider using something else, such as a random set of characters? What would be better? Also help would be appreciated if there is advice regarding managing the encryption keys.

The application resides on a private IP address, and also has the protection of a firewall.

Can I use the employee's password itself as the key?

No. They won't be able to change their password without reencrypting all data and a password is usually a weak encryption key.

First derive a secure hash from the password (e.g. using PBKDF2, Argon2 or a similar Key derivation function), then generate a secure encryption key from a good random source. Use this key to encrypt the data and encrypt this key with the KDF-Hash of the user password. When the user changes the password, you just need to reencrypt the encryption key, but not all the data.


Kerberos vs. LDAP for authentication -- which one is more secure Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment?

And

Can we switch between them transparently?

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment?

LDAP authentication is centralized authentication, meaning you have to login with every service, but if you change your password it changes everywhere.

Kerberos is single sign-on (SSO), meaning you login once and get a token and don't need to login to other services.

There's a trade-off: LDAP is less convenient but simpler. Kerberos is more convenient but more complex. Secure things are simple and convenient.

There's no right answer. If you need SSO use Kerberos. Else LDAP. You could also consider YP/NIS (over IPSEC) for centralized authn.

The fact that the OpenBSD security hawks dropped Kerberos but make their own LDAP server might tell you something...

  Can we switch between them transparently?

No, you cannot. Well, maybe you can with PAM. But your users will notice


Who are these crazy referrers? In my web pages' IP logs, I have recently begun seeing some very strange referrers, like this:

 http://haddies.4t.com/tramadol-hcl/tramadol-hcl-200mg.html
    http://bosnia.00it.XXX/percocet/acetaminophen.html
    http://perso.wanadoo.XX/paranormal2000/indocin/indocin-yellow-stool.html
    http://darany.fabpage.XXX/concerta/concerta-dose.html
    http://kralicek-a-slepicka.prodejce.XX/prednisone/prednisone-iowa.html
    http://gruber.20m.XXX/flomax/carmichael-flomax.html
    http://www.freewebs.XXX/epenoy/flagyl/pancreatitis.html
    http://rjdownloads.angelfire.XXX/sibutramine/rohypnol-wiki.html
    http://perso.wanadoo.XX/digerk_dany/azithromycin/azithromycin-for-uti.html

(Used XXX to render the addresses useless here)

I am really puzzled by the appearance of these crap pages pointing to my pages, but even more puzzled by the fact that some idiots out there are actually visiting the crap pages and then clicking on links that lead to my pages.

Anybody know who these people are??

Usually those are a spammer's bots who fake the referrer and try to make you click on it.
Those pages don't really contain a link to your page. (They might also use the e-mail address field, in fact any input to spam you with their domains, URLs and keywords...

Especially small sites and individuals are excited about visitors and where they come from, so they tend to click on those referrer URLs which only contain ads and/or malware. Steer clear and ignore them.


Converting sound to keystrokes: can I actually try it out? I heard that there are ways to tell which keys you press based on your laptop microphone. Is there a project that I could run as a proof of concept to actually experience that on my own?

They only conclusive parts of that analysis is that it is possible to recognize typed characters by the same person over time when you have previously run extended machine learning on that person's typing.

This implies that a program must be installed on their computer to really know what they're typing, making this approach totally useless for actual hacking. If a hacker was to implement this, he'd be wasting a lot of time for nothing since the keylogger would already be installed and more precise than anything else.


What needs to be focused on when hardening a LAMP stack? I have a site running on a VPS.  I set up the LAMP stack and a few other programs personally.  This is only the second time I have set up a VPS and I am a bit worried about security.  Are there things that I should be aware of (regarding my Linux install and LAMP stack) which people could use to gain access to my VPS and steal/alter my site or shut it down?

Any external service is a security risk. You indicated you're running a LAMP stack, so I'm assuming you have at least the following services running:

 1. SSHd
 2. Apache/Nginx
 3. PHP
 4. MySQL

MySQL by default is not externally facing, and you should not make it so unless you're involved in a clustering or replication environment (in which case there are alternatives to putting it on the wide web, like a VPN.)

Apache/Nginx + PHP cannot be made internally facing if you intend on providing content to people on the web, so these are going to be your main points of ingress.

SSHd itself has to be public facing (not always, but for the sake of simplicity in this case). Use of a Key pair for authentication and completely disabling password authentication is your best best for preventing people from obtaining access via this service.

Let's talk about webservices. Apache, Nginx, and PHP. These are the services that people will attempt to exploit in order to obtain access to your machine, so let's talk about securing them.

Firstly, you're going to want to isolate the services. If you've installed them yourself that means that ensuring that Apache and Nginx are running as non-root users.

Secondly, you're going to want to take a look at php-fpm or suphp, which allow PHP to operate as a user that is separate from your webserver even at a virtualhost or directory level.

This accomplishes two things, by taking root permissions away from Apache/Nginx, if someone gains control of that service they cannot impact anything but the operation of that specific service.

Changing the user of php (especially on a per-site basis) isolates the PHP module from interacting with other sites on the machine, and with the webserver itself, so if you have a client or website with exploitable code on it, your entire service, other sites, and your machine is not at risk.


Can someone bypass/recover/access data to Hard-Drive when Password Protected? I've decided to designate a separate topic to this question ( even though I've mentioned this in topic: Best practice to secure hard-drive of computer(laptop) in case of Stealing ^ Loss ^ Unauthorized access? ), so this question is not duplicate.

If I have password-protected hard-drive (so, password is asked on boot), it is called "encrypted" hdd?  Can someone easily bypass passworded hdd, either by software, or even hardware level (attach the physical hdd-plates to same-kind unlocked hdd-chip)?

BIOS hard drive passwords are implemented using a "lock" mechanism in the drive controller itself. When the drive has a password set, the controller "locks" itself and will not allow the data to be read without being "unlocked." However, this can be bypassed by an attacker who replaces the drive's controller board with another (unlocked) board of the same model, or, depending on the controller, by resetting or erasing the password through a model-specific (usually undocumented) hardware or software mechanism.

A BIOS hard drive password is not the same as encryption, and should not be used as a defense against anything more than casual attacks by unskilled attackers.


Using keys inside a secure enclave on a non trusted hardware and OS Are secure enclaves like intel SGX protected from memory leaks? What if a non trusted privileged user dumps all the physical RAM memory. Is it possible to extract the keys in this way?

A full memory dump from a trusted user or a hardware attacker will not reveal the contents of the enclave. The enclave memory is encrypted using a key that is stored only in the CPU, generated at boot, and not present in memory. However, it's important to realize that there are many side-channel attacks coming up which allow a local attacker (a malicious user, privileged or otherwise) to leak sensitive information from the enclave, especially when using modern microarchitectural attacks.


Nmap says host down when host is up I am using Nmap 7.12 on Mac OS X. The host that is being scanned is a Linux RHEL server in VirtualBox.  I can ping the server and receive ICMP replies and vice versa. I am scanning an IP inside the subnet as per the below information with the Nmap command:

root# Nmap -sS 192.168.0.171
Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-28 00:41 SGT
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 0.49 seconds

When I run tcpdump to see the traffic and where it's going, it shows all these ports being scanned when the Nmap command is run, and the Nmap scan completes successfully.

root# nmap -sS 192.168.0.171
Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-28 00:52 SGT
Nmap scan report for 192.168.0.171
Host is up (0.00092s latency).
Not shown: 998 filtered ports
PORT   STATE SERVICE
22/tcp open  ssh
53/tcp open  domain
MAC Address: 08:00:27:58:0E:98 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 5.71 seconds

However, as soon as I stop tcpdump and re-run the Nmap scan, it then states that the host is down.

What am I missing here?

Try  nmap -Pn 192.168.0.171, also confirm try nc -z -v -w 1 192.168.0.171 80 if that does not work.


Blocking clientclient traffic on LAN WannaCry infected other machines through the LAN. That made me think of how we use the LAN at our office: The traffic is client<->server, client<->internet, and server<->internet - never client<->client.

What would be an easy way block client<->client traffic? E.g. is it possible to make a 24-port switch regard the first 20 ports as client ports between which the traffic is blocked, and make the last 4 ports be regarded as server/internet ports which can talk to any other port?

Some switches support the private VLANs concept, which does exactly what you describe. It's not really common on low end devices though. The alternative (which may be a bit more flexible) is to use local firewalls (which is a good idea anyway) and allow only traffic to and from specific hosts and ports.


Hydra gives right password if used after 3 minutes else gives wrong passwords I have a D-Link DCS 5222LB IP camera. I am trying to bruteforce the IP camera. The camera uses basic HTTP authentication. I use the following command:

hydra -l admin -P passlist.txt -t 3  http://IP_address

The issue is that if I run this command with a difference of 3 minutes, hydra gives me the right password otherwise it gives me wrong password.

I have inspected the network packets to find if it uses the Form method but, what I found is that my camera server gives same response if the password is right or wrong and hydra does not know which is the successful response and which is not.

Kindly tell me is there any way through which I can tell my hydra (without using http-post-form) the diference between right and wrong response?

I Have figured out the issue. Hydra considers 401 as the Fail Response and 200 as the "Success" response. It also considers 403 as success response. My IP-Camera is smart enough to identify that hydra is trying to bruteforce. At the start, it returns 401 for the wrong passwords and 200 for the correct password. If I try again immediately, it figures out that something fishy is going on here and responds with 403 instead of 401 (Hydra takes 403 as a success response). If I wait for 3 or more minutes, It starts responding with 401 again.


What lessons can be learned from the latest spate of Ransomware attacks? I'm not sure this is the right place, but figured people would find it useful if they aren't too familiar with security policies and general best practices.

There is a lot of information out there, however, we all know that you can't completely lock down a system because people need access to various outside sources.

So as a Cyber Security forum (of sorts), what would your recommendations be to combat this latest Petya and NotPetya ransomware attack?

Edit: it would also be useful to know what allowed the affected companies' systems to be infected.

I think one of the main lessons learned is that the security services shouldn’t be hoarding zero days and tools to exploit them, (especially) if they can’t properly secure them.

The thing to remember, however, is that WannaCrypt and Petya both had patches available before they hit and both also took advantage of poor configuration.

Additionally, many organisations that were hit hard could have avoided some (possibly all) pain if they had standard belts and braces security practices in place.

The main lesson organisations should learn is that they should get the basics right.

For example:

Vulnerability Management

Conduct regular vulnerability scanning, understand the security posture of all assets and what vulnerabilities are present, what threats are related to these vulnerabilities, and what risk they pose to the IT estate and the business it serves.

This includes both missing patches (i.e. MS17-010) and poor configuration (i.e., having SMBv1 enabled).

This should all be supported by proper processes that allow for ongoing discovery, remediation of vulnerabilities (either via action or risk acceptance) and confirming remediation.

Ideally, all risks across the entire IT estate should be known about and managed.

Additionally, roles and responsibilities should be assigned to ensure that all of the above is done correctly. This includes security managers, security analysts, vulnerability managers IT technicians etc.

Patch Management

Ensure that patches are deployed in a timely manner. This doesn’t just mean pushing the latest Patch Tuesday patches.  This also includes understanding what software you have in your IT estate and having a full inventory of assets to make sure everything is patched.

Removable Media Controls

Ensure removable media is limited to devices that are sanctioned only. Ideally, I would blacklist all removable media and whitelist anything that you approve. (This is just my view, however)

Malware Prevention

Ensure you have some kind of AV on all end points, at least the classic heuristics and definition based AV. (although there are more advanced solutions available) Make sure it is up to date and working.

Disaster Recovery

Ensure you have backups, including off-site, off-line backups of critical data.

Incident Management

Ensure you have a plan to react to a major security incident; ensure you have the right people in the right places supported by the right processes.

Control User Privilege

This one goes without saying really:  make sure that all users have the least amount of privilege. This should be supported to ensure that this is audited regularly.

User Education and Engagement

Ensure all staff understand the security policy of your organisation. Conduct exercises such as phishing campaigns to test your users and provide training to allow them to understand the risks involved and be better prepared to spot pushing emails, web sites, social engendering etc. (Again, this is just a view, some people may suggest that security shouldn’t be a user problem; it should be an IT problem)

Good Network Security Hygiene

Have the correct access controls on your perimeter, ensure you have properly configured firewalls at all appropriate places in your network (with regular rule audits and reviews), and make sure that VLANS are properly setup with as much segmentation as is required. Ensure that all remote users can connect securely and that any devices they connect from have at least 1-to-1 patch levels as devices already on the network. Also, make sure that you have robust BYOD controls.


Can't request ocsp status with chain of certificates I have deployed basic ocsp server from OpenSSl Cookbook by Ivan Ristic page 44 with following command

$ openssl ocsp -port 9080 -index db/index -rsigner root-ocsp.crt -rkey private/root-ocsp.key -CA root-ca.crt -text

Certs have following chain root-ca -> root-ocsp and root-ca -> sub-ca -> server and I want to request status of server.crt.

$ openssl ocsp -issuer root-ca.crt -issuer sub-ca.crt  -CAfile root-ocsp.crt -cert server.crt -url http://127.0.0.1:9080
Response Verify Failure
139779327862424:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:unable to get localissuer certificate
server.crt: unknown
        This Update: Mar 24 19:44:15 2017 GMT

$ openssl ocsp -issuer root-ca.crt -issuer sub-ca.crt  -CAfile root-ca.crt -cert server.crt -url http://127.0.0.1:9080
Response Verify Failure
140137564870296:error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted:ocsp_vfy.c:166:
server.crt: unknown
        This Update: Mar 24 19:51:42 2017 GMT

$ openssl ocsp -issuer sub-ca.crt -issuer root-ca.crt  -CAfile root-ocsp.crt -verify_other root-ca.crt -cert server.crt -url http://127.0.0.1:9080
Response Verify Failure
140252372211352:error:27069065:OCSP routines:OCSP_basic_verify:certificate verify error:ocsp_vfy.c:138:Verify error:self signed certificate in certificate chain
server.crt: unknown
        This Update: Mar 24 19:53:15 2017 GMT

 $ openssl ocsp -issuer sub-ca.crt -issuer root-ca.crt -CAfile root-ca.crt -verify_other root-ocsp.crt -cert server.crt -url http://127.0.0.1:9080
Response Verify Failure
140563322316440:error:27069070:OCSP routines:OCSP_basic_verify:root ca not trusted:ocsp_vfy.c:166:
server.crt: unknown
        This Update: Mar 24 19:54:16 2017 GMT

What I am doing wrong?

$ ll
total 96
drwxr-xr-x 2 bjorn users     4096 Mar 24 11:19 certs
drwxr-xr-x 2 bjorn users     4096 Mar 24 11:19 db
-rw-r--r-- 1 bjorn wireshark 3160 Mar 19 13:08 ocsp_recording.pcapng
drwxr-xr-x 2 bjorn users     4096 Mar 24 10:56 private
-rw-r--r-- 1 bjorn users     2542 Mar 24 11:03 root-ca.conf
-rw-r--r-- 1 bjorn users      934 Mar 17 21:50 root-ca.crl
-rw-r--r-- 1 bjorn users     6876 Mar 17 21:39 root-ca.crt
-rw-r--r-- 1 bjorn users     1732 Mar 16 14:29 root-ca.csr
-rw-r--r-- 1 bjorn users     5747 Mar 19 10:09 root-ocsp.crt
-rw-r--r-- 1 bjorn users      948 Mar 17 22:07 root-ocsp.csr
-rw-r--r-- 1 bjorn users     5103 Mar 24 11:19 server.crt
-rw-r--r-- 1 bjorn users      980 Mar 24 11:03 server.csr
-rw-r--r-- 1 bjorn users     2436 Mar 16 14:11 sub-ca.conf
-rw-r--r-- 1 bjorn users     6682 Mar 17 22:03 sub-ca.crt
-rw-r--r-- 1 bjorn users      928 Mar 17 21:58 sub-ca.csr

Whole project zip (everywhere password is pass)

You have the following setup:

server.crt is issued by sub-ca.crt, sub-ca.crt is issued by root-ca.crt
OCSP response is signed by root-ocsp.crt which was issued by root-ca.crt

The process to validate a OCSP response is described in RFC 2560 section 4.2.2.2. (now obsoleted by RFC 6960) In short the OCSP response must be

either signed by the issuer of the certificate in question, i.e. signed by sub-ca.crt in your case.
or signed by a designated responder. This responder must have an extended key usage of OCSPSigning and must be issued by the issuer of the certificate in question. This means the responders certificate must be signed by sub-ca.crt.

You are trying to use the designated responder. Your responder has the correct extended key usage. But the responder is issued by root-ca.crt whereas the certificate in question is issued by sub-ca.crt. This conflicts with the requirement that the issuer of the responder certificate must be the issuer of the queried certificate and thus the validation fails.