How bad is a source code leak for an antivirus? I was reading that Symantec suffered a source code leak and I was wondering how bad this is for a anti-virus product.  Do these products rely heavily upon "(in)Security Through Obscurity" or does it really matter?  ClamAV is open source,  does this weaken the security that it can provide?

I'm not certain this is necessarily security through obscurity by design. Symantec, like many corporate entities before them, see their source code as the intellectual property and not necessarily guarded for the sole reason of protecting their product from directed attacks.  (Note that it doesn't hurt to have a little security by obscurity as long as it isn't your only means of protection.)

However, with that said, having their (old) source code read can open up new avenues for exploits.  Although it is 5 years old, it is entirely possible (and generally probable) that parts of the source code have been reused in many of their more recent products.

Personally, I have reviewed -- as part of my job -- source code for products which have been in iterations for the past 10 years or more.  The latest editions almost always have at least some code from their initial versions because it is usually the case that the core simply gets augmented rather than re-written.


Split RSA private key into two parts securely Let's say I have a RSA key pair: N, E, D, in which N, E are the public part, D is the private part.

I'd like to split the private part into two pieces, D1 and D2, and store them in two different places. Is it secure if I just choose D1 as a random string (same length as D) and D2 is calculated as D XOR D1?

I'd like to split the private part into two pieces, D1 and D2, and store them in two different places. Is it secure if I just choose D1 as a random string (same length as D) and D2 is calculated as D XOR D1?

Yes. This is known as the one-time pad, and it is the recommended approach. The only way to get the original secret will be to obtain both D1 and D2.

Make sure you use a Cryptographically Secure Random Number Generator such as /dev/urandom.


Can employer see home network usage on personal device I am just wondering whether it is possible for an employer to monitor usage on personal device on my home network in circumstances where a work device is also connected to the home network at the same time but not in use. I work from home occasionally and when I want to browse non work related things will use one of my own devices but often leave my work computer connected to my home network in this time.

How about in circumstances where personal phone which has had to install an app to secure it in order to access work emails on the phone is used as the modem, e.g. the personal computer and work computer are both hotspotting from the phone. The app does say they cannot see web history by installing it.

Thanks

First of all, monitoring your personal usage, on your personal network seems highly illegal (IANAL). So there's that, your employer is unlikely to spy this way.

Then, monitoring your home network is possible in a variety of ways when having an other device on it, but not everything would show : only your DNS queries (say, you went to facebook.com or google.com), but then since most of the web is moving to HTTPS, what happens between your computer and the remote website can't be read, so no reading your queries to Google or your Facebook posts. Also, since the computer can't really know easily if it is on your home network, or say a government building wifi, the legal ramifications are big, and your employer would probably not risk it.

I can't say for sure when using your phone. If it is a VPN app, that routes all your traffic through your employers network, then it is possible to check what websites you went to, not necessarily what you did there (HTTPS again), and so on. Again, this seems highly unlikely, and potentially illegal.

In short, using an untrusted device is almost always "game-over", but you have to estimate your threat model. If your "adversary" has more to lose than to gain, he is unlikely to "attack" you. So I'd say you're fine, unless you signed some charter explicitely barring you from using your phone in such way.

Edit: typo


Resources to learn about Windows systems exploitation I'm a beginner in penetration testing, and I'm struggling with finding decent material to learn. I used book about nmap, Metasploit, exploit writing etc..., but they contained too much information about too many OS's. I want something specific, something that can get me familiar with Windows exploitation systems, especially Windows 7.

I also noticed that security world is changing at a baffling speed, so I would like to stay in constant awareness with these changes. What are the most interesting sites/forums/social networks and such that you advice ?

windows is a close source OS so, your work is hard.

  you need learn basically about windows Architecture and you need learn
  Assembly with c/c++ language for attack.

specially Assembly.
also about this sentence :

  i used book about nmap, Metasploit, exploit writing etc..., but they
  contained too much information about too many OS's

this tools for penetration testing only is used.not for learn exploitation at kernel or system.
as you said at title :

  about Windows systems exploitation

if you need learn about Exploits and vulnerability's, see Submited Exploit's at something like that :
Exploit-db

for example : Windows 8.1

i hope my post is usefull for you, but with search about Architecture about your mind OS, you can learn every thing  :)
goodluck.


Using mysql root account to execute root commands Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?

Assuming the MySQL daemon runs as a non-root user, you can't. At worst, you can exploit a vulnerability in the MySQL daemon and gain a shell running as the same user as MySQL. From there you'd have to use a local privilege escalation vulnerability in the OS to gain root.


How should we implement responsible discovery program internally only for our organization employees? We experienced a very interesting phenomenon in the last 6 months and that is that some employees found and reported to our security teams few very crucial security issues. We were thinking about encouraging this type of behavior (we think employees should be able to feel comfortable reporting security vulnerabilities they have identified) but not sure how to do it.

The best way is recognition - after a security issue has been identified or fixed send them some email award template and CC in their manager. The value to them is being able to refer to this item in pay reviews and discussions with management.

Outline what is considered a security issue and what isn't to try and filter noise.

Add another level to this with a reward system - every month or quarter provide an aware to those that have reported security issues. Base it off reporters number of issues, severity of issue report or at random. Ensure that comms go out either company wide or department wide about the winner of quarter and month + what they received as  reward.

Ideally what you are trying to do is build up security champions in the company so not only do they report issues but influence those around them to do it.


Using Google Search results to determine password strength Google is a repository of Internet data, as it indexes tremendous amount of data. It uses a prediction service to determine the rest of the search query.

With such a huge repository in place, can we take advantage of it to determine the password strength?

Can we use the password as a search query to determine its popularity? Based upon the number of hits we get for the password, can we give a score to the password? Is this model feasible?

I think the passwords that are popular, occur more frequently on web-pages or as search queries. This doesn't mean that rare words of smaller length will be given a strong score. This is for obvious reasons, smaller passwords can be brute-force searched or can be queried in a finite time.

I think this model will work well for determining the strength of longer passwords that adhere to natural language such as English.

Is this approach to measure the password strength trivial? Or, in other words, is there any easy attack if such a model is used for measuring the password strength?

Note: If there is a trust issue with Google, assume that we can build our own service.

Edit: Research (https://madiba.encs.concordia.ca/~x_decarn/papers/password-meters-ndss2014.pdf) has shown that most of the strength meters deployed today mislead users while creating the passwords. Using repository of search engines like google, can we measure the password strength more accurately? There will be false positives, as pointed out by many, but won't it be better than existing strength meters?

There is plenty of research on which passwords are "popular."  You can find a lot of it here: https://xato.net/passwords/more-top-worst-passwords/

You have no way of knowing what Google does with queries.  It is almost certain that such queries are logged, and are associated with the originating IP address.  That would mean Google has a list of the passwords you tested.  That list could be misused by a Google employee, and might be subject to search warrant, subpoena, discovery, or some other legal demand: https://www.aclu.org/blog/technology-and-liberty-national-security/how-private-your-online-search-history

If I were Google, I'd be looking into search terms that produce no hits; that's how they write the rules that let them do their magic.  So, your practice is likely to come to the attention of Google researchers.

Finally, to address whether there is an easy attack, password attackers first try word lists of various sizes, then go for brute force and heuristic attacks.  Short passwords not on any list or in Google's indices will fall to brute force.  Longer passwords may fall to heuristics.  Ars Technica did a series of articles on this.  The most relevant is here: http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/

Give it up.


How to track MAC policy violations back to HTTP request? Suppose there is a web application under public load that runs under a very restrictive MAC (e.g., SELinux, TOMOYO, Grsecurity) policy. Suppose we detect and log a MAC policy violation like a file being read or written by the web application that shouldn't be.

Can this MAC policy violation be tracked back to a HTTP request that caused it? How?

Web application is under load of more than 100 requests/s. All requests are legitimate, except one, which is malicious. The malicious request needs to be found so it can be analysed to determine how it passed the security filter inside the application.

In very general terms, your problem is one of keeping context information. IF we assume the following:

Each request is handled by some code in the server, with one of the execution threads.
Each thread processes one request at a time.
The server code logs each incoming request with both a high-precision time stamp (milliseconds or below) and the identifier for the handling thread.
The MAC policy engine, when it detects a violation, logs it along with a high precision time stamp and context information, in particular the identifier for the offending thread.

Then it becomes easy to map violations onto requests.

In practice, depending on the involved technology (server code, application design, policy engine...), some of the above information may be missing. For instance, the policy engine may log only the process ID and a process may contain several threads (there are "system threads" handled by the OS, but at application level there can also be so-called "lightweight threads" that the OS is not aware of). Some server engines may pursue several requests simultaneously (state machine design with poll()). Logs may lack sub-second precision. In the server, the I/O accesses may be centralized and shared, so the thread which received the request is not necessarily the one which does the file access.

If you do not have all the needed information, then you will have to analyse all the requests received in the relevant time frame, until you find the funky one. You might want to resort to simulation: keep all incoming requests in a circular buffer, so that at any time you have a copy of the last minute worth of request data or so; if the policy engine detects a violation, make a snapshot (a copy of the requests and the relevant server state). Afterwards, during analysis, resubmit all these requests to a copy of the server, one at a time, until you find the one which triggers the problem.


Encrypt data stored in a database I recently talked to a potential customer who wants to build up a database which contains fairly sensitive data. One of her key requirements is, that the data storeed will be encrypted in a way that only the user will be able to access it. Even if there are certainly some disadvantages I thought about how I could achieve this and I came up with the following approach:

When a user is created I am creating a public/private key pair for him. The private key will be encrypted symmetrically with the users password. All data that is stored in the database (most likely except the timestamp - and of course the id) is encrypted beforehands with the public key. When the user logs in the password will be used to decrypt the private key, which can in turn be used to decrypt the data from the database when reading it. All en- and decryption may happen transparently in the data access layer.

There are some major drawbacks to be addressed here:

We'll have to de- and encrypt the private key when the user wants to change her password
If the user loses her password we won't be able to reconstruct the data
Either the private key or the users password has to be stored in plain text temporarily
Whenever we suspect that a private key has been corrupted (in the sense of stolen) we'll have to reencrypt all of the users data

and of course some more that did not come up to me, yet.

The first issue is inconvenient for us, but may happen transparently to the user, hence no big issue.

The second one is a bit more intricate. We do not want the user to lose her data, but we'll have to assume that the user will loose her password (storing and/or using a fixed password are no options for obvious reasons - never). A possible solution would be to create a very strong passphrase (30+ characters) which will be used to encrypt a backup of the private key. This might be sent to the user via snail mail or the like. The user may use this to restore her data if she forgot her password.

I have a bad feeling about no. 3, but I have no better idea at the moment.

The fourth issue again is inconvenient for us and may take a while, but should be no big issue. The only problem is the human factor here. We'd need the user to log in to perform the re-encryption and would not be able to do this automatically.

Are there any serious flaws about this, especially concerning the data security? Is this a good idea anyway?

One of her key requirements is, that the data stored will be encrypted
  in a way that only the user will be able to access it.

The only way to truly guarantee this is to have the encryption key reside on the client, under the control of the user.  This introduces (at least) two problems -

Having a thick enough client to support key management and decryption
Users will lose their keys and, correspondingly, their data

The first tends to rule out browser-based applications (although I'm sure someone, somewhere, has been smart enough to find a way to do it).  The second is an unavoidable implication of the requirement, and may well be acceptable to users (a user with sufficiently strong secrecy requirements may prefer data be lost than compromised).

The protections you've devised - using the user password to protect the key - only protect the user from you if you're honest.  If you're not honest, you could capture their password when they unlock the key, or capture the unlocked key when they're using it.  Or maybe you're honest, but there's a government agent standing behind you with a warrant and/or a gun.  Either way, if you really mean "encrypted in a way that only the user will be able to access it," then the user has to be the key custodian.

(Now - in fact - if you supply the client, then they have to trust that you didn't backdoor it to capture their key, their data, etc. etc.  But theoretically, since they have the client in hand, they can analyze it and attempt to detect such misbehavior on your part - just like anti-virus vendors and forensic incident responders analyze code to see what it's doing under the hood.  This improves their assurance over what it would be if the key is stored/used server side.  Realistically few people have the skills to do so, and even fewer have the motivation, but the fact that it is possible results in the perception that the client can be trusted more than the server in this scenario)


Determine the Identity of Caller Let me explain my situation.

I have a provider which is made up of a registration page and a web service.  Online vendors (clients) register with the provider by providing details such as username, password, email address, telephone number etc before they can use the web service.

Now, in every web service method, I check the certificate sent by the vendor to determine who he is.  How can I link the information in the certificate with the registration details?

For instance, I was thinking of asking the vendor for the certificate's serial number on the registration page.  Then, when the web service call is made, I simply get the serial number from the certificate sent and compare it with all entries in the database.  If there is a matching record, then the vendor has been located inside the database.  However, I don't think that this is secure because anyone can know the serial number of a specific certificate and register with it.  Moreover, what happens if the vendor's certificate was stolen and being used by someone else?

I also had an idea of comparing the URL from where the web service call originated with the host domain in the certificate.  However, I recently found out that this is not possible since a web service can be called from a console application for example.  What I could is compare the IP address from where the web service call originated.  However, there are two problems associated with it:

1) I am working on one machine, meaning that every IP address sent by my vendors will be 127.0.0.1

2) Large online vendors such as Amazon usually have a lot of sub IP addresses and servers.

How can I solve this problem?  How can I link the information found in the certificate sent with the web service request with the details that the vendor provided in the registration process to ensure that he is who he claims to be and to locate him in the database?

How is this implemented in the industry?

Thank you.

I solved the problem by having the vendor send the public certificate as well as a digital signature along with the signed text.

The server would then verify the digital signature by using the certificate's public key.


Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header? With the introduction of the HTTP X-XSS-Protection header it seems to me that the vulnerability impact (read: amount of possibly affected users with modern browsers) is drastically reduced.

Firstly, does this mean that when the X-XSS-Protection header is properly set and that when the browser's XSS protection is enabled, the web developers don't need to worry about XSS anymore (at least for the visitors with modern browsers)? Which could be as simple as "We don't support browsers X, X and X and versions X and lower.".

Secondly, what (popular) browsers implemented this security feature, is it enabled by default, and since what version or on what date was that version released?

Thirdly, are there known bypasses of that browser's XSS filter?

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

No. X-XSS-Protection is only used to enable or disable the inbuilt filtering[*] - which is generally enabled by default anyways.

So a more fitting question would be if XSS reached its end-of-life with browser filters.

But again, the answer is no. XSS is still a danger, because of three reasons:

Persistent XSS is not affected by browser filtering at all, as the browser has no way of knowing what is user input and what isn't.
Some browsers do not have filters against XSS, for example Firefox. XSS vulnerabilities are introduced server-side and web developers should not rely on browser vendors defending against them.
Bypassing of browser filters: XSS is context sensitive, which makes it very difficult to defend against without knowing the context (which is also why XSS should be defended when outputting data, not via some generic input filter).

The bypassing can basically happen because of two reasons:

There is a bug in the filter.
The user input is echoed in a location where filtering is not practical. One example would be <script>[userinput]</script>.

[*] As the header is not defined in any RFC, it is difficult to say how browsers will react. For example, Chrome 51 will disable its filter if the header is set to 0, but it will not re-enable the filter in case the user disabled it if 1 is set. Other browsers may behave different.

  Which could be as simple as "We don't support browsers X, X and X and versions X and lower.".

It's really not that simple. Especially large organizations are notoriously bad at updating. Depending on your website, you can't just say that you don't support browsers X.

  Secondly, what (popular) browsers implemented this security feature, is it enabled by default, and since what version or on what date was that version released?

X-XSS-Protection is supported by IE, Chrome, and Safari.

Chrome had an XSS filter since 2010 (Chrome 4). It was disabled by default in the same year, and then re-enabled in Chrome 8.

IE had an XSS filter since 2008 (IE 8).

Firefox doesn't have a filter, the NoScript plugin does though.

  Thirdly, are there known bypasses of that browsers XSS filter?

Yes. Of course. There are more. Most depend on some specific situation (eg input is echoed in two locations). The IE8 filter actually introduced an XSS vulnerablity, even into sites that did not contain one.


How would an attacker know the Gateway IP's of 2 VPN endpoints? My office has two Sonicwall Routers each at a different physical location and with two different ISPs.

There is an SSL-VPN tunnel between the two.

Today I noticed that the same Chinese IP address attempted to connect to the External IP's of both of these devices on coming from the same port.

Source: 61.160.213.108 port 10000
Destination: Each External IP of our SonicWalls and different ports

Any idea's as to how they could know there was relation between the two routers?

You're assuming the attacker has knowledge of both devices. The particular address you've listed is no stranger to random attacks. SANS Internet Storm Center lists it, it has appeared on other watch lists as well. One can conclude that this is either part of a botnet or some other automated scanning/hacker/badguy machine.

Botnets, compromised machines, etc., have a tendency to fire off massive amounts of recon scans against numerous amounts of machines. Think about it, if you were an attacker, why wouldn't you leverage one machine to scan many? What these machines do, is scour random, and or defined network blocks, enumerate what is visible, what is not, and pass this at times to other machines to perform the exploitation.

Consider the following:

Attacker Botnet
Recon machine: 61.160.213.108
Exploit machine: 10.10.1.2

Recon machine goes out scours the net for potential victims. When/if it finds them, it usually passes it off to another machine to perform an exploit, or bruteforce attack. In the event you were vigilant and noticed a probe, you could block the Recon Machine, but the reality is, exploit machine will likely partake, or implement the attack.

While you perceive that the Recon Machine knows about your infrastructure, there is a high likelihood the initial probe was random. Then of course there is the alternative. Someone is targeting your network. In the event they were, it is not difficult to obtain information on companies, and the networks associated with them. Consider a random company: ACME, if I were targeting their network, I could use Arin and simply say: "Hey Arin, show me what networks might be associated with ACME" and with that information, I can target each network I find:

There are plenty of ways someone can target you, but my guess is, each network of yours that was found, was likely random.


Does setting a Firefox master password make sense given that full disk encryption is used? I wonder if having a master password will make my login data saved in Firefox more secure given the fact that I use full disk encryption. The password database won't be exposed in plain text physically on the hard drive when it is locked anyway. Still I guess a master password may protect the login data from other processes running on the same machine. I have Firefox Sync enabled, if it makes any difference (if I understand correctly, it don't).

Yes, enabling Firefox master password will provide additional security to your logins. You've also partially answered your question. Even though you've enabled full disk encryption, the master password will protect your logins from other processes.

For example, a malware which has been able to execute on your computer will be able to read the disk contents (like other local processes), but wont be able to read your Firefox saved logins due to the master password.


Securing media uploading to the cloud from reverse engineering I own an RPG multiplayer game written in Java, where players can fight each other in the game.

Recently I planned to invent a new feature, where the last 15 seconds of your fight and the "knockout" will be saved and a gif will be created of the fight's ending and automatically uploaded and can be linked to your account and viewed on the game's website gallery.

Strategy I planned to use:

Server sends a start-recording packet to the client to start recording the graphics buffer
Client will clear the buffer and only keep the latest 15 seconds (X frames) of the current fight.
When the fight ends, server sends stop-recording packet, this packet will contain a pre-signed URL generated by the server in which the client will use to upload the gif that the client will create in this step. the presigned URL will have the user's ID encoded so that way it is linked, and a record will be created in the database aswell on the presign or on upload callback.

Might use AWS S3 as my storage.

What is the issue?

People can reverse-engineer my client, and can basically start fights and upload any gifs that they would want to, pornographic and unrelated content.

Is there a way, besides image-processing to solve this issue?

Since the whole process takes place on the client side, there is no 100% secure implementation of what you are planning to do. If the client can do it, a malicious user can do it as well.

Good news is, that the incentive for an attacker does not seem to be high for executing such an attack. This means, that it is most likely sufficient to make the attack difficult enough, so that the attacker loses interest before succeeding. With a limited profit motive, this threshold should be achievable with reasonable effort.

I recommend the following measures:

Obfuscate the Java client to make reverse engineering more difficult. There are tools available for that, no need to re-invent the wheel.
Sign the video files with a "hidden" key (either in the client code or fetched on demand from a server) and verify the signature on the server-side.
Perform plausibility checks (was the right codec used, is the video 15 seconds long, etc.)
Only allow uploads from registered accounts and ban accounts misusing this feature.
Provide an easy way for users to report misuse, so that you can react in time.

Combining all those measures will make exploitation more difficult, and only the really stubborn attackers will succeed. Given the limited profit motive, that's most likely secure enough.


How can I verify that my laptop does not have malware in the firmware? I purchased a used laptop on eBay.
I scrubbed the hard disk to make sure there were no lingering or unknown viruses left on the disk and then installed fresh Windows 10.

But, what about the firmware?

Does Windows Update make legitimate updates to the firmware?

Is there a way to detect that the firmware contains unauthorized  modifications?

Is there a way to re-write the flash firmware with factory fresh content?

"But, what about the firmware?"

Which one? BIOS/UEFI?
HDDs and SSDS have firmware too. There is some public and certainly more non public data around on hacking those. Depending on the laptop there could be more devices with firmware or persistent storage like GPU, NICs ...
A TPM can help you with BIOS and UEFI. afaik it is no solution for the rest as the firmware runs completely independent from the rest of the OS.

  "Does Windows Update make legitimate updates to the firmware?"

No. Usually there some custom tools from the manufacturer of the devices.

  "Is there a way to detect that the firmware contains unauthorized
  modifications?"

You need to get a legitimate copy for comparison.

  "Is there a way to re-write the flash firmware with factory fresh
  content?"

Search around here.


Bypass safe mode in PHP I am doing penetration testing on a dummy website. On this website I was able to upload a PHP shell, but I have two problems:

PHP safe-mode is enabled
I only have low privileges

Is there any method with which help I can bypass the PHP safe mode and gain write permission so that I can penetrate completely?

PHP's safe_mode is a deprecated feature - that was meant to solve the shared-server security problem at the PHP level. This was never a good idea, and thus the feature was deprecated and removed as of PHP 5.4 (your target is running PHP 5.3.10 which is ancient). This answer will demonstrate why safe_mode wasn't a great idea to begin with and will contain two parts - bypassing PHP's safe_mode and elevating privileges. Without further ado - let's get down to business.

Bypassing safe_mode

When approaching the safe_mode problem the first important thing to note is there isn't one canonical solution, and it really depends on your target configuration (and a bit of luck). Following is a overview of the techniques that might work.

pcntl_exec - If you have a bit of luck, the PCNTL extension is enabled. If it is - you can use it to gain code execution, as it isn't affected by the safe_mode directive. To check if it is enabled you can run the following command: echo function_exists('pcntl_exec');.
The LD_PRELOAD trick - A little known fact is that while safe_mode restricts the accessible environment variables - for this setting to be effective the safe_mode_allowed_env_vars directive must be set (you can check its value by running var_dump(ini_get('safe_mode_allowed_env_vars')); if an empty string is returned you're in luck - this means that the safe_mode restrictions on the environment is effectively disabled and the LD_Preload trick can be used as described here to gain code execution bypassing the safe_mode.
Another option to bypass safe_mode is to upload a shell that uses server side technology that is available on the target and is other than PHP. The most common candidate is Perl, which you've already mentioned isn't available. You can also check to see if Python or Ruby are available. If neither is available it's time to whip out your SSI shell and check out if it'll work.
Last but not least - exploit a vulnerability that allows code execution outside the PHP interpreter. There are a lot of such vulnerabilities that was published lately, and as your target is running an old version - it's most likely that you'll manage to find a vulnerability such as CVE-2016-9137 that you can exploit to gain code execution.

Elevation of Privilege

If you have a bit of luck - the lack of writing privilege is the effect of the safe_mode directive, and thus as it's bypassed - you now have write permission. But if you have no such luck - you'll need to escalate privileges on the OS level. There are a couple of ways to go around to perform such an escalation:

The old school way - find some SUID left on the system, and exploit it to gain root privileges (that will allow you, among other things, to have a write permission everywhere you want). A nice write-up demoing such an endeavor can be found here.
Use a kernel exploit - from the screenshot in your question it would seem that your target uses a pretty old, which means it might be vulnerable to a public kernel exploit such as DirtyCOW or some other exploit.

Congratulation if you've followed till here, and everything worked out fine up to this point - you now have fully compromised your target and have a root level shell, it's time for a write-up. Also, with all your new gained knowledge, you should remember - with great power comes great responsibility.


Need help understanding Windows Firewall I'm trying to better understand Windows Firewall and how it works. What I've learnt today is that the firewall contains 60,000 or so different ports that are opened when requested. I still don't really understand the difference between inbound and outbound firewall rules.

Does inbound only allow programs on the inbound list to receive incoming data or does it allow both incoming and outgoing data?
What is the purpose of the outbound list if the inbound list can send and receive data?
Why are many programs on the inbound list not on the outbound list?
At what point is a program allowed to create an inbound firewall rule?
Are we normally prompted when a program wants to create a firewall rule?
I understand that a lot of Windows programs and processes are configured to have firewall rules by default is that correct?

If this is too basic for this forum please advise where I should move to.

Well, I don't know how Windows PC firewall exactly works. But I can help you with inbound and outbound, since I know how firewalls work.

Basically it refers to the traffic:
Inbound rules are rules that define what traffic is allowed (or not) to pass the firewall from the internet (or in your case your network) to your PC. Outbound rules are exactly the same, but the other way around. From your PC to the internet.

Btw: maybe you don't get much answers because you have a lot of questions in just one post. I'd like to encourage you to split it up in several posts. ;-)

I hope I could help you in somehow.


Presistent XSS Filter Bypass Question I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script>

It did not work instead. But this particular "><script>alert("XSS")</script> javascript works instead.

I did not understand it at first since I did not included any filtering or sanitizing as the back-end code is entirely vulnerable.

But when I tried to look at the back-end SQL query which stores the XSS code as shown below.

UPDATE users set name = 'XSSINPUT';

Based on the above SQL query I managed to understand why the first javascript doesn't work its because its in single quotes hence it closes the SQL query before the whole javascript code is entered and breaks the SQL query as shown below

UPDATE users set name = '"><script>alert('XSS')</script>';

hence this is making it unable to execute the javascript pop-up.

Where as this server-side code below managed to execute successfully

UPDATE users set name = '"><script>alert("XSS")</script>';

because its in double quotes and does not break the SQL query and successfully allows the DB to execute that SQL query.

So, my question is. Is my understanding correct?

You are correct.  The update statement containing the single quotation mark would be broken due to the termination of the name's value and the ad hoc nature on the update.  It is surprising that errors aren't occurring since the extra text after the closing of the single quotation isn't valid SQL.

I have set up an example of both of these cases (as SELECTs since it is easier to set up as an example) which you can find here.

It is doubtful that you don't already know this, but persistent XSS is a fairly severe vulnerability and if you are curious, some of the impacts are highlighted well here.


Create certificate without private key or using USB eToken Considering this thread:

Create certificate without private key with OpenSSL

I have a very similar situation. I have a USB eToken 5110 JC (Aladdin) which has an inaccessible private key, since it's the main objective. I can use pkcs11-tool --module /lib/libeToken.so.9 -l --pin -s -i and it works fine. The libeToken.so.9 is provided by the SAC 9.1 (Safenet Authentication Tool) driver. So far so good.

My problem is: I need to generate certificates and sign them with this eToken. I tried to use the pkcs11 engine with openssl with no success. Maybe due misconfiguration (I tried https://github.com/OpenSC/libp11 how to, but I've got many errors, and I've given up)

I tried to use gpg but I get errors while learning card.

Since I can easily export certificates and public keys from USB Token, the tip of Valentin Bossi sounds good, since I could run openssl x509 -force_pubkey. Is it correct so far?

What will be the problem of doing this? I know that signing is a process of generating a hash of some data and encrypt it with a private key. When some data is sent to someone with its signature, the recipient will check what was the hashing algorithm, then generate a hash of the data with the same algorithm, and compare to the decrypted hash data with the sender's public key, am I right?

So when generating a certificate, no matter if the data came from a CSR or stdin, the signature made via public key would not assure digital signing, since anyone could get this public key and generate certificates on behalf the eToken owner.

So, what now? What have I got wrong?

Encrypted data with a private key can be decrypted with its public key and vice versa. But I didn't know that it's possible to encrypt and decrypt by using the same key (since the keys are asymmetric).

I think you are confusing things. In the question you refer to a different problem is addressed: not being able to sign the CSR with the proper private key but still creating a certificate based on this CSR. This is possible since the signature of the CSR is only used to verify that the creator of the CSR has actually access to the private key but the private key is not actually needed to create the certificate.

You are instead asking about signing the certificate - which is different from and serves a different purpose then signing a CSR. Since the signature on the certificate is essential to check the validity of the certificate you cannot skip it or fake it (using a different private key). Thus, there is no way to properly sign a certificate without having somehow access to the private key, i.e. by having the private key itself or by having a device containing the key which can be used for signing.


How to store client login credentials? My company has to constantly connect to remote server where there are numerous way to access, often via vpn and remote desktop connections, as well as SQL servers.

There are over 50 clients that this is the case for and everyone has different login credentials. Currently we store all this information on an excel spreadsheet that exists on a USB drive, that stays in a drawer. Periodically the list is updated and someone passes out a 8x11 sheet with all this info.

What is the best way to store this information securely, but make it easily accessible to everyone in the office? Is the best thing to do really just store it on a local server? Password protected?

You might want to investigate Password Managers such as Lastpass.  (This is just one example; a search for "Password Manager" will bring up many others.)  In addition to storing userid/password credentials for specific URLs, these systems have the ability to store files securely, so you could save all this information in a secure note, and then share internally to the people who require this information.


Should we store personally identifiable information on google drive? For a number of reasons, including remote accessibility, my company would like to move all of our accounting records, account applications, and marketing materials to Google’s Apps for Work Drive. At first glance, this sounds like a pretty bad idea, but I don't have the firsthand knowledge or reasons to argue a case against it.

The information stored includes banking information, names, and addresses; as well as SSNs, mostly in the form of PDF documents.

Can we legally host our files with Google Drive, who would be responsible for the costs associated with a breach in access, and is the amount of risk worth the increased accessibility?

Documents provided by Google support:

Security and Compliance Whitepaper
Certifications Summary
Audit & Certification Summary
Certificate
HIPAA Business Associate Amendment

Google Drive is no more or less safe than any other web-based service with a single logon. Your company must decide for itself whether it is willing to put the data online (albeit behind Google's authentication)

At the very least, I'd recommend that

2-factor authentication is used
Any data travelling outside the organisation is encrypted.

Google Drive is presumably fairly secure, but as we saw with iCloud, people can (and do) sometimes get access to systems they shouldn't be able to access.

One piece of advice a tutor at university gave me was:

  Treat anything that isn't behind your firewall as though it was on a USB pen you'd just left on a train

Meaning: assume that it may fall into the wrong hands, and ensure that you've taken sufficient precautions to make it useless to them.

(In fact, I'm a fan of treating things that are behind my firewall the same...)

Edit

To add to the "liability" question:

This is mostly a matter of what is stated in the contracts, agreements (EULA or ToS etc) etc between you and Google, and potentially you and any third parties who the data belongs to. Note that this doesn't just include clients/customers, it also includes your staff, if you are storing their personally identifiable information in the cloud - so this could not only cause financial issues, but also destroy employee trust if there is a breach! Your bank may also refuse to reimburse any money lost if bank details are stored in the cloud, as this could be considered negligence.

In general, though: unless specifically stated, at least some liability will always remain with you. Some liability may or may not fall upon Google for data breaches etc, but this will depend on the agreement. You will still be liable for any third party data, however, in as much as you have chosen to entrust it to a third party.

If there was a data breach, it would then become a (likely very long and drawn out!) legal question, and would revolve around whether either Google or yourself were negligent, the nature of your agreement, and whether you both took any and all reasonable steps to protect that data.

I think the crux of your question is "Will Google take responsibility for the security of data on Google Drive" to which the answer is "No, probably not". But I am not a lawyer, nor do I play one on TV.


How Browsers prevents Malware and Phishing attacks I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of blacklisted websites like in case of mozilla . Secondly, is there any security standard or specification the browser must be compliant with?

Safe Browsing API
Google offers Safe Browsing, which uses URL lists as well as heuristics:

Safe Browsing works in two ways to help protect you against phishing and malware. First, Google downloads a list of information to your browser about sites that may contain malicious software or engage in phishing. If the URL of the site you're on matches anything in the list, your browser will contact Google’s servers for more information to make a decision. If your computer then decides that you're visiting a risky site, it can warn you about it.
Second, Safe Browsing helps to protect you against targeted phishing attacks (sometimes called “spear phishing”), where a site may not already be known to Google so isn’t on the list of phishing sites. Chrome does this by analyzing the content on the site and warn you if it seems suspicious.

The Safe Browsing API is used by Chrome, Firefox, and Safari, but the effectiveness varies by implementation.

Microsoft
IE uses its own methods of protection (SmartScreen), but the process is very similar to Safe Browsing.
Effectiveness of each browser from various tests show vastly different results depending on the type of tests run.


How secure is Sandboxie? Sandboxie is a very popular and useful program for handling suspicious executables on Windows. Due to flawed security properties of Windows systems (eg. compared to Linuxes), it is hard to rely on the OS alone for containing threats, yet a full blown VM can have prohibitive performance cost. Sandboxie seems to offer a convenient middle ground, largely isolating processes without incurring the heavy cost of hardware emu/simu-lation.

However, how secure is Sandboxie, really? I am aware that even full VMs are not perfect, and exploits exist that allow a process inside to escalate into the host OS. Obviously these exploits are much rarer and more complicated to actually do, hence why people actually use VMs for security. Does Sandboxie offer comparable security to a VM, or even something like Linux jails? Or is it fraught with security holes due to being deployed on inherently inescure system (Windows) and being closed-source? What are the most egregious, known vulnerabilities in Sandboxie that have been observed in the wild?

It's decent! After all nothing is secure...

By that I mean:

In 2013 in a public audit it was broken ONLY with targeted malware that affected the OS Kernel, OS User Mode at an Sandbox Bypass level and Key logging, Remote Webcam/MIC Access, Clipboard Hijack, Screen Scraping, Steal Files (in some cases), Network Shares Access at an Sandbox Leakage level. Those problems were detected in 2013 and since then there were many security and optimization improvements.

You can read there last public security report at: https://bromiumlabs.files.wordpress.com/2013/07/application_sandboxes_a_pen_tester_s_perspective2.pdf


Differentiating identical requests from different computers in a local network On the same local network, we have two identical computers (a) and (b) which have identical software installed which send identical HTTP headers and requests to the same server, except for the url which reveals which machine the request comes from:

a$ curl example.com/a
b$ curl example.com/b

Then we let the two machines use a different software to again send two identical requests, but this time we use completely identical URLs, so the requests are indistinguishable.

a$ wget example.com
b$ wget example.com

Is there any way the receiving Web server can tell which of the two wget requests came from machine a and which came from machine b?

I assume the answer lies in explaining how NAT works and if there is any way someone on the outside can know which of n machines inside a local network they are talking to, provided the requests themselves are identical and don't reveal anything specific about the requesting machine.

If the machines have the same software version of wget and curl and operating system, and assuming that both requests have the same source IP due to the NAT, is impossible to know the source machine from the destination server. Take into account that the only field available on HTTP that could differentiate the machine type is the User-Agent and also this field could be modified and fake it on the source. Hope clarifies

An example on python-curl (wrapper of curl)

User-Agent: PycURL/7.43.0.2 libcurl/7.59.0 OpenSSL/1.1.0i

This User-Agent could vary depending on the python-curl version and on the openssl used.

An example of python requests

User-Agent: python-requests/2.19.1

So if you have two machines with the same version of python-requests 2.19 (for example) but one is Windows and the other is Linux, and only the 2.19.1 is supported in Linux you will know exactly what was the machine, but remember that this information (the user agent) could be modified easily.


How can a font be used for privilege escalation? Recently Kaspersky released an analysis of Duqu 2.0 and apparently the malware used a True Type Font File to exploit a critical vulnerability (CVE-2011-3402) to "jump directly into Kernel". I haven't been able to find many details on this particular vulnerability, nor on how TTFs can be used for insidious purposes. I would naively think that the code to turn font instructions into characters on the screen wouldn't need Kernel access nor would it need to be particularly complicated, but that's obviously incorrect. So what makes an evil font file capable of running arbitrary code?

Fonts are hard. It's old code. It runs in kernel mode.

Julia Wolf of FireEye, Inc. did an analysis:

Video here: Julia Wolf, 29C3, 2012-12-29, CVE-2011-3402 Technical Analysis
PDF here: Julia Wolf, CanSecWest, 2013-03-08, Windows Kernel TrueType Font Engine Vulnerability
Video/Slides again here. HackInParis, 2013-06-20, Analysis of a Windows kernel vulnerability: from espionage to criminal use, Slides: 303 page PDF, Video: 1 hour on YouTube

Gist seems to be this:

Slide 32:

Outlines are drawn using a Turing
Complete language to manipulate the
graphics state

(And that language seems to be interpreted in Kernel mode.)

Slide 78:

It was the length of the CVT array, stored within
the True Type VM’s internal global state structure.
As a consequence, the TrueType engine now
believed that it held one hundred and twenty nine
elements, rather than the original length of one.

Update 2016-06: General background at Project Zero

Google Project Zero has put together an in depth background blog post about font vulnerabilities in general:
(The specific CVE-2011-3402 from above is not mentioned, though.)

Google Project Zero Blog, 2015-07-31, Mateusz Jurczyk, One font vulnerability to rule them all #1: Introducing the BLEND vulnerability (Archived here.)
Google Project Zero Blog, 2016-06-27, Mateusz Jurczyk, A year of Windows kernel font fuzzing #1: the results (Archived here.)
Google Project Zero Blog, 2016-07-01, Mateusz Jurczyk, A year of Windows kernel font fuzzing #2: the techniques (Archived here.)
For even more in depth background detail: see the personal blog of Mateusz ‘j00ru’ Jurczyk (Archived here.)

Update 2017-01: Windows 10 Aniversary Update now parses fonts in USER mode

TechNet Blogs: 2017-01-13, Matt Oh and Elia Florio, Windows Defender ATP Research Team, Hardening Windows 10 with zero-day exploit mitigations (Archived here.)

  Font parsing is now done in user mode within an AC ["AppContainer"]

(The image that contains that statement seems to be from slide 34 of this presentation: BlackHat 2016, Windows 10 Mitigation Improvements.)


hparm -I /dev/sda does not report a Security section - should I be concerned? I am in the habit of wiping new drives and for SSDs I use hdparm to perform an ATA secure erase.

I just purchased two 44-pin PATA SSDs through an eBay seller in China and hdparm does not report a Security section when querying the drives:

# hdparm -I /dev/sda

/dev/sda:

ATA device, with non-removable media
        Model Number:       KingSpec KSD-PA25.6-032MS
        Serial Number:      xxx
        Firmware Revision:  20131018
Standards:
        Supported: 9 8 7 6 5
        Likely used: 9
Configuration:
        Logical         max     current
        cylinders       16383   16383
        heads           15      15
        sectors/track   63      63
        --
        CHS current addressable sectors:   15481935
        LBA    user addressable sectors:   62377984
        LBA48  user addressable sectors:   62377984
        Logical/Physical Sector size:           512 bytes
        device size with M = 1024*1024:       30458 MBytes
        device size with M = 1000*1000:       31937 MBytes (31 GB)
        cache/buffer size  = 1 KBytes (type=DualPort)
        Nominal Media Rotation Rate: Solid State Device
Capabilities:
        LBA, IORDY(can be disabled)
        Standby timer values: spec'd by Vendor, no device specific minimum
        R/W multiple sector transfer: Max = 1   Current = 0
        DMA: mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 *udma5 udma6
             Cycle time: min=120ns recommended=120ns
        PIO: pio0 pio1 pio2 pio3 pio4
             Cycle time: no flow control=120ns  IORDY flow control=120ns
Commands/features:
        Enabled Supported:
           *    SMART feature set
           *    Power Management feature set
                Write cache
           *    WRITE_BUFFER command
           *    READ_BUFFER command
           *    NOP cmd
           *    48-bit Address feature set
                Mandatory FLUSH_CACHE
                FLUSH_CACHE_EXT
HW reset results:
        CBLID- above Vih
        Device num = 1
Checksum: correct

From a security perspective, is this something I should be concerned about?

I asked a more detailed, non-security question at Super User (no responses):
hdparm does not report a Security section

A look at the hdparm source code reveals that the -I option triggers an ATA "identify" command, to which the drive responds with a sequence of 256 16-bit integers, that encode the drive capabilities. Among them are the "security features". hdparm then proceeds to print out these capabilities in human-readable format.

If the integers don't specify support for any of the security features (password, secure erase) then it skips the "Security" section altogether:

    /* security */
    if((eqpt != CDROM) && (like_std > 3) && (val[SECU_STATUS]
       || val[ERASE_TIME] || val[ENH_ERASE_TIME]))
    {
            printf("Security: \n");

Since you don't see a "Security" section, then this means that the drive declares itself completely unable to do security-related things. Namely, you cannot lock the drive with a password, and you cannot do a "secure erase" on it: the drive simply does not know how to do that.

After all, these are (from the protocol point of view) optional features, meaning that any specific drive may lack them. That's what you observe in this case.

Now the "secure erase" is about preventing leakage of old data. You don't need it for a drive you just bought; a "secure erase" would not guarantee you against any hardware backdoor either. What you want to do is to logically reset the drive so that it appears to be "clean" from the OS point of view. This is done with a simple dd:

dd if=/dev/zero of=/dev/sdX bs=512 count=1000

(with sdX to be replaced with the appropriate drive letter). This call will bombard the first thousand of sectors with zeros, in particular removing any partition table.

Notes:

Be extra careful with the dd parameters, because it is easy to wipe out the wrong disk. "dd" is also known as "disk destroyer".
You may want to reboot (or unplug/replug the disk if it is in some hotplug USB cradle) so that your kernel reloads the partition table (in this case, notices the lack of partition table).


Why do Symantec not believe their customers will be affected by Google distrusting this root certificate? So  Google will be moving to distrust the “Class 3 Public Primary CA” root certificate operated by Symantec Corporation, across Chrome, Android, and Google products, because it is no longer going to adhere to the CA/Browser Forum’s Baseline Requirements.

However, the blog post says that

  Symantec has indicated that they do not believe their customers, who
  are the operators of secure websites, will be affected by this
  removal. Further, Symantec has also indicated that, to the best of
  their knowledge, they do not believe customers who attempt to access
  sites secured with Symantec certificates will be affected by this.

How comes that?

UPDATE (after StackzOfZtuff's  answer):

Some websites were actually affected (for instance, Netflix). The revocation has been temporarily reverted

From Symantec itself you get the following description at https://www.symantec.com/page.jsp?id=roots about the usage of VeriSign Class 3 Public Primary CA:

  This root CA is the root used for Secure Site Pro Certificates, Premium SSL Certificates and Code Signing Certificates. Effective December 1, 2015, Symantec has discontinued the use of the VeriSign G1 root for issuance of public SSL certificates. This root CA will be used to issue non-public SSL certificates. Browsers/root store operators are encouraged to remove/untrust this root from their root stores.

This suggests to me that this CA is not (or no longer?) intended for any kind of public certificates on the internet and thus removing it from the browsers will not cause any problems. In fact, they even suggest this.


Which exploit and which payload use? I'm learning penetration testing. I've read the Metasploit Unleashed guide on offensive-security. I've learned the Metasploit Fundamentals and the use of msfconsole.

After reconnaissance and scanning of my target, I have enough information to pass to next phase.

Some info I have is open ports with related running services, names of the services, service's versions, the operating system of the device, firewalls used, etc.)

I launched the msfconsole.

I should find the correct exploit and payload, based on the information collected to gain access. But I don't understand the way to start all of this.

Assuming that my target has 20 ports open, I want to test the vulnerability using an exploit payload that do not require user interaction. The possibilities of which exploit and payloads to use are now reduced, but are too many. Searching and testing all exploit and payloads for each ports isn't good! So, if i don't know the vulnerability of the target, how do I proceed?

I would like to be aware of what I do, and do not try without understanding. The remote exploit is only an example. I want to know the concept behind the choice of an exploit. Why I use exploit A and not B before check if A and B exploit work on the target?

It's great to see that you're trying to understand what exploit and payload to choose, and more importantly, WHY. That's the way to do it. This will save you lots of time in the mid/long term, and will help you become a much better pentester.

  I should find the correct exploit and payload, based on the information collected to gain access. But I don't understand the way to start all of this.

Usually, the payload is the easy part. It mainly depends on what you're trying to achieve on the victim system (get a shell, install a backdoor so you can connect to it later on, DoS the service/app, etc), but also on the reduced set of options available for the particular exploit you will end up choosing.

  Assuming that my target has 20 ports open, I want to test the vulnerability using an exploit payload that do not require user interaction. The possibilities of which exploit and payloads to use are now reduced, but are too many. Searching and testing all exploit and payloads for each ports isn't good! So, if i don't know the vulnerability of the target, how do I proceed?

In order to choose the right exploit, most of the time you will have to do some research. Sometimes a little bit, sometimes a lot. Of course, you want to do this process as efficiently as possible in order to save time (this seems to be your main question).

In real-life scenarios, a host will usually have only a couple ports open, maybe
a few, but you will hardly ever find one with a number of open ports as large as 20. This narrows down the search quite a bit. For the couple open ports you find open, you'll want to identify the software (including version) running on each one and then try to identify potential vulnerabilities for this software (see note [ 1 ] below). If your goal is to simply get access the system, you will want to go for the "low hanging fruit" -- a popular phrase in the security community (see [ 2 ] below). This means that you will first look at the services that have better chances of being vulnerable. For example, HTTP is usually one of the first services to look at, because in general web applications are much more likely to have vulnerabilities when compared to other type of software. A MySQL/SQL server would be somewhere in the middle of the list, whereas an SSH one would usually be last (assuming it's running a recent version). But in order to make these decisions, you need to identify all services/versions first.

Sometimes the easier targets will not strictly depend on the service type itself, but how badly configured/maintained it can be. Examples are using blank, default, or easily guessed credentials, having obvious SQL injection issues, missing critical security patches, etc. Most of these apply to different kinds of software/services.

There's not much detailed theory out there about the "low hanging fruit". The practical experience you gain over the years makes a big difference. I did find a useful image at https://www.tenable.com/blog/vulnerabilities-by-common-ports-dashboard that's worth sharing:

Note how HTTP/80, HTTPS/443 and SMB/445 have the highest number of high and critical vulnerabilities, and also a big percentage (55-90%) of those are exploitable. On the other hand, even though SSH has a large number of high/critical vulnerabilities as well, only 3% of those are actually exploitable.

[ 1 ] Searching for vulnerabilities in a specific piece of software is a little science in itself. Usually, I start by simply googling about the software and version combined with the words vulnerability and/or exploit. I often find googling much quicker than using other tools, but of course I use the other tools as well: search function in MetaSploit Framework, www.exploit-db.com and its searchsploit tool included in Kali, https://www.securityfocus.com/vulnerabilities, specific software vendor website (security announcements), etc.

[ 2 ] Sometimes you will want to try to identify and exploit every single vulnerability on the target system, and not just one that will get you access. This is particularly true for some pentest engagements, since the customer wants to make their system or network as secure as they can, so it's very valuable for them to get a report listing all vulnerabilities found, the different ways they were exploited (or could potentially be exploited), remediation steps, etc. If you only include one, the customer can patch it but could still have lots of other security issues that could result in their system or network being compromised.


OSSEC on an existing running machine I am setting up a OSSEC on existing running machine. From my research I find that I should be running the following command to check for previous intrusion.

zcat /var/log/*.gz | /var/ossec/bin/ossec-logtest

Secondly it will automatically run  the syscheck and store checksum in /var/ossec/queue/syscheck/ . Is there anything else I need to configure for me to start working with OSSEC ?

If your system is compromised, you can't trust the OSSEC logs or any other logs generated from that machine. OSSEC is good for detecting new intrusions through log analysis. The command you give is used to detect which OSSEC rule will match the given log. So you are piping all the log files to the ossec-logtest utility and finding out if something matches then you are assuming that the system is already compromised. However, the first step an attack do is to clear all the log entries in order to cover his tracks. That is why OSSEC won't help there.
To your question what steps you need, decide which log files you are going to monitor and add the log file entries in the ossec.conf (or agent.conf) file. If you want to monitor certain files/directories for change, you can do that as well. If you have some custom log files that is not parsed by OSSEC out of the box (you can check it through the ossec-logtest), then write custom decoder in the local_decoder.xml. Don't put your decoder in the decoder.xml file because if you update your agent, it will be lost.As a last step if you have a centralized log server, then configure the OSSEC manager to forward all the alerts to the central log server by specifying the IP address in the ossec.conf on the manager side.
Edit: For website security, there are some very good posts by Tony Parez:
OSSEC for Website Security Part I
OSSEC - Detecting New Files - Understanding How it Works


Databases with spam, phishing email examples I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc).

I order to do this I need to have a lis of examples I could use to understand "spam", "phishing" or "social engineer" language.

I'm planning to focus on english language emails.

Are there any databases that contain examples of:
 - spam email (my spam box is very mixed, and I might have some valid emails in there.
 - phishing emails (or spear phishing)
 - emails marked as social engineering attacks.

Assuming you're using some sort of machine learning (and even if you're not), you'll need a distraction corpus as well (in the anti-spam industry, we call desired mail "ham" because it's easier to say than "non-spam"), and that will –by far– be your biggest challenge.

One starting point on your road to attracting spam could be this old Stack Overflow request for a Publicly Available Spam Filter Training Set or this old Stack Overflow Brainstorm: How to quickly create a honeypot for mass spam?  While both are off-topic for Stack Overflow, that might not be the case here.

Another starting point is the SpamAssassin public corpus, though at this point it's 10+ years old.

There are other techniques for attracting spam and ham, too.  Search for seeding a spam trap and you'll find tons of advice from anti-spam experts and email service providers.

Generally speaking, it's a lot of effort to collect a good corpus that will help you predict how to filter new spam.  It's significantly harder to collect proper samples of phishing, advance-fee fraud, and other targeted spam.  I've already mentioned that collecting non-bulk ham will also be a challenge, but if you're trying to calibrate to catch phishing, you'll need to make sure your ham corpus contains lots of legitimate non-marketing mail related to finance and account maintenance.

Your best bet is to team up with somebody in the industry who already has good data.

This could include free software communities like that of SpamAssassin.  If you can instantiate your work as a logical combination of regular expressions (SpamAssassin rules), you can get the SpamAssassin QA system to run your combinations against its own corpora.  This will require licensing your work as Apache License v2 so that it can be used by SpamAssassin itself.

The Anti-Phishing Working Group (APWG) has lots and lots of phishing samples, though you may have to pay for them (unless you're working on a paper for their eCrime Symposium?)

Project Honeypot also has a good collection of spam (though they won't have ham).  You might be able to work with them.


Which key usages are required by each key exchange method? I'm only really concerned with RSA keys, so the exchange methods are RSA (generate a key, encrypt it, and send it over) and [EC]DHE_RSA (generate an ephemeral [EC]DH key, sign it, and use it for key agreement).

The actual operation in RSA is "Key Encipherment", and in [EC]DHE_RSA it's digital signature, but they're both forms of key agreement. So, which of "Key Encipherment", "Digital Signature", and "Key Agreement" are needed in the key usage extension for each method? I haven't been able to find this specified anywhere and it probably varies by implementation, so the answer might be a table per-implementation.

The Key Usage extension is described in section 4.2.1.3 of X.509, with the following possible flags:

  KeyUsage ::= BIT STRING {
       digitalSignature        (0),
       nonRepudiation          (1), -- recent editions of X.509 have
                            -- renamed this bit to contentCommitment
       keyEncipherment         (2),
       dataEncipherment        (3),
       keyAgreement            (4),
       keyCertSign             (5),
       cRLSign                 (6),
       encipherOnly            (7),
       decipherOnly            (8) }

In SSL/TLS, when the server certificate contains a RSA key, then:

either a DHE or ECDHE cipher suite is used, in which case the RSA key is used for a signature (see section 7.4.3 of RFC 5246: the "Server Key Exchange" message); this exercises the digitalSignature key usage;
or "plain RSA" is used, with a random value (the 48-byte pre-master secret) being encrypted by the client with the server's public key (see section 7.4.7.1 of RFC 5246); this is right in the definition of the keyEncipherment key usage flag.

dataEncipherment does not apply, because what is encrypted is not directly meaningful data, but a value which is mostly generated randomly and used to derive symmetric keys. keyAgreement does not apply either, because that one is for key agreement algorithms which are not a case of asymmetric encryption (e.g. Diffie-Hellman). The keyAgreement usage flag would appear in a certificate which contains a DH key, not a RSA key. nonRepudiation is not used, because whatever is signed as part of a SSL/TLS key exchange cannot be used as proof for a third party (there is nothing in a SSL/TLS tunnel that the client could record and then use to convince a judge when tring to sue the server itself; the data which is exchanged within the tunnel is not signed by the server).

To sum up: digitalSignature for (EC)DHE cipher suites, keyEncipherment for plain RSA cipher suites. However, some implementations will also accept keyAgreement in lieu of keyEncipherment, or nonRepudiation even if digitalSignature is not set; and some will just totally ignore the Key Usage extension (even if marked critical). For maximum interoperability, specify all four flags in the Key Usage extension.


Risks posed by docker daemon running as root My team has been getting pretty excited about using docker because it promises to simplify our deployments and provide a number of other design and operational benefits.  We recently started to really get things rolling with it and ran into some issues with the fact that the docker daemon runs as root.

In general, my stance on running server platforms as root is "don't".  We recently went through a bunch of battles to get our operators to stop doing this and to even stop running things under accounts that can modify the server deployment.  So right off the bat, I have problem here that it seems a little hypocritical to go back to these same people and ask them to set up docker to run as root.

I'm not the first to comment on risks posed by the docker daemon running as root.  According to this "Eventually, it is expected that the Docker daemon will run restricted privileges, ..."  Should we just wait for this to be addressed?  I thought docker would improve our security profile but this seems to make it worse.  My enthusiasm has been deflated for docker and I'm not sure I am motivated to make a case for using it in this state to our risk team.

EDIT:  I should clarify that I'm not specifically concerned here with the issues around users being members of the "docker" group.  It's important to know about but that can be managed.  I really appreciate all the great answers here (both pro and con).  I think I've been conflating the daemon with the containers themselves.  I probably need to work on a clarified mental model of the docker architecture.  Again lots of great stuff here all around.  I'll have to ruminate a bit before accepting an answer.

Am I wrong to think this is a major flaw with docker?

The docker daemon does run as root, as it interfaces with the host operating system in a farily fundamental manner, however that's no different than most/any system daemon that makes use of linux capabilities which require that privilege.

This doesn't mean that using docker is insecure, just that you need to be careful with how you use it.  Luckily there is already some fairly good security configuration advice available on this from Docker themselves and in the form of a security configuration "best practices" guide from the Center for Internet Security

A couple of practical considerations which you do need to be aware of when running docker.

First up is that if someone is a member of the "docker" group on the host, they're effectively root on the system as it's possible to use docker to escalate privileges in this case. So you need to treat membership of that group on production hosts with care.

Docker uses Linux capabilities to restrict what actions a user inside a container can take, so just being root inside a container doesn't necessarily mean automatic root on the host.  That said you do need to be careful with things like volume mounts (so if you mount a system directory from the host into a container for example) as this can allow a root user inside a container to make changes to files on the host.

You can also reduce the capabilities provided to a container fairly easily, which can improve the security of the process further.

Also remember you don't need to run processes in containers as root, you can run as other users with a bit of configuration, and this mitigates the volume mounting risk.

I find that the way to think about containers is as processes on the host. If you compare running things in containers to running them directly on the host, I'd say that the container architecture is likely to add security rather than remove it, as you've got a better defined interface between the process and the host and more control over what the process can do on the host.

Also it's worth nothing that a richer user mapping architecture is coming fairly soon to docker (planned for 1.9) which will add some more options for restricting actions in a container.


Simpler idea for protection against reflected XSS on client side I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, NoScript. They use regular expression and other sophisticated techniques. Why didn't they use any simpler idea?

My question is- why don't we store what ever is going to server as parameters and if these parameters are reflected in HTML response then discard it or encoded it. Simple idea. I feel there may be false positives but not very convincing ones. Any input?

My question is- why don't we store what ever is going to server as parameters and if these parameters are reflected in HTML response then discard it or encoded it

Any parameters? So if I search for “Hello” and the response page contains the text “Here are your results for Hello”, it gets mangled?

There has to be some criterion for what counts as potentially dangerous, otherwise every form on the web is going to break like this. You could start out with “any parameter with a < in”, but then what about attribute injection attacks like onmouseover=, or JavaScript injection like '; alert(document.cookie)? And how do you stop a parameter of just < from breaking every tag on the page? There isn't an obvious watertight answer, which is why detection ends up being a complex mess of heuristic rules and not a clean, watertight pattern.

Personally I think client-side reflected-XSS detection is deeply misguided: in principle doomed to failure and in practice worse than useless, but if you're going to do it you'll need to limit its scope because content reflection is a common property the web needs to work properly, not always an attack.


SQL Injection Issue Multi-line query I am currently doing a SQL Injection attack against a website in school(that the tech created) sadly I can't point anyone to the site in question, the teacher has allowed us to gain knowledge as necessary. I do have permission to test against this site before people ask why I want to know the answer. I have found what I think is an injectable uname field to create a new user on the website however whenever I try and use multi-line queries the query fails to execute.Before running an INSERT query it seems that a SELECT query is run to check if the uname already exists in the system.

I'm assuming the username field is exploitable as if I create a new user with a single quote in their surname:

uname: o'connor

I get the following verbose SQL error:

OH DEAR - unable execute SQL query: SELECT * FROM usertable WHERE uname='o'connor'

However If I try and use a semi-colon and run a multi-line statement it fails to execute, for example:

uname: admin'; UPDATE  usertable SET password='pass' WHERE uname='admin';

An error occurred:

OH DEAR - unable execute SQL query: SELECT * FROM usertable WHERE uname='admin'; UPDATE usertable SET password='pass' WHERE uname='admin'; '

the PHP script that processes the POST data seems to add a single quote on the end but my understanding was that my injected query would execute before reaching this single quote. Am I executing multi-line queries properly?

**UPDATE
I have also tried:

uname: admin'; UPDATE  usertable SET password='pass' WHERE uname='admin'; --

to no avail same issue that it is unable to execute and I know all these column names and table names are correct. Is there anyway I could output the original query to a text file or something like that or when the results are returned change the value of something that is output on the page to the passwords?

I'm not a PHP programmer, but I believe most people use mysql_query() when executing MySQL queries in PHP and this will only allow you to execute one SQL statement at a time.  It is possible to execute multiple statements in PHP, but specific steps need to be taken.

It's possible that whoever wrote this code is using mysql_query which would mean that you will not be able to inject additional SQL Statements.

SQL injection is still possible but on a much more limited level.  For example you can inject sql into the where clause by passing the following value:

test' OR '1'='1

Which would generate the query:

SELECT * FROM usertable WHERE uname='test' OR '1'='1'

You could also append a UNION clause that queries another table and returns results:

test' UNION SELECT * from creditCardTable where uname = 'admin

Which would generate the query:

SELECT * FROM usertable WHERE uname='test'
UNION
SELECT * from creditCardTable where uname = 'admin'

Hope this helps.


Detecting and Responding to Email Account Compromise (regarding FINRA 12-05, ISAC/IC3 alerts) FINRA, the ISAC and IC3 issued an alert regarding e-mail based attacks that attempt to obtain client contact information.  They then use social engineering / persuasion to complete the attack.

What should the IT Security department of a Broker/Dealer do to specifically address and mitigate these threats?
What technical solutions should be put in place? (or be enhanced accordingly)
Does anyone have additional information on these attacks? (e.g. breadth, scope, etc?)

If you look at the guidance provided, they give a couple of specifics that are relevant for IT Security:

Perform out-of-band authentication and verification of the payment instructions through a
validated contact channel.

Ensure your controls are enforced so that individuals cannot sidestep your current out-of-band authentication and verification

Leverage payment instruction and transaction anomaly tools to flag suspect transactions.

If you run statistical analysis tools to alert on anomalies, they may well already be picking up this sort of wire transfer fraud.

Use traditional security tools (DLP, spam filters, etc.) to search for e-mails with key
words like “wire + funeral”, or “wire + travel,” etc.  Clients and employees noted in 3
flagged messages should then be contacted directly by other resources within your
financial institution.

This is probably the key IT control here - even a basic DLP solution should allow you to search for these words at your mail gateway, which can pick this up rapidly.

It is a fairly standard social engineering attack, relying on the financial institution wanting to be as helpful as possible to the customer in dire straits. As staff are only human, enforcing IT controls is the simplest way to avoid a 'helpful' member of staff bypassing procedures and then becoming a victim.


What can I do to prevent my web browser from accessing local files? According to http://mftbug.surge.sh [ed note: potentially dangerous link on the page], any web page can attack a user through the browser without knowledge about the user. How can we stop this default behavior?

In answer to the question there is no global way to stop access to local files for ALL browsers via the address bar or via a web link.

You may though be able to block these links via your AV or anti malware software. As many have black list style options.

With IE, as it is Windows based, there may be ways to edit the registry or by using Local Group Policy.

A small caution note. By blocking local file access it may cause some minor usability issues. Such as downloading a PDF and trying to then run it in a browser (for example chrome).


How "strong" is a password generated using PostgreSQL `random()`? I need to generate password on row creation in PostgreSQL. I have solution like this:

ALTER TABLE sippeers ALTER secret
SET DEFAULT trim(both from (encode(decode(md5(random()::text || current_timestamp || random()),'hex'),'base64')), '=');

And passwords look like this:

select trim(both from (encode(decode(md5(random()::text || current_timestamp || random()),'hex'),'base64')), '=') FROM generate_series(1,15);
         btrim
------------------------
 MVve5ziDWUweBcNHpZU0zA
 ERPkHr407VvQUoxLNmsg9A
 zi6+zYGTFl5EqxvQTuIfsw
 vXJRb2RJzaikQDXCWYWKFg
 LHfAYJkrFJzKGRR1mAyeqA
 +JQIcr+CkYsFDH6HaGQTeQ
 gEeZjD/6zI5btzRfaKebYw
 Qi7jyLadnQ3FXBYLhU2TaQ
 DR70MoyHHyLHlUmBCj9Lzg
 87gaalFYGgs76N02/CLfLw
 93407RcVXT5+ei9KeuejXA
 C5iONK9ef4jHFrj1oNrxSQ
 +JZaWNtjRFUbdMCGIxdQgw
 3AOUzdeqIL2qS2YfAXSDhg
 +giwgzxkEa6gvman4Ccujw
(15 wierszy)

I know random() in not really random. Cannot use pgcrypto.

How "strong" passwords generated like this will be?

According to this post, PostgreSQL's random is a 48-bit LCG. This means it has 48 bit seed and 48 bit state. Once somebody guesses either of those, he can generate the same numbers as you, so also the same passwords.

As far as I can tell, in PostgreSQL the seed is always the same (unless you call setseed). This means that an attacker can create a list of passwords by just running the same function you used to create the passwords. He can then use this list to brute-force your application.

If an attacker obtains one of the passwords, he can deduce all other passwords, even if you seed the random function correctly.


What's the point of public key servers, if they usually don't require any authentication at all upon upload? Do they offer any benefits at all to the security of key distribution?

Public key servers are not meant to bring security; they are meant to make the public keys available. Security is achieved, in the case of PGP, through the Web of Trust: signatures from people on other people's keys. A public key server is simply a repository so that you may more easily find intermediate public keys with signatures between yours and that of the intended recipient.

A public key is not deemed secure because you just downloaded it from a key server; key servers have no idea whether the keys they contain are genuine or not. A public key is deemed correct because you could verify sufficiently many chains of signed keys from your own key to that key. How you obtained the keys is not important; they could have come over some HTTP connection, on USB keys, on magnetic tapes carried by camels through the Australian desert, that does not matter. A public key server is thus just a huge camel.

Without the key servers, each PGP user would have, when he sends a signed email, to send along with it a bunch of other signed keys so that the recipient may validate the signature. This would be cumbersome and does not map well to the WoT structure. With a more centralized PKI, like the prevalent model in X.509, sending "helper certificates" is workable; that's what SSL servers do: when a SSL server sends to a connecting client its certificate, it actually sends a certificate chain.


How do I securely store credentials and key files on my mac? There must be a handy way to securely store, say, GCP key.json somewhere on my machine and access it whenever I'm deploying stuff. Backup to cloud is a must. The Apple's Keychain access seems troublesome. Is there a better solution?

I know you quickly dismissed Apples own Keychain but I'd like to make a case for it and help guide you in the right direction of how you can use it via terminal.

It’s protected by 256-bit AES encryption.
It's backed up on cloud servers.
You can use it to store secure notes.

Locally the keychains are stored in ~/Library/Keychains/ and /Library/Keychains and Apple has a command line utility called security (/usr/bin/security) that can be used to administer. see man security for help on this command. It's fairly robust and documentation out side the man page is sparse. I was able to quickly create a keychain although I didn't spend too much time on it.

If security is too much of a learning curve, I'd recommend a python module called Keyring It has a command line utility that while is not as robust but very simple to set and get data to the keychain. I sometimes use it to store credentials for scripts instead of using .env.


Yahoo Account hacked, changed pw, spam still going out elsewhere? Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts.

I changed the password, then saw (via rejected emails sent to my Yahoo account) that mail had gone out again with my email in the "FROM" field, to all my contacts.

However, in neither case did the account show to be accessed (verified in the Yahoo web client), nor did the account have anything in the sent folder of the account.

So I looked at the headers, and the last "Received" marker before the FROM looked suspicious, leading me to believe that my account is no longer able to be accessed, but with my full contact list, the spammers can now impersonate me and send out mail to my contacts.

Two of the headers' "Received" markers are shown below:

The "FROM" marker in each is my Yahoo account, caveatrob@yahoo.com

Received: (qmail 9004 invoked by uid 0); 27 Feb 2014 06:16:28 -0000
X-TCPREMOTEIP: 1.53.225.12
X-Authenticated-UID: brian@monahanlaw.com
Received: from unknown (HELO monahanlaw.com) (brian@monahanlaw.com@1.53.225.12)
  by 0 with ESMTPA; 27 Feb 2014 06:16:27 -0000
From: "Rob Lastname" <caveatrob@yahoo.com**>

This is the second:

Received: from [188.253.180.46] (helo=mst-music.ch) by box6.rapidenet.ca with
 esmtpa (Exim 4.80.1)   (envelope-from <caveatrob@yahoo.com>)   id
 1WIvxj-0003Jw-Rn; Thu, 27 Feb 2014 03:05:00 -0500
From: Rob Lastname <caveatrob@yahoo.com>

I will answer this question in accordance with your numbered questions in the comment.

1: Impossible to know without access to your computer, if at all.

2: The attacker did HAVE access to your address book, but it is once again impossible to know if he made a copy of it on his machine.

3: Logically, if an e-mail exists, someone or something sent it. If it wasn't you, it was someone else. As @mr.spuratic pointed out, you can verify for certain that a e-mail WAS sent from within yahoo, but you can't prove that it wasn't.

4: Impossible to know without access to your computer and account.

5: See 2.

6: Make sure the attacker can't get your password again (do an AV scan, use HTTPS Everywhere, etc.)

Hope this helps you out.


Authentication Token storing after database authentication I've worked on a Spring 4 MVC RESTful backend application.  We authenticate to an OpenAM server, and a lengthy token is stored in a cookie on the front-end.  The front-end takes the token out of the cookie, and passes it back as a header in every Ajax call to the back-end.  So, if we call the RESTful backend in an Ajax call (POST, PUT, GET), the token is sent as a header called "openam_token."

We have implemented Spring Web-Security based on the SiteHeader example.  A token comes in as a header and we have a PreAuthorizationFilter which we implemented called "CustomUserDetailsService."  This code takes the header, and gets the token, we pass that token to OpenAM to ask them if this is valid, and if so, returns us the username of that user.  From that unique username, we can lookup the user in the database and get the user details and their roles.

I presume that if I created a Login from Google+, LinkedIn, or Facebook, the process is the same.  We flip to their login page, the user gets authenticated and then a token comes back.   The token gets stored in a cookie on the client side.  Every Ajax call from that front-end to the backend passes back the token in the header,and then in CustomUserDetailsService ...we call LinkedIn, Google+, or Facebook, and see if the user is correct.   But this is on my presumption of how these work, but I could be completely wrong.

So, on the Spring RESTful app I am working on.  Usernames and passwords are stored in the database along with the salt.  I've done a lot of research on storing the salt with the username, a unique salt generated when the user is created or when they change their password.

So, provided a user provides a username and password, and the user has authenticated ... I want to generate a token for this user, and I am wondering on what the common practices are for generating a token?

Second,where is the best place to store that token?  If the token comes back, then I presume I can save that in a cookie on the client side as well, just like we do when we authenticate against OpenAM.   Now, what would be the best way to store those temporary tokens on the backend?   I could persist the token in the users table along with the user.  I could store those tokens in another table.   The idea is ... the tokens, stored in the cookies, need to match on the backend for that user with that token.   So, the question is on what a godd strategy for doing that.

I understand that I will never have the 100% most secured site, but I can take some common steps and do my due diligence.

Seems like an awful lot of explanation for something that seems like an easy question.

Thanks!

Token length of 256 bits, it's 42 characters in base64. It needs to be random.

Token is usually stored in cache with user session. For example, Redis. Every other storage method would do and it will vary with responsiveness, e.g. fetching long JSON from tmpfs and from SQL DB is different. Compression helps.

This can be other local service. For example, token service which holds API keys.


How to detect if files were saved or copied from an external hard drive/USB? Is it possible? If so, how?
This is needed to alert on the copying of "important" files.
An example of what I need:

There is a document on an external hard drive/USB.
You're just allowed to VIEW it, not COPY it.
Someone (an employer for example) copy the document. An alert is sent to the owner (by email for example).
There will be a software on the external hard drive/USB to do such thing.

Reading the file is copying it into active memory.

Once the file is in active memory, you can't control what happens next.

There are special platforms which perform DRM (Digital Rights Management) which can make it far more complex for people to take copies of your file.  Snapchat has some controls like this, as does the Kindle reader.  Encryption, proprietary protocols and control over the software and or hardware are required.

There are online services such as https://digify.com/product.html which do something like this too, not by USB of course.

This kind of control is really only effective at keeping honest people honest.  Even if they haven't hacked the software or have a technical circumvention,  a motivated person could always photograph the document from the screen.

See the measures taken in the TTIP as an example of somebody trying to solve this issue:  http://www.independent.co.uk/news/world/europe/ttip-controversy-secret-trade-deal-can-only-be-read-secure-in-reading-room-in-brussels-10456206.html

  "In the basement of the US capitol, there is a room, a locked soundproof room, and the only people allowed in this room are US senators, and they can't bring their assistants, they can't bring their phones, they can't even take notes in there."


With IPv6 do we need to use NAT any more? I'm wondering how to use NAT with IPv6. Seems that you don't even need it any more. So what exactly is the concept behind firewall configurations in IPv6 environments?

There is some widespread confusion about NAT.

NAT has never been meant to be used as a security feature. However, it so happens that in most cases (not all), when a machine has access to the Internet through NAT only, then the machine is somehow "protected". It is as if the NAT system was also, inherently, a firewall.

Let's see how it works:

An IP packet has a source and a destination address. Each router, upon seeing the destination address, decides to which subsequent router the packet shall be sent.
When a router implements NAT, it forwards outgoing packets under a guise; namely, the packets bear the router's external IP as source address, not the actual source. For incoming packets, the router does the reverse operation. The TCP/UDP port numbers are used to know to what internal host the packets relate.
However, from the point of view of the router, the internal hosts have (private) IP addresses which are directly reachable. NAT is for communications between the internal hosts and machines beyond the router.

Let's take an example:

Inner <---> HomeRouter <---> ISPRouter <---> The Internet

"Inner" is your PC. "HomeRouter" is the router which does the NAT. "ISPRouter" is the router at your ISP.

The "firewall effect" is the following: usually, even if "Inner" has an open port (it runs a remotely reachable service, e.g. a local Web server on port 80), people from "the Internet" will not be able to connect to it. The reason is the following: there are two ways by which an IP packet may be transferred by HomeRouter to Inner:

An incoming packet may come with HomeRouter's address as destination, and targeting a port which HomeRouter knows to be associated with an outgoing connection from Inner to somewhere on the Internet. This works only for a connection which was initiated by Inner, and this implies that the port will not match that of the server which runs on Inner.
An IP packet contains Inner's private IP address as destination and is somehow brought to the attention of HomeRouter. But ISPRouter does not know Inner's private IP, and would not forward an IP packet meant for that address to HomeRouter. Source routing could be used to tag a packet with Inner's private IP address as destination and HomeRouter's public IP address as intermediate host. If ISPRouter supports source routing, then such a packet will reach Inner, regardless of NAT. It so happens that almost no ISP actually supports source routing.

Therefore, the "firewall effect" of NAT relies on two properties:

Attackers are far: attackers do not inject packets directly on the link between the home router and the ISP; all their attempts must go through the ISP routers.
ISP don't allow source routing. This is the (very) common case.

So in practice there are a lot of machines, in private homes and small business, which could be hacked into in a matter of seconds except that they benefit from the "firewall effect" of NAT.

So what of IPv6 ? NAT was designed and deployed (widely deployed) in order to cope with the scarcity of free IPv4 addresses. Without NAT, the IPcalypse would have already destroyed civilization (or triggered IPv6 actual usage, maybe). IPv6 uses 128-bit addresses, instead of the meagre 32-bit IPv4 addresses, precisely so that crude workarounds like NAT need not be used.

You can use NAT with IPv6, but it makes little sense - if you can live with NAT, why would you switch to IPv6 at all ?

However, without NAT, then no "firewall effect", flimsy as it could be. Most operating systems are now IPv6 ready, and will use it automatically if given the chance. Therefore, if an ISP decides to switch IPv6 on, just like that, then a lot of machines which were hitherto "hidden" behind a NAT will become reachable from the outside. This could well turn into a worldwide hacking orgy. It is no wonder that ISP are somewhat... reluctant.

To switch to IPv6 nicely, you have to couple its enabling with some solid, well-thought firewalling rules, which will prevent incoming connections which were not possible in a NAT world (with the caveats explained above), but are now feasible thanks to the magic of IPv6. The operational word here is "think": this will require some time from some people, and that's not free.

So it can be predicted that IPv4 will be used and maintained as long as it can be tolerated, and, thanks to NAT and transparent proxies, this will be a long time (especially if we succeed at containing human population below 10 billions).