What does SSI signal does mean in captured packets in wireshark? In the packet captured below, captured by wireshark

does the SSI Signal in dBm represents the power at which the sniffing network adapter (say USB network adapter wlan1 on Raspberry Pi3) received the packet or it represents the power at which a nearby Wi-Fi AP (access point) received this packet?
(Sorry if this question is too easy for you guys).

A similar point has been answered on Wireshark's own SO/SE in How to interpret signal strength.  Yet we can add some more details here.  And add some up to date links since the ones on that answer died.

The SSI Signal is radiotap's antena signal (and the SSI noise is the antenna noise) and we see in there:

  RF signal power at the antenna. This field contains a single signed 8-bit value, which indicates the RF signal power at the antenna, in decibels difference from 1mW.

*(emphasis mine)

Borrowing from the answer on wireshark's SO we have:

10((dBm-30)/10) Watts

So, yeah, that pretty much is signal power.  But note that that is:

What your card is telling you, radiotap is an encapsulation, not something that actually went through the air.  Therefore:

  the sniffing network adapter received the packet or it represents the power at which a nearby AP (access point) received this packet?

It is the sniffing adapter/card/antenna.
Not the strength of the signal for the packet it is the strength of the signal at the time that the packet was received.  Now, as we saw in the radiotap quote above, it is the power at the antenna.  But note that there is also noise there (SSI noise).  I'm not particularly confident that:

SSI Signal - SSI Noise = Actual power that the *packet* was received

This is because you have Signal to Noise Ratio, and some of the noise could have been interpreted as part of the signal.  SNR is beyond me though.

In summary, radiotap is the encapsulation of the state of your network card and antenna at the time that the packet was received.  Whether that can be used as an estimate of AP signal strength is debatable.  Since the signal strength is the signal of the network that the card is retrieving packets from and the rest is (more-or-less) noise then you can use that as an estimate.

In laboratory conditions I'd argue that the signal strength presented in the radiotap is a good enough estimate of signal AP strength discounted the distance from the AP.  Yet, in  the real world, e.g. in an urban area with a lot of APs and interference, the radiotap signal strength is neigh useless to tell you anything about an AP.

Extra

Also note that the radiotap encapsulation is part of IEEE 802.11 and is defacto standard for captured wireless packets.  Calling it a header is an oversimplification.  There is a header that defines several fields that may be present or not and then there is a list of fields that a certain card may or may not provide (but should tell you which ones are provided through the header).  This can be analogous to TCP and TCP options.

For example, in the Linux kernel code you can find the definition of the header in include/net/ieee80211_radiotap.h.  And then the structure that is built after the header in net/wireless/radiotap.c.

Some useful reading:

radiotap description
wireshark usage for RF


Is this an SMS hack attempt? A member of staff at work has been getting a number of texts like the below. He got a batch of them in July, and then again 2 weeks ago.

Am trying to find out if this is a hack attempt. Has anyone seen similar, is there an explanation?

NB, he doesn't know the number sending them.

Also, his phone runs iOS 9.3.2 (though he is not sure when he last updated).
There was a serious vuln published in July to do with image handling which apparently allowed a hacker to exfiltrate passwords just by sending an image and having it render in messaging. My main worry is that this might be something to do with that?

On device tests

Check the logs off the previous batches of texts; if they came in some what regular intervals and then stopped I'd take that as a sign of automated hacking attempts. And their stopping as a sign that either; they ran out of exploits to try, or had one succeed in pwnage.
Check the time stamp of latest system update, if messages resumed shortly after an upgrade then I'd take that as a sign that it was once in a bot-net and is being re-assimilated once again.

Suggested actions

Do not respond to the number. Some automated phishing/malware deployment scripts seem to be testing for text compatibility before attempting to send payloads.
Do not plug the device into any computer; not even for forensics! I've already heard one horror story that didn't end well when an infected phone touched a PC in a USB way.
Do not allow it on your local Wi-Fi network. While I've not seen malware jump over Wi-Fi in the wild (between phones and PC that is) I've tested if possible on Android and it isn't hard.. on my own devices only (I'm not a distributor) which you can read up on it at Stack Overflow where I've detailed how to get Android running Metasploit.
Do take the device into the dealer and make them explain what those messages are. If they can't figure it out ask for their security department contact details.
Do contact the security department for the devices service provider. Ask them to either monitor the account and traffic for suspicious activity or send them the device for imaging. Their hardware is put at risk instead of you own.
Check the local laws regarding harassment. If the texts are coming in at times that are legally defined as an inconvenience then you maybe able to take this issue to government agencies responsible for enforcement and investigation.

I've experienced having to report possible security issues to two different service providers and can say that you'll need to be patient & persistent. This is because from my expenses to get in contact with both the right department and the correct person took multiple calls, transfers, and luck. Most will tell you to turn it off and back on again in which case ask to be transferred up the chain till you get someone with more that the minimum required metal capabilities to be considered living and warm.

That all being said the best course of action is to notify the service provider because not notifying them may make you partly liable for damages done to other servers or devices. Think of it like knowingly spreading an infectious disease if you don't notify them because that device is showing symptoms.

Edits & updates

Additional malware hunting options

Both Android and iPhone have an interesting bug/feature involving Airplane mode which I documented a bit at Security Stack Exchange here's the relevant quote...

  For Rooted Android (attacking/sniffing) I like InterceterNG and DSploit for intercepting traffic between another device and it's WiFi access point. However for this to work on cell phones and force all traffic through the WiFi the target should first be put into 'Airplane Mode' and then have it's WiFi turned on. Then fire up interceptor on the attacking Android device and sniff away. WireSkark helps with pcap files but if you just need IPs and packets with time stamp IntercepterNG is great on the go; it'll even try to help strip https.

... the suggested course of action was to intentionally "Man in The Middle" (MiTM) attack the device's Wi-Fi and profile it's traffic.

Note this trick with airplane mode also works for Bluetooth sniffing.


Custom socket server on the internet running as root We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the firewall, and serve internet traffic. As written today, the server directly mmap's /dev/mem, which requires root.

This feels like a terrible liability.

Without knowing specific exploits, it's hard to make a compelling argument against this decision beyond handwaving with "best practices," "principle of least privilege," "execute arbitrary code as root," or simply "this is f****ing insane."

How can I convince management that we need to run the server as a non-root user, even if it means significant code changes and schedule delay?

That the code "runs as root" is mostly irrelevant. Root or non-root is a distinction that makes sense only locally to a machine, and only if you want to contain some potentially hostile code (e.g. hijacked server code) without bringing down the whole machine. This is the mainframe model from a few decades ago. At that time, it was believed that you could have a Unix (or Unix-like) system such that non-root process could be kept apart from each other, without any possibility to evade that containment and reach other process on the same machine.

This belief hardly holds nowadays. Local privilege escalations are plentiful; it is very hard to plug them all while maintaining a fully functional environment. In general, it is safer to assume that any hostile code running on the machine, under any user, will be able to take control of the whole system, unless some stronger containment measures are applied, such as (in increasing levels of complexity and containment) chroot, jail, virtual machines. In any case, a process that calls mmap() on /dev/mem can gain full control on the local machine (possibly the virtual machine if you go the VM road).

The conclusion of all that is that if your machine is hacked into, and making it Internet-facing sure increases that likelihood, then you should ask yourself what could happen if it gets subverted by hostile outsiders. Changing the code not to run as root and not to mmap /dev/mem does not substantially change things here. What matters is whether the code has been well designed, reviewed, tested, documented and maintained.

I must say that a direct mmap() on /dev/mem sends a strong signal of "these guys should not be allowed to go near a keyboard". I don't know why you are doing that in your server(*) but it seems real weird. Mapping physical RAM in your address space is not a security issue, unless you cling to the outdated mainframe model; however, doing very funky things is a security issue because it makes design, reviewing, testing, documentation and maintenance much harder.

(*) My best guess is that your server interacts with a custom piece of hardware that lacks a specific kernel driver, and does I/O by mapping its circuitry in the physical address space, like, say, a graphics card. It would be cleaner, and thus safer, to actually write an appropriate kernel driver.


Checking if a server is compromised I do free/low-cost web/shell hosting as a non-profit organization (With a the same friend and co-founder) since 2007.

We're on CentOS 6 + CPanel, and unfortunately we're still funding the organization from our own money. Since last year, we've noticed some strange subdomains, additional domains and parking domains created for phishing websites, we usually suspend or terminate them until we've noticed it was random and sometimes on trustworthy customers account or even ours (personal admin accounts).

2 months ago, we've rent a new and stronger server, reconfigured it from scratch and migrated the CPanel account, changed passwords, prevented root login without password ans changed our WHM access key, but the "strange" domains/subdomains are still appearing and BuyCpanel (our CPanel licence reseller) told us it seems to be a compromised server and we should investigate it.

We would like to investigate it ourselves but we don't know where to start or how to trace the origin of "compromise", we've checked root connections, FTP connections, WHM connections, we can't find a trace of a script creating the subdomains. Can you give us some advices?

Thanks

All of the recommendations start by telling you to disconnect the server from the Internet, something that might not be possible here. The problem is, a determined attacker can get round any changes you make "live" faster than you can change things.

One of your biggest problems is your reliance on 3rd party software such as CPanel. This shows regular vulnerabilities that would allow attackers to gain remote access and elevated privileges. Unless you can move your DNS and domain management functions out of CPanel and disable them there, I'm not sure you are going to be able to totally fix the problem.

I'd perhaps recommend moving that part of the service to a secondary server that doesn't use CPanel and has an absolutely minimal server install. Make sure all accounts have long passwords and don't connect the two systems until you have fully hardened the new server. You need to ensure that you have IPTABLES configured correctly and have moved any remote access to non-standard ports (don't leave SSH on port 22 for example or you will never be able to spot real problems in your logs from the constant hacking attempts.).

You also need to make all of your users aware of the ongoing problem. Keep them informed.

Also, did you change all your account passwords and certificates after you updated after Heartbleed?


Is it possible to go undetected on a WiFi network? How could someone go undetected on a WiFi? (No trace with NMap scan, not in network admin page)
Is this even possible?
If so, how can you prevent it?

If being undetected while on WiFi network isn’t possible, what are some key things to do to hide your devices identity while on a network? (MAC spoofing?)

One thing you can do is disguise yourself. Look at the devices on the network and pretend to be like them. Change your hostname to match their naming scheme, change your MAC address, and if you feel really cool, expose the same types of services on the same ports (granted there is a lot of ways to go wrong there...). If the devices don't have general access to the Internet (for example, if it's an IoT network where HTTP is blocked but NTP isn't), see what ports the other devices are using and try to use that to communicate with your external server (which can then translate the traffic into standard web traffic if necessary). Be warned there are ways to detect suspicious traffic that's using the wrong port.

However, that's all targeted at sophisticated networks. If you're dealing with a home network with a cheap WiFi router, you can sometimes evade detection by... using a static IP address. Some routers will only list DHCP clients in their web admin pages.


Ransom32: How does it work? Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which contains the harmful JavaScript as well as the means to execute it.

But what exactly does Ransom32 exploit? A vulnerability in WinRAR or in Windows? Or does it rely on wrong user behavior?

The best description I could find:

  The malware uses the script language implemented in WinRAR to automatically unpack the content of the archive into the user’s temporary files directory and execute the “chrome.exe” file contained in the archive.
  [...]
  Once Ransom32 arrives on a system and is executed [by whom? the .rar itself?], it will first unpack all its files into the temporary files folder. From there it copies itself into the “%AppData%\Chrome Browser” directory. It uses the bundled “s.exe” file to create a shortcut in the user’s Startup folder named “ChromeService” that will make sure the malware is being executed on every boot.
  source

So to me, it sounds like an attack works like this:

User downloads a .rar file
User opens the file (or does it open itself?)
The .rar file decides for itself where to extract to
The .rar file executes a .exe file (or must the user execute it?)
The executed file will copy/link itself to a specific location, so that it is started on every boot

Is this a correct summary?

If it is, it would seem to me as if steps 3. to 5. really shouldn't be happening[*]. Does Ransom32 exploit some known vulnerability in Windows or WinRAR? Or is this desired behavior, and did I misunderstand how the ransomware affects the system?

[*] I'm not that familiar with Windows security, but it doesn't seem like a good idea to let a .rar file decide for itself where it wants to be extracted to, or to let a .rar file execute .exe files.

Nope, no software exploits, just classic exploitation of dumb users.

The payload is distributed in a self-extracting RAR file. A self-extracting RAR file is really just an executable extractor with the .rar file appended to the file. Such a file is an executable file with the .exe extension, and has a feature to run arbitrary code after extraction.

The steps are more like this:

User downloads a .exe file
User runs the .exe file (Fail!)
The .exe file extracts itself to the users Google Chrome profile to hide in
The .exe file run some code to make the extracted malware run and run at boot

There's really nothing original about this.

This post is based on the information in the following article:

http://www.bleepingcomputer.com/news/security/ransom32-is-the-first-ransomware-written-in-javascript/


Is openVZ patched against all exploits for its current kernel version? I am looking for a container vitalization software that will allow me to create containers that will house specific software/jobs/tasks which I can start stop at will (and bind to interface aliases). The containers will house actual users as well as specific servers for such entities like video games.

I have a few different pieces of software I am considering at the moment which are FreeBSD jails (which I have yet to get working inside a VM), and openVZ (which I have currently working), and maybe a full virtualization platform like KVM (which I haven't used at all).

Anyways, my first question is... since I noticed that openVZ is using the 2.6.32 kernel (which has known local root and other exploits), is the openVZ version of this kernel up to date with patches? If not would I be better off using FreeBSD jails, or other software like KVM on a more up to date kernel?

My second question is... if openVZ is not fully patched because of its old kernel, is there a way to use a updated kernel with the openVZ containers? I am using Debian wheezy 3.2.0-4 as my host node kernel if it matters at all (even though openVZ replaces the kernel).

And my list question (although unrelated to openVZ itself)... with software like KVM is it straight forward to create a virtual machine and bind it to a specific IP alias like in openVZ? I know FreeBSD jails and openVZ can only create Linux containers as they share their kernel with their containers, but KVM allows for full virtualization of other OS platforms like windows which is something I may look into in the future.

Thanks for your time and answers.

Just take a look at OpenVZ kernel changelogs -- there are regular (up to a few times per month) kernel releases, often with CVE fixes. Also, it's not 2.6.32 -- it's RHEL6 (which was based on 2.6.32 but moved forward a lot).


Security Benefits in Replacing Windows Desktop Programs with New Windows Store Apps for Higher-Risk Uses? Question:

I'll put this as concretely as I can:  For a small business-owning user of a Windows 10 PC who's highest-security-risk activities involve opening plenty of email attachments of PDF and Office documents from sources on the Internet, would uninstalling the traditional desktop Adobe Reader and Microsoft Office 2013 suite programs now used to open & work with those documents and replacing them with the MS Reader and Office for Windows 10 apps from the Windows Store constitute make a sizable difference in the security of that user's PC? (Assuming the user would go along with that.)

Follow-up question:  If so, does that have more to do with Windows Store apps (ie. new Windows 10 and arguably Windows 8.1 apps) inherently having stronger security characteristics in the new Windows app model, or with there being so much more attention and effort put into finding weaknesses in & attacking the legacy desktop programs because they are still much, much, much more widely used?

Some Elaboration

Was writing an email to a client of mine (a small business owner) answering a question about matters related to starting to move the PCs in the back offices of the his three stores from Windows 7 to Windows 10.  I was mentioning just a bit about the security improvements that might come from that upgrade when I starting trying to describe the possible benefits of using new Windows Store apps to do higher risk things like open documents that arrive in email attachments vs. using traditional Windows legacy desktop programs. I wrote this:

  Using Windows Store applications to do risky day-to-day things is
  much safer than doing them with legacy desktop programs, because a security measure called AppContainer constrains apps that contain programming flaws [ie. security vulnerabilities] and might be hijackable by bad guys from doing a lot of bad things on your PC if that happens, because the new apps are often written in more secure ways [ie. meaning with managed languages like C# and html5/JavaScript, although C: and C++ are certainly still available choices],  and because Microsoft verifies the identities of developers and screens the code of apps before they become available in the Store.

I wrote that paragraph, then stopped, thought for a second, then deleted in from my reply.  Partly because I was getting more off-track about what the conversation started off being about (Windows 10 compatibility with a creaking old l.o.b. inventory program. Fun.), but also because re-reading it I wasn't totally sure it was correct.

I mean, the P.R. from Redmond certainly has been that they're a big improvement re. application security issues in the new model apps vs. legacy Windows programs. And I haven't read about major attacks occurring against say, Microsoft's official's pdf reader app in the Windows Store or the Office for Windows 10 apps, which obviously is far from the case with the legacy Adobe Reader and Office suite programs. But on the other hand there are a lot fewer installs of the new apps out there than the utterly ubiquitous traditional versions.  But on the other, other hand having that AppContainer sandbox + other security technologies & mechanisms that the Windows Store apps probably has to do some good..... Huh.

The main purpose of the store apps is to enable users to use the same set of apps wherever they go, by using their Microsoft account as the login credentials. So, as far as the password is secure and that the user account is properly signed out/locked when the PC is not in use, the user information remains secure. Further, it lets the app publisher to verify the legitimacy of the license of the software being used. So there is no possibility of cracks/hacks, making the application secure from the backdoors created by cracks/hacks.


Are self signed certs safe to a developer use in local debug? The same computer I use for work in home, is the same for personal uses (gamimg, social medias) and of course, internet banking.

I'm back-end developer and recently, I started to work with fiddler to intercept requests coming from mobile apps to debug and API... And exploring the tool, I saw that fiddler has and configuration that use some of these certs and decrypt header and body of a request and response.

I'd like to know if it's safe having these self signed certs installed in computer for some applications use, like Fiddler, Postman for instance, don't they open security breaches?

I'd like to know if it's safe having these self signed certs installed in computer for some applications use, like Fiddler, Postman for instance, don't they open security breaches?

When you use intercepting proxies such as Fiddler and/or BurpSuite, the certificate needs to be imported in your browser. You have to trust this certificate in order to intercept HTTPS traffic.

The certificate that you are trusting is generated on your computer and is supposed to be different for all users that install these tools. In case of paranoia, you could regenerate the certificate after installing these tools (at least I know it is possible in BurpSuite)

I'd recommend only installing the certificate in the (one) browser only and use other browsers to do your non-developing work such as banking.


Zone elevation protection in Google Chrome Internet Explorer has a security feature called "Zone Elevation Protection", in which sites outside a list of trusted sites (which can be configured) are not allowed to navigate to the ones on the list.

Is there anything similar to that on Google Chrome? I know a similar protection does exist for treating local files, but can I do something like that for a list of trusted sites? (Even being that a list of SSL-trusted sites?)

The zone concept first appeared in Internet Explorer 4 (1997). It got prommoted to more prominent status in Internet Explorer 5. It was microsoft's attempt to model the web in discrete steps of trustworthyness/danger. Most other browsers use the white-list(trusted) and black-list(dangerous) method instead of zones.

What Internet explorer is doing is protecting it's zone concept by preventing a dangerous site from redirecting to a trusted site and doing some cross site scripting (XSS) when IE things it is at a trusted site. Really a IE specific XSS defense.

Google Chrome Preferences in the "Under the Hood" tab the "Content Settings..." allows you to set exceptions (white-lists) to the content restriction rules. This is a more fine grained level of control because you can set exceptions on a per site basis rather than for every site defined to be in a particular zone.


Why do we trust US Certificate Authorities? Why do people trust companies in countries with big surveillance programs like the US?

Many US Certificate Authorities secure the web for live SSL/TLS connections. Still, a NSL would be enough for the government to gain the right to intercept the traffic legally. So why does anybody even assume that US CAs are remotely private?

Why do big companies and other (illegal) organizations where privacy is a big factor not fully use CAs from countries with strict privacy laws like Switzerland or Sweden?

Why do big companies (...) not fully use CAs from countries with strict privacy laws like Switzerland or Sweden?

Because any CA can issue a certificate for any domain anyway (with some caveats).

If your ISP wanted to intercept all your future connections to https://example.com/ by exchanging its certificate with a rogue one, they wouldn't have to ask the original issuer of the certificate for help. They just needed to get any issuer in your local root certificate store to issue the certificate, and your browser would accept it as valid (you'd see the green lock icon and not be aware of the attack without examining the certificate).

So switching to a more reliable CA wouldn't help the site owner a whole lot against a government actor. (If you personally distrust some CAs, you could also revoke their trust locally in your root cert store.)

Instead, what a site owner can do is use certificate / public key pinning. E.g., a website can send a HPKP header to announce hashes of public keys that must be part of the certificate chain when connecting to the site. If a site has implemented HPKP correctly and your browser is aware of the pins (either by having seen the header before or by preloading), a rogue certificate would be rejected by the browser even if it was issued by a trusted CA because the attacker (or any CA) can't produce one whose fingerprint matches the pin.


How secure is the new MacBook Pro's Touch ID? I'm afraid that if I will lose my laptop while turned on, somebody might take the fingerprint off the screen or somewhere else and unlock my laptop with the fingerprint sensor.

Is this a valid concern?

Your concern is perfectly valid in theory.

I am not an expert in fingerprint recreation, but a I've read quite a few articles where people have successfully hacked in devices using the fingerprint sensor via one of the following methods -

A high resolution picture of a finger. Link - https://gizmodo.com/chaos-computer-club-says-they-can-hack-your-fingerprint-1675845311
Using a material to store the host's fingerprint like rubber cement or silicon gel. In fact the attacker can even use tape or the imprints left on a keyboard to recreate a fingerprint which will easily pass through as legit.

The reason it is easy is because finger print recognition like face recognition is a 'not such a great way of authentication' on the level of personal applications. The fingerprint sensor is essentially a camera that takes a close up image of the finger and its valleys. So in the way face recognition fails when you use a printed picture to pass through it, one can pass through fingerprint sensors. It works well in places where you are authenticating yourself in front of a guard, like in military or research bases. At the level of personal items they are more of a convince like me using my fingerprint sensor on my phone to not spend time unlocking my phone via a pattern or a password. Surely one can't 'read' or 'guess' my fingerprint but if an attacker is good enough, any fingerprint sensor isn't good enough. That perfectly brings me to my final point.

To quote an expert who was being interviewed at DEFCON, "A dangerous hacker is a black-belt martial artist, if he chooses to beat you up, there isn't much you can do unless you know it firsthand." Same goes for hacking, if you are really concerned and think that someone is after your data, use a good password and set up a few more steps that ensure your data is safe and not in wrong hands. If you think otherwise, use it as a convenience.


Can my customer's ISP trace who visited my business website? I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web site (by seeing which user IP visited my website's IP). My web site has an SSL certificate, HTTPS, therefore static IP.

My concern is if people from these ISPs find out who visits my web site and provide this info to my business competitors. I do not know if it happens, I want to avoid this possibility. How can I achieve this?

Yes they can. If they are logging all outgoing connections (as for instance Turkish or Chinese ISPs tend to do) then they can easily correlate locally used IPs to your website.

SSL works at higher level of the internet stack. Furthermore even if you would obfuscate your IP address they would still see your customers DNS requests passing by. There is no way to obfuscate this unless all your customers start using Tor or another VPN solution which is not transparent to their ISPs.


Should anyone support / implement P3P policies? Do they matter? Are they legally binding? Google and Facebook authentication both have fake P3P policies in the HTTP headers that link to a webpage that explains why they don't support it:

CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"

Considering that companies listed above are in the business of collecting PII information for social networking I'm not sure I want to believe their claims.  Also note that I can't find a similar invalid P3P policy in Yahoo's or Microsoft's website, I'm not sure who to believe.

  Are Google and Facebook giving out bad advice, saying that this is an outdated
  technology? (perhaps to protect their own self-interests)

  If the technology really is outdated, are there legal ramifications of having
  a "fake" P3P policy to allow cross domain cookies in IE?

  Should anyone support P3P policies at all (given that they may be in fact outdated)

  Are they legally binding?

I agree with most of the previous responses, but note that the FB and Google compact policies might be considered fraudulent due to the fact that they omit P3P elements and the way the P3P syntax is defined, omitting an element is an affirmative statement that you do not do the practice represented by that element. (See for example section 3.3.4 of the P3P spec: "Service providers MUST disclose all that apply. If a service provider does not disclose that a data element will be used for a given purpose, that is a representation that data will not be used for that purpose.") Also, the policies might be considered deceptive since an IE user might rely on IE to block cookies from websites without CPs and these CPs are designed to evade IE's blocking. However, I am not a lawyer.

There is a class action lawsuit pending against Amazon on a similar matter
http://www.infolawgroup.com/tags/p3p/

And there is a relevant research paper at
http://www.cylab.cmu.edu/research/techreports/2010/tr_cylab10014.html


What is the need for the ;(1 in this XSS payload? In an XSS attack (proof of concept for pen testing reasons), the following string is appended to a url:

;alert(String.fromCharCode(88,83,83));(1

I understand what the ;alert(String.fromCharCode(88,83,83)) does (it just creates an alert dialog saying "XSS"). What I don't understand is why it needs the ;(1 for it to work.

What is the need for that last piece of text? Also why have the number 1? I tried letters and different numbers and both worked.

As far as I think, the

  ; in ;(1 is just for ending the alert tag.

And since you haven't mentioned in which context are you using this payload, it will be best to say that the ( is simply starting because there must be another ) after that so that the two parenthesis can match.

  Also, as you are concerned about 1, I think, you can write anything there "aaa" or "blahblahblah" will also work.

P.S. You have yourself mentioned in the question that both numbers and strings worked. When you are using this payload, just check in the response where does it get inserted. So that you can see by yourself how one parenthesis is used for closing the other to make a valid statement. Cheers..:)


Unlock a computer bios? If someone adds a password to the bios of a computer and make it so that when booting the computer it prompts for the password, is there any way to bypass or overide that protection?

Take out the CMOS battery, which is on the inside of the computer on the mother board. Wait for 20-30 seconds (less time may be needed, but the exact time varies). This is normally a button battery. Put the battery back, boot, and there should be no more BIOS password.


Link between Cipher suites and certificate key I'm trying to understand the SSL/TLS protocol and I'm lost on a specific point.

What is the link between the public server key (eg. : "EC 256 bits" or "    RSA 2048 bits") and the cipher suites ?

This post give an answer : SSL certificates and cipher suites correspondence but when I try to analyse cipher suites for https://www.wikipedia.org, there is something illogical to me.
wikipedia.org has an EC 256 bits key and TLS_RSA_WITH_AES_128_CBC_SHA is an accepted cipher suite. According to this post SSL certificates and cipher suites correspondence (if I understand it correctly) it should not be possible because

"
For TLS_RSA_* cipher suites, key exchange uses encryption of a client-chosen random value with the server's RSA public key, so the server's public key must be of type RSA, and must be appropriate for encryption (the server's certificate must not include a Key Usage extension that says "signature only").
"

So, why can we use TLS_RSA_WITH_AES_128_CBC_SHA on wikipedia?

The TLS_RSA_WITH_AES_128_CBC_SHA ciphersuite uses RSA for both authentication and key exchange.  Key length is not specified, but the current standard is 2048 bit RSA keys, so that is likely what is used in this case.

For other ciphersuites, you may see components that differentiate between the key exchange algorithm and the authentication algorithm. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 would be an example of this, where ECDHE (Elliptic Curve Diffe Hellman Ephemeral) is the key exchange algorithm, but the key in the certificate is for the Elliptic Curve Digital Signature Algorithm.

So, if the ciphersuite being used for your TLS session was TLS_RSA_WITH_AES_128_CBC_SHA, it was for an RSA certificate, not an ECDSA certificate.  You would have needed to use a different ciphersuite in that case.


Is there a way to access the local DB from external webapp? I found a Django app running on http://test.com that is running on debug mode. After trying some wrong paths I got with the django error screen showing the stacktrace and the credentials used to access the DB.
But this DB is used on the LAN, so I can't access remotely.
Is there a way to bypass this restriction, or even with the credentials there is no way to access this DB?

I want to know if this kind of scenarios is a game over or a hacker could still working with this vulnerabilities.

It depends...

Assuming the web server has access to the DB in the backend you could look for other vulnerabilities in the web application that allows RCE or even SSRF where you can further utilize the credentials you found.

See this for an example of how debug mode on Django was used to achieve RCE and extend access to other systems.

In case of RCE and SSRF you are executing commands as if you are the web server hence you inherit the connectivity of the web server which implies that you need to be able to communicate with the backend DB or other systems on the LAN not directly exposed to the public internet.

If you have mandate to look for issues on this application, I would certainly not stop there and neither would a good bug bounty hunter.


How to encrypt, sign and decrypt a file with gpg? I am using gpg to encrypt and decrypt a file. Here are the steps I am doing taking reference from this question:

# Sender
gpg --encrypt --recipient recipient@gmail.com --output confidential.pgp confidential.txt
gpg -–sign –-local-user sender@gmail.com --output signed.pgp confidential.pgp

# Recipient
gpg --decrypt –output confidential.pgp signed.pgp
gpg --decrypt –output confidential.txt confidential.gpg

It works, but is this the correct way to encrypt, sign and decrypt a file if the signature verification has to be made mandatory at the recipient end? Especially, decrypting twice seems a bit odd. Can this be done in a single command?

I tried using --signdirectly in the encryption command, but it just warns and decrypts the file which doesn't satisfy the mandatory signing requirement. Here is the official manual, but it doesn't talk about doing everything in a single step.

# Sender
gpg -–sign –-local-user sender@gmail.com --encrypt --recipient recipient@gmail.com --output signed.pgp confidential.txt

# Recipient
gpg --decrypt –output confidential.txt signed.pgp

Update 1

After some research, I found a very related question which seems to indicate that gnupg --sign --encrypt first signs and then encrypts a document. So we will have to decrypt it first anyway to see the document. It can optionally output the status using --status-fd which can be used to check if the signature is fine using a simple script. So the code would look like:

# Sender
gpg -–sign –-local-user sender@gmail.com --encrypt --recipient recipient@gmail.com --output signed.pgp confidential.txt

# Recipient
gpg --decrypt --status-fd –output confidential.txt signed.pgp | verify

where verify is a shell script that checks the status registers and aborts if required.

You're trying to use technology to solve a people problem

This is generally not a good idea.

Let me explain a bit more in-depth. You - the sender - generate a message, then encrypt it and then sign the encrypted message. This is akin to writing a letter, putting it into a box, locking the box and then putting your signature on the box.

You want the recipient of the message to verify your signature, then decrypt it and read your message. This is akin to them looking for the signature, verifying that it is correct, then unlocking the box and then reading the letter.

The problem in both scenarios is that you can't control how the other person is going to act. They could be lazy and always just unlock any box they find, just how they could just decrypt anything they find without checking who sent it.

A people problem...

Before, I stated that this is a "people problem". What I mean by that is that you want recipients to verify the signature, so that they don't trust something they're not supposed to. Some people just don't care, and it's hard to fix that. "Making someone care" is very difficult, and human psychology isn't really helping.

For example, when a user does something, they do that for a specific reason. If a computer asks them "Do you really want to do that?" then, they will just click whatever button they need to click for that message to go away. This is true for many security warnings, and unfortunately, there's not a lot you can do technology-wise.

...requires a people solution.

But what you can do is educate users. Explain to them what a signature is, why it's important and why they should care. And if your reason for them to care is because it's mandatory, as you said, then that should be a good enough reason.

Imagine your boss would come in today and say "Look, if there is a warning and you ignore it, you could get fired", then I have quite a high incentive to not click that warning away. It's a people solution, even if it's negative reinforcement.

Security at the cost of usability comes at the cost of security

Someone who is much smarter than me, but who's name I don't remember, once said that. And for all intents and purposes, it's true. You want to use signatures to improve security, and that should be hassle-free for your users. Signatures should be verified automatically without users even having to think about it.

If you tell a user "Command foo does the thing you need to do. Command bar needs to be run before foo and it does something you don't care about", guess how many users will actually run bar and then foo? Approximately none.

Instead, deploy a script that automatically runs bar, checks if the signature is valid and then runs foo.


How do I secure my SaaS startup? I came across this question

I like to offer my startup also for security advice.

Objective: building a SaaS web application that allows businesses to quickly open up online stores akin to Yahoo! Stores.

Programming: Done mostly by me. Sometimes I hire freelancers to help me with stuff I do not know.

I use CakePHP framework for my web application.

Hosting: Using Amazon EC2 and other Amazon Web Services like Elastic Load Balancing.

Systems Administration: I am running Ubuntu server 10.04

I know this is still a high level question. Let me break this up into several subareas.

Programming, collaboration with freelancers

I am using git and a remote git repo on ProjectLocker. I am not an expert in git. All I know is git add, git commit -a, git push, git merge, git checkout , git pull.

When freelancers do work for me, I always tell them to commit their work in a separate branch and I will do a merge myself into the main branch.

Not sure if there is any security loophole there. Please let me know.

Programming, the code itself

Well, you guys cannot see the code, but I am using CakePHP framework.

I think I did everything correctly except that I had to disable the CSRF protection at times to allow certain flash plugins to work.

Not too sure what I should do about it.

Not sure if there is any security loophole there. Please let me know.

Deployment

I use capistrano to do the deployment for me. Basically I think the capistrano ssh'd into the server and from there gives it an instruction to do a git fetch from the remote repository.

I basically copied and pasted the capistrano deploy script from somewhere and modified it.

Not sure if there is any security loophole there. Please let me know.

Web Application for users

Just bought and installed SSL certs. I had to use a wildcard certificate for my users individual subdomains and a standard SSL cert for the signup page.

Did not buy an extended validation SSL cert. Didn't think I need it.

Not sure if there is any security loophole there. Please let me know.

Systems admin, collaboration, hosting:

I do not have a protocol on how to update my server with security updates since I am not LIVE yet.

I would appreciate something simple that a Ubuntu novice can use.

Amazon Web Services, Systems admin, collaboration:

I hired a sys admin freelancer to help me install SSL certs because
a) I am not familiar with Linux,
b) I am not familiar with Amazon Web Services

If in future, I hired someone to help me troubleshoot either Ubuntu or my Amazon Web Services, how do I do it without putting my SaaS at risk?

I saw this for Amazon Web Services

Not sure how to use it.

Can someone give me a good protocol to allow hired freelancers to solve my system admin issues in a safe manner?

Other areas I have NOT thought of

Please let me know.

Alright, this answer is by no means exhaustive as this is a large question, but just off the top of my head here are some thoughts:

GIT:
That's good that you're doing the merges yourself, does that mean you're going to handle all the diffs?  If you're not going to, the trust of the coder could be a POF, but if you are going to depending on the amount of merges expect to spend a lot of time doing all the diffs yourself.

Programming/Framework:
Might want to be careful disabling CSRF, whenever you do that and have flash there can be some nasty exploits.  Best bet to prevent those is to make sure you have really solid session handling, and verify verify verify any time a user is accessing a resource.  You can find some more info on common CSRF stuff here: CSRF FAQs.  Also, watch out for this vulnerability.  I don't have a ton of familiarity with CakePHP, but best rec is to make sure to sanitize, whitelist if possible, use ACLs, etc.  Here is a very basic way to add a bit of additional security to your CakePHP instance.

Server Security:
I don't have a ton of experience with Capistrano, but from what I've heard it's  a pretty solid tool, as long as you've grabbed a reliable fork.  I would be more cognizant of vulnerabilities in the SSH handling itself, as it seems to me that is where capistrano could most likely be exploited.  As for web server security, I think Amazon is one of the best choices out there.

SSL:
I would be very wary of a wildcard cert.  If one of your subdomains is compromised, so will your entire network.  All it takes is one certificate authority having a vulnerability and all of your customers and their data will be compromised.  Since you're doing e-commerce, it's really important to have the highest levels of security for customer data.

Summary:
All in all, I would really recommend hiring a web app security professional who is credible in the field and has experience to take a look at your application.  Since you will be dealing with financial data, which is one of the most sensitive types, a solid exhaustive look at your software is very important.  I know it's hard when you're just starting out, but if you don't take the time to secure your app thoroughly one exploit could bring down your entire business.

Hope that helps :)


Private REST API accessible only via SSH? We are trying to bulletproof our server from DDoS / MIM etc.

Use case:

Clients (<5 in number) want to get some data from remote server
Client open SSH connection to server, they can now access GET REST
APIs on server.

Is this a safe architecture? SSH connection is on a non-default port

What could be the advantages of an SSL + OAuth approach?

Regarding the proposed solution

It solves the problem of MITM/DDoS attacks, As long as your HTTP server doesn't serve to non-local requests. However, you are introducing a new attack surface (the SSH port).

A Different Approach (based on client-friendly approach)

Instead of creating another attack surface (SSH),you have other standards to cases like that:

Using SSL+OAuth as you have suggested, doesn't add the new attack
surface, and let's you ignore requests which are not having a
legitimate token. if you decide to implement Oauth based solution -
DON'T DO IT YOURSELF, because it's a complicated protocol, an you might end up with a lot vulnerabilities. Of course, there are
open sourced libraries for that :)
Using SSL + Cookies/Token bearer (such as JWT) - might be even simpler than Oauth.
Using Client SSL Cetrificate - since you have only 5 clients, this might be a great fit, since it's super simple, and doesn't require too much boilerplate code and maintenance. Furthermore, in some web servers (such as in Apache HTTP Server)
you can validate it in the server, instead of running your own code, which could be translated to a boost in your performance.


Forgot password and revealing whether account exists So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets;

Notify the user whether or not the email address matched with one in the database and based on this advise whether a reset password email was set or;
Immediately respond with a "Email sent" or "If this user exists, we have sent you a password reset email" regardless of whether or a match occurred resulting in an email sent.  This is done (apparently) for security reasons.

I've implemented the latter myself and generally found it raised annoyance with users due to;

If a user mistypes their email address, they are told an email is sent, but they will never receive one.
If they've typed in a different email address than the one they registered with, again they won't be getting an email.
A combination of the above can result in multiple attempts but no receipt of a password reset email, resulting in giving up.

Finally, upon investigation of popular websites that use the second scenario, I've found that attempting to register an account with these sites where the entered email address matches an existing account, a "this email address is already in use, or unavailable" type message is displayed anyway.

As such, what are the benefits not revealing whether a password reset email has matched an account, and, how are these beneficial when registration requires email matches to be revealed?

There is sometimes a trade-off between security and usability.

If it's important to you or your users that other people don't know they're using the site, then your second choice is the best one.

You can always send an email to an address that doesn't exist in your system, like "Someone requested a password reset for this address, but it's not in our system". That handles your second complaint.

Add a link to re-do the password reset on the confirmation page. Hopefully, they'll type in the email correctly the next time.

So, decide whether avoiding user enumeration is more important than the occasional mis-typed email address.

  What are the benefits not revealing whether a password reset email has matched an account

You don't give or confirm a list of users' email addresses to an attacker and don't let other people know that a given user is using your site. If it's a site about kittens, who cares? If it's a bank or extra-marital affair site, then this is important.

  How are these beneficial when registration requires email matches to be revealed?

Who says registration requires this? Do the same thing for registration. Request email address, send "step 2" link, or "someone requested a registration on our site but this address is already registered" emails.


Stop an in-progress passive scan in OWASP ZAP 2.9 I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all.
I have disabled all of the passive scan rules by going to Options -> Passive Scan Rules and setting the threshold to "OFF" on everything.

The console log is saying the following over and over - of course with different times and different URLs

[ZAP-PassiveScanner] WARN org.zaproxy.zap.extension.pscan.PassiveScanThread  - Passive Scan rule html_mailto took 211 seconds to scan https://[target-site-url]

If your session is already persisted then just exit. ZAP will tell you there's still a bunch of stuff to passive scan but you can say you don't care and exit anyway.

There's also this long standing enhancement ticket: https://github.com/zaproxy/zaproxy/issues/3813 if you feel up for contributing and making things even better.


Will creating a shortcut/favorite for my network drive instead of using a mapped drive help prevent encryption by ransomware? For security reasons and the prevention of spread of Malware over the network, is creating a Desktop Shortcut or Internet Explorer favourite considered safer than a Mapped Drive?

No and Yes

No:

  Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore

10 Immutable Laws of Security

Ultimately, if it's running on your system, malware has (at least) the same level of access to your file system, and those of networked resources, as you do. So, strictly speaking, it won't matter whether a file share is "mapped" or linked through a shortcut - if you have access to it, the malware can get to it too.

Yes:

The key word in the above paragraph: can.

Just because malware can do something, doesn't mean it will. Unless you're dealing with an attacker that's specifically targeting you or your organization, the majority of malware you'll encounter is going to be from generic toolkits engineered to optimize effectiveness across the largest possible number of targets. In short, most malware is generic.

It is relatively easy, and generally more valuable on the majority of targets, for malware to just look for mounted drives to infect. If a resource is already mounted in the OS, it's a fair bet that it's within close reach (i.e.: low latency) and that you've got at least some level of access to it. Searching all devices on the local network for drives that will allow the malware to have read/write access is a much more complex and time-consuming matter, and generally much less likely to bear fruit. It's also a lot "noisier", and therefore more likely to be caught by corporate monitoring systems.

This is very commonly seen with ransomware. Most ransomware will (on a Windows system) simply run through all the lettered drives (e.g.: local hard drives, local removable media, mapped network drives) and encrypt whatever it finds in those areas that matches the file types it's made to target. Resources that aren't linked to a drive letter usually won't get touched. So, for ransomware and other malware that behaves similarly, there certainly is a benefit to avoiding mapped network drives.

It is certainly still possible for malware to discover network shares you're connected to even when they're not mapped to a drive letter. To see this in action (for Windows systems), manually browse to a non-mapped network share in File Explorer and then run net use at a command prompt. You'll see the resource you're connected to in that list, with no letter associated.

That said, avoiding networked drive mappings still offers a certain amount of defense against this sort of discovery. To be most useful, mapped drives have to be persistent - that is, the connection is re-established on system startup and it is maintained until you explicitly destroy it. The connection that is made when you follow a desktop shortcut is more transient, though - at most, it will usually only last until the next reboot. So, while it is not impossible for malware to discover this connection it will generally reduce the likelihood of it happening.

TL;DR:

Strictly speaking, once you have malware running on your system it can do whatever it wants to do with resources you have access to - regardless of whether or not they're "mapped".

However, in practice, most malware that you will see is simply going after "low-hanging fruit". So, it will not usually be made to go very far beyond whatever resources your system has mounted at the time of infection. If you avoid using network drive mappings, you substantially reduce the likelihood that there will be a connection for malware to discover when it runs. If you happen to get hit with something that only looks for "drive letters", the impact is completely isolated to the local system.

So, while it may be far from foolproof, there is still some security value in staying away from mapping network drives. In many ways, it's like using a non-default port for common network services. It's a low-effort, additional layer, that you can add to your security posture to obtain potentially high value. (Emphasis on additional because, again, this is not foolproof. You also should have other, more reliable security measures in place to prevent malware infections and isolate their impact.)


Does it matter in which programming language you write the shellcode? I have been searching a lot and I didn't find anything. I still wonder: does it matter in which language you write shellcode? Will shellcode in Assembly, C, etc. work everywhere they can be used and be as good as the other?

The term "shellcode" comes from the fact that it is typically used to gain shell access on the machine. In most cases, shellcode is used when there is a memory corruption-based vulnerability (e.g. buffer overflow) where the attacker is able to write to parts of memory that will be executed or caused to execute. This needs to be machine code, since it is being executed directly by the CPU.

Since there is often limited space to work with in the buffer, shellcode is often designed to be as short as possible, thus it is often written by hand in assembly and dumped to an escaped bytes sequence (e.g. "\x23\xa4\x00"). It is possible to write a C program, compile it, then dump the bytes like above, but the C compiler may introduce unnecessary complexities and add additional length. Usually, the shellcode will be short, and could pull down a second stage off the network if a longer payload is desired.

In short, you need machine code, and it doesn't really matter whether this code came from C or assembly, excepting what was said above. However, the definition of shellcode is somewhat loose and could be applied to interpreted languages as well (e.g. getting a shell by exploiting an unsanitized call to eval() in a Python application), although it is typically not the chosen word in these cases.


How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work? I've been hearing more about the OpenSSL Heartbleed attack, which exploits some flaw in the heartbeat step of TLS. If you haven't heard of it, it allows people to:

Steal OpenSSL private keys
Steal OpenSSL secondary keys
Retrieve up to 64kb of memory from the affected server
As a result, decrypt all traffic between the server and client(s)

The commit to OpenSSL which fixes this issue is here

I'm a bit unclear - everything I've read contains information about what one should do about it, but not how it works. So, how does this attack work?

This is not a flaw in TLS; it is a simple memory safety bug in OpenSSL.

The best explanations I've run across so far are the blog posts Diagnosis of the OpenSSL Heartbleed Bug by Sean Cassidy and Attack of the week: OpenSSL Heartbleed by Matthew Green.

In short, Heartbeat allows one endpoint to go "I'm sending you some data, echo it back to me". You send both a length figure and the data itself. The length figure can be up to 64 KiB. Unfortunately, if you use the length figure to claim "I'm sending 64 KiB of data" (for example) and then only really send, say, one byte, OpenSSL would send you back your one byte -- and 64 KiB (minus one) of other data from RAM.

Whoops!

This allows the other endpoint to get random portions of memory from the process using OpenSSL. An attacker cannot choose which memory, but if they try enough times, their request's data structure is likely to wind up next to something interesting, such as your private keys, or users' cookies or passwords.

None of this activity will be logged anywhere, unless you record, like, all your raw TLS connection data.

Not good.

The above xkcd comic does a nice job illustrating the issue.

Edit: I wrote in a comment below that the heartbeat messages are encrypted. This is not always true. You can send a heartbeat early in the TLS handshake, before encryption has been turned on (though you're not supposed to). In this case, both the request and response will be unencrypted. In normal usage, heartbeats ought to always be sent later, encrypted, but most exploit tools will probably not bother to complete the handshake and wait for encryption. (Thanks, RedBaron.)


What are the risks of not hashing auto-generated passwords? Summary

The main reason for hashing passwords seems to be that users reuse passwords and, thus, leaked passwords would disclose sensitive information about a user (cf. this question.)

If the password is auto-generated and cannot be changed by a user, are there still good reasons for storing only the (salted) hash of a password?

Concrete example

I have two components which need to communicate, say, device A calls webservice B via HTTPS. To prevent some malicious actor from connecting to B and pretending to be A, A provides a password. I auto-generate a password and put it into the config files of A and B.

Now, A obviously needs the password in plain text, but B would only require the hash (since B can just hash the value received from A and compare it with the hash it has on file). Thus, my security-conscious gut feeling tells me that I should only store the hash in B's config file, but looking at the pros and cons, it is not so obvious:

Pros of storing only the hash on B:

In the unlikely case that B's config file gets compromised without B itself being compromised, an attacker can use the password to impersonate A. (If B itself is compromised, the attacker obviously does not need the password any more.)

Cons of storing only the hash on B:

If A breaks and needs to be replaced, I need to change the hash on B because I don't have the original password any more. (Alternatively, I need to have my client, on whose premise A and B run, securely store the password, which they probably won't do. Alternatively, I need to store the password securely somewhere, which is additional work and liability risk for myself.)

Any other pros/cons that I missed?

The main reason for hashing passwords seems to be that users reuse
  passwords and, thus, leaked passwords would disclose sensitive
  information about a user

This is an incorrect statement. The main reason for hashing is to protect passwords from disclosure in case an attacker has got access to the database (access to the database directly or to its backup). It does not matter if the password was created by the user or generated by some tool.

You are right that weak passwords can be "improved" by hashing. But hashing cannot really make a weak password secure. E.g. if an attacker takes a database with 100 000 of weak passwords, he/she can test all of them easily despite using "resource expensive" hashing like Argon2. That's why hashing should not replace the check of password quality. If the user changes the password, the password should be validated to ensure sufficient complexity (length, randomness). This is equally applicable to passwords of real users and for passwords of "technical" users like your "device A".

In my opinion, generating a hash (in case the password for device A needs to be updated/replaced) is pretty easy. And this should be done not only in an emergency case when A was compromised, but it should be done regularly, e.g. once a month or once every 3 months. The admins should have a tool for it. So that updating a password takes a few seconds. That's why I don't see any disadvantages with it.

TLDR: There are no real disadvantages, there are only advantages.


Password cracking using a wordlist I came across a test question that said "Given a random password, which type of mode typically produces fastest results?" and the two likely answers were "brute force" and "incremental". The instructions were to circle all of the possibilities (so not you're typical multiple choice). First off, I think the question is poorly worded: does it mean random password as in any password you know nothing about or random password as in you know that a random password generator was used to produce it? This makes a difference as a user generated password probably has words in it that may be in a wordlist.

Is my reasoning correct, a wordlist is only useful if there's words in the password, and wastes time if there's not? Can an attacker know in advanced whether or not there's word in a password they're trying to crack?

I know in John the Ripper there's word mangling rules, what is this?

By the way, are the terms "dictionary" and "wordlist" usually used interchangeably in this context?

The question is poorly worded but it's safe to assume they're talking about human generated passwords.

  Is my reasoning correct, a wordlist is only useful if there's words in
  the password, and wastes time if there's not?

Using a wordlist can be successful on random passwords, although incremental cracking will usually be more performant.

  I know in John the Ripper there's word mangling rules, what is this?

In my understanding, this refers to leetspeaking words (e.g 'f00tball' instead of 'football'.)

  By the way, are the terms "dictionary" and "wordlist" usually used interchangeably in this context?

Yes.


Privilege escalation using symlink I am working on a "Hack me" challenge, I have access to apache account in the server, I tried to get root access, I run linpeas.sh script and linpeas didn't find anything special, however, there is a file /etc/profile.d/modules.csh which I have write permission on that
However, this file is a symbolic link to another file (Which I don't have access to write on that)
Can I do something with this symlink file? the contents of the symlink file is exactly the same as the file which it points to, what happen if I edit  the contents of symlink file?
and do you have any other idea for privilege escalation? (Note that Linpeas didn't find anything special)

From man symlink(2):

The permissions of a symbolic link are irrelevant; the ownership
is ignored when following the link

So no, without write permissions on the file, you may not edit it.
There is also not a "symlink file"; the symlink is just a pointer to another file.


ESP8266 Dash Button Security I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The action should only be triggered from this specific microcontroller. Replaying the Api Call may not be possible.

How can i archive this?

I think about challange response with a secret both client(esp8266) and server knows.

You would want a large list of secrets on SPIFFS files (removing after use) or track used secrets (and search for usage using a set of nested 1st letter\2nd letter\etc folders) to prevent a replay attack.

A dash button is simple; depending on your other libs and code, you probably have enough RAM left to use HTTPS (depending on the cert). That would make replay a lot harder since the prior guesses would be "dark" to observers. You can likely re-use keys or at least parts of keys if you use HTTPS.

Another option would be to use secure ESPNOW to talk to another ESP which has an Ethernet controller which talks over the wire to a PC that then uses HTTPS to talk to the outside world, and can further authenticate requests in a PC environment (lots of easy options) instead of an MCU environment (few hard options).


What will happen if I use weak passwords in a free SMS-sending website that exposes few personal information? There's a free SMS sending service in our country. It requires a phone number to log in. Once registered, you can send SMS to any phone number within this country. The phone number which you use to send the SMS will be displayed to the recipient.

How risky is it and what will happen in worst case scenarios if one were to use a password such as '123456', 'password', or the phone number itself?

When logged in, here are the information available to the person:

username (in my case, it's my real name)
date of birth (I've given a false date of birth)
contacts: the website gives you the option for storing numbers you send SMS to. Only the name and phone numbers are visible (of course, the name is anything we specify).

Just to be clear, I don't use a password like that, but a friend of mine using this service does. So, I'm trying to convince him with risks that he might be facing.

Well, the by far biggest threat is not the personal information leak on its own, but the ability of the attacker to impersonate you. By being able to send SMS from your number and a bit of social engineering, attacker can convince a lot of people he is you (or your friend in this example).

While he may not be able to persuade for example a Bank right away, he can just build up. First contact the cellphone service provider saying he needs a new SIM, getting full control of your phone number. Then using it to obtain recovery SMS code for your email. Use email to get access to plethora of web accounts by using "forgotten password" reset. Getting personal information from these account and eventually tricking important institutions, such as Banks. Basically pulling of full identity theft.


The security of an unique URL parameter Take for example a simple messaging system. Users can send each other personal messages. When reading a personal message sent to you, the URL would be something like http://www.example.com/messaging.php?mailid=453796451. I see many websites retrieving data using only a unique identifier, like 45379451 in this case. If someone else would known this unique identifier, he would be able to read the private message sent from user A to user B.

Now my question is if such an id passed via the URL is really secure? In this case the id consists of 8 numbers, which would mean that a hacker would have to try 100,000,000 numbers at a maximum, in order to read the private message. But if the database stores one million private messages, the hacker would be able to read a private message roughly every 100 attempts. Is it therefore a bad idea to make the system only rely on the id passed via the URL, or is it devious to check if the user matches the message's recipient?

I am programming a private messaging system at the moment, and I was wondering what would be the best practice to do so.

Sorry if my title is a bit misleading, I couldn't think of another way to describe this problem.

in this case. If someone else would known this unique identifier, he
  would be able to read the private message sent from user A to user B.

This is not (necessarily) true. Usually, there are user accounts on such sites, and a user logging in creates a session with an ID in a cookie. messaging.php can then check if the given session ID matches the ownder of the requested message, and display an error message if it does not.

If someone else gets the session ID, then it's true that access is possible.  However, getting is not is as easy. It's certainly longer than your message ID, and not auto-incrementing; guessing would take much longer (especially you need the single session ID mathcing the current message ID, not just any session ID). And there are many things preventing cookie data to be read by everything coming not from the cookie-creating site itself.


Is it ok to let someone unlock their own account with their admin account? Scenario:

Person A's normal computer account is personA. They have locked this out with too many bad password attempts.
The user is part of the IT group, so they also have an admin account: personA-admin.

They use this admin account to unlock their standard account. On the windows event log, it shows as personA-admin unlocked personA

Question:
Is this ok?

I say no because someone else should be unlocking it. I'm thinking along the lines of separation of duties, privilege escalation maybe etc.
My colleague says yes because they're not gaining any additional privilege over what they have right now...

Let's examine why this person has multiple accounts - the general explanation is that there should be an additional barrier to access administrative functions, reduce logins to that account, etc (https://cloud.google.com/resource-manager/docs/super-admin-best-practices). You can consider their admin account their 'primary' account (even though it's not the one they use day-to-day) as it's what matches their role. Nothing else they can do on their admin account has to be done by someone else.

Resetting your own password via your admin account isn't poor practice. Getting locked out of an account that should be your day-to-day account is a potential yellow flag. There are no separation of duties between these accounts - this person is presumably allowed to perform the actions in their admin account. There is also no privilege escalation - the lower level account is a best practice, and not a reflection of the user's permission level.


Why do we encrypt ephemeral Public key in Encrypted Key Exchange Encrypted Key Exchange can resist off-line dictionary attack

Protocol :

      A ---> B : Ep (PK)

      B ---> A : Ep(Epk(K))

K is Session Key generated by B

PK is an ephemeral public key generated by A

B transfers K to A using double encryption.

PK is a public key , its meant to be public. I am wondering what is the purpose behind encrypting the epheremal public key PK ??

The "encryption" step is what makes EKE a Password Authenticated Key Exchange algorithm; the low entropy shared secret (the password) can be tolerated precisely because of that step.

Note that it is a special encryption; we are not talking about something like AES here. The idea can be roughly expressed in the following terms:

There is a base, unauthenticated key exchange algorithm, e.g. Diffie-Hellman.
Both parties encrypt their messages with the shared password as key.
The "encryption" must be such that it converts each message in what could structurally be another valid message for the base key exchange algorithm.
Each encryption represents a commitment.

The last point is the most important and yet the trickiest to grasp. When Alice sends her Ep(ga) (her half of DH, encrypted with password p), she commits to the password p. She may complete the DH computation, i.e. find the shared DH secret gab, only if she assumes that Bob also used the same password p. A fake Alice, trying to guess p, may try to change her mind afterwards and think: well, I sent Ep(ga) but maybe Bob was using password p', so Bob computed Dp'(Ep(ga)) and ended up with some group element ga' on which he based his DH computations... and there Alice fails, because she cannot know that value a'. The layer of "encryption with p then decryption with p'" puts Alice outside of the inner DH. The net result is that a transcript of a single protocol exchange between Alice and Bob can serve to test only one password, the password p that Alice used initially. This is what protects the password against offline dictionary attacks.

(Everything about EKE and PAKE is in the paragraph above. Read it again and again until you understand it or your head falls off.)


How much information can be sniffed at tor exit nodes When someone is sniffing data at a Tor exit node, how much information can be obtained? The IP can be revealed, but can they see everything you do?
Does it make a difference if it is encrypted using https, or if it is a hidden service link?

Every unencrypted thing that passes through that exit node can be seen, for as long as you use the node.  That means plain http, but it also means POP3, SMTP, and IMAP email, telnet sessions, etc.

Things that cannot be seen: your IP address, the contents of anything going over https or other encrypted protocols (but various side-channel attacks, such as monitoring packet sizes, are possible), or hidden service connections (those don't use an exit node).


Are rainbow tables a viable tool for cracking NTLMv2 hashes? Background

I am unclear about the difference between NTLM hashes and the NTLM protocol, regardless of version.

My tentative understanding is that there is such a thing as an "NTLMv2 hash", and that these hashes, being unsalted, would be viable targets for pre-computation attacks using rainbow tables.

That being so, I was surprised to find that a web search for "NTLMv2 rainbow tables" brings up no showing published rainbow tables for NTLMv2. The Distributed Rainbow Table Project created rainbow tables for NTLM but not, as far as I can see, for NTLMv2. Nor it appears, did its community show much interest in generating NTLMv2 rainbow tables. Maybe this is because NTLMv2 rainbow tables are more expensive to compute, and no-one who has invested in generating them has so far been willing to publish any?

Questions

Is there such a thing as an "NTLMv2 hash", and if so, would these be viable targets for pre-computation attacks using rainbow tables? If not, then is that because there is no such thing as an "NTLMv2 hash", or because there is, but rainbow tables are not viable attacks against them?

NTLMv1 or NTLMv2 is a Windows Challenge-Response authentication protocol used in authenticating users in interactive and non-interactive logons. Interactive logons and non-interactive logons are explained here

https://msdn.microsoft.com/en-us/library/gg604699.aspx and
https://msdn.microsoft.com/en-us/library/windows/desktop/aa378749(v=vs.85).aspx

NTLMv1 and NTLMv2 authentication protocols have vulnerabilities like pass-the-hash, reflection and relay attacks but are immune to Rainbow Tables attacks.

NT Hash is referred to as NT One-Way Function (NTOWF) in MSDN Documentation on NTLMv1 and NTLMv2 and uses the MD4 or MD5 hashing algorithm to obtain the hash from a user’s password. NTOWF uses MD4 or MD5 hashing algorithms to compute the hash from a user’s password. The NT Hashes of all users in a Windows domain are stored in the ntds.dit file on the Domain Controllers. While the NT Hash of user’s password can also be retrieved from the Security Account Manager (SAM) and SECURITY Registry hives of Windows systems they interactively logon.

NTLM is often used interchangeably to refer the NTLM Challenge-Response Protocol and the NTOWF, which is the root cause of this confusion.

The lack of salting in storing users password NTOWF on Windows systems or Domain Controllers makes it vulnerable to Rainbow Tables attacks.

Here is how the string ‘hashcat’ looks like as NTOWF and when used in NTLMv1 and NTLMv2. I have borrowed this from hashcat’s example hashes webpage.

NTOWF
b4b9b02e6f09a9bd760f388b67351e2b => This remains static and will be stored in identical format in the SAM or Domain Controller until the password is changed.

NTLMv2 admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030 => This authentication response will change even if the password is ‘hashcat’ as the challenge used to compute this response changes everytime the Challenge-Response protocol is negotiated.

NTLMv1 u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c => This authentication response will change even if the password is ‘hashcat’ as the challenges used to compute this response changes everytime the Challenge-Response protocol is negotiated.

Wikipedia has a good writeup on how NTLMv1 and NTLMv2 authenticate users by using their passwords (aka NTOWF) in “NT Lan Manager”.

In case you are curious why NTLMv1 and NTLMv2, the prior authenticates client to server and not vice-a-versa while the later authenticates both the client and server to each other.


Attacks on keys generated with low entropy If I were to give someone a two 4096 bits keys, and say one was generated in a Linux OS with very very low entropy available, and one was generated in a Linux OS with more than enough entropy.

Would be possible to differentiate between the two? Would be them be able to do any kind of attack on the low entropy generated key?

I ask this mainly because I often generate a lot of 4096 bits keys/certificates/DH parameters and more on VM's and my little knowledge of this is that I want a lot of available entropy to use because it makes more harder to predict things.

I did some search on why randomness is important and I found a blog article (Why secure systems require random numbers) which tries to explain why randomness matter and describes a hack of the popular programming and technology website Hacker News:

  And all pseudo-random number generators need to start somewhere; they need to be seeded and that's where Hacker News failed. The random number generator was seeded with the time in milliseconds when the Hacker News software was last started. By some careful work, the attacker managed to make Hacker News crash and could then predict when it restarted within a window of about one minute. From it he was able to predict the unique IDs assigned to users as they logged in and could, therefore, impersonate them.

Ok I get that, but doesn't this still need the attacker to make a active attack instead of just passive attacks? I mean you couldn't get a stream of someones traffic and says "Hey this Diffie-Hellman parameters/SSH keys appear to be generated  with low entropy so lets attack them", right?

So lets say I've just generated a key or something else with low entropy, but the attacker is not able to launch an active attack and currently does not know which randomly chosen pre-master secret has been used, so what?

I still don't feel I'm being able to really express what I'm saying so I'm going to add this one more example :

  Here's part of how a computer using WiFi establishes a secure
  connection to an access point using the popular WPA2 protocol:

  The access point generates a random nonce and sends it to the computer.
  The computer generates a random nonce and sends it to the access point.
  The access point and the computer continue on from there using those random nonce values to secure the connection.

Ok that's fine. Says I'm MITM you and passively watching the traffic, and it happened that the router had ran out of entropy, so what? How could I somehow know this to even think about launching an attack to cause a new handshake and from them try to predict the random nonce used and thus defeat the encryption?

If the answer is " you can't " like I think, why then it even matters? This wouldn't be the first attack anyone would try unless they could know that a low entropy source was used like they knew on Hacker News event.

Also feel free to edit my title if you can come up with a better title lol.

Entropy will basically define the maximum number of different states you random number generator may have at a given moment (more information on the subject can be found here). The higher the entropy is, the higher possibilities there are.

The main problem with low entropy is that the random number generator will have less different possible states to switch over, therefore it will begin to repeat itself.

The main way to detect such issue is to try to detect such repetition. A common issue for instance may affect session ID: an attacker may request a lot of session ID from the server (or nonce from the AP in the case of the Wifi access - did someone talked about WEP?) and analyse if the server can be tricked into generating the same ID twice. If another flaw allows it, he can also cause several quick application restart to analyse the first ID generated.

A very good, historical example of entropy issue affects Debian (and its numerous derivative). During two years, they broke Open-SSL random number generator limiting the ssh-keygen command (used among other thing to generate keys used to authenticate people on servers and authenticate the server itself to avoid Man-in-the-Middle attacks) to 32 767 different keys. As a result of this:

A server affected by this issue could be immediately identified since he will present the public part of one of these vulnerable key to authenticate itself: the private par being known by the attacker a wide range of attacks become available,
If one user uses such vulnerable key to authenticate itself (the server itself does not need to be vulnerable), an attacker could gain access to his account just by trying each key from the set which should be relatively fast.

As a final word, you must not rely on the fact that low entropy "looks like" good entropy and that you do not know yet a way to detect it. This is called security through obscurity and it does not bring any good security. Indeed, the fact that you do not know such a way do not mean that nobody else does, and if one single attacker does the consequences could be catastrophic (I guess WEP people initially considered their system to be secure...).

For your concerns regarding VM's entropy, you may be interested in this discussion. Basically, a simple yet efficient fix consists in "seeding each VM with a seed obtained from some other random source elsewhere; this is as easy as writing some file into /dev/random" (quoted from Thomas Pornin's answer).


How do social media apps notify you when someone else takes a screenshot of your profile? Social media apps like snapchat, instagram, viber, etc notify you if someone takes a screenshot of your profile, chat, conversation, story, etc.

How does the app find out that you are taking a screenshot of their conversation, profile, story?

Links:(https://support.viber.com/customer/en/portal/articles/2739322-secret-chats)
(https://www.women.com/connieliou/lists/can-someone-see-if-you-screenshot-a-snapchat-message)
(https://www.google.com/amp/s/amp.businessinsider.com/does-instagram-notify-screenshots)

This is a major revision to my previous answer, which was factually incorrect. It is posted as a new answer in order to prevent baiting-and-switching of votes, as I feel the current answer is not the same as the one I had initially posted.

In order for a social media application to notify a user that a screenshot has been taken, the application has to know that a screenshot is being taken.

To my knowledge, neither iOS, nor Android, have a framework intended to detect screenshots. This means that developers need to find a workaround on how to detect a screenshot being taken. There are several questions on Stack Exchange regarding this (such as here and here) and the method that seems to be recommended the most is to observe for a new file to be created in the screenshots directory.

Since an application can determine if it is currently in foreground or not, and can receive a notification when a new screenshot is being created, the application can therefore determine if a screenshot of the application is being taken. The application can then react accordingly, such as notifying users that a screenshot of their profile or conversation has been taken.

Keep in mind that I cannot answer exactly if this is how Instagram or other Social Media applications implement this. This answer explains how it could be done.


Is this passport survey website legitimate? I recently asked a question on skeptics.se about a website regarding the legitimacy of it as a survey website for a passport survey.  The website address is https://www.passportplanning.com, and is a website that was included in a paper letter sent to my address.

Is this a legitimate website and a legitimate survey?

It may be legitimate based on this US Dept of State notice: https://travel.state.gov/content/passports/en/news/passport-demand-study.html

However, they recommend you email passportstudy@state.gov (from the bottom of your letter) if you want verify this.  You can request that they specifically confirm the passportplanning.com domain is indeed associated with their study.  This government page (http://www.reginfo.gov/public/do/PRAViewIC?ref_nbr=201410-1405-002&icID=185826) seems to confirm that the passportplanning.com domain is associated with their study.


Plausible way to hack website keeping [username / hashed password] pairs? I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the associated password.
This way, the system only has to compare the hash of an entered password to the known hash associated with that username's password.

Since hashes are theoeretically unique and hash functions always map to the same output, this seems like a secure scheme.

However, I was thinking about the following scenario: Let's say a hacker gains access to the server's database and can see the output of password hashes from the hash function used. Couldn't that hacker choose a password (any legal password), get the hash of that password, and then modify the database to replace another user's password hash with the hacker's own password hash?
Thereby fooling the server into thinking that the hash associated with that username is the hash of that user's password, when in fact it's the hash of the hacker's password.

I'm sure this is completely bogus or it would happen all the time, but I'm curious as to what about it is infeasible.
Obviously one could question the need to do this is the hacker has already gained access to the server's database, but I'm thinking of a case where the rest of the valuable information is encrypted in a way that can only be accessed by certain users.

If an attacker gets write access to the database (e.g. through SQL injection), then there is nothing preventing them from changing users' password hashes to their own. The reason it's not brought up too often is that, as you point out, there are usually more serious concerns if an attacker has write access to the database.

  I'm thinking of a case where the rest of the valuable information is encrypted in a way that can only be accessed by certain users.

The best way to do this would be to derive the key from the user's password (separately from the password hash used for login), in which case replacing the password hash wouldn't allow the attacker to decrypt the information.


How can using multiple laptops improve security? My being an admirer of Edward Snowden I've read several books about him. In each book and article there was said that he used four laptops in Hong Kong. Not for storing the documents, but because it was for security and it's a security technique.

I've tried to look up how four laptops can be more secure than one, but I can't find anything about why.

So, my question is why are four laptops more secure than one (or two, or three, for that matter) and what role separation should be used on them to improve security?

My guess:

Laptop 1: Highly-encrypted and pass-secured disk/BIOS/... air-gapped without NIC laptop to store documents/contacts/files/...
Laptop 2: Highly encrypted network- & connection-encryption for communicating.
Laptop 3: Laptop with IDS (and eventually IPS) to detect network or malware intrusion.
Laptop 4: Same security as laptop 1, but with more obfuscation to store passwords in a self-made local highly-encrypted database (with self-destruction if wrong master-password?) OR for testing USBs and files for malware (because passwords can also be stored on laptop 1).

You seem to assume that handling sensitive information is all that Snowden - or anyone else - does all day.

But that's not true. Most people use a laptop for a variety of tasks: Gaming, watching videos, listening to music, surfing the web, developing software, social networks, etc.

Many of these tasks create additional attack vectors. For example, there are games that contained vulnerabilities and DRM systems that were vulnerable. And that's assuming that the person purchases the game legally over a secure channel.

It seems reasonable to separate tasks that produce an additional attack surface but do not contain any sensitive information - eg gaming, music - to a different computer.

Personally, I don't really see the need for 4 laptops. Your ideas might be close to Snowdens thought process though (1 Laptop for communication and 1 for IDS/Firewall seems to make sense at least). Your Laptop 1 is only responsible for storage though. Why not use an external drive for this?


Why is client certificate authentication not more common In my understanding client certificate authentication is not especially complex to implement and have several benefits compared to password authentication

The secret (private key) does not have to ever leave client machine.
The server side breach does not endanger client accounts in other services
The user can remember single master password to his key - or preferably have the key unlocked by OS login - instead of trying to remember per sit login

But I do not remember using any site on the internet that offers this authentication variant (I'm not saying that there are none but my impression is that they are not common). Why it is not more common?

I understand that

The setup is not trivial from the end user side
The portability of credentials is non trivial
Some devices may not support it (if I recall correctly android bellow 4.0 did not support them natively for example)

But still why not offer them for sites requiring high security where user is ready to go extra mile to ensure it (say bank sites) or sites that want to provide impression of high security (say bank sites again)?

Or am I mistaken and client certificates are used more commonly that I imagine?

Your three points are pretty valid.

In short: client certificates are unnecessary complicated to average internet users.

tl;dr

The root problem comes from the fact that mutual authentication (TLS) doesn't work the same way for both parties. Explanation below assumes mutual TLS authentication.

Client connects to server and expects some identity confirmations from server in a form of server certificate issued by a trusted authority. If server certificate passed TLS authentication, then we got the right server.

When server is listening on port and client connects to server, server should authenticate and authorize the client. Server must map remote client to a local user database in order to validate permissions and provide personalized content. Here is the difference: client only authenticates the server, but server authenticates and authorizes client.

As you can see, client only consumes resources and do not need to authorize remote server. Server is resource producer and should verify if client is allowed to receive requested data, so authorization must be enabled on server side. In a email/password authentication scheme, server maps email/password to a particular account in local database. Server receives this information when user registers on server. Registration with certificate:

is hard. Requires sophisticated tools with cryptic syntax and special knowledge;
it requires certificate management.

This is where uneducated users will fail. You can remember a email/password combination, so switching between accounts and devices is not an issue. Switching device in certificate-based client authentication will go to nowhere. How easy would be to average user (who is not an IT expert) to move the certificate from his Windows laptop to iOS phone/tablet, for example? Move certificate between Android phone/table and Mac laptop?

Since client doesn't authorize server (do not maintain a local database of valid servers), server can rotate its keys every day and no one will notice this. Server will work as usually.

I disagree with @SyntaxxxErr0r statement that end users are lazy. They are not ready to perform certificate management on their own. And attempts to teach them will result in a food for potential hackers. Again, average internet user isn't an IT expert and is not required to be it. It is a good deal that end users understand email/password combination and it is impossible to ask from them anything else.

  But still why not offer them for sites requiring high security where user is ready to go extra mile to ensure it (say bank sites) or sites that want to provide impression of high security (say bank sites again)?

Same story. Internet banking is supposed for everyone regardless of their technical education. That is, my 80 years grandma should be able to use internet bank services to manage her pension and make basic payments. Though, some banks issue to clients a personalized hardware token, but this is an extra investment from bank side. Literally no site in wild Internet will invest in hardware tokens for every user.

another thing to consider: websites offer password reset via email. How this will look in case with certificates? Try to answer these questions and you will figure why certificate-based client authentication is not widespread in wild Internet and won't be for a long time.


Kerberos - obtaining the krbtgt's secret in order to perform Golden Ticket attack As far as I know, in order to create a Golden Ticket, the attacker needs to obtain the krbtgt's password's hash, which is not a trivial task. My question is: is it possible to find the krbtgt's password by getting a legitimate TGT (encrypted with the krbtgt's password's hash) from the Authentication Server and cracking it, just like in a classic Kerberoasting attack?

Theoretically? Sure. It's just a brute force attack.
Practically? No, probably not. It's a brute force attack against a key derived from a randomly generated password that ends up being a hundred plus characters long in the easy case, or a randomly generated key that's 16-32 bytes long.