Is there an official standard and/or name for PEM certificate bundles? This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes:

I know two approaches for bundling related certificates/keys together:

Heavy weight approach: PFX. There is the PKCS #12 file format. Windows saves these as .PFX or .P12 files.
Light weight approach: Just-cat-everything (aka "PEM bundle"). Just running cat on all the certificates/keys (in your desired order) and redirecting this into a new text file.

Question

Is there an actual standard for the "PEM bundle" approach? Is it even called that or is there a more official name? (Citation please!)

It was my impression that this is just the ad hoc way that OpenSSL used to handle bundle of certs/keys and it's been adopted as a de facto standard. Is this true? Or is the "just-cat-everything"-approach part of the PEM standards?

Nomenclature survey

What do people call these PEM bundle files?

StartSSL uses the term "bundle". They have a ca-bundle.pem file available for download.
DigiCert says "concatenated certificate container".
GoDaddy says "Bundle".
Comodo says "Bundle".
GlobalSign says "Bundle".
OpenSSL

OpenSSL does not use the term "bundle" for a file where a certificate is stored with its associated chain and/or private key. (I've grepped the source for "bundle".)
They do however use the term "bundle" for the CA truststore.

Apache sort of calls this an "SSLCertificateChainFile".
RedHat says "ca-bundle".
cURL says "ca-bundle".

There is no real standard for things in "PEM" format. There was a proposed standard called Privacy-enhanced Electronic Mail, from which the "PEM" acronym was derived; however, that standard never gained traction against its competition (PGP and S/MIME) and nobody implements it.

OpenSSL picked up PEM and "enhanced" the PEM format with extra functionalities and headers, without any actual specification or documentation worth that name, so that nowadays, "PEM" really means "whatever OpenSSL produces and can parse". Other vendors followed, e.g. Microsoft, whose software can decode PEM-encoded certificates.

The principle of PEM (Base64-encoded data, with a '-----BEGIN XXX-----' header and corresponding '-----END XXX-----' trailer) has been used for other things; PGP calls it "ASCII armor". The point of that way of doing things is to be able to locate the interesting data within a sequence of text data, regardless of the various tortures inflicted to that text as it is transferred (e.g. sent as e-mail, copy&pasted, included in a Word document, printed and scanned...). This is an important point: it means that the whole point of PEM is to be able to store the certificates together and haphazardly without having to follow a specific, precise standard. In that sense, a standard for a "PEM bundle" would be a self-contradiction: a "PEM bundle" is what you do when there is no standard.

It is not incorrect to call it a "de facto standard".

When you want to encode and send certificates, there are in fact more than two methods; possibilities include:

Encode each certificate separately, using ASN.1 DER encoding (which is standard).
Use PEM to further make these certificates more resilient to ASCII-based transfer; this also allows storing several of them in a single file (that which you call a "PEM bundle");
Store the certificates in a PKCS#7 (aka CMS) SignedData object. A SignedData is nominally a format for embedding data which is signed; but you can omit the data and include exactly zero signature, in which case you have some sort of shell that includes a field for embedding "extra certificates" (nominally, these certificates are there to help in validating the signatures). This is the reuse of an existing standard for something that the standard was not meant to do, but existing software does that. Microsoft calls that a "PKCS#7 certificate" or a "P7B file".
Use a PKCS#7 SignedData but also PEM-encode it (so you could conceptually store several of them in a single file).
PKCS#12 (also known as "PFX"). This format also allows storing other kind of objects, and includes provisions for password-based encryption, so it is commonly used to store a certificate and its private key. (Apparently, nobody ever thought of PEM-encoding a PKCS#12 archive.)

Private keys also have their own formats. For instance, PKCS#1 defines an ASN.1-based encoding for RSA private keys, that OpenSSL will gleefully use and then PEM-encode with a "BEGIN RSA PRIVATE KEY" header. That format may be further wrapped into a PKCS#8 object, which includes an ASN.1-based identifier for the algorithm, and also optional support of password-based encryption; and then, OpenSSL will also encode a PKCS#8 file, this time with "BEGIN PRIVATE KEY" or "BEGIN ENCRYPTED PRIVATE KEY" (no indication of the algorithm in the PEM header), depending on whether password-based encryption was used or not. Alternatively, the raw PKCS#1 format may also be password-encrypted, using the extensions to PEM that OpenSSL implements but does not document (OpenSSL's source code being supposed to be the specification).

To sum up: it is a mess.


PCI Compliance with scanned checks? Client want's to store scanned checks on his publicly accessible server that is NOT PCI compliant.

I told him it's a bad idea.

I need to present him with the laws / FTC guidelines / government regulations that specifically outline the requirements for storing scanned checks or else find the portion of the PCI DSS specifications that says: "This means for checks too."

Does anyone know what that is?

Googling it only shows me millions of results about scanning checks for mobile deposit...

You can't find anything about PCI for checks, because it doesn't cover them.  PCI stands for "Payment Card Industry" - aka, credit cards (and debit cards with a cardbrand logo).  The PCI Council (who set the standards) couldn't care less about securing any other form of payment (cash, checks, money orders, etc).  Even credit-card-like systems (gift cards, store-issued charge cards, etc) aren't officially covered, even if they have a magstripe.

That said, it's good practice to follow PCI standards for other forms of payment, since they're designed for security. If you accidentally leak your customers' payment information, who do you think they're going to blame?

Instead of PCI, the ACH industry is covered by the NACHA Operating Rules, which you can also fund summarized here.  From what I can tell, the relevant sections are 1.6 (Security Requirements) and 1.7 (Secure transmission of ACH Information via Unsecured Electronic Networks).  Together, they comprise less than one page of text.  I can't copy them here, but 1.6 basically says "You have to have policies in place to protect this data." without specifying any specific requirements.

All in all, the client's request may be perfectly valid in a way that it wouldn't be for card data.  It doesn't make it a good idea, but it's valid.


Data recovery from file collections I am presently working as a summer intern.

My first objective is, given a collection of files, recover and identify the file types present in it.

To download sample pseudo-forensics data I have been using: Digital Corpora

To recover files I have been using 'The Sleuthkit' but this does not seem to do the work as I always get error messages regarding the format of the data being used.

It would be great to get suggestions/links to tutorials or software which help in recovering data.

I am also looking forward to links to download psuedo forensic data similar to the one above.

Specifically, I would like to recover all data that are in text formats(word,pdf,emails,html... etc) then unify it into one single file in text format and then use natural language processing to determine places the person was associated with. I have some ideas with respect the natural language processing aspect of the problem but need help with respect to data recovery. How best to do this task.

This is quite a broad question but here is one way you could possibly do it,
you could use autopsy over the full sleuthkit as it is really just a wrapper for the sleuth kit but a heck of a lot easier to use.

Next index your target disk (assuming it is coming from a hard disk) and you can then regex query your index from the autopsy using things like .doc or whatever.


How to protect websites against ZIP bombs and reference bombs? A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) - someone uploads i.e. a 100 KB file [ 50 GB compressed] to your site and when your site extracts (or whoever opens that) runs out of resources, causing the consequent damages.

Antivirus software is said to detect such zip bombs by detecting the recursion depth and common patterns, but i dont ask about Windows OS or like that (where we could be protected by AV) but i speak on websites (i.e. vps or shared hosting) where we just use programming languages (I'm interested in PHP, but for other people might Java or ASP also needed).

Are there any kind of builtin solutions in PHP(etc..), which already prevents happening that? if not how can we limit that? (any code example)
How can we detect these kinds of files on our servers (without extracting them)?
Another layer of attack seems to send a request with a Gzip bomb. How can we protect against that?

Zip bombs are harmless if you don't extract them. Antivirus software will go through them a file at a time.
You don't even need malice to get this effect - lots of poorly coded websites cause browsers to freeze or crash.
The defense is described in your link: cap the memory allocated to a parser thread and have it stop once the limit is reached.

An anecdote: I had to implement method (3) in a system with all trusted users. "Trusted" is a bit of an understatement; it involved five different layers of assurance. The defense was required against many models of paper scanners defaulting to their maximum resolution and no compression, and the users subsequently uploading... check the typical scanner resolution limit and do the math.

While it's not only the most naive of software that would be affected by such attacks, their effect is no different from what already happens to it regularly through incompetence without malice.


Is it possible to locate a cellphone's location just by ringing it? With today's technology, is it possible to locate a cellphone's location just by ringing it, kind of like what we see in movies?

The phone does not need to be rung or even on in some cases.  (This is why in some secure facilities, the battery is removed from uncertified phones.)  Phones are constantly in communication with their local radio towers when on and some will even periodically poll when off.  It is also possible for commands to be remote issued to the radio's on the phones to gather additional information.

At a minimum, the radio towers that it communicates with are known as is the relative signal strength which gives a rough approximation.  In some cases, it may even be possible to get a GPS location depending on how things are implemented in the phone's radio.


Is it possible to encrypt a file so that it can not be brute forced? Is there any program or method that allows encryption that can not be brute forced or is it just that any encrypted file can be decrypted by brute force?

The only encryption scheme that is theoretically impossible to brute force is a one-time pad. However, with any modern cipher, it would take millions to trillions of years to brute-force, barring the discovery of catastrophic new cryptanalysis, or -- in some cases -- the invention of quantum computers. This is widely considered Good Enough by those who do not count witches or galaxy-spanning alien civilizations among their adversaries.

If you plan to use TrueCrypt, you have more practical concerns, like software bugs, or a compromised random number generator, or a home full of cameras, or getting kidnapped/arrested and politely asked for your keys.

Why do you ask?


How to block all porn websites from firewall? I want to block all porn websites and similar contents in my Windows 7 PC using Windows firewall. Till now I can block it by inserting sites one by one. Is there any category defined for such sites or contents so that I can block all porn sites and contents from my windows PC.

If it is possible to block all such sites and contents such as videos and Images from my PC then please tell me the method.

Please also tell me how to do the same in Ubuntu 16.04.

*I do not want to use any third party application for Windows and Ubuntu other than firewall.

Your best bet may be to head over to OpenDNS.com and setup your network interfaces to block sites by category according to your preferences. You simply replace your current DNS ips with 208.67.220.220 and 208.67.222.222. It's a free, maintenance free solution that additionally offers some protection against the DNS attacks that we are seeing frequently today.

Also, since you are adding these IP addresses for your network interfaces, i.e., ethernet, wireless, it will work across browsers. You can even configure the block page the user sees. There are also other options including Comodo.com. Good luck.


Public key - private key question I have a query about public/private key encryption that I hope someone can answer. So as I understand it:

Client connects to server and server responds with certificate
Client pulls the public key from the certificate and encrypts using this
Client sends message to server and server decrypts.

So that seems fine. What about when the server wants to send something back to the client machine that needs to be encrypted? What is the process to ensure that the server encrypts data in such a way that the client can decrypt it?

Assuming HTTPS here.

  Client connects to server and server responds with certificate

Yup.

  Client pulls the public key from the certificate and encrypts using this

Nope. Client uses this to handshake with server. Result of handshake is a shared secret. That shared secret, called the Master Secret, is then split up into separate server-to-client and client-to-server keys.

  Client sends message to server and server decrypts.

Yup. Client uses client-to-server key for that.

  What about when the server wants to send something back to the client machine that needs to be encrypted?

The server uses the server-to-client key to encrypt. And the client uses that same key to decrypt.


When Shellshock was introduced, how bad was it **then**? The shellshock bug, and the underlying feature allowing Function Import from the Environment (I'm calling it FIE), have been in bash since at least 1993, before the rise of CGI.

At that time, the rest of the Unix/Linux/GNU environment was very different.

So at that time in history:

Were setuid scripts allowed at that time?
Were setuid scripts part of default configuration at that time?
Were the system(3) and popen(3) calls used routinely by setuid binaries at that time?

common uses are for expanding shell globs (less appears to use it for this, but is not setuid) and executing external commands

was it common at that time to inherit the environment when su-ing?
Could the environment be propagated by things like rlogin etc? (I think telnet propagated DISPLAY by default).
Are there any features which would make the FIE bug more problematic back then?

So how bad was this privilege escalation and code execution bug, which has been hiding in plain sight for over twenty years, when it was originally introduced?

How bad?  Not very.

None of the common remote attack vectors existed when the bug was introduced: the "shellshock" parsing bug pre-dates CGI and DHCP by about a year, and pre-dates SSH by two to three years.  Remote-access programs such as telnet and rsh don't have the command restriction ability that SSH does, so although a "shellshock" attack could probably be mounted against them, it wouldn't gain an attacker anything they couldn't get just by logging in normally.

As for local privilege-escalation attacks, as far as I can tell, Linux has never supported setuid scripts.  There aren't very many setuid programs: at the time, they would have been what are now the "util-linux" and "shadow" packages.  These programs are part of the POSIX specification, and haven't changed in their fundamental operation in the past 20 years.  Of them, only su, mount, and umount are setuid and call other programs, and all of them do it through exec*().  su did and still does pass the environment through if invoked without -, but it's not an easy attack vector to use: you need to get your target to execute it with an environment under your control, and invoking it as su - (which cleans the environment) is second nature to many sysadmins.

The big wildcard is other *nix-like systems.  The GNU userland was a popular replacement for low-quality vendor programs, and some of the *nix-like OSs supported setuid scripts.


How are various softwares' files/information kept safe from me, the user I started making a simple user authentication program just for fun, and I realised I don't know how to keep safe the files that will store all the usernames and passwords. This got me thinking.

What is stopping me from viewing sensitive information about the different software installed on my computer. How is this information stored/encrypted?

Passwords are stored on the computer as hashes, those are only one-way. You can hash a value, but you can't retrieve the value back.
The authentication works like this :

Create password, hash it, then store it.
The user tries to login, the password he puts in gets hashed, and is then compared to the hash stored on the computer.

Popular hashing algorithms are:
Sha-2, MD5, NTLMv2 (windows 7 and 8 use this one)

Edit:
Also, an addition:

Usually you hash something multiple times, for example 1000 times, this way it is longer to compute, and brute force attacks (trying each possible password, and comparing it with your hash) take longer.

You also use a salt, which is stored unencrypted next to the password, which is just some high number, and differs for each password. This way when there are two similair passwords, the attacker won't notice it.


Are my personal files safe from BORA ramsomware if I have set them to 'read only'? A friend's PC got infected with BORA ransomware 2 days ago and I was wandering if his files would have been encrypted if he had made them 'read only' before the ransomware had struck.

Is it possible that he could have protected his data this way or is the ransomware still able to modify them?

If ransomware hijacks your account, it can do anything you can do. This means it can just turn the read-only bit off again. Thus, this is not an effective defense.


Dynamic, Randomized Protocols to Deter Attackers Imagine a protocol that changed periodically.
What if the order of these fields were changed a lot?
One point in time the protocol might be

{ Payload, Checksum, Length, Flags, ID }

The next point in time it becomes

{ Flags, Checksum, Payload, ID, Flags }

After a set period the protocol changes again.

As an attacker, the goal is to know what it is about a target to exploit it or find holes. If it were to change periodically it could be harder for an attacker to know how to exploit a weakness. Also the underlying code, fields, field length, encoding/modulation scheme, and other stuff could be changed.
Of course the client/server would need to be in sync with these changes. This sounds like security through obscurity, but it could delay the attacker.  Has the been done before? If not, does it sound like it could be useful?

If it were to change periodically it could be harder for an attacker to know how to exploit a weakness. ... the underlying code ... Of course the client/server would need to be in sync with these changes.

As you found out yourself - client and server would need to be in sync. This means that there would need to be some state held on both sides or the server must be able to extract the state from the clients messages and but the client should not be able to invent its own state. If you closer look at these requirements you already have the typical forms of either symmetric encryption (i.e. state relates to encryption key) or authentication (state similar to session cookie). Both are these are established and simple techniques so why invent a new one which is more complex and does not really offer better protection:

With a session cookie like state you first check if the client is authenticated before you interpret the rest of the data. No need to change the format for the rest because it gets ignored anyway if authentication fails.
With encryption data must be first decrypted. No need to change the format because the payload gets ignored if the decryption fails.

At the ends the security depends only on how hard the common state can be guessed by the attacker. It does not matter if this state is an encryption key, a session cookie or some algorithm which describes format changes. Only that the latter is more complex to implement than the other two solutions.


Slash and dash DDOS - what are they trying to do? I've noticed a curious flood pattern on some of my sites - bots trying to access the page "/-/-/-/-/-/-/-/-/-/-/" on the root domain - that's 11 slashes alternated by 10 dashes.

The thing with this is that it may be quite difficult for firewalls to catch it - Cloudflare and Wordfence are doing poorly (only working in certain conditions). Well, due to the nature of the string I couldn't even find anything on google.

For now I'm doing a redirect to a sort of honey-trap, but I'm nonetheless curious what it's trying to achieve and how it can better be rid of.

This is called a Full Path Disclosure attack. This kind of attack allows the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. It keeps on adding slashes like /////  until it gets a file or anything interesting, and won't stop. It floods the site with slashes and special characters and the attacker may not know it but he is DDoSing the site. To stop this kind of attack you can use fail2ban or use nginx and set heavy caching of /.


mis-use of email address to obtain services from Groupon I recently bought a new domain name "familyname.net" and I redirect emails to this domain to my normal email address.
Recently I received various emails, one of which came from Groupon to confirm the purchase of some things. The user used an email address sarah@familyname.net
Groupon were useless in dealing with this, so I logged on to that account and asked it to send me a password, which they did. I then changed the password, but I noticed that the so-called user had a real name and had left her credit card details.
What is happening here?

The user, intentionally or accidentally, likely left a mocked email address of which GroupOn did not validate. As a result, you were able to identify as the account holder because you were able to access the account's email. This is the users' problem for using mocked emails for their account and is a living example of why email verification is important.


Can my ISP know these things? I am a novice about digital things (imagine the antonym for "tech savvy").

Can my ISP know my yahoo email address? I have signed in on yahoo more than a million times. Yahoo is https.

Can my ISP know my Yahoo password?

Can my ISP know my Amazon.in (India) account email and password? There are Indian alternatives to Amazon: Flipkart.com, Snapdeal.com, Infibeam.com Can they (my ISP) figure out by any means about my email and password on these Indian shopping websites? All websites mentioned are https.

Those shopping websites obviously require me to enter my physical address, the place where I live. Can my ISP know where I live, by this way, that is through these websites? They are all https, just to remind.

Can my ISP know my purchases on these websites?

Can my ISP know which video I watch on YouTube? [https]

And finally, can my ISP know which video I watch on PornHub? (again, https)

Imagine someone searching about "how to spread terror-" sort of things. If the Govt. directs ISPs to find such people. How could the ISP find such people?

I am afraid I will not like even my ISP to know where I live or what I purchase. It is so fearful to know that they do keep such information about us. The first time discovered it, I couldn't believe my eyes.
Could anyone please help me know the details/mechanisms behind this? I am willing to learn even if I am not a computer-savvy person.
PS: One of the sites that I found useful is this but I don't know how accurate it is.

(1) Can my ISP know my yahoo email address? I have signed in on yahoo more than a million times. Yahoo is https.
(2) Can my ISP know my Yahoo password?
(3) Can my ISP know my Amazon.in (India) account email and password? There are Indian alternatives to Amazon: Flipkart.com, Snapdeal.com, Infibeam.com Can they (my ISP) figure out by any means about my email and password on these Indian shopping websites? All websites mentioned are https.
(5) Can my ISP know my purchases on these websites?
(6) Can my ISP know which video I watch on YouTube? [https]
(7) And finally, can my ISP know which video I watch on PornHub? (again, https)

No, unless you tell them. Your ISP knows which sites you navigate (and a lot you don't, but are referenced on the pages you view: images, scripts, things like that). That's why some people tell you to use a VPN to protect your privacy against your ISP.
Those days, the vast majority of traffic are protected by HTTPS, so the ISP have no much knowledge on anything you do, except for the metadata: which site it is, how many times you connect, how much traffic is involved. And the name of every site because the plain old DNS you are using is not encrypted.
DNS is the protocol used for finding the IP address for a domain name (like www.wikipedia.org, for example, is 208.80.154.224 from where I live). The DNS request is sent on clear, so even if you don't use your ISP DNS server, they can see the request, and even intercept it and respond themselves.
Using DNS-over-TLS or DNS-over-HTTPS mitigates this privacy leaks because now the ISP won't have the domain you are visiting, but only the IP address. It's possible that more than one site uses the same IP address, so in some cases, it's not possible to say for sure that you are visiting site-a.com when site-b.com shares the same IP. And high-traffic sites usually employ a CDN (content delivery network) to distribute traffic, and the IP they use are not the site's IP, but an IP belonging to the CDN (like CloudFlare or Akamai).
They cannot tell which video you watch on YouTube or PornHub, but they can tell you are on YouTube, PornHub, and have a good estimate of how much time you spend on each one.

(4) Those shopping websites obviously require me to enter my physical address, the place where I live. Can my ISP know where I live, by this way, that is through these websites? They are all https, just to remind.

They know, but not by decrypting traffic. If the connection is fixed (ADSL, fibre, phone line, long range wifi) they must know where you live so they can install the cable or receiver. If it's cellphone service (4g, 3g), they can track your position in realtime. And the contract you sign must have your address too, and it's not a good idea to lie on a contract.


Json hijacking does not work I have patched my site to prevent JSON hijacking. During this process, I was interested to see if I could actually exploit this vulnerability.

So I created a foo.html, added a script tag which source attribute referenced my site which I was logged into. I was unable to exploit the vulnerability. I took a look at the network traffic, and I could not see my authentication cookie being passed in the request.

Does this mean that most browsers have fixed the vulnerability? Is there some table that will let me know which browsers have fixed it? Or have I completely misunderstood the vulnerability?

https://capec.mitre.org/data/definitions/111.html

Does this mean that most browsers have fixed the vulnerability?

Yes, this vulnerability was fixed in all browsers about ten years ago. According to John Resig, the JavaScript specification was modified and the behaviour at least in Firefox was changed so that constructors can't be overridden to steal data.

  Is there some table that will let me know which browsers have fixed it?

Generally, no. For some features CanIUse shows which browsers have implemented things. The Chrome Status site is useful to see the state of features in Chrome.

  I could not see my authentication cookie being passed in the request.

I would expect the cookie to be present. Perhaps you are testing this with the latest Chrome, which is more careful with sending cookies to other sites.


Is it a good practice to forbid IP access to port 80? I see some sites have blocked there port 80 (or 443) to be accessed by IP.
When you access by IP, an Nginx forbidden page shows up (with there OS version).
My question is does it affect any side of security of that sever and web application running on it in a positive way?
If it depends on OS please provided for Ubuntu.

I see some sites have blocked there port 80 (or 443) to be accessed by IP.

My guess is that you mean that access to http://hostname works while http://ip-adress/ does not work. At the TCP level the host is still accessed by IP address but the HTTP request looks different because the name given in the URL is contained in the HTTP request, e.g.

 GET /some-page HTTP/1.1
 Host: hostname

The main reason for having the hostname inside the HTTP request is that you often have multiple virtual servers with different hostnames on the same IP address. These have different configurations and the server needs to be able to distinguish which configuration should be used. If you give a hostname which does not have any special configuration then some default configuration is used and often this just displays an error page (what else should it do?).

And this exactly is what happens when you give an IP address instead of the hostname. Since there is no special configuration for Host: IP address the default configuration showing the error will be used.

Apart from that it makes sense to properly check the hostname even if their is only a single site on this IP address, because accepting an arbitrary hostname  can lead to DNS rebinding and similar attacks.


certificate authentication between apps I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I created a new Certificate Request (though I wasnt asked to enter a private key at all doing this from the wizard within IIS) - our company signed that with our trusted root CA and then I completed that Certificate Request in IIS and when I hit my IIS server I get my application coming up fine.

What I need to do now is set up 2 way mutual authentication with another application which is also hosted internally within the company but is hosted on a Tomcat Server.

So there is a RESTful service on the application that is hosted on Tomcat that I need to hit from my MVC controller action. So from my HomeController Index action I need to hit a RESTful service on the Tomcat application. The authentication I need to have in place between .NET app and Tomcat App is 2 way mutual authentication with certificates. Can anyone advise on the correct way to set up this two way mutual auth with certs between IIS and Tomcat. Should I give the admin of the Tomcat sever the CSR I created and they will give me the certificate they have generated for their app on Tomcat? Im not sure what I should do with the certificate I get from the Tomcat App - should it be installed within MMC?

And what is the correct way to connect to teh RESTful Service on Tomcat using the certs we both have in place to make sure that both Applications trust each other?

It sounds to me like you need to configure the Tomcat service to request a client side certificate for authentication.

I'm wise in the ways of IIS, but unfortunately Tomcat is not my forte.

DO NOT give the admin of Tomcat your CSR.

I recommend referencing Configure SSL Mutual (Two-way) Authentication

Ideally you would use your internal CA to sign a client certificate as opposed to generating this from Tomcat/OpenSSL

From what I recall, Tomcat does not use the Windows certificate store, so you'll want to make sure the appropriate root and intermediate certs (if there are any) are also loaded into the Tomcat/Java keystore.

Image from: http://www.codeproject.com/Articles/326574/An-Introduction-to-Mutual-SSL-Authentication


Heuristics to Identify CSRF from Web Access Log File I am new here in security.

I want to identify suspicious users on web application by analyzing web access log file. For this, I am considering CSRF attack.

For this purpose, I am generating some heuristic (possible) rules for identification of suspicious users from web log. I am not confident but still guessed some rules,

In web log,

1. Referrer URL is blank or not equal to requested URL's domain name.

for e.g.

192.168.4.6   [10/Oct/2007:13:55:36 0700] "GET /trx.php? amt=100&toAcct=12345 HTTP/1.0" 200 4926
"http://www.attacker.com/freestuff.php" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)"

Two fields are important here, the requested URL (/trx.php? amt=100&toAcct=12345) and the referer ("http://www.attacker.com/freestuff.php"). Usually, the referer is an URL from the same site (www.bank.com). Here is a sample perl snippet, how this could be detected:

# assuming $referer is set with the, well, referer
if ( ( $referer ne '' ) && ( $referer !~ /^https?:\/\/www.bank.com\/(login|overview|trx)\.jsp/ ) )
{
    # handle XSRF attack
    print(“XSRF attack: $referer\n”);
}

2. If HTTP status is 403 i.e. Access Denied

(If the CSRF token is not sent, or if an invalid CSRF token is sent in requests that require a CSRF token). So, here checking of 403 status will be included. Because token can not get checked in log file.

3. By measuring the time difference of the requests of a user.

If there was no user input for several minutes and then suddenly some transfer requests are coming in, it could be an indicator that this request was triggered by something/someone else. Here, it will be needed to check time difference upto the threshold value from same IP address.(Along with this, If values are present after ? symbol and if these would be 'pass','password','amount','amt','money', or any link and if User request status would be 200 i.e. successful or OK).

4. Multiple POST request (repeatation) from single IP address also
   results into CSRF.

Idempotent methods and web applications
Methods PUT and DELETE are defined to be idempotent, meaning that multiple identical requests should have the same effect as a single request (note that idempotent refers to the state of the system after the request has completed, so while the action the server takes (e.g. deleting a record) or the response code it returns may be different on subsequent requests, the system state will be the same every time[citation needed]). Methods GET, HEAD, OPTIONS and TRACE, being prescribed as safe, should also be idempotent, as HTTP is a stateless protocol.

In contrast, the POST method is not necessarily idempotent, and therefore sending an identical POST request multiple times may further affect state or cause further side effects (such as financial transactions). In some cases this may be desirable, but in other cases this could be due to an accident, such as when a user does not realize that their action will result in sending another request, or they did not receive adequate feedback that their first request was successful. While web browsers may show alert dialog boxes to warn users in some cases where reloading a page may re-submit a POST request, it is generally up to the web application to handle cases where a POST request should not be submitted more than once.

5. A website might allow deletion of a resource through a URL such as
   http://example.com/article/1234/delete, which, if arbitrarily
   fetched, even using GET, would simply delete the article. (I don't know what to do here)

I know, CSRF identification from log file is difficult, so, I am mentioning possible ways (i.e. heuristics) here. If wrong, correction in this is required.  Any more rules/help would be appreciated.

I understand you're trying to count/analyze malignant cross-site requests based on the logs.

Technically speaking, a cross-site request is one issued by the browser of a real user while the user is interacting with a different website. Sometimes these are good, and should be enabled by "cross site resource sharing" (CORS) HTTP headers. If you don't want that to happen, then make sure your CORS headers are correct; they tell the user's browser to prevent other websites from making requests to yours.

In practice, a lot of robotic traffic will look like cross-site traffic in your logs. A script running on my cloud server that crawls your site for unprotected resources is vaguely like a malignant javascript ad that tries to hijack cookie-based authentication sessions.

CSRF tokens can hinder both of the above behaviors; it sounds like you already have that set up.

Let's look at your heuristics in turn.

Inspecting the Referer field probably isn't useful. You want people to be able to enter URLs manually (even if only a few people do, it's still important). You also want people to be able to link in from other sites. For pages where these things shouldn't be allowed, your real-time CSRF protections should kick in.
This if a fine search rule iff you're sure there are no other rules in your system that could cause a 403 response. If counting CSRF denials is a priority, then you could probably give them their own response code. Codes 418 or 420, or any 4xx not listed here would be fine, but your current analysis might not justify tweaking the server setup in this way.
I'm not sure I understand the details of what you're proposing here, but in general I would not assume that real users don't take long pauses in their interactions with your site.
De-duping POST requests is important, but probably a separate problem from cross-site requests.
Is the system you're working on your system? The behavior you describe in this item is certainly possible, but it's not typical. For purposes of identifying CSRF attacks, I wouldn't worry about this unless you already know it's possible on your system or you already know an attacker is trying it against you.

If you're searching specifically for bad cross-site requests:

Make sure your CORS Headers are properly set up to prevent requests, and make sure your CORF Tokens are good enough for your application. Then search by HTTP response as described in point 2 above. If 403 isn't specific to CSRF denial and you don't want to use a different code, you may be able to filter out the other instances of 403 using heuristics for those cases.

If you're searching for robot traffic:

You can inspect the User-Agent header. I haven't been able to find any modern-looking lists of common bots, but the open-ended search in this answer is probably good.

If you're searching for bad robot traffic:

Welcome to the arms race! A dedicated attacker will, at minimum, be able to get their robots to do anything a human user would be able to do, and if that's all they're doing then you'll never be able to tell the difference. That said, there are some things you can keep an eye out for:

Lots of 404, 403, or other errors in quick succession or from the same IPs.
Traffic from an IP at a faster rate than a human user could realistically cause.

You will find traffic from "attackers". Don't panic, maybe don't even worry about it. If you're set up to deny them what they're after, then they're not causing any problems. (Except maybe DOSing you, in which case you could look into a rate limiter.)


Are client-side-only apps regulated by PCI? Consider a client-side-only application. It may allow a user to make a payment by redirecting them to payment gateway website, where they enter the credit card details. If I understand correctly, in this case only the payment provider must be PCI compliant, as the app itself does not know anything about payment info at all.

Now, what if the app remembers credit card details (for convenience) and automatically populates the payment form on that website? The whole thing happens at client-side. Are there regulations regarding how the card number has to be stored on the client? Is it ok to remember it at all?

Your application processes cards so it must be assessed against PCI-DSS. The fact that it is client-side only or that the processisng is done on the server does not change the fact that at some point, someone is inputting a credit card number via your application.

In the case of client-side applications you have three possibilities:

SAQ A if you have an IFRAME or redirect the curtomer to the processor
SAQ A-EP if you still do not store cardholder data but use some elements from the processor's site in your appliucation (typically APIs and Javascript)
SAQ D-Merchant if you store the data (your case).

The point here is the protection of the cardholder data from "something" accessing it when it should not. Imagine that you store the data on a SD card in the open and that this data is available to other applications - typically it has not been secured enough.


Why am I asked personal information when creating an OpenPGP key? Today I learned about the basics of OpenPGP and tried to create my first OpenPGP key. However, I found a couple of options suspicious - in the GUI version of the program I downloaded there are fields like name or email or expiration date.

Why am I asked for my name or email? From my very basic understanding to send and receive encrypted messages I only need my private and public key and a public key of another person, the key creation and encryption/decryption is just mathematics, so why the other options? My guess is that name and email can be send to some server and later if somebody wants to send me a message (and doesn't know my public key but knows my email address), they can look it up if there is a public key that matches a given email address. Am I right, and if no, what are they for? Can I just leave them blank?
Another suspicious thing was after what time the key should expire. Is the information about expiration date contained within the key (I don't think it is)? So is the key stored on a server somewhere or what? How does it work?

The reason I ask is that this whole OpenPGP thing seems more centralized than I thought. Why can't the OpenPGP software just have a "Generate a new key" button which generates both the public and private key for me to copy and use (and of course an option to encrypt/decrypt text)?

First of all, you don't need to enter them, or you can enter false ones if you like, so go ahead and do so if you so prefer.  (You may need to read up on the options to disable the fields.)

But the reason PGP asks for such information is that it's not just a tool for encrypting messages—it's also a tool for defeating impersonation, i.e., proving that message senders and recipients really are who they claim.  The point is that, as long as you control your private key (nobody has stolen it from you), and other people are confident that your public key belongs to you (the web of trust has tied your public key to your identity), now:

People who send messages to you can be confident that they're reaching you, and not an impersonator;
People who receive signed messages from you can be sure they come from you, and not an impersonator.

Note also that it doesn't matter if the identity tied to your key is your real name, or an alias, or whatever—it just needs to be something that other people will recognize you by.  It's just the answer to the question "whose key is this"?  PGP doesn't care if the answer looks like "Jane Smith ", "John Doe" or "spaghettiman123"; only the people who try to use the public key will care.

  Another suspicious thing was after what time the key should expire. Is the information about expiration date contained within the key (I don't think it is) ? So is the key stored on a server somewhere or what? How does it work?

The expiration date is stored in the key.  The idea is to protect you if your private key gets stolen without you noticing—the expiration date means that the person who stole it only gets a limited time window during which they can impersonate you.

PGP doesn't automatically store keys in servers, and doesn't connect to any server as part of routine operations.  But public keys can and often are uploaded to key servers so that people can download them off there.

  The reason I ask is that this whole PGP thing seems more centralized than I thought. Why can't the PGP software just have a "Generate a new key" button which generates both the public and private key for me to copy and use (+ of course an option to encrypt/decrypt text) ?

It's not centralized, but it does want to interact with other systems—public or private—in order to work ideally.  But you don't have to use any of that.  You can just generate a key pair with no identity attached to it.  You can manually give the public key to a counterparty in person, e.g. in a flash drive, and that will work fine.

The tricky issue here is: how do you securely get another person's public key over the Internet?  If you just downloaded Jane Doe's public key from some web site, you have no way of knowing whether that's really her public key or an impersonator's.  So all that extra functionality you're seeing is about providing tools to attack that problem.  Again, read up on the web of trust, and on public key infrastructure.


fake website used for phishing purposes Our real web site is www.abc.com. Recently Intel notified us of another web site www.fake.com having some parts of the site appearing the same as our real site. This is obviously a phishing site.

Not much damage has been done and I don't think our users are stupid enough to recognize www.fake.com as our real site and try to access it. However, I would like to know what are the mitigation measures we could take.

I reckon sending our users an email or a company circular to warn them that we have only one real site is a must. What else can we do to prevent?

I know that RSA offers services that will, among other things, take down phishing sites. More information can be found here.

I have experience with them and I must say, whenever we request a take down on a phishing site, their response is quite fast.

Unfortunately, I have no idea regarding costs etc.


Any security risks for the login authentication and change password on the same page? I want to ask if there are any security risks for the login authentication and change password on the same page?

Normally the user needs to authenticate first in order to see the password change form. I have seen the login authentication and password change on the same form with 4 fields (User ID, Password, New Password to Change, Confirm the New Password) that combines both authentication and change password functionality. This https://myaccess.ucsf.edu/myaccount/changePassword is an example page. You can see it allows the user to authenticate and change the password on the same page. I just wonder if there are any security risks? This is my first time to see that approach. Normally the user needs to authenticate first in order to see the password change form.

Normally the user needs to authenticate first in order to see the password change form.

By entering the user name and password, the system should first authenticate the user and once authentication is successful, the password should be changed. This is something that can't be verified using the example URL you gave.

However, in this case I would recommend to have an anti Cross Site Request Forgery mechanism implemented in this specific form in order to validate the origin of the request.

In addition, it is recommended to implement some sort of anti scripting mechanism to prevent bots from guessing credentials and then change them upon a successful login. E.g.: rate limiting or captcha after x amount of failed requests.

As far as your question if there are any security risks, my answer would be: There might be, but it highly depends on the implementation. Unfortunately this is not something that we can determine without having an account on one of these applications.

From what I can see on the example page you gave us, there is no anti CSRF mechanism in place, which in theory could start a brute force attack on your behalf if you would visit a malicious website that contains this type of code.


Is there a test for KRACK (devices and routers)? After Heartbleed was announced, a number of tests popped up that let me test if a server I was connecting to was patched, unpatched or unknown. For example, https://filippo.io/Heartbleed/

Is such a test possible for KRACK? Including checking...

my device [1]

my device that I updated over an unknown wifi connection

the router I am connected to (but don't control)
the router I own

[1] I have other ways of finding this out, but here I'm thinking of J. User who hears scary news and just wants to know if their laptop/phone is vulnerable

Test scripts will indeed be published by the original author but are not available yet.

As stated by the author:

  We have made scripts to detect whether an implementation of the 4-way
  handshake, group key handshake, or Fast BSS Transition (FT) handshake
  is vulnerable to key reinstallation attacks. These scripts will be
  released once we have had the time to clean up their usage
  instructions.

I expect the linked page to be updated once the script become available, so check it regularly.

The author just published the scripts to test the devices and access points.


How to Send Decoded URI? I'm working in Burp and received an interesting response when sending a decoded string as a GET request. Copying/pasting the same string into a browser, the string is automatically encoded by the browser when the request is made.

Is it possible to send decoded URI's in modern browsers?

Encoding is required and is the main part of how URL functions for the application server to receive correct form of data.

If your attack doesn't require user interaction like XSS, you can just craft your attack payload in python; in case it will remain the same and the attack takes place.

If you're missing the basics,  you can read the article below.

https://www.lifewire.com/encoding-urls-3467463

Encoding a URL
The most commonly encoded character in URL string is the <space> character. You see this character whenever you see a plus-sign (+) in a URL. This represents the space character. The plus sign acts as a special character representing that space in a URL. The most common way you'll see this is in a mailto link that includes a subject. If you want the subject to have spaces in it, you can encode them as pluses:

mailto:email?subject=this+is+my+subject
This bit of encoding text would transmit a subject of "this is my subject". The "+" character in the encoding would be replaced with an actual <space> when it is rendered in the browser.

To encode a URL, you simply replace the special characters with their encoding string. This will nearly always begin with a % character.

Encoding a URL
Strictly speaking, you should always encode any special characters found in a URL. One important note, in case you are feeling a bit intimidated by all this talk or encoding, is that you generally won't find any special characters in a URL outside their normal context except with form data.

Most URLs use the simple characters that are always allowed, so no encoding is needed at all.

If you submit data to CGI scripts using the GET method, you should encode the data as it will be sent over the URL. For instance, if you are writing a link to promote an RSS feed, your URL will need to be encoded to add to the script URL you're promoting it on.

What Should Be Encoded?
Any character that is not an alphabetic character, a number, or a special character that is being used outside its normal context is going to need to be encoded in your page. Below is a table of common characters that could be found in a URL and their encoding.

Reserved Characters URL Encoding

Character   Purpose in URL  Encoding
:   Separate protocol (http) from address   %3B
/   Separate domain and directories %2F
#   Separate anchors    %23
?   Separate query string   %3F
&   Separate query elements %24
@   Separate username and password from domain  %40
%   Indicates an encoded character  %25
+   Indicates a space   %2B
<space> Not recommended in URLs %20 or +


Satoshi Nakamoto Renaissance Holdings' website is Wordpress? Is it safe? So, Satoshi Nakamoto, creator of Bitcoin has announced that he will supposedly be revealing his real identity. I find the fact that Satoshi's company website is hosted on Wordpress to be endlessly amusing for some reason. I mean, I get it, I use wordpress myself but I always saw it as endlessly vulnerable from a security perspective and I don't trust anything of true value to it. Satoshi, being a brilliant crypto expert and developer (I'm assuming) using Wordpress confuses me.

https://satoshinrh.com/wp-login.php?redirect_to=https%3A%2F%2Fsatoshinrh.com%2Fwp-admin%2F&reauth=1

Should Satoshi expect problems with his site? Could this be an indicator that this site is not genuine? The SSL certificate was recently issued so it's possible this is a placeholder website? It's only domain validation so I suppose it doesn't guarantee anything other than integrity of connection with the server...

Anyway, I'm simply very amused and would like to know if anyone finds that this is a dangerous decision on Satoshi's part. I'm by no means a security expert but Wordpress for anything other than a blog gives me the heeby-jeebies.

The only way anyone would be able to prove they created the network is by moving Bitcoins out of one of the very first (and oldest) blocks (EDIT: or signing something with their private key). As this is not demonstrated on the website, the fact of whether it is secure, hosted on WordPress or any other indication is irrelevant.

I think it's safe to say that this website is not genuine.


How to find the IP address of a CCTV camera connected to laptop via ethernet I'm trying to get the IP address of a CCTV camera and so far had no luck.
The device it's a Hikvision DS-2CD2042WD-I
I have connected it to a PoE switch, which is then connected to my laptop(Ubuntu 18.04)
I want to find the address to that I can rstp to check if the camera works correctly.
My understanding is that these cameras often come on a different interface (i.e 192.0.0.*) and that we need to be on the same interface in order to be able to scan their ip address
There's a tool called SADP that does the job but it's not working on linux for me
I'd like to know if I can achieve the same results using linux command lines
Is there a way to find what network interface the camera is on, find the ip address, change the ip address to be on the same network interface as all of my other devices?
Thank you

One method is passive; use a packet capture tool such as Wireshark or tcpdump to see if you can see the device communicating on the network.
If that fails, try netdiscover, which can actively sweep all subnets to find devices.


Distance Education Programs in Digital Forensics I am looking for a distance education program with the end product being a Masters of Science in Digital Forensics. I looked through the site and did not find any results, and was hoping since most people here are in the industry, someone might know a couple more.
 I only know UCF's Msc in Digital Forensics, and even this one is partially online. I can't attend in residence, as I am an engineering during the day :)

Boston University Looks like it has what you are looking for.
http://www.bu.edu/online/programs/certificate-programs/digital-forensics.html

Also Champlain College has a program as well.
http://www.champlain.edu/Graduate-Studies/Programs/Master-of-Science-in-Digital-Forensic-Management.html


Is exploit researching different from penetration testing I'm confused by some terminology - reverse engineering seems to me to be pretty similar to exploit researching. I mean if you can reverse one program probably you will be able to find a vulnerability, but for this you need to be good with C and Assembly.

A lot of people tell me that a pen tester should master python and other scripting language not C and Assembly. This is really confusing so my question is:

Is exploit researching part of pentesting?

Short:

Is exploit researching different from penetration testing? Yes.

Is exploit researching part of pentesting? Usually not.

Good summary of what penetration testing is is here: Wikipedia definition of penetration testing.

Simple penetration testing

A lot of penetration testing work is actually just running pre-existing, well-known attacks or exploits. (Like e.g. run MetaSploit.) This work is based on some modeling of where the relevant problems may lie. But does not actually involve exploit researching or reverse engineering.

Going deeper

However, going deeper to penetration testing, it is not sufficient to use tools which are completely off-the-shelf. On this stage, people:

Consider the target system (its operations, and its possible weaknesses) in detail
Create attacks based on the target system

The analysis of target system is usually on level of examining its high-level design, components (like web servers, frameworks, communication protocols etc.).
This analysis can of course go as deep as reverse engineering or source code review, but often already higher level details are good enough to sufficiently nail it down how to attack against the system.

More elaborate description of usual stages relevant for penetration testing can be found in this previous answer What is the difference between a penetration test and a vulnerability assessment?

Why not reverse engineering or exploit researching

The reason reverse engineering and exploit researching is rarely important part of pentesting is that pentesting is being made for the owner of the system. Therefore, the attacker is already given much better tools than exploit researchers typically have: the system is usually revealed to them in detail to allow them to do their work efficiently. (In other words, they are allowed to short-circuit much of exploit research.)

Python and scripting

The reason scripting is important in penetration testing is that penetration testing usually involves large numbers of very similar test cases. To make those small variations efficiently, scripting is typically used.

For example, Metasploit which is common tool to use on this field can be scripted using python.

In addition to python, some other scripting languages, like Ruby and perl are used.

  I mean if you can reverse one program probably you will be able to find a vulnerability, but for this you need to be good with C and Assembly.

In case of well written software I would disagree. Even if you have access to original source code of the software, typically it is hard to find vulnerabilities.

If you have only access to the binary, it is even harder, as you effectively need to decompile the software, and lot of knowledge has disappeared and the code is no longer in easy to read format. Modern software is large enough that it is very hard to concentrate on important parts of the binary and dig essential vulnerabilities from it.


Rainbow tables/hash tables versus WPA/WPA2 In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks?

Is there an advantage of one over the other?

Where would one get said tables or can they be generated? Is there a way to defend against all attacks of this type?

What hashing functions do WPA use and how does the process of authentication work?

In depth explanation and some scenarios would be lovely.

WPA/WAP2 does not use a dedicated random salt.  Instead, it was designed to use the SSID as a salt value.  This is better than no salt but it does mean some access points are vulnerable.  For quite a while most routers would ship with a static SSID ('linksys' or 'default').  So while hackers can't just precompute a single set of passphrases they could precompute common passwords against common SSIDs. Church of Wifi has some rainbow tables (1 million common passphrases for 1,000 common SSID = 33GB) as well as general information on wifi cracking.
http://www.renderlab.net/projects/WPA-tables/
So WPA/WPA2 isn't as bad as WEP but relying on a low entropy value like SSID made it more vulnerable than it needed to be.  That vulnerability was made worse by companies shipping hundreds of millions of routers for years with static SSIDs.  Many people never changed them, and some who did picked other equally bad/common SSIDs.
The most common SSIDs
linksys
<no ssid>
default
NETGEAR
Wireless
WLAN
Belkin54g
MSHOME
home
hpsetup
smc
tsunami
ACTIONTEC
orange
USR8054
101
tmobile
<hidden ssid>
SpeedStream
linksys-g
3Com
WaveLAN Network
Wayport_Access
hhonors
pi07490509x
pi07490509x09
Motorola
SST-PR-1
ANY
eurospot
188ALT
Gateway
HomeNet
GoldenTree
SITECOM
ConnectionPoint
<No current ssid>
Philips WiFi
Customer ID
PCX5000
arescom
Wireless Network

Today most routers use a pseudo-random SSID like linksys_AUENFJS22 instead of just linksys but there are a lot of vulnerable hotspots out there.
The hashing function is PBKDF2 which uses multiple rounds to slow down attacks.  The entire authentication process is far too complex to be a good fit for SO.
To protect yourself from precomputation you should ensure you use a unique SSID.  One thing I have seen more than once is someone thinking they are secure by disabling the SSID except that is common enough that it became an entry in most rainbow tables.


Can system be monitored while VPN is disconnected? I am a software engineer by profession and as of now doing wfh. So we always connect to VPN and I know my activities will be monitored. But what will happen if I disconnect from VPN? Will IT team be able to monitor what I browse or access? I am just curious to know this. It is my office laptop and we have softwares installed on it.

It is my office laptop and we have softwares installed on it.

Software to monitor the activity on the system does not need a working network connection at all time. It is sufficient if the software logs information to the local disk and later these information can be collected.

But this does not say in any way that your employer is actually monitoring what you are doing when you've disconnected from the VPN nor that it is monitored what you are doing when being connected to the VPN. It only says that just being disconnected from the VPN does not make it impossible to monitor the activity.


Google Analytics showing page views from pages I don't have on my server? What does this mean? I don't have these pages/directories but GA is showing them as pages viewed. I tried to follow the link and I didn't make much sense out of it.

If you display a generic 404 page for those URLs, then Google Analytics may count it as a "page".

With those pages, someone may be attempting to see if you're a proxy, or if your site can be used to redirect users. It's noise traffic that comes from scripts and bots. Unless you have a vulnerability on your site, it's really nothing to worry about.


Does a smart card do encryption or does it just provide a private certificate? I don't really understand how smart cards work. Do they sign or encrypt themselves (where the computer provides data to it to sign) or do they provide a computer with the private certificate when I enter my PIN?

This highly depends on the smart card.

Some card simply provide a key store whereas others provide a complete infrastructure where you send your data and the smart card can sign and/or encrypt the data.

The second type (which is typically meant when using the term smart card) have the advantage that the (private) keys never leave the smart card.


Host sending massive amount of TCP/IP Packets with RA Flag: Part of DDoS Attack? I have a host on the Network that tries to send TCP/IP Packets to various servers. The DST Port is always 80 or 443 and the Flags set are RST and ACK. These Packets are blocked by our firewall. I did whois request for all target addresses and it where all addresses of the Google Cloud or Akamai. All 100 Request where sent within a secound. This happend several times.

My Suspicion now is that there are no further packets sent because the malware realized that the packets are blocked by the firewall. Is this a reasonable idea or is there a less malicious explaination for this behaviour?

// The questionable host is running windows 7.

I wrote a script that fetches the certificate from all hosts that where listed in the firewall with TCP:RA to port 443. The Results showed that ~70% of that hosts had certificates for *.dropbox.com and to some other cloud based solutions. Seemingly the connection of these clients had been reset by servers by sending a packet with the RST Flag set which terminated the State in the firewall. The firewall then blocked the RST,ACK Answer from the client. So no malware in most cases. One host was actually infected.


What would it take to attack or disrupt the GPS system over a wide area? What would it take to attack or disrupt the GPS system? In other words, how feasible or likely is it for the GPS system and its network of satellites to be disrupted across a large area such as an entire state or country?

I understand that GPS jamming might be possible from the ground, but I suspect it would be quite localized and apparently newer devices are more resilient to this.

If conflict was to arise between two countries, what is stopping the country that controls some of the GPS satellites from blacking out or jamming an entire region.  And perhaps more of a political question – would the effort required actually pay off in any significant advantage or bargaining power?

Traditionally as GPS was an american military system, it was intended to be possible to disable it in times of war, by removing the unencrypted civilian signals.  Also in the earlier days Selective Availability could be used to render it inaccurate.

However the situation is different now as there are multiple systems controlled by different countries, GLONASS from Russia, BeiDou from China and Galileo under development from the EU.

As such disabling by switching off the signal is unlikely to affect all the available services, which would make country-wide jamming problematic.

As to more localised jamming that's perfectly possible as the signal for GPS type systems is pretty weak and all that's theoretically needed is a transmitter which swamps the signal in an area.  On a small scale there's evidence to suggest that truckers use these to disable employer tracking of their movements.


Continuous learning: Identifying/ Leveraging papers on new research, best practices, etc As we all know there are so many resources with awesome information security related content.  Does any one have best practices for managing the large influx of these papers and blog posts across their organization?

At the smaller level, RSS feeds, email newsletters, and Twitter, are great to obtain "what's happening in infosec."  What is the solution for larger scale knowledge management?

I'm sure there's a better way to phrase the question I am trying to ask.

Well, any answer is going to be very opinion based since there isn't a single answer. It depends on how you like to work and what you are used to.

Personally, I've ended up almost exclusively using Microsoft OneNote as it is flexible, quick and easy to use. All my notes and most of my links go into notebooks that I reorganise from time-to-time based on what is of interest.

I've used many other knowledge management tools in the past but they never really help in the long-term for me. OneNote with it's comprehensive searching along with some simple organisation into Notebooks, sections pages/sub-pages is enough. You can take hand-written notes via a tablet too and it will generally still search the text. Same for documents, voice and video recordings embedded.

I use a personal list of sites and blogs that I consume via RSS. Articles of particular interest are pushed to OneNote (or may just be kept as an interesting link with a comment). Finding trustworthy sites with reliable sources and writers is key.

Twitter might be useful though I tend only to publish curated links and comments to it, I rarely find the time to consume via Twitter. I suspect the trick is in finding the right voices on Twitter that publish a high enough content-to-noise ratio. Finding the right hashtags can also help.

Whatever you do, don't forget to record the source not just the content so that you can reference it in the future. Also, don't be afraid to both regularly reorganise your knowledge but also to archive it by starting a new notebook - possibly from scratch or only copying over some key info. Keep the old notebook in case you want to reference it.


what to do after a "tech support" scam I don't know if it is the right place to ask this question but I am in a desperate situation. If this is not the place please let me know where I can get advice.

I was going to download something and a message saying that I should call Microsoft and that if I don't, the computer would get blocked within 5 minutes came up. So I called them and they remotely accessed my computer and installed some antivirus software and the problem was resolved. But, then when I checked online for this issue it seems like a scam as several posts such as this were there and here (when I called them I didn't have access to internet, so I couldn't check their legitimacy and most of all I panicked). They installed F-secure anti virus and included Adguard Adblocker, Malwarebytes and AdBlock Plus and some network guard (That's what I know that they did). But, since this was like a scam, I already canceled my bank card.

And they provide me service for one year and I am concerned now whether they can access my computer from today onward. What should I do? Should I tell them I don't want their one year plan and try and get rid of them?
Is there a way that I can know if they have installed anything on my computer that they can get details of what's happening in my computer. I now realise what I did was utterly stupid, but hen that message came up I panicked and called them. I have back up copy of windows. Should I reset the PC? Should I change the email passwords? If I keep away from making any online payments from this laptop would I be safe? Should I take this laptop to an expert?
I would extremely value your suggestions as I am scared as to what dangerous outcomes can happen

This is a scam, you have done the right thing to cancel your debit card,  if you have given them any other bank details, tell your bank.

The only safe assumption is that your machine is compromised, it possibly has a remote access tool installed they can take advantage of in future and may have keyloggers installed.

You should wipe and reinstall your machine.  Although most of these scams just want the cash, you can't be sure what they have done and should err on the side of caution.

I would advise you to change any password you have entered on your computer since the call and enable two factor authentication on any account you can.


Can you describe a real-life scenario of exploiting sticky bits? Sticky bit are mentioned in every UNIX security book, but I couldn't find anyone that describes the exploitation of Sticky Bit set on a file.

Can you?

man chmod #Debian Linux

  RESTRICTED DELETION FLAG OR STICKY BIT

  The  restricted  deletion  flag  or  sticky  bit is a single bit, whose
         interpretation depends on the file type.  For directories, it  prevents
         unprivileged  users  from  removing or renaming a file in the directory
         unless they  own  the  file  or  the  directory;  this  is  called  the
         restricted  deletion  flag  for the directory, and is commonly found on
         world-writable directories like /tmp.  For regular files on some  older
         systems,  the  bit saves the program's text image on the swap device so
         it will load more quickly when run; this is called the sticky bit.

Note that the "on some older systems" part applies to various BSD systems. Linux has never had any special handling for the sticky bit on files. See http://en.wikipedia.org/wiki/Sticky_bit for more detail about that.

From a security standpoint, it's really just about understanding why that permission exists on the /tmp directory, and possibly others. It prevents users from deleting the files of others in a directory that can be written to by multiple users. It's really only an issue if you don't set it and somebody gets delete happy on others' files.


Is taking a screenshot of my VPN settings safe? I had a problem with my VPN Service, and I asked a guy in a forum for help, and he told me to screenshot all of my settings in my VPN application. Is this safe, if not, what setting should I redact?
Is there something I need to hide from others, and is it safe to say what VPN service I use ?

Its not a good security practice to share your personal stuff online.
There is no problem in sharing screenshot unless you are sharing your vpn's configuration file.


Is it safe to share my hostname I am using GNU/Linux. Sometimes, I copy/paste code from the terminal (like user@hostname ..) to put it in a forum thread or a blog ..etc And I was always wondering that it is better to hide it .

Is it safe ? What risks may I encounter when I share my local hostname when using a regular internet connection  ?

As a private individual, unless your hostname is myPassWordIs123 and your password is 123, then you really have nothing to worry about. Here's a screenshot from my main everyday-use laptop:

However, in corporate environment, hostnames usually hint at the functionality or the role of the server/machine. They might even provide some information that allows attacker to gain a deeper understanding of how the corporate network is designed and implemented.

After securing your machine with proper firewall rules, an anti-virus, common-sense usage practices, etc., then it might be beneficial to add a layer of obscurity and vagueness to your system.

Bottom line is: In your case, I wouldn't really worry about it.


It is actually URL-Encoding and decodes to this:

cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -d auto_prepend_file=php://input -n

Its some kind of PHP interpreter exploit I think. You can read about some more of this here:
Protect against POST //cgi-bin/php attacks?

Btw: The actual code they are trying to inject is probably in the POST-Content. (Most likely not logged by your webserver)


How to prevent a virus from stealing data when I transfer files between offline and online computers? Let's say I have one offline computer with some important data, and one online computer. Sometimes I need to move files from the offline computer to the online one. When I transfer those files, is there a risk that a virus would also transfer some of the important data that should not leave the offline computer?

As long as I don't plug anything into the offline computer everything is surely safe. But how can I then pass some files between the two computers, without risking that a malicious virus cache some of my other files from the offline computer and pass them to the online computer, and then send them away? I think it is possibile to write such a virus, that query the hard disk with some search and save some data when it is plugged in to the offline computer, and when it is plugged into the online computer it sends this stored data to a third party server.

How can I set up an environemnt and how should I behave in order to protect myself in a scenario like this one?

How can I control what is leaving the offline computer on a pendrive? Is it enough to check for hidden files in the file explorer? Maybe calculate a checksum before I plug in to the offline computer, and then compare that to the checksum of the files I transfer on the pendrive? Is there any alternatives? What about bluetooth? I guess there is no different which channel or protocol I use?

There is no simple way to move files between computers and preventing other files from being moved. Yes, what you described is not only possible for malware, but was famously pulled of to destroy Iranian centrifuges by the Stuxnet virus.

As for some of your ideas. Most of them won't work. The virus can just write into unused space on the storage device and there is not a simple way to detect or prevent that. You could try to chceck all used space and overwrite unused space, but how would you prevent the device performing the overwrite from getting infected as well?

Using bluetooth is potentialy even more dangerous, as it is similar to just connecting it to the internet.

Transcribing data manually is about the only foolproof way of doing this, though a more reasonable level of security can be achieved using flash drives.


Can the following function be somehow exploited/used for malicious behaviour? I am using a main Site Engine class which is constructing most of my pages.
I'm using this language function to change language website for all of my pages in the start of the Site Engine class:

`$defaultLang = 'en';

//Checking, if the $_GET["language"] has any value
//if the $_GET["language"] is not empty
if (!empty($_GET["language"])) { //<!-- see this line. checks
    //Based on the lowecase $_GET['language'] value, we will decide,
    //what lanuage do we use
    switch (strtolower($_GET["language"])) {
        case "en":
            //If the string is en or EN
            $_SESSION['lang'] = 'en';
            break;
        case "tr":
            //If the string is tr or TR
            $_SESSION['lang'] = 'tr';
            break;
        default:
            //IN ALL OTHER CASES your default langauge code will set
            //Invalid languages
            $_SESSION['lang'] = $defaultLang;
            break;
    }
}

//If there was no language initialized, (empty $_SESSION['lang']) then
if (empty($_SESSION["lang"])) {
    //Set default lang if there was no language
    $_SESSION["lang"] = $defaultLang;
}

        Template::SetLanguage($_SESSION['lang']);`

I am asking two questions:

Can somehow the domain.com/?language=LANG_HERE be exploited?
Since I store additional session variables upon successful login into the website: $_SESSION['Account'], $_SESSION['Password'], $_SESSION['Email']
Is it possible the lang session variable to be exploited or manipulated? It's NOT user input since I'm setting it according to the response of ./?language=LANG_HERE but still overall can this script above be exploited somehow?

Sorry if these questions seems stupid but I am still learning and I need to know that for sure. Thank you!

Your code looks good and there doesn't appear to be anything you need to be worried about.

A side note or two:

I would consider adding trim() to your variable to clean any white space.

I am a little curious why you use if(!empty){}if(empty){} instead of an if(!empty){}else{}


How to make QR Code uncopyable - Scanning of the QR Code at consumer level I am designing a Consumer Protection System for import products on Blockchain technology. My Client wants to use QR Code instead of Security Tax Stamp. How can we make QR Code uncopyable at the consumer level?

Scenario:
I went to a shop to buy an imported Cadbury chocolate bar. The chocolate bar I am buying is not custom cleared and QR Code pasted on it is copied from an authentic custom cleared chocolate bar. As a consumer, I scan the QR Code on that product using an authorized application it will fetch the information stored against that QR Code.

Adding an unauthentic product on blockchain is impossible but at consumer level where only scanning is involved how can it be made secure in a manner that consumer is able to find out the product they are buying is authentic or not?

Thanks.

A QR code is just text, encoded in a format that is easily readable to a computer. Can you make the preceding sentence uncopyable?

You cannot make text incopyable. Forget it. It is utterly impossible. What stops me from whipping up paint.exe, and copying the QR code pixel by pixel? Or place it on a scanner and print thousand copies?

QR codes relies on that the smart phone is able to make a copy of the content. When you scan it with your phone, the picture is a copy of the content. The picture is decoded, and a new copy of the information is made, this time as a text string.

So what you ask is not only impossible, it strikingly impossible. You must look elsewhere for how to solve your problem - for instance by invalidating the data in some online database.


What is the best practice for placing database servers in secure network topologies I have a classic DMZ architecture:

My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network as it contains confidential data.

Where should I place the DB server and why? Should I add a second firewall and create another DMZ?

The best placement is to put the database servers in a trusted zone of their own.
They should allow inbound connections from the web servers only, and that should be enforced at a firewall and on the machines. Reality usually dictates a few more machines (db admin, etc). Obey reality as needed, of course.
They should only be making outbound connections if you're updating software on them.


mobile number authorization strategy using SMS, best pattern and practices In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS.

In a typical scenario;

the GUI which user is interacting with (whether it is a web site or an app) asks user to enter her/his mobile number
then server generates a token and
sends that token to the provided mobile number
then user must switch to a new GUI for instance, if the original GUI is a web site,  user must switch to her/his mobile device's to find the received message in SMS inbox. it is the same if user was originally in an app. in that case user must switch to SMS manager app on her/his Smartphone
the user then, must copy or memorize the received token to
then user must switch back to the original GUI and
enter the copied or memorized token into the originating web site or app and
hit a key (for example) and
wait for the server to process the entered token
at the end, server validates entered token and if it is correct then authorizes that mobile number and may set it as an authentication mean for the user and
finally the result is displayed on the GUI

this is a typical scenario which most of well known IT companies (such as Google, Facebook and others) use to authorize their users.

now assume another scenario,

the GUI which user is interacting with (whether it is a web site or an app) asks user to enter her/his mobile number
then server generates a token and
shows that token to the user in the same GUI and asks the user to send it to a specified number (Server Messaging Centre Number = SMCN) using the mobile number that is entered by user.
the user may have to copy or memorize the displayed token,
then user must switch to a new GUI, for instance, if the original GUI is a web site, user must switch to her/his mobile device to type the token and send it to SMCN. it is the same if user was originally in an app. in that case user must switch to SMS manager app on her/his Smartphone to send the token. however in this case, app may employ smart device's programming API to call SMS Launcher and pre-fills the address and content of the message on behalf of the user.
the user just sends the message to SMCN,
then user must switch back to the original GUI and
hit a key to declare that the token has been sent to the server and
wait for the server to process the entered token
at the end, server validates entered token and if it is correct then authorizes that mobile number and may set it as an authentication mean for the user and
finally the result is displayed on the GUI

now the question is, which method is better in terms of security and other factors if there is any?

EDITED:

I have updated the question based on @Andre edit and answer for better understanding,

first, both methods may use in authentication as well as authorization. assume the case that someone have logged into her/his Internet Banking account and wants to transfer money, here the mentioned methods may use to authorize user and grant her to transfer money or not.

second, let's focus on comparing these two methods and not talking about downside of using SMS in authN and authZ process.

Third, comparing two alternatives, (as I said before) in both cases users have to memorize or copy something then leave one environment for another and type or paste it. So, it sounds like, in terms of usability both methods are the same; as in method one, user have to type something received in SMS into the original GUI and in method two, user have to type something seen in original GUI into SMS send|receive GUI. Therefore in both cases, user may make something wrong.

Lets look at some different attacks and how they impact the two different systems, followed by some usability considerations.

Control of phone (draw)

If the attacker has full controll over the phone, it is game over no matter what. However, an attacker may have been able to get a trojan onto ther phone that only has limited permissions. At least on Android, reading and sending SMS is different permissions. However, this secnario feels rather contrived and I see no reason why it would be harder to get one permission than is is to get the other.

Social engineering (#1 wins)

To fool some users to read the code is easy if that is all the message contains. Call the user, say that you are from the cell phone company testing the reception or whatever, and that they will soon recieve a message to read back. (A competent attacker could come up with a way better lie than I just did.)

However, this can be made hard if the SMS contains an explanation of what the code is (and perhaps an exlpicit warning against phising), thereby revealing all your social engineering lies.

A user that has to send an SMS can get not such warning. That user could fall for tricks like "just send this code to this number to claim your free sport car". Not everybody would fall for this, but some would, especially if it is for a service they seldom use so they do not recognice the number.

Eavesdropping on the phone network (#2 wins)

As GSM encryption is famously weak, and fake cell phone towers to use for MitM can be bought on the internet, an attacker might try to eavesdropp on the SMS communication. This is not a theoretical threat, but something that is done in the wild.

With system one, an eavesdropper has to read the passcode that is sent to the user when they try to login. The attacker then needs to use it before the user (should be easy if the process is automated). This requires the attacker to be in the physical proximity of the target when the user happens to login to the service.

With system two, it doesn't matter if the attacker reads the SMS. The passcode is (or at least should be) unique to the users device, and the attacker can not authenticate on his device even if he knows the passcode the user sent.

SMS spoofing (#1 wins, major issue)

SMS spoofing is a very real thing that is used in the wild. If the attacker can spoof the users phone number in an SMS, he can overcome alternative two. This is a major weakness in that approach.

I just googled "free SMS spoofing service" and came up with this site. Surely even your computer illierate uncle could do the same, thereby bypassing your authentication scheme.

Usability (#1 wins)

Alternative two has some downside when it comes to usability:

The user has to enter a passcode and a number to send it to. This takes longer time. Two things to copy paste is twice as many as one.
The user might enter the wrong phone number, resulting in a failed login. If the wrong passcode is entered in alternative one, it is easy to give appropriate feedback to the user. If an incorrect phone number is entered, it is hard for the server to know what happend and give the right feedback to the user.
Sending a SMS might cost money for the user.

Conclusion

On security, it is 2-1 to alternative one. But how serious are the different vulnerabilities? I would argue that especially SMS spoofing but also social engineering are larger threats than eavesdropping. They can both be done from anywhere in the world, and require much less effort and technical knowledge. SMS spoofing could possibly be done automated on a large scale.

So even leaving usability to the side, I would argue that alternative one is the safer alternative.

TL;DR

You can spoof the sender of an SMS, making them useless for identifying the sender. Use the first alternative.


Is it possible for my ISP to do MITM attack on my VPN? Yesterday my ISP dropped my connection for several hours. This idea came to me during that time.

Is it possible for my ISP to do MITM attack on my VPN when he knows I start it almost instantly as he turns on my connection again?

Well, I don't know much about these things, so I better re-phrase to be crystal clear and mention some things that might be important:

System: Linux Mint 18.2, kernel 4.10
VPN: Private Internet Access
OpenSSL: Version 1.0.2
Certificate:

/home/<username>/.pia_manager/data/ca.crt

I only imagine that the ISP could interscept the initial handshake and by that possibly decrypt the communication? Is something like that possible?

Not if your VPN client is verifying the certificate of the VPN server.  VPNs (particularly OpenVPN) are very similar to TLS: a server certificate is cryptographically verified as part of the connection setup.  Without a valid certificate for the host (or, depending on your configuration, the exact same certificate) on their MITM server, your client will just reject the connection.

Technical means aside: unless you're doing something really shady, you're likely not that interesting to your ISP that they would want to MITM you.  They have lots of other problems to deal with.


Preventing registered users from sharing passwords Below is a proposal for dealing with a situation of website security. I am wondering whether it seems feasible, from both a technical and usability point of view. I want to make sure that the proposal does contain any glaring errors.

The website

The website in question is a school website where students may purchase various items. These students get an account on the website with a username and password, which they can use to login. Once they login, they have access to protected pages with private content which are unavailable to the public at large.

The security concern

The owners of the website wish to prevent a situation where a single student signs up on the website, obtains a username and password, and then circulates those credentials to a circle of friends who are then able to login to the website and illegally view the private content.

The solution

The central idea we have come up with to deal with this security problem is to permit each student to login to the website on two devices only. Once a student logs in on two different devices, they are restricted to those two devices. If they then attempt to login on a third device, the system would simply not permit them to do so. It is our understanding that other websites offering private content, such as Netflix, use such an approach.

Implementation

Two ideas come to mind to implement the above security measure: IP address and cookies. We rule out IP addresses which can change, and choose cookies. Websites such as amazon.com allow their customers to login once, and then whenever they return to the website, they are always recognized. This is almost certainly achieved through cookies.

Thus each time a student logs in, we will store on their device a cookie. And we will also store this cookie in our database under that student's account. Thus each time a student logs in on any device, we will check whether the device they are currently logging in on contains the cookie we have stored for that student. If it does not, we will know that the student is logging in on a different device. We will thus be able to know how many devices the student is trying to login on.

Drawbacks

We have identified at least three possible drawbacks to this approach:

Clearing cookies. People can, for a variety of reasons, choose to clear the cookies from their computer.
A bona fide person may occasionally not have access to their usual device, and wish to login on a different computer.
People do purchase new devices from time to time.
These are examples of situations where a bona fide user, for legitimate reasons, wishes to login, but will be unable to, due to the website's security restriction of two devices.

We have some ideas as to how to build logic into the system to deal with such situations, which we may implement in the future, but for the time being, we feel that such situations are sufficiently rare that we do not need to handle them programmatically.

Rather, for now, in the event that a student is locked out, they will get a screen with a message explaining why we have not allowed them into the system, and a button which they can click on which will automatically generate an email to the site administrators.

The email will inform them that a student wishes to login on a third device. The administrators can then contact the student, and if they are satisfied that the need is bona fide they will be able to take steps from the CMS to allow that student in.

The size of the student body is sufficiently manageable that the above approach should be feasible.

Fair warning

We will inform the students of these security measures when their account is activated in order to prevent unpleasant surprises.

What you are trying to do is futile. Information can not be contained. You can not prevent someone from passing on information. When they can not share their logins, they just copy&paste the text. When you disable copy&pasting (the common methods to do this can be easily bypassed, by the way), they will make screenshots. When you find some way to make screenshots impossible (I couldn't think of any), they will read it to each other. All you will achieve is impair the user experience for legitimate users without really preventing abuse.

But when you really want to go down that route, you might look at alternative ways of browser fingerprinting than IP address and cookies. There is a lot of other information a web browser transmits on every page request, and often it is sufficiently unique to identify a user. The Electronic Frontier Foundation has an interesting demo with their Panopticlick website.

Among the techniques used are:

UserAgent string (browser self-identification)
HTTP_ACCEPT Headers
Installed plugins and their version numbers
Installed fonts
Timezone
Screen size and color depth
Alternative cookie techniques (localstorage, persistent storage in plugins like Flash)

Keep in mind that all these identification methods are prone to false negatives because many of them can change at any time. You should only consider a fingerprint as comming from a new device when multiple properties drastically change simultaneously. When the difference to the previous device profile is minor, you should silently update the device fingerprint instead.


Can my school see the websites I've visited while on my home WiFi after I reconnect to the schools? I know that they can't monitor me on my home WiFi, but can they see the websites I visited while on my home WiFi after I reconnect to the schools?

Probably not. However, if you set your browser to reopen all tabs when you start it, then they might see what your last open tabs were.