How can I encrypt a file using gpg without including the recipient's key ID? An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question.

Is there any way to remove that information from the resulting encrypted file? Does gpg provide an option to not include that information?

If not, what workarounds are recommended? I want to encrypt a file for a specific recipient and share it with any third party without revealing the identity of the recipient or of the sender.

(It may be assumed that the recipient's public key is widely shared and associated with the recipient's real identity.)

Use the -R (or --hidden-recipient) flag in gpg to do this. More details in this answer.


Is it possible to protect a key from an attacker with physical access? So a colleague and I are having an argument about physical access.

We have two devices A and B where A contains a function f(x) whose implementation we want to keep secret. We want to allow users to connect to A from B, input x and read out f(x). They have physical access to both devices. To protect the algorithm, we want to encrypt the HDD of A and keep the key in B. Now the question is, can we ever realistically hope to prevent an attacker from gaining access to the key?

I'm saying that to secure this system, A or B needs to somehow be connected to an external validation source C, that the attacker does NOT have phyiscal access to. Is this correct?

whose implementation we want to keep secret

This is usually an indicator that your scheme is insecure. The implementation itself should not need to be secret. The secret should be key material, not the alghorithm or implementation itself. This all falls under Kerckhoffs's principle.

  Now the question is, can we ever realistically hope to prevent an attacker from gaining access to the key?

Absolutely not. I can think of at least five attacks off the top of my head that'd break this, starting with dumping all memory via PCI-e DMA.

As an example of how utterly impossible it is to keep keys hidden away when an attacker has physical access, look at the games console homebrew scene. The Xbox 360 and PS3 had a whole range of security controls built right into the CPU's silicon, with on-die secret key storage, isolated RAM for secure execution units, cryptographic chain-of-trust from the bootloader all the way to the applications (games), and all sorts of other clever controls... and it only took 12 months for people to break each platform (in the case of the PS3 it was 12 months after Sony killed Linux support). Physical access means the attacker will ultimately make it do as they wish and gain access to every last bit of data on the device.

  I'm saying that to secure this system, A or B needs to somehow be connected to an external validation source C, that the attacker does NOT have phyiscal access to. Is this correct?

I'm not sure how "validation" applies here, but essentially you need to keep f(x) from ever being leaked, so it must be stored and executed on a system which the user (or an attacker) does not have access to.

You'll also need to consider the effects of an attacker employing your remote service as an oracle, which it essentially is. As an example, the PS3's hard disk was encrypted and nobody could access the decryption keys (these were on-die and only accessed from an isolated execution unit) but, due to a flaw in the encryption process - they used the same key and IV for every sector - you could take a snapshot of the disk, upload a movie to the PS3, look for the big block of sectors that changed, then overwrite those sectors with any others from the disk (say, the operating system itself), boot the PS3 back up, download the movie again, and the system decrypts the disk sectors (without you ever knowing what the key was!) and gives you the original plaintext back. Homebrew devs used this oracle attack to decrypt data without ever needing to know what the key was. You should consider similar attacks against your system.


DDOS attacks and multi-threading Does a host create a separate thread for each TCP SYN request? Or it depends on the socket implementation for the host?

Except for user space network stacks the operating system fully handles the complete TCP handshake in the kernel and notifies the application only once the connection is fully established. The kernel part is handled in a lightweight way, i.e. usually there are no kernel threads involved. What's happening in user space after the connection is established depends on the application. Some applications create a new thread or a new process for each new connection while others handle it  inside the same thread and process.


How can this executable have an .AVI extension? Disclaimer: I opened the following torrent file just because someone reported it as a movie containing a virus, which seemed very strange. I do not support piracy.

So, upon opening a .torrent file downloaded from internet, I get the following dialogue in uTorrent 3.4.7:

Although it seems to have an .AVI extension, the icon reveals that it is in fact an executable (other, legit .avi files show the VLC icon)

When uploading this file to torrenteditor.com, I get the following result:

As you can see, when I try to copy using mouse cursor from left to right, it skips the .exe part, and I have to move the mouse RIGHT to LEFT in order to copy the remaining part.

Unicode allows for right to left languages as well as left to right, so what you have here is a cleverly arranged title including a right to left part with .exe being the suffix.

From https://www.explainxkcd.com/wiki/index.php/1137:_RTL

U+200e    LEFT-TO-RIGHT MARK
This is used to insert left to right script into a right to left sentence.
U+200f    RIGHT-TO-LEFT MARK
This is used to insert right to left script into a left to right sentence.
U+202a    LEFT-TO-RIGHT EMBEDDING
The following text will be left-to-right. This will not change directionality of characters, so for example Arabic letters will stay right-to-left. This character alone does nothing in an English text, since the text direction is left-to-right by default.
U+202b    RIGHT-TO-LEFT EMBEDDING
The following text will be right-to-left. This will not change directionality of characters, so Latin letters will stay left-to-right. Full stops, which don't have a directionality on their own, will be left of the sentence. Use this character for some little misplacings that cause big confusion.
U+202c    POP DIRECTIONAL FORMATTING  The following text is formatted like the text before the last U+202a, U+202b, U+202d or U+202e character.
U+202d    LEFT-TO-RIGHT OVERRIDE  The following text will be left-to-right. Additionally, the directionality of characters is changed to left-to-right. Used alone in an English text, this will only affect characters that are right-to-left by default, like Arabic letters.
U+202e    RIGHT-TO-LEFT OVERRIDE  The following text will be right-to-left. Additionally, the directionality of characters is changed to right-to-left. Use this character to completely screw up an English text.

So, as you have spotted, the .exe comes last and indicates to Windows that this is an executable, despite visually looking like an .avi file.


Notepad++ updater had no tittle or info. Is this okay? While updating Notepad++, the updater window showed no title or information. Is this okay from security point of view ?

This is perfectly fine.

When a program opens a window, it sends to it a few parameters including the window title, main text, button labels, etc. In this case, it seems like the updater simply hasn't given any such information. It's silly from a UI point of view, but there are no security implications with this behavior.


Difference between Trust and Federation In the context of Identity and Access Management, is my understanding that Trust is between directory services and Federation is between IdP servers correct?

I have also come across  terms that are specific to each, for example Transitive Trust (but not Transitive Federation) and Federated Service Provider.

To briefly answer your question, in order for a Federated Identity Management to work a trust must exist between SPs and IdPs.

Federated Identity Management separates account management from the service itself. Identity Providers (IdPs) act as the source of identity and account information for a user. That information can then be re-used across all services so that a user only has to remember one account name and password and SPs no longer need to spend time on account management. As I said, the SPs and IdPs have to trust each other for this approach to work. Typically this trust is made explicit by signing policies and contracts that describe the requirements and responsibilities of the IdPs and SPs. An Identity Federation is a collection of IdPs and SPs that have agreed to work together and trust each other.

Next to the trust, policies and contracts there needs to be agreement on how to communicate (identity information) between IdPs and SPs. Almost all Federated Identity Management Systems currently use the SAML2.0 protocol (Security Assertion Markup Language v2.0) to achieve this. An overview of a SAML login flow is shown below.

Note: You should stop using the term Federation as it implies something completely unrelated and can be miss-leading.


How to make sure my HTTP server on Win 7 is secure? I'm hosting a HTTP server from home. I'm concerned about security issues since the machine has some personal files in it.

I have forwarded data from external IP port 80 to my IP at port 80. The website seems to work without adding an inbound exception to port 80 at the Win 7 firewall.

The HTTP server itself is called "Netty" - it comes out of the box with Play framework -applications. I haven't configured it at all.

I'm asking for general practices and pitfalls as how to make sure no attackers can access my computer/personal files, aside from good programming practices?

When I hear this question, my first response is don't. If you are at all concerned about your personal network and your personal data, don't expose any part of it directly to the internet by hosting services.

If you feel you must, here are some steps:

Host the website on an entirely separate machine with nothing else on it
Put that machine on a DMZ (most routers allow you to set up a basic DMZ) so that there's no direct connection from the machine to your internal network
Have backups
Properly configure the router
Further segment with a hardware-based firewall to mitigate pivoting to your network as well as compromised services from sending spam and malware

This is not to deter you from learning but rather to serve as a helpful warning. Furthermore, this does not cover proper permissions on the host, ensuring your code is resilient to attack, and other components of CIA (confidentiality, integrity, and availability).


Does including the username in a password make it less secure? Many registration forms prevent you from choosing a password that includes your username. Is it a reasonable restriction from security standpoint? I can see that if your username is "foobar" and password "foobar1" it's easy to guess, but shouldn't it be allowed if the password is otherwise strong enough?

Is n)_h322">L2=Q2*foobar really less secure than just n)_h322">L2=Q2*?

In a word, no. But that's not what usually happens.

Anything added to a password either makes it more secure, or no change at all. But since appending/prepending your username is so common, it tends to fall in the no change category in many use cases, which makes password strength verification very difficult.

For example:
Username: JonathanParr27
Password: JonathanParr27!

Here, the password is simply the username with a ! appended. The password does contain a capital, lowercase, digit, and punctuation, plus it's 15 characters long. By typical metrics, it should be a good password. But an attacker will try appending numerals or punctuation to the username on brute-force attempts, so now this long, complex password can really just be reduced to username + !, which is quick and easy to guess.

As such, most places with secure password requirements will simply say, nope, if you use your name in your password, it's no good. This both simplifies password strength verification and also puts an end to the silly practice of using your username as the basis for your password.


Is there a way to exploit unused GET POST parameters in web application? So there is an application that accepts some data from the outside. Assuming that it accept only finite number of different POST/GET parameters and the application is correctly handling all the data sent with these parameters, is there a way to exploit an application sending additional parameters.

By this I mean the following: assuming my application accept only one post parameter 'number', is there a way to somehow send other parameters (may be too many parameters, or may be too big parameters) to exploit the application?

The question is not language/server specific.

Under normal circumstances, your application should solely only handle the parameters you expect.  If you use a framework though, there might be additional security problems such as "Mass Assignment" (good -read on Ruby on Rails' -dated- security problem).

But, as in your example, if the application is only accepting "number" as a POST argument, it should not handle anything else.


How to protect your wifi traffic from sniffing if untrusted people know the password? WPA2 PSK is used to encrypt packets to and from a router. All the members on the network have the wifi password, so theoritically if one of them is untrustable they could be able to capture and decrypt packets from my machine.

Is there anything to get around this or eliminate this security vulnerability? I guess the only solution would be to use a VPN? Is there any other solution to add another layer of encryption?

Please note that I need a solution for the home/presonal setting, on a limited budget.

Use WPA2-Enterprise (which uses 802.1X). Not only does every user have their own credentials, but their connections are encrypted with different keys. Note that this requires additional infrastructure; a RADIUS server at a minimum.


Why can passwords be used to encrypt data, but are less strong for authentication? Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible.

Websites use passwords to authenticate users. They in particular store a hash of the user's password. If an attacker gets access to the server, it is difficult but still feasible for the attacker to get the passwords. That's why the hashes are kept secret.

Why is this? Is there a reason that encryption is harder to break than hashes?

The simple answer is that it's not less strong. Encryption that's solely password-based is just as (in)secure as a equivalently-architected password-based authentication system.


Is using haveibeenpwned to validate password strength rational? I have been hearing more and more that the haveibeenpwned password list is a good way to check if a password is strong enough to use or not.

I am confused by this. My understanding is that the haveibeenpwned list comes from accounts which have been compromised, whether because they were stored in plain text, using a weak cipher, or some other reason. This seems to have little to do with password strength to me. There could be very strong passwords that were stored in plain text, and thus compromised, and would really be pretty fine to use as long as they weren't used in combination with the original email/username. The fact that their hashes are known (duh, any particular password's hash is known!) doesn't matter if the place you are storing them is salted. Although it really doesn't hurt to rule out these passwords, as perhaps a hacker would start with this list when brute forcing, and it is easy to choose another one.

But the inverse is where I am concerned - there will always be very easy to crack passwords that aren't on the list. "longishpassword" at this time has not had an account using this password that was hit by a leak. This does not mean however that were a leak of hashes to happen, this password would be safe. It would be very easy to break.

What is the rationale behind checking a password (without an email/username) against the haveibeenpwned list to see if it is worthy to be used? Is this a good use of the list or is it misguided?

edit:

It is way too late to change the scope of the question now, but I just wanted to be clear, this question came from a perspective of checking other people's passwords (for instance when users register on your website, or people in your organisation are given AD accounts) not for validating the strength of a personal password. So any comments saying "just use a password manager" have not been helpful to me.

"Strong" has always had the intention of meaning "not guessable". Length and complexity help to make a password more "not guessable", but a long, complex, but commonly used password is just as weak as Pa$$w0rd.

If a password is in the HIBP list, then attackers know that the password has a higher likelihood of being chosen by people, hence, might be used again. So those lists will be hit first.

So, if your password is on the list, then it is "guessable".

If your password is not on the list, then from a dictionary attack approach, it is less guessable and not what others have chosen, and by implication (for as much as that's worth), is "less guessable". Many other factors, of course, can make your password "more guessable", even if it is not on the HIBP list.

As always, a randomly generated password is the most "unguessable" and a maximum length and randomly generated password is extremely difficult to bruteforce. And if you are randomly generating it, then why not go max length?


Testing a hardware random number generator The Raspberry Pi has a built in hardware random number generator but there doesn't appear to be any public documentation on the hardware, and even if there were it would be questionable (what company is going to publically admit that there might be problems with their own hardware if they can get away with it?).

So the question, what is the best method of testing a hardware random number generator? If I filled a 10GB file with random numbers generated with the hardware random number generator are there any tools on my main computer I can use to see if there are any patterns in the numbers produced?

I find it hard to believe that there is no third party way to verify whether a random number generator (be it software or hardware) is safe to use. Otherwise why would anyone ever trust a random number generator that wasn't open source and that couldn't be independently audited?

I'd like to use the Raspberry Pi to generate some private keys but the normal software random number generator doesn't get enough entropy to make it viable (takes ages to generate) but with the hardware random number generator it is much more viable. I just don't know if I can trust the hardware random number generator or not.

There are several factors at play here:

The physical HRNG mechanism used inside the ARM microprocessor.
The supporting logic on the silicon inside the microprocessor.
The microcode deployed on the microprocessor.
The implementation of the RNG inside Linux.

According to the manufacturer, that particular chip uses noise from a reverse bias transistor, in an open-collector HRNG design. This is precisely the hardware I'm using in my current HRNG project, but much smaller. It's one of the cheapest ways to implement a HRNG directly into silicon; whereas I'm using discrete transistors, the ARM processor simply shrinks this to a few blips of silicon on the chip die.

We know that this mechanism is a strong source of randomness, because it relies upon a phenomenon called quantum tunnelling, which is known to be probabilistic and random. The basic idea is that electrons will randomly "jump" over the band gap inside the transistor, leading to a randomly fluctuating signal. We can then amplify this (simple PNP transistor amplifier will do) and interpret the output as either a 1 or a 0 by sampling the result at a fixed frequency - if it exceeds a certain threshold it's a 1, otherwise it's a 0.

One slight deficciency of this mechanism is that any DC leakage will lead to a skew towards 1s appearing more often than 0s. In order to get around this, we can use a simple trick called von Neumann decorrelation, which essentially involves encoding bit pairs 01 and 10 to 0 and 1 respectively, and ignoring all 00 and 11 pairs. This produces a statistically unbiased stream.

I can almost certainly guarantee that this is the mechanism by which it produces random numbers. There's one major alternative (two reverse biased NOT gates in parallel) but it's covered by an Intel patent, so I doubt ARM is using that. Unfortunately, the only way to know for certain is to grab some acid and decap a chip, then take a microscope and start reverse engineering the silicon. I don't happen to have the spare gear available for this.

The potential vulnerability that you might find in such exploration is that high frequency clock signals or other HF data lines are routed very close to the HRNG or its supporting logic, leading to a potential for interference. This is usually unlikely in ICs, but we're talking about high sensitivity applications here, so it's worth looking for. Even if it were the case, though, I don't see it providing a useful skew from a cryptanalytic perspective.

The next potential for exploitation is microcode. Recently, a researcher demonstrated that it was possible to patch microcode for Intel processors to look for unique patterns in the instruction buffer and detect when the RDRAND instruction was being used to fill the /dev/random pool. It would then identify the position of that pool buffer in the processor cache and effectively zero it, causing the zero pool to be copied back into system memory. This meant that /dev/random would constantly output the same attacker-controlled value, with obviously devastating results. If a similar but more subtle trick was employed in the ARM microcode, it might be possible to massively reduce the entropy of the HRNG in a way that is only known to the creator of the patch. Detecting such tricks would be difficult, but it could be done by extracting the microcode and analysing it.

Finally, the last problem is the RNG design inside the Linux kernel. The /dev/random pool is usually fed from a bunch of state-based sources, using a mixing algorithm that is built upon a cryptographic function. However, when RDRAND or similar instructions are available, the engine simply xors the data over the pool. This isn't exactly a good idea, because it makes it easy to screw with the pool data in a meaningful way by producing certain values. If the stronger mixing function were used, the attacker would need to break that (or do something more conspicuous) in order to gain meaningful control over the pool.

There is not an obvious answer to your question. Hardware random number generators can be very high quality, but it's difficult to analyse their implementation given only a consumer device. That being said, if you're going to distrust your hardware, you can't really make any guarantees in the first place. If you want to limit the scope of distrust entirely to the quality of random numbers produced, then design your supporting system around that fact.


Impersonating Client Certificate Authentication with Same Subject Name I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is white listed. Also it verifies that the cert is valid (cert chain validation).

But if an attacker gets a certificate with the same subject name that is issued by some certificate authority, they can attack our service, right? This seems less secure to me. Server SSL certificates are secure because users are reaching to a domain explicitly and the SSL cert the server uses contains the domain name validated by a cert authority. Unless the server certificate and some how the domain the user is trying to reach is compromised, the server is secure and client can trust the server.

But trusting a client seems less secure to me. Is my understanding right or am I missing something?

Good question. With C# and .NET it is hard to limit a number of trusted root CAs via X509Chain class you will use to validate chains. This class doesn't offer such functionality (although, underlying CertCreateCertificateChainEngine native function allows this via CERT_CHAIN_ENGINE_CONFIG.hRestrictedRoot, bit it is long story).

In Active Directory, for example, this question is solved by introducing an NTAuthCertificates record under CN=Public Key Services, CN=Services, CN=Configuration, {ConfigurationNamingContext} which stores CA certificates (direct issuers) which are allowed to issue smart card logon and client authentication certificates. Domain controller during smart card logon performs general path building and validation, then gets issuer (from validated chain) and checks if it is listed in NTAuthCertificates. If everything is ok, then certificate logon continues, otherwise, it fails.

I would suggest to go same way. Maintain a collection of CAs (again, direct issuers, not roots) which are approved by your policy to issue authentication certificates. You can store whole certificates, their thumbprints, public keys or whatever that helps you to strongly identify them.


Where can I find all SSL CA certificates I am working on an SSL implementation project and ofcourse I need to verify the certificate presented by the server. To do that I need CA certificates or at least root CA certificates (correct me I am wrong) but I cant seem to find any source which can give me certificate database. Where can I find all these certificates, preferably from single source? I know I can get certificates from all CAs separately but I am not comfortable with that method as it would make update process a mess.
The closest thing that I could find was this file from mozilla http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt. Is this the right source for certificate database and if it is, how frequently this gets updated.

It seems there is no single source to get all the keys. But looking at your requirements, starting with a credible browser's certificate database could be a good way to approach. The link you mentioned seems to be a good source. This perl script can download the certificates from the site and converts them from txt to PEM format.


Building a "Hello, world!" X.509-based system for establishing trust between servers I want to build a distributed software system with the following elements:

A number of workers, which manage potentially sensitive data and execute code on behalf of a number of clients.
A number of clients, which can send commands to the workers.
A central trust authority, which grants the right to execute actions on a given worker to a client.

In a typical operation, the client would contact the trust authority and request the authorization to execute an operation on a worker. The trust authority would authenticate the client and -if it succeeds- grant the authorization. The client would then connect to the worker server and issue the requested command, presenting the authorization that was obtained before. The worker server would be able check the validity of the authorization for the requested operation and -if it succeeds- perform it.

X.509 seems like a natural fit for this kind of problem, and the simplest solution I came up with looks like this:

The trust authority uses a X.509 certificate to hand out authorizations to clients, signing them with the private key of the certificate.
The client transmits the signed authorization from the trust authority to the worker server.
The worker server downloads the public certificate from the trust authority's server and uses its public key to validate the authorization provided by the client.

To implement this, I would provide a HTTPS-based REST API on the trust authority server. Using this API, the worker server could download the public key certificate and locally validate it against a higher-level certificate (if it was signed by a CA). Using the public key obtained in this way the worker could then validate an authorization received from a client.

To obtain an authorization, a client could use another API endpoint on the trust authority, to which it provides all relevant details of the given command and worker server. The trust server would then respond with a signed authorization that the client can pass on to the worker server.

(in all of the steps above I assume that the communication between all parties can be secured and validated using some form of TLS)

My question regarding this setup is threefold:

Is this a reasonable approach? If not, what would be?
Against which possible attack scenarios would this scheme be vulnerable?
Are there any open-source reference implementations of such a system?

x509 is a file format not an application architecture.

It's far from clear what you are asking or intending to actually build here. A HTTPS webservice using client certificates is not exactly innovative nor even esoteric. Certainly if you are expecting to build your own cryptographic capabilties I would strongly recommend you to think again - these are available off the shelf but are extremely difficult even for experts to implement correctly.

Most open-source software is components rather then complete distributed infrastructure patterns.

Assuming that you just want a HTTPS webservice using client certificates, then the server part would take around an hour or so to set up using (for example) Apache, mod_ssl and a suitable logic tier. What consistutes a suitable logic tier depends on where you want to implement authentication and authorization. If this is done in Apache (with SSLOptions +SrdEnvVars), then any old scripting language will do (indeed you could even use stunnel or stud in front of a generic webserver rather than mod_ssl inside Apache).

For testing - stunnel or stud provide an easy way to wrap connections using TLS and client certs (assuming you don't want to just use a browser)

In terms of generating a "signed authorization", again this is simple - but is there a reason for implementing a secondary authorization mechanism on top of the facilities available within TLS/x509? If you can reliably authenticate the client and the trust authority, then either embed the authorization in the client cert or just provide mappings of identity to authorizatoins to the agents from the trust authority.


Need help understand ARP spoofing attack? I am currently reading the network exploitation section of the book Hacking: The art of exploitation. The book covers ARP spoofing attack in brief, but doesn't go over much detail.
Before starting I would like to tell what kind of system/peripherals I would be using.

I use a System that accesses internet via Ethernet Cable. i.e. I don't have a router, due to which I directly connect the ethernet cable to my pc (PPPOE)
That cable goes to the electric pole, where it is connected to a switch. That switch also acts as an endpoint for other users like me as well
A lot of these switches are interconnected with one another

I do have a fundamental understanding of the attack (rectify if wrong), which in brief goes as follows:-

Run ARP protocol to get MAC addresses of all the live hosts in the local network

Poison the ARP cache of hosts by sending them ARP responses (on regular interval) stating that the IP address of another system is at our mac address

This will make them send packets which would have our MAC address in the Data-Link layer, and would reach us

I have many doubts (some regarding the above process, others are conceptual)!!

In order to execute the attack we needs to have IP address of other local hosts. Which I just can't seem to have.

I ran a Windows machine and tried using Advanced IP scanner, but ended up getting IP addresses associated to my pc (VM, Ethernet, Default Gateway).
Tried arp -a command, ended up getting a huge list of IP addresses of which 99% were static, few were dynamic. Some of them had MAC address entries, on others which was blank.

So, How am I supposed to get the IP addresses of other hosts?

The book mentions default gateways as a target. So what exactly is a default gateways (for my setup), And how does it work?

Since we can poison the ARP cache to add entries to it, Is it (asking from a security perspective) possible to create entries to addresses that aren't local!! For Example. Let's say we have the IP address of 192.168.1.12 having mac 00:00:00:01, and a Facebook server has IP address 10.0.0.23. Is it possible to send a ARP response i.e. it will poison the ARP cache of a local user to make it seem like the address 10.0.0.23 is at mac address 00:00:00:01. Then would the packet sent over to the Facebook IP be delivered over to us? Or would it be filtered by the router?

What is the address of the first node (to me) where my data is sent over to? Like for most users it would be their router (at a basic level), but since I don't use one, what would be the first node through which my data goes?

P.S.:- Initially I posted this question on network engineering, but it got closed over there as they thought I am trying to hack a network. Firstly, I am using the above test in a controlled environment. Secondly, the questions are related to a lot more to securing stuff then to exploiting them. All I am trying to do is get a understanding about the underlying protocols.

In order to execute the attack we needs to have IP address of other local hosts. Which I just can't seem to have.

As you're using PPPoE, most likely you don't actually connect to the same L2 Ethernet as other customers. The switch is configured to isolate customer Ethernet ports so that they can only talk to the PPPoE server (which might indeed be the switch itself, or something further away). This is a common feature within Ethernet switches, and is something I would definitely expect an ISP to do on their customer-facing ports.
Once you establish the PPPoE connection, it only gives you a layer-3 tunnel – it doesn't carry Ethernet layer-2 headers and there is no ARP inside a PPP tunnel, because there's only one way a packet could go ("the other end of the tunnel") so the L2 addressing would be redundant. You cannot perform ARP poisoning on networks which do not use ARP.
(This also means that the PPP tunnel doesn't really have a subnet as such, and its "subnet mask" might not reflect the addresses of nearby customers at all, and might confuse IP scanners which expect the network to be a contiguous /24 or similar, while it's more like a collection of arbitrary /32's in reality.)
Generally the same applies to most VPN tunnels as well. Ethernet-like L2 VPNs do exist, but aren't the standard choice.

The book mentions default gateways as a target. So what exactly is a default gateways (for my setup), And how does it work?

"Default gateway" is shorthand for the gateway (i.e. router) that's specified in the "default route", which is the 0.0.0.0/0 route (or the ::/0 one for IPv6).
PPPoE is relevant here as well. Because L3 tunnels don't use L2 addressing or ARP, routes over L3 tunnels actually don't need a gateway address – it wouldn't make any difference to the packet headers.
So it's quite possible that your default route via PPPoE has no "default gateway".

Since we can poison the ARP cache to add entries to it, Is it (asking from a security perspective) possible to create entries to addresses that aren't local!! For Example. Let's say we have the IP address of 192.168.1.12 having mac 00:00:00:01, and a Facebook server has IP address 10.0.0.23. Is it possible to send a ARP response i.e. it will poison the ARP cache of a local user to make it seem like the address 10.0.0.23 is at mac address 00:00:00:01. Then would the packet sent over to the Facebook IP be delivered over to us? Or would it be filtered by the router?

It wouldn't even get to that point.
The ARP cache is consulted only if the routing table says it should be consulted. A host or a router won't bother looking ARP for addresses if it already knows that those addresses are non-local.
For example, if your routing table was like this (a very typical home Ethernet host),
192.168.1.0/24 dev eth0
0.0.0.0/0 via 192.168.1.1 dev eth0

then the host would know that only 192.168.1.0/24 is local and should be ARP'd (because it's a device-only route), and it would know that everything else is non-local. When the matching route has a "gateway" specified, that directly implies that the destination is non-local and so the only ARP query is made for the gateway, not for the actual destination.
(The only situation where this would work is if the network was configured with Proxy-ARP in mind, where the default route also has no "gateway" address (but it's still a regular Ethernet and so ARP is still in use, unlike in the PPPoE case). This would indeed make every host directly make ARP queries for any destination, with the gateway answering on their behalf. Such LANs have existed in the past, though I can't imagine them being common nowadays – they were used to achieve router failover, something which VRRP handles much better now.)

What is the address of the first node (to me) where my data is sent over to? Like for most users it would be their router (at a basic level), but since I don't use one, what would be the first node through which my data goes?

In terms of IP (layer 3) nodes, in your case that would be the ISP's system which handles the other end of the PPPoE tunnel. You might be able to see its IP address from traceroute or tracert results.
(Again, it's PPPoE that makes you seem to get different results than the rest. If it weren't in use, you would just have a normal default route, and the first node would simply be the ISP's router whose address shows up in your routing table.)
Still, in any case, the next node for an IP packet (if it's not the final destination) will be a router. If it's not your router, then it will be the ISP's router.


How to tell if a "PGP PRIVATE KEY BLOCK" is passphrase protected? I've used gpg4win's Kleopatra tool to create an OpenPGP RSA personal certificate. I want to export the private key for several reasons (import it on another machine, as well as backing it up in Keepass), so I right-clicked the certificate and chose "Export Secret Keys..." and chose to "ASCII armor" it.

If I open up the file in Notepad I see this kind of thing:

-----BEGIN PGP PRIVATE KEY BLOCK-----

asdfhoewiqifEFJUIONsedfiOEJhioEFh8903FSED.....etc.
etc.
etc.
etc.
-----END PGP PRIVATE KEY BLOCK-----

How can I tell (or alternatively: know) if this is passphrase-protected?

Is this passphrase-protected? There's a high probability it is!

  How can I know if this is passphrase-protected?

Simply enough: import the exported key and try to use it; if it was originally created with a passphrase, it will be exported with the passphrase. You need to know it after the import, too.

It is possible to create a passphrase-less key pair, but after confirming this three times and then finally re-entering the empty passphrase you should already be pretty aware that this isn't smart:

  How can I tell if this is passphrase-protected?

You can also analyze the key with gpg --list-packets --verbose private-exported.asc.

On a password protected key you'll see something like this:

    pkey[1]: 010001
    iter+salt S2K, algo: 3, SHA1 protection, hash: 2, salt: 85B065E6EAFE95F6
    protect count: 2752512 (181)
    protect IV:  e6 47 c1 03 96 b1 5c e8
    skey[2]: [v4 protected]
    keyid: F5798EF2ECAC2051

While the unprotected key reveals all the keys like this:

    pkey[0]: BC1A19AD1A1AC852F7A5E....
    pkey[1]: 010001
    skey[2]: 02CA55EDF940900EFFD2A....
    skey[3]: D477DA74DF0DCD8E991AA....
    skey[4]: E2A43778C36FEE7E27903....
    skey[5]: E0CC81786737F2838A7FE....


non-rfc1918 address appeared on router dashboard Quick context: Home network, performing some DPI on my perimeter router (Ubiquiti EdgeRouter Lite) that governs 2 internal subnets separating my traffic from a bunch of roommate devices. No IDS on the network yet, so I don't have many logs to investigate.

I noticed an IP outside of the private range via DPI dashboard. I have pretty strict firewall rules and haven't seen outside IPs before. The address responds to pings and has a few services up/filtered, but no whois information or nslookup can be found. Visiting this IP's HTTP server lands me at a page displaying "Monitoring Page - sorry-hostname-not-available.imrworldwide.com". From https://www.findip-address.com/ it appears to be a local business? The IP address disappeared from my dashboard shortly after I looked around, which leads me back to thinking ubiquiti is just buggy. No additional mac addresses show up on my switch that all internal traffic flows through.
As I was looking into this, I noticed the Ubiquiti AP on my less-trusted "roommate" network received 67kB from "DNS" (this is also something I've never seen before). Why would this AP be receiving DNS responses and transmitting 0kB?

All-in-all I'm just a little confused. Should I be concerned about this? Is this just Ubiquiti being buggy and doing weird things? Regardless, I'm implementing an IDS and making a tin-foil hat tonight :)

The IP itself is 138.108.50.100.

The IP you provided is owned by A.C. Nielsen, which is most famous for providing television ratings based on sampling by recording devices.  They've since branched out into many other forms of market research.  The most likely reason you're seeing it is that some device on your network or some page you browsed to triggered activity data to be sent to them.

I would consider this activity innocuous - albeit, if you're the kind of person who is performing deep packet inspection on their segregated-from-the-roommates LAN, no activity is innocuous.  But it's Marketing spying on you, not Government or Hackers.


Pre-Requisites for Mutual Authentication For Mutual Authentication, the client must contain the CA certificate of the Server and his own Certificates, and the server must contain the CA certificate of the Client and his own Certificates.In this way , the Server may contain multiple CA-Certificates for different clients ?
Is this correct ? In this way Server may be loaded with various Client Certificates ?
Can anyone please mention few of the applications which use Mutual Authentication.

The server will indeed have and announce to the client (during SSL handshake) a list of trusted client CA, and the client will have to provide a client certificate signed by a CA on that list.

you said: In this way Server may be loaded with various Client Certificates?
I guess you meant "Client CA". The server wouldn't be pre-loaded with the actual client cert, unless it's a self-signed (root) cert.

At work, I see SSLMA used between technical components that need to be talking to each other for security-sensitive functionality. E.g. webapp1 -> webservice2, if webservice2 is doing something that you don't want to expose to everyone in the network. Webapp1 may have authenticated and authorized the end-user; but if webservice2 isn't set up to authenticate/authorize the end-users, it may suffice to have webservice2 accept a limited number of SSLMA clients; including webapp1.

On the internet, I haven't seen that much use of SSLMA (from browser to website), but there are cases, e.g. to log on to some government or banking websites. Typically, the client cert is then installed on a smartcard. I can think of only a few examples in Belgian context, not sure if that would help you.


Decrypting SAM hive after Windows 10 anniversary update? After a lot of frustration I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash.

In particular, samdump2 decrypted the SAM hive into a list of users with "blank" passwords:

samdump2 system sam -o out

I.e., admin:1001:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Conversely, mimikatz succeeded in outputting the proper NTLM hash:

mimikatz # lsadump::sam /system:C:\system /sam:C:\sam

I.e.,

RID  : 000003e9 (1001)
User : admin
  Hash NTLM: f1320e0960da374b88e40cffbec44885

The problem with mimikatz is that AVs flag it as malware the moment it gets download.

Are there other tools available on Kali that may decrypt the SAM file properly after Windows 10 anniversary update?

Why not just resetting the password? This is much easier and the process could be done in less than 5 minutes.

For password recovery, Ophcrack seems more effective than mimikatz.

Credit: A list of the top 10 free password recovery tool for Windows


Why does an nmap -sT scan show ports filtered but -sS shows ports closed What are possible reasons why an nmap -sT scan would show "ports filtered" but an identical nmap -sS scan shows "ports closed"? I understand that -sT is a full TCP Connect, which is easier to detect (and to filter) than the -sS half open scan. But why?

Both types of scans send a SYN packet; both types of scans should expect back a SYN|ACK or a RST. The only difference that I see is that the half open scan will send a RST instead of finishing the connection handshake.

Also, I ran the command nmap -sT -P0 which tells nmap not to send a ping first (I think it typically does both a TCP ping and an ICMP ping). Doing that command causes it to respond with "ports closed" which is identical to the -sS scan response. Is that because -sT is normally being blocked due to pinging first?

That's my assumption, but I want some more experienced opinions about what I am seeing and what types of scans I can do to investigate further. Btw, I am of course allowed to be doing these scans (class work).

If you saved Nmap's XML output, there is an attribute of the <state> tag called reason, which will give you the reason Nmap chose to label a port closed, open, or filtered. This is usually something like "reset", "conn-refused", "syn-ack", or "port-unreach", depending on the kind of scan and the state of the port. This information can also be viewed in "normal" output by using the --reason flag or setting -d for debugging.

A common misconception is that the SYN scan (-sS) is "more stealthy" than the TCP Connect scan (-sT). At one time, and from one point of view, this was true: that is, from the perspective of the application running on the host. Back in the day, before IDS and stateful firewalls, your best indication of a port scan was application logs showing connections that were opened and immediately closed. The SYN scan, because it tears down the connection before it leaves the kernel, never crosses into the application, so these logs are not written. From the point of view of the network, however, the behavior of a half-open SYN scan (SYN, SYN-ACK, RST) is quite unusual, and can be a significant indicator of a port scan, even if only one, open port is scanned. In this case (scanning a small number of ports likely to be open, protected by IDS), the TCP Connect scan may actually be "stealthier."

-Pn (formerly known as -P0 and -PN) instructs Nmap to skip the host discovery phase, and instead assume that all hosts are up. The details of host discovery are well-documented, but it is possible that this behavior is triggering an adaptive firewall on the host. Adaptive firewalls can be tricky, since you get a variety of responses depending on your behavior and the speed of the scan. I would recommend slowing the scan with any of the timing options and reducing the number of ports scanned to a handful, until you get consistent results.


OAuth in open-source plugin I'm designing an API server and client pair. Typically, I want the client to be in a WordPress plugin. I'd like to use OAuth or something similar to secure the requests. However, as you know, OAuth depends on secrecy of the client credentials and especially the client's secret. However, WordPress is open-source, so I cannot store the client's credentials in the code.

So, my general question: what are the options to secure such a system, in which you can't store the client's credentials because the client's code is open-source?

So typically is is exactly the sort of problem that OAuth was designed to avoid, not create.

You, as a resource provider, have created a system that you have decided to protect with OAuth, and a WordPress plugin that acts as a client to your system.

Bob, who has a WordPress site and who would like to use your system, installs the plugin into his WordPress site.  Then, Bob visits your system, informs it that he would like to use it and requests access.   The system then gives him a new, unique client secret.   He adds the client secret to the plugin configuration on his site, and he can now connect to your service using credentials that are unique to him.

This way, every site that has installed the plugin is uniquely identifiable, and the client secret need never be known to anyone other than the single WordPress site that owns it.


What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files? As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA.

Loading my CA certificates into FireFox in PEM format is relatively easy.
Creating an HTTPS server in Go using my Server certificates is also (relatively) easy.

However my ultimate goal is to use double ended TLS where both the client and server authenticate each other.

To do this I must load my client certificate/key and my CA's public certificate/key into my browser.

Unfortunately FireFox and Chromium will not load PEM formated client certificates. They will only load client certificate/key bundles in the
PKCS#12 format.

Each time I tried, FireFox (v73 on XUbuntu 19:10) refused to load my PKCS#12 by saying that there was a (general) format problem.

I know that my PKCS#12 file is formatted correctly since I am able to use the openssl pkcs12 -info command to correctly read the contents of my PKCS#12 file.

Both FireFox and Chromium use libnss3 to manage their x509 certificates. After many searches I finally noticed discussion on the web about how to use the certutil and pk12util libnss3-tools to interact with FireFox's cert9.db certificate database.

Using these two tools to try and load my PKCS#12 file I stumbled upon the "SEC_ERROR_REUSED_ISSUER_AND_SERIAL" error. The pk12util command provided the additional (helpful) message:

You are attempting to import a cert with the same issuer/serial as an
existing cert, but that is not the same cert.

So: What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?

Here is the answer that I stumbled upon... there might be other answers, or work-arounds... if so, it would be good to collect them here.

After some struggle, I finally realized that the two certificates that pk12util was referring to were my client and my CA certificates (as bundled in the same PKCS#12 file). Both were signed by the same issuer (my CA) and both had been accidentally been given the same serial number in my Certificate Requests.

One of my problems while trying to understand this problem, has always been the fact that I could not find any "duplicate" certificates in the FireFox certificate database (either through the FireFox browser or using the certutil tool). Of course, in hindsight, the reason was simple, the two (conflicting) certificates had not yet been loaded into the certificate database, but were instead in my PKCS#12 file.

  After recreating my CA, Server and Client certificates carefully
  making sure that each had a different serial number, I was able to
  load my PKCS#12 file, and more importantly I was able to have my
  client (browser) and (Go) server authenticate each other.

A complete working example of a Go based Certificate Authority with certificate creation as well as mutually authenticating client/server applications can be found on GitHub diSimplex / ConTeXtNursery.

I hope this question/answer helps others who have this same sort of problem.


Securing REST API without sending or storing clear credentials We are currently designing a REST API, and thinking about securing it.
Going through a lot of documentation, it has become clear that 2 options are available.

HMAC Authentication

By hashing with HMAC-sha1 a series of predefined elements with the secret_key, we sign the request. The verification is done by doing the exact same process server side and comparing the resulting hashes.

Our implementation goes like this:

Getting current timestamp
Creating HMAC: hmac(full_url + request_body + timestamp + secret_key + token)
Sending the signature as it: clientId + hmac_signature + timestamp + token

The main advantage of this, is that the secret_key is never transmitted in the request, which prevents replay attacks mostly. But as a drawback we have to store the client credentials (secret_key) in a raw format in our database. And if our database gets compromised we might as well revoke all current API clients credentials.

HTTPS Authentication

Using SSL over our API will allow us to create a secure channel to exchange private information.
We basically send the same information without hashing it with HMAC.

Our design is going to be exactly like (or very similar to) the OAuth2 specification.

Comparing to HMAC this has many advantages as we delegate most of the job to SSL. And clients do not have to include a library for hashing like with HMAC. Finally our database is safe since client's secret_key will be securely stored.

But if someone successfully sniffs out one request, he could steal the secret_key and start to create his own requests.

Is there a way to use the advantages of HTTPS without sending clear credentials and without having to store clear credentials?

One of our alternative designs was using private/public key generated client side, and use it to exchange a key to encrypt secret_key for future requests. But not many browsers have this capability (<keygen>) and it is quite an annoyance for mobile applications.

As pointed out in the comments, ssl/tls will protect your credentials in transit.  Encrypting traffic is part of the purpose of the protocol.  The other major purpose of the protocol:  verifying that you are communicating directly with the party you think you are communicating with.

The OP said that ssl proxies are possible and has seen it in action for mobile applications.
It is true that ssl man-in-the-middle proxies exist, but the client will warn that the server it is talking to has failed to present a valid certificate (and if the client is a browser, not proceed).

If your Rest API is configured to ignore bad SSL certificates (and some are - i know, I've written one), then, yes, a ssl MITM proxy would indeed be able to sniff your credentials.  This is purposely subverting the SSL/TLS protocol (you can't say you are using SSL/TLS in this case).
This is why "self-signed" certificates are only for development and testing purposes.


Adding hash value to user supplied URL in a web application: any security benefit? We administer a Java web application from an external supplier where we have access to the source code.

The user is able to provide an external URL which is stored in a database and later on embedded in a website generated by the web application. Only stuff members can supply URLs. The URL is properly escaped and embedded into the web page as a call to a redirect servlet together with three parameters:

external URL
timestamp of the database entry
hash code

The hash is calculated from the URL, the timestamp, and a server secret. The server secret is a GUID calculated at startup.

The redirect servlet recalculates the hash and throws an error if it doesn't match the embedded hash.

The disadvantage is that on each server restart the server secret changes and any hash will be invalid. The problem arises with search bots like Google or Yahoo which queues crawled URLs accross server restarts. Hence after restarting the server the error log is flooded with messages of invalid external URLs.

My questions:

Is this a common pattern in web applications?
What are the security benefits of the hash?
Is it "safe" to calculate the hash without the server secret?
Are there any security patterns which provide the same security benefit but which are not susceptible against server restarts?

Thank you

The scheme you describe is commonly used to ensure that a link is current, so if someone's changed the content, no other references to it will continue to work.  Generating a new GUID upon reboot guards against someone making database changes while the server is down, ensuring old links are invalidated.

This scheme has almost nothing to do with security, and everything to do with data integrity.  While related, these are not the same qualities.

So now ask yourself "Why do we need the hash? What are we trying to protect against?"  If it's not ensuring your users always have absolutely correct and current data, you don't need the hash.  If you think you do, and can somehow trust that your database won't be modified if the server is brought offline, then you could eliminate the server GUID so the URLs would survive reboots (this is where the minor security issue comes from, in case an attacker can bring your server down and change the data while it's offline.)

If you're seeing a lot of entries in your logs due to server reboots, maybe you need to determine why the server is rebooting so often that it's presenting an issue to your users.  Or maybe it's not reboots that are the problem, and your data is changing much more frequently than you expect.  Or maybe your users are letting their sessions time out, and trying to reuse stale data more often than you think.  Make sure your user sessions are timing out appropriately for the rate of change of your data.


PCI compliance when using credit card details on behalf of another person My client emailed herself her credit card details and she has given me access to her email by sharing the username and password. She wants me purchase plane tickets, items, on her behalf using her card. I will not be storing any of her details on my system. I will also not charge her card for my companies' services at all. Does my company still need to be PCI compliant with this setup?

Here are the PCI-related services your are providing to this client:

You have access to a third-party's card number.
You are initiating transactions on behalf of the client.

Based on the PCI SSC's definition of a service provider, you might be consider to be acting as a service provider for this client:

  [A service provider is a] business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data.

Your company needs to decide if it wants to assume the risk of acting as a service provider for this client. As stated in the comments there may be other ways you can perform the requested services without having to have the client's card number.


Can SSL using Blowfish cipher be considered strong enough? I use OpenVPN to connect to a public VPN. Sometimes I connect from my college campus (it's fully open to alumni) and when this happens I can only use TCP SSL because the college network has a security theater firewall that blocks everything except HTTP, TCP SSL and WhatsApp. My VPN provider only supports Blowfish cipher for TCP SSL connections; if I want to use AES-256, I have to use an UDP connection. Wikipedia's entry on the Blowfish cipher says it can be considered secure and this other question mentions that any cipher more advanced than DES can be considered as "good enough", but the Wikipedia article mentions that there is a class of weak keys that are vulnerable to attacks.

Will I still be functionally secure (as in, it will take an awful lot of resources to eavesdrop my communications) if I use Blowfish instead of AES-256?

Blowfish is secure enough for TLS/SSL but AES is preferred. Especially 256, because 128 is still considered unbreakable and 256 is even more secure.


If I port scan a server on the outside of a firewall will this also tell me the ports the firewall is blocking? Theoretically I was thinking a firewall inspects the TCP header and looks at the destination port and discards/forwards based on its firewall rules.

So could I port scan an external server to the firewall and see what ports are returned?

I'm on a network where FTP, PPTP, and other stuff is blocked.  I just want to know what ports are open on the firewall and available to me.

Am I on the right track or is there more to it?

You have to make sure that the external server answers on every port, which is quite unusual. But if that is the case you are on the right track.


RDRAND in Intel Celeron CPUs under Linux Is there any reason to believe that the hardware RNG in an Intel Celeron CPU is more unreliable than in other CPUs?
Can someone confirm that what Linus Torvalds says is true, namely that Linux does not rely fully on the hardware RNG in the CPU, in particular in an Intel CPU?

Finally, to make it concrete for my particular use case:

Can I always trust the random bytes provided by OpenSSL's RAND_bytes when run on Debian or Ubuntu Linux, even if run on an Intel Celeron CPU?

The reason people are concerned about the RDRAND instruction is that it is a proprietary hardware random generator and has never been formally analyzed.  Without that analysis, there's no way to tell if it's a genuine hardware random number generator or, for example, a simple counter being passed through a cryptographic hash.  In the latter case, the output will look random, but someone who knows the starting point of the counter knows exactly what numbers will be generated.

Anyone can look at the Linux source code for /dev/random and confirm that the kernel is mixing RDRAND output into its entropy pool in a way that doesn't reduce the amount of randomness available, even if RDRAND is hopelessly biased.

Whether you can trust RAND_bytes or not is a judgement call you'll have to make for yourself, but what I can say is that running it on a Celeron with RDRAND is no worse than running it anywhere else.


Deliberate Vulnerable Openstack images for penetration testing/training or research I was just wondering if there are already deliberate vulnerable Openstack images for penetration testing/training or research. Something in line with OWASP's DVWA e.t.c....there quite a lot out there for web applications especially.  I am doing a research and will be very glad if someone already has something like that or possibly direct me to the right place. The similar projects as mentioned here differ from what I am seeking for. While most of the existing solutions focus on linux distributions and web applications,  OpenStack composes of several cloud services which could have several types of vulnerabilities. Moreover, OpenStack could be installed standalone via ironic.  Many thanks !!

After searching across the internet, it seems there are really no "ready made" vulnerable OpenStack images similar to web applications like OWASP DVWA. However, I think a starting point is to install old OpenStack releases  and also install some vulnerable software on it. I have found icehouse easy install here. I will like to start working on this...any one interested in this topic is welcome.


how to deal with with authentication tokens in the client browser and in my database? I am building an asp .net mvc project and I want to save the user who is currently logged in , So I read about sessions and cookies and I found that authentication tokens stored in a cookies are a solution for the problem, So I read about them and I need to know If I am understanding this before implementing anything here What I get until now :

After the user logs in, I generate an authentication token (using a GUID generating method)
The generated authentication token is stored in a cookie in the client browser for .....(I don't know for how long would sound acceptable if someone can plot this thing out for me)
The generated authentication token is stored in my database (hashed for further security using SHA256 hashing method) and corresponding to it the account id of the user and its account type (user or admin)
I check the cookie first thing to know where the user will go to the user or the admin or even to log in page
If the user logs out or the cookie expired and then logs in again , I generate a different token and don't use the stored one in the database (Not sure about this one)

I would really appreciate it if someone tells me if I am missing something or I am doing something wrong ?

I would not allow persistent admin logins with cookies because the administrator could browse a site with malicious javascript and get his cookies stolen.  I would force a password check at each new admin login. The cookie could obviously maintain the session once he has authenticated but the method outlined above looks to be insecure.


End to end encryption for files I need to develop a system where a user can upload a file via browser which encrypts the file and stores it on my server. After the file is uploaded other user can download the file with an iOS or android app and decrypt it to view it.
The problem is I shouldn't be able to decrypt the file on my server, because the files are potentially very sensitive.
Now, I don't have any real knowledge about encryption and don't know where to start.
Do you have any hint what is best practice for this kind of end to end encryption?

I have come up with an idea of how my security scheme should look like.

The CMS client logs in and his password is used from now on as upload key (later used)
On the CMS side, later app user (potential file receiver) are created, with a login password (for the app) and a download key (later used) to decrypt the downloaded files.
The CMS client sends the app users their login password and download key in separate mail (no email)
The CMS client uploads a file which gets encrypted with a random key (later used) in the browser and stored on server 1. The random key and the reference to the file are getting encrypted with the upload key and stored on server 2.
The CMS client selects app user (one ore more) to view the uploaded files. In this moment, the random key and the file reference (from the 3. step) are getting decrypted with the upload key. This decrypted package gets duplicated and encrypted with the download key of the selected app user (this step is done for every selected app user, therefor we will have multiple packages for every app user)

Is this approach close or am I heading in the wrong direction?

I need to develop a system where a user can upload a file via browser
  which encrypts the file and stores it on my server. After the file is
  uploaded other user can download the file with an iOS or android app
  and decrypt it to view it. The problem is I shouldn't be able to
  decrypt the file on my server, because the files are potentially very
  sensitive.

People do this frequently with cloud storage systems like Dropbox: encrypt a file, store it on the host, then decrypt it elsewhere.  You can re-use any common, well-tested encryption system (GPG, TrueCrypt, etc.), and to the host it's just an encrypted blob.

If you provide this as a product, you should re-use existing file encryption software, and re-use existing cloud storage systems (S3, for instance, is quite cheap and provides excellent availability and durability guarantees); the only bit you have to do yourself is the UX on top of them.


How to know if firmware is stealing my information? The recent news item Chinese Star N9500 Android smartphone contains factory-installed Trojan, says security firm has prompted me to think about firmware security. The news mentions the spyware is part of the device's firmware.

This makes me worry: How can I detect when firmware is stealing my information? What can I do to mitigate this problem?

I'm worried about cell phones (Android) and routers. Does someone have some information regarding detection programs?

[Edit]: Reason I ask is that I am considering a router from a China brand - which would cost much much more if it is from other brand. It is from Mi.com. The router, costs 699 RMB or 112 USD, includes a 1TB 2.5 inch hard drive. The price is very attractive, but I am worrying that my information may not be secure.

You could use a tool like Wireshark to analyze your outbound traffic (you need to be upstream of the device) and look for unexpected/suspicious outbound traffic.  Of course, it could be infrequent or only triggered by certain activities, so you'd need a large volume of data to analyze.  And you'd need to be able to analyze (at least traffic analysis) the encrypted traffic as well as plaintext.

Alternatively, you can dump the flash of your devices and reverse-engineer the firmware in the devices.  Of course, you'll need to consider all the firmware:

Cell Phone

Android OS & Apps
Bootloader
Baseband (GSM/LTE)
Bluetooth
Wifi Controller

Router

Router OS (Linux, VxWorks, RouterOS, JunOS, iOS, etc.)
Wifi Controller
Modem (if applicable)

And don't get me started on a laptop or desktop...

So, long story short, you're talking about a project of immense proportions, something that's one of the big open questions in security.  How do we trust the hardware?  See all the stories about NSA implants and the questions for enterprises trying to secure their infrastructure.

Depending on your threat model, you might be able to find some things, but it's nearly impossible to be sure there's nothing unless you're making all your own chips & software.


Is it safe to signup multiple applications with facebook? Putting all eggs in one basket.. Is it safe to sign-up on different applications with facebook or such similar platforms, linkedin, twitter etc?

Is it safe to signup on multiple applications with single email address? The same thing applies here too. One thing is when you sign up on other applications through social networks, your circle may get notifications of your activity. If you have privacy issues, you can set your social media settings to private. Keep your passwords and security questions strong.


Mail client: Public key pinning I'm running my own mail server setup:
- IMAP: Dovecot
- SMTP: Postfix

There are 4 clients which retrieve emails via IMAP:
- iOS (Default client: Apple Mail)
- Android (Default client)
- Mac (Default client: Apple Mail)
- Windows (Thunderbird)

The problem: I don't want these mail clients to trust anybody except my server's certificate. (MITM risk w/ compromised CA)
Is there a way to "untrust" all certificates, which were shipped by default (only for SMTP/IMAP)?

Also is there something like HPKP (HTTP-Public-Key-Pinning) for IMAP?
My domain and Mail Clients don't "support" DNSSEC, that's why I can't use DANE.

It seems that only Thunderbird has an add-on ("Certificate Patrol") which allows what I want. However this is useless, as my other three mail clients don't have a similar add-on.
It's enough if an attacker is able to MITM's one Mail Client to get my password..

Maybe I should switch to something like *-Challenge-Response instead of plain password authentication?

No dice
I don't think you'll find a way to pin the mail server cert across all these clients. Not unless you cripple the devices' cert stores down to only your own CA's cert. And that would work. But it would also mean that regular HTTPS would stop working.

VPN instead?
Could you put your mail server behind a VPN instead? This should be easier to nail down to just a specify cert on the clients.


What key needs to be used to compute HMAC? I use AES-128bit to encrypt files and I want to compute a HMAC for each one of the encrypted files to ensure their integrity.

Can I use directly the AES KEY to compute HMAC or should I used a derived form (eg. PBKDF2 sha256) ?
In other words I wonder if the HMAC can facilitate the recovery of the AES key or not...

Thank you in advance.
Best regards

In general, the advice is always to use two unique keys for two distinct functions.  The main reason is for separation of responsibilities.

Consider that your senior executives may have a very sensitive file that talks about an upcoming business deal.  It needs to be encrypted so that only the other executives can read it.

However, you may need to ask a system administrator, security reviewer, or arbitrator to periodically authenticate or monitor the integrity of the files.  If they're both using the same key, you can't separate those duties.


TLS1.2 AES 128 CBC Encrypted Data size I know that TLS ciphers such as TLS_RSA_WITH_AES_128_CBC_SHA transmit data as shown. From my understanding, the ciphertext must be a multiple of the block size, which in this case is 16 bytes. However, when I look at the below output from Wireshark, I'm confused.

After subtracting the 16 bytes corresponding to the IV from the beginning of the Encrypted Application Data, that leaves 100 bytes of ciphertext which is obviously not a multiple of 16. What am I not understanding?

EDIT: Based on the structure of the struct in the above link, I was under the impression that the MAC was appended to the plaintext prior to encryption and thus included in the ciphertext.

The final SHA in TLS_RSA_WITH_AES_128_CBC_SHA also means (among other things) that every packet has an HMAC-SHA-1 tag, to ensure the data has not been tampered with. This has length 20 bytes, as this is the digest length of SHA-1. So of the 116 bytes, the final 20 are this tag and we are left with 96 = 6 times 16 pure ciphertext (AES-CBC) bytes, the first 16 are the IV needed for the CBC mode, and there is some padding at the end but we have about 4 to 5 blocks of actual application data in here.


Is the use of regular OCSP or OCSP stapling a privacy risk? Is the use of regular OCSP or OCSP stapling a privacy risk? Since a request is sent (in each handshake) to an (external) OCSP Responder.

The OCSP responder can potentially register a load of metadata.

The usage of OCSP Stapling is actualy the solution to "hide" the visitors from CA's eyes. And of course also for reducing the load on CA's OCSP responders.

OCSP Stapling's principle is that the web server is getting the OCSP response from CA's OCSP responder on behalf of the visitor, so CA can't log the visitor's IP addres, time of the visit or anything else. The webserver then caches the response for some time and serves it to other visitors later (until the response expires). So the CA doesn't even know how many visits or visitors you have.

OCSP responses are signed by the CA so they can't be forged - thus using OCSP stapling is totaly safe.


Inject custom markup via vanilla JS without increasing risk of client-side XSS? The world of business-to-business enterprise software has always required a high level of custom per-client markup associated with branding and customization. In a SPA that generally means injecting markup in script.

Some posts tout frameworks like angular.js for safer rendering of this type.  However, there is increasing pressure to shift away from frameworks towards vanilla script in many situations. There are benefits to performance, integration, maintenance, and so on.  This is fueled by increasing size and complexity of existing frameworks, new major releases which depart radically from prior ones, and the constant churn in the JavaScript framework market.

What are the correct client-side security measures to inject markup using vanilla JS?

Please do not flag this as a duplicate of more general client-side XSS questions without the vanilla js requirement or the requirement for custom per-client (this could be termed untrusted, but unknown might be more accurate as it emanates from the client) markup.

I'm not sure I read you right, but I think you want to insert untrusted HTML into the DOM using JavaScript? If so, these are my recommendations:

First of all you need a HTML purifier or sanitizer or whatever you want to call it, that removes any inline CSS or scripts. One example is Google Caja, but I am sure there are more options out there. Make sure to configure it to work the way you want it to. Blocking styles and scripts might not be the only thing you want to do. What about iframes? Forms? Links to strange protocols?
Now you need to use it on everything you insert into the DOM by e.g. using innerHTML(). One way to do that is to create a new function to use instead:

Element.prototype.secureInnerHTML = function(input) {
  this.innerHTML(mySanitizer(input));
}

Note that .textContent and .setAttribute() are already safe, as they operate directly on the DOM and does not treat the input as a string of HTML. In general, it is a good rule to always use .textContent when markup is not needed.
Set a strict content security policy, disallowing all inline scripts and styles.

I'm not saying this will make you 100% secure, but at least it is a good start. Please note that since we have disabled inline CSS all styling has to be done using classes. If allowing inline CSS is a requirement, you have a much harder problem to solve.


Can Central Authentication Service (CAS) do authorization? I have a few web applications that I'm trying to tie in via CAS, but I'm a little confused about the authorization, which I read CAS isn't supposed to do.  Yet, I see something like groups, but don't know what they are.

Anyway, my scenario is pretty common, and is as follows:

We need to restrict access to each of our apps that are going to support SSO.  Within each of our apps, there are roles.  These roles are used to prevent certain users from accessing various parts of the site.  In addition, admin users should be allowed to assign users access to the apps they are an admin of.  Also, an admin of one system may not be an admin of another system.  Is it possible to satisfy all of these scenarios with CAS?  Or should I be looking at a completely different type of SSO?

-- to explain --

CAS - http://www.jasig.org/cas :

  Central Authentication Service project, more commonly referred to as CAS. CAS is an authentication system originally created by Yale University to provide a trusted way for an application to authenticate a user. CAS became a Jasig project in December 2004.

No, CAS is just an Authentication Service, but you can surely impose Authorization using the mechanism, which is the base of doing authentication for your CAS.

Say, if you are using LDAP to authenticate the Accounts for CAS. Then, for the requirement like yours.....

You can create UserGroups in LDAP and assign respective User IDs to their groups.

Now, at web application you keep the log-in via CAS which on success contacts LDAP (or whatever Auth-Mechanism you have at backend) and fetches the UserGroups assigned to the User.

Now, on the basis of UserGroups fetched, you can allow/disallow access to web-app features.


Do the firewall hardware specifications have to be better than the network it protects? If I need a bodyguard I'll have to hire someone whose muscles are much tougher than mine. If a server can't handle a DoS/DDoS attack because it consumes it's resources does this mean the firewall has to have better resources than the server it protects? ie bigger RAM, better processor and of course this means the firewall cost more money than the server itself?
What is wrong about my assumption?

You say:

  If I need a bodyguard I'll have to hire someone whose muscles are
  much tougher than mine

This mean that if you need a bodyguard, you will need someone with very specific capacities allowing him to protect you effectively. He will not need to have the same study background as you, he will not need to be able to administrate servers, he will not need to beat you at chess or whatever.

In other words, the bodyguard does not need to be "better" than you, he needs to be dedicated to his job.

The same apply for a firewall: he will need reliable network cards, low latency bus. But he will not have to handle all the bell and whistles required by a full fledged web server running HTTP daemons, proxies, databases, application servers, and the list could go on endlessly and the longer the list is, the more you will need RAM and CPU. But, when talking about firewall just handling small TCP/UDP packets to decide to let them pass or block them, RAM and CPU power becomes  of less importance.

Recently I went on an interesting article dealing on this kind of subject, do not hesitate to check it.


Mutual TLS - with self-signed client certs - what is the security purpose of a client private key in addition to client cert? In mutual TLS, during client-authentication phase, a client proves its identity to the server by sending its client certificate (Certificate message). Additionally, it signs all previous handshake messages using its private key and sends the resulting hash (CertificateVerify message). Server uses this hash to validate client's ownership of the certificate.
What is the security benefit of the doing CertificateVerify validation above? How cert can be compromised while key can't?
A typical key storage/management logistics for client key+cert is "bundled". Usually, when server issues client certificate to a particular client - it supplies key+cert (often bundled into a single P12 or PFX file, or PEM file with both parts concatenated), and all client APIs (OpenSSL, curl, Node.js request, etc.) expect both key and cert to be supplied. Therefore, a client reasonably deals with key and cert local storage/protection the same way.
Since they're typically bundled - what benefit/reason there is for key-verification of a cert? Why supplying just cert would not be good enough?
Official definition and reasoning (which is not convincing to me, per the above):

https://en.wikipedia.org/wiki/Transport_Layer_Security#Client-authenticated_TLS_handshake
https://security.stackexchange.com/a/141050/249969

EDIT (to emphasize the client cert is self-signed by the server):
It is clear that for well-known-CA signed client certificates, key is indeed required. That's because in such case - client's cert is publicly known.
However, in most real-life cases I saw - the server is a well-known entity, while clients are not (or the server doesn't care if they are, and still issues, and expects to get, self-signed certs of its own). Since clients are not well-known entities - arranging a well-known-CA registration for each client - is not practical. In other words, the server issues the key+cert. And then - the question is - is there still any security benefit of supplying key-verified hash, in addition to cert during mTLS client auth?
Does it only exist in the protocol to cover the case when client cert is issued by a well-known-CA, i.e. for cases when client cert is protected differently than key? Or there's some solid reason for key in self-signed scenario as well?

I think you need to do some reading on what a certificate is. At it's core, a certificate is an attestation from the Certificate Authority (CA) to bind together the following information:

Name (DN or SAN)
Public key

Think of it like a driver's license that "binds together" your name, birthdate and photo. Imagine you hand your ID to a bouncer; alright, so they know that somebody has that name and birthdate, but to prove that it's you, you have to show your face and let the bouncer verify that it matches the photo. Mailing someone a photocopy of a driver's license does not actually prove that you are the person named on the ID.
Similarly, when you authenticate to a server using a client certificate, you are proving your identity in the following way:

Provide a public key.
Perform an operation that could only have been done with the matching private key, thus proving that you are the owner of that public key.
Provide a CA-signed certificate binding that public key to your name, thus proving that you are the person named in that certificate.

Update addressing comments
Yes, you really need to use the private key, even if the client cert is self-signed, even if it's issue by a private CA.
Sending a client cert without using the private key is like showing your ID to a bouncer without showing your face. You need to use the private key in order to prove that you are the owner of the public key in the certificate. In digital security we call this a "replay attack" because if all you needed to do was show your certificate, then once you've shown it to one server, that server could impersonate you to another server (or an admin of that site could impersonate you). Public key cryptography solves this because you only share your public key (which is inside the certificate) and keep the matching private key to yourself. If you're not using any of the cryptography in a certificate, then why go through the effort? Why not have users log in with username/password; that would be much simpler and get you the same security properties.


Integrating ZAP to SDLC. Am I doing it right? We are trying to integrate OWASP ZAP scans to our Build Cycle. When a new build reaches the QA team, they run an automation tool similar to Selenium, which opens a Firefox web-browser in a Windows machine and runs their test cases. Being completely new to ZAP, this is what I have setup now to get the scan results from those tests regularly.

Installed the ZAP tool in a Linux machine and it is running in
daemon mode with an api-key on port 8080
Made changes in Firefox settings in the Automation Test machine so
that each new Firefox profiles opened by Selenium will have the proxy pointed to <IP_of_ZAP_Machine:8080>.
A cronjob will run every midnight that does the following in this order:

Collects the URLs scanned by calling the URL
http://IP_of_ZAP_Machine:8080/XML/core/view/sites/?zapapiformat=XML
Generates a list of URLs which shows alerts for each 'sites'
obtained from the previous step.

Example: http://IP_of_ZAP_Machine:8080/HTML/core/view/alerts/?zapapiformat=HTML&baseurl=https%3A%2F%2Fwww.example.com&start=&count= for the results of scan on https://www.example.com
Downloads the scan results in HTML format by calling all the URLs from the above step and putting all the HTMLs in a ZIP file.
Emails the ZIP file to my team.
Loads a new session so that the results e-mailed next midnight will contain results only from the previous midnight. The new session is loaded using the URL
http://IP_of_ZAP_Machine:8080/JSON/core/action/newSession/?zapapiformat=JSON&apikey=<my_api_key>&name=${newsessionname}&overwrite=

While I am getting the scan results as expected everyday, the questions is: Am I doing it right? Is there a more correct or established way of doing this?

Note: Results from all the steps are logged into a log file for future verification.

Is it working for you? If so then yes, you are probably doing it right ;) ZAP is a very flexible tool and many people use it in different ways. One question - are you restarting the ZAP instance, eg for each scan or after a period of time? If not you may run into issues as ZAP is not really designed to be run as a long running process. We are working to change that, but we're not there yet.


How to prevent yourself from exploitable browser? If we suppose that an attacker has a zero-day vulnerability for a major browser, and can exploit this vulnerability. How can a Linux/Ubuntu user secure themselves from downloading malware (like keyloggers or other stuff that can can access to user's OS / escalate privileges) and gain execution a user's system?

If an attacker has a sandbox-bypassing 0day exploit, there is little you can do. The best way of preventing this from happening is having good web-browsing hygiene.

Things you can do to limit your risk of infection:

Run an Add blocker (advertisements are often targetted as they're widespread across different websites)
Run no-script plugin (to prevent unwanted redirection)
Don't visit dodgy websites, but only visit reputable websites
Try to use SSL as much as possible


Is it safe to use Memcached in a shared hosting environment? The shared hosting I am using had Memcached enabled, I searched some forums that using Memcached in a shared hosting environment, can cause security problems like view the cache of the other user, edit the cache, etc. But the date is way back 2013, so I am a bit anxious about it, is it still not secure/safe to use Memcached in shared hosting environment?

And also, I do not have an access in the php.ini so SASL authentication will not work on me. Is there a way to use Memcached safely/securely? If it doesn't, are there any other options for me to use cache the data results?

If you did not configure it, then you can't know if its secure. Doesn't matter if we're talking about memcached, an Oracle database, opensshd....

As grochmal says, there are no intrinsic access control mechanism in memcache. So there is very little scope for the service provider to implement the kind of partitioning you might desire.

Encrypting all the data you store in memcache would solve the disclosure problem (but creates a key management problem). It doesn't prevent damage to the data.

  are there any other options for me to use cache the data results

We don't know what the hosting is nor what your requirements for security are. If "the data" is a mysql result set, then you use mysql's caching. If its JSON data fetched via HTTP then you may be able to use a forward proxy. If its caching the output of your own pages, then a reverse proxy.....


Does Facebook scan the photos I upload? I uploaded a photo of mine with my friend and tagged some random Facebook users of my friend list. After some time when I opened that post, Facebook is suggesting me to tag my friend who is in that picture. Facebook even shows my friend's name (Facebook name).

Is Facebook scanning photos we are uploading?

Short answer: yes.

Everything you send to Facebook is stored and processed, and that includes more than posts or pictures. All your likes, all links you click, all friends you check, how much time you spend on Facebook, how many times you use it, which hours you check. Everything.

They earn money by knowing everything possible about you and everyone you know. Making a profile of you so detailed that they can predict what you will like or dislike, and send you exact the things you like.


What does the PCI-DSS statement "Store separately from the data encrypting key" mean? As per the PCI-DSS 3.5.2 requirement
Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data encrypting key.
Does this mean:

Storing the keys(DEK and KEK) in different servers(server1 and server2)
or
Storing the keys(DEK and KEK) in different location path on the same machine.

path1(DEK): c:\user\chandru\Document\DEK\DEK.txt
path2(KEK): c:\user\chandru\Document\KEK\KEK.txt

or
3. Storing the keys(DEK and KEK) in different user location on the same machine.

path1(DEK): c:\user\chandru\Document\DEK\DEK.txt
path2(KEK):c:\user\somenewuser\Document\KEK\KEK.txt

Is there any other way to store the key apart from the HSM as per the PCI-DSS standards?

Dedicated Server with HSM:

Two dedicated server without HSM:

There's two ways to do this:

Simple storage-only approach

The first method is to use one device for encrypting the data, and another device for storing it. So data gets encrypted on some application server, but gets stored on a database server. The place where the data is stored does not posses any of the keys, it's just storage.

More complex but more secure approach

The second method is to use a public/private keypair. A unique, random session key is generated for every piece you want to encrypt. You encrypt the sensitive data with the session key, and the session key with your public key, and then discard your session key.

You can then store the encrypted block on the same server as the public key that was used to encrypt it, since the public key is useless for decryption.

To decrypt your data, you use the private key to decrypt your session key, and use the session key to use decrypt the sensitive data.

This is how tools like PGP/GPG work, so you don't need to (and shouldn't) implement it yourself, you can just use one of these stock utilities.


Getting my first HDD encryption So my friend told me about this thing called disk encryption, how you can protect your data if your computer were ever to become compromised..
Now I go to a school where there are alot of bad people, who might steal my computer and I dont want them to steal my projects, my bitcoins I just dont want them to snook around my computer due to the fact that I got alot of family related things on it. (Family trips, fishing with my dad etc)
I've known about this for a while but I've always been sceptic.
I've heard about the most popular ones such as.

BitLocker
TrueCrypt
VeraCrypt

And there are a few reasons to why I dont trust these.
BitLocker
Was developed by a big corporation that wouldnt mind selling out users and helping people retrieve data. Also (This might be a bit far fetched) someone who works there might one day steal my computer and how hard would it be for him to unlock everything? I would guess it would take him 1 day with the right tools.
(Keep in mind that I've never used a disk encryptor so this is just guesses at this point)
TrueCrypt
The project died out and is now a open-source project due to a Unknown "Hack" or a "Security breach" back in 2013.
and the fact that it was unknown makes it even worse because it could of been anyone in between a normal skidder to someone who works at the NSA.
(I say NSA because apaprently they had a hard time cracking TrueCrypt)
And who knows.. Maybe they fianlly succeeded.
VeraCrypt
I dont know too much about VeraCrypt if I'm going to be completely honest.
But I do know that the project is open-source which makes the code available for anyone and everyone right? Which just writes security breach all over the project.
Question
What are some good softwares to look into or is there no use because they're all crackable?

Necessary Information
I'm not a professional and most of the things in this post are based upon things I've read online and some are just thoughts floating around my head.
75% - 25%

I will just reverse your arguments concerning VeraCrypt. First, it is by no way a brand new tool, but it is a fork of TrueCrypt. The fork was done when TrueCrypt was discontinued, and that was allowed precisely because TrueCrypt was an open source product.

Secondly as far as security is concerned, the major opinion is that open source is better than closed source. Security must not rely on obfuscation (unknown algorithms) but on well known algorithms and thoroughly reviewed implementations and on secure keys.

So the fact that VeraCrypt is an open source project offers 2 guarantees:

if the team that currently manages the project, another team is likely to produce a new fork, so users will not be left with an abondoned and no longer maintained tool
as it is open source, experts can scrutinize the code and report vulnerabilites. I would never trust a closed source security tool.


How can I trace Hacking attempt First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check those data and if they are malicious I want to call assistent via mail or sms or phone call.

The bold phrase above is the tricky part. How to define if something is malicious? Hacker sends valid data from the apps point of view. But outside that application domain another tool can examine it.

Is there any tool like that? If not what are the common logic to trace intrusion? I can write a tool then.

As mentioned in the comments, try and IDS or IPS. My favorite and free one is hostbased and called  OSSEC.

It will alert you of break-in attempts and other irregularities on your machine.


Is it possible to obtain the login credentials submitted by users? It's a question at computer security textbook

Assume that user A is about to use some website that requires login credentials. User A starts his web browser, types the website’s URL, and submits the URL request. The web server hosting the requested website responds and sends a page requesting login credentials. User A types then submits the required credentials. The Web browser sends the login credentials back to the web server as plain text (without encryption).
why or why not it is possible for user B to obtain the login credentials submitted by user A if:

User A and User B on the same subnet (sub network).
User A and User B are not on the same subnet (sub network).

If user B is in same network, so he can use ARP poisoning for capturing the data that transfer from user A to the server. This type of attack called MITM ( man in the middle) attack.
But if user B  is not in the same network, the only way is that installs a backdoor or trojan on the computer of A.

Anothe way is that before that user A open web browser, user B change the dns setting of router that user A use it, and put malicious DNS in order to run DNS-based pharming attack.