Why do cellphones not use software to simulate a NAT router between the phone and the internet? Connecting through wifi adds the benefit of being behind NAT. Why do cellphones not simulate being behind a nat network when connecting directly to the internet to limit the attack surface? Or, is there software that has implemented this?

NAT does not explicitly add security. It only implicitly adds security because it needs to keep a state for all outgoing connections to map incoming packets back to the originating connection - and thus implicitly denies any incoming packets which don't match an outgoing connection. But, this security can already be done with a stateful packet filter (like iptables) which is usually the base for a NAT solution anyway.

But, this kind of security is actually only needed to protect services on the phone which accept packets from outside even though they don't expect such packets. This means services which bind to any address instead of only the localhost address. Usually there are no such services, i.e. either they bind to localhost only or they actually expect traffic from outside.

That does not mean that such a packet filter is not useful on mobile devices. It actually is very useful because for example on a rooted Android phone you can use the builtin iptables with a nice interface (such as Android Firewall) to limit which applications can access the local network, use WLAN, use mobile data or even can be used with roaming.


How can I check open ports on android? I know that every ISO based network system uses TCP port, and Android is of course not an exception.
My question is, can I check the open ports in my device? Can I close them? Is there an app to handle this issue?

You can use a terminal emulator and execute the following:

shell@android:/ $ cat /proc/net/tcp

That will list open ports.

Alternately, install an app like OS Monitor.

If you want to close any, use a Firewall app.


What is "play security information update" In my android phone I have random downloading progress started by download manager. The notification says "play security information update". I have no idea if this is a regular android security check or this may be data leakage or kind of virus? Is there any document about play security? Is it a part of Google play protect service?

This is good.

Google Play Protect periodically scans your device to remove harmful applications.

As all other applications on your phone, it needs to be updated, thus the message on your screenshot.


Not Asking Email Verification on Account Creation Could we consider it as a security flaw to not ask an email verification on account creation?

Let's say there is a service that ask you to enter an email address as a username and a password in order to create an account. Then, as soon as you press the "create account" button, your new account is ready and you're never asked to verify your email address.

The first thing that comes to mind is that you won't be able to get back this account if you don't own the email address, but is it also possible to exploit the fact that there is no email verification to deny possible users to the service?

For example, if I own a competitor company, I could create account using the email of my clients on that other company website and I would effectively block those clients from creating an account using their favorite email address for that other company.

It's just annoying to the user to try to create an account and realize that your own email address is already taken while you have clearly not created an account, but, on the web, anything that annoy your users will make
you lose customers.

Note

I'm asking that question because I believe a previous question got misunderstood and I'm assuming in the other question that this is a problem. So please, help me understand whether or not this is an issue.

The answer to your question likely depends on a couple of factors.

Can the e-mail address used for registration be used for password reset. It would be a mistake from a security and usuability perspective to do this where the e-mail address was not validated during registration as a typo during registration could effectively lock you out of your account, if you forgot the password (absent any other password reset mechanisms).  Also if you register using someone elses e-mail address (for whatever reason) they can effectively steal the account from you in this case as they can just trigger a reset and take control.
Is there some real world consequence to someone using an e-mail address that they do not own.  For example if a user fraudulently registers as billgates@microsoft.com would that achieve some security relatd goal where they could mis-represent themselves as being Bill Gates?

So the consequences of this very much depend on the nature of the site in question and are hard to be precise about in the abstract.


Limited open redirect ideas This website (example.com for confidentiality) has an odd open redirect situation. It redirects after logging in by a URL parameter like example.com/login?returnURL=https://example.com

I found that it allows you to change the redirect protocol to almost anything except a few windows protocols like mailto, so you can do something like:

example.com/login?returnURL=steam://egg.example.com

However, as in the example above, *.example.com must be immediately after the protocol or it doesn't work.

Any ideas on common protocols where I could make my own malicious link and it would redirect to it?

There are various ways to bypass such if it's properly validated. To know it better, you need to understand the URL architecture and how things are dine programmatically.
For example,
http://example.com@evil.com redirects evil.com. This is because example.com in this case is username (part of authority) directly supplied in URL. You can learn more about URL architecture from https://tools.ietf.org/html/rfc3986#section-3. I'd also recommend you go through Tangled Web.
And, deoending in how it's being validated, you can also send http://evil.com?http://example.com. This also satisfies the condition that scheme is directly followed by example.com.

If you're just looking for payloads, you might find this useful;
https://github.com/cujanovic/Open-Redirect-Payloads


Basic things that need to be explained to employees about a security policy and at what point in their employment I was asked this question:

  What are the basic things that need to be explained to every employee
  about a security policy? At what point in their employment? Why? (List
  at least 4 things).

Would the basic things be how sensitive information must be handled, responding to security incidents etc?

Also, I'm not sure on when during their employment these things should be explained?

Policies are not written to stay on a shelf. Every line in every policy should be tied to a risk that the organisation needs to control. As such, each policy needs to be communicated to the people who need to follow the policy.

What should be communicated? Whatever is relevant to that employee.

When should it be communicated? Before the employee starts to access and process the systems and information that they are expected to handle in accordance with policy.

Else what's the point? "We've written this handy guide on the important things you should know about flying a plane. Don't worry about reading it until you have flown passengers around a bit."

The question assumes that there is a set (a set of 4, in this case) of core things in the policy that is a higher priority than the rest. What those things are will be potentially different for each organisation because the risks that an organisation needs to control are different for each organisation.

In short, the question is hyper-specific and wants the answerer to understand what the most important things are in the policy. We cannot know that without understanding the policy.


How might this Amazon account hack occur? My mother recently had her Amazon account (buyer, not seller) hacked. She is not a security expert but does work in database management, so she is definitely not computer illiterate. I am also not a security expert but I work as a software engineer, and still this situation is strange to me. She asked me for advice and despite our best efforts, the hack is still ongoing. I would like to know how this hack could have been carried out, and what steps should be taken to stop further damage.

Here is the sequence of events, to the best of my memory (as she told the story to me over several phone calls):

Two weeks ago my mother noticed a $50 Nintendo eShop Gift Card ordered by her Amazon account. She immediately understood that her account was hacked.
She immediately changed her password (I later learned that this was a 1-character change) and turned on two-factor authentication (2FA) going to her cell phone. She assumed that this process would "kick off" the hacker who might still be logged in, in their own browser session.
A couple days later another unauthorized purchase was made, again for a Nintendo eShop Gift Card. During this time, my mother did not receive any messages related to 2FA.
The hacker added a new credit card to the account, using a name and card number that we do not recognize. The billing address was left unchanged.
My mother called me at this point asking for advice, since she didn't understand how the hacker still had access to the account after the password was changed and 2FA was turned on. I was also confused, and advised her to change the password to a completely different one, and then call Amazon for advice. I was unable to find an option on Amazon's website to force other account sessions to be logged out. I also hypothesized that her computer could be compromised, for example with a keylogger that would make password changes useless (but how does that get around 2FA?). I also considered the possibility of malware on her computer placing the fraudulent orders on her behalf, but it would take an incredibly specialized attack to do this, and it doesn't seem like an extremely skilled hacker would go through that trouble for a couple hundred dollars in gift cards.
She spoke to an Amazon representative. The representative did not know whether the process of changing a password will automatically log out other sessions, but the representative did make a request for that to happen (by putting the account "on hold").
My mother changed the password to a completely different one, using a different computer.
Today another unauthorized purchase was made, $40 worth of Nintendo eShop Gift Cards. The hacker also added a credit card with my father's name and his work address, but we do not recognize the card number. Again my mother has not received any suspicious 2FA messages.

Questions:

How might this attack have occurred?
What can we do to stop the attack?

So far all of the following has been unsuccessful: two password changes, the latest being a completely different password set on a different computer, adding 2FA, and having the account put "on hold" which according to the Amazon representative should log out other sessions.

What can we do to stop the attack?

The damage and the extent of the breach might be more than you think of.
The email account that is tied to the Amazon account needs the same security steps implemented or re-implemented, like changing your passwords to one with a completely different set of characters & theme/nature and the setting up of 2FA.
It is possible for the breached access to have gotten past the need to enter 2FA. Under 'Two-Step Verification (2SV) Settings' > 'Require OTP on all devices'

Do check on the number of 2FA apps enrolled as well.

You can also rule out the possibilities of her cellphone being breached by using your phone's authenticator app as hers. Find the breach, plug it!


How Big are Antivirus Definition Databases? Accoording to HowToGeek:

  Your antivirus software relies on virus definitions to detect malware. That’s why it automatically downloads new, updated definition files – once a day or even more often. The definition files contain signatures for viruses and other malware that have been encountered in the wild.

My question is, wouldn't the storage space required to hold such signature databases be quite large in size? However, this doesn't seem to be the case as daily AV updates don't seem that big, nor does the installation download.

Are these signature definitions just not as big as I'm imagining them to be?

ClamAV's database size from their update server is 109.1MB as of today. These signature databases are created and stored in such a way as to compress them, as you can imagine.

ESET says their updates (performed 2-3 times a day) are 60KB in size on average (though can be bigger).

Installations would only include the binaries to install the program, and the program would contact the update server to retrieve the latest database, also as you would imagine.

These databases are the intellectual property of the AV vendor and represents one of the unique values the vendor provides with the product, so they will not be forthcoming with all the details about how they manage their databases. But open source programs provide a glimpse into one method for how they might work.


What the most trustworthy way to demonstrate digital File Integrity? I'm looking for ensure the integrity  of uploaded files and demonstrate this integrity  to a user.

In my current scenario, a user sends multiple files in several different formats,  these files are transported to a storage device or location.
I need to create a report provider a container with these files(eg. Zip), but on this report I must print a visual and effectively reference as a "seal", "mark", "hash" or something else that's proof the following files are integrate;

The following is a list of some of the more common methods of demonstrating integrity:

Hashing function: An established mathematical calculation that
generates a numerical value based on file content data. This alpha-numerical value
is referred to as the hashhash value. Hashing computes a number using
a complex formula and is very sensitive to changes in the file content.
Digital signature: This process is used along with a hash process.
The resulting hash is encrypted with a specific private key. File
integrity can be verified using the hash value, and the source of the
signature is validated using the public key.
Checksums/Cyclical redundancy check (CRC): Checksums are often used
in file transfer to verify that the data transfer was successful.
Some checksums are as powerful as hashes. It is recommended that
those checksums that are not as powerful as hashes be used in concert
with other methods (such as hashing or visual verification) to the
degree possible. Eg. MD5Checksum.
Encryption: This process modifies the content of the files and does
not in and of itself demonstrate that the file has not been altered.
Encryption can be used in concert with other methods.
Watermarks: This process modifies the content of the files and can
persist as a part of the file. This method is not recommended.
Proprietary methods: Methods offered for sale or license by a vendor
that controls the source code may not be independently verifiable.
Likewise, it may not be possible to validate the methodology
independently. Therefore, this method is not recommended.

After demonstrate the digital File Integrity, the user should be able to validate the authenticity of it when they wish.

It depends on what whether you really mean the "most trustworthy". As with many aspects of digital security, there is a sliding scale of strength / reliability vs usability / feasibility. I think some important questions to consider are:

Who are your users? To what extent do they care about proof of file integrity?
Even if the users don't care, how important is it to you or your service that files are transferred completely and unaltered?
How can you balance the usability of such a system with security? (If the users have to go through some elaborate private key / certificate generation hoop jumping process, this might not be worth it for the added security, or it may well be depending on sensitivity)

Verifying the integrity of transferred data is an incredibly involved science, and it scales from the most basic checksum all the way up to the most complex methods. It all depends on what your needs are.


Can I hide my location whilst using mine and my company's VPN? My laptop must be connected to my company's VPN (Global Protect) before I can be able to work at home. I try to connect my Express VPN at the same time to stop my company's VPN  from "seeing" my physical location when I'm in another country. Please how do I do this?
I try to connect my Express VPN same time when the Global Protect is ON, but it won't let me. The company's VPN won't connect except I disconnect from my Express VPN.
Please assist me here as I don't mean any harm but just want to be with my family abroad at the same time. And I don't want to lose my job. But I am willing to do my work well but still be with my family.
What do I do to stop my employer from seeing my location when i am abroad?

Depending on your operating system and TCP/IP stack, it's not so clear-cut that you can. Running two VPNs requires establishing which is the "inner" and which is the "outer" VPN, and this means the two software drivers might need to collaborate to some extent.
At the most basic level, some VPN softwares (and your company's might well be one of those) require that the carrier interface is physical (i.e. not a VPN itself).
However, as I see it, if your company allows you to work through VPN this means that they should not be concerned about where you're connecting from. That is the point of a VPN. So, have you tried asking? They might be all right with allowing you to work from wherever you wish, provided the work gets done. Actually, this once happened to me, they might be ecstatic and assign you to some specific task that would benefit from the different time zone (or exempt you from Skype calls at certain awkward times).
And on the other hand, if your company only allows specific places to act as VPN endpoints, this means they require the additional security - they might not want you to get your laptop screen in any old Internet café where someone might be able to snoop from behind your shoulder. If this is the case, it stands to reason that they will have instrumentation in place to help detect non-compliances: the simplest one is check out from which IP you're connecting.
In which case, if you fire up your private VPN from anywhere in the world, including your own home, and thus appear to be located in PrivateVPN's rack space, the fact you're nesting two VPNs will be immediately obvious and trigger some alarm.
Also, in the case of the time zone, you might find yourself forced to stay awake at night, or be unexplainably unavailable during normal workhours when your colleagues might wish to communicate with you.


Boot or reboot to clean state on Windows each time? I use virtual box to securely surf the web, but it's easy to get lazy and use the same image more than once.  Currently, I have a golden Win 7 image that I built and loaded my required software.  I then made a linked clone for different machine types.  Examples are Sensitive machine, Non Sensitive, TOR machine etc.  I use each VM for a different purpose (sensitive is for going to banks and brokerages, non-sensitive is for random web surfing).

Has anyone found a way to automate a snapshot restore at reboot?
Has anyone used linked clones in an automated fashion to generate a new machine each time and delete all the linked clone files at shutdown?

You can take a snapshot of a freshly installed Windows VM and revert to that snapshot each time you want a new OS.
You can automate restoring by using the VBoxManage tool:
VBoxManage snapshot restore <uuid>|<name>

The VBoxManage snapshot command is used to control snapshots from the command line. A
snapshot consists of a complete copy of the virtual machine settings, copied at the time when the snapshot was taken, and optionally a virtual machine saved state file if the snapshot was taken while the machine was running. After a snapshot has been taken, VirtualBox creates differencing hard disk for each normal hard disk associated with the machine so that when a snapshot is restored, the contents of the virtual machine's virtual hard disks can be quickly reset by simply dropping the pre-existing differencing files.
The restore operation will restore the given snapshot (specified by name or by UUID) by resetting the virtual machine's settings and current state to that of the snapshot. The previous current state of the machine will be lost. After this, the given snapshot becomes the new "current" snapshot so that subsequent snapshots are inserted under the snapshot from which was restored.
The restorecurrent operation is a shortcut to restore the current snapshot (i.e. the snapshot from which the current state is derived). This subcommand is equivalent to using the "restore" subcommand with the name or UUID of the current snapshot, except that it avoids the extra step of determining that name or UUID.


What is the risk of using SHA1 in PGP email signatures? SHA-1 is being phased out by a lot of major companies due to vulnerabilities.
For example Chrome no longer considers it safe for public web PKI.

Is it insecure to use SHA-1 for PGP email signatures?

There are no practical attacks on SHA-1 yet. Experts estimate that SHA-1 attacks will start to appear around 2018.

As you have correctly pointed out, companies like Google and Microsoft have already taken action and are replacing SHA-1 with newer and safer standards:

  Microsoft is recommending that customers and CA’s stop using SHA-1 for cryptographic applications, including use in SSL/TLS and code signing. Microsoft Security Advisory 2880823 has been released along with the policy announcement that Microsoft will stop recognizing the validity of SHA-1 based certificates after 2016.

The recommendation is to move to SHA-2. So you'll have to reconfigure your PGP software to use another hash function, but the basic working principle of PGP will remain the same.


Rearranging hash adds no security? I'm a rookie when it comes to Information Security so I've been reading a lot of the top questions on this stackexchange for the sake of learning.  I came across this question that discusses hashing.  In criticism of a home-brew security algorithm, people repeatedly say that shuffling a hash adds no security.

A comment that I can't find an answer for:

$nt = substr($pass,0,8); // <--- BAD BAD BAD - why shuffle an MD5 hash?!?!?

and here:

  Again hash = sha1($salt+md5'($password)). Rearranging the MD5 adds no security (swap(00112233445566778899aabbccddeeff) becomes ccddeeff8899aabb0011223344556677) the swap does not prevent you from using md5 rainbow tables after (e.g., look at the code and reverse the swap). However, the presence of the unique salt makes the rainbow tables infeasible.

There must be something I don't understand about hashing.  It seems to me rearranging the characters in the hash randomly would offer a sort of security?  Clearly that's not the case, but What mistake am I making?  I'm ignorant of my own ignorance right now.

First of all, based on Kerckhoffs's principle, you must assume that an attacker knows the algorithm you used to hash the passwords, so doing things differently than others won't make you secure by default.

While your algorithm is  based on MD5, it's a entirely different algorithm. How do you make sure that you didn't reduce its strength by performing your own calculations on top of it?

Finally, this question seems to be about password hashing. In this context, hash algorithms are expected to be slow. MD5 is fast. Shuffling an MD5 is fast. Your algorithm is fast. So you shouldn't use it for password hashing.


Is there more of a security risk by providing an email when creating a new account? With all of these recent breaches, I have been thinking about security best practices.

One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR USERNAME, or even JUST EMAIL.

To me, this sounds like a big risk, because you are now given 2 separate vectors to attack from, one from knowing the email, or one from knowing the Username.

But lets take this a step further, and assume we don't know the email, but do know the Username.

Lets say their password was cracked, and someone is in the account, which gives the attacker access to the user's "Registered Email Address."  Or even if the attacker was able to SQLi the site's database and were able to get a list of email addresses and username/pw combos.  This means the attacker can now do a lot of damage over a wide area.

With email listed, attackers now have access to new data that previously was not known.  Assuming these people aren't smart, and reuse their passwords, a hacker now has access to their email account.  Even if they didn't reuse their password we now have an email in order to start attacks.

From there, we also have 2FA, which I'm not 100% how it works, but it seems to require authentication by using your mobile device, either a code or some sort of login from the device.

The thing is, I've heard that if someone sets up 2FA on your account, you can be locked out....  So what use does your email have now, besides providing additional information about you, that you really do not need.

My questions are.

Is providing an email address these days actually useful, or is it a security risk due to providing additional information that could be harmful?
If 2FA is enabled, and we get locked out of our account, would our email be able to save us?  It seems 2FA has a higher permission level than the normal password reset of an email, so even if you did reset your password, the 2FA would not allow you in (granted I'm not sure how to reset 2FA).

Since an email address' only function (usually) is to provide a way to reset your password, it seems to me, that if we register an account, and then set up 2FA on a mobile device the email address is really not needed.  Password resets could be sent to that 2FA device, so that it could change your password, without ever having to send it to an email... (not sure if this is done now, but figure this could be implemented).

So am I wrong to think that Emails are dangerous to provide these days, and that we could possibly accomplish what we want with just 2FA?

EDIT:  I just want to point out, that the above was written under the assumption that email addresses/usernames are not Hashed.  After reading a few questions on here regarding hashing emails, it seems some people do it.

I'm curious how many people recommend hashing an email address?  What about a username?

Personally I like hashing as much important data as I can, but not sure what "Security best practices" are, or what a lot of people do.

Neil has good points. I would like to add some more thoughts.

First: 2FA is a more generic term. Your smartcard, fingerprint scanner and iris scan also add a 2nd factor to 2FA. What you are talking of here is 2FA with OTP, one time passwords. And again with OTP there are many possibilities.

OTP possibilities

There is this cheap way of sending SMS or the cheap way of using your smartphone as your OTP generator. The OTPs are nowadays (there are still some like RSA and Vasco who refuse to adapt) according to RFC4226 or RFC6238. In both cases your device and the backend (site) have the same symmetric key. The key and some kind of moving factor like the keypress (RFC4226) or the time (RFC6238) are combined into an HMAC-SHAxxx algorithm. Using SMS is a bad idea as you saw during the last weeks but also using the Google Authenticator has its disadvantages.

But there are also hardware devices of many different vendors. Google and Facebook will not use those naturally. But sites or portals with some kind of defined or restricted userbase might use such devices. The Yubikey can even be initialized, so that the vendor does not know the symmetric key.

Losing an authentication factor

A user can lose or forget an authentication factor. Either forgetting his password or loosing his possession factor. If you have no workflows installed so that the use either may reset his password or revoke and reenroll a possession factor, than of course the user cannot login anymore. Never again. ;-)

You are right and Neil point with the credit bureaus. The challenge indeed is, to define a secure workflow to reset the password and reenroll a new hardware-token or register a new smartphone. This is why there are management systems for 2FA like these of classical vendors like Safenet Authentication Manager but also open source solutions like privacyIDEA (Disclaimer: I am working on the second one.)
These management systems already provide workflows to revoke or delete possession factors and verify the identity.

Forgetting password

As far as losing the password is concerned, the email reset functionality is IMHO legit. The user can reset one forgotten knowledge factor with hopefully another good knowledge factor (the password of his email account).

Of course the problem arises when the user uses email on his smartphone (with cached password) and the Google Authenticator. Loosing the smartphone will compromise both factors! As the finder (or thief) get the possession factor and can reset the knowledge factor!

But it is also difficult to avoid the user writing his password on a sticky note under his keyboard.

Losing possession factor

The user loses his smartphone. Either with SMS or Google Authenticator. Or his hardware token. What will happen?
First the user has to notify the administrator/site, that he lost his possession factor. The site will lock or revoke this factor, so that it can not be used anymore.

Now it very much depends on how you setup the process. Never send a QR code for the google authenticator via email to the user. In this case your 2FA would be reduced to 1FA as you already realized. The attacker could request a password reset and a smartphone reset on the same (hacked) email address.

The company/site should choose a good process. A simple way is that you can work with emergency codes like the PAM module of the Google Authenticator. Print 5 one time passwords as emergency possession factor. These can be stored "save" offline. If the smartphone is lost, use these to login.

The above mentioned management software can assign several factors to one user. E.g. if the user normally uses a dedicated hardware token to authenticate, he could also have smartphone receiving text messages and only use this second factor to reenroll a hardware token.

Or - not very sexy for Google and Co - the site can send a new authentication device or a new QR Code or some tricky registration codes for registering a new mobile phone for text messages to the postal address of the user.

Bottom line

The sense of 2FA is to raise the hurdle for the attacker. Classical attackers are good in online-software-attacks. They know how to attack passwords on a large scale. This is why text messages or the enrollment process of a google Authenticator are problematic. These are in the same realm of the skill profile of the attacker.

An now you see, why using credit bureaus or postal letters is attractive, since the attacker does not like going to the post office and it just does not scale.


How/why can Cloud Access Security Brokers be superior to managing access controls locally? I'm studying for the CCSP exam and I'm a little confused on why outsourcing access controls to a third party CASB would be appropriate.  Could someone please explain the rationale there (and ideally perhaps a use case)?

It seems like, if anything, access control is the ONE thing that organizations would prefer to manage locally since it's such a sensitive and powerful thing.

One of the main reasons to utilize a third-party CASB, or any third-party provider, would be to ensure the offering is done "right." In this case, a CASB would have the necessary resources to supply IAM services or other monitoring (depending on the provider) that does it BETTER than you would yourself.

Let's say, you have three members on your team, and none of them have the necessary experience or the knowledge to implement IAM services "correctly" and "securely," utilizing a third-party can provide you confidence that is being done. Of course, that depends on your SLA/Contract.

Stick to what you know, and do well, rather than try to implement a control or mechanism yourself.


Is Gmail showing images by default a good idea for privacy? Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default:

Instead of serving images directly from their original external host servers, Gmail will now serve all images through Google’s own secure proxy servers.

Also, on this page they explain why they think that this is safe:

Some senders try to use externally linked images in harmful ways, but Gmail takes action to ensure that images are loaded safely. Gmail serves all images through Google’s image proxy servers and transcodes them before delivery to protect you in the following ways:

Senders can’t use image loading to get information like your IP
address or location.
Senders can’t set or read cookies in your
browser.
Gmail checks your images for known viruses or malware.

In some cases, senders may be able to know whether an individual has opened a message with unique image links. As always, Gmail scans every message for suspicious content and if Gmail considers a sender or message potentially suspicious, images won’t be displayed and you’ll be asked whether you want to see the images.

This appears to be a step in the wrong direction by giving marketers visibility of which messages have been delivered and then opened. Is this a good idea? Google is possibly compromising the privacy of its users for marketeers that are not necessarily customers of Google.
If I use the Email Privacy Tester with the default Gmail options on, I can see that the sender is notified as soon as I open the email on the web. I could see how Google could be clever about this by removing the tracking information from links, but it appears that this is not the case.
For example if Google processes the same message containing <img src="http://www.example.com/img.jpg?trackingId=1234" /> to multiple recipients, but with different trackingIds they could be clever and show the image to users by requesting the URL without the trackingId, which is initially what I thought may be happening. The algorithms would need to be pretty sophisticated to work out which section of the URL was used if it was not in the query string, and to also ensure that the image received was the right one, but this is what Google excel at if you judge them from their search engine.
What are their motivations for exposing user privacy for the ability to view images by default?

Their motivations are to increase the value of their service, based on cost-benefit analysis of the problem space and their solution.

Pros: Better email experience, most threat vectors of loading images defanged.

Cons: Threat vector of identifying read activity ('read receipt' or 'live email detection') via unique images.

Mitigation: Most of the people who would abuse the remaining con are spammers.  Google also filters spam, lowering the likelihood you'll be confronted with an email that would benefit from this new system.  Also, as long as they provide opt-out, they cover people like (presumably) you who aren't happy with the tradeoff.

Heck, this is Google.  They could load and cache every image from every email upon arrival, negating the remaining con - the attacker finds that every image is loaded, without regard to the status of the inbox or the reader's interest.  Sure, it would take bandwidth and disk, but see step 1, "this is Google."


How to deal with administration tools such as ipscanners and PSTools? In my company (And many others around the world) there is a wide usage by tech teams of tools such as ipscanners, psexec, pskill and other tools.

How do you deal or control the usage of such tools in your environment?

It's common for threat actors after an intrusion to use internal administration tools that are already available within servers and workstations, I would like to prevent.

If you're worried about malicious actors using standard user internal utilities (psexec, pskill) after gaining access to a system, you're worrying about a scenario where no matter what actions are taken in preparation for the intrusion, the attacker will be able to circumvent it, as they already have access to the machine. Making it more difficult to use some of the "power-user" oriented tools on the system will only make it more frustrating for your legitimate users to do their jobs, and won't do anything to prevent the attacker other then mildly inconveniencing them.

However, if you're concerned about tools and utilities that require root/admin level access being used by the attacker after intrusion, you should look into securing your user system (e.g. only giving sudo/admin level access to users signing in with PGP (or if Windows, only from local logins), or only allowing local access to root (only applicable to Linux), etc) instead of trying to limit the tools available in your userspace.


Is this Google mail from gaia.bounces.google.com legit? I've received the following suspicious mail in my Gmail inbox, about my password being exposed:

As you can see, it comes from gaia.bounces.google.com and is signed by accounts.google.com. But there are two weird things about it:

It is written in Portuguese. I live in Spain (but near the border with Portugal, just in case that's relevant) and usually receive Google mail in spanish.

The mentioned account is a @hotmail one I use as backup account, not the main Gmail one. It's been listed on haveibeenpwned.com time ago but I changed all my passwords a few months ago when I started using a password manager.

I cannot see any problem with the signature, and the links on the mail seem legit. I've checked the certificate on the linked website and read this.
Is this legit? Does Google warn about other non-Google accounts?

The email you've received is legit, it is signed with correct certificate of google.
However, you are not the first one to raise a red flag for this one, whole security industry specialised in social engineering is applauding google for great "phishing attempt".
To answer your question, yes google is checking databases of leaked credentials also for your recovery email address.
Chrome has now functionality for checking hashes of your passwords (to any account on any website you're logging into) with their database of leaked credentials. This is part of their safe browsing feature.


SNMP - need help with terminology In many resources, I see that community strings are also called default passwords. But in the Server Manager, I see "Community name" and it makes more sense.
So why people often use the phrase "default password"? If we enumerate the information by their name...

"Community Name" are used in SNMP v1 and v2 as an authentication asset: one presenting the good "Community Name" in his request will be authorized to get/set informations.

That's probably why people call this "default password" ...


How can I put in relation http timestamp with country time zone of the IP? I have a series of packets within a PCAP files,
among them I'm getting packet with HTTP protocol.

starting from IP address I get the timestamp in GMT format and the time zone, for example:

Source IP: 95.172.94.24
http.date: "Sun, 14 Jun 2015 11:33:56 GMT",
time zone: Europe/London

Packet timestamp: 1434280757335 - sun 14 jun 2015 13:19:17 (local timestamp GMT +2)

so in this case http date matches with packet timestamp, but the question is:
is there any case where I could find a gap between the two timestamps?
(for example if the packet had been generated within TOR network)

Thanks in advance

There is just one field for the date in the header.If it is missing the recipient adds one.Taken from http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.18
14.18 Date

The Date general-header field represents the date and time at which the message was originated, having the same semantics as orig-date in RFC 822. The field value is an HTTP-date, as described in section 3.3.1; it MUST be sent in RFC 1123 [8]-date format.

Date = "Date" ":" HTTP-date

An example is

Date: Tue, 15 Nov 1994 08:12:31 GMT

Origin servers MUST include a Date header field in all responses, except in these cases:

If the response status code is 100 (Continue) or 101 (Switching Protocols), the response MAY include a Date header field, at the server's option. 2. If the response status code conveys a server error, e.g. 500 (Internal Server Error) or 503 (Service Unavailable), and it is inconvenient or impossible to generate a valid Date. 3. If the server does not have a clock that can provide a reasonable approximation of the current time, its responses MUST NOT include a Date header field. In this case, the rules in section 14.18.1 MUST be followed.

A received message that does not have a Date header field MUST be assigned one by the recipient if the message will be cached by that recipient or gatewayed via a protocol which requires a Date. An HTTP implementation without a clock MUST NOT cache responses without revalidating them on every use. An HTTP cache, especially a shared cache, SHOULD use a mechanism, such as NTP [28], to synchronize its clock with a reliable external standard.

Clients SHOULD only send a Date header field in messages that include an entity-body, as in the case of the PUT and POST requests, and even then it is optional. A client without a clock MUST NOT send a Date header field in a request.

The HTTP-date sent in a Date header SHOULD NOT represent a date and time subsequent to the generation of the message. It SHOULD represent the best available approximation of the date and time of message generation, unless the implementation has no means of generating a reasonably accurate date and time. In theory, the date ought to represent the moment just before the entity is generated. In practice, the date can be generated at any time during the message origination without affecting its semantic value.


YouTube App Security Update History A friend watched a hacking video on my tablet using an outdated Android OS and an outdated YouTube App, and now I am concerned. No serious signs of entry, but it would be hard to tell since it is normally sluggish, and the security apps do not detect anything.

Is there a site which lists all of the discovered security bugs in the YouTube app since the version that is installed had been released? This way I can at least ascertain the feasibility of such an attack through the video stream on the app player. They did not click on any links, just played the video in the app until I yelled at them. Previous searches return results mainly for the API version history.

Yes, I am paranoid. No, no one is out to get me.

It is highly unlikely that the YouTube app resulted in a compromise. Not only would an attacker have to have XSS on the youtube browser container, they would then have to break out of the app sandbox, and then root the system - which requires a minimum of three exploits. The Google Bug Bounty Program pays out for these kinds bugs, although XSS has been found in youtube before, an attacker will make more money reporting this kind of bug to Google than compromising an old tablet.

YouTube is a service, and is not eligible for CVEs.  Google has no obligations to make public the details of patched vulnerabilities.

Yelling at your friends it not a security measure,  if you are interested in keeping your systems protected - then they must be regularly updated.  If chrome and android haven't received updates, then any website you visit could result in a remote jailbreak - which requires one less exploit. In context, Stackoverflow is far more dangerous than Youtube because google has more money to spend on security.


Secure communication between two REST apis I'm building an application which stands alone for the most part, but which needs to access another system for private user data.

What is a simple and safe method of securing that private data? We would like to make sure that only my known server can access the API.

There are many possibilities to enhance the security:

use HTTPS for transport encryption
authenticate with an API key
only allow connections from specific IP addresses
use certificate pinning (store the server's public key fingerprint and compare it when connecting to prevent MITM)
isolate the two servers from the rest of the network or the internet

As always, there won't be perfect security and you have to decide on how much effort you want to put into securing your data depending on your threat assessment.


Why is filling up at the gas pump require a quick scan of the Credit/Debit card? Always wondered about this. I had a friend tell me it's to make sure your information can't be stolen as easily on the credit card, but I will admit I am a bit skeptical of his claims.

At most gas pumps (as long as you dont pay with the attendant), the gas station usually requires you to insert your card, then just as quickly, "remove the card quickly". I've always wondered what would happen if you decided to leave your card in there, and sit there.

Why do the machines require you to remove the card quickly? Is this some security issue?

The way the magnetic stripe reader works is by detecting changes in the magnetic field of the stripe as it passes under/across the head, similar to a magnetic tape head.  In fact, mag stripes were invented from magnetic tape.  Just like swiping your card at a point-of-sale kiosk, removing the card "quickly" is necessary to read the magnetic field flipping.  (There's a certain minimum rate for the flips to be properly detected, but it varies from reader design to reader design.)  Feel free to leave the card in there, but it just won't be read by the pump.


Why not signing a certificate with more than one Certification Authority A student asked me a good question today when I was explaining the concept of certificates chain.
As I said "if a CA is compromised by an attacker he can emit false certificates for the entities the CA is allowed to sign (e.g all the *.fr)",
he asked me : "why not signing each certificate by more than one CA, let's say 3, so the compromise of only one CA is not sufficient to break the trust and the likeliness to have three CA compromised is far far less than only one."
I think the question is good. Even if it's not currently permitted by the x509 standard, it remains a valid criticism of the current model.
I don't see why the proposed model would not be better but maybe I miss something ?
To be effective this way will need that the 3 signatures were mandatory or that  specific DNS record mentions that the certificates for this domain need 3 signatures to be valids.
EDIT: close to Why do we not require websites to have several independent certificates?

I don't see why the proposed model would not be better but maybe I miss something ?

The approach of requiring multiple valid trust anchors instead of one is a sound approach in theory and is actually used in practice within OpenPGP. There the trust into a key depends on how many trusted endorsers have signed the key and how much trust one itself has into these trusted endorsers etc - a web of trust.
Unfortunately, while this concept is useful in theory, it adds lots of complexity on multiple levels. The technical implementation is likely less a problem as the example of OpenPGP shows. In the simplest case the whole process of CA's would work like before but the TLS server would send multiple leaf certificates with multiple chains like suggested in Why do we not require websites to have several independent certificates?.  See also Multiple CAs signing a single Cert/CSR?.
But apart from the technical issues: how many certificates should be required in which context and from which CA. Are there any CA which are more trusted than others, depending on the context (like CA from China are less trust in US and CA from US are less trusted in China). How many less trusted CA together can achieve the same trust level as one more trusted CA etc. One cannot expect this decision from most end users, so browser makers and certificate authorities have to make the decision for the end user - with many discussions and likely also nasty politics involved. In other words: there is lots of organizational complexity on top of the technical problem and this is likely the harder one to solve.
And what is actually the gain for the end user? If it is about reducing the risk into a single CA (i.e. compromise) - there are other approaches for this. With CAA one can restrict which CA is allowed to issue certificates for one owns domain (although this is only checked by the CA itself), Certificate Transparency ensures that no "hidden" certificates are in use but everything is done in the public,  blacklisting of CA or sub-CA which showed problems contains the impact of a compromise. This is far from perfect, but much less complex and disruptive then the proposed approach.
In summary: the approach by itself is sound. Implementation in practice is limited by technical and organizational problems. Also additional hardening of the PKI system was done by other approaches already so that there is less need to implement such approach.


Ranking of web security conferences I have prepared a paper to publish in a web security conference. How can I know the ranking of available conferences to know which conference is better? For example, should I look at their sponsors?

If you are asking about an academic peer-reviewed conference on web security, I have some thoughts for you.

First, the four most prestigious peer-reviewed conferences in computer security are generally considered to be IEEE Security & Privacy ("Oakland"), Usenix Security, ACM Computer and Communication Security (CCS), and ISOC Network and Distributed System Security (NDSS).  Folks will debate the order, but most people will probably say that Oakland is the most prestigious of these and NDSS the least.  All of those conferences will accept web security papers, if they are strong enough.  Usenix Security and NDSS probably are the conferences that are most closely aligned with web security.  Papers have to have an exceptionally strong contribution to be accepted at these top-four research conferences.  If you are active in the computer security research community, you probably already know about these four.

Second, there are other peer-reviewed conferences and workshops that focus specifically on web security.  W2SP is a fantastic workshop that accepts many strong research papers on web security each year.  You could also look at WWW and Usenix WebApps; their focus is on web technology in general, but they tend to accept several security papers each year.  If you are active in the computer security research community, you should already know about these conferences, I'd hope.

Finally, there are many other peer-reviewed security and web conferences that accept good web security papers.  For example, you might look at ones like ESORICS, ACSAC, DIMVA, RAID, and too many others to list.

One last piece of advice: Before submitting to any of these conferences, you must first become an expert on the published peer-reviewed literature on this topic.  Read through the proceedings of the last few years of the conference.  Also, read the other published work that is related to your own research.  There is a tremendous amount of prior work on web security; it is important that you be familiar with it and able to articulate how your work fits into the past work and how it advances the state of the art.  If you are not familiar with the related work, and not familiar with the standards of the conference, it is not likely that your paper will be accepted by the conference's program committee.


wfuzz default number of connects in parallel per target? In Hydra, default number of connects in parallel per target is 16 and it can be changed with -t flag.

E.g. -t 100 for 100 connection in parallel per target.

wolf@linux:~$ hydra -h | grep parallel
  -t TASKS  run TASKS number of connects in parallel per target (default: 16)
  -T TASKS  run TASKS connects in parallel overall (for -M, default: 64)
wolf@linux:~$

What about wfuzz? I did not see this info in it's help menu. Is it possible to change it's value?

wolf@linux:~$ wfuzz -h | egrep -i 'thread|parallel'
wolf@linux:~$

In this blog post https://resources.infosecinstitute.com/wfuzz-and-webslayer/ It shows that the default threads Number Is 20 and you can set the Number of thread Udine -t flag


Does GnuPG check for revocation certificates on keyserver automaticaly? If a key was revoked, I may not know if the revocation key was published just after I downloaded the key with gpg --recv-key.

Does GnuPG grant that it is up to date before using a key? Or do I need to run gpg --refresh-keys every time I encrypt of verify a signature?

GnuPG does not automatically fetch or refresh keys when using them. You should update your keyring regularly and on occasion, especially if you fear revoked keys.

For this reason, it is reasonable to notify known users of your key when revoking it.


Unusual design aspects of AWS HMAC-based authentication, v4 I am designing a RESTful API in python. I want to use HMAC authentication. I could not find any suitable HMAC libraries, so I am rolling my own. However I want to use a well-known standard such as AWS HMAC authentication v4.

While coding an AWS-compliant client and server HMAC auth implementation, I noticed some uncommon aspects of the standard's design. I fail to fully grasp several design choices that were made.

Question 1: Why does AWS use a complex signing key (produced via HMAC) instead of the shared secret itself?

Task 3: Calculate the AWS Signature Version 4 describes:

  Before you calculate a signature, you derive a signing key from your AWS secret access key. (You don't just use your secret access key to sign the request.) You then use the signing key and the string to sign that you created in Task 2: Create a String to Sign for Signature Version 4 as the inputs to a keyed hash function. The hex-encoded result from the keyed hash function is the signature.

  To calculate a signature

  Derive your signing key. To do this, you use your secret access key to create a series of hash-based message authentication codes (HMACs) as shown by the following pseudocode, where HMAC(key, data) represents an HMAC-SHA256 function that returns output in binary format. The result of each hash function becomes input for the next one.

  Pseudocode for deriving a signing key:

kSecret = Your AWS Secret Access Key
kDate = HMAC("AWS4" + kSecret, Date)
kRegion = HMAC(kDate, Region)
kService = HMAC(kRegion, Service)
kSigning = HMAC(kService, "aws4_request")

Question 2: I do not understand the purpose of the 'credential scope' string.

In steps 2-3 of Task 2 (Create a String to Sign for Signature Version 4), a date and credential scope value are appended to the string that is signed. What is the purpose of these values?

The standard already signs the UTC timestamp in the x-amz-date header, as part of the canonical request that was prepared in Task 1. The same is true of the region specifier (us-east-1), since it should presumably be reflected in the Host: header.

  Append the request date value, followed by a newline character. The date is specified by using the ISO8601 Basic format via the x-amz-date header in the YYYYMMDD'T'HHMMSS'Z' format. This value must match the value you used in any previous steps.

20110909T233600Z\n

  Append the credential scope value, followed by a newline character. This value is a string that includes the date (just the date, not the date and time), the region you are targeting, the service you are requesting, and a termination string ("aws4_request") in lowercase characters. The region and service name strings must be UTF-8 encoded.

20110909/us-east-1/iam/aws4_request\n

  The date must be in the YYYYMMDD format. Note that the date does not include a time value.

I could not find any suitable HMAC libraries

Err, the standard library has one. So does the cryptography library.

  Question 1: Why does AWS use a complex signing key (produced via HMAC) instead of the shared secret itself?

One good reason I can see for doing it this way is to avoid a leaked signing key compromising the entire AWS account. Deriving a signing key from a combination of the secret key, region, a specific service and other values ensures that different things use different signing keys.

  Question 2: I do not understand the purpose of the 'credential scope' string.

The "credential scope value" (20110909/us-east-1/iam/aws4_request\n) probably helps Amazon to assert that a particular request is targeted at the region and service. I don't see why the date is included so many times but it may have just been an oversight when Amazon is designing the process.


Is there a static way to discover all Http requests made by an Android application? Imagine the following scenario:

I want to check how secure is an Android application
I have access to it's source code
I suspect that some sensitive information is being passed via Http instead of Https in some features
I could intercept the traffic and see if it uses http or https (Using a tool like Burp Suite), but the application is really big it would take a long time.

So, is there some way (like a script) that I could sweep through the source code and list places where a http is being used? So I could analyze individually?

I found an interesting module for the tool Drozer that meets the needs that I previously had and helped me in my task. So I decided to post an answer here if anyone is interested too.

The modules description:

  Finds URLs with the HTTP or HTTPS schemes by searching the strings
  inside APK files. You can, for instance, use this for finding API
  servers, C&C servers within malicious APKs and checking for presence
  of advertising networks.


How to delete one exe file that is probably malware? I stupidly saved an .exe file that claimed to be an urgent Firefox patch (318K).

I haven't (and won't) run it, but how can I delete it so that it's gone, i.e. no risk to my Win7 laptop?

I thought of opening a large file (like a photo) and saving that as the malware file name, hoping to overwrite it... but after looking around here feel doubtful that that would work. Kaspersky AV didn't find any problem with it but I want it gone.

As it happened, I couldn't attend to this for the last few days, and in the interval Kaspersky learned to recognize it. I went looking for the file, and found it in quarantine--where I'll leave it.

Thank you everyone for your answers. I guess I had the idea that even if a malware file was deleted, it might somehow have the ability to self-activate, or accidentally be activated in some way. It's a relief to know they're not quite as magical as I imagined.

Malware files by themselves are not special in any way, they're just like any other file albeit with a malicious purpose.

So, you can simply delete it as you would any other file. If for some reason you feel that someone (yourself included) might go digging through your computers recycle bin, you can also empty it to prevent accidental retrieval.


SSH Timed out problem I can't connect to my kali linux ssh server running in Virtualbox through puTTY. I didn't make any changes to /etc/ssh/sshd_config file, besides Port and PermitRootLogin

That's how i booted up my ssh server (openssh-server installed)

root@yasumi404kalimain:~# service ssh start
root@yasumi404kalimain:~# service ssh status
● ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; disabled; vendor preset:
disabled)
   Active: active (running) since Fri 2019-06-14 13:15:13 EDT; 3s ago
     Docs: man:sshd(8)
       man:sshd_config(5)
Process: 1694 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
Main PID: 1695 (sshd)
Tasks: 1 (limit: 4915)
Memory: 1.2M
CGroup: /system.slice/ssh.service
       └─1695 /usr/sbin/sshd -D

июн 14 13:15:13 yasumi404kalimain systemd[1]: Starting OpenBSD Secure Shell server...
июн 14 13:15:13 yasumi404kalimain sshd[1695]: Server listening on 0.0.0.0 port 6886.
июн 14 13:15:13 yasumi404kalimain sshd[1695]: Server listening on :: port
6886.
июн 14 13:15:13 yasumi404kalimain systemd[1]: Started OpenBSD Secure Shell server.
root@yasumi404kalimain:~# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
    inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255
    inet6 fe80::a00:27ff:fe1b:142c  prefixlen 64  scopeid 0x20<link>
    ether 08:00:27:1b:14:2c  txqueuelen 1000  (Ethernet)
    RX packets 3  bytes 778 (778.0 B)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 26  bytes 2260 (2.2 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
    inet 127.0.0.1  netmask 255.0.0.0
    inet6 ::1  prefixlen 128  scopeid 0x10<host>
    loop  txqueuelen 1000  (Local Loopback)
    RX packets 18  bytes 1038 (1.0 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 18  bytes 1038 (1.0 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

And that's what I got when tried to connect.

When tried to connect via Andrax on android, being connected to the Wi-fi router which is in the same LAN as the computer.

And when I also tried using puTTY in the host system of virtual machine.

How do I solve this problem? Also, will I be able to connect to ssh server while being not in the same network, or I will need a static IP to do that?

I apologize in advance if mistake I made is silly, I'm new to infosec.
I will be happy to provide additional information/logs if needed.

UPD: I tried changing ListeningAddress to 10.0.2.15, result is still the same. (i restarted the ssh server and tried to connect)

The problem is that I didn't connect my Virtual machine to the bridge adapter, so I can't get access to it. I should've just add it in the VM's settings, and all started to work well!


Does running Windows XP pose a security threat to the whole internal network? I have a laptop that is not capable of running any versions of Windows above XP reliably, but that I want to connect to use to browse web using the last version of Firefox available for Windows XP. I don't care about this laptop's security at all, as there is nothing of value, but I wonder if running such a device on a network poses a security threat to all other devices on this network if it gets compromised?

And what are the attack vectors and known exploits that could use a Windows XP machine as a leverage to break into more protected devices on this network?

There is nothing specific to XP that poses a threat to other machines on the network. The fact that it can be controlled by a malicious actor is the threat that it poses. With XP, this threat is more likely than with other operating systems and patch levels.

So, putting aside the specific operating system, the threat is that it can be used to pivot and allow an attacker to worm across the machines in the network. The risk of a malicious actor connecting their own attacking machine on the network is the same as a compromised machine under an attacker's control.

The defense is to segment the network and to harden the other machines on the network as if the network is hostile. A DMZ is one way of doing this, so is ZTN and microsegmenting.


Is using JSON a secure way of handling sql queries in python? The question

I will try to articulate this as clearly and best I can:

Suppose that I have a python program which connects to a database on a server. Next I ask you to consider that this python program grabs Mysql queries from a JSON file, python reads them, and then they are used to make the database do something. Is this secure? Why don't others do the same? Have I made some kind of grave error in doing this? Is this vulnerable to SQL injection or the like?

I apologise for asking what is more than one question. I suppose I really want to know if this is a good or a terrible idea.

Context

I have no experience with security and began using python for server side stuff a week ago. I'm mostly doing this to learn. I'm trying to put together a website that uses python and Mysql to handle the database. This means:

At some point this code will reach production.
Because: 1) I'm not too good with security and 2) People will actually be using this I'm very anxious about how secure the code might be.

My goal when beginning this code was that I wanted a very easy and efficient way of making secure queries to my MySql database. As a result, I kept all of my queries in a JSON file, which python then reads and returns into a function decorator that makes a connection to the database.

The code

# Imports
import json
import mysql.connector

# Class which reads json files
class json_read():
    def __init__(self,name):
        self.name = name
    def json_caller(self):
            with open(self.name) as f:
                f = json.load(f)[0]
                return f

# Returns the file needed to connect to the database
f = json_read("database_connect.json")
config = f.json_caller()

# Function decorater used to initiate the connection to the database
def mysql_connect(func):
    def wrapper(*args, **kwargs):
        try:
            cnx = mysql.connector.connect(**config)
            cursor = cnx.cursor(prepared=True)
            cursor.execute(*args, **kwargs)
            result = cursor.fetchall()
            print("\nConnection is stable @ the function " + func.__name__)
            print(result)
        except:
            print("\nConnection failed @ the function " + func.__name__)
    return wrapper

# Returns the line from the json file associated with the key
class query_dbh():
    f2 = json_read("queries.json")
    def __init__(self, index):
        self.index = self.f2.json_caller()[index]

@mysql_connect
def output(*args, **kwargs):
    pass

# Select_names is the key
output(query_dbh("Select_names").index)

How the queries are stored:

[
{
    "Select_names" : "SELECT first,last FROM user",
    "Select_id" : "SELECT id FROM user"

}
]

What you want to do is used stored procedures. This is built into MySql itself. It will help prevent risks of SQL injection, and potentially speed up your application because the query won't need to be compiled and planned every time it's executed.

OWASP has a great resource about how to prevent SQL injection. Here's the relevant section to stored procedures listing their benefits and drawbacks. https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet#Defense_Option_2:_Stored_Procedures


Logging server compromised (IptabLes and IptabLex) I am trying to figure out how it was compromised. They installed IptabLes and IptabLex in /boot.

They also added /etc/init.d/IptabLes and /etc/init.d/IptabLex which simply call the respective /boot files. It seems this attack uses a lot of bandwidth (probably a DDoS); I noticed it immediately.

The server is running CentOS 6.5 with all the latest updates.

It runs logstash, redis, ElasticSearch, and Cherokee webserver serving Kibana.

I am thinking it must either be ElasticSearch or Cherokee web-server.

ElasticSearch port (9200) was open to the world, because Kibana requires it to view the nice graphs. Redis ports (6379) were restricted to only 5 known hosts via iptables.

Cherokee webserver runs on port (8080) not default of 80 and was open to the world.

SSH does not seem to be compromised. The server uses keys and no password authentication

is allowed. We run SSH on port 2020, which is listed as (xinupageserver) in iptables.

Here are the iptables rules. Notice redis is restricted to web hosts,

but http via Cherokee (webcache) and ElasticSearch (wap-wsp) are open.

➜  ~  iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:xinupageserver
ACCEPT     tcp  --  web1.mydomain.com     anywhere            tcp dpt:6379
ACCEPT     tcp  --  web2.mydomain.com    anywhere             tcp dpt:6379
ACCEPT     tcp  --  web3.mydomain.com     anywhere            tcp dpt:6379
ACCEPT     tcp  --  web4.mydomain.com     anywhere            tcp dpt:6379
ACCEPT     tcp  --  web5.mydomain.com     anywhere            tcp dpt:6379
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:wap-wsp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:webcache
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Thanks so much for the help.

You should never leave Elasticsearch open to the world, in the same way as you wouldn't leave any database server open to the world.  Always put a proxy in front of it and use (at least) HTTP auth.  Preferably, your proxy should limit what can be done from outside, eg only allowing GET requests, otherwise any user could delete all your data or shutdown your servers.

From version 1.2.0 onwards, dynamic scripting (passing a script as part of eg a search request) has been disabled by default.  On older versions it is enabled by default, meaning that any outside user could do anything on your server that the Elasticsearch user can do.

If you're running an older version, you want to add this to your config/elasticsearch.yaml:

script.disable_dynamic: true

See http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/modules-scripting.html#_enabling_dynamic_scripting for more, and http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/url-access-control.html#url-access-control


What OID Issuance Policies are appropriate for SmartCard and Browser Certificates? I'm investigating issuance policies for SMIME and Browser certificates with different levels of assurance.

For the purposes of S/MIME and Browser certificates, should I even use an assurance policy?

Should the assurance policy apply at the End Entity certificate or at the CA?  ... both?

How should I generate my OIDs?

Should I use this custom Microsoft VBScript to generate a random OID?
Should I register with a central authority such as ANSI or the ISO?
Should a use a pre-existing OID (for compatibility reasons) 2.5.29.32.0 or 1.3.6.1.4.1.311.21.8.x.y.z.1.400 (source)

Finally, I'm assuming that I shouldn't mark the assurance as critical, especially if I use a custom OID.

What Microsoft calls "issuance policies" or "assurance" are known as Certificate Policies in X.509 (see section 4.2.1.4). A certificate policy is defined as such:

  In an end entity certificate, these policy information terms indicate
     the policy under which the certificate has been issued and the
     purposes for which the certificate may be used.  In a CA certificate,
     these policy information terms limit the set of policies for
     certification paths that include this certificate.

The whole idea of an OID is to uniquely and unambiguously identify an "object" (which can really be anything, including abstract concepts) in a worldwide naming hierarchy. As such, randomly generated OID totally defeat the purpose and cannot be condoned. In the case of certificate policies, the OID should "point" at a specific policy, i.e. a document which defines the conditions under which the certificate was issued and for what it may be used. You should obtain an OID subtree: any organization can obtain its own subtree from the IANA (it's free and permanent). Then you allocate the OID in that subtree in any way that you sees fit.

That being said, certificate policies make sense as part of the certificate validation process described in section 6 of RFC 5280 (see in particular step (a) of 6.1.2, (d), (e) and (f) of 6.1.3, and step (g) of 6.1.5). The validation process computes the set of certificate policies which are valid for the whole path, i.e. which appear in every certificate in the path. There are various subtleties, notably with regards to the special wildcard anyPolicy (that's 2.5.29.32.0, which Microsoft calls "All Issuance") and the policy mappings. However, if one of the CA certificates in the path does not have any Certificate Policies extension at all, then the vallid_policy_tree will be NULL, i.e. it all comes to naught. The certificate path will be validated "generically" but no specifically identified policy will come out of it.

The sad truth is that many CA use certificates in the way Microsoft promotes it, i.e. completely wrong with regards to what they were supposed to do; instead, they use certificate policies as a kind of fancy comment which software will consistently ignore (policies can be adjoined qualifiers, which can be plain text or a URL pointing to something which may or may not be a readable document).

Since certificate policies are so thoroughly misused, it is not useful to make the extension critical. In practice, you add the extension with a URL pointing to a 200+ page Certification Practice Statement as a PDF file, which at least demonstrates that you are serious about your CA business, to the point that you are willing to indulge in some heavy legalese. See RFC 3647 for guidance on writing a CPS.


Does an email signature increase security? I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to exchange a symmetric key then use this key to encrypt emails via AES.

When Eve doesn't know the key, she can't modify ciphertext to change Alice's or Bob's message or send a fake message that claim is from Alice or bob because when they try to decrypt that email with the key exchanged before, decryption fails.

I think even MAC is waste of energy. What's the point of signatures here for every new email?

A symmetric key can certainly transmit data securely from Alice and Bob.  When they use a symmetric key, they can be sure that:

the mail was not tampered with in transit
the mail was not viewed in transit

The PGP key exchange will allow them to work out a way to trust each other, traditionally in a Web of Trust model.  The trick with PGP is that until later versions, there was not creditable authority that both Alice and Bob depended on - that's the big variation between PGP and a PKI system that provides email signatures and encryptions in most mail clients.

The issues are in in several parts:

in a symmetric key exchange, there is risk added with each person who knows the key.  If Alice and Bob want to resend the mail to Charlie, either they will have to share the symmetric encryption key with Charlie or either Alice or Bob will have to create another encryption key for sending Charlie.  If there will be multiple mails between Alice, Bob, and Charlie, there could be 3 keys (Alice/Bob, Bob/Charlie, Alice/Charlie) - this increases exponentially as more people join in the conversation.
point to point encryption does not prove lack of tampering between the points.  If Bob mails a mail to Alice, and Alice gets ticked off and forwards the mail to Charlie saying "Look what Bob wrote!", there's no proof that the mail actually came from Bob if the encryption was from Bob to Alice and then Alice to Charlie.  Alice could have faked it or modified it.  However, if Bob had signed the mail to Alice, and then Alice forwarded Bob's mail to Charlie, Bob could not easily claim that Alice messed with it, so long as the signature remains intact.  The email and signature can be stored indefinitely, and in the clear with this method of security.
Assymmetric encryption (typical email encryption when you use a mail client) is based off of having a repository of known credentials of other users on hand and knowing exactly what key pair to use to route a mail to any given recipient.  This mitigates the key distribution problem - I have a safe repository of secure methods to send to anyone in the system, and we didn't have to exchange keys.  If someone looses their key pair, only the mails they themselves have received will be compromised.  If we used a symmetric key pair as a group, all group communications would be at risk.

All that said, setting up key pairs, and directory services serving certificate credentials for a group of people is a non-trivial task.  Making a self-signed certificate is pretty easy, but also pretty worthless - the value is having it in a system with shared trust coming from a common source, and creating that system and maintaining it requires some effort.

It's not overkill, but it's not easy - so it's the sort of thing you bother with when there's a value to non-repudiation (Bob can't deny that he mailed the mail), and private communication across a larger group of people.  For two people the value is much, much smaller.


Creating a DDoS attack using DirectConnect I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and here).

To quote from one of the references:

  These are the steps of a file download in DC protocol:
  D = downloader
  U = uploader
  H = hub
  1. D>H: $ConnectToMe  |
  2. H>U: $ConnectToMe  |
  3. U>D: TCP Connection to D’s IP and port

  ...

  The attack uses a vulnerability in the DC++ hubs (Verlihub-0.9.8c, Verlihub-0.9.8d-rc1, Ynhub <
  1.0306, Ptokax < 0.3.5.2), respectively in the Client-to-Client communication described above.
  The vulnerability is in step 2, when the hub forwards the $ConnectToMe request to the Uploader client
  without verifying it. So the Downloader can put any IP address and port it wants in the $ConnectToMe
  request and the receiving client (Uploader) will connect to that address, trying to continue the file
  download protocol....

But I am falling short of a good tool which will allow me to tamper/forge packets for my purpose.

ngrep gave me good hope, but I guess the project isn't maintained anymore.

Any suggestions on what tools will allow me to tamper with all kinds of packets?

Edit: Being concerned over the low views and no answers/comments, I felt that I should clarify what I am looking for- I need something  on the lines of what Wireshark does as a packet sniffer- sniffs all varieities of packets. But I don't want to just sniff packets, I want to tamper them. There are many available tools to tamper with HTTP requests (like
fiddler). But I need something to deal with all kinds of protocols - IP, TCP, UDP and HTTP headers and payloads.

I think what you are looking for is Scapy. It can do all you request and more and is under active development.

"Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more."


Trouble understanding SAQ A question 12.8.5 I encountered this question in SAQ A form and the question states:

Is information maintained about which PCI DSS requirements are managed by each service provider, and which are managed by the entity?

Who would be the entity in this case?

The entity would be the entity being assessed. The third parties would be the Payment Service Provider handling the transactions on behalf of the entity being assessed. There should be an understanding by the entity being assessed what are the compliance responsibilities being taken on by the Service Provider. This knowledge will allow the entity perform due diligence and monitor the Service Provider is satisfying its compliance requirements.


RDP Authentication with domain credentials There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good.

But with a domain account, how is done the comparison ? How does RDP authentication works in this case ?

Kindly

RDP uses a protocol called CredSSP to delegate credentials. The process works like this.

MSTSC prompts for credentials (or uses saved creds)
MSTSC requests a network logon ticket (Kerberos or NTLM) to the machine typed into the "computer" field using the credentials from (1)
A TLS session is established with the remote machine (this is why you sometimes see the yellow dialog indicating the typed name doesn't match the certificate name)
The ticket from (2) is sent to authenticate the client machine
A response to the ticket from (2) is sent to client to authenticate the target machine
An encryption key is negotiated between the client and server
The client encrypts the credentials typed in (1)
The target decrypts the credentials and passes them to the logon process
The logon process does a Kerberos auth of those credentials and starts your desktop session

The last little bit is no different than when you walk up to a computer and type your credentials in physically. You can also substitute password with smart card or certificate.

The security of this exchange lies in the fact that you used Kerberos to verify the identity of the target machine is one you trust because the name matches a service in Active Directory (yes, you're delegating that trust decision, but if you can't trust AD you're screwed anyway).


Secure flag for ASPXAUTH Cookie in MVC We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool.

Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's developer tools, there are some cookies with Secure flag. But ASPXAUTH was not one of them.

Already I have included below line of code in Web.Config file.

<httpCookies requireSSL="true"/>

Note : We are not using Forms Authentication for login.

What is the correct way to mark ASPXAUTH as secure?

I'm going to hazard a guess and say that this flag in your config is being ignored:

Looking at the httpCookies docs it says that "This setting is overridden by any other feature that exposes the requireSSL configuration"

One way to ensure that it is set would be to do it in dedicated code.

This Stack Overflow answer has an example

Basically before the response is complete in protected void Application_EndRequest(Object sender, EventArgs e) in Global.asax you check for the correct cookie and set the .Secure property to true


Mac laptop security on insecure wifi connections I'm going every year at big IT conferences (3k->4k people). Everyone is connected to the internet with wifi on laptops. This wifi is open, everyone can read the traffic and analyse it... The risk is nearly the same on wifi in hotel, hotspot etc.. except you have a concentration of interesting informations and hacking competencies at the same place...

I use those precautions on my mac :

use SSL everywhere
avoid to sent sensitive data even on encrypted link
encrypt data on disk
take the laptop with you everywhere
antivirus
update Mac OS X to the last version

Is there other security measure to take on mac ?

Thanks in advance

What's the threat model?  With the exception of particularly hostile environments (DEF CON, for example), I just connect to a VPN and move on with things.  I believe I have my laptop hardened adequately to protect against general malware, theft, etc., by:

Don't run network exposed services.
Firewall in case I screw up #1.
Patched.
VPN.
Full Disk Encryption.  (This is the theft bit.)

If you're worried about Evil Maid Attacks or other targeted attacks, you'll need to take more precautions, but if it's just general malware/bored script kiddies you're concerned with, then patch, run a VPN, and enjoy the conference.


Should content from database be sanitized again Suppose I save content into the database after sanitizing it. Is there still a need to sanitize it again when retrieving it? If yes, why?

"Sanitize", by itself, is meaningless. There is no such thing as "dirty data" as opposed to "clean data". When people think of data being "sanitized", they really mean "data which has been verified to be in a format suitable for a specific processing". For instance, if the purpose of the data is to be embedded into some SQL statement, then "sanitation" of the data involves making sure that it contains none of the characters that the SQL parser will consider as special (typically, no quotes).

A better word is validation. Whenever you must use some data, and the data is "potentially hostile" (it could have been crafted at some point, more or less directly, by an attacker in order to trigger unwanted behaviour in your code), then the data must be verified to be appropriate for the intended processing. If you "saved content into the database after sanitizing it" then chances at that you made sure that the data was in proper format for the purpose of storing it in the database. Depending on the validation steps needed to ensure safe storage, and what you intend to do with the data when you retrieve it, then this may or may not be sufficient.

For instance, suppose that the data element is obtained as some characters from the user, and should be stored in the database. The data element is supposed to be a number. However, the database-storage thing only minds about "special characters" and thus sees no problem in storing "BozoWasThere" in the database. In that sense, the string was sanitized (and the storing went very fine) but it still not a number, so this would warrant for further sanitation after retrieving it.

The concept of "sanitized data" is a great source of confusion. It is some mantra that many developers ritually utter ("sanitize all things !") because it give them the feeling that they did something about security, without having to perform that most inconvenient action known as thinking. In the long term, this does not work well.


Proper way to allow access to systems within different offices? I have a system that sysadmins in a few of our global offices need to access.  What is the best way to grant them access through our firewall to this system?  I don't think that having them use static IPs and then using the firewall to allow those specific IPs access is a scalable or great solution.

Some more information:

We have a firewall that groups many of our systems into separate VLANs. Our disparate offices connect either through VPN, or through an MPLS connection.

So for example, someone in Italy needs to access a web application hosted in the US. This would require the network team to tweak the ACLs to ensure that the individual there can access the system.

Separate physical locations can share the same logical network using a VPN.  A client's IP address can be used in a multi-factor authentication system, but a password and a Key FOB is more commonly used.


Is there such a thing as application-specific encryption? I am looking for a way to encrypt certain files (.jpg, .pdf, standard file extensions) such that they can only be opened by a certain application (assuming this application will have the relevant file viewer included with it).

It would seem that the way to go about doing this is to have some encryption scheme specified by the application client; to encrypt a file, it must be done through the client - thus to open the same file, only the application can understand how to open it.

How should I go about trying to implement this application-specific scheme, using standard encryption techniques (if possible)?

Pardon my ignorance, I am very new to information security.

There are several ways to do this but basically you are describing something of a digital rights management problem.

There are some open-source DRM programs like OpenIPMP which may help but there are probably other ways to solve your problem without using DRM.
https://sourceforge.net/projects/openipmp/

You didn't provide a lot of information about your needs or limitations but if it's an option the application could simply send the data to a remote site for decryption such that the application itself would never have access to a copy of the decryption key at any time. This could even be implemented as something of a streaming service of sorts.

Similarly you could implement a type of certificate-based PKI USB authentication token (hardware key). Again this type of solution is aimed at protecting the decryption key from other applications.

There are probably hundreds of ways to solve this problem but you may have to look at your limitations and options from a different perspective.

As much as I'm not a fan of DRM software solutions recently I've been seeing an increased need for easy to implement / free / open-source DRM solutions. It's an interesting problem to have.


Can someone use my phone as a proxy? I was recently contacted by someone who claimed my phone had logged into their snapchat. Upon checking it was indeed my phone, all the details and IP matched. But I didnt log into their snapchat and am confident no one else had my phone at the time. Is it possible my phone is being used as a proxy?

Yes. One built-in way is the "WiFi tethering" functionality, where you share your 4G internet connection over WiFi.

Another possibility is that some app or malware is being used to proxy network connections through your phone.


How to manage company passwords when employing temporary freelancers? I am from a marketing firm which now has a development team, which i am part of. We have been tasked with finding a few freelancers who can come in and work when either me and the other developer is off, on holiday, ill etc. Now, in these circumstances, we don't want the freelancers to be asking questions all day, and so a Developer Guide was deemed a good idea. However..

How do we manage the password control for these freelancers?

Giving them the root passwords to everything we've worked? This choice isn't supported by us.
Creating a new user for every website would also be time consuming. Not only that, but paid services or accessing our clients services would also require a new login, creating costs and hassling high profile clients for some logins that would rather not be bothered.

How else does anyone manage passwords for temporary freelancers? Attempt to trust them or go through the hassle of creating temporary logins?

Or is there a 3rd option we haven't considered yet?

In that situation where creating user accounts is prohibitive or impossible (in the case of some hardware devices) my approach is to have the requisite usernames/passwords stored in sealed envelopes (that can't be seen through.)  That way they will only see what they need and when you return you'll know which passwords they've seen and so can reset and set up a new envelope for the next time.

Note: - This is only something you should use if you absolutely must by the way, if you can create accounts you always should and where possible your admin/root account should not be your 'user' account - even for yourself!