Symmetric encryption with different encryption and decryption keys In the book, Applied Cryptography by Bruce Scheier, in the foundations chapter he defines symmetric encryption algorithms as

  algorithms where the encryption key can be calculated from the
  decryption key and vice versa.

Then he goes on to say (caps added by me):

  In most symmetric algorithms, the encryption key and decryption key
  are the same.

As per the definition it is clear that the encryption and decryption keys need not to be the same in a symmetric encryption algorithm.

Can someone please give me an example of such algorithm where the keys are not the same? Does any extra security added if one key is derived from the other or in other words why do we choose to have same key for encryption- decryption (other than the simplicity of use).

That encryption and decryption keys are not identical occurs in almost all symmetric encryption algorithm, from a certain point of view. For instance, if you consider DES, from the 56-bit key are computed 16 48-bit subkeys (through the key schedule). These 48-bit subkeys are what is used for encryption. So, it could be said that the actual DES key for encryption is a sequence of 384 bits (16×48). Then, if you consider decryption, the algorithm is identical except that the order of subkeys is reversed. In that sense, DES uses distinct keys for encryption and decryption.

This is not a very relevant concept. It has no implication on security. Symmetric encryption is called symmetric because the power to encrypt is equivalent to the power to decrypt: if you can encrypt then you know enough to decrypt the data as well. Even if the sequence of bits used at some point in the algorithm for encryption and the one for decryption are distinct, either can be recomputed efficiently from the other, so they represent the same knowledge.


Where can I find exploit code? I am doing VA/PT on a sample web application. I run the Nessus scanner and I found some high severity vulnerabilities that are related to HP System Management Homepage. The CVE-numbers are:

CVE-2010-1917
CVE-2010-2531
CVE-2010-2939
CVE-2010-2950
CVE-2010-3709
CVE-2010-2950
CVE-2010-4156
CVE-2011-1540
CVE-2011-1541

I am trying to find exploits and tutorials to exploit these vulnerabilities. I searched on exploit-db.com, http://www.securityfocus.com and http://web.nvd.nist.gov.

I am getting the vulnerability details but unable to find the exploits. I found exploit code for CVE-2010-3709 on exploit-db.com but unable to understand how to use it?

Can anybody please tell me the sites where I can get exploits for these?
If anyone can explain me how to exploit those vulnerabilities, I will be very thankful to him.

For the 2010-3749 issue, presuming you're looking at this exploit it doesn't really look like a canned exploit, more like an explanation of the issue. It would require for the application in question to make use of the vulnerable function for it to be exploitable.

Indeed, having a quick look through some of the issues that you've linked they look to be PHP language level issues. With this kind of problem, unless the codebase on the target system makes use of the vulnerable functionality, it may well not be exploitable. It could well be that Nessus is reporting vulnerability based on a received HTTP header which indicates an old version of PHP in use.

This doesn't necessarily mean that that the system in question is actually vulnerable

In addition to the sites you've mentioned I tend to look at cvedetails.com for any metasploit modules which may target the affected issue.

you could also try secunia.com and search for issues based on the product, as opposed to looking at language level issues.


How can I know if the cyber-protection offered by my ISP is worth the extra cost? My ISP offers a "cyber protection" service at an extra cost. They say it "identifies and blocks privacy attacks, credit-card scams, identity thefts and hacker attacks against computers connected to your home network", but do not say how they do this.

Is there a test I can make, in order to see if their cyber-protection is worth the extra cost, or maybe I should look for cyber-protection elsewhere?

My ISP (SFR, French one) also sell this option.

It basically consists of a "security app" for Windows/Mac OS X/iOS/Android that implements antivirus, anti-malware, browser analysis, etc...

It's more or less the equivalent of Avast, Kaspersky, etc...

Since I wouldn't "buy bread from a butcher", I didn't buy the "security app" from SFR.


How to decrypt AES CCM with salt on Windows? I have an old file that contains some important information. I know the password, except I forgot how I generated it, and as a result don't know how to decrypt it.

Here it is (decoded from it's original base64):

{"iv":"HNpO0wJzMdTRl/2B0q4pPA==","v":1,"iter":1000,"ks":256,"ts":64,"mode":"ccm","adata":"","cipher":"aes","salt":"....", ct": "...."}

I can't figure out how to decode AES CCM. I've got openssl on Windows and Cygwin and neither seem to show support:

Windows:

Cipher commands (see the `enc' command for more details)
aes-128-cbc       aes-128-ecb       aes-192-cbc       aes-192-ecb
aes-256-cbc       aes-256-ecb       aria-128-cbc      aria-128-cfb
aria-128-cfb1     aria-128-cfb8     aria-128-ctr      aria-128-ecb
aria-128-ofb      aria-192-cbc      aria-192-cfb      aria-192-cfb1
aria-192-cfb8     aria-192-ctr      aria-192-ecb      aria-192-ofb
aria-256-cbc      aria-256-cfb      aria-256-cfb1     aria-256-cfb8
aria-256-ctr      aria-256-ecb      aria-256-ofb      base64
bf                bf-cbc            bf-cfb            bf-ecb
bf-ofb            camellia-128-cbc  camellia-128-ecb  camellia-192-cbc
camellia-192-ecb  camellia-256-cbc  camellia-256-ecb  cast
cast-cbc          cast5-cbc         cast5-cfb         cast5-ecb
cast5-ofb         des               des-cbc           des-cfb
des-ecb           des-ede           des-ede-cbc       des-ede-cfb
des-ede-ofb       des-ede3          des-ede3-cbc      des-ede3-cfb
des-ede3-ofb      des-ofb           des3              desx
idea              idea-cbc          idea-cfb          idea-ecb
idea-ofb          rc2               rc2-40-cbc        rc2-64-cbc
rc2-cbc           rc2-cfb           rc2-ecb           rc2-ofb
rc4               rc4-40            seed              seed-cbc
seed-cfb          seed-ecb          seed-ofb          sm4-cbc
sm4-cfb           sm4-ctr           sm4-ecb           sm4-ofb

Do you mean you don't remember the name of the tool you generated it with?
If so, I think it is https://bitwiseshiftleft.github.io/sjcl/demo/

You can paste your JSON in the blue Ciphertext inputbox and your known password in the top left green Password inputbox, and your secret message should reveal itself when clicking on the blue decrypt arrow.


PMKID found , but it should be WPA handshake i was trying to get access in wifi network but i came to something that i need to ask afteraireplay-ng –0 20 –a [router bssid] –c [client bssid] wlan0mon i expect

  WPA handshake

in right top corner in the terminal, but it appears

  PMKID found

can i crack this as same as WPA handshake with aircrack-ng -a2 -b [router bssid] -w [path to wordlist] /root/Desktop/*.cap or what should i do to crack this?

you can certainly try your luck cracking it with hashcat. if you want to test it out, capture a PMKID of a wifi that you know the PSK password for and try bruteforcing with the known password to confirm it works.
install the latest version of hcxtool from github on Linux: https://github.com/ZerBea/hcxtools
then run hxcpcaptool on the pcap file to extract the PMKID like this:
hcxpcaptool -z pmkid_hash.txt your-pcap-01.cap

now run hashcat (using mode 16800) on the extracted pmkid hash:
hashcat -m 16800 pmkid_hash.txt -a 3 -w 3 '?l?l?l?l?l?lt!'

ref: https://hashcat.net/forum/thread-7717.html


Are string comparson timing attacks practical over public networks Related are-there-any-working-proof-of-concept-string-comparison-timing-attacks

I was looking at doing some encryption and hashing in PHP and came across this note

  Please be careful when comparing hashes. In certain cases, information can be leaked by using a timing attack. It takes advantage of the == operator only comparing until it finds a difference in the two strings.

It seems to me that in most cases the difference in comparing two strings is only going to be a few clock cycles. Given the overhead in HTTP, PHP and changes in network latency, there will be a lot of variation in the time taken to process a request. I don't see that using such an attack over the public internet.

Has such an attack ever been demonstrated in a real-world situation?

I'm not saying that you shouldn't protect against it just in case, I am just wondering how big the risk actually is.

With enough requests made it is possible to carry out statistical analysis of the results. Check out ircmaxell's blog post:

  It's been shown that you can remotely detect differences in time down to about 15 nanoseconds using a sample size of about 49,000

Analysing a large number of requests will iron out any network or application latency issues.


Is it safe to visit any website in TOR when the Security Bar is set at Maximum? (Safest) Someone has sent me a link on Tor which when visited instantly read that the website itself was not available and that apparently the link is broken somehow. When using Tor i use the option "Safest"
But im a little paranoid that i clicked on something which was risky. Am i instantly exposed now to the apparent "hacker" ? Could have also been a wrong copied link but i can't be too sure about that.

The "Safest" setting is in relation to the tor browser and it will only allow features that a static site would have.  Thus it will disable things such a javascript, and etc.
This will improve your security posture, (at a major cost of functionality) but is not a guarantee against compromise from websites or strategies to defeat tor's anonymity model.  The Tor browser and tor network are designed to complement each other so it is more secure than just using tor from a random browser.
There is not enough info in the question to indicate if you were compromised or not.
If you looking to increase your security posture, I recommend using Tails in A VM.


Is there a Hash Function that spit out printable ASCII character MD5 and SHA functions output a string of Hex representing the data the hash generated. Is there a hash that exists, or a way to convert these hashes to create an output that would only result in a string using only printable Ascii characters.

Instead of getting a hash that only has the possible values of [0-9] and [A-F]

I would like to get [0-9] and [A-Z] and [a-z] [!@#$%^&*-=_+[]{}|;':",./<>?`~]

I do understand that the Hex value that MD5 and Sha spit out is just a representation of the binary value they actually represent, so perhaps it is not so much a hash function that I need but rather a different way to parse the binary.

However if I'm not mistaken a direct translation from Hex to Ascii would most probably include non printable characters which would defeat the purpose, so I suppose I would need a final hash function who's soul purpose is to do just this.

As you say, the output of a hash function is merely a string of bits, and so not restricted to the ASCII character set.  So what you'd like to do is encode those bits more efficiently than hexadecimal encoding, which is only 50% efficient.

You should review the list of binary-to-text encoding methods on Wikipedia, but your best bet is Base 85, which is 80% efficient:

The proposed character set is, in order, 0–9, A–Z, a–z, and then
the 23 characters !#$%&()*+-;<=>?@^_`{|}~.

Here is an example of hash output being encoded both ways:

$ python3
>>> import base64
>>> import hashlib
>>> data = 'The quick brown fox jumped over the lazy dog.'
>>> m = hashlib.md5(data.encode('ascii'))
>>> base64.b16encode(m.digest())
b'5C6FFBDD40D9556B73A21E63C3E0E904'
>>> base64.b85encode(m.digest())
b'TyOi`K-pDmbD|z&!{F%z'
>>>

(note that the encoded output strings are python quoted with b'', so the first two characters and the last character are not part of the actual string)


cryptencrypt produces visually similar ciphertext I am playing with the windows cryptography functions and notice that the results for cryptencrypt produce similar ciphertext for similar plaintext. for example:

plaintext "100000" produces    T\ãK„© or 84 92 227 75 132 169

plaintext "100001" produces    T\ãK„¨ or 84 92 227 75 132 168

plaintext "100002" produces    T\ãK„« or 84 92 227 75 132 171

Shouldn't encrypted data appear to be totally uncorrelated to the source data?

these are the parameters I'm using:

CryptAcquireContext   PROV_RSA_FULL
CryptCreateHash  CALG_MD5
CryptDeriveKey  CALG_RC4

RC4 is a stream cipher.  If you're using the same key and IV, you will get ciphertext that looks very similar when the plaintext looks very similar.  This is why IV reuse with stream ciphers is a really, really, bad thing.


Are buffer overflows pretty much a thing of the past in 2020 After learning about buffer overflows: In the 90's finding a buffer overflow nearly always meant you could exploit it.
Nowadays there are a lot of protection mechanisms like address layout space randomization, making memory either executable or writeable, stack cookies, ...
It seems to me that with only 1 protection mechanism in place, you can get around it (for example with return orientated programming). But when you combine these protection mechanisms, the door is pretty much shut down. And if someone finds an overflowable buffer there is a 95 percent chance it's not exploitable.
It seems to me that the only way buffer overflows are reliably exploitable is if these protections are not in place, but operating systems force these protections
So are buffer overflow attacks pretty much dead nowadays?

While it is shocking, buffer overflows (alongside other memory corruption vulnerabilities) are still very much a thing of the present.
Due to exploit mitigations and hardening used by modern systems, it becomes much harder or impossible to exploit many of these vulnerabilities. However, many vulnerabilities are still introduced and/or found, as many new projects today are still written in unsafe languages, and many existing projects (e.g. Linux) written in these unsafe languages cannot easily be rewritten (yes, I'm aware there have been attempts to write kernels in Rust, but the language is probably very far from replacing the entire kernel codebase).
Anecdotally, I have found several buffer overflows this year in new code, or sometimes old code being reused for a new product. Some of them only amounted to denial of service, but others resulted in remote code execution. In some cases, it was easy to exploit them due to lack of exploit mitigations (e.g. many consumer-grade IoT devices have binaries compiled without mitigations), but other times, while more challenging, most of the mitigations could be circumvented.
In short, memory corruption vulnerabilities may never fully be eliminated as long as computer systems are not perfect; even a "safe" language can have bugs.


Unsecure to allow all headers? I'm currently developing an webapp. For testing and developing I allowed all Headers. Is this unsecure for productive use?

Header unset Connection
Header unset Time-Zone
Header unset Keep-Alive
Header unset Access-Control-Allow-Origin
Header unset Access-Control-Allow-Headers
Header unset Access-Control-Expose-Headers
Header unset Access-Control-Allow-Methods
Header unset Access-Control-Allow-Credentials

Header set   Connection                         keep-alive
Header set   Time-Zone                          "Asia/Jerusalem"
Header set   Keep-Alive                         timeout=100,max=500
Header set   Access-Control-Allow-Origin        "*"
Header set   Access-Control-Allow-Headers     "Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Param$
Header set   Access-Control-Expose-Headers    "Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Param$
Header set   Access-Control-Allow-Methods     "CONNECT, DEBUG, DELETE, DONE, GET, HEAD, HTTP, HTTP/0.9, HTTP/1.0, HTTP/1.1, HTTP/2, OPTIONS, ORIGIN, ORIGINS, PATCH, POST, PUT$
Header set   Access-Control-Allow-Credentials   "true"

Header set DNT "0"
Header set Accept-Ranges "bytes"
Header set Vary "Accept-Encoding"
Header set X-UA-Compatible "IE=edge,chrome=1"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set X-Xss-Protection "1; mode=block"

For testing and developing I allowed all Headers. ...

It is not very clear what you mean here (maybe be more specific and do not only dump the config) but...

 Header set   Access-Control-Allow-Origin        "*"
 Header set   Access-Control-Allow-Credentials   "true"

It is definitely not a good idea to allow cross origin access from everywhere. And it is even worse to combine this with sending cookies and other credentials.

With this loose restrictions an attacker could use XHR requests do access a site with the stored credentials of the user (i.e. session cookie), change data with permissions of the user (classical CSRF) and even read the response back (what classical CSRF can not do). For instance if you would deploy this code for a company internal application an outside attacker could use the internal users browser as a trampoline to fully access the application and read the content and all with the identity of the currently logged in user.

Such XHR based attacks could be delivered when the user visits the attackers site and such a visit could just be triggered from within an advertisement delivered by any of the ad networks.

Apart from that:

Header set   Access-Control-Allow-Methods     "...HEAD, HTTP, HTTP/0.9, HTTP/1.0, HTTP/1.1, HTTP/2, OPTIONS, ORIGIN, ...

I have no idea what you are trying to do here but methods are GET, POST, HEAD... and not HTTP/0.9, HTTP/1.0 etc. I really recommend that you take a closer look at how CORS works, what the headers mean and what the security implications are.


Can OpenID Connect be used to implement social login? Using OAuth to implement social login is insecure (https://tools.ietf.org/html/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because the local application incorrectly thinks that, because a certain Access Token returns ID
information, the user with that ID has been authenticated by the OAuth provider, and so can be authenticated as the corresponding user in the local application.

In contrast to the above, OIDC performs authentication and returns an ID Token, for which the local application is the audience. As such, can an ID Token be used to securely authenticate users, assuming that the ID Token is used immediately when returned from the token endpoint? Are there any obvious security ramifications to this approach?

Social Login is an umbrella term that equates to a number of implementation options/architectures. The underlying protocol you would have to use depends on the identity provider. OpenID Connect was designed for authentication and the id_token can be used by the relying party for this very purpose.

...but not all major social platforms support OpenID Connect. For example, as of this writing Facebook Login is based on oAuth. As you correctly noted, oAuth is an authorization framework and a loose one at that. Therefore Facebook rolled out Login as a set of libraries that do everything for you and cover the authentication use case in a Facebook-proprietary way in addition to standard oAuth-ish authorization.

For platforms such as Google that do support OpenID Connect, the devil is in the details and that includes "security ramifications". Good news: a lot of threat modeling work has already been done on OpenID Connect. Bad news: it's complicated.


Using client certificates for website authentication I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to start on developing a site that uses this authentication scheme? Is it possible with Python and Django?

A simple Google search on "django client certificate" reveals this, and this, and this, which all answer to your question as: yes, Django can work with certificate-based client authentication.

People don't do that often in practice, because client certificates work only if you can arrange for clients to have certificates, basically meaning that you must manage your own PKI. Software for running your own PKI is available (e.g. EJBCA), but PKI management requires strict adherence to clearly defined procedures, which will take you time; the long-term cost of a custom PKI is very often underestimated (that is, if you want to do it properly).

Client certificates will also inconvenience users, because they won't easily (or at all) transfer their certificates to their tablet or smartphone or even alternate laptop, the way they do with passwords. None of this is really blocking, but it explains the rarity of client certificate deployment.


Scripting a search through php files for dangerous calls for manual review I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed.

Does anyone have any recommendations for my script? Is there anything I've forgotten to search for? Please note that this script was put together in 10 minutes, so I'm sure there are a lot of improvements that can be done in order to make it easier and better (like multiple egrep arguments).

find . | grep "php$" | xargs grep -s "eval(" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "fopen(" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "passthru(" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "exec(" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "proc_" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "dl(" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "require($" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "require_once($" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "include($" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "include_once($" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "include($" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "query(" >> /tmp/review.txt

Definitely this list is not enough. First of all, it is not complete, secondly, different obfuscation methods can be used to hide web-shells, other malicious scripts.

For such purposes long time ago I have written my own PHP-script to look for dangerous places: http://0x416d73.name/proj/fcc.html. It is written on PHP, so don't expect it to be as fast as "find" command. Though, it allows to check file hashes, view which files have appeared, are missing or has changed. I advise you to test it first against some small script, just to feel how it works, before running on production server.
Also, specifically for search for vulnerabilities in PHP code, some time ago I have put together some easy bash script - http://privatepaste.com/88a5d5eaa3. It is not complete, might require tuning and criticism from bash guru's :)

If you want to continue on your own script, here is nice list from which you can extract what you need: http://privatepaste.com/dc335ccb86.

Updated: as it figured out, topic is about code review. Above mentioned solutions still makes sense, but then I would like to mention this one project: http://sourceforge.net/projects/rips-scanner/. To my mind, currently it is the best freely available source code analyzer for PHP web applications.


How does an attack on a digital signature work? In our IT Security class we have been told that you need CA's to prevent attacks on a digital signature. Sadly, our docent didn't elaborate how such attack would be performed - I can only guess that someone would try to do a MitM:

Alice wants to authenticate towards Bob, so she writes him a message and signs that with her private key. She also appends her public key.
Eve intercepts the message and verifies the message with Alice's public key, then signs the message with her own private key and forwards it to Bob, appending her own public key instead of Alice's.
Bob receives the message assuming it's from Alice, verifying it with the appended public key (from Eve) and is now sure to communicate with Alice.

So if Bob would just have looked up Alice's public key at some CA, he would have known that the appended key was wrong.

Is that the scenario people are generally referencing to when it comes to why you need CAs?

A digital signature, like all cryptographic algorithm, does not solve problems, it just moves them around.

Take care that signatures are NOT encryption. If someone tried to explain signatures as a kind of encryption, then go find them and hit them in the teeth with a wrench, repeatedly. Tell them that they are unworthy, and I am disappointed with them. This flawed explanation does not work, never worked, and spreads only confusion.

In a signature system, there is a message m, a public key kp, a private key ks, and a signature s. The signature generation algorithm computes s from m and ks. The signature verification algorithm takes m, s and kp, and returns either "true" or "false". When it returns "true", what this means is that whoever owns the public key (i.e. knows the corresponding private key) was involved in the generation of signature s on the specific message m.

The important point is in the key ownership: the signature verification algorithm does not tell you "yep, this is signed by Bob"; it only tells you "yep, this is signed by whoever owns that public key". This guarantees that the signer is really Bob only if you have a way to make sure that the public key you see is really Bob's public key. If Bob simply sent his public key along with the signed message, it would be easy to impersonate Bob by simply saying "hello, I am Bob, here is my public key, and here is my signed message". It would prove nothing at all. The attack here is simple, it is called "lying".

While signatures are useful (indeed, they reduced the problem of verifying the provenance of several messages to the problem of associated a single public key with its owner), they don't magically guarantee ownership out of thin air. This is where Certification Authorities come into play. The CA is an organism whose job is to make sure that Bob really owns his alleged public key; presumably, the CA does that by meeting Bob in person, or some other mechanism of that kind. When the CA has duly verified Bob's ownership of his key, the CA puts Bob's identity (his name) and his public key in a certificate. The CA then signs the certificate.

Alice's machine can then verify the signature on the certificate, thereby making sure that the certificate contents are really from the expected CA. At which point Alice has some guarantee about the fact that the public key she sees in the certificate is really Bob's key, and she can use it to verify signatures which have purportedly been computed by Bob.

At this point you should say: "But how can Alice verify the signature on the certificate by the CA ? She would have to know the CA public key !" And, indeed, the problem has again been moved, to the question of CA key ownership. We can move it yet another time, with another CA. And so on. But it must stop somewhere. That "somewhere" is the root CA. A root CA is a CA whose pubic key you already know, absolutely. That's the magic part. In practice, your computer comes with an operating system that already includes the public key of a hundred or so of root CA, who made a deal with Microsoft to the effect that their public keys are inherently known (and trusted) by all Windows systems.


BLP Lattice structure with missing top and bottom levels I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level.

Would it make the BLP lattice more secure if I added them?
If so why?

You seem to have misunderstood how this lattice model works, and the diagram you gave doesn't really help. It's meant to be a 3D structure.

In this model, we have:

Entities - These are things that you can have access to. In your diagram, these are crypto and nuclear.
Privilege levels - These are generic levels of privilege that can be applied to any entity. Each higher privilege inherits the privilege below it. In your diagram, these are secret and top secret.
Entity privileges - These are privilege levels associated with an individual entity. For example, you might have (Top Secret {nuclear}), or (Secret {crypto}).
Escalation paths - These are ways to increase an individual's privilege. Notice that each line on the lattice increases one type of privilege - e.g. it's not possible to jump directly from (Secret {nuclear}) to (Top Secret {nuclear,crypto}). This allows for strongly defined privilege escalation procedures, and proper audit trails.

The lattice model essentially puts all possible combinations of entity access on each privilege level. As such, an individual can only possibly be at one point in the lattice.

Entity privileges in this model do not allow for cases where an individual can have a higher privilege on one entity  than another. You have the same privilege for all entities that you have access to, but you might not have access to some entities at all. This is often a good thing in classic law enforcement and government systems, but doesn't lend well to modern business computer systems.

Altering this model to have missing privilege levels or have missing layers doesn't make any sense. From a software design point of view, your administrator would hold the highest privilege level for all entities, whilst an unauthenticated user has no privileges on any entity. Individual users would be at any point in between. Removing any of these entity privileges makes escalation paths more circuitous, and makes for some unnecessary validation work.

If you're looking for a more flexible access control model, try access control lists with inheritance. In such a model, users may be organised into groups and subgroups, each of which have a base privilege level that inherits from its parent. Individual users may be escalated beyond the base level, but not below. This allows for complex privilege groups to be created with minimal work, in an intuitive way that mirrors your physical infrastructure.


What would stop me from cracking a certain bcrypt hash? Assuming I have a bcrypt sha1 hash, which I know it's salt, wouldn't it be possible to get one of those 13GB password list, hash every password with the known salt creating a custom rainbow table, and then compare?

I know bcrypt is a slow hashing algorithm so using a huge password list would take time, but would it be feasible if the list were shorter? (lets say, 100 password as an example.)

Thanks

Yes, it's possible. Don't need the rainbow table - that would only benefit you if you had multiple passwords using the same salt - since you can directly test the passwords.

Could take a while though - if you can calculate 1000 hashes per second, and you are using an alphabet of 64 characters (A-Z,a-z,0-9, plus a couple of symbols), looking for passwords of exactly 8 characters, the formula would be 64^8 (to get the number of passwords) divided by 1000, to get the number of seconds required. For that example, it's 281474976711 seconds. Or 8925ish years. Input your own hash checking speed to work out the actual time - it will vary based on your system.


two-factor authentication suffix code in the password In many sites where 2FA is enabled, the login flow is:

A form asking for username/password
If credentials are valid a new form asks for the verification code.

However, there are some implementations in where the verification codes are suffixed into the password so the flow is only a single form asking for username and password+verification_code.

Which approach offers better security?

Let's assume that a user has knowledge of its username, password (of course), and has access to its two-factor authentication (2FA) codes.

From the server end, having the password+verification_code in the same field will incur a slight overhead in extracting the password & code from each other, provided that we know that the code is the last 6~ digits of the entire string. We would have to decrypt it, split, check against the database, then permit the user. But I do see an upside to this, skipping one hop of user interaction and connection. Which means cutting the authentication period and communications to close to half.

Which to me seems like a convenience for the end-user, and what do they say about convenience? Especially when it comes to security.
Convenience increases risk.

  Which approach offers better security?

Well, when it comes to having two separate forms, one for username/password and the other for the 2FA Code, this alone offers segregation, a distinct line between two different forms for different purposes. Having segregations are extremely valued in this field.

It is good practice for an implementation that will provide a different session or a unique token upon successful credentials being POSTed. This brings us to the next step, a new page/form that prompts the user for the 2FA code. This very practice is about sending two pieces of key information separately, one being something you know like your username/password and the other being something within your possession like a 2FA physical token or an authenticator app


How to fix a repeatedly hacked gmail account (where 2FA is enabled and passwords are changed)? A friend of mine came to me for help with this issues. Her Gmail account has been hacked and keeps sending out spam emails to her contacts. This is happening to her on a monthly basis. Each time it happens she changes her password. She also went through and tweaked all her security settings. However, even after having done all this repeatedly, when she goes into her "Device activity" in her Google Account settings, it keeps showing an unauthorized Android device that belongs to the hacker. It doesn't give her the option to remove it from her devices either.

It looks like the emails aren't being sent from her device (they're sending spam emails to her whole address book and spoofing the from address to make it appear to come from her). However, we still want to know how to rid this device from her account.

She must be missing something...let us try this:

First read about the google answer on "someone is sending spam from my email"  here as they state it there: "

The message was spoofed, forging your address as the sender.
The original sender used your address as a reply-to address so that responses would be sent to you.

Neither of these possibilities indicates that your account was compromised..."

There are two ways to check for that:

Get a copy of the email, including headers, and check the originating IP address to see if it was not one you could have been using
If you’re receiving bounce messages from a bunch of email addresses for people you’ve never heard of

If your account was spoofed, they simply created an email that had fake details (usually the “From” or “Reply-to” address), and there is very little you can do to stop this.

If in fact your account have been hacked follow this:

While logged in the account you want to manage access:
https://security.google.com/settings/security/permissions?pli=1 = here you can review all APPs phones and sites that are connect to your account and you can remove this rogue android from here just click on "Android" then revoke access
https://accounts.google.com/b/0/SmsAuthSettings#devices = here you can check the phone that is being used for 2 way authentication and make sure you still have 10 reservation codes
https://accounts.google.com/b/0/SmsAuthSettings#registered = here make sure you make google ask for the code in all computers except the one you are using
Now change your password this should log you out of any connected device and with the 2 way aunthentication they should not be able to get in again

Now if this don't work then we can suspect that the attacker may be regaining the password after she changes it (e.g compromising her pc or if she changes to a not so different password he may be able to brute force it again fast phishing attacks and etc ) if thats the case then i  recommend the usual : only change the password via a phone and do some AV scan on all her pcs.

Another possibility is that her password has been leaked on another site especially if she reuse her password everywhere so she may want to choose for a unique password for gmail for now.


Is oauth client credentials flow safer than basic authentication with preshared secret? Assuming that both travel over the latest version of TLS, why should I use client credentials?
The obvious answer is:

The access token will expire at some point
The client id and secret will travel only once over the wire
We can also use a refresh token, further strengthening the security

I argue that we could also make the username/password or preshared secret travel only once and share a session token that will too expire quite easily.
So in this scenario, is the refresh token the only reason to use it?

The purpose of the client credentials grant flow is to enhance the ability of the client to bracket their privileges.
Here's the idea. You have a small piece of glue code which actually talks to the authorization server. It does the usual authorization code grant flow on behalf of other parts of the client and returns access tokens, like a proxy server. The rest of your code is then blissfully unaware of most of the OAuth complexity, and only has tokens for the specific resources that it needs to operate on. This is good, because it provides for privilege bracketing, reducing the amount of damage that can be done if a specific portion of the client is compromised. It also makes audit logging simpler and harder to subvert. You are likely to derive more security benefit from this if the proxy is heavily isolated from the rest of the client, such as by running on a separate machine, and only communicating with the rest of the client through a narrow and simple API. The proxy can also perform any sort of internal authentication which may be appropriate to the client's needs, to ensure that each component can only request tokens scoped to the appropriate permissions or resources.
But then you have a problem: Sometimes, part of the client wants to interact with a resource which does not belong to any end user, but instead belongs to the client as a whole. This might involve provisioning, billing, or any number of other administrative processes which are not specific to one end user. The "easy way out" is to give this piece of the client the same credential you gave to the aforementioned proxy, so that it can prove its identity. But if you do that, then this component will be able to do anything that the client as a whole can do, including requesting unrelated access tokens. This breaks our nice privilege bracketing.
This is the problem which the client credentials grant flow is designed to solve. The component which wants to do (whatever administrative thing) simply asks the OAuth proxy to obtain a client token for the specific resource it needs, and the proxy does so. That token is then scoped to this specific administrative task, and in no way entitles the component to access a user's data or anything else which is "not its job."


Able to read private SSH keys Im able to run cat ~/.ssh/id_rsa meaning that my private keys are displayed on screen, I have a strong passphrase for it but doesn't that mean if my laptop was stolen, my private keys could just be copied to another key file and used to access my server I thought a passphrase would stop this kind of thing?

Is what I'm seeing from the cat command my key or is it encrypted?

They are 4096 bit RSA keys generated with the flag -o (for the new OpenSSH format)

Having a password on your key protects against this exact thing.  You cannot use someone else's key if it is password protected.  Remember that if they do get their hands on your key, they can still try to brute force it, so make sure to use a strong password.  If you had not password protected your key, it could be used by anyone who had physical access to your computer with the key on it.


Should users have access to the IPsec pre-shared key? We are in the process of switching from Hamachi to Meraki VPN by Cisco. Hamachi was managed internally, but this new VPN solution is managed by an external party and they have set it up as L2TP/IPsec with a pre-shared key and authentication. They insist on keeping the pre-shared key private, which means they have to set up the VPN for everyone in the company via TeamViewer.
This means I cannot easily set up VPN on my Linux dual boot or my phone whenever I want. Is it standard practice to keep the pre-shared key super secret or should users have access to the pre-shared key?

This is really too broad to have a single answer. If you trust your users enough to give them root/admin access, then they can get the PSK anyhow; nothing to be done about it. At some companies it's standard practice to give everybody root access if they want it; at others it's standard practice to never give it out at all except to the actual sysadmins. Neither of these are an industry-wide practice.
The same is true of hiding the PSK or not. If they don't trust (in the sense of "confident won't do something wrong, knowingly or by accident) employees enough to give root/admin, then it wouldn't surprise me if they don't trust employees to see the PSK. If they do trust employees to follow the principle of least privilege and only use elevated access when necessary, they might still keep the PSK secret because most people have no need to know (and they might not have considered your valid reasons to need it... or they might not think your reasons are valid).


Identification of TLS POODLE Vulnerability How can I identify whether the remote server is vulnerable to TLS POODLE vulnerability? Although, there are online scanners such as Qualys SSL Labs. As per my understanding, these online scanners do not work on custom ports such as 8086, 8909 etc. Also, these scanners cannot be used when we are performing the security assessment on internal network devices.

Poodle attack works on SSLv3 although there is a variant of poodle attack on TLS that appeared in recent years by accepting incorrect padding after decryption.

nmap is checking the TLS/SSL version. You can find the script of poodle identification rules online.

It is recommended to completely disable SSLv3 on server side.  On the client side, you should always upgrade to the latest version. Also, most of the browsers/servers use "TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks" to prevent any intentional downgrade of version and drop the connection.


Do mobile phones automatically connect to spoofed cellular tower antenna? I was told that an attacker is able to create a fake cellular tower antenna imitator near your mobile phone, and your phone will automatically connect to it, whether that antenna has an encrypted connection or not, and thus the attacker can see your transmissions, SMS, etc.. is that correct?

Yes, your phone will not be able to differentiate between a regular and a fake cell tower and will connect to whichever has the strongest signal.

As for the encryption, not really sure what you mean. Since the attacker owns the base station, he can monitor all the traffic going through there. The over-the-air encryption between the phone and the fake base station doesn't really matter here - the only traffic that an attacker cannot see is data that is end-to-end encrypted between the phone and, say, a web service it accesses.


Do I need to expire a session cookie when sessions are handled server-side? The only data in the cookie is the session ID. There is no expiration timestamp set when creating it, a session is always evaluated server-side to see if it has expired.

When logging out, the session is destroyed server-side. Is there any point then in expiring the cookie?

Telling the browser to expire the cookie is just a form convenience, because the user is always able to override that. After all, the cookie is really on his browser, so you'll always check the expiry of the session on the server side.

That said, I'd still recommend setting an expiry date on cookies. It's a piece of information there in the user's browser, and when it's not needed anymore it's not a bad idea to tell the browser to get rid of it.


what is the link between server certificate and cipher list advertised by server for nmap command? Nmap out put for google.com.
ssl-enum-ciphers.

TLSv1.2:
ciphers:
       TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A.
       TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A.
       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C.
       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A.

Questions.

Server selected CIPHER  for TLS1.2 is  "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA.

Here key-exchange used = ECDHE.
Authentication    = ECDSA.

It means server using ECDHE certificate?

but server also advertises "TLS_RSA_WITH_3DES_EDE_CBC_SHA" for TLS1.2.

Key Exchange used = RSA.
Authentication     = RSA.

How come TLS_RSA_WITH_3DES_EDE_CBC_SHA agreed for ECDHE certificate?

... server also advertises

The server does not advertise any ciphers. The client advertises ciphers and the server either can choose one of the advertised or not. Detection of server supported ciphers like done in nmap just tries varies ciphers and see if it succeeds.

  Here key-exchange used = ECDHE. Authentication = ECDSA.
  It means server using ECDHE certificate?

There is no such thing as an ECDHE certificate. ECDHE is a key exchange which is not a property of the certificate. The relevant part here was "Authentication = ECDSA." instead, i.e. an ECC certificate where ECDSA is used as signature algorithm within authentication.

  Key Exchange used = RSA. Authentication = RSA.
  How come TLS_RSA_WITH_3DES_EDE_CBC_SHA agreed for ECDHE certificate?

A server can have both an ECC and RSA certificate, i.e. two different certificates for the same site on the same server. If the client supports ECDSA then the server will pick an ECDSA cipher since ECC certificates are smaller for the same security than RSA certificates. If the client only offers RSA ciphers it will get the RSA certificate.


Is there any methods available other than brute force and dictionary attacks? I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?

To attack a black-box (i.e. you don't have access to the hashes), then you will be mostly limited Brute-Force and Dictionary Attacks. If you manage to get the hashes in question, then you can also perform a Rainbow Table Attack.

There is also an entire group of attacks known as Side Channel Attacks. However these are often very specific to an implementation, rather than a general attack.


Is a C plugin safe if I read it through an echoing parser before? I wanted to use sharable plugins for an application. However, the plugins were extremely time critical, so I wanted to distribute them as C libraries. Now, these are not guaranteed to be safe (the programmer could user system calls or cause segfaults).

Then I had this idea: The application puts its source code through a parser which defines what is allowed - not by making restrictions (subtractive), but by enabling features(additive) - then outputs the code, and finally, this output is compiled using an ordinary compiler. How safe would this be? (Compared to using no parser in between, or using a scripting language, like e.g. python)

In order to make C code "safe", even against a malicious developer, then you have to fix the core issues of C, which have all been repeatedly exploited for arbitrary code execution (exactly what you want to avoid):

Weak types. In C, you can take a bunch of bytes, and interpret them as a pointer, an integer, or whatever. All it takes is a cast. As long as such casts are possible, then the language won't be safe. You need to enforce strict unescapable types.
Unchecked array accesses. C gives you pointers and from these you can read and write arbitrary bytes in RAM, with no control. From these follow buffer overflows, which can lead to security holes. In your new language, you must enforce strict array bound checks.
Manual memory management. In C you dynamically allocate memory with malloc(), and then release it with free(). Nothing prevents you from trying to access a memory block after having freed it, or freeing it twice (these are the classic use-after-free and double-free, both leading to serious consequences). Lack of free() can also imply memory leaks, which can be bothersome. In your new language, you must do something to prevent these memory management issues, and that is called automatic memory management, which is most often done with a garbage collector.

Down this road you get Java. Or C#, if you prefer. This works, but it is a considerable development effort. Moreover, the systematic checks on array bounds can imply a non-negligible overhead. For purely computational tasks with no I/O bottleneck (no disk access, no network access, and all data fits in the CPU L1 cache), I typically get a factor of 2 to 4 between optimized C and optimized Java (tested on numerous cryptographic algorithms such as hash functions; also on zlib-compatible compression). For some algorithms the slowdown was smaller (Java code was achieving up to 70% of the speed of C code), but that's rare. For the specific task of computations with big integers, Java is more like 6 times slower than C+assembly, because of the lack of support for the 64x64->128 multiplication opcode.

There are two main roads out of this (assuming that the overhead of a Java-like language is not acceptable to you). The first one is to try to use formal verification. The concept is that the code will be executed only if it can be proven that it "behaves properly". In essence, Java is doing a weak form of verification, in that the JVM proves that a piece of code does not do anything wrong like using a reference with a wrong type; but that verification relies on systematic checks, e.g. on casts and array accesses, and also the presence of the GC. Formal verification is an active research area, whose scope extends beyond security: basically, this is about proving correctness, i.e. absence of any bug.

There are good mathematical reasons why a generic verifier which works on all possible programs cannot exist. Researcher still hope to improve things in several directions:

There are programs for which proofs are feasible. For instance, a program with only if but no loop, and no recursive call, cannot loop "forever": that's an example of an easy proof of correctness for programs which follow some specific rules. Researchers try to define more useful sets of rules which still allow for proofs.
The human developer may provide proof elements. There are constructions for which no algorithm is known to generate the proof, but a developer-provided proof can still be verified. Assertions fall in that category.
We may find optimizations: starting from a generic "safe" language like Java, an automatic prover might find "occasions", e.g. code chunks where it can be proven that some array accesses are necessarily fine, thus allowing for removal of the corresponding checks. In fact, modern JVM apply such strategies, which is why they are not as slow as could be feared. Many researchers believe that there still is room for improvements.

However, right now, don't hope for too much: existing top-of-the-line Java and .NET virtual machines are about the best that can be done for now.

The other method is to surrender the CPU to the potentially hostile code, and instead move the security perimeter at an upper layer. The "plugin" is executed in an address space of its own; the MMU blocks unwanted accesses. The plugin code can do all the memory accesses that it wishes: it will see only its own code and data. If the code tries system calls, then the kernel knows not to honour them.

Among incarnations of this method are FreeBSD's jails and Linux's seccomp. The same concept at a still higher level is virtualization with hypervisors: the guest can be a full operating systems, with access to disks, network... and yet all this hardware is virtual and the guest cannot escape from the closely guarded perimeter set by the hypervisor.

The main problem with that kind of isolation is overhead for data exchanges. If your "plugin" must consume a lot of data from the application into which it is plugged, or if it produces a lot of data for that application (typical example: video codecs), then the moving of data between the two worlds, beyond the MMU/hypervisor barrier, can kill performance.


Bluetooth attack against Android phone - could be successful? Couple of days ago I attended a political demonstration. Amateur mistake, I know but I left my Bluetooth set to discoverable. I have a LG G2 running Android 5.0.
Once during the demonstration I saw that I had one unsuccessful file transfer from another device. It was a file called [something].sqlite.

Although it was unsuccessful, hearing about these new hair-raising vulnerabilities like Heartbleed and Shellshock, I wouldn't be surprised if an "unsuccessful" file transfer could infect a phone. Especially performed by a government agency...

Is it possible that they infected my phone?

I don't know what makes you think that a file that couldn't get into your phone would attack you. If you got a "file transfer unsuccessful" or similar message, it clearly means that the file isn't received. So, no worries.
SQLite is a database that is used in android.
Even if you had received the file, it should be executed by a program, your or a third party who can physically access your phone. Which didn't happen. Also, you would need root permissions to allow other apps to make something to execute.
So, basically, don't worry on it and don't keep the Bluetooth to discoverable mode to avoid such surprises.


opening random extensions with notepad I get files with random extensions sometimes in order to bypass corporate firewalls. Usually I would just ask the other party what it is that I just received. Other times I get curious and open the file with notepad. Sometimes the file would have a plain text header which describes how to open it. Could this potentially cause "issues" if I didn't do it in a sandbox?

In theory, someone might be able to find a buffer overflow in notepad that could cause issues when opening a file, but the chances are pretty minimal and the file would have to be specifically made to exploit notepad.  A sandbox is still technically the safest, but I generally view files in Total Commander's viewer (which is equivalent to opening it in notepad) because the risk is so low that it isn't really a problem unless you have really high security needs.


How to secure file delete/wipe on mobile phones? With old HDD to secure delete a file you need to use Gutmann standard, but with new HDD you can use only 1 pass overwrite
I'm not sure what hard drives mobile phones use and don't know how many passes will be okay for secure deleting files on phone.
What standards are okay to safe delete files on phones? How many passes you need ? Is 0x00 or 0xFF standart overwriting with random data 1 pass safe or you need to use DoD 5220.22-M standard or Gutmann standart ? This question is  Android and iPhones related

On modern Android and iOS devices, some type of file encryption is certainly in place. Without the encryption key, the data is irrecoverable. Therefore, performing a factory reset to remove the key should render the data irrecoverable.
This is assuming you are willing to discard all data on the device.


Does Wire use encryption-at-rest? Does Wire employ encryption of data at rest?
I generally consider Signal and Wire to be the best tools today for sending information privately between two parities. Both meet the marks on crypto, open-source, 3rd party audits, PFS via the double-ratchet algorithm, etc.
Personally, I prefer Wire because it doesn't require a phone number and you can install it on Linux, Windows, MacOS, Android, or iPhone. So you can put it on TAILS or Whonix or a burner phone or some sandboxed VM.
But today I was searching through Wire's website, and I was surprised that I didn't see any information on their "security" page about encryption-at-rest.

https://wire.com/security/

In most cases, I'd have FDE anyway -- but in the off-chance that the person I'm communicating with doesn't have FDE, I want to make sure that my messages wouldn't be stored in plaintext on their HDD when they retire their device.
Does Wire store all of its data encrypted-at-rest?

It appears that Wire does not itself encrypt all of its data at-rest. In fact, in their security whitepaper, the explicitly state that their users should employ FDE because of this. Wow.
From their security whitepaper:

https://wire-docs.wire.com/download/Wire+Security+Whitepaper.pdf

7.2  Local data protection

Wire apps store the content of conversations such as text messages, imagesand other assets locally on the device. Depending on the platform, differentprotection mechanisms exist:

iOS: Local data is stored using Core Data and in files (both protectedin with NSFileProtectionCompleteUntilFirstUserAuthentication).  Con-versation content, cryptographic key material and other sensitive data isnot synced with iCloud or iTunes backups. Local data can only be ac-cessed from the Wire app, it is inaccessible to other apps thanks to theiOS sandboxing.

Android: Local data is stored using SQLite and in files.  Conversationcontent, cryptographic key material or other sensitive data is not syncedwith Android Backup Service. The local data can only be accessed fromthe Wire app, it is inaccessible to other apps thanks to the Android per-missions.  The app sometimes keeps cached data (i.e.  downloaded im-ages) on the external storage (SD card). Those files are encrypted usingAES128, each file uses a different random key which is stored in the privatedatabase.

Desktop clients: Local data is stored using IndexedDB. The data is storedin the user’s folder. It is strongly recommended to use full disk encryptionlike FileVault on macOS or Bitlocker on Windows.


Best practice for accessing management port of firewall I'm in the process of setting up a bunch of servers at the other end of the world (well, 8 hours travel time) in a co-location place.

The servers and firewall all have a remote management port (KVM, DRAC, you name it). I'm wondering what is the best practice how to access & secure that.

Obviously I could just put all those in a separate VLAN and put some filtering rules on the firewall (a Linux box). But then the accessibility of the firewall remote management depends on the firewall itself - I don't think this is a brilliant idea. One ifdown and you're out.

I could also just put the servers management ports into a separate net, and leave the firewall management port open on the internet, but this doesn't seem to be very elegant.

I could also leave everything on public internet, of course.

What are your recommended best practices?

I suggest you to use the bastion backdoor architecture.

Install an hardened machine inside your remote network which will be
used as a uniq entry point to access the inside of your remote network. For the clarity of this textual description I'll name it bastion.
As a rule of thumb any protocol not used on bastion will have to be off.
All allowed protocols will be logged (if possible on a syslog server within your remote network).
Put all your managment interfaces in a dedicated closed VLAN: managment. managment won't be accessible from the WAN or from the remote LAN. It will only be accessible from bastion.
Block any WAN direct access toward your firewall. Your firewall will only be accessible from bastion and through a very limited set of protocals (IPsec, ssh).

bastion will be a potential point of failure. In case of trouble on this
system, your remote network won't be accessible. If an attack on bastion turn successfull, the attacker will have control on your firewall and on all your managed server. Hence all your OS hardening should be done to make this
bastion as attack resistant and failure proof as possible.
I advise you to build it on top of any Unix which have a good reputation to permit the building of hardened OSes.


Prevent someone from using your site for phishing? So I have a site where users can create online surveys and send them out to whomever they like.  Over the past few months we have seen an uptick in one particular user who creates an account, then creates a survey where he requests user names and passwords for a different site.  It's always the same site that he targets, and he always asks the same sorts of questions.

Our best solution up until now has been to create a monitoring service that searches for potentially malicious surveys and then notifies us when they are found.  We then go in and manually review the survey and lock the account if it's up to something shady.

This has not been very effective.  Even though the surveys are locked fairly quickly the malicious user still finds value in endlessly creating these surveys under new accounts and sending them out.

The best idea I've come up with is to not allow a survey to be activated by the user if it contains suspect keywords.  Require and admin to review and activate it.  The problem with this is that there are many false positives that get picked up, so I would need to perform an action more often than I do now in order to let the legit surveys go live.

Can anyone suggest an effective way to thwart this person without spending a chunk of my day performing manual tasks?  Is there some way to fingerprint this user to prevent him from using our site for phishing?

Depending on the language and framework you are using, maybe it's time to look at some machine learning libraries for spam detection.  If you use this malicious user's methods as the training set you maybe able to lower your false positive rate.


Is there a way for a "hacker" to know your password length and if you used numbers or symbols I understand that you make a password more secure by increasing its length and by adding numbers and symbols since you increase the number of possibilities that a hacker would have to brute force. However, would he know beforehand the length of the password and if you used numbers or symbols? Or would he only find out slowly as his brute force machine chugs away?

Even most weak hash routines like MD5 do not reveal the length or diversity of characters in your password until the matching hash is found.

This is thanks to something called the Avalanche Effect of cryptographic hashes.

This holds true even more so for strong hashes. The attacker would not have any clues about the password until the brute-force successfully finds a match.

It is important that the developer uses a unique salt per user, so to prevent the use of pre-existing Rainbow Tables.


Where does Snort log the messages when using a pcap file? When you're using Snort for real-time monitoring the messages are logged to /var/log/snort/alerts.

However, when you load a pcap file, where do you see if any packet triggered a rule? Because they are not stored in that same directory.

Nevermind... the alerts are logged in the same directory. However the problem seems to be that even if I'm using the default configuration file, I need to use the -c parameter


Is e-mailed cryptic download link considered secure? An online storage platform allows sharing files with anyone who does not have an account there by sending an https link leading to direct download of the file. The link is e-mailed to invited users.

A part of the link is long key, probably random enough not to be successfully guessed by a human. But can such a shared link (which lands only in recipient's inbox) can be considered secure enough against unauthorized use?

Would it be considered secure if the link wasn't e-mailed, but sent via some secure channel? (I am not sure whether direct download link, even if kept confidential, is secure per se.)

Depends on your definition of secure.

For something to be secure, it should have the following three components of C.I.A (at minimum):

Confidentiality
Integrity
Availability

Does this link meet C.I.A requirements?

Having a download link like this: https://example.com/de2e1ecd-d5ee-42a7-8980-969961a4f397 meets the definition of confidential in and of itself because it is computationally infeasible  to find this file on purpose without prior knowledge of where it is. Brute forcing the site and trying every possible combination would take millennia.

The example uses SSL (TLS) so it is protected in-transit as well.

This does not meet the integrity requirement. We have no way of knowing if this document was altered by a MiTM attack, was changed by a bad actor at the server, etc... The file just is sitting on the server.

This file link does meet the availability requirement. Navigate to the URL, get the data. Doesn't get more available than that.

Where does the security break down?

The security of this link breaks down when you start to transmit the link to people to make it available.

Transmitting the link in plain text via email breaks any security that the GUID-named file ever gave you because unauthorized people can get access to the plain text URL.

In order to maintain the security, you would need to use a method of communication that used both encryption and authentication. Encryption protects the URL in-transit, and authentication ensures the person reading it is the correct person, and allows them to ensure the person who sent it really was you. (This adds even more complexity because computers cannot really guarantee the person reading the message is the intended recipient. An unattended, unlocked iPhone, the recipient held at gunpoint and forced to open the message, etc... could all be possibilities on how the message could be read by unauthorized personnel.)

This link never had integrity, so it can't be broken.

This link's availability is still maintained here.

How can you improve the security of the link?

Add a password for access to the system. A good on. 16+ characters, which are randomly generated from a password generator. This opens up yet another issue of password security, but for now, just use random passwords at a minimum length of 16. This adds a second factor, and secures the link against eves droppers. Of course, you can easily break this as well if you send the password in the same email as the link. The password must at minimum be sent out-of-band. (Email link, call and tell them the password). NextCloud and ownCloud offer this obfuscated link + password option, for example.
Use GPG / PGP to send the information to the recipient. This allows you to encrypt the message and sign it prior to sending it to the recipient. The recipient also has to have their password to decrypt the message. In this scenario, the information is properly and safely transmitted to a recipient, which maintains the integrity of the GUID link. Alternatively, you can use Signal or WhatsApp, which make this same process transparent and have widely accepted security standards and protocols.
Use public key cryptography to sign the document. Signing the document at the download location allows remote users to verify the document is in its exact, intended state and has not been tampered with since the original author authored it.

How much is too much?

You have to decide what your threat model is. What problems could you have if this file "gets loose?" If it's pricing for a customer, which may be different on a per-customer basis, and you don't want the customer to be able to guess another account to shop you, just the link is probably sufficient. If you're transferring confidential secrets that you don't want the company IT guy to find if he's bored, you're going to have to step it up a notch. If you're transmitting government secrets... well ... you get the point. Figure out what you are worried about first, then define the security parameters that need to be met within that context.

References

Information Security - Basic Principles


JS challenge based on computational complexity Assuming I have a website with a button that sends AJAX requests to my server which will be expensive to process.
I suppose that mostly cookie or JavaScript + cookie challenges are used to prevent (most) attacks from bots. This way, only requests sent by bots who can process cookies (and JavaScript) would be processed by my service.
However, requests by bots using headless browsers that support cookies and JavaScript will still be processed, so the system will still be vulnerable to this kind of attack.
I came up with another idea that uses a JavaScript challenge with more computational complexity to mitigate attacks. Like when hashing passwords, a higher number of hashing iterations will not be a problem for a legitimate user (because a few milliseconds won't hurt when hashing one password), but will prevent an attacker who gained access to a database from brute-forcing the hash (as those milliseconds add up to years).
My idea is that I give the user a script to compute a token that is needed to access the service, exactly like in a JS cookie challenge. But as opposed to a JS cookie challenge, I would give the user a script to solve a cryptographic problem that will take a few milliseconds on fast systems (and like 100ms on slow ones). After a legitimate request the user will get a new script/problem to compute in the background. A legitimate user wouldn't notice a script running for about 100ms in the background after loading the website and after each click on the button. However, an attacker would be limited to send about 100 requests per second per processor, and they would need a lot more resources to launch an effective attack.
With a scalable design, I could scale the complexity of the problem with my current server load, and I could give heavier tasks to users whose IP addresses generate excessive traffic. This design would also work without cookies, so I wouldn't have to show a banner when targeting EU states.
My questions are:

Does a system like that make sense? Is this used in practice and if not, why?
What would be a good scalable challenge for this? I would need a one-way-function that can be reversed with a simple algorithm (which of course is not efficient by definition). I am thinking about letting the user compute a prime factorization of a product of random prime numbers.

I would also appreciate literature recommendations about stuff like JS cookie challenges, as I couldn't find any.

An attacker can generate a token randomly without spending any resources on your computation. Thus it will not prevent attackers from brute-forcing.
For simplicity, suppose your tokens consist of 4 alphanumeric characters. An attacker will not waste time computing your algorithm and will instead generate all possible tokens directly: 0000, 0001, ..., 000a, ..., 000z, 0010, 0011, ..., 001a, ..., 001z, ..., 002z, ..., zzzz, ..., ZZZZ.
If you have longer tokens, the approach remains the same. You cannot force the attacker use your algorithm.
There can be many solutions for your problem. For instance:

You can generate tokens randomly and they should be long enough. Formally, make sure they have entropy 90 - 100 bits. If you use 64-characters set, then tokens should consist of 16 or more characters. You can store tokens in the database. Validation would mean checking if the token is available in the database and if it is not expired. Brute-forcing such long tokens will take much resources and a lot of time.
You can use signed tokens. E.g. use JWT. Then you don't need database. When you receive a token, first check signature. If invalid, then just ignore the request.


Server attack attempts, what are they trying to achieve? Recently, I have got a few 404 errors where the user has requested PHP pages.

The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4.  There is also some query string as part of the request.

  %2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E

Which translates to something like:

  -d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on+-d+disable_functions=""+-d+open_basedir=none+-d+auto_prepend_file=php://input+-d+cgi.force_redirect=0+-d+cgi.redirect_status_env=0+-n

I do not have cgi-bin or php folders exposed so I am not overly concerned about these requests but I am curious as to what they are looking for to ensure I am patched up.

All of the exploit boards are exploding with the recent Apache + PHP 5.x remote code execution vulnerability.  Every HTTP server on the planet is getting hit with this right now.


Static MAC address on Switches and routers I was having a discussion with a friend of mine in IS industry and he insisted that setting static MAC addresses (i.e. port security) on devices were a effective way to block MAC spoofing. I found this hard to believe as it does not prevent an attacker from sniffing and finding the MAC addresses of legitimate traffic and then spoofing it.

Question then is, would static MAC address on switches and routers help prevent attackers gaining access through MAC spoofing and if so, how?

Assigning a specific MAC address to a specific port guarantees that only a device with this MAC address will get connectivity on this port. This policy is usually done in combination with monitoring the port for policy violations to detect if somebody plugs in a device with another MAC address.

Thus an attacker has to use passive sniffing techniques to get the MAC for the device used on this specific port and then replace the device with its own. But with a simple replacement the other device will no longer work. Since this might get detected the attacker needs to employ a more intelligent solutions. At the end the knowledge and care needed by the attacker to be stealth is much higher than without static MAC assignment and the chance to get detected is higher too. This makes static MAC assigning not a 100% secure solution against MAC spoofing but makes spoofing considerable harder which is in most cases enough.


SSL browser session keys I am trying to export/write the SSL master secret and keys to a file from the chromium browser. I would appreciate if someone could advice me how to do this.

To write the premaster secret we can simply export the SSLKEYLOGFILE variable in the environment. The premaster secrets can be used by wireshark to decrypt an HTTPS session.

The premaster secret is used to compute the master secret which is further used to create 6 keys - CLIENT_WRITE_MAC CLIENT_IV CLIENT_WRITE and 3 more for the server.

I want to output these keys to a file instead of the premaster secret.

I figured if I could use wireshark code to simply output it but this is more complex I believe the code for wireshark handling SSL packets and using the premaster secret is in here. github.com/boundary/wireshark/blob/master/epan/dissectors/packet-ssl-utils.c

Another way to proceed is to make changes to the chromium browser and compile it. I think changes need to be made here. https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/derive.c&q=client_write_mac_secret&sq=package:chromium&type=cs&l=214

I was going through more source code and I found this file to be related.

https://code.google.com/p/chromium/codesearch#chromium/src/net/third_party/nss/ssl/sslsock.c&q=SSLKEYLOG&sq=package:chromium&dr=C&l=3569

Looking at the code above I notice that there are more environment variables that can be set. Does anybody know if the SSLDEBUG environment can be set in the same way as the SSLKEYLOG variable. Any other way or technique to do this would help also

I have not been able to successfully do export the keys so far.

The six keys are derived from the master secret, the client random and the server random. You can get the master secret and the client random from the SSLKEYLOGFILE. I suppose you can sniff the server random with Wireshark from the server key exchange message.

If you have those, you can call some library function or script on them to get the six keys.

The way this works is that a HMAC is computed over the random numbers and the master secret and the result is cut in parts to get the six secrets:

  To generate the key material, compute

  key_block = PRF(SecurityParameters.master_secret,
                  "key expansion",
                  SecurityParameters.server_random +
                  SecurityParameters.client_random);

  until enough output has been generated.  Then, the key_block is
  partitioned as follows:

  client_write_MAC_key[SecurityParameters.mac_key_length]
  server_write_MAC_key[SecurityParameters.mac_key_length]
  client_write_key[SecurityParameters.enc_key_length]
  server_write_key[SecurityParameters.enc_key_length]
  client_write_IV[SecurityParameters.fixed_iv_length]
  server_write_IV[SecurityParameters.fixed_iv_length]

More info:

Decoding TLS with PHP
The First Few Milliseconds of an HTTPS Connection
Fun with the TLS handshake


The First Few Milliseconds of an HTTPS Connection [TLS 1.2 / TLS_ECHDE_RSA_WITH_AES_128_GCM_SHA256] In his blog post, 'The First Few Milliseconds of an HTTPS Connection', Jeff Moser does a wonderful job of walking through the TLS/SSL handshake process, and explaining what is happening on the client side, what is happening on the server side, and what is going over the wire during each step of the process.

But, being that the post was written in 2009, the article describes the process using TLS 1.0 with the TLS_RSA_WITH_RC4_128_MD5 cipher suite.  Of course, TLS 1.0 with this cipher suite is now considered to be deprecated.

I'm interested in seeing a similar walk-through based on SSL/TLS protocols and cipher suites that are considered to be secure today (preferably with perfect forward secrecy) - e.g. TLS 1.2 with TLS_ECHDE_RSA_WITH_AES_128_GCM_SHA256. Would anyone on here be interested in taking a crack at writing one?

Disclamer: I am NOT a professional cryptographer nor an expert on the subject, only a security enthusiast. Therefor, I strongly encourage anybody more qualified to improve this post.

Before we start, I assume you mean "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (0xC0,0x2F).

So based on the article you published, here what would change compared to TLS1.0.

TLS1.2

[Client] ClientHello

First things first: the protocol version should be 1.2 (0x0303) and the client specifies the following parameters:

Supported cipher suites
Supported extensions along with their associated values (server name, named curves, EC point format, ALPN support, signature algorithms, etc.)

See below a capture of a ClientHello packet (Firefox 51 Nightly).

⚠ Some extension parameters aren't unfolded because empty/irrelevant.

[Server] ServerHello

The server picks its preferred cipher suite (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) and point format (uncompressed (0) since it's listed as first choice) and send it back to the client.

[Server] Certificate

The server returns its RSA certificate, nothing changes here.
The server authentication process is identical to the one detailed in your article.

[Server] ServerKeyExchange

The server send the curve type (named_curve), the selected named curve (secp384r1), its ephemeral public key (04:31:b9:9d:bc:66...) and the selected algorithms for hashing and signature.

The signature is defined as:

SHA-256(ClientHello.random + ServerHello.random + ServerKeyExchange.params);

and is signed by the server's private key.

The curve secp384r1 (also known as P-384 under NIST classification) is standard and defined by the following equation:

E: y2=x3+ax+b (mod p)

with the following domain parameters over the prime field Fp-384:

p = 2384 − 2128 − 296 +
232 − 1 = 39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319
a = -3
b = 27580193559959705877849011840389048093056905856361568521428707301988689241309860865136260764883745107765439761230575
g(X,Y) = 26247035095799689268623156744566981891852923491109213387815615900925518854738050089022388053975719786650872476732087,
8325710961489029985546751289520108179287853048861315594709205902480503199884419224438643760392947333078086511627871
n = 39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942643
h = 1

All these parameters are public.

Side note: Both the client and server have agreed on using a named curve, resulting in a much smaller Server Key Exchange packet since the domain parameters are standardized and thus known by both parties.

The server public key is calculated as:

Kpub = Kpriv × G

The server private key is just a random number, defined as:

1 ≤ Kpriv ≤ n-1

[Server] ServerHelloDone

No difference with TLS1.0.

[Client] ClientKeyExchange / ChangeCipherSpec

This packet contains the client's ephemeral ECDH public key. It's calculated the same way as the server's public key (again, the generator G is common between the client and the server).

From that point, the client advise the server the next message(s) from it will be encrypted.

[Server] ChangeCipherSpec

The server acknowledges client's last message by returning the same ChangeCipherSpec message.

Beyond that point, all communications are encrypted using AES-GCM 128bit.

The symmetric key is calculated on both parties by multiplying its own private key by the other's public key i.e.:

Client : Symmetric Key = Client Kpriv * Server Kpub
Server : Symmetric key = Server Kpriv * Client Kpub

TLS 1.3 (bonus)

As of today (august 2016), TLS1.3 is still a draft so it would be premature to deep dive in it. Still, writing similar article based on packet sniffing would be tricky on TLS1.3 because the handshake is vastly different as illustrated below:

Source

As you can see, sniffing the handshake sequence (using cloudflare server) won't tell you much since the relevant data are encrypted in the ServerHello packet (see "EncryptedExtension" field).

I couldn't illustrate the sequence using Wireshark since TLS 1.3 is not supported yet.


What's the mechanism used to extract my user name on a website? I was browsing this forum

http://openelec.tv/forum/64-installation/40869-putting-openelec-onto-sd-card-using-usb-reader-from-a-mac-for-raspberry-pi

,and realised that they show my hostname and my (computer's login-)user-name. How does my computer communicate these things to the website?

NOTE: Mystery solved. The person in that forum thread just happened to have the same host- and username as I did. I checked on another computer.

Sorry, I should have checked first. Moderators: Perhaps please delete the question.

Hostname can be retrieved by a DNS lookup on your IP address (PTR record). Your IP address is sent to the website at TCP level as your browser makes requests to retrieve content. The website simply uses that information.

Regarding username.... you do not specify which username is displayed. I can only assume you have registered and logged into the site.


Why isn't there a Global Root for SSL? I was just wondering why there is a file on your computer implementing the trusted root CA's instead of something similar to DNS where there is a file on root servers that computers check against to retrieve the list of trusted CA's?

Thanks again,
Francis

There is no World Overlord because there are too many candidates for the post.

The whole X.509 protocol is completely up to the task of having a single root CA. However, there is no single root CA because people could not agree about who should thus be entrusted with complete power over all certificates.

Or, from another point of view, there is a Global Root. He is called Bill Gates. Internet Explorer will validate a certificate against a list of locally known and trusted root CA, and that list comes with Windows, and is updated through the official update mechanisms from Microsoft. Therefore, for 99.9% of the people (who don't fiddle with their locally installed root CA), Microsoft decides, ultimately, what root CA are trusted. In that sense, Microsoft is the Global Root (at least for all Windows users).


How to protect against portable applications There are many portable apps around that could be downloaded and run on local PCs.
Usually running of exe could be blocked by using UAC. however, in this case of portable applications, how do I mitigate/restrict from execution? ( I know restricting staff from plugging in USB is one way ). Thanks

I use programs in my computer such as the commercial Faronics Anti-Executable and the free version of NoVirusThanks EXE Radar.

These programs whitelist all the existing programs in your computer at setup and then for every new program that executes they ask you for permission to allow execution.

In other words you have control over the future program executions.


Java SSL factory connection to SSL server (with just public-key and certificate) I am trying to connect to a SSL web server.  We currently have a pkcs12 file and connect, that is our private-key and certificate.  Is it possible to connect using Java code with a public-key and certificate.   Imagine I have a file (it is digital but here is the pem output).

> Myfile.pk12 / Myfile.pem
>
> -----BEGIN CERTIFICATE----- ...
> -----END CERTIFICATE-----
>
> -----BEGIN ENCRYPTED PRIVATE KEY----- ...
> -----END ENCRYPTED PRIVATE KEY-----

And we can connect to the server with this:

import org.apache.commons.httpclient.DefaultHttpMethodRetryHandler;
import org.apache.commons.httpclient.params.HttpMethodParams;
import org.apache.http.HttpEntity;
import org.apache.http.HttpHost;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.conn.params.ConnRoutePNames;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.impl.client.DefaultHttpClient;

KeyStore keyStore = generateKeyStore();
    System.out.println("==>" + keyStore);
    SSLSocketFactory socketFactory = new SSLSocketFactory(
                                    SSLSocketFactory.TLS,
                                    keyStore,
                                    KEYSTORE_PASSCODE,
                                    null,
                                    null,
                                    (X509HostnameVerifier) SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

This works, but let's say we connect with the certificate and public key. Wouldn't Java internally create a private key based on the keystore we provide and that would allow us to connect?  E.g.

> MyfileNEW.pk12 / MyfileNEW.pem
>
> -----BEGIN CERTIFICATE----- ...
> -----END CERTIFICATE-----
>
> -----BEGIN PUBLIC KEY----- ...
> -----END PUBLIC KEY-----

If the public key is embedded in the certificate? Can I use Java to send a request to the server without pre-creating a private key?

A certificate is a public key and the matching private key.

What you are referring to as the certificate between the BEGIN CERTIFICATE and END CERTIFICATE tags is likely a public key.

The basis of public-private key cryptography is that it is computationally infeasible to generate a private key from a given public key. The public key and private key (i.e., the certificate) are generated together. The private key is used to encrypt messages that can only be decrypted with the public key. The public key is used to encrypt messages that can only be decrypted with the private key.

Without the private key, the public key cannot be used for SSL encryption, as the message could not be decrypted on the receiving end (or could not be encrypted on the sending end).

A PKCS #12 file usually contains both the private key and the public key and is typically encrypted and stored in a binary format. The formats you are describing with the BEGIN and END tags is typically a PEM format, a Base-64 representation of the DER formatted keys.


Can I get malware just by navigating to a webpage? Is going to a webpage a risk per se? If yes, how does work, and how can we defend ourselves from this? I have to constantly review websites and I get the links from job seekers (that is, I'd navigate to lots of pages, not necessarily from people that I know anything about). Disabling javascript is not an option.

Since browsers and plugins like flash are not bug-free there is a non-zero risk that you can be attacked with malware just by visiting a web site or that your credentials gets stolen. These can be silent attacks (drive-by-downloads, cross-site-scripting, CSRF...) or social attacks (downloads of fake software updates, scareware, fake login,...). You will find these attacks everywhere, i.e. in your mail, in advertisements (malvertisement) and in compromised systems. These attacks are no longer restricted to the shady sites of the internet.

There is no way to eliminate the risk fully but you can reduce it in several ways:

Use a  browser with a good security record (i.e. fast fixes, good sandbox...). This is Chrome/Chromium in my personal opinion.
If possible use a secure OS which gets not targeted much, i.e. Linux. If you only do Web and Mail it will provide everything which Windows can do, only in a more secure environment.
Install a proper antivirus product if this is needed on your OS. This often does not help against the latest attacks but vendors try to quickly catch up. Don't take the one with the best marketing but look at independent tests.
Installing ad-blocking software which helps to reduce the risk of malvertising
Throw away plugins with a known bad security record, i.e. Flash, Silverlight and Java. Actually you don't need to use any Plugins today.
Keep your system lean and up-to-date. Throw away any software you don't need and don't install unknown software. Keep all installed software up-to-date. If it is out of support (i.e. old office versions) throw it away.
Get a router with a good security record. Lots have really bad security and can be easily used for man in the middle attacks.
Think twice before entering your login credentials anywhere.
Do sensitive things like online-banking on a dedicated system or at least another browser profile.
and there is probably more


How can I find the size of an array just from compiled C program? I'm playing around with buffer and heap overflow vulnerabilities, and it is all fine to exploit stuff when you have the source code and can see all the variables, their sizes and values, etc. But, what if I only have the compiled program, and I need to find a size of an array. For example, if we take the sample program below, which has declared some variables and an array, and at a later stage of the execution the array is passed to another function.

int main(int argc, char **argv)
{
   char test;
   char arr[100];
   double someVar;

   // Somewhere in the main call another function with array
   myFunc(arr);

   ...
}

If I didn't have the source cod,e but knew that the array is passed somewhere (gueesable), how would I go on to determine the size of the array? I mean I can always try to write something like a script where I always pass larger and larger argument to the program from command line, and see where it fails, but this is not a very practical approach (in my opinion). I guess reverse engineering may give some information, but how exactly? Can gdb also provide something useful? I mean what would be methods to determine the size of the array if the source code is not known?

There is a pretty good explanation at the following link on stackoverflow:

reverse engineering c programs

Short answer: There is no way to get exactly the same code that you have on a C written program.

It passes through many stages until it reaches binary code for a specific machine. It is somehow compared to an ice cube that melted, assuming that you have lost no water through evaporation. There is no way to get the original ice cube EXACT shape, unless you have a mold(and yet, the internal formation will not be the same).

Having a good translator that could look at assembly pieces and figure out whenever it could be an array, would be the best solution. But this tool does not seems to exist as far as i know.

This guy at re.stackexchange have some tips on how to look at the disassembled code, and get the information you want about C arrays:

How to find the size of an array in binary?


PGP on hibernation files? I was afraid reading this: This $299 tool is reportedly capable of decrypting BitLocker, PGP, and TrueCrypt disks in real-time. It seems to me that PGP and other sensible tools have to lock memory to ensure they where not be swapped, nor hibernated.

Seems to me that programmers know this, from  as long time swap and hibernation files exists!

So I don't know the target operating system (as I like to work with efficient tools, I've never work with this. But I know his poor reputation about core system).

My question: Could that be true!? Or is this a hoax?

If true, this give me another argument to tell some to migrate, but as everybody know I'm paranoid, nobody would believe or understand the importance of this.

To be more explicit: I'm an old computer actor, so I know a lot of things but even, while I do some sensible installation, like crypted disks or messages, everything is locked by default (cannot be swapped and will be unmounted before hibernation). If I try to build sensible thing in a less secured manner, I'll be warned.

Working for people who don't know anything about computer must imply some responsibilities. So I understand, reading this, that a huge amount of people, working  with confidence on his registered OS (they should pay dearly) are much less protected than they think!

Well known as a paranoid, I won't present this to my customers without your precious feed-back!

As @Lucas says in his answer, and as it says in the article the OP linked to:

  So, how does it work? Elcomsoft Forensic Disk Decryptor acquires the
  necessary decryption keys by analyzing memory dumps and/or hibernation
  files obtained from the target PC. You’ll thus need to get a memory
  dump from a running PC (locked or unlocked) with encrypted volumes
  mounted, via a standard forensic product or via a FireWire attack.
  Alternatively, decryption keys can also be derived from hibernation
  files if a target PC is turned off.

This is not new - this has always been possible, and in fact is often used by forensics teams where access to the running PC is available.

To be safe, you don't let others have access to your computer when it is on, (or off - see Evil Maid attack), ensure you don't leak information by leaving hibernation files, memory dumps or other unencrypted data around and generally follow the usual security guidance.


Why isn't Internet DNS based on blockchain? Aside from the fact that verisign makes a lot of money doling out certificates from a central location.

We already have such a system: DNSSEC, that allows precisely the control required.

The problem with using Blockchain with domains, is that theres no inherent link between the domain and the keypair using for signing.

So this information must be tied to each other somewhere. And somewhere would then be at the registrar, making the whole blockchain then useless as the registrar could then directly host the public key used for verifying - voilá - we reinvented the wheel: DNSSEC.

The blockchain is useful in 3 cases: Either, when you want to store public information, that can never be tampered with regards to time (time-stamping of information) or never be erased.

The third case would be where theres a inherent link between the domain and the key used for signing, thats whats makes the system truly decentralized. But then we would get web adresses that look like TOR onion adresses.
And TOR onion adresses is exactly this, hashes of public keys that makes it impossible to "forge" a site using a specific onion URL, and this can be validated without having to trust anyone.

To further illustrate the problem:

[secret data] = the private key
[public data] = the public key
[custom data] = your domain name or whatever name you want to associate with public key

There might be possible to create a process where you use some [secret data] + [custom data] to render a output of [custom data], but where [secret data] can be used in such a way that the corresponding [public data] can be programmatically related to [custom data] without having to trust anyone.

The only way I could come up with is a process like vanitygen, as if anyone can create a matching [secret data] for any [custom data], anyone could also "steal a domain name".

Thats why you need a trusted third-party, that will make this association, and make this association only for the person who owns the domain name in question, eg not allow this association for a domain name that is taken. So when it comes to domain names, you MUST trust somebody.

Because I bet you don't want a domain name like this:

Hey. I created a new website.
Here it is: l05gh64k3wghvsk7jfs09a07654354f7

Then we don't need any DNS at all, we could simply use the IP adresses.