Received email from ISP saying one of my devices has malware My dad received a suspicious email from our ISP (mtnl.net.in).
The email was from noreply@mtnl.net.in and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP itself.

Email details below:

Subject:

"Intimation Regarding Malware/ Virus Infected Systems"

Body:

  Dear Sir/Madam,
  Greetings!
  It is observed that your device connected with MTNL Mumbai broadband network with broadband number xxxxxxxx@a is infected with Malware. This is as per the analysis of Computer Emergency Response Team -INDIA (Cert-IN), under the Ministry of Electronics and Information Technology.
  Malware (CNC) is unwanted software that is installed in users system without users consent while user is surfing on the Internet. An attacker or cybercriminal can remotely send commands to such systems which are compromised by malware. These compromised machines can be used to create powerful networks (botnet) of infected devices capable of carrying out distributed denial-of-service (DDoS) attacks, stealing data, deleting data or encrypting data in order to carry out an extortion scheme.
  The device becomes part of the botnet due to malware/virus installed on it.
  To secure your devices , Kindly check your devices for malware/ botnet using Antivirus S/w.
  For more information on malware/botnets and the counter measures kindly visit https://www.cyberswachhtakendra.gov.in. You can also download "Free botnet removal tools".
  Thanks & Warm Regards,
  MTNL, Mumbai

I extracted all links from the email and scanned them via the https://www.virustotal.com/ URL scanner but all were reported as safe.

Links:

http://www.cert-in.org.in/
https://www.cyberswachhtakendra.gov.in/
https://www.quickheal.co.in/bot-removal-tool
http://mtnlmumbai.in/index.php/broadband/triband/promotional-plans#unlimited-high-speed-plans
https://selfcare.mtnl.net.in/mumbai/TribandRegistrationInstn.aspx

Looking online there is a similar question on Quora but a different scenario.

NETWORK AT HOME

Two mobile phones (Android)
One laptop (Windows 10 with Avira antivirus)

QUESTION:

Can an ISP really detect this?
Should I act on this and what should I do?

To answer some of the questions:

Only the above 3 devices are connected to the wifi, no other IoT devices.
My parents are the only users ... so you can rule out TOR browsers or any inappropriate searches.
Also no VMs on the network.
I will try to contact the ISP but they are a government one and have very bad support.

Also after doing some more research it seems that Quick Heal has a tie up with MTNL and BSNL, both government providers, so there is a chance they might be just promoting Quick Heal.

Links: Link1 Link2 Link3

Personal note: I find it very odd that MTNL is actually taking trouble to find bots !!

Can an ISP really detect this?

The ISP can see all data your systems exchange with the internet (but not the plain text from encrypted data). Based on this he can detect botnets which often show typical behavior.

  Should I action on this and what to do?

Yes, you should action on this since there seems to be malware in your network which is used to disturb other systems on the internet (sending spam mails, DDoS attacks, used as VPN to hide malicious activity and others) and which might also affect your internal network (infect computers, steal data, take data as ransom ...).

If you don't fix the problem you might also risk that the ISP restricts your network or even completely disconnects you from the internet (depending on the terms of service).

Based on the information you've provided it is impossible to say what exactly the problem is though. It might be that your laptop is infected (Antivirus do not offer 100% protection) or that one of your phones or that the router itself. It might also be other devices in your network you are not really aware of, like a TV, printer, IP camera or other IoT devices. And it might be also caused by software you have knowingly installed yourself, but which has a hidden malicious functionality you are not aware of.

The links they provided in the mail seem to be fine so that you can follow these for more information and for the offered botnet removal tool. But if you are in doubt if the mail really originated by your ISP please contact the ISP - it is impossible for us to see based on the information provided what the real origin of the mail is.


Is my WiFi connection protected? In my college the WiFi is open type connection and before I connect to it using my laptop with windows 8.1, it displays message "Other people might be able to see info you send over this network " (See the snapshot). Also important to mention that they do MAC address filtering that is, to connect to the network we are required to provide MAC address of the device on which we want to use internet.
Now I want to know that is it possible that the whole internet history and all related information is/can be intercepted by someone on the network? If yes, then how I can prevent it from happening or protect my information?

If possible please explain with example,so that I can tell the problem to concerned authorities so that they take necessary steps to protect users.

Everything you send over the network is visible to anyone near you. Even if they do use MAC filtering, it doesn't help -- with no encryption on the network, you're broadcasting every packet in the clear over radio. Any wifi card capable of monitor mode can record everything you send. As André mentioned in comments, this is also potentially vulnerable to active attackers. MAC control does not protect users of the network from eavesdropping; it makes it slightly more annoying for an unauthorized user to connect to the network (this does have its uses; it discourages casual passersby from using the school network, and might fulfill some bureaucratic requirement that the school needs to follow), but that's it. At the scale of a large university, a pre-shared key would be no better (it might as well be completely public).

The only way to protect against that is to encrypt your traffic. A VPN can be a very effective way to do this; if you can connect to your school's VPN from the wifi network, this will encrypt your traffic over the air. Likewise, any site you visit using HTTPS will be encrypted, so an eavesdropper can't read your messages.

At a network level, the school has more options: the best one by far is to offer a secure network using WPA2-Enterprise, for which you log in to the network with school credentials, which are used to derive an encryption key specific to you (with WPA2-PSK, anyone else who knows the wifi password can still eavesdrop or perform active attacks; with Enterprise, they can't). For devices that don't support this (like game consoles), there's no really good option; what my school does is run a WPA2 secure network that everyone's recommended to use, and run an unencrypted MAC-controlled network for devices that just don't support the secure network. This requires some amount of infrastructure (nicer APs support it better, with one AP carrying both those networks), but it works well for security.


Is there any way to hide my using the internet (or maximize privacy) when connected via router to other computers? I shall begin my question with the remark that I am not tech savvy at all!

The problem is the following:

A cluster of computers (laptops, desktops, etc.) A, B, C, D... are all connected to the same router. Let's say my computer is computer A and I am a guest at big brother Bob's home, who owns the router and computers B, C, D...

Assuming Bob has no physical access to my computer but can access the other computers, is there a way to prevent Bob from knowing what I am doing on the internet, or even better, to completely hide from Bob that I used internet at all? (short of his contacting his ISP and demanding a report or something which would take a non-trivial amount of time and assuming I don't download anything or watch HD videos which could show up as a sudden spike of consumption)

When it comes to hiding the names of websites I visit and internet searches, according to some research it seems like Tor does a good job in hiding it completely, even if the ISP is contacted. However, can Bob determine quickly (i.e. without contacting his ISP, using some cmd dark arts) that computer A has connected to a Tor node at all without physically accessing computer A? (Let's say it's not in the cluster anymore when Bob does his checks)

According to further research it seems to be impossible to get the internet history of all connected devices to a router without access to the devices, but I am unsure and opinions seem to vary somewhat.

TL;DR I'm basically looking for a way to make my internet usage as inconspicuous as possible during a very specific time period when indirectly connected to other computers via a router I don't own, is using Tor the best thing I can do in this situation to maximize privacy?

Thank you.

Let's take this from Tor backward.

Yes using Tor is likely going to maximize your privacy and anonymity. That said, Tor comes with usability issues that may not be worth the pain for your needs. You can try Tor easily enough by downloading and running TBB (Tor Browser Bundle). Anyone who can access the router traffic can see that you are using Tor but no content or destination information.

A commercial VPN service will provide a secure encrypted connection out through the router without the usability issues of Tor. Anyone who can access the router traffic can see that you are using a VPN but no content or destination information. Of course the VPN can see what you're doing, but you didn't indicate that was a problem.

Doing nothing special on a switched network. Normally the router connects everyone via a switch. This means that the other computers would not normally be able to see your traffic anyway unless they can access the router traffic (or router logs). It's technically possible to poison the network, but I'm assuming you're in a benign environment.


How to prevent persistent XSS vulnerability with the Java Struts 1 Framework? I have an application that executes under Tomcat 7, developed with Struts (Java Web Framework). My application contains a security vulnerability (XSS Cross-site scripting).

What kind of XSS vulnerability is it ?

Persistent (or stored)

How is it introduced and what is the context ?

Enter value in the textfield

What Java frameworks are you using ?

Struts 1.3

XSS is performed by the HTML code, which was introduced by a third party and is performed by the application. In the following example shows the vulnerability:

<html:text name="grupo" property="description" size="50" alt="Description"/>

After submit the form:

Don't know about Struts if it has some built-in protection, but you could escape (sanitize) the html tags, so that when the script tag is printed to the page, it won't be executed. You should put your sanitization code to the action controller where the form submits to.

Replace "<" character with &lt; and ">" with &gt;. After that script tags won't be executed.

OWASP XSS cheat sheet will help you to mitigate XSS vulnerabilities: https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

Or as @dandavis commented: a CSP would help to mitigate if you can't update the app logic.


Is it possible for digital forensic evidence to be multiple types of evidence at the same time? I'm studying for the CCSP certification and the online training course I'm taking is a little vague on the topic of evidence types (within the context of digital forensics).

Specifically, I'd like to know if it's possible for evidence from a digital forensics investigation to be multiple types of evidence at the same time.  For example, can digital content bet Direct Evidence and Real Evidence and Best Evidence?

The instructor presented them as completely separate types of evidence independent of one another but it seems to me that there could be some overlap here and that one piece of digital evidence could serve multiple purposes.

Let's first map out what each of these terms mean:

Direct evidence: "proves or disproves a fact directly." It's common for direct evidence to take the form of eyewitness testimony, but this doesn't have to be the case. Real or documentary evidence can be direct evidence, too.
Real evidence: used interchangeably with physical evidence, is "any evidence that is a tangible object, as opposed or oral testimony or documentary evidence, which records information that is offered as evidence." What's more, it's "used to prove a fact based on the characteristics of all or part of an object." For example, if I'm at a stoplight and I get rear-ended and my airbag deploys, the airbag would be an example of real evidence.
Best evidence: "requires that an original or a highly accurate copy of a document or other object be brought into court."

Now to your question: Can a piece of evidence fall into all three categories?

Yes, and here's a (common) example. Imagine an external hard drive with a terabyte of child pornography on it. If a forensic scientist can demonstrate that the external hard drive belongs to the defendant who is being accused of possessing child pornography, then the direct evidence condition has been met.

For real evidence, let's assume that the defendant covered his external hard drive with a variety of stickers. Upon examination, the defendant plays dumb, but the prosecutor reveals that a search of his apartment found sheets of the same stickers that were on his hard drive. The characteristics of the hard drive, the stickers, would be good reason to believe that the hard drive belongs to the defendant.

Lastly, the original hard drive of the defendant or a forensic copy  could satisfy the best evidence condition. Hashing the forensic copy can verify that the "image" (in the digital forensics sense, not necessarily a picture) is identical to the source media, which would mean that the forensic copy of the digital hard drive would satisfy the best evidence condition.

Sources:

http://www.rotlaw.com/legal-library/what-is-real-evidence-is-it-the-same-thing-as-physical-evidence/
http://www.rotlaw.com/legal-library/what-is-circumstantial-evidence-what-is-direct-evidence/


Can all the (other) recepients of a PGP encrypted message be identified? Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody?

To a large extent, yes. See RFC 4880, section 5.1: for each recipient, there is a "Public-Key Encrypted Session Key Packet" which contains the recipient key ID. This key ID is a 32-bit value which is used as index in key servers; there are key ID collisions, so this is not an absolute, totally accurate indication of the recipient, but it still gives a lot of information.

Theoretically, an all-zero key ID can be used as a way to discourage traffic analysis, but this is not a complete solution. For instance, with RSA keys, the packet still contains an integer between 0 and n-1, with n being the RSA modulus, with a fairly uniform distribution. Thus, observing many messages can yield, statistically, the first (most significant) few bytes of that modulus, which can be used to discriminate recipients from each other.


Getting encrypted password I have seen many hackers bruteforce password for gaining access to social media.

In famous Mr Robot series it is shown that Elliot(main character) brute forces people and the password is displayed on screen.
But for brute forcing we need the encrypted password.
So how does a hacker get this encrypted password?
(Mainly for social media)

There are multiple ways to get access to accounts.

Online Attacks

One way is to try to log into the account online, by just trying a bunch of different passwords. This usually only works with services that don't care at all about such attacks, as any more security-aware service would start to run anti-automation techniques, such as CAPTCHAs or just slowing down the connection. However, in such a case, the attacker only needs a password candidate and nothing else.

The biggest downside is that these are very noisy (meaning that the site can notice easily that something is amiss) and very slow - both things attacks generally don't want.

Offline Attacks

Offline attacks are what people think of when they hear "password cracking". Attackers steal the hash of a password, along other relevant information (e.g. salts, parameters, etc.), and attack those offline. This means they try to find the input that, using the same parameters and the same function, will result in the same output.

The advantage is that there is no need to continuously communicate with the service you are trying to attack. This makes things a hell of a lot faster (several orders of magnitude, in fact), and also less noisy.

The obvious disadvantage is that attackers need to gain access to the hash first. One way this is done is to simply look for existing leaked hashes. People love re-using passwords and as such, if you find that Alice uses some password for LinkedIn, chances are high she'll also use the same password for Facebook.

Another way is to attack the service directly and attempt to get access to the database. If it's a read-only access, then you can dump the hashes and crack them offline. If it's read-write access, you can be even more malicious and replace the original hash with one that corresponds to a known password, use this to log in as Alice, do something malicious, then set the hash back.


Potential HTTP Host header attack from malicious IP, what does it mean in practical terms for me? Should I be concerned? I'm asking about an error I've got a few times in the past day, outside of the theoretical. I'm wondering what may be actually happening in my case.

The error comes from Sentry, on my ubuntu/nginx/uwsgi/Django via AWS Elastic Beanstalk stack:

Invalid HTTP_HOST header: '54.149.10.254'. You may need to add u'54.149.10.254' to ALLOWED_HOSTS.
Exception while resolving variable 'exception_type' in template 'unknown'.

54.149.10.254 is associated with scan-15.shadowserver.org. ALLOWED_HOSTS is there to prevent the HTTP host header attacks.

Should I be concerned? What is going on here in concrete terms?

Thanks

Should I be concerned?

Not particularly.  You're being scanned by a known non-malicious party called
Shadowserver.  They're very open about their activities and intent.

Bear in mind that on the Internet you're going to get scanned.  A lot.  By many people who are outright malicious.  While some may have legitimate concerns about 'scan vigilantes' like Shadowserver, Shadowserver is certainly more benign than a lot of other traffic you can expect to receive.

  What is going on here in concrete terms?

They are connecting to your web server and sending a request using an invalid Host: header - one that doesn't match your actual site, but actually matches their IP.  There are a variety of ways the host header can be abused; Shadowserver is looking for vulnerable IPs.  Given their mission statement, they're probably looking for web servers that can be tricked into sending or redirecting traffic to [the IP they used in the Host: header], which would indicate that those web servers can be abused in an amplification attack.

The fact that your server reports Invalid HTTP_HOST header leads me to believe it correctly rejects connections which don't contain a valid Host: header for your site.  Good job.


What is the ideal technique to protect unauthorized redirects I'm looking for the best way to secure unauthorized redirects from GET parameter where

url=http://example.com

I'm thinking about creating an unique identifier like using a hashing function (md5 for example) and check whether hash(url) === passed hash via GET to validate the redirect or deny it,

Where passed hash is within an html tag like: <a href="?url=url_here&hash=pre_calculated_here"> And I think this is bad because an attacker can figure it out, maybe add an unique HASH_SUFFIX by applying md5 to url+hash_suffix

What is the best way to protect my redirects?

Thank you.

If you only have one domain you can usually get away with simply prefixing a safe url (should have) handler://host/ (<--- the final slash is important).

redirect("https://example.com/"+$url);

Or you could whitelist all the known domain prefixes and compare the url to the whitelist (again safe url rules from above applies).

If you're planning on precalculating all the hashes of the redirect urls I presume you know all urls and you could just make a lookup table:

if ($url=="0000") {
  redirect("https://example.com");
} elseif ($url == "0001") {
  redirect("https://otherplace.com");
}

A whitelist will always be more effective than obscuring the redirect. Adding a prefix or suffix to the url before hashing can still be bruteforced just like a password hash can be, just consider the url a salt, but its unlikely that any attacker would go through that much effort. Open redirects by themselves are not significantly more dangerous than users clicking on links in email.


Keep OpenPGP revocation certificate in safe place? Do I have to keep the revocation certificate of my OpenPGP key in a safe place or may I place it in e.g. Dropbox to have it ready on all my machines?

I know that, if compromised, the certificate can be used by anyone to revoke my key. I am just assuming my Dropbox/whatever place is reasonably secure from unallowed access.

Anybody with access to your revocation certificate is able to revoke your key, with you losing all reputation in the OpenPGP web of trust in consequence (but that's it, he will not gain access to your private key).

You can put it anywhere you like – it might just not be reasonable. How bad this would be and how much the gain of a less secure storage would be is your decision. Anyway: be aware you will (hopefully) never need it. Though, if you have to expect your key to be stolen at any time with a reasonably high chance, it might be a good idea to have the revocation certificate at hand all time. You will have to find the balance between availability and security, where exactly to go depends on your needs and must be your decision.

Cloud hosters should never be considered save nor trustworthy.

I'd recommend to additionally create a QR code with the certificate, print it a few times and store it in your bank safe or with somebody you trust, for example your parents. You can create such a QR code using gpg --armor --gen-revoke [Key-ID] | qrencode (probably you will add some options, but make sure to print it next to the code, just in case...).


Preventing buffer overruns when performance is no concern Anti-exploitation technologies (DEP, ASLR, stack protector, etc.) do not provide complete protection. One reason for this is performance; these technologies are designed to work with a low performance overhead.

For a system that has high security needs, but low performance needs, are there techniques that can provide more reliable protection against buffer overruns (and other memory corruption flaws)? As a rule of thumb a 10x slow down would be no problem, although a 100x slow down would probably be unacceptable.

I'm interested in both theoretical techniques and practical systems.

Edit: To be clear, I'm talking about a system that needs to run an existing code base in a non-memory-safe language. So Java, .Net, etc. won't help.

Language interpreters such as those mentioned here should be able to detect out-of-bounds memory accesses with high reliability. In exchange for this higher reliability the interpreters will run your application slower (I have no stats but saw numbers saying 5x) and will likely introduce incompatibilities with the compiled code. These incompatibilities may be due to interpreter bugs or just looseness in the language spec. You should check the settings on the compiler you use as they may have options to enable extra memory checks at a performance cost.


Should I sign software release keys with my own key? A good practice is verifying software with a team signing key, to ensure the software hasn't been tampered with.

The problem

When I verify a download, I usually stumble upon the following message:

$ gpg --verify keepassxc-2.3.3-src.tar.xz.sig
gpg: assuming signed data in 'keepassxc-2.3.3-src.tar.xz'
gpg: Signature made Wed May  9 19:40:24 2018 CEST
gpg:                using RSA key C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8
gpg: Good signature from "KeePassXC Release <release@keepassxc.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BF5A 669F 2272 CF43 24C1  FDA8 CFB4 C216 6397 D0D2
     Subkey fingerprint: C1E4 CBA3 AD78 D3AF D894  F9E0 B7A6 6F03 B590 76A8

I don't really like this part:

  gpg: WARNING: This key is not certified with a trusted signature!

  gpg: There is no indication that the signature belongs to the owner.

Each time I want to install the software on a new device, or each time a new version is released, I need to do the same tedious job: I need to find the official page where I can compare the key fingerprint, and cross-check it with multiple other sources to make sure the official website hasn't been compromised. Not a good UX at all.

One possible solution

One simple solution is to certify the key once and for all, so the check (i.e. the "tedious job", remember?) is done only once. Once I've certified the release key, I can just quick check the gpg output of my freshly downloaded file: no warning --> file OK. Simple.

Even Kleopatra suggests to certify a key by comparing the fingerprint from the official website:

The question

I've read that it is not a good idea to sign a key from someone who you haven't met in real life. But usually, the release keys are not held by a unique person, but by a team, so it's kinda difficult to meet the people in real life.

Is this a good idea to sign a release key (after having cross-checked multiple sources)?

The idea is the same as a public key infrastructure. The Root certificate authority (self-signed) signs the signing key. Root CA --> signing key

In the event the signing key is compromised, it can be revoked by the root CA, another signing key can be issued which is signed with the root CA. Then you can ensure the new signing key is issued by the vendor. It creates a chain of trust as we use with HTTPS. I am not saying a PKI does not have disadvantages, direct compromise (root CA) being one, but it allows for automation, easier validation and does not directly expose the self-signed certificate.

Notice the Root CA is offline, which should greatly mitigate the risk of compromise.

  is: is this a good idea to sign a release key (after having cross-checked multiple sources)?

This is quite a delicate answer. As the signing (release) key needs to be validated, otherwise, we could be downloading potential malware, and believe it was released by the vendor as the package is signed. My opinion is, the more sources we can validate from before using the signing key for long-term use, the better.

What happens if my signing subkeys are compromised? should give some insight.


How to block foreign language UTF-8 characters in usernames? I am using UTF-8 for a new website, so I can do internationalisation on different pages, for example in greek (ελληνικά). I asked a question here earlier about possible security bugs this could bring and some people mentioned ones for example: "admin" (english alphabet) and "аdmin" (cyrillic "a") look absolutely the same however have different character codes and someone could register another account called "аdmin".

I am wondering what's the best way to completely filter out non-english alphabet characters. In the account information page I have a field for changing the username (for example, I don't actually), how would I go about removing them? Should I add a function checking with regex or something?

function changeUsername($newUsername)
{
    if($this->isValidCharacters($newUsername) !== 1) {
        send message saying invalid characters
    }

    continue changin username
}

And if so, what would the regex look like, still allowing all symbols but NO unicode characters or other alphabet characters?

Or is there an even easier way of blocking all input coming in from being UTF-8? For example changing the default charset in php.ini back to the default and simply sending a header changing the charset when I'm outputting in another language? And if they do send input with another alphabet and my server doesn't have the UTF-8 charset on how does my server interpretate it? Do I still need to do checks?

(As I said in my other post, I have no idea what I'm doing when it comes down to character sets.)

Should I add a function checking with regex or something?

There are lots of unicode characters. Lots and lots of them. If you are concerned about weird characters in usernames, a blacklist will not solve the problem. You'll need to use a whitelist instead.

One solution is to go with alphanumeric plus some special characters like - and _. That could be done in a regex like this:

/^[a-zA-Z0-9_\-]+$/

If you want to be more permissive with the special characters you could allow all printable ASCII characters. They go from #32 () to #126 (~). So you would get this regex instead:

/^[ -~]+$/

Note that this will not give you any XSS protection - the username <script> would be allowed. Still, there are special characters this will forbid, like ¤ and £. If you want to include some, you can add them one by one to the whitelist.

  For example changing the default charset in php.ini back to the default and simply sending a header changing the charset when I'm outputting in another language?

Messing around with multiple charsets at the same time is a sure fire way of opening up XSS vulnerabilities and similar by mistake. Don't do this. Just stick with UTF-8 all of the time.


How can Facebook verify my face if it should not have one? I do not use Facebook but recently I created an account for the purpose of connecting it to an app. I uploaded several photos of myself to Facebook, did what I needed with the app and deleted the photos.

The next day I tried to login to my Facebook account and saw this:

How can Facebook use my photo to check if the account belongs to me? They now should not have any of my photos, right? Does this mean they actually keep deleted content?

Facebook does not need to store the deleted photos. All they need to do is to use the photos you uploaded to extract the biometric details to be able to recognise your face. That data is what they use to verify new photos.

This is all outlined in their privacy and security settings. You can turn the feature  to collect facial biometric data off.


How to approach ruling out that past developers are backdooring my website? My client says that one of his old developers found some code that allowed a past developer to access the site in certain ways. She wrote code to allow herself to log in to certain restricted areas and to send herself emails when certain things happened on the site, for example user sign up.

My client now wants to make sure that this is not going on. He has asked me to do this by looking over all the source code. Now that might be useful, but what is the best way to rule out that a past developer is using something like a backdoor to still access the site?

There are infinite many ways a developer can place intentional and unintentional backdoors into code. When the developer is skilled, they can hide them well and/or mask them in a way which appears like an unintentional mistake. A complete code-review is the only way to achieve reasonable certainty that further backdoors are unlikely to exist. But there is really no sure way to completely rule out the existence of backdoors.

When you are in a hurry, you could at least try to rule out the most obvious things before you start investigating the complete code line-by-line:

Take a look at the login and authentication code - this is the most obvious place to have a magic parameter, universal password or hardcoded credentials which allows one to log in without a valid account.
Check if there are any scripts in the codebase which don't appear to be referenced anywhere - they could be a hidden control panel or similar.
When email messages in particular are a concern, grep the websites codebase for those functions which send emails in your programming language. You could also monitor the webservers traffic for outgoing SMTP traffic to notice any emails which do not match the format usually sent by the application (when it is supposed to send emails at all).

By the way: This might also be a topic for your legal department to address. Backdooring the application is likely a breach of contract and might even be a felony in your jurisdiction.


Does running random "docker pull" essentially mean I'm giving someone root access? I just noticed I'm rather eager to test projects that have a Docker container bundled with them. I do realize that setting a sudoers exception for the "docker" command basically means giving root access on the host system to regular users. Is running random "docker pull" insecure as well or can I assume that the containers downloaded this way will not easily get root access to my Linux host?

Welllll....  The simple answer is 'no'.  docker pull must execute with elevated privileges, but that does not grant those rights to other users.  The kicker is "What comes next?"  If you are not allowing other users the right to run docker (such as creating a docker group with lots of users or generic users) than the risk is only a question of avoiding dodgy containers by only sourcing from reliable sites.

The real question is, "Why are you using docker?"  If it is just to manage images and build environments, the tool can be used with very little risk.  The closer you get to letting regular users run these system administrative functions, the more risk you undertake.


Why were hyperlink auditing pings used for DDoS attacks and not any other requests? A few days ago this new story has been published:

  Researchers have found that the HTML feature called hyperlink auditing, or pings, is being used to perform DDoS attacks against various sites. This feature is normally used by sites to track link clicks, but is now found to be abused by attackers to send a massive amount of web requests to sites in order to take them offline.
  […]
  In new research by Imperva, researchers have found that HTML pings are being utilized by attackers to perform distributed denial of services attacks on various sites.

The article goes on describing the attack that basically executed some JS to add a link with ping attribute and automatically ”click every second”.
It goes on in the same usual way describing that attackers are supposed to have “used social engineering and malvertising to direct users to pages hosting these scripts”.

Strangely it does not mention the victims, but just says these were “gaming companies”.

The question now is, especially considering they have used JS anyway, why did not they just use any other form of requests?

I admin, usual AJAX requests may have been problematic, as the attacked websites likely do not have CORS headers set, so they would have been blocked by the browser as they violate the same origin policy, but usually CORS does not apply to <img tags e.g.…
So they could just have used that.

Why did they choose the ping attribute for that, and are they thus more dangerous than other (common) methods for DDoSing?

There are some potential benefits of using <a ping>, but they are not unique to <a ping>. It is not outside the realm of possibilities that the attackers simply chose any working method to trigger network requests.

<a ping> works when JavaScript is disabled. But in this case the attack started with JavaScript. Even if JavaScript were to be disabled, there are many other ways to trigger a request to an external site, e.g. embedding images and stylesheets.
<a ping> requests are background requests. When the user leaves a page, the ping request will not be aborted. In this case, the attack relies on the page being around in order to send a ping every second, so this is probably not the main reason.
<a ping> requests' response body is ignored; the browser is allowed to immediately end a connection when a response body is sent by the server. This allows the attacker to carry out the attack with a low impact on the data usage, to make it less likely for the user to notice that their network is being abused.
<a ping> responses are not cached, so every ping will result in a request to the server. There are many other cache busting techniques to do so. The fetch API literally has an option to ignore the cache.
<a ping> requests are POST requests (and therefore not cached, see the previous point). This allows the same URL to be used. If random URLs were used (as a cache buster), then these may stand out in access logs. However, being a POST request is already somewhat unusual. Besides, these requests are uniquely identifiable by the "Ping-From" and "Ping-To" request header, as well as the more generic "Origin" header for cross-origin requests.

When I saw your question a few days ago, my first thought is "Why would there be a specific reason for doing so?". In the absence of any other probable answers, I guess that the answer is that there is no unique feature that the method provides. As said before, there are other methods with the above benefits, e.g. CSP violation reports, navigator.sendBeacon, fetch. There is nothing special about <a ping>.

The reason why you think that there may be something special to it is because a security firm posted an article about it, with a catchy headline and interesting write-up. Their final paragraph also mentions that these requests can be filtered, and of course they have a product that does it:

  Fortunately, web site and application operators have some control. If you are not expecting or do not need to receive ping requests to your Web server, block any Web requests that contain “Ping-To” and/or “Ping-From” HTTP headers on the edge devices (Firewall, WAF, etc.). This will stop the ping requests from ever hitting your server. (Note: Imperva DDoS Protection is already updated to prevent ping functionality abuse targeted at your sites.)


Using short hostname in X509 certificates We are using an internal Certificate Authority for our company.
We noticed that it is possible to add as subjectAltName the hostname without the domain. We are using example.org for internal servers and example.com for external, public facing servers.

E.g. instead of using mysite.example.org, we can create a certificate like:

Subject: CN=mysite.example.org
subjectAltName=DNS.1=mysite.example.org,DNS.2=mysite

In this way people can use https://mysite/ and it will work. The DNS search is example.org and example.com.

I have 3 questions:

is it secure?
what are the security problems that could be cause by such setup?
what is the type of attack that someone could take advantage of this config.

Edit1: It seems that public certificate authorities are moving away from signing certificates using an "internal name": https://cabforum.org/internal-names/ and https://www.digicert.com/internal-names.htm

is it secure?

a bit less than FQDN. The problem with short names is name ambiguity. FQDN is unique in public, but not necessary to be in private networks. The problem with short names is name ambiguity and nothing else. It is acceptable to use short names in small private networks, however it is impossible to maintain them in large networks. There is nothing wrong if you use unique short name in private networks. However, there might be an issue when multiple factory-provisioned devices are configured to share the same short name.

  what is the type of attack that someone could take advantage of this config.

an attacker still have to spoof name resolution mechanism (DNS for FQDN and NetBIOS for short names) to redirect client to rogue host with the same name.


Resetting LUKS password from CLI with the recovery key I have a dd of a computer which has a LUKS-encrypted partition. I do not have the password but I do have a recovery key which would allow me to change the password through a GUI interface when the computer is booted. Unfortunately, I no longer have direct access to the source computer to reset the password.

What I wish to do is reset the password using the recovery key so I can then access the data. I can obviously dump the dd copy to a HDD and boot the system but is there a way to reset the LUKS password with the recovery key through a CLI? I am thinking the ideal scenario is to mount the DD and then reset the password.

Thanks

For the partition which is encrypted with LUKS, you will need to get the offset for the partition as well as the logical sector size of the device. Using sfdisk together with a regex expression is useful for this. Assuming the partition number with LUKS is partition 2, and the image file is backup.img:

# set the partition number for LUKS and the image file
partdev=./backup.img
partnum=2

# get offset of partition, sector size, and the next free loop device
partoff=$(sfdisk -d $partdev | grep -oP "$partnum : start= .*\K[0-9]*"
secsize=$(stat -c %B $partdev)
loopdev=$(losetup -f)

# using these values, create a loop device, decrypt, and mount LUKS
losetup $loopdev -o $((partoff * secsize)) $partdev
cryptsetup luksOpen $loopdev backup_crypt
mount /dev/mapper/backup_crypt /mnt

You now have the decrypted filesystem available at /mnt. Do what you want with it. When you're finished, you need to unmount, close the LUKS device, and remove the loop device:

umount /mnt
cryptsetup luksClose backup_crypt
losetup -d $loopdev


Is it possible to get XSS through uploading an image via the filename? I just wanted to know if its possible...
If i have an image i.e abc.jpeg and i rename it to an XSS vector such as <img src=x onerror=alert(1)>.jpeg will it successfully produce the XSS or is there actually another way to do this...

Could there exist some site that is vulnerable in this way? Sure, obviously. If the server takes the user-supplied file name and tries to emit it, unescaped, into the document, you'll get XSS. Same as any other user-supplied data.

Is the particular site you're looking at, or indeed any site on the whole Internet right now, vulnerable? We have no way to know the former, and I at least don't know the latter.

Mind you, there's a ton of ways to attack file uploads. Upload an HTML file containing malicious javascript and then request it from the server for XSS. Use path traversal to overwrite other files, which can overwrite user data, trash the server, or potentially get you code execution on the server. Use spaces and shell metacharacters to try and get command injection (code execution). Upload a server-side code file (PHP, ASPX, JSP, whatever the server uses) and navigate to the page to see if you can make the server execute your code. Upload a zip bomb and try to denial-of-service the server. Upload a really big file and see if the server tries to hold it all in memory. There are so many options! It depends on what kinds of files the server expects, how it enforces that (content type? file extension? magic number?), what sanitization it applies, what the server does with the files, whether the user can request them back again, and what happens when the user requests them. Just like literally every other kind of input.


Android Device Encryption I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed into a secure key for use with the Decryption?

And how is the Decryption Password Stored and hashed on the device?

I am trying to demonstrate points of potential vulnerability on our enterprise android devices, and mitigations.

Android Encryption Implementation Notes has a pretty detailed description of how the disk encryption is implemented from 3.0. When a user enables encryption if they do not already have a pin set they are required to set one.

  The master key is a 128 bit number created by reading from /dev/urandom. It is encrypted with a hash of the user password created with the PBKDF2 function from the SSL library. The footer also contains a random salt (also read from /dev/urandom) used to add entropy to the hash from PBKDF2, and prevent rainbow table attacks on the password

The master key is then stored in the footer of the encrypted partition. Most of the code that is used to start the encryption process is in Vold, Android's volume daemon. If you have the full AOSP source for android you can take a look at /system/core/vold/cryptfs.c which implements many of the commands for encryption in vold as well as commands for verifying and changing the password.

This blog post, Android Disk Encryption also has some good insights into the crypto implmentation as well as the implications of tying the decryption of the master key to the pin/password entered by the user to unlock the device.

Hope this helps.


How to harden an iPhone/Android app so it's tough to reverse-engineer it? These are the following objectives I have in mind:

Make the app hard to crack, as the binary will hold some secret tokens.
If it still can be cracked, is there any way the app can tell someone or its own self that it has been cracked (like checking against some checksum or certificate or the OS doing it for the app) and take some action? The app binary can get infected or bad code can get injected while the program is in memory as well, so suggested methods should be able to deal with both these cases.

I'm using these platforms:

iPhone [OS: iOS, Language: Objective-C]
Android [OS: Android, Language: Java]

Please don't factor in costs and development times, as this is a critical app for its audience. It will be great if I can get the questions answered for both the platforms. Thanks for your time and attention already.

Edit 1: Are these ProtectionClasses undocumented? I don't see any documentation under the Apple docs. Anyone has any idea on if these are of any use?

Edit 2: codesign for Mac OS X came with a -o kill option for signing binaries such that whenever a binary doesn't match with its checksum in the certificate, the OS would kill it. Detailed here [Ctrl-F 'option flags']. Is there anything like this for iOS?

Edit 3: I'm thinking of using a combination of these ideas. So in case someone comes looking here, this might help. One-way function & Oblivious transfer.

Basically the objective '1' will not work; reverse engineering just works too well. It will be especially easy with the Android version, because Java is really simple to decompile (on Android, a specific bytecode format is used because the Java implementation is Dalvik, not the "true" Java, but the principle remains). However, it will not be that hard with the iPhone version either (Objective-C compiled to ARM code, not the hardest thing ever to disassemble and figure out).

Objective '2' will not work either. First of all, reverse engineering and data extraction are passive only, so the application is unaltered -- therefore, there is nothing which the application can do to detect that such reverse engineering took place. Also, it is easy to modify some application code to bypass any internal test; that's the number 1 cracking technique employed to work around copy protection of games since the early 1980s (at least).

The best you can hope for, is to split users into two categories: those who have jailbroken their phone, and those who did not. On an non-jailbroken iPhone, only apps dutifully approved by Apple can be installed and executed, so this prevents installation of a modified, non-official app which would use your "secret tokens" in a way you do not want. But jailbreaking is exactly what people do to install unapproved apps, and it seems to be relatively easy.

You can also try to make life harder for attackers by renewing your secret tokens very often, and constantly publishing new versions of your app. That's what game console vendors do, with constant new "firmware versions" that users must download to be able to play with the newer games, view the newer movies, or connect to a gamer network. This annoys users, too, so that's not exactly cheap to do.

Things would be much easier for you if you could arrange for the "secret tokens" to be user-specific -- this way, if a token value is unduly extracted, you can still blacklist it on your server (I assume that your app uses the tokens to connect to a server somewhere).

Note that keeping data secret in a deployed application, or, failing that, reliably detecting fraudulent usage of said data, is the Holy Grail of all game editors and movie publishers around the World. Last I heard, the big players like Sony and Warner have not found it yet, and that's not for lack of trying.


May I have into account security concerns when considering to send emails massively (>100,000)? I'm considering sending more than 100,000 emails as fast as possible to different users of my website. These is not spam but requested emails. I'm using my own mail server (Exchange 2010).

May I have into account any security concerns?

For example, I think that:

My IPs may be blacklisted by remote mail servers (if for example I
send too much emails to Gmail receivers...)
An attacker may see that I am sending lots of emails and try to phish my customers

Any other security concerns?

Mail receivers often track sender spam reputation per IP address. If you use a third-party provider to send the emails, then it is their IP which will take the reputation hit not yours. This is important to understand, as you don't want your all-important company Email Server to be on the same IP that sends a questionable quantity of emails.

Make sure that your email server is properly configured with a correct rDNS entry set up by your ISP. Also you should keep proper SPF records up to date.

You should throttle your emails. Sending them 'as fast as possible' will surely get you banned. It is much safer to spread them out with a delay between emails.

It is likely that your email traffic will have to go up gradually, or perhaps you will have to fill out unblock requests from the big carriers (Microsoft, AT&T, etc) as they will not take kindly to the huge spike in traffic (assuming this IP sends only minimal traffic prior to this)

You can also list an official unsubscribe feature, so that the mail client (i.e. Gmail) can provide a simple Unsubscribe quick link.

If you send enough email from your domain, Gmail will provide you with reporting on how well your emails fair.

There must be some canonical answer to how to properly format emails to avoid spam marks, but I'm not sure where it is.


Anomaly Intrusion Detection relevant features I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic.

I found 41 features from KDD CUP'99 project (the paper: WENKE LEE, SALVATORE J. STOLFO, "A Framework for Constructing Features and Models for Intrusion Detection Systems") and many papers on how to do feature selection to reduce them and find most relevant ones. I also learned PHAD uses 34 features from the HEADERs.

Are there any other relevant traffic features to let the classification algorithms to detect the anomalies more precisely? I learned about 200 features somewhere but not the details.

Thanks.

EDIT: I found a great survey paper on this, "Jonathan J. Davis, Andrew J. Clark, Data preprocessing for anomaly based network intrusion detection: A review, 2011". Several features are listed as tables in its appendix.


How can I execute a base64 encoded exe stored as a variable, inside a powershell script without writing any files? Basically if I have exe1 encoded with base64 and I copy that encoded source into a powershell script as a variable. I want to be able to decode it and execute the source exe without writing the exe to disk. is this possible? if so how can it be done.

The short answer is that you're not going to be able to. Unless you have a library that can load a PE32 into memory correctly, which is not the same thing as allocating a single, continguous block of memory and copying the bytes into it, then you're going to have to write the binary to disk and rely on Windows to load it for you.


"SSL: CERTIFICATE_VERIFY_FAILED" with my own certificates Two sites. Only one works.
I have two SSL-enabled sites running on Heroku, both of which provide APIs. I bought the SSL certificates from different sources.
When I use Ruby and Python to make some POST calls to Site #1's API, everything works fine.
However, when I use Ruby and Python to make some POST calls to Site #2's API, I get SSL: certificate verify failed errors. (Even though everything looks fine when I access the site in Chrome)
Ruby error for site 2:
OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
Python error for site 2:
requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)
Is a "Domain Validated" certificate enough?
I'd like other users to be able to access Site #2's API, without having to hack to get around this error. But I'm not sure what the problem is -- is it that my certificate is inherently insecure (it's only domain validated, but I believe certificate #1 is also only domain validated, so I'm not sure why that one works fine), or is it possible I messed something up when setting up SSL for Site #2 (so I can fix the problem without buying another certificate)?
If I do need to buy another certificate, do I need to make sure it's an OV or EV certificate? Or would a DV certificate from a certain source work? (I don't have an official company set up yet, so would prefer a DV certificate for now, even though I know it's less trustworthy-seeming.)
(I've googled these errors, but all the solutions seem to suggest some kind of local Ruby/Python problem, whereas I think I have a certificate problem.)
More details
More details about the troublesome certificate:

Issued by COMODO RSA Domain Validation Secure Server CA.
The "common name" is actually different from the domain I'm trying to access. (because this is intended to be a multi-domain certificate)
If I view the details of the certificate in Chrome, Chrome says Valid Certificate: The connection to this site is using a valid, trusted server certificate.
ssllabs.com (https://www.ssllabs.com/ssltest/analyze.html) gives the domain 3 A+ ratings.

I have no problems accessing www.hybridml.com with python and requests library. Tested with 2.7.6., 2.7.12 and 3.5.2. Also the SSLLabs report looks fine, i.e. no missing chain certificates and the subject matches. And the browsers work fine.

This together suggests that you have something that is intercepting the SSL connection. Such SSL man in the middle results in a new certificate for the target site signed by the CA of the interception software. Since the browser throws no warnings this is probably legal interception, typically done by a corporate firewall but also by various antivirus solutions for desktop. It might also be that the browser and the proxy is connecting differently to the target, i.e. one through a proxy and the other not. Such differences can happen because python and ruby neither share the list of trusted CA nor the proxy settings with the browser.

I suggest that you check the certificate chain inside the browser and see if it actually results to the expected Comodo CA as a root or something else, i.e. the CA from the man in the middle.


Legal Risk to unpatched servers Since one of the 10 domains on the CISSP is legal/governance, I figured this would be the best place to ask.

I recently did a security assessment for a non-profit. I found that their systems needed some attention. I want to make it clear to them that just because your network has no sensitive data on it, you are still at risk. One point is if someone places illegal files on your server, you are responsible.

Any other examples? I want to make sure I don't miss anything else. On a side note, does anyone know where I can find exactly what some of these penalties are (time/monetary fees)?

It is still mostly the case that liability for computer breaches (not including disclosure of private information) is legally blameless. There are plenty of laws cropping up all over about data privacy, but as far as protection of computing resources themselves there isn't really a standard. "Gross negligence" on the Internet is still a basically non-existent standard. Thus, for ultimate liability you're probably in a very safe spot.

That said, nothing prevents a case from being brought and incurring court-related fees including legal representation. Investigations of misuse of your server may not result in any charges, but you could lose your servers for a long time while they're impounded as evidence. Law enforcement in the US at least is not known for very fast turnarounds.

Applying patches is usually much less expensive than either of those outcomes.


Corporate PKI - SHA1 deprecation Here is the context. Suppose you have a corporate PKI with :

AC_Root (offline in safe store - SHA1 signature)
SubRootA and SubrootB (offline in safe store - SHA1 signature)
SubSubRootC, SubSubRootD, SubSubRootE... (online in HSM - SHA1 signature)
End entities certificates (servers, users smart card, auto enrollment, Active directory)

What are the impacts due to SHA1 deprecation ? I know the root certificate is not concerned, because self-signature is never verified (only presence in truststore), but what about the Subroot certificates ?

Editors like Google or Microsoft announced that browsers will print warnings and even fail when SHA1 will be used, and quite soon (2015/2016).

Is this a hot issue for mostly security reasons or for the user experience (warnings in browser, OS refusing SHA1 certificates) ?
Is it needed to organise a new key ceremony for creation of a new "SHA256" chain ? Even for offline chain (root and subroots) ? Re-issuing new end entities certificates with SHA256 ? Introducing a sliding period for key renewal ?

Is this a hot issue for mostly security reasons [...]

Not yet. There is no practical published attack yet. But it's in the post. The gradual transition now is better than the transition from the earlier MD5 hashing algorithm to SHA1. Back then there was no explicit deprecation strategy AFAIK and there actually were evil attacks that used MD5-collisions. (Flame) We shouldn't wait until the same thing happens with SHA1.

  Is it needed to organise a new key ceremony for creation of a new "SHA256" chain ? Even for offline chain (root and subroots) ? Re-issuing new end entities certificats with SHA256 ?

Yes. Offline or not doesn't matter. The cert chain is only as strong as the weakest link. (Excluding the root, whose signature does not matter.) And also: A CA cert is always a juicier target for an attack than an end entity certificate.

  Introducing a sliding period for key renewal ?

Yes. Don't issue anything with SHA1 past the mentioned cut-off dates. If you do issued SHA1 up to the cut off date do only with written justification and manager sign-off.


preventing cross iframe key logging in javascript We have a web application, where other partners can include their pages as iframes. We implemented a server-to-server way of authenticating users for the iframes, but one partner doesn't want to implement it.

The bad thing is, they also don't want to display their login page in the iframe in order not to be vulnerable to javascript key loggers.

We always bind in iframes with sandbox="allow-forms allow-scripts allow-top-navigation-by-user-activation allow-same-origin" - that's of course to guarantee the security on our side, I couldn't find any place where the iframe server could request sandbox to be active. Is there a way for them to do it, or would they just have to trust us?

Also, does the sandbox attribute guarantee that we cannot log key strokes which were created while the focus was on their iframe? - I thought it would guarantee it, but I couldn't find it anywhere documented.

Regarding server making sure that the iframe can't be loaded into any malicious page, they could simply white list us with header https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options or?

Their best best is to turn on the X-Frame-Options header, as you mentioned.

While pointing this out won't help your cause, the reality is that if they haven't had that header on then they have been vulnerable to various iframe-related attacks this entire time anyway.  You trying to load their site in an iframe doesn't make them anymore vulnerable - it just takes makes them aware of a threat that they have already been vulnerable to anyway.  All that to say, them attempting to limit what you are doing probably doesn't make them more secure, because even though you are announcing your intent, attackers don't.

As a more general answer, due to the same origin policy, your site would not be able to listen to any keystrokes inside the iframe anyway (see this question for a starting point).  As a result their immediate concerns are actually unfounded.  With iframes you do have to be concerned about clickjacking, which is solved via the X-Frame-Options header.

However, that really isn't relevant here either.  To boil it down, you are trying to implement a solution where users login to your site and then access a third-party site through your system.  In essence, this is a variation on SSO.  Understanding that, and looking at things from their perspective, your original proposal (server-to-server authentication) is really the ideal solution.  The advantage for them is that they can easily log that a particular user session came from you.  As a result, if anything "unusual" happens during that session, they can potentially (and accurately) hold you responsible for anything bad that might happen.  Of course it may be that they simply (for whatever reason) do not want to participate in whatever it is that you are trying to accomplish.  Obviously, they have the right to make that decision if they feel it is best for their business.


is it safe to implement custom way of storing cookie in android? i want to store session information in android application temporarily (as long as application is running). i am sending real-time data to node.js server from android client using Custom Protocol (over UDP). Along with this data i will send cookie (or session string unique to each user) to server for further processing. is this a safe way to store cookie in ram. Is this safe for users?

I am new to this security stuff so i want help. if i have missed any information i am willing to add it.

Instead of how it's stored I find it much more alarming that it's transmitted over a custom network protocol. It might either be completely unencrypted or encrypted with a homespun implementation. That's how you are really going to leak the cookies.


What are reasons why one shouldn't run Tor at a network level? I've been considering proxying all web traffic on my network transparently through Tor and dividing up my bandwidth to share with the rest of the Tor network.

Practically speaking, what are some of the reasons why one shouldn't do this? Obviously bandwidth is a concern, but apart from this, are there security concerns?

I'm particularly concerned about running Tor network-wide and seeing greater security threats open up as a result of it.

This is a question of threat modelling. Which adversary are you most concerned about? Tor has the advantage of obscuring the origins of the traffic, which makes it difficult for your ISP, as well as the destinations of your traffic to track you. The adversary you should be worried about is the exit nodes. Since anyone can run an exit node, it's lucrative to sniff unencrypted traffic for information, such as passwords, credentials or other personal information. Furthermore, a really clever exit node could use your credentials transparently—after all the connection appears to be coming from the exit node—for example to spam (in the case of forums, or other communication) or spread malware (in the case of say an uncencrypted FTP connection.)

As long as you can guarantee that all network traffic you are generating has strong encryption and trust (such as ssh fingerprints, which would not be known the first time you're connecting) it would be secure enough to route all your traffic through Tor.


802.1x certificate authentication, private key? In 802.1x does the client authenticate with the certificate containing the privat e key e.g. is the private key stored on the device that is wishing to access a given resource network ?

is the private key stored on the device that is wishing to access a given resource network ...

For authentication using public-key cryptography as done in 802.1x or in TLS certificates the authenticating party needs to proof ownership of the private key. This is done by doing cryptographic operations using this private key, typically by signing some value given by the peer or derived from a value given by the peer.

Such cryptographic operations can be done by some software running inside the clients operating system if the private key is accessible to the system, i.e. typically stored on the file system. But it could also be done by some special hardware integrated or associated with the system, like a smart card, TPM, HSM or similar.  Such operations could also be done on a remote system like in Cloudflare Keyless SSL.


A tool or browser which changes the IP Address (Not like a single VPN, lots of different addresses) but fast I am curious if there is a browser or tool that changes the IP continuously but not multiple routes like Tor instead just like a single proxy. I think there might be a way of configuring Tor Browser like that too but I don't actually know anything about it.

Do you guys know any tool/browser like that?

This is possible by using python modules. You can use an https proxy list which can be easily found using simple google search.

Then you will be able to emulate a different browser by using a module like Fake-useragent.

Here is a writeup which you can refer to :

https://codelike.pro/create-a-crawler-with-rotating-ip-proxy-in-python/


What is a good way to authenticate a user to websites and applications with a smart phone? What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone?  By good, I mean that it is both secure, and user-friendly.  Passwords don't seem to be the best fit because a password needs to be long to be secure, but it is hard to type a long password on a smart phone.  Some thoughts I have begun to think about are biometric measures (e.g. possibly facial recognition), and / or a token.  I asked a very similar question of authenticating a user to the smartphone itself here: What is a good way to authenticate a user to a smart phone?

Consider SQRL. It's a quite new, free, token based authentication system, using a client application. To authenticate, the client signs a cryptographic challenge with a per-domain private key. Thus it offers per-domain pseudonymity.

From Wikipedia:

  SQRL or Secure, Quick, Reliable Login (pronounced "squirrel") is a
  draft open standard for secure website login and authentication.

Some more resources:

Illustrated Guide to SQRL
Wikipedia article
Inventor's Website


Application proxy structure & functions http://postimg.org/image/76newirnv/

For application proxy,

Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read a number of papers but still bit confused

Secondly, how can application proxy know if the incoming data is safe or not?

Thirdly, how does a proxy function if i am going to send packets to external network

Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read a number of papers but still bit confused

The client connects to the proxy, either explicitly (configured as proxy in browser) or implicitly (transparent proxy). The proxy then looks at what the client wants (i.e. access web site) and executes this. This means the client does not get the web site by itself but it instructs the proxy to get the web site and then gets the data from the proxy.

  Secondly, how can application proxy know if the incoming data is safe or not?

They don't really "know" fully if the incoming data are secure. But they can check if the application protocol is valid, can check the payload for malware  signatures, extract suspicious payload and execute it inside a sandbox etc. This way they can detect at least part of the unsafe content.

  Thirdly, how does a proxy function if i am going to send packets to external network

If you don't send the data to the proxy but directly to some external network than the proxy must be somehow in the path. This is usually on a firewall where packet filter rules redirect your traffic to the proxy for analysis.


How to hide encrypted volume as playable video? How do I hide an encrypted VeraCrypt volume as a playable video file?

I know I can store the encrypted volume as whatever file type I want, but what if I want that file to act as the file type? For example, if I save it as an mp4 file, how can I open the file in a media player (and it will play something) and open it in VeraCrypt?

With some intermediate steps it works for some video formats.

Many formats allow "trailing garbage", which either causes an error message after the correct video played, causes garbage output or is just ignored.

When you now append your volume to the video, the video still works. To access the volume, you can e.g. use the device-mapper (when using linux) to create a blockdevice from the file, which has some offset (the length of the video) and then use this.

If you only want to hide the volume (e.g. to put it on a usb stick when traveling) but not use it in this form, you just need a program to split the file at the offset, so you can unpack it on the computer where you want to use it.
There are programs which allow to combine images and rar files, which may work with videos as well. So the easiest solution there might be to pack it into a rar and use such a program.


Command line tools to decrypt my Firefox 45.7.0 passwords using key3.db and logins.json? How to read the key3.db file? describes how to decrypt Firefox Password Manager stored usernames/passwords using a Python script, but I'm sure there's an easier way using just command-line tools. What is it?

What I have so far:

Using db_dump185 I can view key3.db and it looks something like this:

format=bytevalue
type=hash
h_ffactor=65536
db_lorder=1234
db_pagesize=4096
HEADER=END
[bunch of stuff that I'm pretty sure is an encryption key in base 64, and is the rest of the value for the HEADER key]

Any file reader shows the unencrypted logins.json. The interesting fields in each line appear to be encryptedUsername and encryptedPassword both of which appear to be in base 64 as well.

I'm pretty sure I need to take the value of HEADER in the key3.db file (possibly excluding the "END\n" value at the start) and apply it to the encryptedUsername and encryptedPassword fields in logins.json

But how?

EDIT:  I realized after the fact there is a nice infographic in the git repo I reference in this post which should help if you follow along: https://github.com/lclevy/firepwd/blob/master/mozilla_pbe.pdf

I am going to rewrite this answer as I understand this process a bit better now.  This is my attempt at an English synthesis of the information contained in https://connect.ed-diamond.com/MISC/MISC-069/Protection-des-mots-de-passe-par-Firefox-et-Thunderbird-analyse-par-la-pratique (English translation).  Even though my answer here is pretty long, that document explains much more than my summary here.

Basically, this database contains two tables (I am going to explain this from the perspective of the key4.db sqlite DB, the key3.db contains the same data, but of course is stored in the bsddb185 format.  Refer to the readBsddb() method in https://github.com/lclevy/firepwd/blob/master/firepwd.py for the intricacies of actually reading this DB.  I think since this method exists, what's important is understanding the data that's actually in it rather than the mechanics of reading this old database).

One of the many pieces of this puzzle that had me confused was that, while I knew 3DES+CBC was the encryption algorithm used to store this data, I did not realize there were three separate 3DES+CBC strings to understand.

Once the data from the database has been extracted from either the key3.db BDB or the key4.db sqlite3 DB, the data we need is spread across two tables, the metadata table and the nssPrivate table.

The value we need from the metadata table is the encryption key for the actual private key used to decrypt the data in logins.json, known as the global-salt.  This can be extracted with "SELECT item1 FROM metadata WHERE id = 'password';".  The item2 column is actually just the string "password-check" that is encrypted with this global salt along with an IV packed along with it.  For our purposes this should be unnecessary unless we want to test our master-password.

The next value is contained in the nssPrivate table.  There's quite a bit of other data stored here, but the important column for our purpose is the a11 column (note those are ones and not Ls), extracted with "SELECT a11 FROM nssPrivate".

This column contains an ASN.1DER object that contains a few different values, but important to us are the encrypted private key, and the IV used to generate that private key (needed for the CBC part of 3DES). There is a lot going on in the ASN.1DER object, but using the pyasn1 library we can extract the values that we need.  Once we've extracted all of those values, we simply need to pass them to the 3DES decryption method.  All those steps together should look like this:

import sqlite3
from pyasn1.codec.der import decoder

conn = sqlite3.connect(key4.db)
c = conn.cursor()
c.execute("select item1 from metadata where id = password;")
row = c.next()
globalSalt = row[0]
c.execute("select a11 from nssPrivate")
row = c.next()
item2 = row[0]
decodedItem2 = decoder.decode(item2)
entrySalt = decodedItem2[0][0][1][0].asOctets()
cipherT = decodedItem2[0][1].asOctets()

BUT WAIT, THERE'S MORE

Before we can decrypt the value stored in cipherT, we have another set of arcane hashing functions we need to perform before we get our private key.  This will contain SHA-1 hashing the global salt together with the master password, then padding the entry salt with null bytes until it is 20 bytes long, SHA-1 hashing that with the value we just generated, then three more arcane hmac hashes.  Once we've completed that set of arcane hashes on the global salt and the entry salt, we can split the value we receive - the first 8 bytes are the IV and the last 24 are the key needed to decrypted the value stored in cipherT.  Put that all together, and you get this:

import hmac
from hashlib import sha1
from Crypto.Cipher import DES3

hp = sha1( globalSalt+masterPassword ).digest()
pes = entrySalt + '\x00'*(20-len(entrySalt))
chp = sha1( hp+entrySalt ).digest()
k1 = hmac.new(chp, pes+entrySalt, sha1).digest()
tk = hmac.new(chp, pes, sha1).digest()
k2 = hmac.new(chp, tk+entrySalt, sha1).digest()
k = k1+k2
iv = k[-8:]
key = k[:24]
privateKey = DES3.new( key, DES3.MODE_CBC, iv).decrypt(cipherT)

Now that we have our private key, we need to do this whole process over again with the value stored in logins.json.  The encryptedPassword and encryptedLogin fields are actually another ASN.1DER object encoded in base64 containing the actual encrypted password, the IV, as well as some other data not important to our particular use case.  We can use the same pyasn1.codec.der.decoder.decode() function we used previously on the base64 decoded data.  Once we get the encrypted password and the IV from that function, we can plug those values into the 3DES decrypt we used before to get our password:

encryptedPassword = "MDIEEPgAAAAAAAAAAAAAAAAAAAEwFAYIKoZIhvcNAwcECIb8AxZg6uueBAi0G6tJ10aBhQ=="
asn1data = decoder.decode(b64decode(encryptedPassword))
iv = asn1data[0][1][1].asOctets()
cipherText = asn1data[0][2].asOctets()
#use privateKey from the codeblock immediately preceding this one
cleartext = DES3.new(privateKey, DES3.MODE_CBC, iv).decrypt(cipherText)

print(cleartext)
>>> 12345

Wow! That's the same combination I have on my luggage!

This is definitely a much more long and involved process than I originally expected, and finding this information was pretty darn difficult, so I hope that even though I may not have explained it all that well, that this may help anyone trying to answer this question in the future (the reason I wasn't really able to use https://github.com/lclevy/firepwd/blob/master/firepwd.py as is was because I'm actually working on doing the reverse - I have a TON (in the thousands) of PCs with thunderbird whose passwords I would like to change automatically which required that I do the reverse, which took about 3 workdays to figure out).  Though my use-case will admittedly be pretty rare, so possibly this may only be of academic interest in the future.

Oh, and someone please change the combination on my luggage


FTP Bounce attack, what's wrong? I'm studying security in a training lab, and I'm trying to implement the infamous FTP-bounce attack.
 I'll use a remote FTP server (called BOUNCE here) in order to access a folder on the VICTIM machine which is forbidden for my IP address. I don't know if the VICTIM machine allow access to the forbidden folder to BOUNCE, but it's still worth trying :).

Here is what I do:

I start my own pure-ftp server and connect to it:

service pure-ftpd start

~# ftp My_IP 21
ftp> USER my_own_username

Then, I tell my server to go into passive mode, It answers with an Ip address (which is my own IP address) and a PORT with a shape like: (F,F,F,F,X,X) I take note of it for later.

ftp> quote "pasv"
Entering Passive Mode (F,F,F,F,X,X)

And finally, I tell my server to accept data from the data channel and store them into foobar file, if it does not exists, the server creates one.

ftp> quote "stor foobar"

After this, my server (which is in passive mode now) will hang...

Now I'm going to use a FTP-bounce vulnerable server (which I found thanks to nmap displaying the message "Ftp-Bounce Working !") which I'll call "Bounce". If I understood correctly this latter is abble to connect to other FTP servers using the PORT command. Luckily I can connect to Bounce anonymously and upload some files on it using the PUT command.

Next, I'll import the following file onto Bounce:

user anonymous
pass whatyouwant
cd /restricted-folder
port F,F,F,F,X,X
ls
quit
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ ... ^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ ... ^@^@^@^@
...

It will then be uploaded from Bounce to the Victim Machine in order to let this latter execute the instructions in in.

I do this with those last commands (still on Bounce):

put instrs
quote "port C,C,C,C,0,21"
quote "retr instrs"

Where C,C,C,0,21 is the IP of the victim machine (let's call it VICTIM). (so It will connect on VICTIM, and tell it to execute the instruction in instrs file, if I understood correctly).

Problem: just after the command quote "retr instrs I get the following error: 501 Cannot RETR. Error

So, I'm wondering, is It VICTIM or BOUNCE that prevent the RETR command too work ?
Tell me also, If you think I misunderstood something.
Thanks a lot for you attention.

You have not understood FTP Bounce attacks.

FTP Bounce attacks does not let a FTP connect to another one, but to request access to ports by using the command PORT.
It's mostly used to make a port-scan without being detected (as you are not the one doing it, but the FTP server for you), or even for D.o.S. attacks.

Turning this FTP-bounce to upload a file from a FTP server to another (as it seems you want to do, sorry if i misunderstood you) requires much more than this.

So PORT command may work, but not RETR


How to share sensitive documents with unknown/untrusted parties? My exact use case is that I'm starting a new job, and I need to transmit sensitive personal documents to support my application. However, the same applies for applying for a loan, buying a house etc etc. In each case, certain sensitive documents need to be transmitted to a certain party, and then possibly sent onwards by them to others. Utility bills, bank statements, etc.

We all know that sensitive documents should not be sent by insecure email. So, I could put all the files in a zip, and secure it with a password. I could provide the password with a phone call or SMS etc. Great, but once the files have got to my recipient, I have lost control. He can forward them on unsecured.

Same with Dropbox (or similar). I can provide a link to the documents, and ask that the link is used for onward transmission. But I really have no control - the first recipient could re-transmit them any way he wished.

Anyone know of a way to continue to maintain the security of sensitive documents in such a scenario? Is there a file format I could use that would prevent the document being sent unsecured? I've never heard of one.

There is no way to be sure that the resipient won't retransmit your documents unsecured to others.

You could use password secured PDF files, theoretically they sould be safe if you forbit to print and edit them. But even in this case, one could easily take a screenshot and get the crititcal Information out of the PDF.
Or someone resends your files in the same mail together with the password.

As long as you don't trust the recipient you can't really be sure what happens to your files. But the same logic applies to a normal letter or each other form of communication as this is not really a technical problem but a problem with humans ;)


Can password based SSO be trivially compromised? Many cloud SSO providers now offer "password based SSO" (e.g. https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appssoaccess-whatis ), where, even if the SaaS you want to log in to doesn't support SAML or the like, you can still do SSO, because the SSO service will parse the HTML, store your password, and log you in to the 3rd party SaaS app.

Microsoft is advertising this.  And, for example, if you do a Google search of "Gusto SSO", you'll see many others that advertise it.  (I pick on Gusto, because they have no SAML, and you can see from all the SSO services that claim they support it that it is an autogenerated template...).

Now, to me this is a major vulnerability: The main reason we want SSO is so that when we onboard someone, we do it in one place, and when they leave, we have only one password to revoke: not dozens.  Otherwise, you're bound to forget that they also have the password to randomsaas.com...

But, that only works if the password doesnt go through their browser.  If it's a password based SSO, and the SSO app is just autotyping their login the login goes through their browser, and so, they can sniff and store it.  Therefore, even if you revoke the users SSO, they can still have stored the password.

Is there any solution for this?

Technically the Password-based Single Sign-On from Azure AD (from your link) is not an SSO solution but a password management one. The external application has its own credentials including password, and a plugin installed in the browser types them into an HTML form on behalf of the user, exactly what Lastpass does.

That means that those credentials have to been managed individually: created for a new users and revoked if user leaves. No doing so will indeed leave open security breaches, and the linked page in clear on that point even when credentials are managed by an administrator (emphasize mine):

  The credentials are obfuscated from the end user during the automated sign in process; however they are technically discoverable by the user using web-debugging tools, and users and administrators should follow the same security policies as if the credentials were presented directly by the user.

That means that you should have different credentials for each user and individually revoke them if the user leaves.

Only in true SSO solutions like SAML or CAS where there is one single account shared by multiple applications you have one single password to revoke.


Krack prevention by channel lock? Is there a way for most of the field clients to lock their channel to the one they know their secured AP is handling?

If I look at my channel can I tell immediately if there is an attack AP on me?

Is there a way for most in the field clients to lock their channel to the one they know their secured AP is handling?

Irrelevant, but I will get to that in a moment.

  If i look at my channel can i tell immediately if there is an attack AP on me?

Maybe, but again that doesn't matter. The attack demonstrated by the discoverer of the KRACK vulnerability was just a proof of concept attack. It was not meant to provide a model for any sort of real world exploit. Just because that demonstration used a change in channel doesn't mean that any real world exploit would do so, it was simply a mechanism that allowed an easier demonstration of the exploit at work. Expect real world attacks to be a bit more "clever" than a proof of concept.

Put another way, the KRACK vulnerability doesn't depend on any sort of change in channel, it is purely an attack on the WPA/WPA2 handshake. While the change in channel may make some aspects of the attack easier, it isn't entirely necessary.

So depending on detecting a change in channel does not really provide you any protection, especially since many sites (including an increasing number of homes) also use multiple channels as part of normal operation. If you want to provide protection against KRACK, upgrade devices as soon as patches are available for your device.

Further, many consumer devices will auto select a channel, often at the time they boot or at scheduled intervals. If your device reboots for any reason, it may change channel itself. The change in channel is no sign of an actual attack.


Why is WPA Enterprise more secure than WPA2? In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.

All earlier answers are missing a very important step and its implication and are misunderstanding EAP.

WPA2-PSK (aka WPA2 Personal) basically does the same thing as WPA2-Enterprise from the clients perspective: The client associates to the access point, authenticates to the access point using the pre-shared key and access point creates a 256bit PMK (pairwise master key) from the SSID and the pre-shared key (PSK). This PMK is then used to encrypt data traffic using CCMP/AES or TKIP.

The important thing to note here is that all clients will always encrypt their data with the same PMK, all the time. So it's easy to gather a lot of data encrypted with the same PMK. Should someone break the PMK, they could decrypt all data encrypted with that key, past/recorded and future/realtime.

WPA2-Enterprise is only a little bit different behind the scenes, but the security implications are severe: The client associates to the access point, authenticates to the access point, who passes this on to a backend RADIUS server (using EAP, but that's not important here, so more on that at the end). When the RADIUS server has authenticated the client, it gives the access point an OK, plus a RANDOM 256bit pairwise master key (PMK) to encrypt data traffic for the current session only.

Well, that's quite a difference. Instead of each client using the same PMK all the time (the seed of which is known plaintext, because the SSID is used as seed!), now every client uses a different PMK, it changes every session/association and the seed is random and unknown. Not only that, but this PMK will be 256bit real entropy (not a hash from a usually much smaller password containing words), so dictionary attacks are useless.

Should someone break a particular PMK, they only get access to one session of one client. Also (if the right EAP method is used) they don't get access to the users credentials, since they where individually encrypted. That's a whole lot more secure.

Also remember that this PMK is 256bit AES, this is currently "uncrackable" (128bit is considered safe for the moment, but not for long). The fact that the PMK of WPA2-PSK (also 256bit) can be cracked comes from the usually weak passwords (dictionary attack), the known seed (SSID) and the fact that all clients use the same PMK all the time, so a lot of ciphertext of known plaintext can be captured.

So, then a little about the Extensible Authentication Protocol (EAP). This is often understood as a security protocol in itself, but it isn't. It's basically a standard for passing messages from a client wanting to authenticate and a server that authenticates. EAP itself has no security features, it just specifies how the client speaks with the RADIUS server.

Now, you can encapsulate these EAP messages in a secure tunnel. Like HTTP (an insecure messaging protocol) goes over a secure layer, SSL/TLS to yield a secure connection to a webserver. Someone said in another answer that there are over 100 different EAP "methods", some very insecure. This is true, because EAP is old there were encryption standards implemented that are sub-standard today.

But in practice, if you need to support recent Apple or Android machines/devices and Windows machines, there's only two options, because others are simply not supported: Protected EAP (PEAP) and TLS-EAP (well, I lied: really there are a few more, but they are basically identical to TLS-EAP in functionality and security).

PEAP is just like a https server, a secure TLS tunnel is setup between the client and the RADIUS server (protecting the entire wireless and wired path between them), the server presents a certificate to the client (in companies often signed by their own CA) and a secure channel is setup on the basis of this certificate.

If the client has the CA as trusted in their certificate store it sends its username and password to the RADIUS server. If the CA isn't trusted, the user gets a warning about the certificate as with a https site that has something wrong with its certificate. The credentials are usually protected with the (old and now weak) MSCHAPv2 protocol, but that doesn't matter, since everything is already protected by 256bit TLS. The MSCHAPv2 protocol talks with the RADIUS server using EAP.

An obvious weak point is that you could setup a false access point, present a false certificate of which you have the private key, and hope that some idiot user gets a warning about an untrusted certificate and just clicks "trust" (and that option is not disabled by an administrator). Then you could maybe capture the client's weakly encrypted credentials that are fairly easy to crack (I'm not sure about this, as I know MSCHAPv2 can be easily cracked if you have the WHOLE exchange, in this case you'd only have the client side as you couldn't send a valid nonce to the client to complete the exchange, as you don't have the real hash of the users password).

While this may get you access to the real network with a lot of work (and I doubt it, but if you must know, look into MSCHAPv2 at http://www.revolutionwifi.net/revolutionwifi/2012/07/is-wpa2-security-broken-due-to-defcon.html), it wouldn't get you access to any other wireless data, as they are encrypted with a different PMK.

But for companies this may still be a problem. Enter TLS-EAP. TLS-EAP is basically the same as PEAP with the notable difference that the client also has a certificate. So the server presents its certificate to the client which must be trusted by the client (because the CA is in the trusted store, or an idiot clicked "trust"), but the client also has to present a certificate to the server. This can be a certificate that's been placed in the cert store when the device/workstation was provisioned, but it could also be from a smartcard etc. The server has to trust this client certificate, or you won't even get the chance to present credentials.

As many of you may know, such 2-way authentication can also be done for HTTP over TLS, but this is not often seen outside corporate settings. In that case, too, you can't access the website unless you first show a certificate that's trusted by the server.

So now the fake access point isn't very useful anymore. You may get the weakly encrypted credentials if the idiot clicks "trust" and you then blindly accept any client certificate, but since you don't have the private key of the client certificate you don't get access to the wireless network, nor do you get encrypted wireless data of this or other clients still courtesy of the random session-based PMK. You may get access to some intranet with the credentials, but if they went to the trouble to setup a CA for wireless they probably require a client cert for that too.

In corporations it's common to have such a client cert on a smart card, which employees then need to access all resources: logging in, network resources, mail using smtps, imaps, pop3s, intranets using https, anything that uses TLS can be setup to require a client certificate. Usually it's as simple as putting it in the keyboard and enter a PIN, then windows will present it when demanded by a trusted server running TLS.

So, I hope this clarifies a bit. The scale goes:
"basically unsecured" (WEP)
"crackable with some effort" (WPA2-PSK)
"partly social-engineerable" (WPA2-Enterprise w/PEAP)
"currently secure" (WPA2-Enterprise w/TLS-EAP and similar)

There are ways to make WPA2-PSK somewhat more secure, in that it would take months to crack it instead of minutes (pre-computed rainbow tables) or hours (dictionary attack): Set your SSID to a random string of the maximum length (64 I think), since it's used as the seed for the PMK, and use a random pre-shared key (PSK) of the maximum length. If you then change the key monthly you can be reasonably sure that nobody has a current PMK or had/has access to your network.

Though you can't get rid of the fact that someone could have stored a months worth of data of all clients and reads that once they do get the PMK of that month (which can be done, as it's not a key with 256bit real entropy as you're broadcasting the seed used).

Another drawback is that you will have a highly unique SSID, one that your wireless devices will broadcast wherever you go. If someone has your unique SSID of your home network it's a piece of cake to look up your SSID at https://wigle.net/ and find out where you live. So you're basically walking around with your phone/tablet/laptop announcing where you live...

If you're privacy conscious it's maybe a good middle way to keep your SSID set to one that's common, but not in the top 30 or so (that way it's unlikely to have rainbow tables for it available online) and use a random PSK of maximum length. You lose some entropy though.

If you want the same security as wired, use WPA2-Enterprise with TLS-EAP. (Well, for now... There's nothing stopping someone from capturing and storing all the data they want and decrypt it all in 20 years when we can all rent time on a quantum computer and factor all keys in minutes.

The NSA is said to have built a datacenter to do just that, store anything encrypted they encounter until they can crack it, so that problem also affects everything on wires if it crosses the internet. If something needs to be secure for all time, use a random one-time pad that you exchange out-of-band :)

All that said, while I'm paranoid and want the best security and thus spend two days making WPA2-Enterprise/TLS-EAP work, this is probably out of reach (and overkill) for most home users. If you don't already have a domain controller or some other directory service on your network, experience with RADIUS and have all expensive pro wifi gear that an enterprise would use then you most likely won't get it to work. You'd be better off just setting up an always-on VPN and run that over your wifi, that gives you all the security and none of the fun debugging EAP.

PS. For the sake of simplicity I also left out the fact that the communication between the access point and the RADIUS server is also encrypted by a pre-shared key (called the "shared secret"). Afaik this encryption isn't any good today (uses MD5 which is basically broken) but since you put TLS over it anyway that doesn't matter. You can use a decent key size (something between 64-128 chars = 512-1024bits depending on the implementation). I always set the largest secret possible, it can't hurt.


How to fake a browser fingerprint? I'm developing a browser based on Google Chromium and keeping in mind that privacy is freedom; but I need to know how to protect my browser's users against fingerprinting.

I was thinking about intercepting requests associated with fingerprinting, such as requests for:

Browser plugin details and user agent string
HTTP_ACCEPT headers
Screen size and color depth
Time zone and system fonts

And always sending the same (fake) response. I want to do this without breaking anything for the end user.

For instance, if a user tries to watch a video in full screen, and the site asks for screen size to resize it properly, the browser would send a fake screen size, but would actually display it at the true screen size.

Is this even possible? Is it actually possible to intercept these requests and hide this information without making the site not work properly?

Yes, it's possible, but it's a lot harder than you think, and you'll end up breaking some things no matter what.  To take your full-screen video example, it's not the website that asks for the screen size, it's Javascript running on a web page, and you can't know at the time of the request if it's going to use the size to adjust a video, or to fingerprint the browser.

The Tor browser bundle attempts to do this with reasonable success.  I recommend studying it to see how it works, and how it can be improved upon.