What's the point of the nonce in CTR mode? Does having a nonce in CTR mode actually improve security (vs. just using 1, 2, 3, etc. - basically a constant nonce of 0)?

As far as I can tell, the best-case scenario security-wise is that the nonce could act as a sort of second key, which would also be shared securely between the communicating parties. But if the underlying block cipher is secure (let's say AES-128), that should be both unnecessary and unhelpful...right?

It seems to me that specifying a nonce only gives a false sense of added security. Am I missing something?

The "nonce" is better known as the Initialization Vector -- with "IV" being the universal short name for that concept. CTR mode works by encrypting the successive values of a counter (CTR stands for "CounTeR"), so the IV in CTR mode is merely the value at which the counter starts.

CTR basically produces a long key-dependent pseudorandom stream, and encryption occurs by XORing that stream with the data to encrypt; in that sense, it is very similar to One-Time Pad, except that the key stream is generated with AES (as a kind of PRNG): this voids the mathematical greatness of OTP, i.e. its absolute security, but it makes the scheme usuable in practice.

Using an IV of value zero is fine... as long as you do it only once. If you reuse a counter value (with the same key) for another run, then you end up with the same thing as OTP where the "pad" is not "one-time". This is a classical break. The idea is that, for a given key, you should consider each counter value as "burnt" whenever you use it. If you do a first encryption run starting with counter value 0, then you will use counter values 0 to, say, 12782 (for instance if the data encrypted that time had length 276525 bytes). If you do not change the key, then you MUST NOT reuse any of the counter values 0 to 12782. The next encryption run with that key ought to start with IV = 12783.

Conversely, sticking to an IV of value 0, always, will be secure as long as you use the AES key only once. This would make sense in an SSL-like protocol, where a connection-specific encryption key is negotiated during an initial handshake, used for that connection, then dropped forever.

More generally, most modes of operations for block cipher use an IV (because they have some "running state" which must start somewhere), and the requirements for these IV depend on the mode. CTR can tolerate a fixed IV if you never reuse the key for another run. CBC does not even tolerate that, because a predictable IV can be leveraged for chosen-plaintext attacks.


OAuth2 Authorization and Resource Server security check I'm about to launch a web api using OAuth2 for authentication (authorization code, implicit and client credentials flows). The protocol is implemented using the DotNetOpenAuth v4.3 library. Although a somewhat old code base the library seems solid (can't find any CVEs or major complaints).

But it's better to be safe than sorry, so what security checks would you suggest I should run before launching to make sure that my implementation is ok?

When acting as an authorization server (AS) that handles OAuth 2.0, i think two major security features of the library you should check are:

Preventing access token leaking by restricting the redirect URL. In the implicit flow, the AS receives an authorization grant from a client it can not trust. In order not to give away access tokens to anybody, the library should allow you to specify a (white-)list of URLs for every connecting client. In the penetration test, you should check whether you can use a URL in the redirect_url that doesn't match one of the URLs in the whitelist (that would be a fail).
Preventing Cross-Site Request Forgery and/or Session Fixation with the state parameter. The state parameter is a random value, generated by the client. The parameter will then always be included in subsequent communication with the AS. It allows the client to validate that the access token it receives corresponds to the preceeding authorization request. Without this parameter, an attacker could inject his own access token, and therefore grant access to resources that the attacker controls. The end-user would then e.g. publish his data on the attacker's account. So for the penetration test, you should check whether the library properly validates the state parameter, or if you can alter the value.

Oh, and I almost forgot: OAuth 2.0 clearly specifies that it relies on secure SSL/TLS transport. So if you're not exclusively servicing your AS over HTTPS, that's a big #FAIL in the penetration test report.

The initial OAuth 2.0 specification RFC 6749, section 10 already contains lots of security considerations. Moreover, there's an additional RFC dedicated to OAuth 2.0 security:  https://tools.ietf.org/html/rfc6819

Another great resource that sums everything up can be found here: http://www.oauthsecurity.com/


What was/is the purpose of the 'MONLIST' command in NTP? Having looked through multiple RFC documents about NTP without success (of finding an answer), and a ton of blog posts stating how dangerous, evil and useless this command is, but do not explain why it exist or what the real purpose is, I started to wonder:

Why does the MONSLIST command exist in NTP? (The author couldn't forsee what this 'feature' would be used for, but it's a feature and has a reason to exist)

What is the purpose of the MONLIST command in NTP?

monlist is a debugging command that allows to retrieve information from the monitoring facility about traffic associated with the NTP service.

  The reference implementation of NTP [...] allows users to request a list of hosts with which the NTP daemon ntpd communicated recently. The list, called "monlist" has a size limit of 600 entries and contains the IP addresses of the last NTP clients or servers the instance has talked to.

(Source)

You don't find it explicitly mentioned in any RFC as it is a NTP mode 7 request. RFC 1305 explains that implementations may use "reserved mode 7 for special purposes, such as remote control and monitoring".

The ntp-monlist NSE script also has some information:

  Monitor data is a list of the most recently used (MRU) having NTP associations with the target. Each record contains information about the most recent NTP packet sent by a host to the target including the source and destination addresses and the NTP version and mode of the packet. With this information it is possible to classify associated hosts as Servers, Peers, and Clients.

Besides the information disclosure problem, monlist has a history of vulnerabilities such as CVE-2013-5211 which allowed DoS attacks by traffic amplifiaction via monlist queries with a forged source address.


IPsec - when to use AH only? As far as I know, AH only covers integrity and authentication. So, suppose that an intermediate router receives the packet with AH and not ESP. Then, can't the router open its content (<- and that's obvious) and even read authentication data of the packet and use it to fake its identity? (and make replay attacks possible?)

So, if this is true, isn't AH only effective with ESP?

Edit: What I am especially talking about is without fixing the content of a packet, the intermediate router can read the packet and then hand the packet to the original destination. If then, isn't authentication automatically broken?

The IP Authentication Header (AH) is used to provide connectionless
   integrity and data origin authentication for IP datagrams (hereafter
   referred to as just "authentication"), and to provide protection
   against replays.  This latter, optional service may be selected, by
   the receiver, when a Security Association is established. (Although
   the default calls for the sender to increment the Sequence Number
   used for anti-replay, the service is effective only if the receiver
   checks the Sequence Number.)  AH provides authentication for as much
   of the IP header as possible, as well as for upper level protocol
   data.  However, some IP header fields may change in transit and the
   value of these fields, when the packet arrives at the receiver, may
   not be predictable by the sender.  The values of such fields cannot
   be protected by AH.  Thus the protection provided to the IP header by
   AH is somewhat piecemeal.

AH may be applied alone, in combination with the IP Encapsulating
   Security Payload (ESP) [KA97b], or in a nested fashion through the
   use of tunnel mode (see "Security Architecture for the Internet
   Protocol" [KA97a], hereafter referred to as the Security Architecture
   document).  Security services can be provided between a pair of
   communicating hosts, between a pair of communicating security
   gateways, or between a security gateway and a host.  ESP may be used
   to provide the same security services, and it also provides a
   confidentiality (encryption) service.  The primary difference between
   the authentication provided by ESP and AH is the extent of the
   coverage.  Specifically, ESP does not protect any IP header fields

check those links for more details

https://tools.ietf.org/html/rfc4302

https://tools.ietf.org/html/rfc2402

http://www.amaranten.com/support/user%20guide/VPN/IPSec_Basics/Overview.htm


FIDO U2F - MacOS TouchBar I understand how FIDO works with yubikey: Yubikey device has a symmetric key and it uses appId, nonce and symmetric key to generate key pair for a website. And the device gives back public key and keyHandle (which can used to generate private key) to the RP.

But U2F works on chrome in Mac with Touchbar without yubikey. Does it mean MAC OS implemented U2F protocol? (But U2F doesn't work on safari!!!)

Who is generating and verifying the keyhandle in case of MAC?

Does it mean MAC OS implemented U2F protocol?

No, it means that Chrome implements U2F by using properties of the TouchBar. From Issue 678128: Use TouchBar/TouchID as a secure element for implementing a U2F security key:

  ... The new MacBook Pros with TouchID have a secure enclave for storing the fingerprint data. We may be able to use this element for implementing an on-computer second-factor security key. ...

In other words: the support is implemented in the browser by using capabilities offered by the OS. It is not implemented by the OS itself.


Is there any known encrypting ransomware that attacks Macs? Just about every article I read about Cryptowall, Cryptolocker, and its ilk seems to assume that the reader is running some flavor of Windows.

When I Google "ransomware OSX", I get a long list of articles about the FBI Javascript "ransomware".  However, this is not really ransomware in the same sense as Cryptowall and Cryptolocker, as it does not actually penetrate outside of the browser, and does not encrypt your files.  I would consider this to be the milk snake of the ransomware world.

So is there any true encrypting ransomware that affects Macs?

Yes, now there is a confirmed and well documented case of ransomware specifically targeting Mac OS X. It was named "KeRanger" and was distributed through a breach of the Transmission Bittorrent Client website.

http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/

Some basic OS X security features (Gatekeeper) had been circumvented by using a valid developer certificate. Apple has since revoked that certificate and updated it's XProtect signature list, but obviously this happened after the malware had already done damage.


How are Chrome and Firefox validating SSL Certificates? How are Chrome and Firefox validating SSL Certificates?
Are they requesting data from an SSL certification website, like GeoTrust, to validate the certificate received from the web server?

Browsers and/or operating systems tend to come with a pre-defined list of CA certificates used as trust anchors to check the certificates of servers they connect to. They're all customisable (except for EV certificates, for which the root certificates are hard-coded into the browser, although you can disable them... bug excepted).

Firefox uses its own list on all platforms.

Internet Explorer and Chrome use the operating system's certificate repository on Windows. The default is available via Microsoft's Root Certificate programme.

Apple also has its programme.

Trusting an a priori unknown server certificate is done by building a certification path between this certificate and one of the browser's trust anchors. This is done as defined in RFC 3280/RFC 5280.

In addition, certificate revocation can also be checked, either via CRL or via OCSP.

  So it's not possible to intercept communication between the browser
  and a CA to fake a valid certificate as the certificate is likely
  already in the browser's cache ?

To re-iterate the point I made as a comment to Wug's answers: the trust anchors repository is not a cache. A cache is a dynamic placeholder aimed to keep what you've accessed recently at your disposal, based on the assumption you'll need them again soon. In contrast, your trusted certificate list must never be updated automatically on the basis of what you're currently browsing. (It could be updated by automatic security updates, but that's a different issue.)

The server certificate will be obtained every time a new SSL/TLS session is established, and the browser must verify it every time. It's not cached. (You could have some OCSP caching, but that's to improve performance and kept only for a short period of time. This is just for verifying the revocation status, at the time of access.)

Contacting the CA is just for certificate revocation. You don't otherwise contact a CA. CA certificates (your trusted anchors) are a given, a "leap of faith", bundled for you by your OS/browser (which you can choose explicitly, but it's fixed as far as a given connection is concerned). At best you could prevent the certificate revocation check to happen (which may cause your browser to make its validation fail, depending on its settings).


Is it safe to login using HTTP on a WPA2 protected home network? I have a small network infrastructure in my home on which I'm hosting some services such as a website, file server and such.

Many of those services have an administration web interface which isn't using HTTPS or doesn't support it.

I'm currently using a laptop in my home network using Wi-Fi to login into those internal HTTP administration pages.

So, user and password are probably sent in cleartext inside my home network.
Since this is a WPA2 protected wireless connection between my laptop and my home router, credentials should pass in the air encrypted as I know. Other servers are connected using wired.

I know there are a set of public tools, such as airmon-ng, to capture packets which are sent over the air. Is it possible for someone who is using such passive capture tools to get my credentials?

I mean, the attacker captures the WPA2 traffic from the air (without being connected on the network) while I'm logging to HTTP-only internal web pages. So, I'm pretty sure the credentials are present (encrypted) in the capture.
Could the attacker use brute-forcing to get some key and decrypt the WPA2 traffic, so get the credentials from such capture?

I think you already know everything you need to answer yourself.

The only layer of security it's the WPA2 encryption, so, basically any attack against it would show the credentials since it's plain HTTP, so... there's capturing the four-way handshake and breaking it to decrypt the traffic*, there's the Downgrade attack, there's the KRACK attack and pretty much any other MITM Wi-Fi attack, UPnP on your router, etc.

So... It all comes down to your security practices, and the hardening of your home router.

*To your question: Yes if he captures the four-way handshake and the traffic in which you logged in, he's ready to bruteforce for the password and decypher the traffic he captured (Offline).


What are possible security issue if any of automatically inserting 2FA in 1password? I've heard that 1password have a feature.

We basically stored the QR codes for google 2FA in 1 password.

1 password then tell us the google 2FA keys everytime we logged in.

https://support.1password.com/one-time-passwords/

Is 1 password the only one with this feature?

I felt a little bit icky.

The whole point of 2FA is we need two different authorization. And now it's combined into one.

Anyone that can get into my 1password account can steal all my money.

So what's the solution?

TLDR: Don't use that particular feature of 1Password.

  Is 1 password the only one with this feature?

My password manager of choice, KeePass can also support this via a plugin. As for other password managers, I do not know.

  I felt a little bit icky.

It is a little icky to merge your 2 factors into one.

  The whole point of 2FA is we need two different authorization. And now it's combined into one.
  Anyone that can get into my 1password account can steal all my money.

Yes, anyone who manages to gain access to your 1Password would be able to log in. But in this case, the point of 2FA is a bit different. It is not really as much two factor as making the one factor better.

  So what's the solution?

Other then not using this feature, there is no solution. However, I believe there is no "problem" either.

I believe this feature is not meant to protect from 1Password compromise. It is rather meant to prevent the password being compromised when it is entered. Here are few examples the password may be revealed:

Keylogger or other spyware grabing the clipboard when you copy password
Keylogger grabing the password with autotype feature
Accidentaly saving the password in the browser
A malicious web browser extension grabbing the password
A malicious javascript (for example from XSS) grabbing the password
Attacker intercepting the login credentials, for example by MITM attack

In all these situations, the attacker would be able to gain your password, however if you use TOTP 2FA, he would have an old OTP. Therefore, he would not be able to log in at all in some of these scenarios and only log in once in the rest.

This feature is therefore IMO useful when you trust your 1Password will not be compromised, but you are worried about the password leaking. If you feel you need to protect your self, especially with e-Banking, you should use your phone instead. This is for lower-security applications.


Intercepting Android 9 app-traffic I used MitMproxy until recently I switched from the Samsung Galaxy S5 to the S9+ which runs Android 9... and suddenly I can't intercept apptraffic anymore. Looks like the proxy in the wifi-settings is ignored completely by apps?

Aside from that I noticed apps using certificate-pinning and refused to work.

Is there a solution for both? Or do I have to use some kind of Android-emulator on the PC now to check what data apps are sending out? I'm not an expert, just a DIY-pentester and curious about what my smartphone is doing.

Any way to resolve this? :) Thank you.

Typically I wouldn't monitor my network traffic directly on the device that it's coming from. You often miss a lot of traffic that is hidden. I would recommand to put it on WLAN and then record all the traffic with a suitable network card (promiscuous mode).
Afterwards you can analyse it with Wireshark.
This way you can be 100% certain that you're seeing all the traffic.


Using RFID-only on door lock to house? I'm thinking of equipping the door to my house with an RFID-reader and a custom arduino-like board to do the authentication.

My question is what is the recommended security level for a normal house (in Europe) lock? I'm thinking that i might need a PIN or other additional measures so that if someone finds my wallet with my rfid-card, they won't be able to gain access to my house.

What PIN-length would be "good enough?"

EDIT: There is already an app that can control your door from an iPhone. Wonder what my insurance company would think of that?

For home locks, I think that the proper way to analyze it is to think about money, and more specifically insurance. You put the kind of lock that will please your insurance company; with a custom lock, chances are that your insurance company will ask for more money every month -- or refuse to give you money if you are burgled (even if the burglar came in through, say, a window).

About PIN: PIN codes usually have relatively low entropy (only 10000 combinations with 4 decimal digits) and rely on auto-locking (e.g. the system which expects the PIN locks itself out after three wrong PINs). For a home door, this is not very good: you do not want to be locked out of your home because someone came by and idly played with the available keyboard. So you would need a relatively large PIN code, e.g. 8 digits. Also, PIN codes are susceptible to side-channel leakage: if you type the same code every day, the involved keys are likely to experience premature wear, revealing which digits are used in the PIN code.

You probably want to be able to enter your home even in case of a power shortage -- and you do not want to have your door opening automatically in that situation (see the Die Hard movie for an illustration). For that reason alone, I would recommend against your idea.


What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0? I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009.  The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is involved.

I'm guessing that the hole is that a malicious site can pretend to be using OAuth, and redirect the user to a phishing site meant to mimic Twitter in an attempt to get their username and password. Is this correct?

Additionally, whatever the flaw is, how is it being addressed in 2.0?

The April 2009 "session fixation attack" is described here: http://oauth.net/advisories/2009-1/ and in more detail here: http://hueniverse.com/2009/04/explaining-the-oauth-session-fixation-attack/

Security means different things from different perspectives.  As I keep repeating on this site, it all depends on your threat model.  Application providers have a different threat model than users, which is different than the RIAA's.

There is a movement among some OAuth 2.0 users from crypto signatures to a "wrap" model: "bearer tokens wrapped with TLS" (like cookies).  The editor of the spec talks about his concerns with that for interoperable discovery scenarios: http://hueniverse.com/2010/09/oauth-2-0-without-signatures-is-bad-for-the-web/  In Draft 11 of the OAuth 2.0 spec the option for signatures is back in.  The bearer token spec is moved out to a companion spec, and there are also companion specs for signatures via SAML and Kerberos.  Perhaps there will be others (like the OAuth 1.0 scheme?)  See the decision and thinking at http://www.ietf.org/mail-archive/web/oauth/current/msg04573.html

See also another earlier comment: http://benlog.com/articles/2009/12/22/its-a-wrap/

Here is another discussion of how it can get messy dealing with the different security perspectives.

http://benlog.com/articles/2010/09/02/an-unwarranted-bashing-of-twitters-oauth/


Are Digital Signatures tuned to become harder as computers become faster? For example, how long does a typical CPU take to verify a single secp256k1 signature? Wouldn't this need to change in time so that signatures can't be brute forced? How is it decided how "strong" the signature verification should be?

Suppose you need to check 2^128 = 10^38 keys to brute-force. Suppose your computer checks 10^9 keys/s. In a year this is ~3x10^16 keys. Let's round it up to 10^17. If you have 10^10 computers (more than the Earth population), you would check 10^27 passwords in a year.
CPUs are getting about 20% more powerful each year. If this trend remains for 100 years (which is hard to believe), the performance in 100 years would be 1.2^100 ~= 10^8 higher than now days. Means it would be possible to check 10^27 x 10^8 = 10^35 passwords in a year.
Means, even in 100 years later even when using the whole computer power on the Earth  will not be sufficient to brute-force a 128-bit password.
Thus, there is no need to consider other algorithms because of increasing CPU power.
But one should pay attention to cryptanalysis and what attacks are getting known each year.
How strong should the signature be? It depends on your threats, on your risks, on the benefits that an attacker can get by brute-forcing your signature.


hashcat specific brute force Is this scenario possible:

I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be repeated any number of times, and the file encrypted is a 7z file.

Is a masked attack this specific possible? i don't want to waste two months, i pratically know the password, it's just i used too many variations of it that i can't seem to open the file anymore.

Thanks for your time


Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites? I considered writing a program to do the above for websites I only intend to use for short-term use.

Yes, there's a very good reason, it's called KeePass. It's a free and open source password management application. It can automatically generate a rock-solid password for you, pair it to certain website, and store it in a securely encrypted database for which you have the key in a form of a master password.

Other than for learning purposes, don't play a crypto pro and write your own security-related programs.


Timing attacks in password hash comparisons I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java timing attack that happened in Java 6.
public static boolean isEqual(byte digesta[], byte digestb[]) {
    for (int i = 0; i < digesta.length; i++) {
        if (digesta[i] != digestb[i]) {
            return false;
        }
    }
    return true;
}

And my version, which I think is correct:
public static boolean isEqual(byte digesta[], byte digestb[]) {
    boolean isEquals = true;
    //this avoid a possible timing attack
    for (int i = 0; i < digesta.length; i++) {
        if (digesta[i] != digestb[i]) {
            isEquals = false;
        }
    }
    return isEquals;
}

Which, for me, indicates there is a possible timing attack that could be done because you return false if there is a mismatch in the hash. He argued that this would not be a risk in the application and that the important thing is that the password is salted and hashed and that will probably will not affect the security of the application.
Am I paranoid about the security of my application?

The first algorithm is sensitive to timing attacks, while the second looks better (but I don't know for sure if it's vulnerable or not). However, there is a bug with potential security implications in the second version: What happends if the two strings have different lengths?
Timing attacks are a real security issue that it is reasonable to be worried about, so you are right to bring the issue up. I could partly agree with your friend in that it is more important to use salt and a good hashing algorithm. This however does not mean that timing attacks are not important or should not be taken seriously. They should.
However, in this case, it is not obvious how an attacker could pull off a timing attack. Since the input (the password) is hashed with a salt, the attacker probably can't freely control what any of the compared hashes will be. That means it might not be possible to search your way to a matching hash. But all this depends on how the entire system is built, not just on the string comparison algorithm.
One good way to deal with all of this is to use a good library for the hashing. A well written library should take care of both salting and defense against timing attacks for you, without you having to go through the hassle to write all the code yourself.


Avoid being hacked with brute-force attack During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account.

Our website is a wordpress site. The attacker keeps performing POST requests (non-stop 24 hours a day) on the wp-login page (wordpress authentication page). It's not fast though, it's 4 requests each minute and each new 4 requests are made using a different IP and different User agent.

I have installed some security tools and set up rules so that each 3 wrong tries will have the user blocked by the firewall, and made the users password hard to guess.

Is this enough for this kind of attack or is there anything else i should do ?

There are a few things, options, settings etc; that you could set in order to improve application and underlying server hardening. Here are my recommendations on what I believe to be a good balance between easy implementation and effectiveness.

Limiting Connections

The biggest instant impact, that may not cause too much difficult to configure depending on the specific option you go for, would be to limit who can connect to the application.

Black listing is certainly an option but as you have described the attacker is constantly changing IP addresses. I would recommend you do not do this.

A white list would be a better suggestion and allowing only certain IPs to access the application. This would stop the attack in its tracks.

You could combine this with a VPN, this would mean those working from home (with most likely dynamic IPs) could easily connect to the application without having to get someone to give them access.

Secure Passwords

If this slow attack has in anyway resulted in an account being breached, you really need to question your password policy. There are many many references on this site giving password advice, I will not go in depth here.

If your password is worth its salt (haha) this attack shouldn't phase you.

Change the default username

If you can, change the default username from admin, you will throw a lot of people. I mean, first user I always try is admin.

Do Not!

Do not disable the account after X tries, you are just asking for a DoS.
Do not (or at least avoid) blacklist so many IP addresses, they are probably popular VPN services, which many people use a lot.


Why do we lock our computers? It's common knowledge that if somebody has physical access to your machine they can do whatever they want with it1.

So why do we always lock our computers? If somebody has physical access to my computer, it doesn't really matter if it's locked or not. They can either boot a live CD and reset my password or read my files (if it's not encrypted), or perform a cold boot attack to get my encryption keys from memory (if it is encrypted).

What's the point of locking a computer besides keeping the average coworker from messing with your stuff? Does it provide any real security benefit, or is it just a convenience to deter untrained people?

1. unless the computer has been off for a while and you're using full-disk encryption

In some places they have a saying: "opportunity makes the thief". All you're doing by screen-locking a computer is making the cost of hacking it just a little bit harder.

Security is an economic good, with a price and a value. The value of locking is somewhat larger than the price of locking it.  Sort of like how in good neighborhoods, you don't need to lock your front door. In most neighborhoods, you do lock your front door, but anyone with a hammer, a large rock or a brick could get in through the windows.  In some neighborhoods, not only do you lock the door, you have a solid-core door with a deadbolt, and you have steel gratings over the windows.  In the best neighborhoods, the value of the steel gratings isn't worth the price, but in bad neighborhoods, the value does exceed the price.


Skype is doing funny things when I type or click, does this necessarily mean malware may be in my computer? I'm new to the IT Security Stack Exchange! This is my question: I've Skype installed on my Windows 7 computer. In the last few months I've noticed my mouse cursor blinks (I mean it shows that cursor that appears when the computer is processing something) every time I type or click while Skype is the "focus" of my attention.

I think this could mean someone has installed a keylogger or some kind of malware on my PC. I think I could also just be paranoid about this. This happened some time after I gave out my Skype name online because somebody wanted to collaborate with me on a project.

I've ran multiple antivirus scans with Avast! free AV, scans with MalwareBytes Anti Malware, and even during Safe Mode on that computer. Not one scan has turned up any kind of malware threat detection!

Another important detail is I keep getting unsolicited contact requests on Skype as well. I don't know who they are so I decline and mark them as spam.

I wanted to ask this question here though I don't know if its much to go on. I don't know a whole lot about computer security.

It seems strange that odd behavior only occurs when using Skype. If there was a RAT (remote administration Trojan), which can include key logging functions, your computer would be compromised across the board.

The loading/processing cursor icon might not be signalling malware at all, its strange that you would suddenly think this is a sign of a virus. If you have scanned with multiple AV engines, its unlikely there is malware affecting your computer.

You could try inspecting Skype, looking at Windows processes for any outbound connections, among other steps but it doesn't really seem necessary.

Spam is common on Skype, if you are worried you could change your Skype password. Also try completely uninstalling Skype and reinstalling (make sure it is from a trusted source). Also, handing out your Skype name does not open your computer to malware, although it could provoke spam.

If you experience any other strange behavior, then considering further action/inspection.


Is it possible to transfer one-time credit card info to a physical mag stripe card? Several banks allow you to generate a one-time credit card number via an app or web page, with restrictions such as maximum amount and/or short expiry date.  These are fine for online transactions but sometimes you would like to use a one-time number for an in-person transaction (eg a petrol pump or redbox machine, or for use in an environment where there is a real risk of your card being cloned).  Would writing the number/name/cvv/date to a magstripe card give you something you could swipe?

Although the implementation of this would be similar to the subject of Is it possible to generate valid track 1 and track 2 data from basic CC info?, it is not the identical question because this usage also depends on the behaviour of the back-end systems which may be specific to use-once virtual credit cards and different from cloned regular credit cards.

No, this is not possible.  Among other things, the value provided for CVV online (such as a one-time use credit card number) is a CVV2 value, similar to what's printed on the back of a Visa/Mastercard.  (And is generally used for any "Card not present" transactions.)

On the other hand "card present" transactions require the CVV1 value, which is encoded on magnetic track.  A one-time-use card on the site wouldn't provide that value, so it wouldn't be possible to build the whole magnetic stripe.


Is my network tester (Fluke) being blocked? I am really desperate to get an answer on this, as I am wasting a lot of time trying to figure out what the problem is.

Can Cisco switches be configured to block network testers?  My network tester behaves extremely erratic when I connect it to a new network switch we installed at work.  If you search for NetTool Series II pdf in google you'll get info on what it does, and how it works.

Q.  Can Cisco switches be configured to block network testers?

A.  Yes the switch could be blocking your testing device if the port is configured to only allow specific MAC addresses.  See this link ands the following excerpt:

"If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs".

Alternatively, this could be due to the link negotiation (auto negotiation or hard coded) config if the devices are not set to negotiate correctly.  Check your docs and have the Network team confirm the current settings for the ports you are using.


Simplest way of hashing a password with multiple different hash algorithms I have a list of plaintext passwords that I would like to hash with various different hash algorithms (for educational purposes). As a minimum I would like to obtain hashes under MD5, SHA1, SHA256, (with and without salts), bcrypt, PBKDF2 and NTLM. Since hashcat supports all of these, I thought the simplest approach would be to run hashcat on the passwords with all the different algorithms.

However, to my astonishment (and frustration), I haven't been able to find a simple way of doing this in hashcat! Since hashcat is targeted towards breaking already hashed passwords, it requires a list of hashes, not plaintexts.

Thus, is there a way of simply running each algorithm in hashcat on a password in the clear - to obtain its hashed value?

Note: I don't really care if it's hashcat I use or not, I'm only looking for a simple way to hash some passwords with various different hash algorithms - minimizing the amount scripting I have to do myself. So if you have a better tool or approach, please share it.

On most UNIXoid operating systems, the openssl command line program should be available. It implements most of the hashes you mention. To use it just for hashing, pipe the output of echo -n to openssl dgst -[ALGORITHM]. To calculate the SHA1 hashsum of "Hello World", for example, use this:

 echo -n "Hello World" | openssl dgst -sha1

openssl dgst supports the following algorithms: md5, md4, md2, sha1, sha, mdc2, ripemd160 .


How can I Instruct a browser to reject proxy MITM certificate for my website Is there any way for my website to tell a browser, such as Chrome, to disallow a substitute MITM certificate like those used by corporate proxy servers? e.g. see Question 61056: Is there any way for my ISP or LAN admin to learn my Gmail address as a result of me logging into Gmail's web interface through via their network?

I understand the normal way this is supposed to work, and I understand that generally, control of the browser by the corporate group can control it how they like, but I'm wondering if, perhaps, under instruction from the website, Chrome has a way to defeat that, or, at least, make it more obvious when that's happening. (e.g. Perhaps through an alternate verification path?)

(I figure mine must be a dup question, but I can't find another, right now. — DN)

[new answer based on improved understanding of question based on OP comments to first, now deleted, answer]

  Is there any way for my website to tell a browser to disallow a
  substitute MITM certificate like those used by corporate proxy
  servers?

There are, although they are solutions designed to prevent the damage caused by certificates that were incorrectly issued to malicious parties by a CA.  Two such solutions are HPKP and DANE.  However, these are waning in support as other, different solutions (which don't help your use case) come into play.

HTTP Public Key Pinning (HPKP) involves the server communicating which certificates are valid to the browser within the HTTP headers. It has been deprecated, however, "because of its complexity and dangerous side-effects."  But it's worth noting particularly because, pertinent to your question,

  Most browsers disable pinning for certificate chains with private root
  certificates to enable various corporate content inspection
  scanners and web debugging tools (such as mitmproxy or Fiddler).
  The RFC 7469 standard recommends disabling pinning violation reports
  for "user-defined" root certificates, where it is "acceptable" for the
  browser to disable pin validation.

In other words - there are hooks to permit Corporate MITM in HPKP, as well.

DNS-based Authentication of Named Entities (DANE) does something similar, placing information about acceptable certificates into DNS entries.  It doesn't appear to have very good browser support, however, and if the Corporate Overlords are imposing MITM at the proxy, they're also capable of blackholing the necessary DNS queries.

Newer solutions to the problem of "bogus" certificates have shifted away from the browser, and as such aren't useful for your purposes.  DNS Certification Authority Authorization (CAA) allows server admins to publish a DNS record identifying the correct CA they use; however, this is used by other CAs as a check to avoid malicious requests for certificates from someone other than the domain owner.  Browsers do not use this record to verify anything.

Likewise, Certificate Transparency (CT) requires CAs to publish the certificates they've issued, allowing subjects and third parties to look for malicious certificates.  However, this isn't something browsers use, either.

Theoretically, if you wanted to get creative and roll your own, you could use the Forge JavaScript TLS Implementation to open a TLS session from the user's browser to your server for the purposes of inspecting the certificate.  If the certificate isn't yours, there's MITM going on!  Then you could take actions on the client side (e.g., pop up a warning) or the server side (e.g., abort the login or, if already logged in, log the user out).  It might be difficult to discern the proxy the browser is configured to use, though...


In message signing, is the digest encrypted with a generated symmetric key or with the sender's private key? I understand the encryption process uses a generated symmetric key to encrypt a message, and then encrypts the symmetric key with the receiver's public key before it is sent across the wire. This creates a situation that only the owner of the correlating private key can decrypt the symmetric key, and therefore decrypt the encrypted message.

I would like to understand the exact order of things for message signing. Mostly, something that looks like this, but for signatures.

I understand it may vary by protocol, and if so, describing the exact way a particular protocol would still be a good answer if you can also list at least a few pros/cons of doing it that way, verses any other protocol's strategy.

Within that, my main confusion point is:

If asymmetric encryption operations are more taxing on the CPU, and I am planning on sending many many messages, wouldn't there be a better (more efficient) way using some sort of symmetric key to encrypt the message digests that can be reused for many messages?  Then using asymmetric encryption to exchange the symmetric key? Could that still prove a message was sent by a sender, while taking advantages of the efficiencies of symmetric encryption?

In message signing, there is no encryption. Otherwise we would call it encryption.

A signature algorithm is, nominally, the combination of three sub-algorithms:

Key pair generation: that algorithm produces a brand new public/private key pair, using some strong random source, and using as parameter a "security level" to achieve (i.e. the size of the key that is to be generated).
Signature generation: inputs are the message to be signed m and the private key. The output is the signature value s.
Signature verification: inputs are the message m, the signature s, and the public key. Output is a boolean value: "true" if the signature matches the message and the public key, "false" otherwise.

The signature generation and verification algorithms are supposed to be able to process messages of arbitrary length, possibly gigabytes. And they do. Existing signature algorithms are already very efficient at handling huge inputs. So there is no problem which would require some additional construction, contrary to asymmetric encryption where something else is needed to cope with the severe limitations of these algorithms.

Most texts that talk about hybrid encryption say that we need to do that because asymmetric encryption is slow, but that's wrong. The real reason why hybrid encryption is used is because known asymmetric encryption algorithms cannot simply process messages of arbitrary length, and we have no real idea about how we could alter them in order to do so securely. Basically, the "chaining modes" for block ciphers do not have equivalents for asymmetric encryption that would be obviously safe. However, signature algorithms never had a limitation on input length to begin with, so that is a non-issue.

It so happens, internally, that most signature algorithms are efficient at handling large inputs because their first step is to process the complete message through a cryptographic hash function, and then work only over the hash value. This is a design element of most signature algorithms and should be of no concern to outsiders who just use the algorithm. It does explain, though, why some people discussing about "RSA signatures" suddenly begin to talk about hash functions such as SHA-1: this is because the signature algorithm includes, as one of its building elements, a hash function. Note that some algorithms do not work exactly that way; it would be wrong to claim that all signature algorithms begin by simple hashing.

Ultimately this is a matter of terminology. In the case of asymmetric encryption, e.g. RSA, it is traditional to talk about "the encryption algorithm" as using only a short input; and any extra symmetric encryption layer is considered to be, indeed, some extra, outside layer. However, in the case of digital signatures, the same tradition holds that the initial hashing step is part of what we call the "signature algorithm".

There are some good reasons for this terminology choice; in particular, we want the hash function to be part of what we call the "signature algorithm" because using a signature algorithm like RSA or ECDSA without a hashing step (using a "short input" directly with no hashing) may induce severe weaknesses. However, at its core, it still is a terminology issue.


RESTful web application security and authentication scheme I am building a web application where the front-end is a single-page-app and the back-end serves it through a RESTful API. I want to make sure I implement user authentication with the best security practices.

I am planning a system that will perform the following steps to ensure authentication security:

Signing up (or changing password):

User sends username and password to server in plaintext via HTTPS
Unique salt is generated with Python's urandom function (32 chars)
Salt prepended to password
Salt + password is hashed with bcrypt
Salt and hash stored in database table (SQL database, slower than key-value but I'm not too concerned about superspeed for logging in)
Random session id generated with urandom (32 chars)
Session id stored in key-value db (Redis? Key: session id, value: user id) and sent to client along with user object (obviously without salt and hash)

Logging in:

When logging in, user sends username and password to server in plaintext via HTTPS
Server retrieves salt and hash from users entry in SQL db
Salt prepended to password and put through bcrypt
If both hashes match, session id generated with urandom and entered into key-value db
Session id sent to client with user object

Any other request to the server:

Request and data sent via HTTPS including user id and session id
Key-value db searched with user id, if session ids matching, return requested data along with user object
If not matching, return error 401

Session handling:

Allow more than one session for the same user
Set expiration of session to 24 hours, when accessed, put back to 24 hours
Allow persistent session which expires in 1 month, when accessed also put back to full expiration time
On logout, remove session from Redis

Will this be a secure, scaleable and fast (when necessary) system? If not, where are the security flaws? What could I do to improve this process? Is this vulnerable to CSRF attacks? Does it improve security to add the client's IP address and USER_AGENT to the session or is this overkill?

Authentication is a complex mechanism with a lot of potential security failures that should be addressed.

TLDR: use Open ID for authentication instead of implementing your own mechanism.

Brute Force: you must take care of protecting against brute force in authentication (limit number of wrong attempts to login) and also protect against brute force of your session ID. If I were an attacker I just brute force the pair of ID and session ID until I do not get 401... now I have a valid session. You must block that after too. You can use an HMAC to sign the session ID. That way an attacker cannot guess your secret key used to HMAC the session ID and cannot brute force it.
Session ID theft. You did not state how Session ID is sent back to the user. I assume you meant to send it for client side script to handle and send with each subsequent request. That makes your Session ID susceptible for theft from client side script (caused by XSS for example), the way to protect against this is sending it in a cookie with the "http only" flag set so scripts cannot access it (and you need to make sure also "secure" flag set and limit to your domain etc... )
Your mechanism does not allow the user the "remember me" method, hence user will have to re authenticate every time he opens the app, keeping the session ID in a cookie will solve that as well.
CSRF - if session is kept in a persistent cookie you become vulnerable to CSRF. The way to protect against this is using an anti CSRF token otherwise known as Synchronizer Token Pattern

With all this in mind... my final recommendation for you is using open ID to authenticate your users, keep the hard work of authentication to the big guys and only make sure you are using it right, that will save you allot of headache and time and would probably eventually be more secure.


CEH training courses requirements What are the requirements for studying CEH?

Is there any requirements for the programming background?
And can anyone apply for it or does he has to have a recommendation for both studying and taking the test.

I have the CEH certification.

First, please read the official FAQ.

The CEH is pretty basic and covers pre-made tools for hacking and penetration testing, which means that you could pass the exam without a lot of pre-knowledge of anything. That said, you will have a much easier time (and you would be a much more effective CEH) if you did understand the basics of TCP, DNS, and operating systems.

Info Security is a wide area of study and you will never stop learning. Start somewhere and keep pushing in areas that interest you.


Did CVE-2016-2324 allowed remote code execution? Let’s say I have this kind of code :
// In revision.c
char *path_name(const struct name_path *path, const char *name) // by design, name_path->len is a 32 bits int, but this doesn’t concern name
{
      const struct name_path *p;
      char *n, *m;
      int nlen = strlen(name); // the size is converted to a positive number (the correct size was allocated previously with an unsigned long). I got 705804100
      int len = nlen + 1;

      for (p = path; p; p = p->up) { //loop is skipped (except in another case fixed since 2.7.1)
          if (p->elem_len)
              len += p->elem_len + 1;
      }
      n = xmalloc(len); // if len is negative, it will also be converted to a negative 64 bits integer *(which explains it is normally trying to allocate serveral Pb of ram most of the time)* which will be read as positive after that. // but this isn’t the run case that is interesting here.
      m = n + len - (nlen + 1); // the size of m is lower than name
      strcpy(m, name); // strcpy rely on the null terminating character. The result is written in an unallocated memory from heap. This is the definition of heap overflow enabling server side remote code execution if name[] contains assembly, and have the correct size. This open the way to defeat canaries aslr, and nx combined see http://security.stackexchange.com/q/20497/36301#comment182004_20550
      for (p = path; p; p = p->up) {
          if (p->elem_len) {
              m -= p->elem_len + 1;
              memcpy(m, p->elem, p->elem_len);
              m[p->elem_len] = '/';
          }
      }
      return n;
}

Could there be a case where the system let the overflow happen while keeping the path to remote code execution completely closed ?
A crafted path in a git database (a git tree) should contains binary code for performing the remote code execution. However, a path can’t contains thenulbyte (since it’s used as a delimiter in a git tree).
If a specific case is needed, it’s Ubuntu with linux version <3.16 and all security protections enabled (I mean nx aslr and dep combined but canaries excepted). The architecture is x86_64. libc is an old (but security patched) version of glibc.
Update :
Now, creating a proof should be easier.

A buffer overflow (of the "write" kind) gives any advantage to an attacker only if the attacker can arrange for the overflow to spill over other bytes that are used for something else. At any time, the process runs in an address space, most of which being unallocated. If the buffer which is overflown is at the end of the address space, or is followed only by unused bytes then an unmapped page, then the overflow won't help the attacker.

I remember a case with the rlogin command-line tool on SunOS 4.1.4 (sparc systems). It was root suid, and you could get it to segfault if the TERM environment variable contained a string longer than 64 characters. However, the overflown buffer was at the very end of the data section, and there was nothing beyond that to overwrite.

Mind, though, that malloc() may use extra bytes before and after each allocated block to keep track of which blocks are allocated. Depending on the implementation of malloc(), modifying these bytes may or may not help the attacker. The bottom-line is that while some buffer overflows cannot be exploited, it is usually very hard to make sure that a buffer overflow cannot be exploited. It is safer to assume that any buffer overflow can lead to drastic consequences, and not allow them to happen at all.


Security specification In terms of the requirement phase, what do we mean by "security specification"? Does it mean categorizing the security requirements under the security characteristics (such as authentication, authorization) and describing them in detail?

Security Specification is a subtitle in a SRS(Software Requirements Specification) report.

Search "security" keyword in this sample SRS report to get better understanding:

http://www.cse.chalmers.se/~feldt/courses/reqeng/examples/srs_example_2010_group2.pdf

Example specification from that document:

  ID: QR12

  TAG: CommunicationSecurity

  GIST: Security of the communication between the system and server.

  SCALE: The messages should be encrypted for log-in communications, so
  others cannot get user-name and password from those messages.

  METER: Attempts to get user-name and password through obtained
  messages on 1000 log-in session during testing.

  MUST: 100% of the Communication Messages in the communication of a
  log-in session should be encrypted. Communication Messages: Defined:
  Every exchanged of information between client and server.


Linux, TRESOR and XTS I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for things like getting IVs and using a mode like XTS. However, the actual key is requested once the kernel boots and any keys passed to the cipher via the crypto API later on are ignored.

When using the XTS mode, the key is usually split in two halves and one is used as the actual key and the other to generate IVs. But since TRESOR ignores all keys, the kernel ends up using two identical AES keys. From what I can gather from this question and the papers linked there, XTS is vulnerable to a chosen cipher text attack when used like that.

Can this become a problem in practice? And which modes of operation can I use instead? From looking at the code, it seems that cbc-essiv also needs to supply its own key.

This likely will become a problem, if you simply try to use tresor-xts-plain or tresor-xts-plain64. While I haven't tested it extensively, even when I tried TRESOR even with cbc-essiv, it resulted in a non-working system. Only cbc-plain worked, which does use a single key. The way I personally use TRESOR is with tresor-cbc-plain chained with serpent-xts-plain64. I assume that if someone performs a cold boot attack against me and manages to obtain the serpent key will not be able to perform malleability attacks against the cbc-plain, because cold boot attacks are not particularly stealthy. While there are some other weaknesses with cbc, confidentiality is typically still maintained.

However, there may be workarounds. There is a patch to hypervisor BitVisor, called TreVisor which can use TRESOR with XTS keys. I haven't read through the patch extensively. Perhaps looking at the tresor_xts_crypt() function could provide some insight. Its main page is here, in the middle.

There is also RamCrypt, which uses TRESOR to encrypts memory pages of individual processes. It uses the XEX mode of operation, which is similar to XTS (it also uses tweak keys, but the tweak key is the same as the data key). The ramcrypt_page_crypt() function may be a good starting point. Its main page is here.

TreVisor, at least, has a clever workaround for this problem. As XTS mode requires an extra key, the tweak key, TreVisor simply uses a key of half the size (128 bits rather than 256) for encryption, and uses the free 128 bits to store the tweak key. I believe RamCrypt does something similar. See the read_key_0 and read_key_1 macros, and the up argument for the encrypt_block and decrypt_block macros in the TreVisor patch.


Simple protection against reflected XSS I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques.

My question is- why don't we store what ever is going to server as parameters and if these parameters are reflected in HTML response then discard it or encoded it. Simple idea. I feel there may be false positives but not very convincing ones. Any input?

this approach is already found in various frameworks and works (more or less) against basic attack-patterns.

another, more elegant way is to use CSP, but you have some requirements when using this approach (no inline js/styles etc)

the problem is, from defender-pov, an attacker might have other points), nasty stuff like encoding, nullbytes and different ways to mitigate protection. if it were just ASCII, the world would be ( a little more) perfect :)


AES 128bit decryption using a key longer than 16 bytes I got a little problem regarding AES decryption. I have to decrypt some text that has been encrypted using 128bit AES / ECB with PHP mcrypt. The thing is, the key that is being used to encrypt/decrypt is 32 bytes long instead of 16. This is all good when I encrypt/decrypt through mcrypt, but now I have to write a decrypt function in another language (LUA). The problem I have is that the library I'm using in LUA doesn't support keys longer than 16 bytes, it has to be exactly 16 bytes long. I guess that mcrypt internally transforms keys longer than 16 bytes into a 16 byte form, but I don't know how. What I'm trying to do is to do the exact same key transformation in LUA so my library can decrypt it. Changing the key is a no go, as it was given by a service provider. Here's the PHP code that does the encrypt/decrypt:

function aes_encrypt($sStr, $sKey = "12345678901234561234567890123456") {
    return base64_encode(mcrypt_encrypt(
        MCRYPT_RIJNDAEL_128,
        $sKey,
        $sStr,
        MCRYPT_MODE_ECB
    ));
}

function aes_decrypt($sStr, $sKey = "12345678901234561234567890123456") {
    $str =  rtrim(mcrypt_decrypt(
        MCRYPT_RIJNDAEL_128,
        $sKey,
        base64_decode($sStr),
        MCRYPT_MODE_ECB
    ),"\0\4");
   return preg_replace("/[^\d]/", "", $str);
}

Any help is much appreciated.

128bit AES has 128 bit keys by definition. If the key is 32 bytes, it's AES-256.
Perhaps your key consists of 32 hex characters, which only map to 16 bytes or 128 bits.
Note that all variants of AES, map to MCRYPT_RIJNDAEL_128 in php, since that 128 is the block size and AES has 128 bit blocks regardless of the key size.
As Xander said, your code it very weak since it uses ECB mode. Use authenticated encryption instead.


Is wiping LUKS header needed? So I previously had an encrypted install of Debian, and wanted to install a new distro with full system encryption again. Now I understand that you don't need to fill the disk with random data if you already had encrypted partitions, and that wiping the LUKS header(s) will suffice. But now I deleted those previous partitions and I'm kinda stuck on what I have to do now. Do I have to fill the whole drive with random data again (at the possible expense of SSD lifetime, with questionable effectiveness in regards to cache in SSDs) or just let it how it is now, and create new encrypted partitions? From what I've read, when choosing this last option, some background 'noise' will remain, making it easier for an attacker to retrieve data (from the new partitions).

What do you think?

The only way to make "sure" data cannot be regenerated is to use the writing "random data to entire disk" method. The LUKS header is just a "road map" to the data's encryption, loss of it makes it harder but not impossible to reconstitute. All encryption should be equal to the threat level one experiences on a certain machine.


Is there a security risk in using the same profile picture on different sites? Well, the title basically says it.

I'd suppose that using the same profile picture on unrelated sites would allow anyone to do a quick Google image search and therefore associate the profiles with each other, at least on those sites where profile pictures are indexed by search engines.

I'm not sure though if this means that people should start using different profile pictures on every site, because after all, having the same profile picture on different social media profiles provides a sense of consistency and recognizability, which might even be considered a good thing.

However, anyone can copy a profile picture, so a profile with a different picture might indicate that it was indeed created by the person it claims to be.

That said, what should be taken into account when choosing a profile picture?

I think anyone using Social media, or similar, is vulnerable the second they start to broadcast their life into the world.

In terms of a security risk, only really as far as you assisting the bad guys with the Social Engineering part of their attack. Yes, you'd probably be easier to find across multiple platforms, but there a lot of variations.

It'd depend on what profile picture is in use, if it's of your favorite Ferrari, there is a very high chance your favorite car picture is also thousands of other peoples favorite Ferrari. Returning that on a Google image search when trying to find someone called "John Fakename" would be difficult. There may well be many other "John Fakename" out there with the same car picture.

If however, the profile picture in question is of you standing in front of your TV at home holding your best animal friend, a Google image search on that (on the assumption this image is on other accounts) would presumably only return YOUR profiles, and not other randoms with the same name. It'd be much easier for any attacker to say "Ha! There! that's the guy I want" if the same pictures are used.

It's not like using the same image would pose a large enough threat for me to suggest you not do this.

With regards to what should be taken into account when choosing a profile picture, it depends how security conscious you are. There is really nothing more to it, if you'd rather not be easy to locate across multiple platforms, change it up, if you don't care, don't.

Your face picture makes you easily identifiable, remember this. If you're using Websites that don't require face pictures, yeah, i'd avoid it, but that's just personal choice.


How do you search for a botnet out in the wild? I'm interested in searching for botnets out in the wild. Besides Google dorking for a phrase or code used on the control panel backend for web based interfaces. What other ways are there to search for a botnet?

Set up a honeypot, let it get infected with some malware and log where this malware connects to.

Pros:

You might discover some interesting botnets.
You'll uncover more than google will. I guess that their control pages are not indexed!

Cons:

You need to get a machine infected with malware.
You might have to get a lot of infections before you find a botnet.
You need to be able to spot what might be a botnet in the network traffic.


Should I back up automatic strong passwords of iCloud? I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other device or actual paper? Or am I worrying too much?

I would use a good password manager that encrypts the password database with a strong key, and use cloud to backup the resulting file. This way even if the cloud storage is hacked, your password database is encrypted.

If the cloud storage is offline, nothing is lost, because you use it to backup the database. And you don't need to trust your brain to create and remember complex passwords. Because no matter how complex your password is, if you reuse it and a malicious agent (or malicious service) gets your password, you are toast.

A good password manager solves both problems: creates very strong passwords, unique for each service, encrypts the database and allows for safe cloud backups.


Latest Vulnerability Information for IT Security Research Are there any web sites where one can visit to see the latest disclosed vulnerabilities in order to further develop IT security research skills and keep up-to-date?

Sure, plenty.

One of the most prominent is the Full Disclosure list, which was closed down in 2014 and then reborn.  You can find the past archives and subscription info at http://seclists.org/fulldisclosure/ .

Another good source of general information are Linux distros' security lists, which provide announcements of fixed vulnerabilities in their software.  A small selection:

Ubuntu
Debian
CentOS

MITRE provides some feeds of CVEs.


Stack location range on linux for user process In Linux, with ASLR enabled, is there a range of addresses where user stack address lies? What about heap, instruction addresses(text section)? In general, is it possible to look at an address and tell if it is for data or for code?

I am trying to write a Pintool that looks at the EIP after a return and checks if the EIP points to a data area. Let's assume that NX is not enabled on this system.

Yes, there is a range, and you can determine that range trivially for any running process. Read a given process' /proc/<pid>/maps to see its memory layout, as well as the type of memory in each address range. This is described in proc(5). A sample from an embedded device:

root@UP-7197:~# cat /proc/self/maps
00400000-0044b000 r-xp 00000000 1f:02 944        /bin/busybox
0045b000-0045c000 rw-p 0004b000 1f:02 944        /bin/busybox
77450000-77472000 r-xp 00000000 1f:02 802        /lib/libgcc_s.so.1
77472000-77473000 rw-p 00012000 1f:02 802        /lib/libgcc_s.so.1
77474000-77506000 r-xp 00000000 1f:02 891        /lib/libc.so
77513000-77514000 r--p 00000000 00:00 0          [vvar]
77514000-77515000 r-xp 00000000 00:00 0          [vdso]
77515000-77517000 rw-p 00091000 1f:02 891        /lib/libc.so
77517000-77519000 rwxp 00000000 00:00 0
7fc55000-7fc76000 rw-p 00000000 00:00 0          [stack]

The syntax is explained over at Stack Overflow.


Email sending out spam to many contacts I'm asking on behalf of a friend.

A few days ago, I received a email with his full name (with no subject), thought that's from him. But when I opened it, there was only an obvious spam link, and I saw that not only I received this mail but also 20 other of his contacts, however when I checked the address from which this mail was sent, I saw that the mail was NOT his own yahoo mail address , but instead a mail address on a spam domain which contained his name. and I received not only one of these emails, but many, and each time they were sent from a different address and with a different spam link in it.

He can still sign in to his yahoo mail, so his password was not changed.

Has someone access to his mail account or could it also be a dangerous virus on his computer and/or android phone? (he has the yahoo app on his phone)

Which steps should he take?

I will shoot in the dark as there is no way to know exactly what can be the reason without further details...

Each time you forward those emails like : if you don't send this email to 20 accounts and the person who sent it to you in the next minute, you will be cursed..., spammers will receive a lot of information about you and your contacts (many people still don't use BCC). There is no magic in that.

Other possibility is that he set his account in a mail client (e.g. outlook) and his computer got some virus which accessed his contacts, which were sent to some server. Or... some of his friends got a virus / hacked and a spammer was able to get some of those forwarded emails in which all contacts are clearly displayed, for example: your@friend.com -> his_friend1@yahoo.com, his_friend2@gmail.com, etc.... Got the idea?

There are many strategies that can be used to gather such information. Personally, I don't think his account has been compromised or otherwise all emails would have been sent directly from his account (increasing spammer's success rate).


How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for smtp using the postfix directive:

smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination

The most suitible functionality I can find in Dovecot is to force all clients to use secure authentication with the disable_plaintext_auth = yes directive.

As a workaround I can set  disable_plaintext_auth = no and add lines to my firewall using iptables to allow specific port access like so:

sudo iptables -A INPUT -i eth0 -p tcp -s 192.168.0.0/24 --dport 143 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 993 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp -s 192.168.0.0/24 --dport 110 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 995 -j ACCEPT

But this seems rather hacky and introduces more issues for example: This wont allow STARTTLS over port 110 from a remote client.

Is there another way to allow local clients to authenticate with my postfix/dovecot system over either a secure or insecure connection while still forcing remote clients to only use a secure authentication?

You don't want to send passwords over cleartext regardless of whether that's a local or non-local user. It's just bad practice and arguments of the "but it's only traversing my trusted switch" kind inevitably lead into a pitfall. You'll make a mistake, or someone else will make a mistake, and suddenly you'll find out months later that somehow attackers were able to sniff your CEO's account password and leak confidential emails to your competitors. Just don't do it.

Besides, part of your premise is incorrect. What postfix is doing via permit_mynetworks is not the same as what cleartext imap would be doing. This configuration option instructs postfix to accept messages for relaying from any local network without requiring authentication -- so no passwords will traverse the unencrypted connection. However, if you allow local clients to talk directly to imap or pop3, that will send passwords in cleartext over the network. Otherwise how would the imap server distinguish user bob from user alice.

If your concern is the overhead of encryption, then it's really not something to worry about these days. AES is really fast, especially if you're using a system with AES-NI support in the processor (and a relatively recent OS that makes use of that in openssl). The performance hit is not worth the headaches of worrying about your users' passwords traversing the network in unencrypted form.


Broadband security question I have a fixed line broadband connection at home. This morning when I tried accessing Google or Facebook through my browser (Google Chrome) I got a webpage asking me to update my flash player. I found this to be a little suspicious since I had accessed Facebook just a little while earlier from the same machine on a different network. My suspicions were confirmed when the similar thing happened when I tried to connect through a different system and my mobile.

When I tried to ping Facebook or Google, the packets are sent to an IP based in Seattle (108.62.62.234). When I tried to trace the route of the packets, I found a shocking thing that the packets were being sent first to my ISP and then were being sent to that IP.

Is someone tampering my connection? What is happening? What needs to be done in future?

It sounds to me as though your router might have it's DNS server setting compromised with malicious servers. The reason you might be getting sent to the malicious IP address when you ping facebook.com is because that lookup is being referenced to either a rogue DNS server that serves bogus requests, or you have a hosts file that's been overwritten.

I would try manually changing the DNS servers on one of the devices within your network to simply use 8.8.8.8. Try pinging again and see if you get the same address.

You might also use an nslookup to see what DNS server you currently have responding to the request.

> nslookup
> facebook.com


OIOSAML: assertion consumer does not work I wrote a simple system with SP-initiating Web SSO scenario based on OIOSAML. To test the system, I deployed it on the remote host. However AssertionConsumerServiceURL, where I specified URL, on which Shibboleth idP (idP based on Shibboleth) should return the answer is not called.

SAMLAssertionConsumer - just a simple Java servlet. For a begin with, I just need to make sure that the response comes.

Generated AuthnRequest:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
    AssertionConsumerServiceURL="http://ip-of-remote-system-here:8080/saml/consumer"
    Destination="http://ip-of-identity-provider-here/idp/profile/SAML2/Redirect/SSO"
    ForceAuthn="false"
    ID="_068712cd-......163720312"
    IsPassive="false"
    IssueInstant="2014-07-12T06:42:16.673Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">

    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://ip-of-remote-system-here:8080</saml2:Issuer>
</saml2p:AuthnRequest>

if I make request to my servlet SAMLAssertionConsumer direct:

http://ip-of-remote-system-here:8080/saml/consumer

Then it works.
I would like to know how to properly configure the the assertion consumer service. That is the part of the SP-metadata, where I specify the assertion consumer.

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:esia="urn:esia:shibboleth:2.0:mdext" entityID="http://ip-of-remote-system-here:8080">
    <md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor use="signing">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
                    <ds:X509Certificate>
                        MIID...XY7ZiQ==
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:KeyDescriptor use="encryption">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
                    <ds:X509Certificate>
                        MIID...XY7ZiQ==
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>

     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"  Location="http://ip-of-remote-system-here:8080/saml/consumer" ResponseLocation="http://ip-of-remote-system-here:8080/saml/consumer"/>
     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://ip-of-remote-system-here:8080/saml/consumer" index="0" isDefault="true"/>

    </md:SPSSODescriptor>
    <md:AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
       ...
    </md:AttributeAuthorityDescriptor>
    <md:Organization>
       ...
    </md:Organization>
    <md:ContactPerson contactType="technical">
      ...
    </md:ContactPerson>
    <md:Extensions>
      ...
    </md:Extensions>
</md:EntityDescriptor>

I would be very grateful for the information. Thanks to all.

The problem was different. Was used incorrect keystore. Now everything is OK.

Initially, I assumed that entityID attribute must refer to a domain name, which specified in attributes Location. However, it is not. It just must be unique and it is better to use domain name for that.

UnderstandingShibboleth, EntityNaming:

  Shibboleth identity and service providers are used in SAML
  deployments, and as such,  they are assigned a unique name known as an
  "entityID".

Metadata for the OASIS Security Assertion Markup Language (SAML)V2.0, 2.3.2 Element :

  entityID [Required] -

 Specifies the unique identifier of the SAML entity whose metadata is
 described by the element's contents.

UnderstandingShibboleth, EntityNaming:

  Strongly recommended NOT to use the physical hostname of a server
  running Shibboleth as the entityID. As time passes, things get moved
  and that deployment may not always live on the same box.

  Additionally there may be multiple logical deployments of Shibboleth
  on a single physical server, each requiring their own unique
  entityID, so using the server's name doesn't scale beyond a single
  one.

In the sandbox can be use physical addresses.


Nested encryption for multiple users I've developed a web application (developed in .NET MVC 4) which have multiple users with personal login credentials. The web application holds a lot of content uploaded by the users.

My client would also like to have an offline version of the application, for Windows. This application should use the same information available on the web, it should be available offline, and it should be secured in a way that a user should not be able to take the application content and give it/sell it to a competitor (in an easy way).

So I have in my web application implemented functionality to create an application package, containing all relevant information, which is downloadable and encrypted with a symmetric key. However, each user should be able to decrypt the package with his/hers credentials (i.e. personal passwords).

So when a user is created I create an asymmetric key pair for that user, and the private key is stored in the database as a encrypted string where the key is the private password (stored as a hash from bcrypt).

This list of events means that there's a whole lot of nested encryption and it makes me feel uncomfortable because I don't really know if it's secure enough - so I would like some inputs on my method of choice.

The chain of functionality;

When creating a user;

Create an asymmetric key pair
Encrypt the private key with the users credential password
Hash the password with bcrypt
Store hash + encrypted private key for the user

When creating an application package;

Create a symmetric key [Server side]
Create an application package (raw data) and encrypt it with the
symmetric key [Server side]
For each user, encrypt the symmetric key with the users public key
and store the result so it can be downloaded [Server side]
A user logs on to download the package+encrypted symmetric
key+encrypted private key [Server side]
Decrypt the stored, encrypted, private key with the users credential
password [Client side]
Decrypt the stored, encrypted, symmetric key with the now decrypted
private key for the user [Client side]
Decrypt the application package (in memory on the clients computer)
and show the content via a small, built in, server [Client side]

Is this a fairly secure way to solve my problem? Can I do it in any other way? Is there any obvious security holes in this solution?

it should be available offline, and it should be secured in a way that a user should not be able to take the application content and give it/sell it to a competitor

This is not in general possible. The user controls his computer, and can bypass any security mechanism if he is motivated to do so. For example he could use a debugger to halt your program and read the keys from memory.

Complete prevention by technical means is not possible, so is the wrong goal. Suitable goals are:

Keep honest people honest
Provide tamper-evidence/audit trail.

The first can be achieved relatively easily be obfuscating or encrypting local files in some way. However your scheme is over the top. You need only issue each user a unique key (which the app stores) and issue the documents/resources encrypted to that key. Of course they can easily decrypt it if they put in a little effort.

The second needs to be achieved using some sort of watermarking scheme. There are many, but if you are for example supplying the content as PDF files, you can watermark these easily with for example "This copy issued to username@example.com on 2014-01-21" on every page - this will be visible to the user. (In light grey, running up the left hand edge of the page is a popular choice). You might also want to include a second "secret" watermark, to attempt to catch those who go to the lengths of erasing the obvious one.

https://en.wikipedia.org/wiki/Digital_watermarking

Watermarking requires you to issue an individual copy to each user. This is not technically difficult of course, but may be inconvenient.


Enumerate forest trust relationships I'm trying to up my Windows domain enumeration game. I'm doing some exercises where I'm tasked to find the forest trust relationships without exploitation or creds or being on the domain.

All resources I've found seem to use Windows tools and imply that you're already on the domain.

How can I do this from an unauth perspective from a Linux box?

BloodHound is a tool that includes PowerView to enumerate Active Directory trust relationships as well as every other entity type in an Active Directory: computers, sessions, users, groups, privileged users and groups, etc. It relies on PowerShell for its inputs, but the artifacts can still be gathered on Linux, macOS, and probably other OSes. Instead of text output or regular databases, BloodHound uses the Neo4j graph database to internally explain/explore the relationship mappings. It clearly shows domain relationships to forests as well as forests to other forests.
While it does technically require Domain Users rights, these can be gathered from another perspective, such as chuckle. Linux, like Windows, does not have to be on the domain to connect to assets of a Windows Server Domain (only the target domain and entity must be specified). Typically, one would connect with any smb or ntlm client software (again with the domain and entity, e.g., MYDOMAIN\myusername), but a permanent full-domain relationship (from boot) can be configured for Linux using winbind, sssd, PowerBroker Open, Likewise Software's Likewise Enterprise, Centrify DirectControl, Quest Authentication Services, and probably others. Only winbind and sssd are available as free, open-source software.
A quick way to see domain and forests (including correlation of trust relationships) with no authentication or exploitation -- assuming your Linux distro supports these packages -- is to install sssd with samba, samba-common, realmd, and adcli. If all are functional, then it may be as simple as (the braces {} denote that the arguments are optional, the brackets [] indicate that the arguments are required):

realm discover {--verbose} {--server-software=active-directory} {domainname or domain.com}

If you know the domain name (or extract it from the above command when you don't know it), then you can run adcli info to get the closest domain controller, and then run adcli against the domain controller to get the domain-forest info. Once the domain-forest name is known, you can run adcli again to get more information about that forest as well.

adcli info [domain or forest]
adcli info --domain-controller=[dc.domain.example.com]


Redeploying multiple Secure sites on a single server This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm looking to do is transfer these sites to a single server setup (minus loadbalancing, etc.), and have the sites be selected based on Virtual Host.

The network stack would be user > nginx > Passenger > Padrino, running on Ubuntu, with the usual security features, SELinux, fail2ban, denyhosts, ufw, tiger.

I've been trying to weight the pros and cons to this, and so far I'm at a loss, based on 2 key points:

The system would be much easier to maintain, as I would have far fewer instances to keep up to date.
If a breach does happen, it'll be a lot more catastrophic, as it will imply access to every hosted database, rather than a single one.

I can't tell if it's worth the risk, for the sake of saving time (Which I barely have) to keep it right.

You need to do a risk assessment for each site. and consider likelihood as well as consequences. It could be that some of your sites have a much higher likelihood than others. If this is the case, you could consider slightly modified approaches, such as keeping the high risk sites on their own system and only putting the lower risk ones on the shared system. While this may still result in higher maintenance than a single system, it may be less maintenance than 10 separate systems and may provide the efficiency you need.

Once you have a good risk assessment and have identified your proposed architecture, you then need to look at ways you can mitigate the risk. This includes not only putting controls in place that reduce the likelihood of a breech, but also controls which will reduce the impact i.e. make it less catastrophic. for example, frequency of backups, use of snapshots or any other technique which will make it easier to recover should a breech occur.

Once you have done all other this, then you can make the call as to whether the resudual risks are acceptable or not. This assessment needs to include your abiity to maintain whatever solution you decide upon.  Essentially, your challenge isn't a purely technical one. Nobody can say that a single server is good or bad without also having information on the risks associated with each site.


How to ensure web application remains secured after intrusion of server My application employs asymmetric encryption / decryption, the process of how this work is detailed below:

Encryption - Server A

Data is encrypted using the public key of server B
Data is signed using the private key of server A

Admin users of the website can see the submitted data via another web application situated on 'Server B' where the decryption process takes place:

Decryption - Server B

Data is verified using the public key of server A
Data is decrypted using private key of server B

However, if Server A for example was 'somehow' penetrated where an attacker managed to get root access to the server, the encryption would be pointless as the attacker could modify my application code to stop encrypting data and even to send the data to another location. I would like to know how I can secure the application itself from being tampered with, if root access is gained on the server? The application is hosted on Windows Server 2003.

One of the rules of security is:

  If the attacker has access to your box, it is his

This includes root access, or physical access. As root on a server an attacker can do anything.

So, what this means is you should be focusing more on prevention and detection. If you can place controls that make it difficult enough for an attacker that you spot them before they gain access, you can do something about it.

So, how do you do that?

First and foremost - get up to date. This includes upgrading to a more recent OS, and then keeping patches up to date. If a security advisory comes out in any application or framework you are using, test it doesn't break your system, then patch!

Use firewalls - they are a basic solution, but limiting access to only that which is required for business is still essential.

Similarly, limit account access.

Implement some form of IDS - whether it is a full blown IDS, logging of odd activity, su/admin logging etc. Log everything your IT administrators have access to.

Defence in depth - never gets old :-)


Remotely exploit Linux kernel with CVE-2017-18017? I have set up a server running Linux Kernel 4.4. How can I exploit this, preferably not a DoS attack? I have opened port 80(https), however I would rather do it in an elegant fashion so I can actually learn something instead  of just mindlessly running slowloris. A specific vulnerability I have looked into is:

CVE-2017-18017

The description of the sechole is this:

  The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.

Running a server with a 4.4 is not enough. As the kernel.org state says, the 4.4 line is still being developed, the last release is 4.4.196 from 2019-10-07. Most likely it only gets security patches, but these it gets. It is unlikely that they had not fixed it, only it is not mentioned in the CVE description.

The test the code, you need to find a kernel which is enough old for the bug to happen. I would suggest to use 4.9.35 - it is the last kernel with a clear version and mentioned in the CVE.

So we download 4.9.36 and 4.9.35, and compare their net/netfilter/xt_TCPMSS.c. You can do this also with a git command. Check, what changed.

The difference is very small:

$ diff -urNw linux-4.9.3{5,6}/net/netfilter/xt_TCPMSS.c
--- linux-4.9.35/net/netfilter/xt_TCPMSS.c      2017-06-29 13:00:49.000000000 +0200
+++ linux-4.9.36/net/netfilter/xt_TCPMSS.c      2017-07-05 14:40:44.000000000 +0200
@@ -104,7 +104,7 @@
        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
        tcp_hdrlen = tcph->doff * 4;

-       if (len < tcp_hdrlen)
+       if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr))
                return -1;

        if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
@@ -152,6 +152,10 @@
        if (len > tcp_hdrlen)
                return 0;

+       /* tcph->doff has 4 bits, do not wrap it to 0 */
+       if (tcp_hdrlen >= 15 * 4)
+               return 0;
+
        /*
         * MSS Option not found ?! add it..
         */

Note also, the ordinary networking code of the linux does not use this file. It is the MSS iptables target, thus your exploit will only work on servers using it. It should work only on data packets targeted to the TCPMSS target in the iptables.

  The TCPMSS target can be used to alter the MSS (Maximum Segment Size) value of TCP SYN packets that the firewall sees. The MSS value is used to control the maximum size of packets for specific connections. Under normal circumstances, this means the size of the MTU (Maximum Transfer Unit) value, minus 40 bytes.

What we can see, is actually 2 minor changes. As it is visible, it does not make correct boundary checks for TCP packets with an uncommonly long TCP packet header length.

How exactly can be used, it is already hardcore kernel programming. You probably need to use netlink sockets on the "attacker" side, and do some debug work on the defensive one. First guarantee that the packets you send to the host, are really getting the packet (simplest way: insmod a modified xt_TCPMSS.ko which emits printk() debug log). Then you can play with it.

Probably the development of the synthetization code (on the attacker side) will be more hard.


Atm/Debit card Security Is it possible for a person who has your ATM/debit card number and PIN, to withdraw your money? If so, how?

You need a couple of pieces of information in addition to the card number and the PIN, but this is pretty close to accurate.  Card cloning is a common crime and there are criminals who even do it right on the machine itself.  By copying the ATM card and recording the PIN, it is possible to access the account and withdraw money from it.  Fake faceplates can be installed on most ATMs to read the magnetic strip on the card and record the PIN number entered.  This is why it is always important to examine an ATM before you use it to ensure that it has not been tampered with.


Aircrack-ng does not have cuda implementation. Are there alternatives? I need a program to crack .cap files , and would like to use my cuda devices.
I know there is pyrit, but I have very severe driver issues on Linux with it and it does not exist for windows, and aircrack-ng , a program which is so widely supported and used by a giant community has no support for cuda computing.

Are there any alternatives besides aircrack-ng and pyrit ?

Theres a fork of aircrack using cuda.

Check it out here

Alternatively the following listed supports CUDA password cracking too.

John the ripper
hashcat

You may want to consider the other specific cracking tool if you are using rainbow tables instead of dictionaries.

Rainbowcrack
Cryptohaze