How to reduce trouble in case I lose access to my password manager? I have recently started using a password manager, and I am worried about having a plan B in case I lose access to the vault file and need to access the passwords: for instance, both my laptop and my phone get stolen at the same time while I am on the road, and I need to access my funds on e-banking to buy a plane ticket.

Are there best practices on how to deal with scenarios like this one? One approach could be "keep your e-banking and your primary e-mail password outside the password manager, and don't use 2FA for those", but I understand that this weakens security in a different way.

This question is similar to this one, but I am asking about a different risk scenario.

EDIT: Just to clarify after reading the first two answers: I have backup, but accessing backup in a scenario such as the one I have described is a problem in itself.

Backups. Follow the 3-2-1 rule: three copies, on at least two different media, one of which is offsite.

Personally, my 1Password keychain is sync'd to my laptop and my phone. It's backed up regularly through Time Machine, both to the laptop itself and to a hard drive in my apartment accessed over WiFi. It's also sync'd to Dropbox, which allows accessing archival copies of any previous version. The Dropbox password is written down in a fire safe (arguably, it should be a password I remember — if the apartment burns down particularly spectacularly, that could theoretically take out the phone, laptop, hard drive, and fire safe).

Given this, I'm probably more likely to win the lottery twice than to lose my password vault.


Script Kiddies - how do they find my server IP? I've set up a site on Digital Ocean without a domain yet, so there is only the IP.
Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's are trying to hack my SSL port or are looking for PHP files.

But how do they know that I do exist? Where do they get the IP from?

You can't hide your IP address on the internet. They aren't secret.

Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean droplets that are online.

They can do this on a timer so that when you go offline, or online, it will just keep trying as those may be high-value targets that could become vulnerable at a moment's notice.

Let me give you a very rough coding example. Let's pretend your IP address is 104.16.25.255. Let's get the IP address of www.digitalocean.com so we can easily check for associated IP addresses. www.digitalocean.com returns 104.16.25.4. Let's scan everything: 104.16.25.*

Scanning is incredibly easy from a programming standpoint

Let's assume we want to try and find all nearby associated IP addreses. Assume programs can handle numbers and patterns very well. Here's an example of an integer being incremented:

i++;

This increments the current value of i by 1. Let's assume i starts off as 1. After i++, you'll get 2. Check out this painfully simple loop:

for (int i = 1; i < 256; i++)
{
    scanIpAddress("104.16.25." + i);
}

An alternative one-line bash variant would be as follows:

for ip in `seq 1 255`; do scan_thingy_command 192.168.0.$ip --options -oG lol.txt; done

You just scanned 104.16.25.1, and changed i from 0 to 1. As the whole loop continues, it will go from 104.16.25.0 to 104.16.25.255. I don't have time to scan and look right now, however, it's possible that this tiny block doesn't just belong to digitalocean.

To find more targets on DigitalOcean, a programmer may change the numbers even more. For example, introduce another loop that nests the aforementioned loop on the inside, and add j: scanIpAddress("104.16." + j + "." + i);. This will allow them to scan 104.16.1-255.1-255.

From there, they can keep going backwards and nesting for loops until they get the entire internet. There are other, more efficient ways to do this, such as masscan, but this is the most basic way.

Again, this could also be done on the command line with one line:

for oct1 in `seq 1 255`; do for oct2 in `seq 1 255`; do for oct3 in `seq 1 255`; do for oct4 in `seq 1 255`; do scan $oct1.$oct2.$oct3.$oct4 --stuff; done; done; done; done

Other methods

The above example was a really rough example. They may be doing more, their code might be different, and they may be using entirely different methods and/or programs. However, the concept is pretty much the same.

It's also possible that the programs in question are just targeting everyone en masse.

So how can I hide my stuff online?

If it's online, whatever you are hiding, they will find it... or try to find it.

However, depending on your web server, you can try http access controls such as .htaccess. If you're using access controls - again, this depends on your web server - then it's likely that you'll be able to prevent others from viewing/accessing pages.

That won't protect you against non-website login attempts, though. And if you're denying them access to non-existent webpages, they now know you're really online, and can focus their attacks more easily! However, it's still good practice.

Here's an example .htaccess deny for Apache (2.4 and later):

Require ip 192.168.1.100

In the above example, you're denying everyone access to that folder, except your IP address. Keep in mind, 192.168.1.100 is a local IP address. You'll have to replace that with your public IP address.

Also, keep in mind that if your attacker is running a proxy/VPN on your machine, they can still access those pages. If your attacker already has access to the website, they can either edit the .htaccess or remove it. Nothing's 100%.

Just don't put anything online if you aren't ready to be scanned. Everyone has a plan until they get port-scanned in the mouth.


Should I use own constants when using well known hashing algorithms? I understand that it is important to use well known and well tested hashing algorithms instead of designing my own. For such there often are reference implementations available, which initialize the needed constants with manually picked random numbers.

When I use such implementations, does it improve security to pick custom constants? I would expect an attacker to use the most likely values when bruteforcing my hashes, which are those from the reference.

A strong cryptographic hashing algorithm shouldn't be breakable, not even with rainbow tables when using salting. So from a theoretic point, there shouldn't be much of a difference. However, I'm not an expert so I'd like to hear what you say.

No.  The constants are part of what make the hash secure, and the constants in the specifications are what have been used in the cryptographic community's examinations of the hash functions that we currently believe are safe.   It has been shown that intentionally badly chosen constants can break a hash function in subtle but exploitable ways, and coming up with your own constants could inadvertently leave you with a weak hash function as well.


How is public key included in the CSR? I've read a lot of articles on the PKI and digital certificate topics because it's very rare to find one article covers all the aspects; also the topic is confusing at the beginning, (this beautiful question is my last reading: How do certificates work in terms of encryption, hashing, and signing?).
I drew this graph from my understanding point:
https://i.stack.imgur.com/sI7Od.png
I have 2 questions:

I don't understand actually how the public key along with the ciphertext are "packaged" together (it's the best way I could think of to move on to the next step!), at the end the *.csr file is just a plain base64 text, are they encrypted together, so the order of the steps in the drawing is inaccurate?

In order to verify the sender identity (from the web browser for example), it should have a copy of the CSR, but according to my understanding, the certificate only has the hash of it?

Edits:

This video might help to understand the ANS.1 encoding: https://www.youtube.com/watch?v=EccHushRhWs

I corrected the diagram, following Marc's answer here, and here and the specs in IETF/Basic Certificate Fields:

You have a few misconceptions in your diagram.
The most important is that both your encrypt boxes are wrong, they should say sign. Following from that, the CSR sent to the CA includes the various fields (including Subject) and the subject's public key, there is no ciphertext involved just plain data and a signature.
RFC2986: PKCS#10: Certification Request Syntax details the steps to build a CSR:
The process by which a certification request is constructed involves the following steps:

        1. A CertificationRequestInfo value containing a subject
           distinguished name, a subject public key, and optionally a
           set of attributes is constructed by an entity requesting
           certification.

        2. The CertificationRequestInfo value is signed with the subject
           entity's private key.  (See Section 4.2.)

        3. The CertificationRequestInfo value, a signature algorithm
           identifier, and the entity's signature are collected together
           into a CertificationRequest value, defined below.

The subject's (in your case: applicant) public key is included verbatim in the CSR, as is the subject information. This is signed using the subject's public key and everything sent over to the CA.
Not in diagram form, but here are the steps to build the CSR and which data is included:
The correct steps to build the CSR (not in diagram form) are:

Build a CertificationRequestInfo using:

Subject Distinguished Name
Subject Public Key
Other attributes

Obtain Signature by signing the CertificationRequestInfo using Subject Public Key and a particular algorithm Signature Algorithm.
Construct a CSR object by including:

CertificationRequestInfo
Signature
Signature Algorithm

Send this CSR blob to the CA.

Note that the CSR still contains plaintext CertificationRequestInfo and Subject Public Key.
Upon receiving CSR, the CA will more or less do the following:

parse the CSR
verify that the signature matches the fields in the CSR by using the subject's public key
verify that the various fields match its requirements (eg: you can't ask for CN=google.com without proving that you own the domain)
craft a certificate using some fields from the CSR, some from itself
sign the certificate using its (the issuer) private key

The final certificate still contains the subject fields and the subject's public key.
To more specifically answer your two questions:

the subject's public key is one of the fields in the CSR. Nothing is encrypted, just signed.
The subject fields are copied into the final certificate, they are there for any client to see.

You can see list of certificate fields in RFC5280. There is no hash of the CSR because there's no need for it, all relevant information was copied into its own fields of the certificate.


TLS key exchange and certificate subject public key clarification This question is similar to this one, so let me elaborate what I'm struggling with.

I want to get the length/strength of the key used by the server during the key exchange and authentication, i.e. public key size for RSA, prime field size for DHE and so on.

So the way I understand it, the subject's public key and KeyUsage bits in the TLS certificate should be the values I'm looking at.

Now suppose the server has a TLS certificate with a RSA public key. Additionally the following KeyUsage bits are set:

keyEncipherment
digitalSignature

Furthermore let's assume the server only supports the cipher suites

TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256

In the case of the first cipher suite the key provided in the certificate can be used to exchange the bulk encryption key and authenticate the server.

My questions are:

What happens in the case of the second cipher suite?

Can the server return a different certificate chain, where the leaf certificate contains a different key?
Is the RSA key used to only sign the key exchange parameters?

What happens if the keyEncipherment (and/or digitalSignature) bit is not set?

Can I assume that it is always set in leaf certificates?

Is there a rule of thumb how to handle all the different combinations of key exchange and authentication algorithms?

Can the server return a different certificate chain, where the leaf certificate contains a different key?

Given that the first cipher suite requires an RSA public key and the second an ECC public key and that each certificate can contain only one public key the server must return a different certificate. This might or might not lead to different intermediate certificates or even a different root certificate too.

  Is the RSA key used to only sign the key exchange parameters?

In TLS_RSA_WITH_CAMELLIA_128_CBC_SHA the key exchange is RSA too (not only the public key) which means that the client is using the servers pubkey to encrypt (not sign) the premaster secret.

  What happens if the keyEncipherment (and/or digitalSignature) bit is not set?

It might fail, depending on the key exchange required by the cipher. See Which key usages are required by each key exchange method? for the details.

  Is there a rule of thumb how to handle all the different combinations of key exchange and authentication algorithms?

I'm not sure what you expect, but obviously you need to have all the keyUsage in the certificate which are needed for the key exchange methods and the type of the public key must match the algorithms required by the ciphers. Usually client a server do not support all possible combinations anyway but only a subset.


How to ensure identity for server-to-server communication over IP How would one go about ensuring that a server at a given IP address is who it says it is? I need to send confidential data to another server at another IP address. If the server had a public domain it is clear that a SSL certificate would be the right solution, but is this also the case for IP addresses?
I control a specific piece of software running on both servers, where Server1 will send confidential data to Server2. Server1 lives in a cloud I can control, but Server2 can live on any machine around the world as long as it is connected to the internet. At Server1, I have a registry of all Server2s that it can connect to.
I have thought about using a RSA key-pair, where the private key would live on  Server2 and the public key would live in the registry on Server1 alongside the Server2 IP address. Then before sending the confidential data, I could present Server2 with the challenge of decrypting a random string and echoing back the result and check if it matches on Server1. The confidential data will of course also be encrypted with the public key, so an eventual man-in-the-middle attacker spoofing the IP address would get pure nonsense, but I don't like the idea of someone eavesdropping on the communication.
TLDR; How do I make sure that a server at a specific IP address is not a man-in-middle attacker and is in fact a server that can be trusted with confidential data?

Basically you are trying to re-invent certificate based authentication since you only have an IP address and not a domain.
But certificate based authentication can be used without a domain too, for example by having the IP address as the subject of the certificate (if fixed) or by knowing exactly which certificate or public key inside the certificate to expect (certificate pinning, maybe even with a self-signed certificate).
In other words: just use TLS with certificates and don't invent anything new.


Find the destination script of an inbound TCP connection on our shared webserver We have a shared webserver which is being monitored constantly by our ZABBIX agent.
On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address of 109.230.67.50 to our webserver.

We can easily block any connection from and to 109.230.67.50 from IPTABLES but we want to know which of our VIRTUAL HOSTS is receiving this connection or which of our VIRTUAL HOST scripts is making this outgoing connection to that specific IP address.

We are assuming that we have two scenarios. One for INBOUND and one for OUTBOUND

Is there any tool or way to find out exactly what website is receiving the connection or what script on our server is making outgoing connection to that IP?

It is noteworthy it is a CentOS6.5 server and we are using LITESPEED as webserver.

Best Regards

You could try doing this.

Write a cron job that inserts a log entry at a certain start of the window. Monitor the file through some kind of file watching script. And at that point you correlate that with the http logs. The logs are in the common log format.

http://ubuntuforums.org/showthread.php?t=866006

https://pypi.python.org/pypi/watchdog

Alternatively you could try writing a userspace netfilter hook that loads a python interpreter, so you can trigger all this on the fly. Though a kernelspace python might not be such a good idea.

Hope that helps!


Does Renewing SSL certificate change its thumbprint / Fingerprint I would like to know, if renewing a SSL certificate will change my thumbprint? The certificate has expired.

If it can be same then under what conditions can it remain same.

Many thanks in advance.

It depends on what fingerprint you mean.

The public key fingerprint is a hash of the public key only. Since the public key stays the same on a simple renewing, this fingerprint will be the same too.
The certificate fingerprint as shown in the browser is instead a hash of the complete certificate. Since the contents of the certificate will change to reflect the new start and expiration time, this fingerprint will change too.


Detecting attempts to manipulate help desk support If users forget their password, lose their one-time-password tokens, or otherwise become unable to access their accounts, they call the help desk.

In certain circumstances, help desk support is allowed to set a temporary password and suspend multi-factor requirements. This is kept to a minimum, but is unavoidable. As far as we can tell, nothing malicious has been done. Yet.

I was thinking of adding a step for the help desk team to note certain details every time they have to do this (time, account, phone number, ...) and following up with the account holder to make sure everything is OK, but this could leave hours of an attacker having access to a system.

Is there a standard approach to detecting someone maliciously getting a password reset to gain illegitimate access to an account?

Is there a way I could restrict the permissions of any account that had a password reset or multi-factor suspension automatically?

I'm not sure about "standard", but my company does the following:

User forgets password
User calls IT / Help Desk / etc.
IT gathers basic info for making sure the user exists (name, branch, office, etc.)
IT says "Thanks, we'll get right back to you" and hangs up
IT calls back the user on the desk-number / cell-number listed for them in the corporate directory. (odds are if the attack has pwned these already, there's a much bigger problem...)
User picks up, IT vocally confirms their password request, and if it is confirmed, gives the one-time-password. If it is not confirmed, IT forwards the event to our security team.

This way, the IT desk has a much lower chance of being socially engineered into giving passwords orally to someone over the phone, even if they have all of the victims corporate info (barring physical access to their phone).


What programming language is Stuxnet written in? I was listening to a story about Stuxnet and was curious if anyone knew what language it was written in?

Is the source code for Stuxnet available anywhere?

According to some analysis, Stuxnet was written "was written in multiple languages, including C, C++ and other object-oriented languages." Source code is not available, but binaries can be found in the right places. You can try Googling around. I suggest confirming the hash with a reputable site.


Is this machine compromised? (iRedMail server, weird logs) I'm running an iRedMail server on Ubuntu Xenial. Various utilities email me logs and some entries made me suspicious that the machine is hacked.

11 times:
 [2016-11-19 22:20:19 ±3 seconds]  password authentication failed for user "postgres"

I haven't tried to log in as postgres. There are no entries like this from previous days. I don't think PostgreSQL is even supposed to accept connections from the internet.

From 5 days ago:

--ALERT-- [perm023a] /bin/su is setuid to `root'.
--ALERT-- [perm023a] /usr/bin/at is setuid to `daemon'.
--ALERT-- [perm024a] /usr/bin/at is setgid to `daemon'.
--WARN-- [perm001w] The owner of /usr/bin/at should be root (owned by daemon).
--WARN-- [perm002w] The group owner of /usr/bin/at should be root.
--ALERT-- [perm023a] /usr/bin/passwd is setuid to `root'.
--ALERT-- [perm024a] /usr/bin/wall is setgid to `tty'.

I have no idea what that's about.

Today I got this:

NEW: --WARN-- [lin002i] The process `python' is listening on socket 47178 (UDP) on every interface.

I can see 2 python processes, one running under iredapd (related to iRedMail), one under root. According to the "open ports" page on iRedMail's website, there shouldn't be anything like this. Then again, I don't actually see the open port with nmap.

From 6 days ago (noticed it just now):

Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks...
--WARN-- [rootkit004w] Chkrootkit has detected a possible rootkit installation
Possible Linux/Ebury - Operation Windigo installetd

From googling a bit it seems like a false positive, but I'm not sure.

How should I look into this?

In Linux (or other Unices), a setuid program is a program that should run with the rights of the program owner, not the one who called it. For example, if you type ping google.com, ping will likely be run as root to allow receiving ICMP packets. This is not a security hole, as ping doesn't allow shell escapes. All the programs listed have a reason to be setuid, and are nothing to worry about.

su needs to run as root to switch its user id.
at needs to run the command as the user it was asked to run as.
passwd needs to read /etc/shadow, and therefore must be root.
wall needs to write to other people's terminals, and therefore must run as that group.

The chkrootkit warning is more concerning, as well as the Python network port incident. Try scanning the ports locally (nmap localhost via SSH), and see if the port is open, as even if it's bound to all interfaces, the port may still be firewalled from the outside. Try using strace to find out what files the Python process is opening, or better yet, use ps to find out the command line arguments Python received, and just locate the script to see what it does.

I'm not an expert in PostgreSQL, but I assume not allowing login from the Internet means replying "unauthorized" to everyone, therefore it may still show up in logs. Some script kiddies always run scans with default passwords to see which servers they can get into. The fact that it says failed login is a good thing.


Is ProtonMail implemented a mechanism to prevent cookies stealing? I want to check if I can steal my own ProtonMail cookies. I connect to my account, I delete the cookie named AUTH-x12334xxxaazzzrf6567788ddd (cookie name is randomized name). I refresh the page and as expected, I am disconnected. It means that cookie AUTH-xxxx... is a session cookie.
I connect again; I have a new cookie. I copy the name, the content and the path (/api/) of the cookie. I paste this cookie into a new private Firefox window (With F12 and storage --> cookies) but I am not connected.
How is it possible? Has ProtonMail implemented a mechanism to invalidate a cookie after a first usage? It's the first time I have seen such behaviour on a website.

A (specific) : I'm not getting the same results as you are. I can take the session and AUTH cookies, and re-use them in a terminal window to curl for the Conversations JSON payload (among others).
I can even remove the cookie called Session-ID and it still works. I will note that I deleted the header called x-pm-uid and the subsequent request failed. Maybe you've missed that one in your custom user agent?
For others that may be unaware, to achieve this, I opened DevTools (as described in my rather condescending comment 8D and thanks to @mti2935 for F12), performed a login against https://dev.protonmail.com, found an appropriate network event after login was successful, then right-clicked, and selected Copy -> Copy as cURL.
(Note: I tested against dev.protonmail and also mail.protonmail - both worked in parallel, in the same manner.)
A (hypothetical) : Without having put any decent amount of thought into this, my idea to try and force users to continue to use the device they authenticated on would be to cryptographically bind the AUTH session cookie to various properties of the remote user's session and software: this would no doubt look similar to browser fingerprinting techniques.
I would then also re-encrypt the AUTH cookie each time with AEAD. The nonce would encode the number of times the cookie has been used. I would look at deriving this from a short timestamp combined with a pseudo-random seed that becomes an incrementing counter^. The server would need to keep a local copy of the counter and seed, as a session variable, so as to avoid replay and nonce-reuse. Any attempt at regression would invalidate the protocol instance and force another login.
All of this could be side-stepped, of course, however, it could be made to be quite painful to achieve for the average joe... sons and daughters of any dev coding a new UA would curse my name for generations to come... aah, infamy! ... but I digress. It would no doubt thoroughly p*** the users off as well, as they had to keep logging in any time they resized their browser window or idled and then reconnected to the server!
^ (The main reason why you would do it this way is to further frustrate any attempt to lift the AUTH cookie. The server could derive the seed from the authentication and the timestamp using some keyed hash, and then increment this as each iteration of the protocol progresses. Here is an unrelated but quite interesting tangent on visualising un/predictable TCP sequence numbers Zalewski '01.)


Content-Secure-Policy headers I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing such a case and I would like to know:
Are these two headers equivalent?
Will browsers be able to recognize this Content-Secure-Policy?

They are not equivalent.
The W3C Draft for CSP only defines the headers Content-Security-Policy and Content-Security-Policy-Report-Only. No other headers are defined by the document.
That means browsers can choose to include this specific typo, but it is unlikely that browser vendors will attempt to predict all possible ways to misspell Content-Security-Policy in order to improve compatibility.
How to proceed now?
Mark it as a finding, stating that their CSP header is malformed and will likely be ignored by browsers. Fixing it should not be difficult anyways. If the developers state that some arbitrary browser they tested this on still works with it, you can still mention that it's not covered in any draft and is implementation-specific behavior - and thus a risk.


What's the block cipher mode of my PEM certificate? How can I find out the mode block cipher used in a PEM certificate I have?
It's been generated with an intermediate CA that does sha256WithRSAEncryption but I need to find out if it's a GCM or CBC to properly configure some devices.

Certificates only contain public keys for an asymmetric algorithm such as RSA or ECC. They do not contain symmetric keys, which is what operates using block ciphers in the various modes.

Symmetric keys are established during the SSL handshake, and are based on the list of ciphers presented by the server and negotiated with the client at the time the connection is made. The mode of operation is defined as part of each listed cipher.

To assert your clients can use CBC or GCM, you will need to go to your server’s configuration and ensure those algorithms are on the list of valid ciphers. You don’t have to worry about including extra ciphers because your clients will not negotiate to use an algorithm they don’t support.

(You may want to remove algorithms from the list for other reasons. You probably don’t want to support using weak algorithms or very short keys, for example.)


What is the name of this type of attack using transparent encryption? I don't know or remember the name for the following attack and I can't find it on the web.

Using transparent encryption (e.g. TDE) to encrypt data (e.g. databases) over a long period of time, so that also backups are encrypted, and then remove the key to make the data (including backups) unavailable.

Well, that sounds like an Advanced Persistent Threat (APT), but specifically, this would count as Ransomware if you try to sell the key back to the victim, Data Destruction if you don't. WannaCry was an example of both, where the malefactors didn't really keep the keys and anyone who paid was doubly screwed.


How did Anonymous use UTF-16 ASCII to fool PHP escaping? A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were able to "bypass it with with UTF-16 ASCII encoding." What does that mean they did, exactly? How do I protect my site from a similar attack?

First of all "UTF-16 ASCII encoding" is a contradiction, since UTF-16 and ASCII are mutually-exclusive encoding schemes. But presumably he's just referring to using Unicode to bypass filtering mechanisms.

The general principle is this: we often think of characters encoded in ASCII -- "A" is the number 65, "z" is the number 122. But that's not the only character encoding scheme; because the world uses more than just the English alphabet, we need to represent far more characters than that. Hence, Unicode, which has representations for pretty much every character in every language ever written, from Sinhala to Klingon.

Representing all those characters (approx. 1.1 Million possible, not all in use) in a numeric form is a real challenge. You could use 32 bits, but that's a waste of space since 3 of the 4 bytes are usually zero. You could use a variable length, but then you can't do constant-time substring operations. So a number of standards exist, one of which is UTF-16 (which you probably guessed uses 16-bit characters).

Not all programmers are used to the idea of dealing with multiple character sets, even though the underlying framework will often support them. So sometimes filtering rules or precautions will be established using the assumption that characters will be represented in UTF-8 or ASCII, which they usually are.

So the filter looks for a given string, like \" for example, which in ASCII and UTF-8 correspond to the pattern {92,34}. But in UTF-16 it looks different; it's actually {0,92,0,34}, which is just different enough to slip by a filter that wasn't expecting it.

And while the filter doesn't understand UTF-16, the underlying framework does, so the content gets normalized and interpreted just the same as anything else, allowing the query to continue unfiltered.

EDIT TO ADD:
Note that PHP is exceptionally poor at handling character encodings; and if anything, that's understating the issue. PHP by default treats all strings as ASCII, meaning internal functions such as strstr and preg_replace simply assume that all strings are ASCII-encoded. If that sounds dangerously inadequate, that's because it is. But in their defense, remember that PHP predates UTF-16 by about a year, and all this is supposedly fixed in PHP version 6.

In the meantime, the mbstring library was created to address this deficiency, but it's neither widely deployed nor undersood. If you're lucky enough to have this extension available to you, you can use mbstring.overload in your php.ini file to force internal string-processing functions to be replaced with multibyte-aware alternatives. This can also be activated using the php_admin_value directive in your .htaccess files.

Another useful function is mb_internal_encoding, which sets the encoding used internally by PHP to represent strings. By using a unicode-compatible internal encoding, you may alleviate some nastiness. At least one reference I read (but unfortunately can't find now) suggests that by setting the internal encoding to UTF-8, you enable additional processing on inbound strings that normalizes them to a single encoding. On the other hand, at least one other reference suggests that PHP behaves as stupidly as possible in this regard, and simply slurps data down unmodified irrespective of its encoding, and lets you deal with the aftermath. While the former makes more sense, with what I know about PHP, I think the latter is just as likely.

As a final alternative; and I mention this only partly in jest, is to just not use PHP and instead adopt a better-designed architecture. It's hard to come up with a framework this popular that has so many fundamental problems as PHP does. The language, the implementation, the development team, the plugin architecture, the security model -- it really is a shame that PHP is as widely deployed as it is. But this is, of course, just an opinion.


Is it a security issue that Nginx returns server name in errors? I have recently sat up an Nginx in a way that makes it not return a Server header and hide the version information from the error pages.

The error page looks like that now (and anyone can provoke it by sending wrong HTTP request very easily):

The question is really if it is enough? Or to be more precise:

Is disclosing the information that one runs Nginx is an issue?
If it is how can it be hidden, since it's probably not that hard even without this obvious html to figure out by sending specially crafted requests and responses, probably even som version range can be unveiled by this.

No, because the information being leaked is so minimal that an attacker gains no meaningful information from it. If you look at today's server landscape, nginx is currently the most popular web server there is. So even if an attacker would not know for sure what web server you use, they could simply feel lucky and try some nginx-specific exploits.

The real issue would be if you would run an outdated nginx version with known vulnerabilities.

I'd like to clarify some points regarding information disclosure and security through obscurity. Revealing the version information is in itself no vulnerability. It just makes it easier for the attacker, as they don't blindly have to try exploits until one of them works.

If you believe that hiding version information is security through obscurity, then you are in a way right. If you run a vulnerable web application, hiding the version will not protect you more. But also, hiding the version will make it more time-consuming for the attacker to actually exploit you, which means you do have some security benefit.

If you believe that hiding the version information is best-practice, then you are in a way right. There is no benefit for you in revealing that information, but it's also not a big deal either. If your web server is configured to display version information, then don't freak out. As long as your server is safe, you will be fine.


Would this be secure enough? (ZF3 & Doctrine module using halite) Recently PHP7.2 was released with the Sodium library included for encryption.
Of course there were already encryption modules available, even working with Zend Framework 2 or Symfony. We were in need of an implementation for Zend Framework 3 and not wanting to rely on our own encryption method ideas, we created a ZF3 & Doctrine 2 module that uses paragonie's encryption implementation.
The purpose, at the moment, is to be able to automatically encrypt and decrypt on read/write of certain properties, detected via a listener hooked into the Doctrine ORM.
How we've set it up is the following:
Default

Receive a string (do not encrypt null)
Add in-code (config) salt to string
Use in-code (config) private key for encryption

Obviously, not the strongest method of extending a string, but this is to make sure we can encrypt data marked with a tag using default settings. Data such as a street name.
Options

Receive a string (do not encrypt null)
Add generated 32 char salt and/or pepper before (and after) string (stored in separate db table, though records linked via foreign key)
Add in-code (config) salt to string
Use in-code (config) private key for encryption

This is the module we, actually just me, created. The actual implementation of the encryption/decryption starts about here.

processFields function - decides whether to encrypt/decrypt, passes values and, on decrypt, tries a type cast (to support value types) to return original value type
encrypt function - decides if salt and/or pepper need to be added based upon passed options. Then calls "encrypt" on adapter.
decrypt function - decides if salt and/or pepper were added based upon passed options. Removes them from string to return original string to encrypt.
Halite adapter - This is the default encryption/decryption adapter

Why am I asking?
Because I hope I've understood most everything right and thus created something awesome. However, as I'm not cryptology expert and we have no such person in-house, I thought to ask here, hoping to gain some feedback.
The code is provided as is and open source. It's extendable and re-usable so others can use the same service but can use their own encryption adapter. However, I wouldn't want them using something sub-par.

What you did right

You're using a library

You chose to use a library to do the encryption for you. Good job! Somehow people still screw this up. Don't be a Dave, never roll your own crypto (unless you really, really understand what you're doing).

What you did wrong

You're misusing terminology

A salt is used when hashing passwords. It must be unique per password, and thus can't be located in a config. A pepper is similar to a salt, but it's the same for each password, and so it can be located in a config. Neither of these has anything to do with encryption.

You're trying to "improve" the encryption without understanding it

Adding a unique value to each string is unnecessary because (good) encryption algorithms use initialization vectors or nonces to randomize their output when encrypting duplicate data. Halite uses XSalsa20 MACed with a keyed BLAKE2b hash. Don't try to make it better, you'll just add complexity to your implementation for no reason.

There is a legitimate reason to pad data before encrypting, and that is to hide the length of the data. Some encryption algorithms allow an attacker to determine the length of the plaintext rounded to a number of bytes, and others allow to determine the exact length of the plaintext. In this case however you should pad all data to the same length (or a multiple of the same length), and the padding needn't be random.


Is it safe to insert a USB drive of unknown origin? I found a USB drive and I would like to check out the contents to see if there is any information that could allow me to identify and return to the owner.

However, I'm unsure of what is on the drive. Is it safe for me to just insert it into my computer? Is there any possibility it might transmit malware etc.?

Besides Hardware attacks that can destroy your computer like USB Killer
There are also attacks that just use the USB device (like badUSB)

and thats all before you have seen any possible file. The files themselves could be infected. There is simply no way to know if its safe from a distance.


Best way for a hacker to hide a file on Linux? Suppose a hacker obtains a shell on my Linux host and wants to hide a file.  What's the best way for him to do this?  You may assume unprivileged or root access.

My thoughts are

Use a .file filename (pretty easy to find these of course)
Write a file to some obscure directory (might be found by tripwire and the like?)
Append to a log file (so that it's less suspicious that the file is growing)
Use some kind of stego (I have no idea how to do this)
Write to a raw portion of the disk (I don't know how to do this either)

I'm sure you security professionals know the common tricks?!

If I have root on a system and really want to hide a file, the obvious answer is a rootkit, which can hide any files I want from almost all detection, by hooking filesystem reads etc. Rootkits are incredibly hard to find in a normal working environment, as you can't trust anything the OS reports. If you have Tripwire on a system, working correctly and monitoring the entire filesystem, the installation of a rootkit should be detected - however if an attacker can get root and has access to the Tripwire systems, then all bets are off.

What is much more likely in practice, however, is for files to be hidden in the depths of the filesystem, perhaps under . directories so they don't show to a normal ls, or perhaps as innocuously named files. The good thing is that more linux admins seem to know what files should exist than windows admins, probably more down to the fact that windows is managed typically through a gui, however with greater usage of Powershell this is changing.

Writing files to an unused portion of a disk can work, however in an enterprise environment you tend to find disks fully utilised, so an attacker would first need to either alter a partition or find some way to hide the use of a section of existing filesystem. It happens, but not as often as you may think.

Steganography is not used very much. Malicious executables are found in innocuous looking files, but usually as a vector, not in storage.

In summary, from a defenders perspective, protect root, patch regularly and use Tripwire or an equivalent.


Information collected by Windows 10 at maximum privacy configuration I am thinking about installing Windows 10 on a machine.  However I am concerned about the information that it actually collects.  I have searched a bit but haven't been able to find what information Windows 10 actually transmits to Microsoft or their partners.

I am mainly interested in Windows 10 Professional (I know Windows 10 Enterprise gives more control) and information whose collection cannot be easily disabled,
either by options or through disabling of services.

I have seen How does Windows 10 allow Microsoft to spy on you?. It does not answer my question, I am specifically interested in what data is actually collected; not what the documents say can be collected, and and I am only concerned about those which cannot be turned off easily through privacy settings or disabling of services. E.g. although telemetry and error reporting are part of previous versions of Windows they can be easily turned off by disabling the corresponding services without causing any problems.

Edit: this answer includes information beyond what the question asks, mainly about settings less then the maximum. I have made it more clear by making the key paragraph start with a bold section.

Based on my observations of traffic from Windows 10, Microsoft's privacy policy and several articles from Microsoft and Others(see below) I think that the situation is far less bleak then the other answer indicates. You can turn almost all communication off if you like, and based on both my and others observations they abide by your decisions*.

First and foremost default Windows 10 has a very similar privacy policy to IOs, OSX and Android (1,2,3). This is becoming more common as operating systems become more cloud integrated. In order to use a Microsoft account for logons, syncing between devices, email or file storage the operating systems has to communicate with Microsoft servers.

Once you have enabled all of the privacy settings* the computer does still communicate with Microsoft (4). However when asked Microsoft responded with the following:

  "As part of delivering Windows 10 as a service, updates may be delivered to provide ongoing new features to Bing search, such as new visual layouts, styles and search code. No query or search usage data is sent to Microsoft, in accordance with the customer's chosen privacy settings. This also applies to searching offline for items such as apps, files and settings on the device."

Which was consistent with the data that was being transmitted (4).

If you give Outlook or OneDrive permission they will access and upload your files. To quote:

  "We collect content of your files and communications when necessary to provide you with the services you use." (3)

and

  "Examples of this data include: the content of your documents, photos, music or video you upload to a Microsoft service such as OneDrive, as well as the content of your communications sent or received using Microsoft services such Outlook.com or Skype" (3)

But access to this data is REQUIRED in order for those services to function. Also in contrast to many other services Microsoft (5):

  "Unlike some other platforms, no matter what privacy options you choose, neither Windows 10 nor any other Microsoft software scans the content of your email or other communications, or your files, in order to deliver targeted advertising to you."

There are still a few gotchas. If you use default settings you will leak a lot of private information, including keystrokes (see privacy policy section on Input Personalization). Also if you use Bitlocker and OneDrive you recovery key is backed up by default. Finally there have been reports of encryption keys be sent in the Full (level set by user) error reports.

A lot of people have been really beating on Windows 10 for privacy reasons. I think that this comes from two separate areas. 1. The privacy policy for the Beta and the insider version is very bad. And it did include unlimited access to local files. 2. Microsoft had never done things like this before (outside of certain issues with privacy found in Windows 8 and 8.1). However the amount of issues in 8 was less then 10. We had expected this from Google, not from Microsoft.

Will Microsoft help investigations as required by law? Yes they will. Has Windows 10, by default, traded privacy for convenience and features? Yes it has. But do they continue to invade your privacy when told not to? It appears that they do not.

*There have been reports of privacy settings being changed by bugs fairly early on in Windows 10's life cycle. Personally I believe that this was an accident as I have never written bug free software.

http://www.google.com/intl/en/policies/privacy/
http://images.apple.com/legal/sla/docs/OSX10103.pdf
https://privacy.microsoft.com/en-us/privacystatement/
http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/
https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10/

Also please read this excellent answer: https://security.stackexchange.com/a/96727/97432.

And this one: https://security.stackexchange.com/a/129401/97432.

Disclaimer: I do not work for Microsoft or any of their partner companies. All of this is based on my own observations and the work of others. As Windows 10 changes these observations may become invalid. I compiled these on July 7, 2016. Future readers take these with a grain of salt.


How identifiable is a caricature made from a photo? I accept that to some degree this will depend on the software/exact processes used, but I'd like a general idea as to how "risky" it is, and get a better understanding of how biometrics simplifies matching elements.

I wish to maintain a low profile online, but there are communities where it would be useful for people to have a picture if me. My concern is that photo being used to identify me in "real" photos to track me and link my online profile with meat space friends via facial recognition.

I postulate that using a caricature would provide some protection.

Am I correct in assuming that a hand drawn caricature will not leave meaningful markers for facial recognition software, even if they are highly recogniseable to people who subsequently meet me?  How much more recogniseable would a photo turned into a caricature digitally be?

Are there key size guidelines to consider for ? (I assume a 32x32 pixel avatar will convey less identifiable info then a larger pic, but is there any "safe" size for an avatar/low res photo - or - I guess another way to ask is how many pixels of a face are required for AI software to get a statistically useful - for unique identification purposes ?

Similarly, can I assume that 16 colors will yield up to 4 times as much data as black and white - and is there much difference between 256 and 64k color?

Caricatures and facial recognition software:

Your assumption that "a hand drawn caricature will not leave meaningful markers for facial recognition software" is being studied. See these results from Abaci and Akgul in "Matching facial attributes in caricature-photograph pairs":

  Our facial attribute based matching approach defines 32 qualitative features (i.e., gender, hair color, face shape, etc.) for identifying a subject. Then these qualitative features are used to match a caricature to a photograph. In our experiments, we use genetic algorithms and achieve 69% recognition rate at 10% false acceptance rate.

I discovered a second study by Klare, Bucak, and Jain, titled "Towards Automated Caricature Recognition", and they found:

  Using only qualitative features, the matching accuracy (at FAR=10.0%) was improved to nearly 57% (using Logistic Regression+NNMKL+SVM). While the image descriptor-based method performed poorly with respect to the qualitative features, it proved valuable when added to the fusion process: Logistic Regression+NNMKL+SVM+LBP with LDA had an accuracy of 61.9%.

Note: I wouldn't be able to explain this because I myself don't understand how they got their results, but I've shared their findings since they are authority figures.

So, I suppose if someone really wanted to find out who you were, and they had the wherewithal, and a bit of luck, they could conceivably find your identity based on an uploaded caricature, but it seems improbable. Moreover, even if they had the desire to, they'd have to jump through some challenging hoops, unless you crossed paths with a researcher in the area.

Caricatures and human recognition:

I'll add just a bit on your comment that caricatures will make you easier to identify. I was surprised to read this bit of research:

  Although caricatures are often gross distortions of faces, they frequently appear to be super-portraits capable of eliciting recognition better than veridical depictions. This may occur because faces are encoded as distinctive feature deviations from a prototype. The exaggeration of these deviations in a caricature may enhance recognition because it emphasizes the features of the face that are encoded.

Crazy, huh?


Download Torrents on University network without detection I want to download files using Bit-torrent, but I have heard that they can detect when someone is downloading torrents.

How can they detect this? And are there any precautions I can do to prevent their further investigations?

It depends on who "they" are.

If you're torrenting, the university can use commercial traffic inspection tools to identify p2p protocols.  The tools are signature based, and the signatures are proprietary, so the exact methods used and methods to circumvent them vary.

If you're torrenting illegally distributed copyrighted content, then the rights holders will be able to participate in the Torrent, identify the IP, date and time of the connection.

If you want to evade the university, you can use a VPN service.  This will encrypt the content and evade most modern tools.  It is still theoretically possible that the university can detect you though.   They can e.g., perform traffic analysis on your VPN connection.  E.g., they can tell that you're connected to a VPN service, and that there are gigabytes of data being streamed to and from your systems in torrent-sized chunks.  Knowing how universities operate, the onus would be on you to explain what you're doing.

If you opt for the VPN, the VPN provder would be identified by rights holders and might protect you from further investigation.  The rights holder could however force the VPN provider to reveal your identity.

To the best of my knowledge, no VPN provder has been forced to reveal the identity of an illegal content torrenter... yet.


Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications I'm working on a web application where the main purpose/functionality is notifying users when there have been changes to regulations in a particular industry.

The application is subscription based, i.e. you have to pay for an account and using it is a choice. Any email addresses for accounts we hold are active users and we do not harvest this data from anywhere. So all email addresses we have are for real users who actively use the software.

We are designing a setup wizard which allows users to set preferences on what information they receive.

One of the settings is yes or no as to whether the application should send notifications via email. This raised debate as to what the default setting should be.

The argument for "no" was that users should explicitly give their permission to receive automated emails and therefore this was the correct default.

The argument for "yes" was that the users have implied consent because they are using an application whose sole purpose is to inform them about changes, and email delivery is the primary way of doing this.

The application is still usable if the user doesn't receive emails because the data which is present in the emails is visible inside a web-based interface. The disadvantage of using the application in this way is that - unless the user logs in - they will not necessarily be aware of any updates. Therefore defaulting email opt-in is preferable.

The pre-sale marketing material for the application makes it clear that email delivery is the main delivery method for the information and getting it directly to your inbox is an advantage of using the system.

What are people's thoughts on this? We are based in the UK but deal with customers worldwide. Is this covered or referred to by GDPR?

You have an argument for yes as the default, but you will have to go to the ICO/court if someone wants to challenge that. As the case law for GDPR is very thin on the ground, you are potentially the test case, which is a bad place to be.

If it goes to court, it will cost time and money. Even if it doesn't get to court, you will be paying lawers so it will cost time and money.

Personally I would choose option 3, not have a default and require the user to select yes or no.

Edit:

To clarify the following line gives a solid answer for why you would be paying lawers if someone challenged this is:

  The application is still usable if the user doesn't receive emails because the data which is present in the emails is visible inside a web-based interface

The argument is that you can sign up for the service and not want emails. This implies that signing up is not explicit consent.


Am I allowed to DDoS my own server? I have bought a server and used it to host some game servers or my website.
Now I am visiting a computer security course and I would like to test some of the presented attacks.

Am I allowed to, for example, DDoS my own server, or could I damage something?
I don't want that other servers are damaged by my attack.

If the server's on your own network, feel free.  But if it's hosted somewhere, then your DDOS could impact other people using the same network path or other infrastructure.  You could ask permission, but they'll almost certainly say no - SPs are generally comfortable with pentesting but nobody fools around with DDOS testing.


Is my session schema vulnerable to session fixation? I have a PHP application, where two session IDs are being used.

I will use foo and bar as example for those session IDs.

The foo session ID is being generated at the login page.
The bar session ID is being generated after a successful login.

The foo session ID is fixed, meaning it's not changing before and after a successful login. The bar session ID changes after every login and logout. The session is deleted after logging out.

If any of the session IDs (either foo or bar) is deleted from the browser, the application redirects the user to the login page.

Is this application vulnerable to session fixation or not?

If your CMS is creating the session, don't create another one. If you use session_start() somewhere on your custom code, you will use the same session your CMS created.

Don't create another another wheel to replace the professional wheel you already have.


Is it always safe to type [i.e. run Get-Content] on a file in PowerShell? Supposedly an attacker sends me a malicious readme.txt and I'm going to open PowerShell and run type readme.txt.

Can the attacker via any sort of control char sequences or using any other technique cause a non-expected behavior this way?

No, but if its a binary disguised as a text file, you'll just see a bunch of jibberish in the output.

Personally, I'd check the file type prior to running any commands with the file. On *nix machines you can use the file {filename} command. For Windows see this post on SuperUser.


What are the penal consequences for a passive or active scan on a WebApp with no damage? Let's say I only trust web applications that I tested myself with some penetration tests. What penal consequences exist for doing a passive scan (eg. building a map of a website site) or an active scan for vulnerabilities (with SQLMap or ZAProxy for instance) without asking its owner and damaging nothing ? Could the owner of the website charge me with nothing more than evidences that I wanted to find vulnerabilities ? Can I be fined when no damage has been done ? What I found online is very specific to each case and despite the usual "Always ask the owner of the website for its approval before testing", I found no cases of people charged for scanning an application.

Sepcifically since you mentionned France: it is illegal to access, modify, maintain your presence in, or delete information in systems you don't have the authorisation to do so.

Furthermore, the attempt to do such an act is punishable as if you did it (no matter how successful it was).

You can expect something like : 150k euros, 5 years in prison (as mentioned on legifrance)

In general, the rule applies differently depending on the country you're attacking from and the country you're attacking in, you could be held liable under multiple jurisdictions or jurisdictions different from you're own. Ask an expert.

As to the last part of your post, having no one convicted of something does not mean it's legal, or that no one will be convicted. In this case, it might just be too costly, or difficult to prosecute, but it could change.


Can a Trojan hide itself, so its activity doesn't appear in task manager process? Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task manager, you won't see any suspicious activity?

If yes, how can it do that?  What techniques can be used to hide in this way?

Yes. There are a number of ways:

Directly patch Task Manager's process at runtime so that its enumeration code skips over your process.
Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread).
Hook the Process32First / Process32Next functions in every process (incl. task manager) to "skip" your process when the enumeration is performed.
Hook CreateToolhelp32Snapshot so that the mapped section's memory (see here for how snapshots work) is modified ahead of time, so that Process32First / Process32Next end up reading from fake data.
Hook ntdll.dll!NtQuerySystemInformation and, if SystemProcessInformation is passed, patch the results to skip over your process. This is a lower level hook than the above calls.
Load a kernel-mode driver which hooks the kernel-mode handler for SystemProcessInformation queries. I don't know the real name for this in Windows (it's not documented) but essentially there's a table of handlers which NtQuerySystemInformation looks through for this purpose, and you just have to hook the right one.  Here's the ReactOS implementation of the actual handler. In this you'd just mess with the returned structs so that your process isn't shown.
Hook the SSDT to catch  the transition between user-mode and kernel-mode for when various process enumeration APIs are called.
Use Direct Kernel Object Manipulation (DKOM) to modify the EPROCESS structures in memory so that your process is hidden from the kernel entirely. The kernel maintains a circularly linked list of structures which represent all running processes, with FLink and BLink fields as forward and backward pointers respectively. By manipulating those pointers to jump over your process, then manipulating your process' pointers to go back to themselves, the kernel will skip over your process during enumeration. This is a common rootkit technique.


Is it possible to use Greasemonkey to hack a website? Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I protect my site secure against it?

GreaseMonkey (or Tampermonkey for Chrome) is a browser addon that allows you to inject custom JavaScript code in the browser on the client side. You have little to no control over it.

The good news is that none of these changes will affect the contents on the server side, or the contents for other users. So if you rely on the server for your validation/verification/signing in/e.t.c., then you have nothing to worry about. If, however, you rely on the client-side code to provide input validation and other kinds of restrictions, then you have deeper problems than GreaseMonkey. Almost all modern browsers contain features to allow the modification of client-side contents, they're mostly called Developer Tools.

My advice to you is to get a competent individual to assess the security situation of your website, and to help you protect it from future attacks.


What kind of wifi network does not have any protection and yet it's not an open network? When I browse thru the list of wifi networks in my neighbour, I see a couple of unprotected networks (with no wpa/wpa2 or wep protection). When I try to connect, I cannot. These networks belong to Wifi ISPs and you have to buy their service to be able to connect via their APs.

So how do we call such Wifi APs? They're neither protected nor open.

How do such networks protect unwanted users to connect to them? Is there some host or similar file on user's comp which allows them to connect?

Thanks anyone for taking time to clarify these things to me.

EDIT

You cannot actually even connect to this network. It looks like it's open and I can see it says "unprotected", but yet I cannot connect to it.

They could be using MAC-based filtering which only permits specific network cards to access them.  The AP has to know the MAC address of each network card permitted to access it.  That would be a little unusual for ISPs, but certainly could happen.

Such protection is trivially defeated by forging the MAC address of the client.  MAC addresses have traditionally been meant to be hard-wired and unique, and just as traditionally been so easily fungible as to defeat any security method based on it.  Nonetheless, vendors still include it as an option.


SSL VPN network placement Where should I place an SSL VPN appliance like OpenVPN Access Server on my network to enable users to secure remote access to corporate resources?

Knowing that most UTM (Unified Threat Management) or NGFW(Next Generation Firewall) may include SSL VPN capability, I'd say it will make sense to add place you appliance behind the firewall... That way, your firewall rules will be enforced before a user can authenticate via your SSL VPN...

SSL VPN will encrypt and create a tunnel for your data...so the firewall won't inspect layer 7 information : see my previous question here -> Could encryption become a security breach?

Therefore I believe you want the firewall to do it's job before it allows encrypted traffic of you SSL VPN thrafic (I believe your firewall will know you allpliance right ?)....


What is a similar security standard to ISO 27001 with more focus on IT security? *Edit - Replies so far are re-stating what ISO 27K is and is not. We are aware of this, however the perception of ISO 27K is different. We do not have infosec professionals so we just want to know what other options are out there regardless of subjective opinion.

Example: (UK) Cyber Essentials Scheme. This requires implementing basic essential IT security controls, self-assessment and external review.

A similar question has been asked but without satisfactory reply. Full background:

We are a business of around 100 people in a few global locations.
We have been externally certified for ISO 27001, we have only excluded one item from the statement of applicability;
We do not have a dedicated Information Security professional.

We have become quite dissatisfied with the ISO 27K Standard for the following reasons:

Assessors are too focused on procedure and documentation rather than actual security
At no point during any external visits has any assessor even asked about actual web and IT security
Infractions in documentation generate far too much paperwork in addition to fixing any issues.
Inconsistency in approach by assessors in different countries
The amount of time required for maintaining the standard detracts from working on actual cyber security that is not required by the standard such as vulnerability scanning, port scanning, encryption etc etc.

We are mainly a UK/US business. We would like a more IT focused security standard that is recognised in those locations. The only real driver for our ISO standard is its appeal and recognition to our customers. All opinions welcome

ISO27k is about the 'management of security', not about security itself. Auditors will be concerned by what you are doing to respond to the risks you have identified, if you are really doing what you're saying, what do you do when something deviates from what has been specified or to new risks, and how do you evaluate the efficiency of your measures.

So basically, they don't care what you are doing to stop ddos attacks (if this is one the risks you're exposed to), as long as you are doing something, and it is deemed efficient enough by a correct indicator.

ISO27k will never say 'this entity is secured', but 'this entity does manage its security well'.

You're not really looking for alternatives to ISO27k, but for something entirely different. There are plenty of standards you can comply to depending on what your business is.


SSL Breach - Does the latest BEAST vulnerability mean SSL Issuers now have to worry about integrity? Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that there has never been a single payout due to the fact the certificates limit the warranty to just data transmitted en-route rather than post-transmission (which is very rare because hackers usually target storage databases to get more data in one shot).

Still, now that a vulnerability has been discovered in TLS 1.0 which allows the encryption to be broken for data stored in cookies (I got the news from this article:  http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/)  does that mean SSL Issuers are responsible for data stolen since the attack goes straight to the encrypted data while transmitted.

Also, is it possible for the CA's to force clients to obtain new certificates which use TLS 1.1 or another proven technology, in order to reduce the risk (or allow them to continue using 1.0 without the guarantee), or is that not feasible since I'm sure many SSL owners use shared hosting or outsource management so they have little voice in the process.

There are two parts to SSL/TLS: ensuring the confidentiality and the integrity of the communication, and knowing who each participant is. Most of the issues related to SSL have to do with the second part, which is rather more complicated. You can read some explanations on this topic in the question when is it safe to click through an SSL warning message?

Consider what would happen if you took certificate authorities out of the picture. Certificate authorities provide a public-key infrastructure. Without them, servers would all have self-signed certificates, and each client would have to figure out whether the server is the one they intended to talk to somehow (for example, by having been given the server's public key over some trusted medium such as meeting with the server administrator in person).

The SSL flaw uncovered in the BEAST exploit concerns the first part of SSL, the one that is unrelated to the PKI. It concerns the way the cryptographic primitives are used to build a secure channel, not the way for the two ends of the channel to authenticate each other. Therefore certificate authorities are cannot be responsible for the flaw. It is not their fault if any keys are discovered through this attack (though as I understand it the attack allows the attacker to decrypt the content of one transmission, but not recover the server the server's private key anyway).

This doesn't mean that there isn't a CA somewhere that has contracted to pay a hefty sum if such a vulnerability in SSL was found. But it would not be paying for something that it was responsible for, it would be acting as an insurer. For that matter, there may well be professional insurers who end up reimbursing damages caused by this vulnerability — but I don't think any CA is in this market.


Integrity check against package repository? I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.

From time to time I want to boot from a clean boot CD and check if the system has been compromised.

For that reason, I want to check if any packages / binaries have been modified, check the bootloader, check for rootkits.

Let's suppose I booted from a clean boot CD and mounted the hdd filesystem.

How can I get list of all sha256 hash sums of all installed binaries and configuration files and check them against the versions from Debian repository?

I have looked into intrusion detection systems (debsums,) Afick, AIDE, FCheck, Integrit, Osiris, OSSEC, Samhain, Tripwire, but they all have in common, that they want to create a known-good database before auditing. This doesn't scale very well, because updates are pretty frequent, which render that known-good database less useful. Re-creating the known-good database after updating isn't very safe either - let's say apt-get had a bug and installed a malicious package, then the checksum of that malicious package would end up in the known-good database.

I think the real solution is checking against the distribution's package repository. How can I do that?

Have a look at SecureApt they check updates on checksums and also on pgp keys you give your trust to.


Websocket connection spoofing I have a websocket server, where client credentials get validated upon connecting and are never bothered again, since connections are stored in memory. I was wondering, a TCP connection is basically identified by local address:port and remote address:port, if we suppose that an attacker can find out a victim's IP address and the exact local port they are connected from, and we also suppose that the attacker is aware of the software architecture of the server and knows exactly what information he needs to send where, would they be able to spoof and send packets in a way such that the server would think they are legitimately coming from the victim's machine?

Yes.
If the connection isn't encrypted (for example TLS) and the attacker is able to spoof his IP (which isnt hard) in this scenario he can even make a Man in The Middle Attack by putting himself in a position where he can receive the packages from the Client, analyze them and pass them to the Server.


Meterpreter and OpenVPN During a meterpreter session, is it possible to deliver a payload that creates a connection request to a local OpenVPN connection? For example:

I have a payload. Whenever that payload runs on the remote system and calls back to me, it's over an OpenVPN connection using the payload that I've generated. The payload has a .ovpn file which runs on payload delivery, and I then have a reverse shell with the OpenVPN connection.

TL;DR - Meterpreter will deliver it, but you have to write it first.

You can deliver a payload that includes a .ovpn file and script to run it. However, you will have to write it yourself. Meterpreter has plenty of great payloads that require little or no changes to (like linux_86/generic_reverse_tcp_shell and several variations, where you only change LHOST and LPORT). However, there is not one to deliver an .ovpn. You can create that payload yourself using a combination of a stager and a payload, or multi-step payload.


Is my SSL connection encrypted if the certificate isn't trusted? In chrome, when I visit a site that is served using SSL with an untrusted certificate, the privacy warning kicks in and prevents me from connecting unless I really want to. In this case, with a self-signed certificate, is my connection still encrypted (or what other dangers arise from this scenario)?

SSL consists of two major parts:

the encryption of the data
the validation that you are actually talking to the expected server

If you get the warning about an untrusted certificate than the encryption will still work, but you cannot be sure that you are talking to the expected server. This means a man in the middle attack might be possible where an active attacker will decrypt, sniff, and re-encrypt the traffic. That is instead of this:

     Browser <----------- encrypted -----------------------> Bank

you get this:

     Browser <-- encrypted --> Attacker <--- encrypted ----> Bank

In this case the attacker can sniff all data (passwords etc) and even modify the data and the client will not notice it. The connections are still encrypted, but not end-to-end (browser-to-server) but browser-to-attacker and again attacker-to-server.

Usually you should not override the warning by the browser because chances are high that there is a man in the middle attack going on. Only in the case where you know that the certificate is the expected one (verify fingerprint, not just the subject of the certificate) you can override the warning.

Note that there are cases of legal man in the middle attacks, i.e. SSL interception done by antivirus proxies or by middleboxes (firewalls) so that these can analyse the encrypted traffic. In this case your computer is either automatically configured to trust these certificates or you need to explicitly import the proxy-CA which signed the new certificates. If you are having such kind of problem while using your own computer inside the company please ask the network administrator how you should proceed and don't simply accept the certificates.


Why the servers stores hashed password instead of relaying on private/public key I understand why the SSL client certificates are not widely used (need to install them, problems with shared machines etc.). On the other hand when I log into the server the password is send to it and it is in server's memory. Also if the server certificate leaked and there was DNS spoofing there is little protection against getting the password by MITM. While attacks of such type are rare they still happens (see diginotar).

I came out with very simple scheme - because it is not widely used I assume that something is wrong with it:

On password set up:

Random salt is generated (by client, server or both)
The client gets salt and password and seeds the previously agreed cryptographically secure PRNG
The public key and salt is stored on server

On login:

Salt is send to client
Client regenerates the private key
The authentication relays on challenge/response between server

Is there any disadvantage of such scheme (except the additional computational/transfer overhead)?

If you are talking specifically about web applications (as per the tag) then even with client-side password hashing/encryption you are still just as vulnerable to man-in-the-middle as with sending a direct password.

This is because a man-in-the-middle attack can sabotage the client-side script on its way from the server to the client, to make it do something other than the desired crypto-protected passing of the password. The end user would never notice (as it would take a JavaScript debugging expert to determine that this had happened).

To defend against MitM you would have to have trusted code built into the browser (or an add-on) instead of server-sourced JavaScript. This might be, for example, HTTP Digest Authentication.

However in general if you have MitM against the application then you've pretty much lost already. Even with a secure digest-style auth scheme, you'd still be able to imitate any action the user could take in the application, nobble the password at setting/changing time, or just change the app's interface to prompt for the password in-page.

This is why the bulk of effort has been put into keeping the whole channel secure (with SSL) rather than password protection specifically. Not that SSL's perfect, obviously...


Certificates for localhost, MITM Attack Excerpt from https://letsencrypt.org/docs/certificates-for-localhost/

You might be tempted to work around these limitations by setting up a domain name in the global DNS that happens to resolve to 127.0.0.1 (for instance, localhost.example.com), getting a certificate for that domain name, shipping that certificate and corresponding private key with your native app, and telling your web app to communicate with https://localhost.example.com:8000/ instead of http://127.0.0.1:8000/. Don’t do this. It will put your users at risk, and your certificate may get revoked.
By introducing a domain name instead of an IP address, you make it possible for an attacker to Man in the Middle (MitM) the DNS lookup and inject a response that points to a different IP address. The attacker can then pretend to be the local app and send fake responses back to the web app, which may compromise your account on the web app side, depending on how it is designed.

Can some one explain how this MITM attack will be carried out? Assuming I own the TLD example.com. I also add an HOSTS redirect for localhost.example.com to 127.0.0.1 when the native app is installed.

If you add a HOSTS entry for localhost.example.com and the certificate covers only localhost.example.com then no MITM attack within the network against your system is possible since your system will use the entry from HOSTS and not use DNS to lookup the domain.

But, if the application which includes this certificate is not only used by you but by others then everybody must also add such HOSTS entry in order to be safe. You probably cannot expect this.

Additionally an attacker can extract certificate and private key from the application and in some cases use it against users which don't even run the application. For example if login.example.com sets a session cookie with scope of domain *.example.com then this session cookie can also be read when accessing localhost.example.com - and a successful MITM of this domain is possible using the extracted certificate and private key.


Will virus downloaded to guest OS affect Host OS? Possible Duplicate:
  How secure are virtual machines really? False sense of security?

If I download a file in Guest Windows XP machine in Vmware Workstation, which is a virus. Can it affect the Host OS ?

I understand that the work on Guest OS doesnt affect the Host, but I was amazed when Kaspersky detected threat when I was trying to download a virus in Guest OS. So it made me think that may be Kaspersky is scanning packets and it detected virus in it.

So, can a virus affect the host OS when downloaded to Guest OS ?

I'm using NAT in vmware.

If the VM connected with a bridged connection it could possibly spread via the local area
network if the virus has any autospread features or exploits that could target your host OS.

If you had shared folders with the guest os you could also be infected.

Your best bet is running the VM in an isolated network.


sending email through hidden .onionservice for email assuming all emails sent to the clearnet from a specific email provider are tracked by country e.g. all emails from protonmail will have a link to switzerland and the NSA AI will scan and read them cause they are in the clearnet. If protonmail uses a .onion address, does the email exit protonmail servers into the clearnet through a tor exit node? Can the NSA AI track it?

You should slice it into two parts:

Client to server communication

If you want to access the server to send or receive an email, you can use tor and access the hidden service. This has the advantage that an attacker under normal circumstances is unable to see that you have connected with your IP to the server.

Server to server communication

If the server sends an email to another server it uses the clearnet under normal circumstances. The clearnet is used to avoid these emails being marked as spam at the receiving server because almost every tor exit node is on spam blacklists.

Summary

Protonmail mails are not send through an exit node. Because of that the NSA might track that the mail is sent from switzerland.

Small Overview

Client_A ---(tor)---> ProtonMail ------> MailProvider_B -----> Client_B

Legend:

---(tor)-->: Connection via tor

---------->: Clearnet connection, which hopefully uses TLS

Encrypted & meta-data-free alternatives

The following alternatives are relatively new and might have vulnerabilities:

BitMessage(Alpha)
Tox
ZeroNet Mail(https://zeronet.readthedocs.io/en/latest/using_zeronet/sample_sites/#zeromail)


Safety level of encrypting data with BitLocker? Is it kind of impossible to decrypt data that is encrypted by BitLocker and data will be safe enough if my computer was stolen?

In theory as long as you keep the encryption key separate from your device and it is not stolen also you should be fine.
However not so long ago a security researcher found a way to bypass bitlocker altogether on domain joined devices.
The biggest problem with encryption is not the algorithms but the implementation.
Since Bitlocker isn't open source it has never been audited by the community so we can't know if there are more "accidental" backdoors.
You could say that bitlocker is good enough and if someone does steal your device it's probably not going to be the NSA. I'd rather go with open source solutions that have been verified by the community such as veracypt (the replacement of truecrypt) for instance.  Here is a very good read on the whole topic.


How (if at all) can an attacker manipulate an already established SSL/TLS Connection? First off, this is a purely academic question. My first answer would be that he cannot since he does not have the session key.

Could he at least kill the connection, such as by sending spoofed FIN requests or something?

Pretty much any active attacks leads to an aborted connection. This includes disrupting the TCP connection as you suggest, or manipulating the payload, triggering a MAC failure, which in turn aborts the connection.

TCP disruptions have happened in practice. While this was against bittorrent, and not SSL protected connections, SSL over TCP can't prevent this kind of attack.

  According to independent testing, Comcast injected reset packets into peer-to-peer connections, which effectively caused a certain limited number of outbound connections to immediately terminate. This method of network management was described in the IEEE Communications, May 2000 article "Nonintrusive TCP Connection Admission Control for Bandwidth Management of an Internet Access Link"

http://en.wikipedia.org/wiki/Sandvine

It's important to note, that the software using TLS is able to distinguish aborted connections from connections that were closed gracefully, because a gracefully closed connection ends with a TLS "BYE" message, which cannot be faked by an attacker.

DTLS over UDP might be more robust since you can't just disrupt the TCP connection. But of course an attacker can simply swallow all messages preventing the connection from continuing.


Is Google's objective to kill passwords justified? Google's Trust API has already been tested out in “several very large financial institutions” in June. It apparently uses a combination of multiple weaker indicators such as biometric indicators as well as some less obvious ones: such as gait, typing style or screen swimpe technique. These will then form part of a final decision to verify you are who you say you are. Are such measures really necessary?

These measures will greatly reduce the impacts, and or attempts to circumvent them. The issue with passwords are, no matter how much you try to educate anyone, it rarely works. Individuals prefer comfort over security, as indicative by making a password: "P@ssw0rd1" to meet complexity requirements. As long as there are passwords, people will keep creating passwords that are weak, and attackers will continue to break them. Moreso as the power of computing goes up, and pricing on creating a powerful machine to break passwords, goes down.

Psychologically, we want things right now. The moment we type something in. "Bandwidth is too slow. This page took 3seconds to load, it usually takes 300ms" We have slowly been groomed to receive instant gratification, and or, to perform tasks with lightning speed. "Have to log in to upload this report by X deadline." No one wants to spend the added time typing in something overtly long, and complicated. Forcing them to remember: "4%6DMoeTr,$^" won't work as the user will write it down. Forcing complex passwords leads to conformity: "Finethisismypa$$word1" which has not worked.

By Google and others using other variables, the attack surface becomes more difficult to tackle from an attack perspective. An attacker would have to know the proper set of variable to trick systems into authenticating. The issue I can see from the biometrics (machine learning) when dealing with typing will come via the following: "What happens if I break my arm, and am typing one handed", "what happens if I type my password one handed because I am on the phone or eating a sandwich." Swipes, same applies. What happens if I come back from a bar, and after a few drinks my swipes error out. Can I not make a bank transfer?

There is still a way to go including Google having to account/store even more data on individuals which leads to even more potential privacy abuses. "We know he/she is left handed, is likely a drunk due to the false positives every Friday night, and is a horrible speler!" (purposely mispelled). Any company looking to do away with passwords is on both the right path, yet also on a path to having too much information on an individual. Is it necessary? Yes it is. Cybercrime is billions of dollars in lost money, sometimes broken dreams (someone's account getting wiped out). Anything that can tackle this is on the right path


How does master secret calculates in encryption protocol used by WhatsApp? I have read the algorithm behind WhatsApp encryption in this document. I can not understand how the initiator calculates a master secret.

The initiator calculates a master secret as:
master_secret = ECDH(Iinitiator, Srecipient) || ECDH(Einitiator, Irecipient) || ECDH(Einitiator, Srecipient) || ECDH(Einitiator, Orecipient).

If there is no One Time Pre Key, the final ECDH is omitted.

The ECDH() refers to Elliptic-curve Diffie–Hellman. It's mentioned in the paper only indirectly by referring to the Signal Protocol by Open Whisper Systems and Curve25519. This is a commercially focused white paper, so it does't really intend to get into the mathematics.

The reason for using 3–4 different Diffie–Hellman key pairs and concatenating (||) the operations is to prevent stolen private keys to be used to decrypt any previously captured communication: medium-term and one-time keys have changed during the time, while the long-term key pair proves it's still the same person. Because all these keys are needed, it also gives plausible deniability; any proofs of authenticity of the decrypted messages gets lost when the conversation finishes.


IPS/IDS and Firewall Solution(s) to a Small Office I was tasked with implementing a network security solution for a small real estate agency.  They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and web access needs.  They also have their own web server which hosts a simple informational website.

The current architecture, set up five years ago by a local technician, is pretty simple:

Having no previous experience with deploying IPS/IDS or firewalls, I wanted to ask this forum to comment on the following ideas.

Between the WAN link and the current router: I can get a used, working Cisco ASA 5510 for almost nothing.  It's an old model but - probably - could do the trick here.  Otherwise, I was thinking of a dedicated pfSense Linux machine with three NICs.  Two will route the traffic, and a third can be used as a network tap when needed.
Port mirror on the switch and use Snort or Suricata as an IDS, with alerts going to an outside consultant (me or anyone else).
The Windows machines are connected using a 2008 R2 running Active Directory.  In its current form, AD is only used to control user access to the desktops, shared folders, and printers. I was going to implement basic security-related group policies to further restrict access on a as-needed basis.

EDIT: There shouldn't be any intra-VLAN traffic.  Currently, no ports are set to negotiate trunks and they don't use the native VLANs.

Any comments or suggestions are appreciated.  Thank you.

1) Does the current Cisco router have any firewall abilities?  If not, the ASA sounds like a good idea to me.  If its a small office, you could probably just go with a 5505 and be fine.

2) I would get a box and put Security Onion on it.  Set up a SPAN port on the current Cisco router to mirror traffic to the SO machine.  Assuming the Cisco router is doing all the inter-VLAN routing, you can get a pretty good view on things.  You won't have much of a vantage point on intra-VLAN traffic but that may not matter to you.

3) Seems standard basic security on an AD domain to me.


Phishing email sent to me within a few hours after a related incident, what should I do? A few hours ago I was helping a family member pay for something on a government website with one of his credit cards, but for whatever reason it didn't go through, so we used another card and it worked fine. I also put in one of my email accounts for the receipt and payment confirmation, which I got in a minute after paying.

Two hours later I get a phishing email sent to my 'main' email account from a different provider (ie, not the one I put in previously) that pretended to be the credit card company of the card that didn't go through, saying that there was unusual activity in my account and they declined payments, click the link, etc. (I did accidentally open the link on my Blackberry 10 phone before checking the email address that sent it which was stupid of me)

Am I compromised in some way and how does this usually happen? I assume I should change my passwords.

Best thing to do is to contact your credit card provider and  to block the card.


Can an unregistered phone with a prepaid SIM card be traced by the police? Let's say that someone is using an unregistered phone — I mean just a phone that he bought in another country — with a prepaid SIM card. The person is sending messages only on WhatsApp, without making any calls. After he sends the messages, he throws the SIM card away and takes the phone's battery out. Is it possible for the police to trace him?

This looks like a question that would be asked by a Don! Always assume that the police could end up catching you. It may take them time, and they would need to be properly motivated.

If that someone was just revealing the location where his little sister hides her candies, he probably wouldn't attract much attention. On the other hand, if he was leaking state secrets for a long time, he would probably get caught. There are also a lot of other real-world factors that would affect it, too, like the infrastructure around him (eg. the existence of multiple safe houses) or the ability of fleeing to a country that will cover up your actions :)

It is enlightening to see the history of "El Chapo" Guzmán, a powerful kingping that used what was considered quite sophisticated methods to authorities, by using several intermediate agents relaying back and forth the orders and replies from/to the boss. Yet, the authorities managed to use the phones to locate him anyway.¹ (The usage of BlackBerry instead of WhatsApp is irrelevant for what they did)

Focusing on the actual issue on how he could actually be traced, you should take into account that the network operator does not only obtain information about the SIM card, but also the handheld serial number (IMEI) and other less expected information, such as the model and brand of the smartphone. Law enforcement could thus track the connections performed  from this device with the proper support of all involved mobile networks.

Another information leak source that could be used to track his is that, even though he only uses the WhatsApp app, many more applications will be running and, potentially, connecting to internet servers (including connections performed by the OS itself). So there will likely be other sources for detecting him while the phone is on.

Obviously, this traces would only be able to reveal at most the location where he was while the phone was powered on and connected to the network, but getting a number of historical locations, could reveal enough information. The main obstacle would probably be the time required once he connects to LE knowing about it and being able to reach there, as well and the kingpin speed in leaving that place.

If that time was 0, they will obviously catch him. If they find his old locations with a lag of several days, it is unlikely to be enough by itself, but patterns would emerge: he is moving towards that city, he has been in that zone for several weeks, etc.

Combining this with external intelligence about the gang (eg. who could be hiding him in that zone? how much activity do other members show?) could indeed end up leading to his detention.

¹ See La BlackBerry que delató a 'El Chapo' (Spanish) - Google translate


certificate used in SSL and keys used in SSH To do SSH to any server we should create private key pair through which we encrypt the connection. Now in SSH we are just doing encryption and here we don't need to verify the server, that's why we are not using the certificate.

Now in TLS we also use the private/public key pair. Can we use the same key pair which we used for SSH? Like, can  the same public key be placed in the CSR which can be signed by a signing authority?

Can the same private/public key pair be used for SSH and TLS? In SSH we just used keys as only encryption is required, and in TLS we use this for encryption and authentication of the server.

In theory yes. Don't do this though. It may break one or both of your encryptions and increases the chances of security breach in other ways.

Also, you definitely do want to authenticate the server when using SSH!


Does Google Chrome read the contents of screen Lately I noticed that whenever I'm reading an article and I want to search something I read there, as I'm typing the keyword, Chrome autofills it. For example, I was reading a reddit post and someone mentioned the game Dungeons and Dragons. I opened a new tab, and as I was typing Dunge, Chrome autocompleted the full game name. I never searched that before.

UPDATE:

Okay that was a dumb question. But at least they are using clipboard contents. Today I tried to extract a zip file but an error occurred and then was typing in Chrome address bar "an error" Chrome autofilled it with the exact error statement and some other related suggestions. I tried to google using another browser, but there, I got completely unrelated suggestions. I'm not being a security nut but I just found out this today.

No, not chrome itself. That would be illegal perceived as a huge breach of trust. But what they do is use analytics like tracking pixels to see what sites you visit. This is metadata everyone shares. Where the problem lies, is that the page you visit is usually public enough for google to know the content. So they can match your visit with what they know about the page, in effect reading the page you're visiting. The D&D example you mention is probably coincidence, but the general tought is correct, they do that a lot.