Are there any cryptographic techniques which combine encryption with false packet prevention? What is this called? Assume that two devices are communicating via some sort of method that can be publicly viewed, and replicated.  Attackers have the ability to replicate information sent between the two, and attackers can listen to the transfers.  Assume that both devices can't tell if they're receiving communication from the other device, or from an attacker.

What cryptographic techniques can allow the information to not be read by the attackers (encryption), but also allow old packets of information to be validated that they came from a legitimate device?  Also, how could two packets which are identical be made to not appear identical to attackers?

I'm developed a solution which I think accomplishes all of these goals, but there must have been solutions already created for this purpose.  It takes the payload data, concatenates the equivalent of a two-factory authentication code which changes every few seconds, and concatenates a random number on, so identical payloads will look different.  Then, the whole payload is encrypted using some sort of symmetric encryption.  Both devices already have a shared secret key file.

I feel like there has to be some other sort of solution out here, but I don't know what it's called or what to research.  I don't want to "roll my own crypto," and I want to find an existing, verified solution.  Can anyone give me some topics to investigate?

For hiding the data, you use encryption. For making sure it came from a known source, i.e. authentication use a message authentication code (MAC), or authenticated encryption. Note that confidentiality (making sure only the intended recipient can read the message) and authenticity (making sure the message came from a known source) are different!

For detecting and discarding resent packets, you usually add some sort of a counter or timestamp on the packets, and discard anything older than the previous ones. Most modern encryption schemes also take a random initialization vector that makes identical messages look different.


How do security questions work? Possible Duplicate:
  Do security questions subvert passwords?

Is it true that on some websites (e.g.: free webmail) there are "security questions" - if the user forgets about his password he could answer the security question, that he provided before, and then he could change his password. BUT: isn't this a security issue? What happens when the security question is weak, and guessable?

Usually security questions are not used by themselves and are used to accompany email verification. Some services also use them when your logging in from a different location to normal to add to the login process. Using them by themselves, unless you're asking like 50 questions, can be a security issue.

Whatever you do they can still be weak and guessable so the right questions have to be used. There is a list of good security questions here which are supposed to be more difficult to guess.


Does pressing a car remote many times offer denial of service attack for rolling codes? My understanding of remote car key fobs, and similar security devices with rolling codes, is that the key device is a transmitter that, each time the button is pressed, sends the next secret in a known sequence that is unique to the key. It does not contain a receiver.

Meanwhile, the receiver in the car tracks (for each key fob it recognises) what it expects the next secret to be, and only unlocks if it receives the correct code.

There is a risk that a transmission maybe lost - e.g. the button pressed when out of range - so the receiver actually accepts any of the next few secrets in the sequence. I have heard of one system that allowed a window of up to 256, but I don't know if that number is correct and whether it is typical.

If my understanding is correct, it is possible to render a key fob useless (i.e. perform a denial of service attack on the owner) by pressing the button at least 256 times while out of the range of the car.

This obviously relies on access to the key fob, but not when the car is close - which is a time the user may be less vigilant.

So, if a friend gets drunk in a pub, I can make sure they can't drive home by rapidly pressing their car remote 300 times while they are in the bathroom.

It has always bothered me that such an attack is possible, and yet I have never heard of anyone performing it, which makes me doubt that I have understood this completely.

it is possible to render a key fob useless by pressing the button at least 256 times while out of the range of the car.

Not useless, but desynchronized. Any car will allow you to re-synchronize, and one example of a typical procedure is:

Turn the ignition key on and off eight times in less than 10 seconds. This tells the security system in the car to switch over to programming mode.
Press a button on all of the transmitters you want the car to recognize. Most cars allow at least four transmitters.
Switch the ignition off.

  yet I have never heard of anyone performing it

You don't have any 3-year olds around?

My older daughter did that... She got the garage door remote when we were putting things on the car, and after driving 10 minutes without her complaining about anything, I saw her pressing buttons on the remote... Got home to a desynchronized remote.

Three-year-olds can be dangerous, relentless attackers, so take care with the physical security of your key fobs.


How to crack 10 digits with prefix password in John the Ripper? I want to crack a password which pattern was 10 digits start with 0910 or 0912.
So possible passwords would be e.g.

0910333444, 0910444566, 0912111222, 0912145632.

How to configure the incremental mode in John the Ripper to try all possible passwords of this pattern?

Note: I want to pipe the password with aircrack-ng to crack a WAP PSK, so I can only use John the Ripper.

Here's how to do it with john (the "jumbo" version), using head to just show the first ten lines of output:
$ john -1='02' -mask=091?1?d?d?d?d?d?d --stdout | head
Press 'q' or Ctrl-C to abort, almost any other key for status
0910111111
0912111111
0910011111
0912011111
0910211111
0912211111
0910311111
0912311111
0910911111

And for what it's worth, you can also pipe hashcat output to another tool, using hashcat's --stdout option, following @dandavis' suggestion:
$ hashcat -a 3 -1 02 091?1?d?d?d?d?d?d --stdout | head
0912199999
0912231234
0912567899
0912000000
0912900000
0912888899
0912300000
0912452345
0912777899
0912699999

In both cases above, we're defining a custom character set "1", containing the two characters '0' and '2', and then using it in the mask with ?1.
But you don't really want to do either of these. There's no need to pipe a wordlist to anything, because starting with hashcat 4.0.0, you can skip aircrack-ng entirely, and directly crack a WPA2 PSK with hashcat (using -m 2500):
$ hashcat --quiet -a 3 -m 2500 hashcat.hccapx hash?l?l?l?s
a895f7d62ccc3e892fa9e9f9146232c1:aef50f22801c: (wrapped)
    987bdcf9f950:8381533406003807685881523:hashcat!

So your command would probably look something like:
$ hashcat -a 3 -m 2500 -1 '02' hashcat.hccapx 091?1?d?d?d?d?d?d

For fast hashes, this is the most efficient method, as the candidate passwords will be generated much faster on GPU. For a slow hash like WPA2, it doesn't make much of a difference in efficiency.
For more information, see this reference, as well as the closely related hcxtools project, which you may need in order to convert your captured PSK into the hccapx format required by hashcat.


WiFi name keeps changing but not by me Over the last year I continue to get notifications that my WiFi has changed.  I have xfinity and have changed my equipment twice and updated my settings to be more secure as follows:

changed default gateway password
do not broadcast WiFi name
created long WiFi name and password
changed to wpa2
disabled WiFi hotspot

I also view devices on my network. At one point there were numerous unknown devices which I have since blocked.

I use only iPad and iPhone and have stopped using my PC as I’m worried it is being compromised.

Can someone have a repeater or extender in my network without my knowledge?  How can they do this?

How can someone change my WiFi name?

How can I tell if my WiFi is hacked?

What else should I be looking for?

Is net analyzer for iOS a good option?

Are cookies from my surfing the problem?

If you have done all those changes to your router and the WiFi "name" or SSID is being changed then you could possibly have a compromised device on your network.  This isn't guaranteed to be the problem as some routers allow remote management so it could be the case that someone is able to connect from a remote location and perform changes.  One question to ask yourself is why they would need/ want to make changes?  If it was a malicious person that had compromised your desktop computer for example, they might want to maintain access for a longer period of time, and by making changes this is more likely to alert you to their activities.  I would suggest it is possibly more likely to be someone who is playing a joke and trying to wind you up??


Should I distribute Root CA or Intermediate CA certificates to client? I've been following this tutorial to create a Root CA, intermediate CA, and server certificate.

I can verify:

the intermediate certificate with the root certificate
the server certificate with the intermediate certificate

But I can't verify the bundle intermediate cert + server cert with the root certificate.

In other words:

# verify intermediate cert with root cert: OK
openssl verify -CAfile root/certs/ca.cert.pem intermediate/certs/intermediate.cert.pem

# verify server cert with intermediate cert: OK
openssl verify -CAfile intermediate/certs/intermediate.cert.pem intermediate/certs/my.domain.cert.pem

# create bundle intermediate cert + server cert
cat intermediate/certs/my.domain.cert.pem intermediate/certs/intermediate.cert.pem  > certs/my.domain.bundle.pem

# checking bundle with the root cert: NOT OK
openssl verify -CAfile root/certs/ca.cert.pem intermediate/certs/my.domain.bundle.pem # NOT OK

That confuses me because I thought I would deploy the Root CA certificate on clients, and have the server use the bundle intermediate cert + server cert.

Does that mean I should only deploy the intermediate cert on clients, and have the server use only the server cert?

In general, a server must hand over the server certificate and the intermediate certificates.  To quote RFC 5246 (emphasis mine):

  If the server is authenticated, its certificate message must provide a
  valid certificate chain leading to an acceptable certificate
  authority.

It is preferred that the server do this, as opposed to distributing intermediates to all the clients, because trying to make sure all your clients get and keep the proper intermediates is a lot harder than handing them out each time as part of the handshake.

Echoing this setup, you should try, instead of using the bundle as your target, using the -untrusted argument to openssl verify to integrate the intermediates:

  -untrusted file

  A file of additional untrusted certificates (intermediate issuer CAs)
  used to construct a certificate chain from the subject certificate to
  a trust-anchor. The file should contain one or more certificates in
  PEM format. This option can be specified more than once to include
  untrusted certificates from multiple files.


PCI DSS compliant without private VLAN I understand that it may be a best practice to hide in-PCI-scope-elements like databases inside a VLAN without a public address and also strict firewall rules.

However, my questions is: can interconnected dedicated servers with public IP addresses each, that follow strict inbound and outbound firewall rules for every connection also be PCI DSS compliant?

This seems to be a dumb question but at work they interpreted the PCI DSS guidelines as the requirement that servers must not have a public IP address (not speaking about the front-end servers though).

The short answer is yes, but it's more difficult.

The main principle of using VLANs to segregate the PCI DSS environments is reducing scope for assessment and maintenance. If you reduce the scope, then only the servers which need to be compliant are assessed.

If you don't segregate, then the rest of your network (and all the users of those devices) come under scope, too. It's not impossible, but it does complicate matters a lot more than simply configuring VLANs on you network.


Does AH in tunneling mode provide encryption? I've been reading on IP sec for a few days, and i have some confusion on the differences between AH and ESP in tunnel/transport mode. I understand that AH only provides authentication and integrity checks, but NO encryption (ESP does provide encryption). So far so good. However, reading on Tunnel / transport mode always says that tunnel mode encrypts the entire IP packet, and transport mode only encrypts the payload but leaves the headers intact.  Even on the main article of IP sec on Wikipedia it says

"In tunnel mode, the entire IP packet is encrypted and authenticated. It is then encapsulated into a new IP packet with a new IP header(...)"

However, multiple questions on this topic state that AH with tunnel mode doesn't provide encryption. So, which is it? Do tunnel / transmission modes always guarantee some kind of encryption (either on the full packet or only in the payload), or is the Wikipedia's article wrong (very unlikely) and Tunnel / Transport modes only provide encryption when using ESP and not AH?

(here's one example question where accepted answer states that AH in tunnel mode only guarantees integrity and authenticity checks, and not encryption:
IPsec: Is AH in tunnel mode secure?)

Thanks!

AH mode doesn't provide encryption, it only makes the traffic it tamper-proof. It doesn't matter whether it's in transport or tunnel mode. If you need encryption then ESP is what you need.

That distinction your read between tunnel and transport mode is relevant only when using ESP. In case you need to hide the endpoints of the traffic then you need to use tunnel mode, as this info is always visible in transport mode.


Is it safe to invoke PHP GD functions if you don't know whether file is a valid image? There is image upload function in web application. After image is uploaded, it's resized using functions from PHP GD like imagecopyresampled and others. Before invocation of PHP GD's functions there is no special validation that this image is of valid type. Then this resized image is put into directory at web server. When user requests certain url, this image is presented to him.

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

It is better to validate the input as much as you can before trying to process it; this stackoverflow post lists several methods, of which the finfo method appears to address @Polynomial's legitimate advocacy for the devil.

That being said, there are various format attacks against image processing libraries, but they mostly start with a valid image file.  Libraries like GD will generally open up the file and bail out of it doesn't look like a valid image file, so in order to break them, you need a file that's legitimate right up until it violates spec in a way that the parser breaks instead of rejecting it.  So validating input helps avoid accidental and stupidity-based bad inputs, but don't overestimate it's effectiveness against the malicious attacker.


How to not store the card during 3D Secure authentication, to be PCI DSS compliant? I'm implementing a payment solution where the cardholder enters his card details on our own website.

We need to use 3D Secure for extra authentication of the cardholder.

Our payment gateway implements it with these steps:

a form is created with these parameters:

the merchant ID
the card details
the payment amount

upon submission of this form, the user is redirected to the 3D Secure authentication page. He then typically receives a SMS with a secret code he has to enter to authenticate the payment.
upon successful authentication, the user is redirected to our website, along with some parameters, one of them being an authentication ID.
we then perform a server-to-server authorization of the card, with these parameters:

the merchant ID
the card details
the payment amount
the 3D Secure authentication ID received above

All good. But there is a problem.

To be PCI DSS compliant, I cannot store the card number in any way. I can just process it and discard it immediately.

But because of the implementation above, I fail to see how I can not do that.

Let's say the user enter his card details on my website. The form posts to my server, which generates the web form for 3D Secure in step 1. So I generate the form, present it to the user's browser which will post it automatically, and discard the card details.

Now the user comes back to my website from the 3D Secure page with the authentication ID. Good stuff, but I do not have the card details anymore to do the authorization, because I could not store it in the meantime.

What did I miss?

Typically payment APIs fall into 3 categories:

payment page hosted on the merchant side and submitted to the merchant
payment page hosted on the merchant side and only card data submitted to the payment provider (typically via a JavaScript SDK)
payment page hosted on the payment provider side and submitted to the payment provider, the merchant receives a notification upon successful authorization

Assuming the payment provider didn't screw something up big-time you should be completely out of PCI DSS scope by options 2 & 3.

With option 2 you are not in PCI DSS scope, you never use credit card data, but a permanent or temporary token assigned to the transaction (like e4baf901-252b-4818-b826-7f89cad884db) by the JavaScript SDK of the payment processor. Other than this, the 3ds workflow is exactly like option 1, it's just that your API requests have a pan_token and not a pan attribute. See hosted fields API on Braintree as an example https://developers.braintreepayments.com/start/hello-client/javascript/v3

With option 3 you are not in PCI DSS scope, you don't really do anything, you just redirect your client to the payment provider or open the payment provider's page in an iframe or something, here's an example of this kind of API: https://ipgtest.webteh.hr/en/documentation/form

With option 1

That's a different story, yes, you are in PCI DSS scope, yes you need to have a valid certificate, depending on the region perform PEN tests, have a secured organization and all other "bad stuff", password policies, jump host for connection, secured (and preferably segmented) network, make sure the logs show nothing, "deny all" network configs, do audits yearly etc etc etc.

If you go down this road (and I really don't understand why you should, please, don't) at least you can avoid having an HSM and worry about encryption keys etc - meaning you should not store PCI DSS data to a hard drive.

Typically the simplest solution to avoid this is to store the credit card data in memcache with an expiration policy of 1h or less (15 minutes works for all implementations I did so far). The trick is to not write it on the disk (that's why not redis in most implementations for example), but a memory store like memcache is fair game. Just make sure that the access keys are something big and secure, like an uuid (ie e4baf901-252b-4818-b826-7f89cad884db).

It was not always like this in practice...

Historically, the payment companies have been very lax about merchant PCI DSS compliance, the only practical difference between "database full of PANs" and "no PANs ever touching the system" was "how many questions your self-assessment questionnaire has" (PCI DSS SAQ for merchants).

Only in very special cases when a merchant was identified as common point of sale for stolen cards was the merchant forced, very very reluctantly and with a lot of "understanding" by the credit card companies to undergo PCI DSS lvl2/lvl1 compliance audit.

This is however changing due to a series of breaches, and at least in some regions (like SEE Europe), the payment companies are now insisting on a migration away from option 1 to all merchants that do not have a full PCI DSS compliance certificate (not just an 'X' marking exercise in a SAQ questionnaire).


openssl enc uses md5 to hash the password and the salt Wikipedia states that md5's collision resistance is 2^18 (https://en.wikipedia.org/wiki/MD5).

I just found out that openssl enc uses md5 to hash the password and the salt. Let's assume that I want to use a 27 char random password (62 char alphabet).
That would yield 62^27 = 10^48 = 2^160 possible passwords which will take an unfeasibly long time to crack.

Now, how does md5 change this assumption that brute forcing is not feasible?
Will it take only 2^18 tries to find a suitable hash because finding collisions is so "easy"?

If yes, why is openssl enc still using md5?

The OpenSSL apps need to be used carefully, they often have old and possibly insecure defaults, at least by contemporary standards.

In this case openssl enc defaults to using a digest of MD5 (apps/enc.c)

    if (md && (dgst=EVP_get_digestbyname(md)) == NULL)
            {
            BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
            goto end;
            }

    if (dgst == NULL)
            {
            dgst = EVP_md5();
            }

The -md "message digest" option can be used to set this explicitly, you can use any supported digest such as sha256:

openssl enc -md sha256 -e -aes256 -in infile.txt -out outfile.enc -pass pass:foo

Some of your assertions are correct, but they do not quite apply here, specifically since an attacker does not know the digest output a collision attack does not apply.

Finding a collision is only useful sometimes, e.g. when MD5 output is used as a signature or integrity check. A collision attack requires that you have a hash output to work with.

In this case MD5 is being used as a key-derivation function. For that, what is usually more interesting is pre-image resistance: given a digest you could work out an input (e.g. password) that would generate it. MD5 has good but imperfect pre-image resistance, ~123 bits instead of the intended 128, see RFC6151.

Given only an encrypted file, if the attacker's task is to recover the encrypted data, then he must discover the symmetric key (key+IV) used to encrypt. This key is also a digest he can compute from a pass-phrase which he can discover instead (a salt, if used, is available in the file).

The attacker does not know the password or the key (digest of salt/password), either one will do: which is cheaper to find? What might help an attacker is if the MD5 output is biased, but it's not, as far as I know.

(Strictly there may be two scenarios: recover the password in order to prove something, not necessarily access to the encrypted data; or only recover the key in order to access the encrypted data.)

The two obvious attacks are:

brute force the entire (symmetric cipher) key space, if the KDF (hash/digest) output is biased then this will be smaller than it should be, which may help the attacker
brute-force the password space, if the input was chosen by a human then this will be smaller than the key space (the salt will eliminate pre-computed attacks though, enc uses a random salt by default)

Ideally, we want a good KDF with no bias, an output at least as large as the expected input entropy, matched to the symmetric cipher keysize, and expensive so that attack #2 doesn't offer a short-cut.

Using a digest like MD5 with a short output (128-bit output) as a KDF means that the key used to perform the encryption is only 128 bits, and in this case not as long as your required pass-phrase (~160 bits, 62^26). Also consider the symmetric cipher key size that will be used, ideally these should be matched.

The biggest problem here is not the potentially problematic use of MD5, it's that the KDF that openssl enc uses is "cheap", specifically it only uses one round, making brute force attacks on passwords the best attack (apps/enc.c, line #569):

             EVP_BytesToKey(cipher,dgst,sptr,
                            (unsigned char *)str,
                            strlen(str),1,key,iv);

The sixth parameter to EVP_BytesToKey (hard-coded to 1) is the count, designed to slow down an attacker (or not, in this case). What should be used instead is a robust, expensive key-stretching function like bcrypt or scrypt.


The teacher logged me in as administrator for doing a short task, is the whole system now compromised? I worked today with our teacher who logged me into a computer as admin. We had a task that required admin rights. A few seconds later he was talking to other students in our classroom, but I was able to reset the administrator password with lusrmgr.

Was the teacher right to do this (is it a critical problem)?
If he was not right, what could be a better option?

Was the teacher right to do this?

Yes and no. One might be tempted to say that giving a student administrative rights is highly problematic, and leaving them unattended even more so. And to some degree, I even agree with it. You may have added a new administrative user, changed the admin credentials, installed a rootkit or more.

But...

Acting maliciously would not have been without consequence to you. It's very likely that the teacher recalls giving you specifically administrative rights, and at what time. If in this very specific time window, something were to happen to that computer, the school can easily identify you as the malicious actor.

What consequences could there be? That depends entirely on what you did. Changing the local admin credentials could be considered a mere prank, and could probably be reversed by the domain admin. The damage would not be too high, but you could face detention.

If you were, for instance, to install a rootkit, then the school could claim you acted maliciously, with an intent to circumvent their security and to damage their systems. Arguing against that, when you installed what is essentially malware on their system, is going to be very difficult. It could be considered willful damaging of school property, and you could be expelled from school.

If you were to act even more destructive, by running malware designed to damage the hardware (e.g. hypothetically by overclocking the CPU to 12 GHz and disabling any self-preserving safety measures), then the school may even sue you for damages, in addition to expelling you.

Doesn't this imply that the teacher is at fault for providing me admin rights?

No. The teacher gave you administrative authorization to perform a very specific task. That does not give you the right to perform any task, even if you technically had the capability to do so.

If my friend were to give me the key to his house to watch over his dog, this does not authorize me to take anything from his house, or to install cameras everywhere - even if I was technically capable of doing so.

Can this not be considered a penetration test?

  "I was just testing the security of my school's computer systems."

No, it's not a penetration test. A penetration test requires the entity, who owns the system, to explicitly consent to the penetration test. A teacher providing you with administrative access to fulfill a specific task is not explicit consent for a penetration test.

What could the teacher have done differently?

Depending on the length of the task you were supposed to carry out, the teacher could have stayed with you and revoked your administrative access after you were done.

Given what was stated above, the teacher had a reasonable expectation that you would not act maliciously, which seems to have been misplaced.


How could an hard-token be packaged such that the recipient could trust it? I purchased a Yubikey NEO, which arrived in a small plastic thing, inside of a padded envelope. An attacker with access in transit would have had basically unlimited ability to manipulate it.

Which led me to thinking: assuming the recipient trusts the manufacturer, how could they package a hard-token such that the recipient could use it without needing to trust the postal system that transited it?

Tokens are built to be tamper resistant so that you can't just open it up and mess with the circuitry and inner components.

The pin for the tokens are also delivered via another channel(Either the token or the pin is handed in person by the bank, RA or the institute that's responsible for the tokens) so that an attacker can't access both the pin and the hardware token.

Also the key used to generate OTPs "can be" based on the entered pin so with a wrong pin you'd get invalid passwords generated, so without having the right pin a guy getting access to the hardware token cannot do much(he will have access to a part of the key that's used to generate one time passwords).


Is there any reason for disabling telnet client on windows? Since Windows 7 release the telnet client is disabled by default on windows,any security reason for that? is enabling telnet client on windows will make it vulnerable for any type of threat?

The Telnet client does not present much of a security threat in itself though it could be leveraged by some malicious process (virus/malware) to do further damage. It is also disabled as very few users, particularly home users make use of it.

Standard security practice says you should reduce your attack surface as much as possible and that includes disabling tools and services that you do not use.


Is it dangerous "Powered by..." tag Is it dangerous from a security perspective to put a line at the bottom of a website "Powered by Wordpress/Drupal/Django/WHATEVER" ? I know that certain platforms/applications have different security vulnerabilities that are more common/easily exploited. Knowing the ins/outs of a platform would definitely direct any searches for a vulnerability.

I'm not sure if this falls in as "security by obscurity" because but I also think not having that tag may increase the level of effort for a potential attacker.

From a security perspective what would you advise a webapp programmer?

In some circumstances, hiding software identifying information can be considered beneficial to the overall system's security, not to expose it to risks of being targeted by 0-day exploits, or make it generally easier for the attacker to find possible exploits without doing much research on what software he should target, and increasing chances of being exposed in the process.

Scanning for banners (as these signatures are sometimes called by attackers) can be difficult to detect, if the software itself doesn't makes it trivial for the attacker to collect it, so removing any such signatures or changing them to arbitrary non-identifying values is often recommended, for example on web server software (Apache, IIS,...) that might by default publish even what operating system they're running on.

In your case however, discovering what web framework some website is based on (especially the most common ones, like the ones you mention) is fairly trivial by simply inspecting response HTML / CSS / JS for signs of common building blocks these frameworks rely on (and sometimes even on what domain or web hosting server they're published), so I wouldn't really say you'd be hiding essential information that is otherwise impossible to determine by other means. Adding, or removing a line "Powered by..." in / from your response footer (or anywhere else) in my opinion doesn't change a thing for high level software stack (but you might want to omit what OS it's running on, e.t.c.).

Most websites built on such frameworks will be far more at risk of being targeted by automated web bots looking to inject malicious code by commonly known exploits, regardless if your website is built on this or that framework / CMS / whatsitcalled, not even bothering to look at your signature information. And more targeted attacks really won't have hard time figuring what underlying framework it's built on. You would be by far better off by "obfuscating" paths to your CMS, and focusing your attention on hardening web application security by running vulnerability scanners on them on your own and eliminating any potential vulnerabilities they came up with, for example.


What is Byzantine password system? How safe are password managers like LastPass?

One comment there asks:

  Does anyone know of any Byzantine password systems? E.g. 3 or 5 online
  systems, where breaking any single system would not give the cracker
  all of your passwords. Ideally one might be LastPass, and the other
  1Password - i.e. different companies - but even just multiple
  independent instances of the LastPass servers would provide some extra
  degree of security. // Possibly Byzantine for reliability as well as
  security.

That seems like a very interesting system. With lastpass and 1password protected by 2fa(Two-factor authentication), just knowing one won't divulge the other.

Does that actually make sense? Anyone tried that? Is this an actual system many people used?

I think one comment by @jak tells me what I mean

  Maybe it means "n out of x" pieces would be needed to recover the full
  information, like 2-out-of-3 for key ABCDEF being split into ABCD,
  CDEF and EFAB

I want a system where the only way I lost access is if my computer and my head and my finger prints and my phone is gone suddenly. I want a system if I have 2 or 3 of them I can recover the rest. But a hacker need 2-3 of them. So a stable system that always give me an upper hand compared to hackers.

I do not think a hacker can easily get my computer and my password and my finger print. We're talking about James Bond kind of skill to get 3 factors. But I easily have that. If one day my fingers are gone, I still logged in from the same computer. So I have 3 factors again and insert a new finger print on file.

There is no such thing as a "Byzantine password system". "Byzantine complexity" is a description of:

  anything that is so overly and unnecessarily complex as to be beyond
  understanding.

So, all they are saying is to split up passwords across multiple systems.

  Does that actually make sense? Anyone tried that? Is this an actual
  system many people used?

Yes. All the time, and in various different ways. In more general terms, it's called system redundancy. Like when servers are distributed across AWS as well as Azure. Also, data can be backed up on disks, RAID arrays, mirrored systems, and backup tapes all at the same time.

For passwords, many people do this in various ways. Some passwords are stored in password managers, others in the person's memory, some are written down. Some people store some passwords in their browser password manager and some in a 3rd party password manager.

You need to perform a risk analysis to determine what's going to work for you and what risks the extra complexity will create.


Why are CPUs designed in a way so the "meltdown" exploit works? I'm trying to wrap my head around "meltdown", but to first understand it, I've been trying to understand memory accesses.

From what I understand, the CPU attempts to look up the virtual address in the translation lookaside buffer, which indicates what data is in the CPU cache. If it's there we immediately fetch it. If not, we then look up the address in the page table.

Now from my reading, every process has it's own page table. However, every process also has the kernel mapped into it's page table.

Presumably the page table also has access bits, obviously we can't allow reads directly into kernel space when the CPU is in user mode (I think this is called "ring-3").

From what I understand of page tables, these access bits are stored in the lower bits of the address. As our page entries are 4k, there's plenty of bits left over to store access bits.

From what I've read about the exploit, the issue is that the check for access is done after the data is retrieved. The reason for this is for efficiency reasons, we want to quickly get the data to the CPU and we can just catch the permission error before we do any permanent changes. But unfortunately we've affected the CPU cache by doing an indirect memory fetch which is detectable using timing attacks.

This scheme might make sense if the page lookup was cheap but the access check is expensive. But from my understanding that doesn't seem to be the case.

I've read the page table on a 64 bit machine has at least three layers, which means at least three memory lookups. Hopefully these are in the cache but if they aren't that means recursively searching the page table for it's own pages.

After we've done all this work and finally found the page table entry, when we load the physical address from the page table, we also load the access bits. Why not just check it there? It seems far more trivial to check the access bit we've already loaded than muck around with circuitry to deal with it later on.

I'm obviously missing something about how the CPU is working, but I can't work out what. We have to do the page table lookup to even work out what to fetch, and once we've gone to that trouble why not just check the access bit?

A couple things you missed:

The kernel memory in question might already be in cache, making fetching the data just as fast as fetching the access bits.  It's a content-addressed lookup for both.  Even if not, there's the TLB.  Full three-level page table accesses are not the common case to optimize for when performance is the goal.
The privilege level itself might be changed by other half-executed instructions in the pipeline.  Until those instructions are fully retired, the privilege level itself is only a speculation.

I wonder if #2 will lead to the discovery of even more vulnerabilities...


AVG Website Scan, Chance of 'Potential Threat'? In a recent question I asked about investigating websites for viruses.

The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, then used it on a website we suspected and it came up with 'Potential Active Threats'(link to the report).

My organization represents Sheep Farmers in Ontario and if this website is a serious we need to report it.

However I need to know before hand, how credible is the Potential Active Threat alert from AVG? They seem like a credible company and the analysis even lists the potential threats(Blackhole Exploit Kit, and Javasript Obfuscation). I don't want to come out with a warning about the website for our Farmers and have it back fire if there really isn't a threat.

I generally consider AVG to be reputable. When in doubt, you can always check against other scanning sites as well.

I don't know what to make of the "Javascript obfuscation" threat, but the Blackhole Exploit Kit is a clear sign of compromise.

Now, for the really bad news: The infected site is going to have to nuke their web server from orbit. Read the whole answer linked there, but the key thing is the only way to be certain that you've got control of the system is to rebuild the system.


Why there is time period of key pairs in public key cryptography? In Public Key Infrastructure, every key pair is associated with its life time. I don't understand why we have a life time when we have functionality such as certificate revocation list(crl) which tells the user when any key is invalid. That is we can use any key pair for infinite amount of time or till its purpose is finished (for e.g. the Organization for which the key pair was made closed). This way we can save the cost of renewing certificate when the new key is made.

The only intuitive answer (I got) is it reduces maintenance cost of CAs, since there will be loads of public keys it has to maintain. Otherwise, they can just scrap of keys whose time period is over.

The only intuitive answer (I got) is it reduces maintenance cost of CAs, since there will be loads of public keys it has to maintain. Otherwise, they can just scrap of keys whose time period is over.

No, that might be a reason but this is more due to several security reasons.

The first reason: better change your password every x months.

Lets consider a simple scheme. Imagine you use the same password on every website (which you should not be doing: would you use the same brush for your teeth and for your toilets ?).
You can assume that you can change your password anytime (same principle to revocation certificate). But you may forget to change your password on some website. If one of these is compromised, why not some other by domino effect ?
In order to avoid such problem, we generally have a policy that makes user change their password every x > 0 months. For your key pairs this is the same idea.

The second (and more important) reason: the increasing power of computers makes old keys insecure with time. This is due to the increasing power for factoring big numbers. A 1024 bit key may have been considered secure some years ago, but not anymore. Therefore to prevent people to use it, a life time is associated.


Is it reasonable to have the software hold something that the user can't tamper with? I want to create a piece of software that will hold some information, the program works offline and I want to make sure that information can't be tampered with.
The program can create or alter it's information at any point.

I thought about having the program create and hold it's own key pair and sign the information, but is this reasonable? I'm scared that a user could find the private key of the program and fake the information. How could this be avoided?

Thank you.

No, tamper-resistant applications implemented purely in software are unfortunately impossible.

Software which runs on the user's machine is under the user's control. The user can extract any secret keys from the program, either from memory at runtime or from the program's binary code. A program and/or the data it uses can not be effectively encrypted, because in order to be executed and accessed it needs to be decrypted, and that decryption key and the decryption algorithm must be available in unencrypted form.

There are obfuscators which make a program harder to decipher, but those only slow down a determined attacker. They can not stop one completely.

In order to do trusted computing you need trusted hardware. There are hardware solutions available for some use-cases, like USB dongles which can hold cryptographic keys which they don't expose to the host device and can perform cryptographic operations in a black-box manner. These devices are usually quite resistant to software tampering, but they might still be susceptible to physical hardware tampering.

Also, whatever data they receive or send back to the host-system can be intercepted. When you want data to stay secret, it must not leave the trusted device.

You are unfortunately not writing enough about your exact use-case to make a guess if that would be an option in your situation and what pitfalls you could possibly step into.


Block the HTTPS version of a website I would like to block some websites from their HTTPS version and allow them on HTTP. The main websites involved are Youtube and Google Images/Videos. I am using K9 Web Protection on each computer, and it has a limitation on its ability to enforce SafeSearch on HTTPS sites.

For me, this is a very serious issue which spoils many great things about the Safesearch features Google offers.

Is there any software/config that can do that?

P.S.: I'm not sure this is the right place to post this question in, maybe you could redirect me to some other SE platform?

Google has your answer:
http://support.google.com/websearch/bin/answer.py?hl=en&answer=186669

You can use Lock SafeSearch or use the NoSSLSearch option.

*Edit*

I think your best option after reading your comments is a proxy on the firewalls to re-direct the requests to HTTP. Squid can do this, but it might be more advanced than you want. Here is a tutorial to do what you want.

Tinyproxy is a simpler alternative, although I have never used it.


ARP spoofing kills victims connection and other issues Recently I became interested in sniffing/spoofing. I'm running Kali Linux with MITMf(9.8) and SSLstrip.

To start the attack I use:

python mitmf.py -i wlan0 --target X.X.X.2 --gateway X.X.X.1 --arp --spoof --hsts

Victim I (OS X)

I tried to attack my MBP. It works. I can sniff username/passwords when it connects to http sites. It doesn't last long though. After a minute or so my connection on the victim machine is completely dead. I have to stop the attack and reconnect the victim machine to the router to make it's internet connection work again.

I thought it might have been caused by having IP forwarding disabled, but as it turns out it works even worse when it's enabled (connection is lost on victim's machine almost immediately).

Then, I thought it might be an issue with my router, so I tried to run a hotspot on my iPhone. Indeed, it improved the length of the attacks greatly, but still after 2-3 minutes the connection died on the victim's machine.

What can be causing this?
Victim II (Bootcamp Windows 8.1 Pro)

My second Victim was a Windows 8.1 machine running in bootcamp. No luck here either. The connection is killed immediately after I run MITMf command.

Has anyone encountered these issues?

I've not used mitmf.py, but from your description, the most obvious cause is that the tool is only poisoning the victim's arp cache at startup and is not intercepting the refresh of the cache (fast enough). This should be apparent from a packet capture (though you'll have to wade through a lot data to validate it).

If this is the case, re-running the arp cache poisoning at regular intervals may fix the problem.


Does the auth server have to be separate from the resource server when using OAuth 2.0? I'm trying to implement OAuth 2.0 and I noticed in the spec they mention two servers - an auth server to pass access tokens back to and a resource server to use the access tokens on.

My question is, how important is it to have two servers for this? Is it one of those things where it'd be perfectly fine to use one server for both jobs and separating them out is for added security or is it absolutely critical to have two servers for this?

OAuth is like any other auth scheme with regard to its functional purpose. You send creds to it, and it returns user info (even if it's only success/fail messages).

Usually a standards based auth server is used by multiple applications so you really want it isolated to it's own functional domain, code base and host. You don't want changes made to an application to impact an auth server that other applications use. That could be disastrous in a production environment and adds more QA than you should need for changes to the app.

If it will never be used by other applications there's no reason to add that layer of complexity that OAuth will add to the mix.

So yea separation should be there if OAuth is planned. In fact your OAuth server should be it's own project.


Using Private Browsing mode while connected to organization's network At the workplace I use the organization's network for accessing internet (well that's the only option).
I am not sure if the network administrators monitor what I browse, how frequently I access social media websites. But I guess they would/should be doing.

So here's my question - If I use Private Browsing Mode to access websites (lets say social networking sites), will the network administrator find any clue that I am using Private Browsing Mode? And what all websites I am accessing through it?

As others say - Private Browsing is a protection for your workstation/laptop - great if you want to clean it because it's used publicly.  Not great for eluding your network admins.

The company you work for does have the right to set a policy for how it's resources are used, and monitor that employees stick within the policy.  The analogy of a phone system is apt - you've reset your "phone", you haven't erased your phone bill which shows every number you called.

Depending on configuration, your company can see what IP addresses you visited, what URLs you requested, the traffic sent between the sites and you, content transmitted between the sites and you, and get a rough sense of for how long you were visiting the sites.  The sites you visit do represent a security risk, and the company has a right to monitor and protect itself from that risk.

Practically speaking, it's rare for a company to scrutinize employee by employee.  Collecting the data, sorting it for each employee, and going through it in details is just way more work than a company of any size wants to consider.  In a big company, it's like finding a needle in a haystack, in small companies, the one guy who can do this is just too busy.

Generally, you have to do some or all of the following for this to come into play:

do very poorly in job performance - to the point where they wonder what you are doing, because it clearly isn't work...
have a major security issue - if you get hacked or get a virus, they will fix it, research why it happened and try to prevent it in the future.  That extra scrutiny can bring on questions of why you were on a social site if the company policy prohibits it.
visit sites excessively, and compromise availability of resources - if you are streaming Hulu, Netflix, YouTube, etc for the entire work day, you are limiting bandwidth for legitimate use.  When the executive says "why is this so slow?", you don't want to be the reason.

In all honesty, I find the best answer to be - if you want your behavior to stay private, don't do it at work.  The computer for work was given to you for work.  Generally some polite social browsing in limited scope is not against the rules, if it doesn't impact your work... but the point of the computer they gave you wasn't for your personal enjoyment.  If your privacy is important, do it at home, or pack a personal device with net access - it's getting easier and easier with smart phones and tablets to get off the company network entirely.


Security/Privacy reasons NOT to buy an IPhone Background: Obviously, buying an iPhone has its advantages - lots of apps, a closed source operating system, etc. Also, unlike an Android user, it seems like an iPhone user can be reasonably assured that they will actually receive fixes for newly discovered bugs, since the the OS and the hardware are made by the same manufacturer.

But what are some security/privacy related reasons why someone would buy a smartphone from a different manufacturer instead of an iPhone?

Threat model: let's say specified attacks from hackers rather than generalized data collection or spamming, etc

Your operating system knows everything about you. Everything you do, everything you see, everything you type can be stored, manipulated or transferred by your OS. If you are not able to see the source code of the OS, you are at the mercy of the supplier and have to trust him that he is not malicious.

This, of course, is not just a problem of iOS but of any closed source operating system, be it from Apple, Microsoft or a vendor installed Android. As Billy Joel would put it: It has always been a matter of trust.


Why handshake is not initiated for google webserver?? Is there any client side validation before handshake is initiated? I'm using burp suite as proxy and configured my browser to it. I'm able to intercept SSL connection traffic of only some web applications using self-signed certificate issued by burp by adding exception to my browser. But when I try to do the same to google, it does not initiate TLS handshake and we cannot add any exception (as there were no packets related to handshake checked in wireshark).  Is there any client side validation before handshake is initiated?

There could be a few reasons for this, but the most likely are HSTS, SPDY, and preloaded pinning:

HTTP Strict Transport Security (HSTS) is a mechanism by which a server can enforce that the server is only ever connected to via a secure connection (e.g. HTTPS) and that a valid certificate must be presented. Your browser will not allow the connection to initiate on an insecure protocol like plaintext HTTP, or if the presented certificate is not valid. You can't override this. If you're doing TLS MitM in Burp, your browser will reject the certificate as invalid unless you install the Burp CA in your browser.
SPDY is an alternative HTTPS protocol that Google uses a lot. It may well be that your browser is trying to initiate a SPDY connection, and that's perhaps why Burp isn't catching it.
Chrome comes preloaded with a set of server certificate rules for pinning. The idea is essentially that they preload HSTS rules for a bunch of common sites as part of the installer, but with the additional protection of including a fingerprint of the known certificate. This will cause any invalid certificates, even those with "valid" signatures (e.g. signed by a local CA), to be rejected.

My advice would be to install the Burp CA into your system's certificate store, and your browser if applicable. That should probably fix it.


Can WiFi detect you even if you aren't connected I've read that the way WiFi works is that your computer sends out requests looking for any WiFi it recognizes. I use a MAC spoofer but if there is a WiFi in range before I have time to spoof my MAC address, will the WiFi be able to see my MAC address?

I've read that the way wifi works is that your computer sends out requests looking for any wifi it recognizes.

That depends on the configuration of both the access point (AP) and your device.

Most APs periodically emit beacon frames, where they broadcast their presence along with the wifi's name (SSID), capabilities and other information. Your device can stay entirely passive and listen to these broadcasts without sending a single frame.

On the opposite, you can actively discover wifi networks by sending probe requests. This way, your device publicly asks for available APs, along with your MAC address, supported connection types, etc. APs that match these specifications will reply with a probe response frame.

Note that a probe request can also ask for specific SSIDs. This is especially common for smartphones and raised privacy concerns in the past, since these broadcasts can be easily sniffed.

So Yes, unless you are sure you keep your network card entirely passive before spoofing the address, the AP (or an attacker sniffing the wifi traffic in your area) may capture your MAC.


How much can we trust open source implementations of crypto (security) libraries? In one of my projects I was choosing bcrypt or PBKDF2 for the KDF for passwords. I have read that bcrypt is generally more advanced and scrypt is even better. But I am using .NET platform where bcrypt/scrypt are not available from Microsoft though there are various implementations on nuget. In the end I decided to use PBKDF2 since it's a default implementation by MS which is hopefully reviewed by some security experts.

But the question is: what is the best course of action in such situation? Can one just pick top rated library with enough downloads from nuget and trust it's good enough since many people use it? How do I know if it's good enough then. Or it's better to use something from the platform if available? I definitely don't want to implement anything like that myself.

How much can we trust open source implementations of crypto (security) libraries?

Much better than closed source implementation.

When it comes to security that really matters, you have to follow the principle "trust but verify". Trust that popular open source implementations are more likely to get it correct and enough eyeballs to spot mistakes, but verify/audit the code yourself if it really matters to you.

With open source implementation, you can actually verify it yourself if it really matters for you. With closed source implementation, you only have the vendor's word for it.

If anything, distrust over open source security libraries is a good thing; it makes some people to start auditing them before using, rather than just blindly trusting an implementation because they are popular.


What are the ways in which open proxies are risky? What precautions should I take? This question at Workplace and its top-voted answers state that using proxies to access filtered web content is extremely risky for individuals and companies, using pretty strong wording.

  There are many proxies out there that are honey pots. Access one, and they travel back through your computer into your company's network, then hit it with ransomware

I can hardly see how reading web content through an open proxy subjects the user to these risks. I am assuming that the user takes some precautions, including

not installing third-party programs for proxy access
not installing third-party browser extensions for proxy access
not entering his credentials or otherwise sensitive information in a proxy session
having updated software to prevent non-zero-day browser exploits

What risks are connected with using a web proxy that are not mitigated by usual web surfing precautions?

Simple - any content passing through the proxy can be Man-in-the-middled. This could include injecting malicious JavaScript that results in code execution within the browser with a zero day or spectre exploit.

ISP example of content injection

Use TLS and do not install any certificate required by the proxy - but all HTTP traffic will be at risk.

If this is a concern you would need to run the browser that connects to the proxy in isolation. A throw away VM with no network connection and hope there isnt an exploit used to connect back out to the host from guest.


CVE Description - Does impacted supported version mean specific version and older? I needed guidance on how to interpret

Supported versions that are affected are Java SE:
6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit:
R28.3.16.

The above phrase is from CVE-2018-2579.
Does it mean 8u152 and above are impacted or does that mean everything upto 8u152 and above uptil release with fix are impacted?
For instance, if we are running 8u144 - does it mean we are vulnerable?

I would say those specific versions are the only ones that are vulnerable. If there are multiple versions Oracle usually writes "11.0.x" for example, or "Versions prior to 8.1" etc. So when they explicitly write out a couple of different versions numbers, that's probably the only ones that are vulnerable.

Source: http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html (they are doing it right here on their advisory)

(but as noted in a comment, if you are using an unsupported version, then that can be assumed to vulnerable to all kinds of things and you would never know)


aircrack-ng issue: No mon0 when run "airmon-ng start wlan0" and "No such BSSID available" I have read many threads on StackExchange and some other blogs but none helped me. The issue is with aircrack-ng on Kali Linux. It gives me error No such BSSID available when I run aireply-ng. I think it is because of not having mon0 when I run airmon-ng.

root@kali:~# uname -a
Linux kali 4.19.0-kali1-amd64 #1 SMP Debian 4.19.13-1kali1 (2019-01-03) x86_64 GNU/Linux

I have updated the driver of usb wifi adaptor; RTL8812AU and it is the output of iwconfig.

root@kali:~# iwconfig
eth0      no wireless extensions.

lo        no wireless extensions.

wlan0     IEEE 802.11  Mode:Monitor  Frequency:2.422 GHz  Tx-Power=18 dBm
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

I think it needs to show the name of the adapter in the monitor mode, something like mon0 or wlanmon0 but it shows only 3 or some other numbers.

root@kali:~# airmon-ng start wlan0

PHY Interface   Driver      Chipset

phy0    wlan0       88XXau      Realtek Semiconductor Corp. RTL8812AU 802.11a/b/g/n/ac WLAN Adapter

        (mac80211 monitor mode already enabled for [phy0]wlan0 on [phy0]3)

I have read on some blogs that it does not really matter if there is no mon0; but it doesn't work at all and just give me the following error, No such BSSID available.

root@kali:~# aireplay-ng --deauth 100 -a MAC_OF_AP -c MAC_OF_TARGET wlan0
16:56:02  Waiting for beacon frame (BSSID: MAC_OF_AP) on channel 3
16:56:12  No such BSSID available.

P.S.
- I have tested it on Windows 10 and Ubuntu 18.10 hosts as well as Kali 2019 and ParrotSec. Both have the same issue.

In your output for airmon-ng, it says that monitor mode has been enabled for [phy0]3. This means that a new interface named 3 has been created which is using monitor mode.Therefore, 3 is the interface you should use along with aireplay or any other tools of the aircrack-ng suite. Try:
aireplay-ng --deauth 100 -a MAC_OF_AP -c MAC_OF_TARGET 3


How does Google save our passwords on their server? My friend recently told me that:

Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique identifier. This identifier goes to database. And it is unable to reverse engineer/decode the password from the identifier.

Is this correct? Is Google's database unhackable and un-decodable? If not, how are our passwords saved on Google?

Passwords should be stored hashed and salted
Because we must assume every database might get breached, plain text passwords should not be stored anywhere. Instead, the password should be hashed, which is a one-way algorithm, preferably using an algorithm that is slow to calculate and using different and long salt for every password. There are many articles explaining these methods in general, including CrackStation: Salted Password Hashing - Doing it Right.
Google account passwords
Unless Google has documented it somewhere (or the hashes were breached) we could not tell details about their implementation. We can only trust this giant is treating our passwords properly. But everybody makes mistakes, and even Google was actually storing plain text passwords in one of their solutions for 15 years (2005–2019). From Suzanne Frey: Notifying administrators about unhashed password storage:

Google’s policy is to store your passwords with cryptographic hashes
that mask those passwords to ensure their security. However, we
recently notified a subset of our enterprise G Suite customers that
some passwords were stored in our encrypted internal systems unhashed.
This is a G Suite issue that affects business users only–no free
consumer Google accounts were affected–and we are working with
enterprise administrators to ensure that their users reset their
passwords.

Knowing this, as a user you should:

Use a different password for every service. If one gets breached it does not affect all the others.
Use strong, long passwords. If a hashed version of a password leaks, it will slow down the process of offline brute-forcing it.

To achieve both, using a password manager is recommended. A good password manager stores all passwords encrypted with a master password.
While it would be most secure to only store the passwords offline, it might be more convenient to synchronize the passwords between devices. This synchronization should keep the store encrypted: the passwords should not be stored plain in the cloud nor the service provider should even know any of the passwords for 3rd party services.
Google Chrome password manager (not a good choice)
As mentioned in the comments, Google Password Manager is a case where Google actually do have your plain text passwords on their servers without hashing them, as it is the only way to keep them usable while every Chrome installation logged in to your Google account has access to them. This does not meet the requirements for a good password manager established above.
It is possible to disable the synchronization from chrome://settings/syncSetup/advanced by switching the Passwords option off. However, it does not make the local store secure.
More to read:

Chris Hoffman: Why You Shouldn’t Use Your Web Browser’s Password Manager
Mark Hachman (PCWorld): Google Chrome's new password manager makes securing Chrome even more important
Ed Bott (ZDNet): Is it OK to use your browser’s built-in password management tools?


How is resynchronization performed for security keys / MFA devices? When a MFA (time based) device security key drifts out of synchronization there is a procedure to resynchronize it.  But there is no input to the device itself.

Smartphone apps don't have this problem.  I assume this is because the app has access to the accurate clock from the telco provider(s).  Security key devices need to have their own clock or source of time, which can be attacked (receive it over a radio signal such as WWV or CHU in North America), or drift (internal clock).  I am guessing all the devices I have seen use an internal clock, because there many reports of them needing to be resynchronized, often.  But it is not obvious how this is done so quickly, or done in places with no clock sources.  It is also not obvious why an administrative setting is needed to resynchronize the device.

Can someone explain (or provide a good link that explains) how the device gets resynchonized?  I want to understand the degree of risk this might have.

For time based tokens there are basically two methods.

First of all, as the time In a token cannot be manipulated (either it is a isolated frob with bad clock or it is hosted on a system where you cannot influence the clock).

So what needs to be done is on the authentication server, you keep a estimated time offset (or more complex compensation model) and adjust it on each login.

Basically you compare the input from the current authentication with a few codes before and after the current code. If it matches you know a offset to apply next time.

This correction method can be as complicated as you want, since you don’t want to allow an attacker to influence your estimates or you don’t want to make the window too big as it allows more guessing. (For example keep a history of the latest 3 authentications and offsets and do a linear regression to find not only the offset but also the slope of difference)

If you decide that the time drift is too big (or you have no initial data for prediction) you ask for multiple entries. This will reduce the risk of accepting a repeating code (in a too wide timespan).

For the initial registration you probably want to allow a wider timespan before you reject a token (however be careful if the token has a broken clock and you accept the registration you might risk that a future login fails, which is more annoying than rejecting a device registration)

The exactly same mechanism applies to counter based systems as well (with the additional task to account for missed timer updates and luckily never negative offsets)


Can a hacked torrent client be used to prevent others from torrenting? Many pirated game/movie torrents these days have seed boxes which are basically dedicated servers for seeding. I was wondering if leech boxes can be set up by the publishers to delay the torrenting of games.

The speed of download of torrent is determined mostly by the seeder to leecher ratio. Lets say a hacked or custom made torrent client is set up which acts as a leecher. It would discard all the data as soon as it receives it and asks for it again. In this way it can easily soak up all the bandwidth of anyone trying to seed the torrent.

Well, eventually everybody else would be able to download it but it would take an entire month to do so. This would drive up day one sales.

You can poison a particular torrent with false IPs quite easily. The tracker is just a script that takes an announcement request over HTTP(S) with a torrent's infohash, the IP address and port of the peer, and some details about how much of the torrent has downloaded for that peer. The IP given is not required to match the source IP of the announcement.

There are a number of attacks beyond this, e.g. having peers at these address which return garbage data.

In terms of defense against this, modern BitTorrent clients are quite robust. For example, DHT allows the user to reach additional clients as long as it has contacted at least one legitimate peer. Clients also detect many common tricks to falsify availability and ban those peers for the remainder of the download. This means that for a torrent with any significant number of legitimate seeds and peers, the false peers would have to vastly (1000-to-1 or more) outweigh them in order to have any real effect. Of course the side-effect here is that the torrent jumps to the top of the list on search engines, because it appears to be very popular, which is the opposite of what most intellectual property holders want.


Is there a hash algorithm that can identify similar files or strings? Is there a hash algorithm that will help you identify similar files or strings? For example, the hash for ABC and XBC would be similar rather than radically different as is usually the case. I know of one measure of similarity, Edit Distance (http://en.wikipedia.org/wiki/Edit_distance). But this doesn't give you a hash for each input to compare, only a score between any two inputs.

Update

The comment by Andan (locality sensitive hashing, LSH) is what I was looking for. My motive for asking the question is I was wondering how LSH might be used in scanning for malware. Is it used for identifying malware? Why or why not?

Update

In line with Tom Leek's, answer I did some investigation of my own. I wrote a program that would XOR the bytes of a file with a predetermined "random" pattern (the seed didn't change). Then it would sum the total 1 bits. This would produce the Hamming distance from the random pattern to the file. Really, it wasn't a very useful metric as it basically (on average) was just halving the file size to come up with a number.

Some examples:

Two related executables I scanned scored 2684964 and 2738772 for a difference of 53808. They are definitely related (different versions of programs I wrote) but the value of 53k is close to half of the file size difference in bits: ~128k. So it's not a useful metric for determining similarity.

I scanned two similarly sized JPEGs that were definitely different images. They scanned as 3124915 and 3110981 for a difference of 13934. So their difference was "smaller" than the difference between the related executable, even though they aren't related. So it's not a useful metric for determining difference either.

Conclusion:

As Tom Leek, said, it's an open problem for a reason.

"Approximate matching algorithms" (still a NIST draft) or "similarity preserving hash functions" could be of your interest.  These algorithms are specifically designed to determine similarity between two digital objects. Some of the proposed algorithms till now (and useful) are (chronologically): ssdeep, sdhash, mrsh-v2.

To determine the similarity between objects these algorithms require a minimum chunk of data. Mrsh-v2 performing best in terms of minimum size required.

Mrsh-v2 seems to be really promising in terms of performance and minimum chunk size required, but still under development. I hope it potentially solves your issue of handling similar files.


How can a computer found on traceroute show all ports closed? I ran a traceroute on a website I'm connecting to and got the following output:

1  skyrouter (192.168.0.1)  3.989 ms  1.389 ms  1.916 ms
 2  * * *
 3  be397.pr2.thlon.isp.sky.com (2.120.11.8)  31.564 ms  40.750 ms  28.794 ms
 4  ae-3.r02.londen03.uk.bb.gin.ntt.net (83.231.221.45)  26.772 ms  27.799 ms  27.415 ms
 5  ae-3.r24.londen12.uk.bb.gin.ntt.net (129.250.4.23)  33.121 ms  27.261 ms  28.305 ms
 6  ae-6.r24.frnkge08.de.bb.gin.ntt.net (129.250.3.13)  37.456 ms  41.661 ms  59.803 ms
 7  ae-2.r02.frnkge04.de.bb.gin.ntt.net (129.250.5.53)  37.220 ms  41.979 ms  39.719 ms
 8  ve16-xe1-3-rt1-muc2.premium-datacenter.de (213.198.81.142)  42.982 ms  41.741 ms  40.887 ms
 9  104.28.20.80 (104.28.20.80)  41.024 ms  39.590 ms  38.321 ms

I nmapped the computer on the second hop and got this:

Starting Nmap 7.60 ( https://nmap.org ) at 2017-11-18 15:14 GMT
Nmap scan report for ae-3.r02.londen03.uk.bb.gin.ntt.net (83.231.221.45)
Host is up (0.027s latency).
All 1000 scanned ports on ae-3.r02.londen03.uk.bb.gin.ntt.net (83.231.221.45) are closed

Nmap done: 1 IP address (1 host up) scanned in 28.04 seconds

Sorry if this is a basic question, but surely if I'm able to make a hop to a computer one port at least should be discoverable? If it is, what alternative methodology can I use to find out what the open port it is communicating through really is.

Regarding the Nmap results, I have three remarks:

you only scanned 1000 from 65000ish available ports (130000ish when you add together TCP and UDP)
you might not be allowed to access any ports on that router. So called ACLs, access control lists, control which source might have access to a port or not wether it is open or closed.
there might very well be no ports open. Routers are IP (layer 3) devices, often embedded and built solely for routing purposes. Ports on the other hand are on TCP and UDP, which are layer 4.

As to your follow up question of „I can trace route it, there must be a port“:

What trace routing is is sending a packet to the final destination host over and over again, starting with a TTL (time to live) of 1 and increasing that TTL.

The specifications of IP say a router should inform the sender if instead of routing the packet further it was dropped due to a TTL of 0. (routers are to decrease the TTL on every hop by the number of seconds it took them to process, at least 1.) This is done in the form of an ICMP packet sent from the router to your machine and catches and correlated with the packet it sent out.

Hence, for you to be able to trace route the router, you do not need an open port. As it does send ICMP messages, it should however respond to an ICMP echo request and nmap is telling you that correctly (with “1 host up”).


How to protect against leaking Google Drive synced files from a stolen laptop? Our small company uses Google Drive to store some medium-sensitivity documents (they should not contain highly personal information, but still things that would be embarassing to leak and potentially benefit our competitors). Storing them in Drive has been a very convenient solution in our situation, and our employees would be resistant to moving away from it. Most people have installed the google drive desktop app, that syncs the Drive files to their own machine, and they like this feature too.

What I'm concerned about is a scenario where our employee's laptop would be lost or stolen, and the thief would access the hard drive, and thus these Google Drive synced files. What are my options to protect against this scenario? I would like to interfere with our employees' processes as little as possible, so I would appreciate the most convenient, but still secure solution. Some kind of encryption of files, folders or entire hard drive would probably be required, or is there another way? How could I enforce this on all users without too much extra work for them?

You could only sync specific folders from Google Drive, i.e. the ones used most often, while the rest are only available via online sign-in. However, it sounds like that is not what you are looking for, and it may be difficult to enforce.
Tighter access control, and even using multiple accounts per person. Mobile use may not need the same files as office use.
Full Disk Encryption is probably the best option here. Keep in mind that if the laptop is stolen while unlocked then the security will not be in effect.

While it's not actually necessary to encrypt the entire disk, I think that will be easier to set up.

My favorite solution from a security standpoint is not to store the files locally at all.

Perhaps providing a means to remotely sign in to in-office computers from the mobile laptops. Unfortunately, such screen mirroring requires quite a bit more bandwidth.
Migrating to cloud-based solutions, i.e. Google Docs and Google Sheets, or other services that are cloud-based and only accessed through the browser would be the best solution. I'm not sure what kind of documents you are currently dealing with so this might not be an option.

Obviously making sure that sessions are invalidated (signing out) when the device is stolen could be important, as well as detecting the theft to begin with.

Fortunately, with Full Disk Encryption, once the device is shut down, and assuming you have a sufficiently long Password, it is fully secure.

Many devices come with a Kensington Lock Slot which can be used to physically tie the device to its vehicle or something. Obviously many attack options are still available, but least it definitely will increase the amount of time needed for theft. (since simply snatching the laptop is no longer possible without breaking something first)

Finally, it is possible that there is some utility out there which provides filesystem-like access (i.e. a mounted drive, e.g. SFTP or other solution) without actually syncing the file itself. However, I'm not familiar with these options.


How do I securely store passwords in my database? Creating a database for a small question and answer platform and need a way to attribute or create a password protection scenario for the user table.

If you don't need to know the password but just check, whether or not the user has entered it correctly, store the password as a SHA1-Checksum of the password string (The checksum is obfuscated and cannot be deencrypted by anyone - but if you enter the same string, you'll always get the same checksum). Then, when the user enters the password, just generate the checksum of the entered string and compare it to the one in the database. This is also a common implementation for most online accounts


How to compare contents of encrypted files on decentralized system? I have three people: Alice, Bob, and Eva. Lets say Alice and Bob both want to share the same information with Eva, but we don't want Eva to know what the information is, and Alice and Bob don't want anyone to know what their secret is. How can we approach encryption so that the information XYZ is encrypted differently for Bob and Alice (ie, they can't compare results to figure out the source), but Eva can figure out they are equal without being able to de-encrypt them to the base state and know the information.

There is no in between, Eva connects directly with Bob and Alice, but Bob and Alice have no connection.

If you're asking whether two pieces of ciphertext can be compared to glean information, no. The whole point of encryption is to maximize information theoretic security, or in other words, minimizing the amount of information revealed by a ciphertext about the cleartext upon cryptanalysis. Ciphertext indistinguishability, a property of modern public key cryptosystems, is also relevant here. Essentially, the ciphertexts resulting from two pieces of text being encrypted with the same cipher should not have a guessable correlation with their original plaintexts.

Seeing as they have no mutual communication, you could ask Alice and Bob to provide signed hashes of the cleartext to prove they know the same information (without revealing the actual information), but there's little you can do with ciphertext.


HeartBleed and Closed Source Hardware like Cisco With the release of heartbleed how does one protect themselves with closed source networking hardware like cisco? Especially hardware with VPN variety.

Would it be best to replaced such systems with opensource hardware setups such as pfSense or OpenWall?

With closed source you cannot do much besides trusting the vendor.

But I think this is not so much a discussion about open or closed source as OpenSSL is  open source and the the bug was not discovered for years - so this is no guarantee at all.

Specifically for heartbleed you can i.e. deactivate the heartbeat functionality in OpenSSL which makes the attack impossible to happen.

In the wild I've seen companies, where I know that their servers where vulnerable, catching the heartbeat packages on the firewall/IDP level and making the attack impossible as no heartbleed packet was able to reach the server until they were able to patch the servers.


3rd party SSL security and having an extra layer of SSL I did a search and didn't quite find an answer to my question.

I have website that is integrating with a 3rd party for eCommerce and CRM. On my side I am collecting no data. I don't collect any login data, customer data or anything. To retrieve any data I need to log in to their site.

My site pulls various forms from their server that I code into my site via one line snippets. Looking at the source code of my site I cant even see the code of their forms.

If I get an extra SSL certificate for my site via my host, BUT their site/service doesn't have a good security layer for data being transmitted does it make a difference?

Thanks

This depends on how the data is being transferred.

Here's the thing: unless the attacker forces the client to use a weak cipher-suite SSL is supposedly unbreakable for something like a bazillion years. So as long as there are not unencrypted connections in this chain you're all set, regardless of how often your data is encrypted.

So that's the upside. Here's the downside: if, as you say, "their site/service doesn't have a good security layer for data being transmitted," then no, your data is not truly secure. If they don't support a strong encryption you can pretty much expect to be screwed (if someone decides to screw you, that is). Of course, it's probably in the eCommerce company's contracts to be responsible for the security of transactions, etc., so you're legally pretty safe (Although I doubt your clients will be particularly happy with you).

Like I said though, it depends on how the setup works. If this is a simple <iframe> or something similar, they're actually connecting directly to the eCommerce site, so you can't guarantee any kind of security. On the other hand you have a degree of stability if the information is routed through you, because there is an excellent defense against sniffing attacks: using wired connections. Unless someone physically penetrates your company it will be impossible for them to sniff your connection. So yeah, it doesn't matter how you transmit the information to the eCommerce company because you can be rather confident that an attacker never sees it (he can't connect to your network).

But here's the bottom line: if any sender or receiver of data in a chain of communications does not support strong encryption, the privacy of the information sent along the aforementioned chain cannot be guaranteed.


Can my ISP see my new IP when I am connected to VPN? So far I am aware of, after connecting to VPN I get new IP from its service; assuming no DNS leaks etc. all network goes trough encrypted channel.

Can my ISP see my new IP when I am connected to VPN?

If so, then it's security flaw which can be easily tracked back to me, which defeat purpose of using VPN.

The entire idea of gateway tunneling (over VPN in your case) is that any traffic flowing through the VPN is only visible to you. Hereby I'd assume the 'new IP' is nothing more than a temporary ip to exit the remote site towards the internet.

On the other hand you're ISP can always see where the VPN connection is going to, since there needs to be some sort of connection in order to tunnel traffic.


Is forwarding a port(s) a security risk to all computers on the network or just one? I know forwarding ports can add some security risk, but if I forward a port to a computer, say running linux, would it add a security risk to all computers on my network or just the one?

All computers.

Say whatever service is running on that port (e.g., web server, database server, etc) is found to be vulnerable to an attack that allows the attacker to execute any code of his choosing on the server (typically we call this a remote code execution attack). The attacker could leverage this to then begin attacking other computers on the network.

The safest thing to do would be to segment your network. If you have one server that needs to be accessed by the outside, put it in a DMZ. The rest of your network should go behind another firewall to protect them.


Is it safe to reveal information about the OS and the software you use? As in what OS you use, it's version .. etc.

Every time I go to the bank and I get greeted with the ATM in the following photo, this question comes to my mind.. Oh and it's still Windows XP till last week at least

Generally speaking, it is not safer to reveal information than to keep it by yourself (but this has exceptions). But "not safer" does not mean "unsafe". If it so happens that revealing information about your OS and software is positively unsafe (i.e. significantly increases risks), then:

You have a problem, because your software has known holes (otherwise it would not be risky).
You have a problem, because your security relies on the attacker not guessing what software you are using, i.e. the attacker not being competent at being an attacker.

If everything is well, then it should not matter whether you reveal information on your OS and software or not. In fact, it has been argued that revealing all the details is better because it allows for more people to contribute to the improvement of the system (that's the open-source mantra, at least). A variant of that theme is that the prospect of the source code being ultimately published and shown to the world at large helps the developer focus on his task. (This last one tends to fail because, as it turns out, many developers lack all sense of dignity and sense of self-worth, and thereby have no compulsion to write better code when external scrutiny is expected.)

In the case of an ATM running XP, the fact that it runs XP matters only for an attacker who can do network connections to that XP machine, and if he can, then he can normally obtain that information himself. Showing the XP login screen still demonstrates a lack of care of the fine details on the part of the system developer, which is worrying (in a general way).


A workaround for external website's HTTP registration page There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required.

When registering Firefox alerted me that the site was only HTTP, so I tried prefixing https:// and the page doesn't exist. I contacted the site administrator to ask them and they said:

  appropriate security measures have been provided to guarantee the personal data security. As for the SSL certificate (recommended by the GDPR), we will provide with this one as soon as possible.

I know very little about security, so I am hoping someone could tell me whether what they are saying holds water and it could be a secure site that has yet to use a SSL certificate (it seems unlikely if they are only using HTTP)

If the statement doesn't hold water, and the administrator agrees to it, is there a way that I can package and send the data to them securely by alternative means?

tl/dr: This company has no idea what they are doing.  If you want to protect your data, the only option is to refuse to do business with them.

Privacy and HTTP
The first question is whether or not it is possible to communicate privately over HTTP.  The answer is generally a solid "NO!".  HTTP is a plain text protocol, which means that every server in between your machine and the destination server has an opportunity to read, log, and do whatever it wants with any data transmitted over HTTP.  This is not a theoretical problem - there can easily be dozens of servers and switches between you and the destination.
Now technically it is possible for a website to perform its own encryption before transmitting data over HTTP, thus providing privacy anyway.  In practice though it is safe to assume that this is not happening.  The reason is because doing this (and more importantly, doing it well) is quite difficult.  Using an SSL certificate over HTTPS is a much simpler, quicker, and cheaper way of providing privacy over the internet.  It would be absolutely crazy to forgo HTTPS and instead attempt your own encryption over HTTP, especially since there are large parts of the HTTP request that you still wouldn't be able to encrypt anyway.  It wouldn't be a private solution even if you tried.
HTTPS
So to reiterate, HTTPS is the simplest and most effective way to communicate privately over the internet.  Especially since the advent of Let's Encrypt, it's also incredibly easy to implement and free.  There is literally no good reason for a website operator to skip HTTPS on any website that collects sensitive data.  It's really as simple as that.
The company response
So what about this company?  They don't have HTTPS.  They are transmitting your data over HTTP.  I can guarantee you that they aren't trying to encrypt it otherwise, and that really wouldn't work well even if they tried.  That means that your private data is being sent across the internet for everyone to see.  However, they say:

appropriate security measures have been provided to guarantee the
personal data security

Quite simply, this is complete B.S.  All this means is that they believe that their security measures are appropriate.  The lack of HTTPS conclusively demonstrates otherwise.  They dig the hole further on the next line:

we will provide [an SSL certificate] as soon as possible.

As we've already discussed, SSL certificates are free and easy to install.  "As soon as possible" happened literally 4 years ago.  This is nothing but an excuse for incompetence, which leaves your data at risk.
Finally you ask:

is there a way that I can package and send the data to them securely
by alternative means

Unfortunately you are asking the wrong question.  Imagine that you do come up with some way to securely send them data.  When a company has failed so completely with the basics of data security, can you really expect them to store and use your data in a secure and private manner?
You should simply assume that whatever information you send to them, regardless of how it gets there, will eventually be leaked publicly.  Because it probably will.
Next steps?
In the end you have to decide which you care about more: the possibility of getting a job from them or the possibility of having your private data leaked.  Only you can make that call.
They mentioned GDPR, so presumably they are in a region where the GDPR is in force.  Presumably they are violating GDPR, despite their claims otherwise.  This suggests that an obvious next step is to file a complaint with the proper government organization.  I'm in the USA so I have no idea what that entails (and it is more of a legal matter anyway, so not really on-topic here).  Regardless, that is unlikely to make change happen on a timescale you need it to happen, so once again you will have to decide between using them and risking your data, or ignoring them and risking the loss of a job opportunity.


How hard to receive a TCP packet then resend it to another IP on the local network keeping the Source IP address? I need to receive a TCP packet destined to my application, then resend it to another destination on the local network, while keeping the Original IP Address.

How can it be done, or how difficult is it?

I am using simple sockets in Java, running on a Linux environment, and I might consider using C libraries in my code if that does the trick.

I know routers or firewalls intercept such TCP packets, I am guessing they don't change the source IP.

This is achievable with TProxy in Linux, however I cannot say it has been very stable in testing.

I have implemented it in Java for TCP, had to use JNA to do native Linux library calls, as well as wrapping JRE Socket classes (based on this post, with extra changes done).

In summary, they steps are:

IPTables firewall module configuration.
Copy the address of the source socket.
Native library call to setsockopt with the IP_TRANSPARENT option, for the client socket to use the TProxy module.
Set the originating address in the outgoing socket

Apparently there are many implementations for it online, such as this one in Golang.


Cookie based session variables I have a situation in which I cannot use a server-side session, but must allow users to log in, and for their logged in state to be persistent between queries.

As with anything that involves crypto of any kind, I know how easy it is to make a mistake and just wanted some extra pairs of eyes to look over what I am proposing.

u = the unique, numerical user id
s = a global server-side secret composed of a long, random, alpha-numeric string,  64 characters or more

Upon login, I propose to set two cookies on the client.

The User ID: u
The Authentication Token: hash(u + s)

Upon subsequent requests, the server will use the given value of u and the known, secret value of s to calculate and compare against the given authentication token. If they match, this must be a valid user, right?

An attacker cannot generate an authentication token without knowing the secret, and so cannot generate a token for someone else's user account.

If I make the cookies relatively short-lived, an hour perhaps, and provide cookie-destroying logout functionality, even shared computers would be relatively secure.

The global secret s could be changed (perhaps by a daily cron-job) to protect against a long term brute-force on a known hash/userID pair.

Does this sound ok?

Edit:

In reading that through again, I realise the introduction of a timestamp would be very helpful. So a third cookie with the timestamp, and the hash would need to include the timestamp, the userID and the secret. Then a TTL could be set on the authentication token, and cookie expiry (which is not a remotely secure revocation method anyway) would no longer matter.

Your basic idea seems sound, but I'd recommend using HMAC instead of a plain hash.  So the cookie sent to the client would contain three values:

user ID u,
timestamp t, and
authentication token HMAC(s; [u, t]),

where s is the secret key and [u, t] is a string unambiguously encoding the values of u and t.

An obvious disadvantage of this scheme is that there's no way for a user to explicitly log out.  Unfortunately, this flaw is inherent in any scheme that stores no per-user state on the server.  As you note, making the tokens valid for only a short period will help to mitigate this issue, although I'd consider even an hour a fairly long period for such a purpose.

If you can rely on the user's browser running JavaScript, you could include a script that sends a background AJAX request to the server regularly to refresh the authentication cookie.  This could let you reduce the validity period down to, say, a couple of minutes.


Cryptography notation If I wrote RC5-32/12/16, it would mean 32-bit words (which is 64-bit data blocks). What is "words".

I know the 12 is rounds and 16 is key size (16 bytes, so 128 bit).

The word size can be 16, 32, or 64 bits, and it determines the block size.  "The algorithm assumes that the input block is given in two w-bit registers A and B..."  This allows for optimization based on the target architecture.

Reference: The RC5 Encryption Algorithm (PDF)


Sqlmap - appears to be UNION injectable I am using sqlmap for finding out sql-injection threat on our application.

http://myurl.net/question/teaching/answer/sujan-justice?as=Course

and i tried to perform the following:

sqlmap.py -u "http://myurl.net/question/teaching/answer/sujan-justice?as=Course" --dbms=mysql --level=5

Here is the Console :

 [11:35:46] [INFO] testing connection to the target URL
 [11:35:46] [INFO] testing if the target URL is stable. This can take a couple of
 seconds
 [11:35:47] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison'
 and provide a string or regular expression to match on
 how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] r
 please enter value for parameter 'regex': *
 [11:35:59] [INFO] testing if GET parameter 'as' is dynamic
 [11:35:59] [WARNING] GET parameter 'as' does not appear dynamic
 [11:35:59] [WARNING] heuristic (basic) test shows that GET parameter 'as' might not be injectable
 [11:35:59] [INFO] testing for SQL injection on GET parameter 'as'
 [11:36:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
 [11:36:29] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (MySQL    comment)'
 [11:39:25] [INFO] testing 'MySQL time-based blind - Parameter replace (MAKE_SET)'
 [11:39:25] [INFO] testing 'MySQL time-based blind - Parameter replace (ELT)'
 [11:39:25] [INFO] testing 'MySQL >= 5.0.11 time-based blind - GROUP BY and ORDER BY   clauses'
 [11:39:26] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
 [11:40:17] [INFO] target URL appears to be UNION injectable with 1 columns
 [11:40:55] [INFO] target URL appears to be UNION injectable with 5 columns
 injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] y
 [11:41:15] [INFO] target URL appears to be UNION injectable with 2 columns
 [11:41:36] [INFO] testing 'MySQL UNION query (71) - 11 to 20 columns'
 [11:41:38] [INFO] target URL appears to be UNION injectable with 17 columns
 [11:41:48] [INFO] target URL appears to be UNION injectable with 15 columns

Can anyone help me to know what does this line means:

[11:40:17] [INFO] target URL appears to be UNION injectable with 1 columns

I am not sure, but I guess it means that it's possible to perform sql-attack on the application. If that's right, then help me how I should do it?

The vast majority of databases do not allow query stacking.  In MySQL,  there is mysql_multiquery(),  which which allows query stacking and is almost never used.  So how do hackers exploit the vast majority of sql injection?   Using a simple Union Select!  As a pentester this is what I use more than anything else.

What SQLMap is saying is that your injecting into a query that looks like this:

select question from teachers where crouse='Course'

In order to exploit this query SQLMap needs to use a union select,  in order for this to be a valid query both select statments must have the same number of columns:

select question from teachers where crouse='Course' union select password from mysql.user-- '