How effective is antivirus software? On one hand, most antivirus websites claim their products are highly effective, and I've seen antivirus "test" videos claiming 95%+ detection rates for new malware (as in less than a day old, not old samples that have already been added to AV databases). In addition, just about every OS protection guide recommends antivirus software as the number one method of preventing malware infection.

On the other hand, I've seen other videos advertising crypter software that seems to render AV software useless. In many of these examples, the "crypted" malware is undetected by any AV systems, even when pitted against 70+ antivirus systems on online testing sites like virustotal. The fact that it's so simple to hide malware -- there are dozens of crypters, some completely free, available from a number of forums and websites, and usable by even the simplest script kiddies -- and the fact that these crypters are so effective, would seem to indicate that antivirus software isn't very effective.

So how effective are antivirus suites like Avast and Norton, and how could one explain the discrepancies between the 95%+ detection rates that are advertised and the prevalence of crypting software that makes malware virtually undetectable?

I worked at antivirus industry 12 years ago, so I'll try to explain, but it is possible that my knowledge is a bit outdated.

Each serious antivirus vendor has antivirus lab, whose work is split to:

detect new viruses and develop solutions for them: signatures, behavioral patterns for heuristic detection, specialized detection code, sometimes cleaning code etc.
identify new crypters and archive types, and develop code to decrypt original files

Both of these activities include infiltrating several forums and sites hidden from general public.

Better antivirus vendors, like ESET, Kaspersky, BitDefender etc., recognize and deal with hundreds (or today maybe even more) of crypters and archives, so from user perspective, most crypters are transparent and not affecting detection rate.

However there are also less serious antivirus vendors in the market, which recognize less crypters. So if you want maximum security, you should generally choose products from vendors that recently achieved VB100 award.


iOS traffic not shown in proxy when SSL pinning enabled I have and iOS application to test. As per the latest security fix SSL pinning is enabled in the app. But now I am not able to see any traffic related to the application in my proxy tool. But interestingly the app works as normal, just that the traffic is not showing up in the proxy.

I have tried with both Burp and ZAP. The application traffic were visible before SSL pinning was implemented. I can see the traffic of google.com from Safari(to confirm that I have configured the proxy tool's CA properly in the iOS device).

What could be the reason? From my understanding, if SSL pinning is set properly and when the proxy tool is introduced, the app should ideally drop all the communication.

I am confused whether it is not being transmitted via Burp. Or does it simply pass my proxy just like a DNS request(which obviously Burp can't see). Additionally I have read this article. It says for some reason Burp won't show up websocket requests if it uses a non standard port. But this is not my case. We don't have websockets.

Any help is appreciated.

This sounds like your instance of Burp may have auto pass-through enabled: https://portswigger.net/blog/ssl-pass-through-in-burp

Check your pass-through settings.


Decrypting SSL within Multiple Products I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate.  I cannot find any documentation on this subject online.

All of the traffic is currently flowing through the firewalls, from here if it is port 80 or 443 then it is being pushed through to a web filtering system.  The WEb Filtering system currently does SSL inspection, but the firewalls don't.  What would be the impact if I performed SSL Decryption at both the firewall level, and also at the Web Filtering level ?

Would the target URL be aware that multiple SSL Interceptions have happened?

Thanks,

Would the target URL be aware that multiple SSL Interceptions have happened?

In theory the target URL is not aware of SSL interception at all, no matter how many SSL interceptions you do. It only sees that it is doing the SSL handshake with some kind of client and can not see if it is doing the handshake directly with the browser or with some SSL interception device.

In practice it might be possible to detect an SSL interception device by the use of different ciphers or different cipher order or different protocol versions compared to the browser. Or it might be possible to detect interception by some other non-browser features, like accepting certificates the browser would not. But in this case only the device nearest to the server can be detected this way and further devices not, because they don't do SSL handshakes with the server directly.


Android Security - Giving Google Your Phone Number While setting up my Android account on my phone, I am asked

If you like, you can add this phone's number to your account ....
..for example you number will be used to:
Reset your password if you forget it
...

How is that in any way secure? So if someone picks up my phone and requests a password reset, it will be sent straight into their hands? By default, notification content is displayed on the lock screen, and that would include a short password reset SMS.
Now, I realise that physically losing your hardware is never a good thing from a security perspective, but let's look at some of the measures that are in place to protect you in the event that your device does fall into the wrong hands:

Users are encouraged to set a lock screen during setup
Account password is never stored on device, tokens are used instead
By default, debugging and bootloader unlock are disabled, and screen unlock is required to enable them
Even when debugging is enabled, screen unlock required to add new debugging client
Unlocking bootloader causes factory reset

All of the above seem to be undermined by the fact that with the default settings, you can display a password reset token on the lock screen.
Surely Google aren't that stupid? What am I missing here?

Yes it is quite a compromise of a Google account if you lose an Android device that isn't protected (with disk encryption + a lock screen). It is best practice to be able to remotely wipe the device. When you realize you have lost the device you should immediately log into your Google account on a PC to update the 2FA settings. You're not missing anything, using a phone number/SMS for 2FA is not good and I wish we'd stop requiring it.


How safe are encrypted files error-wise? If a non-encrypted document has a corrupt byte - we only get a typo. But what about an encrypted file? It seems, and please correct me if I'm wrong, that if the encryption is done right - every byte depends on the previous bytes. This raises a concern. If I make a disk image and have it done with encryption - perhaps there's a non-negligible chance that I won't be able to restore it.

I understand that even if I'm right - an exact answer will depend on the media type, age, etc. and even then - be quite a guesstimate. But I would like to have at least an order of magnitude of the prevalence of errors. (Or if my original assumption is wrong - I'd like to know that, of course.)

That depends entirely on the cryptographic algorithm used.  One of Claude Shannon's maxims was that errors should not propagate.  In the case of AES in CBC mode, a single bit error will propagate to two blocks.

Modern cryptosystems are likely to use a digest or other message integrity mechanism to detect tampering, so that in case of an error in the encrypted data, the entire ciphertext will be rejected on the basis that a mismatched digest suggests tampering.

Modern computing hardware is so robust that it probably doesn't make sense to worry much about errors.  if error correction is an important consideration, then data should have error-correcting codes added before encryption.  In that way, errors in the decrypted data can be corrected.  However, if decrypted data is accepted despite a non-matching digest, then tampering can no longer be detected.

Edit: Now that I think about it a {ahem} bit, a bit error in encrypted data is no more likely than a bit error in plaintext.  If you accept that a single-bit error renders an entire physical block of the disk unreadable, then a bit error in encrypted data the propagates to the next 128-bit block (AES, CBC) will also result in loss of a single 512-byte disk block 31 out of 32 times, and at most two physical disk blocks in the 1/32 case that's left.  Unless I've missed something in the probabilities, for 512-byte physical blocks, a bit-error in encryption corrupts one block 97% of the time and two blocks the remaining 3% of the time.

If you also accept that a single unreadable physical block means the file is effectively destroyed, then there's no error-rate penalty for encryption.

In any case, one defends against unreadable ciphertext in the same way one defends against unreadable plaintext: RAID and backup copies of files, being physically careful of disk drives, etc.


Can I use 3 same subkeys to 2 different GPG Smartcards? Generated keys on an air-gapped PC.
Backed-up my .gpg folder on a USB.
Imported keys to smartcard 1.
Keys deleted
Replaced .pgp folder with .pgp from USB
Imported keys to smartcard 2.

Is this setup valid and can I use same sub-keys with two completely different smartcards?

Is there a way to test those keys to make sure everything works correctly?

Yes, this should work as you described.

To test, try using the cards to decrypt files encrypted to your public key, use them to sign files and see if you can verify them using your pub etc.

In my limited experience the biggest issue with using the same keys on backup cards is that the system looks for the keys on a specific card, regardless of whether there's a copy of them on the currently-inserted smartcard. When I had that issue deleting my gpg directory (already backed up elsewhere) and running gpg --card-status cleared it up.


Different Nmap results on MacOS and Ubuntu 16.04 I did a Nmap scan with this command:

nmap -sn -n --scan-delay 1s <ip range> -oG -

In Ubuntu 16.04, with Nmap 7.01, I'm getting different results from each scan.

In MacOS X 10.13.3, with Nmap 7.60, the result is the same every time.

The results that I am getting are a list of IP addresses. I use awk in my command to obtain this list of IPs, but that is not the problem and for that reason, I didn't write this part of the command in this post.

The scan is a internal network scan via VPN. In the case of Ubuntu, this conection is realized via Ethernet and MacOS is stablishing the conexión via 3G and, in other tryings, Wifi, in the same network where the Ethernet is connected.

The Ubuntu machine is a virtual machine, VmWare NAT, installed on Windows 10.

Extra Test

I tested with Kali Linux 2018 and Nmap 7.60, creating no-sudo user and using it, and happened the same.

Why is it happening?

The reason of this problem is the NAT network. Analysing the network with Wireshark, I saw that the TTL number was 128. This is because in the NAT network recive the packets and recreate them. This cause problems on Nmap analysis. So, the solution is use a Bridge connection on vmWare or use Nmap on native OS.


Can a malware infect just by right clicking? Someone I know got infected. He sent me the file to analyze. I downloaded the zip and it contained a scr file. I unzipped it and right-clicked to open it in Notepad++. It immediately got quarantined by my AV (Security essentials) and I could not view it.

Then the same guy told me that his AV (McAfee) has also quarantined it. However, next day he was infected. (Login was attempted on his bank accounts and email.)

I am now worried. Is it possible to get infected just by right-clicking?

OS is Windows 7.

EDIT: there was a difference in how I opened and how he opened. I right-clicked, while he double-clicked. Both of us got "quarantine popups".

Strange thing is that McAfee does not catch the virus:
Virustotal scan results

So my theory is this:

He double clicked and it ran, then it downloaded some other virus files which were recognized by McAfee. This was what likely quarantined the virus.

I certainly hope that right-clicking on a malicious exe (renamed to scr) should not allow arbitrary code execution, unless there is a serious flaw in Windows.

EDIT2: As suggested by Daniel Ruf, here is the Malwr.com analysis.

You're basing this on the assumption that the scr file was the source of the infection as supposed to a backdoor downloaded by an established trojan. It is possible to get infected from a number of different ways, including a preview thumbnail. Hence why you should always perform malware analysis using virtual machines or seperate dedicated hardware.


Where can I find a list of checksums for windows files? Why don't MS sign all their executables? Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name?

I could do the same by decompressing files on a windows setup CD, and checksumming them, and then doing the same thing to all installed updates via WSUS and some scripting, but this seems like a lot of work. There must be an easier way!

Do Microsoft release such a list?

As an additional, related, question - why do MS sign so few of their executables? Obviously the PE loader only verifies signatures when things are loaded in to kernel mode, but is there any reason why MS don't simply sign all executables? It'd sure make verification a lot easier.

Some software on MSDN has hashes published but I can't find a way to get a decent list.

They don't appear to publish hashes in the download centre either.

As I understood it though, any software issued through Windows Update should be signed and certainly all 64bit Windows software should be signed.

Can't really think of a reason they don't sign everything other than the overheads of maintaining signing keys for such a large set of software. You certainly would have expected their build process to automatically sign any release software.


Is it possible to prevent unauthorized copying or recording of data by photographing screens? I am thinking on a way which would prevent unauthorized copying or recording of data by photographing screens.

I also think, if the content of a screen is understable for an eye of a living human, it is also photographable by any mobile.

Thus, I think, in general case, the answer is "no". I am right?

Extension, problem details:

As I explained in comments, the primary security objective is to protect sensitive data from employee working on it.
A secondary objective is to protect it from non-employee (and thus, having passed generally much easier security criteria).
The effective solution of this problem is clearly social and obvious (no-cam policy, etc).
The goal is here to find the (admittedly narrow) possibilities of the technical defenses, if there is any.

There is mainly two kind of people to consider in this question:

The person working on the computer. This person is your employee, they went through your HR screening and abides by your policies. They have been trusted to access and work with some data. Due to this, since they need to see, no technical measure can prevent them from taking photographs (using a phone, a pen camera, ...), taking notes or remembering what they saw.
The people around the computer. The computer could be a laptop in an airport or at a customer site, a desktop at a front desk etc., the other people may be unknown people, customers, or even other employees. Here the issue is not the same, and for this use-case you can buy privacy screen filters. These filters reduce the viewing angle of the screen, ensuring that only the person right in front of the screen can see its content (this person being obviously assumed to lock the computer when not in front of the screen).


Why must I send certificate and private key when make HTTPS requests? In my company, we are issued .p12 files and extract the certificate and private key like so:
openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys
openssl pkcs12 -in path.p12 -out newfile.key.pem -nocerts -nodes

These are now in PEM format, and when making any call to a web service, we must send the credentials like so:
with requests.Session() as s:
    s.cert = (cert_file_path, key_file_path)
    r = s.get(some_url, verify=False)

As I understand it, the CA generates a certifcate (and public key) along with the corresponding private key and packages these in a .p12 file. The certificate is signed using the CA's private key, such that when sent, the certificate is proof that I am who I say I am as a trusted user. But why do I send the private key? Shouldn't that be kept on my system?

You don't send the private key, your software will use the private key to prove that you are the legitimate holder of that certificate.
Metaphor: physical driver's licenses instead of certificates. Imagine you get your hands on someone else's driver's license (or a copy of it). That's ok because it's a photo ID, the person you present the driver's license to will check that you match the photo.
Certificates work the same way, except that instead of a photo, the certificate contains a public key, and you need to create a digital signature using the matching private key in order to prove that you are the legitimate holder of that certificate.

See our canonical answer:

How does SSL/TLS work?


Using unique email address for online signups? After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security.

We can only do so much too protect ourselves because at the end of the day we have to trust the companies whose services we use to do their part in protecting us.

Nevertheless, I'm curious if using a unique email address for each online service adds a layer of security which increases the difficulty of social engineering attacks.

For instance, instead of using the same email address, e.g. joshu@mydomain.com I would use something such as github_a4f3@mydomain.com or github_cliche@mydomain.com. The _a4f3 part of the email address would be something random that has no specific meaning and makes it harder to guess than just using github@mydomain.com.

Alternatively, instead of some random string, using diceware to add a real word.

Is there any value in doing any of this?

What you are thinking of should provide better security than using a single email address for everything. However, it is a major pain to manage. Major inconvenience is the worst enemy of good security because you will eventually break down and stop following your system.

What you should do is separate your identities. For example, there is no sense in using the same email address for both your Facebook or Twitter account and your bank account. Even worse, there is no sense is using the same email address for personal correspondence and business matters. For example, this guy was using the same email address for both his personal Amazon account and his startup's AWS account. It is generally a good idea to keep distinct identities for this purposes.


What is the risk of reusing the ATM Pin elsewhere when they tie to EMV cards? What is the risk in the following scenario:

A bank wants to use an ATM pin (debit card and/or credit card) as an additional form of authentication after the customer logs in to her online/mobile banking platform
As the bank owns the cards, it may select to use the ATM pin in whichever way it wants, so it does not violate any compliance requirement
Also, assume that all the cards use EMV i.e., chip and pin

If criminals steal all of the ATM pins, what can they possibly do with it?
What is the risk exposure to the bank in this scenario?

Intercepting the pin on the internet, and knowing it's the same as the card PIN would leave you more susceptible of a targeted attack aiming at procuring the card.

Granted that if the PIN can be intercepted, then most likely the other credentials are as well, and the attacker could perform an attack on the banking site.

Bottom line, don't put user at physical risk.


GDPR - Personal Data breaches for invoices A short question and scenario.

Company X  receives by mistake invoice of Company Y ( there is no relation between them ). Company X is reporting the case to Controller : - invoice is not mine , please send it in the right place.

Y's Invoice  contains a name and surname of a employee working in this company.

Would this personal data detail count as a data breach ? should company Y be informed about this breach?

Br

Whether the name is stored on paper or somewhere else does not matter. When you leak personal identifiable information (PII), which a name and surname are, it is regarded a data leak. This is what is a data breach under GDPR article 4:

  ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

Article 33 states the following regarding the mandatory notification:

  In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. [...]

Just a name and surename is unlikely to result in a risk for the individual and it is therefor not mandatory to notify the supervisory authority. Please note this might be different depending on the area where you work, an invoice for renting a pornographic movie for example might be harmful to someone. In the end, you are faced with a decision regarding the severity of the incident and if you should report it or not.

As you can read here, you should be asking yourself the following questions to determine if you need to file a report or not.

What Happened? What kind of incident was this, did you leave an AWS bucket with all of your users financial data protected or did you just send the wrong customer the wrong email?
How many people were affected? Is this a large-scale breach or is it limited to just a handful of people. Most literature around GDPR puts the cut off for “large-scale” at 500 data subjects.
What personal data was compromised? Is this just a customer’s name and email address? Or is it more sensitive data like financial information or special categories of personal data?
What is the risk to the affected data subjects? Worst case scenario, what could be done with this information to harm the data subject either financially, materially or reputationally?
What caused this situation? Was it an attacker exploiting your security? Was this a technical mistake? Human error?
How easily can this issue be mitigated? Will this take months to fix or is this just a simple tweak? When will you be able to accomplish this?

If you can answer those questions, you should be able to weigh what risks this personal data breach could pose to those affected and whether or not this incident rises to the level of reporting.


What are the most effective ways to stay anonymous in the internet? I wonder how hackers can stay anonymous in the Internet. I have some ideas like using TOR or a chain of servers (for example a few SSH tunnels through different countries) but which of them are common? Are there more promising ways to stay anonymous?

Go to a cafeteria where free Wi-Fi is available. Take your laptop and run  Tails Linux from a USB stick: your Internet connections will go through the Tor network which is the best implementation of onion routing, and offers very effective cryptographic tools to secure your online exchanges; and whatever you do  no traces will be saved in your USB stick -unless if you choose that explicitly by modifying the default settings.


Ways to reduce supply chain risks for java apps What are the best practices for supply chain risks reduction for java applications? In my opinion java dependency management has the following downsides:

Java applications use 3rd party dependencies and compiled jar files are usually downloaded from artifactory (in compliled form, not like source code);
Although jar files can be signed almost no one adopted signature checks; I haven't seen any build system that checks signatures by default and breaks builds in case of mismatch;
Developers can add dependencies just listing them in project files (for example, pom.xml) and they'll be resolved and downloaded during build;
Almost anyone can add jar library to an artifactory;

Are there any good approaches to cope with the downsides above?

Like I mentioned in my comment, supply chain risks can't be completely eliminated. This question, which I also linked to, explains it rather well.
Let's have a look at each specific point of concern:
Dependencies are downloaded as already compiled code.
This could be because the dependency is some proprietary code and source code is not available, or simply out of convenience.
You could either decompile and reverse engineer what the dependency does, or analyze the source code if available. The problem is, nobody does that. It's thousands of lines of code - your developers already have an enormous codebase to deal with, so asking them to basically learn a whole new codebase for every dependency will get people to question the sanity of whoever ordered that. In other words: Analyzing the source code for every dependency, just to ensure it doesn't contain any bugs or backdoors, will bring development to a standstill. And then you have to assume that programmers will spot the backdoor. Just for fun, here's a backdoor:
if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
        retval = -EINVAL;

Try finding it. Keep in mind that this is 2 lines and you know there is a backdoor. Now imagine playing the same game with thousands of lines of code, and not knowing if there is one.
Problems with Jar Signatures
The fact that signatures are not checked by default is a feature. Requiring every Jar to be signed is not something that most developers care about - still only takes a handful of flags to enable that, so that's not the issue.
Problems arise only when developers of some library you want to use don't sign their Jars. Either use a different library or ask the developer to sign their Jars. However, even signed Jars don't stop an attacker from inserting a backdoor into the source code, depending on how well the signing practices of the developer are.
In essence, signing jars can help, but it's not the be-all-end-all of supply chain attacks. And against a malicious developer, it doesn't protect at all.
Developers can add arbitrary dependencies
Yeah, the point of build systems is to be easy to use and add as little friction as possible. That means developers are encouraged by the system to just add what they need.
Now, a responsible developer would consider the downsides of adding a new dependency to a project, weigh in whether this would be a reasonable thing to do or not, and then check how trustworthy the library and its developer is.
A less responsible developer just adds a library that sounds kind-of like it does what they need it to do, and then just see if it works. All an attacker needs to do is create a package named html-parser or json and tons of people will fly to it.
In summary...
nothing you can really do in practice. You can do the things suggested in the linked answer, such as running separate environments, doing code audits for specific versions, etc.. Aside from that, you just have to trust.


Secure Communication Between .Net Application and Website Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our application to check for the User validity and those ideas came up

Using WebClient to enter to our website and log in using the user
provided credentials : However, this might be vulnerable to MITM
attack.
Using the first approach but using SSL certificate (to make sure
that we are connecting to our server and not the attackers') :
However, Fiddler can easily do a MITM attack and de-crypt the SSL
communication, which will result in the same vulnerability as the
first approach.

Due to the internet's lack of documentation of what we need, we had to ask here for someone to explain how could we make sure that:

Our application only connects to our server and not any fake hosted
server (by the attacker).
The communication is secure. Not altered or edited some how in order
to grant unfair access to our application. (by sending a fake
response to the app or editing the original response before the
application receives it (replay attack)).

You can't prevent a sophisticated user from cracking the application. The only thing you can do is make your security measures hard to circumvent.
From what I understand your application provides all functions unless your server says "don't". You have several ways to achieve this

Plaintext: Easy to circumvent. Edit the hosts-file, write a pseudo-server, done.

Encrypted transport: Slightly harder to circumvent. Add a Root-CA certificate, write a pseudo-server, done.

Encrypted message: The application generates an encrypted request, the server answers with an encrypted response. Hard to circumvent on network level. You would have to extract the key from the application (which can be obfuscated in the code). You should use nonces here to prevent replay attacks.

Always possible: Find the instruction that says yes/no inside the application, patch it to always say yes, done :-)


How do I continue pentesting with access to local station? I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an local administrator account, if nothing else then through offline cracking of the poorly encrypted local passwords.

However, once I have secured access to the local admin account, I do not know how to continue on. The MsCache is strong, and rarely contains anything worthwhile, I even read that most good admins turn caching off.

The most promising things I have seen so far was the pass-the-hash toolkit, based on dumping LSA secrets, which promised to "compromise a whole Windows domain after compromising a single machine that was a member of that domain." However, that failed to work on the Vista domain I am pentesting right now.

What are the general strategies in this situation? What are the specific ones?

General strategies - Red Teaming Analysis

Abuse identity and authentication -> Target: People and credentials -> RDP, SSH, more consoles, portals
Exploit privilege and trust -> Target: Infrastructure -> Utility Manager, Sticky Keys, NT Domain administrator, Unix root accounts
Attack data structures and data handling -> Target: Services, Apps -> Client executables, Client-to-server traffic, Server-side controls
Subvert the supply chain -> Target: OEM software and hardware -> "Get there first"

You may want to check out the recent attack vectors and strategies on the Irongeek Derbycon 4 video page.

Specific strategies - Scenario Analysis

Trustwave has a few blog posts that link to some of their homegrown tools, as well as links to other known attack tools/techniques.

http://blog.spiderlabs.com/2012/12/my-5-top-ways-to-escalate-privileges.html
http://blog.spiderlabs.com/2013/09/top-five-ways-spiderlabs-got-domain-admin-on-your-internal-network.html
http://blog.spiderlabs.com/2014/02/responder-20-owning-windows-networks-part-3.html

For general strategy 1, most professionals tend to employ "social engineering" techniques, perhaps using the Social Engineering Toolkit (SET) or related tools such as recon-ng, esearchy-ng, FOCA, et al.

General strategy 2 is the most common attack vector from your position, and these Trustwave blog posts mostly suggest ways of focusing in on this strategy (or perhaps also general strategy 4, which may require patience or social engineering to get people to act on your well-placed traps). However, a great resource are the first few chapters of the book, "Defense against the Black Arts: How Hackers Do What They Do and How to Protect against It". There are also many Metasploit and nmap mechanisms that can aid in the general strategies. Attacking infrastructure may sometimes begin with a classic vulnerability scan. Custom vulnerability scan development will teach you the basics that network vuln scanners will not, so I do recommend using vulscan over OpenVAS, Tenable Nessus, Rapid7 NeXpose, or Qualys QG if you are a completist.

If you do plan on attacking either networks or apps, I suggest learning a lot about those domains. For example, knowing networks could involve learning Wireshark-related tools and methods, along with strong network engineering skills. You'll typically want to learn all of the internals of traceroute/0trace/lft, sslyze/ike-scan, and bnat/nmap/amap. When you start using firewalk, qscan, osscan-guess, traceroute, and packet-trace with nmap, then you'll understand how to combine methods well -- although basic issues like banner grabbing must also be mastered.

Apps are the hardest domain of penetration testing. My suggestion is to learn as much as you can about your target applications: their primary interfaces (e.g., for webapps, try webshot) and their various configurations. Then, move on to their internals by learning how to build and code apps in a variety of environments. If you understand the entry points to the applications, you can begin to learn to look for low-hanging vulnerabilities and spend an extra amount of time bringing them to full exploitation once you verify a vulnerability. Typically, for web apps, you'll need a good crawler to back up your existing domain knowledge (e.g., the Discovery-section of seclists found in Kali Linux) and a proxychain to analyze and attack using fault injections. My favorite open-source crawler and my favorite open-source fault-injection tool is Arachni (the autothrottle and other plugins are good introductions to web app pen testing). Eventually, you'll want to move to commercial tools such as Burp Suite Professional or Acunetix WVS, but there is no need to rush it when you don't understand the basics (as I alluded to with net vuln scanners above).


Use MAC Address to Identify Laptop Model? Is it possible to use the first 6 characters (D8:9D:67) of a MAC address to learn the model/version of the device? For example, this MAC address belong to Hewlett Packard. But they manufacture printers, laptops, desktops, tablets, etc... Are there any public databases to help give some idea what kind of device the MAC address belongs to?

A mac address doesn't identify a specific model of a device, but rather the  the likely manufacturer.  IEEE is the registration authority that contains a list of manufacturer prefixes.

This will ONLY tell you the likely vendor of the network device.  I say likely since MAC addresses can be changed programmatically to any value you want on most operating systems (I know Linux can).  This means I could be running a HP network card or usb network adapter, but alter my mac address to report HTC as the manufacturer.

Another issue is that the network device talking to the network may be a third party device such as a USB network adapter (ethernet or WiFi), and have nothing to do with the original laptop.

There are methods of fingerprinting a network device (NMap can do this), but those methods are not very reliable on anything except the most common of hardware.


What kind of misconfiguration may lead to publicly accessible webserver logs? While Googling for a few rare user agent strings and URL paths, I stumbled upon a few websites that have their webserver logs publicly accessible.

Investigating further, I found that this is not an uncommon problem, as Googling for "inurl:log intext:Mozilla/5.0" will demonstrate.

My question is: what kind of misconfiguration may allow for logs to be publicly accessible? These logs are usually stored in a different directory, and I can't seem to find a reason why logs would be made accessible in this manner.

There are quite a few possibilities:

Someone has changed the log storage directory through a .htaccess or similar configuration file, and the new location is unintentionally within the web root (e.g. they put var/log/apache instead of /var/log/apache as the target)
The system has been set up like this with the intention of an IP block preventing access to the folder, and the IP block has been forgotten or disabled
An alias has been put in place, in a similar way to the /manual default alias in Apache HTTPd (see Google for many examples)
There is an automated log analysis program running which exposes the log data in some way, and no protection has been implemented for this

Essentially, people are endlessly creative when it comes to making mistakes, and log file access is no exception to that!


Adobe Flash and Meltdown / Spectre Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as good as dead, so that's not affected. But even though the technology is dwindling, Flash is still out there.

I haven't found any information about patches for Adoble Flash Player. Should we be concerned about attacks using the Flash executable code? Is there any other mitigation than the mitigation strategy of disabling it altogether?

I cannot find any official statement from Adobe about the problem. But, Flash seems to have bytearrays shared between workers which are similar to SharedArrayBuffer in Javascript and probably can be used for high precision timing. Therefore I think that running Flash content can actually increase the risk of a Meltdown/Spectre attack. Still, given the security track record of Flash I think that there is already a large risk when using Flash in the first place and that Meltdown/Spectre attacks only add a little bit on top of that.


Write blocker, blocked operations In forensics, write blockers devices should block every operation that might change the hard drive content.
Besides the write operation what other operations should a write blocker block?

The concept of a write blocker is to ensure the forensic integrity of a system while simultaneously forensically imaging that system. This is accomplished by permitting read-only operations to a file system, thus a write blocker will prevent all write operations by intercepting them and either translating them into a read operation (if possible) or simply disallowing the write operation.

For instance, a hardware blocker may simply just not include the physical connections for writing (as with USB) and a software write blocker may intercept otherwise write operations -such as disallowing metadata to be changed when viewing an image.

Taken from here:

  The United States National Institute of Justice operates a Computer Forensics Tool Testing (CFTT) program which formally identifies the following top-level tool requirements:

  A hardware write block (HWB) device shall not transmit a command to
  a protected storage device that modifies the data on the storage
  device.
  An HWB device shall return the data requested by a read operation.
  An HWB device shall return without modification any access-significant information requested from the drive.
  Any error condition reported by the storage device to the HWB device shall be reported to the host.


Is uncompromisable obfuscated x86-64 execution possible? I have a problem which has several layers;

Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus their resources too.
Actor A wants to run application 1 (a container) that gets scheduled on a computing resource provided by actor B, B is malicious to user A and wants to sniff on app 1, prevent this.
Execute a OCI (open container initiative) Container on an untrusted host in such a way that prevents unauthorized node-local admin access to resources or running state.
Execute a x86-64-compiled program in such a way which is hidden/shadowed to the executing resource (the CPU and memory) while being resistant to tampering.

The above problem can be shuffled around (encrypt program state/instructions and allow supervisor to access the underlying resource), but mostly it would push the problem around (the supervisor can be compromised by malicious hardware).

What I want to achieve is provide containerization resources in a zero-trust environment, by cryptographically/mathematically/logically making the program state uncompromisable to and beyond the level of the actual final decoded CPU instructions, I assume that anyone (with enough time) would be able to sniff and scrap together a complete saved and snapshotted state of the application, if they had complete access to the hardware, and/or create custom versions which highjack instruction flow.

I want to create a black box from off-the-shelf computer hardware, and/or standard instruction standards, which the actor only has to give compute resources to to make it run.

I want to be able to not trust the hardware it's running on, the CPU. Is this possible in any (practical) way?

No, nothing that is secure anyway.

Currently available systems are standard methods of making sure an app can't be run without a license. However these can be reverse engineered relatively easily.

Secure obfuscation is a topic of current research. So far it has not been implemented yet but mathematicians are working on it. One method is using cryptographic multilinear maps.


Certificates(CA certificate and EE/Local certiificate) There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific.
For authentication using PKI, below are the steps.
--> Get the CA certificate and load it onto the device.
-->Generate a private and public key pair
-->Request for a local/EE certificate.
Now, the steps followed for those are:
Step1:request security pki ca-certificate enroll ca-profile entrust
Received following certificates:
Certificate: C=us, O=juniper, CN=First Officer
Fingerprint: 46:71:15:34:f0:a6:41:76:65:81:33:4f:68:47:c4:df:78:b8:e3:3f
Certificate: C=us, O=juniper, CN=First Officer
Fingerprint: bc:78:87:9b:a7:91:13:20:71:db:ac:b5:56:71:42:ad:1a:b6:46:17
Certificate: C=us, O=juniper
Fingerprint: 00:8e:6f:58:dd:68:bf:25:0a:e3:f9:17:70:d6:61:f3:53:a7:79:10
Do you want to load the above CA certificate ?
[yes,no] (no) yes
Question: Once the device gets the CA certificate from the CA server, how does the device verify that its the right server from the fingerprint?
Does saying yes on prompt automatically means that Im trusting the certificate and Ive verified the fingerprint through some OOB means?
And also, the Hashing and encryption is done for the whole certificate content or just the public key of the CA server?
Step2: user@host> request security pki local-certificate enroll certificate-id
In this step, we request for the local-certificate after we generate the key-pair.
Question: Once we obtain the local-certificate from the server, how do we verify that its from the right source or server and authenticity of it?
Is there any signature decryption done? Or does it trust it because we have configured that server under the ca-profile?
Even if it decrypts it, does the device do it that quick? And also, does all the decryption and comparison has to be done manually by a human?
Step3: Lets say a tunnel has to be formed between A and B. A sends the local-certificate to B and B sends it to A.
If Im not wrong, the local-certs contains their respective public keys.
user@host> show security pki local-certificate certificate-id hello detail
Certificate identifier: hello
.....
Issuer:
Common name: Example-CA,
Domain component: local, Domain component: demo
Subject:
Organization: o1, Organization: o2,
Organizational unit: ou1, Organizational unit: ou2, Country: US, State: CA,
Locality: Sunnyvale, Common name: cn1, Common name: cn2,
Domain component: dc1, Domain component: dc2
Subject string:
C=Example, DC=dc1, DC=dc2, ST=CA, L=Sunnyvale, O=o1, O=o2, OU=ou1, OU=ou2, CN=cn1, CN=cn2
Alternate subject: "user@example.net", user.example.net, 192.0.2.1
Validity: .......
Public key algorithm: rsaEncryption(1024 bits)
30:81:89:02:81:81:00:b4:14:01:d5:4f:79:87:d5:bb:e6:5e:c1:14
..
Signature algorithm: sha1WithRSAEncryption
Distribution CRL:
http://example.example.net/CertEnroll/Example-CA.crl

Use for key: Key encipherment, Digital signature, 1.3.6.1.5.5.8.2.2,
1.3.6.1.5.5.8.2.2
Fingerprint:
76:a8:5f:65:b4:bf:bd:10:d8:56:82:65:ff:0d:04:3a:a5:e9:41:dd (sha1)
8f:99:a4:15:98:10:4b:b6:1a:3d:81:13:93:2a:ac:e7 (md5)
Above example shows a local-certificate, and lets say B receives it from A.
How does, B authenticate the certificate? Or how does it know that it has come from A?
I know there is a signature verification done, but what is decrypted and what is compared to prove that the peer authentiicity.
I have gone through documents, but it has not provided me  with a clear picture, so I have come here for the answers.
Thank you.

Does saying yes on prompt automatically means that Im trusting the certificate and Ive verified the fingerprint through some OOB means?

Correct, so it's the user's responsibility to verify that these are the correct certificates.

And also, the Hashing and encryption is done for the whole certificate content or just the public key of the CA server?

It's definitely possible that the complete certificate is hashed. Other options are to only hash the subjectPublicKeyInfo ASN.1 structure in the certificate, or only the subjectPublicKey inside that (i.e. the public key with or without algorithm identifier).

Once we obtain the local-certificate from the server, how do we verify that its from the right source or server and authenticity of it?

The Simple Certificate Enrollment Protocol (SCEP) ensures that using the trusted certificates installed in the first step. This involves encrypting the certificate request for the CA and verifying the signature after the certificate is returned. All this is completely automated and requires no user intervention.

How does, B authenticate the certificate? Or how does it know that it has come from A?

It has to trust the CA that issued the certificate. And it uses the identity (e.g. the subject DN or a subjectAltName, e.g. a FQDN or an IP address) to verify it is the correct host.

I know there is a signature verification done, but what is decrypted and what is compared to prove that the peer authentiicity.

There are several aspects to this. Host A will provide a signature with its private key as part of the the authentication protocol (e.g. TLS or IKE), which B verifies with the certificate received from A (basically the signature is decrypted and the data is compared to locally produced authentication data). The second aspect is verifying that the received certificate is trusted. For that B builds a trust chain to a trusted CA certificate and the signatures in that chain are verified. And as mentioned above, the identity of host A also has to be confirmed by the received certificate.


is -nU an option with nmap? My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled by default and -sU had to be used for udp to be scanned. Is this correct?

-nU is not a valid Nmap option. You are correct that UDP will only be scanned if you use the -sU option.


How to properly disclose a security vulnerability anonymously? Let's say I found a login-bypass/root-backdoor in a software my company uses that gives you root privileges within that software by simply entering a keyboard combination.

I've reported this within my company and to the company that provides the software but neither really care despite the possibility for major security risks and also legal risks due to this (the software reports production numbers and makes calculations for BI etc.).

I tried the combination with other software products from the same vendor and these also have the same backdoor. How should one proceed in disclosing this anonymously (as I know other companies that use this software) so it won't have consequences for myself which I fear because we have ongoing business relationships with that vendor.

Trying to go trough a third-party might help in this case.

One of the main company in this area is the zero day initiative. You could probably report your flaw to them or another third-party. Depending on the importance of this flaw, you might receive monetary compensation for reporting the flaw.

Those company usually have way more connections and leverage than an average independent person.


Understanding preg_replace Filtering & Exploitation Here is the proof of concept of the code:

<?php
$input=$_GET['input'];
print preg_replace('/[A-DH-M0-9._%+-]+@(.+)\.[A-Z]{2,4}/mADsex', 'strtoupper("\\1")', $input);
?>

I don't quite understand what the filter does, all I understand is that it should change the following letters [A to D], [H to M], [0 to 9] into uppercase characters. Also the /e flag is used which allows PHP code to evaluate. So when I try a test string of system("ls"), it gets printed out to me with any characters removed and without being evaluated as PHP code.

There are two issues here, both of which you can solve.

How preg_replace e works, and how to exploit it

The first problem is that preg_replace with e doesn't just execute anything you pass to it. It only executes those parts of the input that match the regex and are then used in the replacement via back references.

Here is a less complex example of how preg_replace eval works:

// The vulnerable code:
echo preg_replace('/(.*)/e', 'strtoupper("\\1")', $input);

// Your input:
foobar

// foobar is now captured and passed as back reference 1 to the replacement

// evaled:
strtoupper("foobar")

// the result of that eval is then put as replacement into the original input

To solve the issue in your example, simply create an input that is matched by the regex:

A@YOUR_PAYLOAD.AA

YOUR_PAYLOAD is what the capturing group will capture and what will be referenced in the replacement.

Code Execution inside double quoted string

The second problem is that the replacement uses the match inside a string, so your match will not be evaluated as code. This is an easy problem.

Your payload is inside double quoted strings, so just injecting any PHP code will not work, as it will be treated as string, not as code. You may think that simply escaping the string via " would solve your problem, but that will not work, as double quotes are escaped in all references. However, variables and function calls are evaluated inside double quoted strings.

This means that you can gain code execution like this:

input=A@${passthru($_GET[x])}.AA&x=id

The code that will be evaled is:

strtoupper("${passthru($_GET[x])}")

The result will be an empty string, but as passthru directly echoes input, it will show you the result. If warning are enabled, using exec would also work.


SSLCipherSuite !3DES not working Following advice I've seen here and other places, I am trying to remove support on our server for these two suites that flunk the SSL Labs Server test:

TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

I would have thought that setting SSLCipherSuite to:

HIGH:!aNULL:!eNULL:!DES:!3DES:!ADH:!EXP:!NULL:!RC4

would disallow anything with 3DES, but SSL Labs test still shows these two "weak" ciphers as supported.  I tried adding

:!DES-CBC3-SHA:!ECDHE-RSA-DES-CBC3-SHA

to that setting and doing a restart (Apache graceful), but it does not change.

SSLProtocol is set to:

-ALL -SSLv2 -SSLv3 +TLSv1.2

(is the -SSLv2 and v3 redundant?)

What am I missing?

Probably solved by now but, had the exact same problem, lost will to live but then found out it was letsencrypt:

https://www.andrewshay.me/blog/apache-disable-tls_rsa_with_3des_ede_cbc_sha-after-letsencrypt/

I was grepping on CipherSuite in my apache install folder but lets encrypt includes a file outside of it.


Can a website determine what OS or webbrowser a visitor is using if the useragent is blanked/changed? Assume that a visitor to a website has changed his useragent to something like the following, but he's using linux:

Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0

Assume that the website is in the hands of an evil hacker. Is this trick enough to make the expolit-kit nonfunctioning, or is it possible for the hacker to gain control over the visitor (Assume that the visitor's flash-module and browser is outdated)?

Can a website determine what OS or web browser a visitor is using if the useragent is blanked/changed?

If you allow the website to run Javascript which can send code back to the server there are probably multiple ways to detect the browser as different browsers handle things slightly different.

Apart from that there are also user variables besides the user agent with identify the browser. See http://www.quirksmode.org/js/detect.html and http://www.quirksmode.org/js/support.html


Why is Tor over HTTPS insecure? I don't get how a HTTPS connection over Tor can be insecure. Where's the difference between a normal HTTPS connection and a Tor -> HTTP connection?
Many sites recommend to use the Onion-URL instead of the HTTPS-URL.
Where is the benefit?

Tor provides you with anonymity.

HTTPS protects (encrypts) the content of your data.

HTTP provides none of these.

Tor provides anonymity but does not protect the exploitation of an insecure application to reveal the IP address of, or trace, a TCP stream.

Running HTTP over Tor means your communication data could be read and thus compromise your anonymity.

Here are 4 schemas showing the difference between using HTTP, Tor+HTTP, HTTPS, Tor+HTTPS (the green button reflects the used protocol) regarding what an attacker (eavesdropper) may see:

HTTP (the eavesdropper sees everything)

Tor + HTTP (eavesdropper reads the communicated data)

HTTPS (eavesdropper can not read your data, that is all)

4: Tor + HTTPS (even safer)


How can someone hack my PC if I am connecting to the internet through NAT? If I own a private IP address, 192.168.2.1 for the sake of it, and I am physically connected to my router, which it's internal interface is 192.168.2.254 and it's external interface is some public IP address which it got from my ISP's DHCP server.

Obviously my IP is being translated over NAT so I can surf the internet.

So how can someone hack into my computer?

Looking at it from the OSI model perspective:

Layer 1 - Irrelevant
Layer 2 - ARP attacks, only people who live in my home and share the same network, irrelevant for the sake of discussion
Layer 3/4 - Well, my IP is a private one, so people can't really probe me for open ports and vulnerabilities, right? They can probably probe my router, but it's just a "ISP smart box", which isn't really a router (although it operates also as a Wifi AP, so people will need to crack it in order to get something done)
Layer 5 and up - These are the only layers which I will be vulnerable to an attack, am I right? Ranging from XSS, to some other things?

Generally speaking, most NAT boxes also happen to provide some firewall-like protection: they tend to block incoming connections.

This is not an inherent or necessary property of NAT; it is just that most consumer devices that provide NAT also happen to provide this sort of firewalling as well.  (Technically speaking, NAT does not necessarily imply any blocking of incoming connections.)

Nonetheless, for NAT devices that do block inbound connections (i.e., most of them), you do get some of the benefits of a firewall.  This makes it harder for someone to connect to your PCs behind the NAT and attack them.  In practice, this provides a sort of "poor man's firewall" that works pretty well against a common class of attacks.

However, NAT is far from a silver bullet.  People can still compromise your PC, even if your NAT, in a variety of ways:

A malicious website could exploit a vulnerability in your browser, a malicious email could exploit a vulnerability in your mail client, a social engineering attack could trick you into revealing your password or installing malware, a file you download over a file-sharing network could be malicious, and so on.
An attacker could attack your NAT box directly, e.g., by exploiting an open Wifi link, by drive-by pharming, by guessing your NAT box's administrator password, etc.
An attacker could fool your NAT into allowing an inbound connection, using the NAT pinning attack.  This is basically a technical vulnerability in NAT boxes which illustrate that their incidental connection-blocking can in some cases be defeated.

For more detailed elaboration on all of these points, I recommend you read the answers to How important is NAT as a security layer? and What kind of attacks against home router's NAT do exist?.  There is a lot of good information there.


How to prevent access based on MAC Address in local network and internet? I have one server with source code of softwares. I want to give access based on certain MAC address to developers in my office. And also want to give access to some other employee who can also work from their home.

I can change my mac address, so I wouldn't depend on addresses. Addresses are like names, not like passwords.

I probably would use ssh keys, such as described at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s2-ssh-configuration-keypairs.html for Red Hat. There are other articles for other OSs.


When do you use OpenID vs. OpenID Connect Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context?

The reason I ask is because I'm trying to implement the following:

User "Bob" goes to a Client implemented as a User-Agent only application.
The protected resources are controlled by the same domain as the authentication/authorization server, but they are on different subdomains. However, no session is found in the cookies, so...
Bob clicks "login," and gets redirected to authorization/authentication server using something like the following:

GET https://accounts.example.com/authorize?response_type=token&client_id=123&redirect_uri=http://original.example.com&scope=openid profile token custom

Bob is given a list of options to choose from to authenticate, i.e., "example, google, twitter," etc. which leads to his authentication at example.com, which in turn is used for his authorization for a specific API hosted by example.com.

Should I be using OpenID Connect, OpenID 2.0, both? What? This is my first time implementing any of them. I'm only asking about the authentication part of this. I'm just trying to get Bob authenticated so that I can move on to issuing the token to the client.

I don't think either of the other previous responses answer the question, which is asking the difference between OpenID Connect and OpenID 2.0.  OpenID 2.0 is not OAuth 2.0.

OpenID 2.0 and OpenID Connect are very different standards with completely different parameters and response body formats.  Both are built on top of OAuth 2.0 by putting additional values into otherwise valid OAuth 2.0 requests and responses, in order to provide identity information needed for authentication (whereas OAuth 2.0 only provides authorization, not authentication).  OpenID Connect improved naming and structure of OpenID 2.0 fields and parameters in order to be easier to use.  I can easily read the OpenID Connect specification and understand what all the values are used for and what to set them to, but trying to read the OpenID 2.0 specification is a bit more difficult and convoluted.

At this point the choice is easy, OpenID 2.0 is deprecated.  You should use OpenID Connect.


Should i use SSL for local access? I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip).

Should i use SSL for the communications between the sites and the service, or would that just create unnecessary overhead without increasing security?

Please note that all communications between the websites and web service happen inside the server. They are all hosted on the same iis7.5 server.

No, there is no need to ever encrypt loopback traffic with SSL. Loopback traffic never leaves the machine, since the interface is virtual. The traffic never even reaches a real NIC's device driver.

In order to capture the loopback traffic, an attacker would need to execute a capture program on your machine. Once an attacker has code execution on your machine, you are owned. Game over.

Encrypting the traffic is pointless when they can just read the source data, or read the plaintext buffers from memory.


How does a website know my location? Checked with ipleaks and VPN seems to work correctly Recently I have been using a VPN to watch a free web series available only in the US -- on a website called https://go90.com. Until a few days ago everything was running smoothly with just Hola VPN. Then for some weird reason the website started to lock me out. I read up a little and saw that when I go to https://ipleak.net/ they could be able to locate me via WebRTC detection and DNS leaks. I went ahead and fixed those so that WebRTC shows no IP on the site and the DNS shows an American address. When I try to go to the go90 website I am still locked out however.

Being at a complete loss I even tried to create a virtual machine with Ubuntu on it, did the same thing so that ipleak shows me as browsing from the US and then for some bizzare reason I can access the main page of the website but clicking on any link takes me to the 'you are not in the US' page. How can the website locate me? What should I do?

If it is helpful I'm currently running Windows 10 and Chrome, though tried similiar things on Vivaldi and Firefox without any effect. Geolocation is set to ask for permission and the website has not asked for it.

It sounds as though some sort of supercookie(s) were set, to include browser fingerprinting.


USB Stick with write-protection I bought a USB stick with a hardware switch to enable write protection. I burned a Linux iso on it to make some forensics analysis on my installed OS. Could the write protection be bypassed via software from a remote attacker? Could it be attacked and re-written?

It depends on whether that switch makes a change to the hardware or it triggers a software change in the stick (or the OS).

Any software-based protection could be manipulated via software. Hardware-based protection cannot be manipulated via software.


Is a Cloud-Connected Door Lock More Secure Than a Traditional Lock and Key? Now that app based door lock replacements are getting more popular in the market, I'm wondering what the security risks are and why or why not this is more secure than an old fashioned lock with a physical key.

I'd argue that they are fundamentally no more secure than a traditional lock. These types of locks can also be opened by a standard physical key, so they by definition are susceptible to all of the weaknesses of a traditional lock plus any weaknesses introduced by the electronic layer.

Whether or not these additional weaknesses are significant is an open question, and will depend on the specific manufacturer and model. With that said, it's my strong suspicion that the traditional lock manufacturers who have begun building these digital models likely lack the software engineering experience and deep cryptographic understanding necessary to design and implement such a complicated product in a way that would withstand a skilled and determined adversary.

While @raz is correct that a door is only as secure as its frame, an important feature of a lock is to ensure that a break-in leaves physical evidence. Someone entering a locked room is not necessarily a thief just looking to ransack the place for loot. My biggest concern with internet-connected locks is that a software flaw would plausibly allow attackers to silently bypass locks of their choosing, leaving no physical evidence.

That said, if I had the option I would consider putting one on my home. The threat model there is, generally, a thief looking to ransack my home for expensive physical goods, and any additional vulnerabilities introduced by the internet layer are unlikely to be exploited by this type of attacker over simply using a crowbar on the door or breaking a window. The added convenience may be worth the risk. On the other hand, I would likely not choose to install such a lock on the door to a rack of servers, the door to an office suite, or to a safe containing valuable documents.


Can my ISP know my passwords If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how can I secure myself?

Your ISP can know your password any time it's sent unencrypted over your internet connection. If you don't want them to know your password, don't send it unencrypted over the internet:

Avoid login pages that use HTTP (always use HTTPS and don't visit sites with expired or invalid SSL certificates)
Don't use FTP or other services/protocols that don't encrypt your password in transit

Also follow general security guidelines for passwords, such as never reusing the same password.

Additionally, if you are worried that your ISP (or anybody else in between you and the remote server you're communicating with) is watching you, then you also need to take additional steps, such as:

Ensuring that all websites you are logged in to are using HTTPS, so that your cookies can't be snatched from the HTTP request (you're logged in to this site, where HTTPS isn't available, so your ISP can already log in as you here if they want to)
Verifying you are talking to the right server (for example, with SSH, ensure you use fingerprint verification and take notice if a server's fingerprint changes).

If you are only worried about your ISP (or your government), you can improve your position significantly by using an offshore VPN so that all of your traffic is routed through a server outside of their reach. Your data will still be sent unencrypted over the internet, but will be encrypted between the VPN and you, which is enough to prevent your ISP from reading it.


Zap Proxy - script to modify headers automatically Hello just wondering if someone already wrote a script for Zap to modify headers automatically with out me having to do it on each response/request..
example.
modify response from 3xx or 4xx to 2xx to bypass some misconfigure sites.
If I can't find any I will try to write my own, just trying not to reinvent the wheel. thanks

Answered here: https://github.com/zaproxy/zaproxy/issues/4022

For simple replacement theres the Replacer add-on: https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsReplacerReplacer and for more complicated situations there are httpsender scripts: https://github.com/zaproxy/community-scripts/tree/master/httpsender


What are the dangers of sql injection with php? I made an SQL-injectable web-app build to with PHP to get a better understanding of what is going on and automated it all with sqlmap.

The relevant code is the following:

mysqli_query($conn, SELECT trans FROM `dictionary` WHERE `word` LIKE '$unfiltered_variable');

I played around with SQLMap and the only thing I was able to get was the contents of the dictionary (since this was a dictionary website) but couldn't really do anything else since PHP's sqli_query() function does not support stacked queries.

So questions:

1) Is there something that can be exploited to do something else than to get the contents of the database?

2) If the contents of the database are not meant to be kept secret, is there any point in securing this vulnerability?

Let's remove PHP entirely from the equation for a moment.

SQL injection allows an attacker to manipulate the SQL query to be what he or she wants the query to execute. This can be dumping the contents of the database, modifying data, and even code execution.

The example you provided is indeed vulnerable to SQL injection. For the purposes of demonstration, let me simplify it a little:

mysqli_query($conn, "SELECT trans FROM dictionary WHERE word = '$search'");

Given a value of security, the resulting query would appear like this:

SELECT trans FROM dictionary WHERE word = 'security';

This is innocent and normal. However, given the following, an attacker can obtain the version of MySQL that you are running:

' @@version -- -

This would cause the query to result in the following:

SELECT trans FROM dictionary WHERE word = '' @@version -- - ';

Ultimately, depending on permissions and configuration, an attacker can jump from one database to another in your database server, read files from the filesystem, or execute code. Here is an example of how an attacker can read files from a Linux-based OS:

' LOAD_FILE('/etc/passwd') -- -'

This then would result in the following query:

SELECT trans FROM dictionary WHERE word = '' LOAD_FILE('/etc/passwd') -- -'

There are a couple of things to keep in mind at this point:

Not all SQL injection vulnerabilities are the same
Techniques to read files, execute code, and dump databases will vary widely from language, backend database server, and the circumstances surrounding the vulnerability itself

Regardless, I would highly, highly, highly recommend that an SQL injection vulnerability be fixed through parametrization or whitelisting of user input depending on the needs of the functionality in question.

I started off with removing PHP from the discussion because SQL injection is not language and framework dependent - it impacts any language that allows database connectivity. Regardless of language, user input should be treated with suspicion and handled appropriately.


Earning CPE for SANS/GIAC certification renewal through online courses I am currently a holder of GIAC Security Essentials certificate (GSEC) that expires soon, so I'm looking for a way to renew this certificate in the most efficient way.

GIAC Certification Renewal page says that it is possible to earn all necessary 36 CPEs through "ISO-17024-Accredited InfoSec Related Certifications and Affiliated Training". I want to take a certification exam for CIPP/E provided by IAPP, who is in the list of accredited providers.

However, after reading the document at the last URL, I'm still not quite sure how to interpret the sentence "relevant activities completed through an InfoSec related ISO-17024 accredited certification and its affiliated training providers". Do CPEs get earned only for training hours/days, or is it sufficient to just get a certificate?

More specifically, my questions are:

In order to get the 36 CPEs, do I necessarily need to go through a training, or would it be sufficient to just successfully pass the exam and and get a CIPP/E certificate?
If I have to take a training, would an online training course be accepted?
If so, how many CPEs can I get for it? The description of the course length is pretty vague: "The training comprises 11 modules with an audio run-time of approximately 2-3 hours", which gives me pessimistically 22 hours. I could hope that it would be at least 24 hours, plus get the remaining 12 CPEs through Field Work Experience, but such approach lacks certainty.

I would be grateful to anyone who shares his/her experience.

I sent this question to SANS support, and got the following reply:

  Passing a ISO-17024 certification qualifies for CPE credits. Once submitted a member of our team will review your supporting documentation and award the proper amount of CPEs.

In other words, neither the training length nor even the training itself are relevant here. What is relevant is passing a certification exam by IAPP, which grants me 36 CPEs.

I eventually went through the training, registered for a certification exam, and when I passed it, I got the possibility to claim 36 CPEs with SANS. Once claimed, I successfully used them to renew my GIAC certification for another four years.


How to build Linux Volatility Profiles With the Compiled Kernel I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case.

I heard there is a way to build the profile with the compiled linux kernel but I cannot find any documentation on how to do that through googling. Is anyone familiar with building volatility profiles from the compiled kernel and if so willing to provide instructions on how to do so?

Thanks!

You do not need access to a live system to create a volatility memory profile. What you do need are kernel headers for the running kernel, DWARF debug symbols, or the kernel source code in the exact version of the target kernel and the corresponding .config.
If you have a copy of the kernel with DWARF debug symbols (i.e. CONFIG_DEBUG_INFO=y, was set when building the kernel), you can instead run dwarfdump on the kernel.
Assuming the kernel is built with the [IKCONFIG] option, you can use the [extract-ikconfig] script to extract the config from the kernel. If the IKCONFIG_PROC option is set, this may also be available on a live system under /proc/config.gz. Using this config, you can build the volatility module against your kernel source checkout.
If none of these options are viable, you are out of luck, and may need to reverse engineer the structure layouts.


Registration or Enrollment? When joining an authenticated network, I have seen the terms "Enrollment" and "Registration" used to describe the process of initially setting up your credentials on the network. "Authentication" itself then is a periodic activity where these credentials are validated.

I am wondering if these terms are synonymous, or if there is a subtle distinction. Perhaps it is the case that registration refers to a manual process (sign up on a web-page; confirm email address; etc) or enrollment is more of an automatic, and transparent process perhaps assisted by hardware/OS features, such as certificate provisioning.

Are there well recognised definitions for "Enrollment" vs "Registration" such as there are for "Authorization" vs "Authentication"?

Doing some quick research into this myself (by which I mean typing in the words as a part of various web-search queries), I discovered some subtle distinctions in the use of these terms. Firstly of course registration is itself a far more general term which can apply in various different scenarios. Enrollment however is typically used in the domains of certificate-based authentication (in particular with relation to a device, rather than a personal identity) and in biometrics, where it refers to the capturing of biometric information to be used for later authentication purposes.

So how do these two terms relate to one another? Well in the biometrics case I would presume that the person enrolling has previously registered somewhere before being presented to the enrollment mechanism.

In the case of certificate-based authentication it seems that registration is also the prerequisite activity, before a device is enrolled with a certificate authority.

I consulted two infosec glossaries investigating this. The first was the NIST "Glossary of Key Information Security Terms" where the only reference to enrollment is:

  Enrollment Manager – The management role that is responsible for assigning user identities to management and non-management roles.
  SOURCE: CNSSI-4009

which isn't much help. But registration is covered here:

  Registration – The process through which a party applies to become a subscriber of a Credentials Service Provider (CSP) and a
  Registration Authority validates the identity of that party on behalf
  of the CSP.   SOURCE: CNSSI-4009  The process through which an
  Applicant applies to become a     Subscriber of a CSP and an RA validates
  the identity of the Applicant     on behalf of the CSP.   SOURCE: SP
  800-63

which is fairly clear. The other source I discovered was "Javvin Network Dictionary" which defines registration thus:

  Registration in network security means the administrative act or
  process whereby an entities names or other attributes are established
  for the first time at a Certificate Authority (CA), prior to the CA
  issuing a digital certificate that has the entity's name as the
  subject.

Again "enrollment" is a little more vague:

  Certificate Enrollment Protocol (CEP) is a certificate management
  protocol ... CEP specifies how a device communicates with a CA,
  including how to retrieve the public key of the CA, how to enroll a
  device with the CA, and how to retrieve a Certificate Revocation List
  (CRL).

The actual documentation for CEP doesn't define the term, but a related RFC "Certificate Management over CMS (CMC)" describes the term as follows:

  Enrollment or certification request  refers to the process of a
  client requesting a certificate.  A certification request is a
  subset of the PKI Requests.

Still not completely clear, but looking at another related RFC for "Enrollment over Secure Transport":

  After authenticating an EST server and verifying that it is
  authorized to provide services to the client, an EST client can
  acquire a certificate for itself by submitting an enrollment request
  to that server.

So, basically authentication is a prerequisite to enrollment, and if you're authenticating you must surely have already been registered.

This understanding ties in with the Biometrics case, and also my own experiences where I enrol to register my device on a network where my identity is already known. In a more general "non Infosec" sense this lines up too; you register with a university and then upon enrollment you provide your personal details and select your classes!


Emailing 2-Factor Authentication Secret Key In our PHP web application we have included Two-Factor authentication.  Users have a one-time secret key generated which they then enter (or scan a QR code) into the Google Authenticator app.

The authentication is time based, so a new token is generated by the Authenticator app every 60 seconds, and this token must be entered when the user attempt to login to our app.

This is all working perfectly fine, however when a new user is added to our system, their secret token (and associated QR code) is emailed to them first time around.

Furthermore, just like we have a "forgotten password" facility to reset a user's password via email, we're thinking of having the option to re-email or reset a user's Authenticator secret key (for example, if a user's phone gets destroyed and replaced with a new one, and they need to set the app up again).

However, I haven't found any real-life examples of being able to send or reset a Two-Factor authentication secret key via email.  Is it a cardinal sin to communicate this information via email and should it be done some other way?

As well as the Two-Factor authentication we have a range of other security measures (password, access to the system locked to IP address, alerts when new/unrecognised web browsers login to the system, etc) if that makes any difference.

There exists a protocol called Dynamic Symmetric Key Provisioning Protocol (DSKPP). This is a client-server protocol which allows you initialise your authenticator with a secret key without emailing it - http://www.rfc-base.org/txt/rfc-6063.txt


How to make the Tag number of the RFID device appear as a secret number? I just bought RFID-reader device (USB reader) and with it the Tag cards. These tag cards are meant to be as a secret card that no one should know the number of it even its owner. The problem is the RFID-reader is reading the tag cards code anywhere and it also showing the numbers of the tag code. Is there any way to make the numbers of the tag code appear as a secret number as if you typed in your password? Thank you.

Most cheaper RFID tags are dumbtags which stores a static identification value that can be read by any NFC compatible reader. For these dumbtags, you can simply write an app that captures the code as it's being transmitted (or use one of the hundreds of Android NFC readers). In cases where the reader acts as a Keyboard HID, you can simply open a plain text editor and scan. Such RFID dumbtags have many uses but should never be used for security critical scenarios.

To prevent the internal secret code from being known to the user or from being transmitted to the reader/computer, you need an RFID smarttag that uses asymmetric cryptography so the actual secret is never actually transmitted to the reader. Instead, what happens is that such RFID smarttag computes a one-time use, time-limited code based on an internal secret and this is the code that's transmitted. The internal secret itself is never transmitted out of the tag, and the cryptographic algorithm is such that it's mathematically impossible to reverse calculate the internal secret from the one time codes.

The more secure tags involve a challenge-response protocol, in which the smarttag computes a code that can only be used for that particular transaction, and may also have a small display to review the transaction details before approving them.

These measures are designed to prevent and/or limit damage in the scenario where the reader unit may have been compromised, since the transmitted one time code would only be valid for that transaction only and can't be used for future transactions.

Even higher security tags may even include a keypad where you can type your PIN and are designed to be tamper proof to protect against both compromised reader and stolen tag, since the tag is not usable without the PIN.


What's keeping a malicious man in the middle server from forging a valid certificate According to process of authenticating a server certificate:

What's keeping a malicious server to fill up a valid server certificate since it knows all the things:

Forged Server public key (man in the middle public key instead of actual server public key)
Certificate serial number. (actual server)
certificate validity period (actual server)
Server's DN (actual server ... but we are sitting in the middle of the IP route)
Isser's DN
Issuer's Digital Signaure

This question is similar to (How does an SSL server prove its identity?) which deals with step 4, but I am interested in step 3

The "signature" field in a certificate is not a signature in abstracto; it is a signature over the contents of the other fields. You cannot simply copy a signature from a certificate to another one with distinct contents; it will not match. That's the point of digital signatures.

In the case of a MitM, the attacker may put his own public key in lieu of the genuine server's public key, but the client will not be fooled because his signature verification algorithm will tell him that the signature is now invalid. If the attacker wants to succeed, then he needs to obtain a new signature by some CA that the client trusts; and these CA are trusted precisely because they do not sign fake certificates.


Sensitive information rendered into inline static javascript object vulnerability if user saves HTML page I am using a javascript rendering template engine with node.js. I am rendering sensitive user information into a static javascript object which is then served to the client. However I realized if the user saves the the html page and uploads it this could be a vulnerability. Is there any way around this? Could this be more serious than I believe? The information stored includes long lived access tokens. It shouldn't be that hard to work around this but I am personally interested in this.

I was able to render the javascript object in a separate html file, name it as .js file, and include it as a script in the html. Problem solved.

Yes I could have switched to Ajax but I had worked a lot to parse the information with the template engine already and there was a lot of stuff to send.


SQLmap over uni wifi I don't know if this is the right place to ask this question but I'll give it a shot! I was playing around with Kali and SQLmap. I was just scanning some sites nothing serious. When I was doing this I was logged in on my University's wifi network. Now the problem I have just got an email for a meeting with someone. Now is my question if they're able to see what I've done wit SQLmap?

Yes, they can see what you did. They will be able to see what sites you were hitting and that you were sending SQL injection code.

You have likely violated your Acceptable Use policies at a minimum, and possibly committed a crime (depending on your jurisdiction).

Be very open and honest and ask for help in trying to understand how you can stay in compliance in the future.


Adding photos to Truecrypted, airgapped laptop from camera safely I have a Truecrypted, airgapped (no internet connectivity at all) laptop that I use as a completely secure computer for sensitive files.

I want to add images from my iPhone (I know), camera or other device. What is the safest way to do this? I know safety will have to be compromised in some way, but I need to best. Here's my thoughts:

USB: On a normal computer, transfer the files from camera to usb. Then from usb to airgapped laptop. Problem: malware could transfer from normal computer to airgapped laptop via USB.
Upload from iPhone to internet, connect directly from airgapped laptop temporarily before returning to internetless state. Problem: internet access is dangerous.
Upload from camera to Tails booted from any PC. Transfer to formatted USB, then transfer to airgapped laptop. Problem: very slow, inconvenient and Tails may have driver problems with certain devices.

Is there an obvious solution I am missing?

I would trust a USB or SD card over transferring it via an Internet connection.

Once you put the gapless computer on the Internet, you have no idea what's going to come down the pipe.  Applications might start auto-updating, in which case you are downloading and installing EXEs from untrusted sources over an untrusted network, which is exactly what you are trying to prevent by keeping the machine off the network.

To your third point, TAILS should not be confused with a secure OS. It's not. It's a TOR proxied OS. The purpose of TOR isn't security, it's a limited form of privacy. Instead of trusting your local ISP, you are pushing your trust to TOR exits, but you know nothing about who is actually running those TOR exits. It could be a black hat. It could be GCHQ.

When an attacker controls your network, as in the TAILS architecture, there are all sorts of new types of attacks they can potentially use against you, such as DNS spoofing, malicious code injection, etc.  So, I'd stay away from TOR or TAILS when you are looking for a secure environment. It's not their purpose and in fact creates more threats.


Am I being ARP Spoofed? My ISP uses static IPs (IPv4) for providing an Ethernet connection. Now recently I have been witnessing a serious drop of speed sometimes. I called my ISP to verify if there were any problems in the network, which they always tell me if fine on their side. The ping to Google DNS is always fine ie. ping 8.8.8.8 -t

Now I think I am being spoofed because of two reasons. This is a local area broadband connection that I am using, ie. my neighbors are using the Ethernet from the same switch that is placed outside. even the IPs assigned are sequential. My IP is 172.16.130.196 my neighbors maybe 172.16.130.198 or something like that. So(correct me if I am wrong) you could do a scan of the IPs available in the network using something like AngryIPScanner.

The second reason why I think I am being ARP spoofed is because when I run the command arp -a in my Windows terminal I get multiple entries-: like so-:

  arp -a

Interface: 172.16.130.196 --- 0x4
  Internet Address      Physical Address      Type
  172.16.130.193        00-25-90-ea-31-33     dynamic
  172.16.130.255        ff-ff-ff-ff-ff-ff     static
  224.0.0.22            01-00-5e-00-00-16     static
  224.0.0.252           01-00-5e-00-00-fc     static
  224.0.0.253           01-00-5e-00-00-fd     static
  239.255.67.250        01-00-5e-7f-43-fa     static
  239.255.255.250       01-00-5e-7f-ff-fa     static

The only entry that I recognize in this list is 172.16.130.193 which is my default gateway. What the hell are the others ? Is it okay for there to be multiple entries in the ARP cache ?

Am I a victim of ARP spoofing ? If so, how do I deal with it ie. can I ban the IP in my firewall or something ?

If any more evidence is required please let me know.

There is no indication of ARP spoofing, at least not in the information you have provided. What you should see in case of ARP spoofing is that your default gateway has the wrong MAC address, i.e. you would need to verify the MAC address in this entry:

172.16.130.193        00-25-90-ea-31-33     dynamic

Everything else are all perfectly valid entries:

224.0.0.22            01-00-5e-00-00-16     static
224.0.0.252           01-00-5e-00-00-fc     static
224.0.0.253           01-00-5e-00-00-fd     static
239.255.67.250        01-00-5e-7f-43-fa     static
239.255.255.250       01-00-5e-7f-ff-fa     static

These are multicast addresses, not your neigbhors. From Wikipedia Multicast Address:

  IPv4 multicast addresses are defined by the leading address bits of 1110, ... The group includes the addresses from 224.0.0.0 to 239.255.255.255. Address assignments from within this range are specified in RFC 5771...

172.16.130.255        ff-ff-ff-ff-ff-ff     static

And this is the broadcast address of your network


Somebody hacked my router and changed my wifi SSID One of my neighbours hacked the password of my router and he uses my limited internet package. I change the wifi SSID almost daily, but he can hack it easily.
Today, he changed the SSID to a hate speech "insult".

How can I stop him? I need a quick and powerful solution. Is there any easy-to-use software that protects my wifi?

I have an idea but I don't know how to do it. Sometimes my mobile (smart phone) finds a wifi network that does not have a password. So, I can connect to it easily. When I access the internet, all websites are unavailable. And I can not surf any webpage. How to do something like that?

Edit: I'm Using WPA/WPA2 PSK

There are two different passwords that access different functions.  If an attacker has the admin password, then he / she can change the SSID, WiFi password, and any other settings on the WiFi router.

To fix:  ensure your WiFi security setting is WPA or WPA2.  Then change the WiFi password to a long one (at least 12 characters, more is better) with special characters and numbers (such as #, $ %, !, 1, 6, see for example Is there any point in using 'strong' passwords?).  Also, make sure the admin password on the WiFi router is changed from the factory default.  This admin password is different than the WiFi password.  It should also be a long complicated password, but do NOT make it the same as the WiFi password.  The WiFi password is the one you give to friends and family to access your WiFi.  The admin password should be kept with you only, or people you REALLY trust, as it can be used to change WiFi settings.  Once this is done, change the SSID back to one you like.

Also, make sure to disable the feature called Wi-Fi Protected Setup (WPS).  See http://www.howtogeek.com/176124/wi-fi-protected-setup-wps-is-insecure-heres-why-you-should-disable-it/ for details on why WPS is not recommended.

If the attacker is still able to change the SSID and any passwords, your system is more deeply compromised and I would recommend contacting a computer expert or store who can help you clean your system.  They can also give you advice on if there is anything local law enforcement can do, as your attacker is likely committing a crime.


error in running snoopy in kali linux 2016.2 I have installed the snoopy tool in Kali Linux but when I run the tool from terminal it's giving this error. Can you help me to solve this?

I've also tried pip install libmproxy

     ___  _  _  _____  _____  ____  _  _
/ __)( \( )(  _  )(  _  )(  _ \( \/ )
\__ \ )  (  )(_)(  )(_)(  )___/ \  /
(___/(_)\_)(_____)(_____)(__)   (__)
                        Version: 2.0
Code:    glenn@sensepost.com // @glennzw
Visit:   www.sensepost.com // @sensepost
License: Non-commercial use

Traceback (most recent call last):
  File "/usr/bin/snoopy", line 428, in <module>
    main()
  File "/usr/bin/snoopy", line 353, in main
    plugins = common.get_plugins()
  File "/root/Desktop/snoopy-ng-master/includes/common.py", line 24, in get_plugins
    m = __import__(plug, fromlist="Snoop").Snoop
  File "/root/Desktop/snoopy-ng-master/plugins/mitmproxy.py", line 17, in <module>
    from includes.mitm import *
  File "/root/Desktop/snoopy-ng-master/includes/mitm.py", line 4, in <module>
    from libmproxy import proxy, flow, platform
ImportError: No module named libmproxy

Missing libmproxy, errors are pretty verbose. I've run into similar with other hacking tools, so here's my debugging steps.

Try searching and installing via a package manager

apt-cache policy libmproxy
sudo apt-get install libmproxy

Then try rerunning, rinse & repeat till errors (or dander) is gone.


PCI DSS - one server one primary function (different database engines) I looked at a few other questions similar to mine but they all talk about web/email/database on the same server.  My question is a bit different.  My business uses SQL Server 2008 as its backbone and .Net for the front end.  We are outsourcing a redesign to our web site and the outsourcing people want to build this using WordPress.  Which the people building this don't know how to connect it to SQL Server 20XX (even though I have seen articles that say it can, but I don't know how to do it either so I can't throw stones at it.) and will need to install MySQL.

So my question is, is it ok to have both SQL Server 20XX and MySQL running on the same server or does this break the one function one server rule?

The guidance in DSS 3.2 at least is "If server functions that need different security levels are located on the same server, the security level of the functions with higher security needs would be reduced due to the presence of the lower-security functions. Additionally, the server functions with a lower security level may introduce security weaknesses to other functions on the same server. By considering the security needs of different server functions as part of the system configuration standards and related processes, organizations can ensure that functions requiring different security levels don’t co-exist on the same server."

I'd examine the data going into each.  If it is comparable, you may be ok.  If, however, the WordPress (mysql) data is low security and the SQL Server data is not, you'd be hard-pressed to argue you're within this guidance, in my opinion (not a QSA)

I think I'd put it on a separate server just on general principles.  If they are on the same server, do your best to separate them - run them as different users, for instance, do your best to limit what the mysql database could do to the system or the SQL Server database.


Running Firefox from inside a Docker container Will I increase my security level by running Firefox from inside a Docker container (XUbuntu) under a non root user?

Does it make sense to do so to protect against different kind of malware & browser holes?

Why not? It depends of the use your are going to do. In that way if you dowload something for example, it's going to be downloaded inside the container. It will be accessible from the host only if you specify a volume mount during docker run command. Doing that, any virus you download will be "sandboxed" inside the container.

But you must not forget that:

Containers are sharing kernel with host.
Even if you launched the container with a host non-root user, if RCE (Remote Command Execution) happens in anyway, is possible to escape from container to host.

So could be a good a idea but is not a 100% free of risks technique. It depends of the use you are going to do.


Is it possible to decrypt Telegram messages from a private chat? Assuming you have access to another person's device, set up a SOCKS5 proxy, install a root certificate to parse the SSL traffic, and take a screenshot of the private key of a private chat.

Is it now possible to use the proxy to record a message and manually decrypt it with the private key?

EDIT:
You can display the encryption key inside a private chat. Here is a screenshot.

Is this the private key used to encrypt and decrypt the messages? On Telegram FAQ, you can read "this is not the key itself, of course!"

If not, is it possible to derive the encryption key from it? Or is the private key only stored deep in the app?

The data is encrypted using a random AES key. The AES key is then encrypted using the receiver's public key.

The encrypted data along with the encrypted key is transmitted to the user, who uses their private key to decrypt the AES key, which in return is used to decrypt the encrypted text.

  Is it now possible to use the proxy to record a message and manually decrypt it with the private key?

Since the private key is never transmitted during the communication process it is not possible to sniff them using a socks proxy with a root certificate in place on the device.

I think it's a good idea to get a better understanding of how asymmetric encryption works. The following link breaks it down quite nicely using a simple way of explaining it: https://hackernoon.com/asymmetric-encryption-explained-using-chocolate-boxes-5a329ea6813e