Should I sign the CAcert key? Recently I got a CAcert Assurance and discovered that I can get my PGP key signed by CAcert key. After I got their signature, CAcert website suggested that I sign their key, too.

Question: CAcert status aside, what are the pros and cons of blindly signing an arbitrary key?

Signing Keys Without Meeting Somebody

In principle, you can sign any key you want for whatever reasons. Nobody is there to enforce anything, but probably people will realize after a while and distrust you.

You should never sign keys that you could not verify in any fashion. Signing is a statement that you're sure about the other's identity – but how should you?

Regarding CAcert: if you're already able to verify their root certificate (for HTTPs), you can read their OpenPGP fingerprint on their website. If that's fine for you for signing their key, and the fingerprint on the website matches the one you downloaded, do so.

If you're not sure about their root certificate, and it is not included by default in your distribution, you might want to keep the uppermost part of the assurance form, which contains the fingerprints (the assurer is allowed and prompted to hand it to you!). It is not reasonable to assume that somebody is able to tamper with the assurance form the other member printed from their site, and at the same time tampering the CAcert web site.

Certificate Authority in OpenPGP Web of Trust

CAcert is the largest certificate authority in the OpenPGP web of trust, they have a very central position. If you sign and trust it (and thus trust in their methods on signing other CAcert user's keys), you can extend the part of the OpenPGP web of trust which you can validate (usually by magnitudes). Doing so is pretty much the same like adding their root certificate to your browser.

If you do not want to publicly sign their key, you can use a local signature that will not get uploaded to key servers.

My own Opinion

I did sign and trust their key, as I want to take advantage of the huge number of keys I can validate now and potentially put more trust in CAcert's methods of assurance than what most people do at OpenPGP keysignings.


Questions about code review (C) As part of a Security Workshop course I did last semester (im in Australia) we had to learn about Code Auditing on our own by reading "The Art of Software Security Assessment".

In our final exam we had to audit this code. I only managed to find two vulnerabilities:

Vulnerability 1:

Line 290, format string is from user input string “inputString”. This is the format string vulnerability that can be exploited to run arbitrary code.

While there is a valid character filter, this check does not prevent the printf from running with unsanitized string, so there is no “security” filter.

Vulnerability 2:
Line 344. If new array is created and show is immediately called (without the array being initialised), the contents of stack is printed instead.

This could be garbage or information leakage.

Could you guys give practical examples of what other vulnerabilities are in this code and how you went about finding them (thought process)?

I wont go through vulnerabilities present, but I can walk you through my process/thinking.

static analysis tools - start with the obvious and have some tools take a look at it, a couple of options include Visual Code Grepper and Cppcheck
Next we look at things manually, start with functions that are dangerous, these tend to be string and memory manipulation functions.  Follow the code backwards up the call stack to see where they get their data from, checking if that data has been properly validated.  If not, then that is likely to be another vulnerability.
Next, start at all your program inputs, this include program arguments, anywhere where user input has been entered, network reads etc. etc.  Then walk through the code to ensure that all inputted data has been properly validated.  Again if not, then this is likely to be another source of vulnerabilties
Finally (there may be more steps, but this'll get the bulk of them) look for language or framework idiosyncrasies.  Do you have API calls that have the wrong arguments e.g. a realloc where the resultant pointer is the one used in the call.  Is there a correct sequence of API calls required to set something up (crypto falls into this category)

That's more or less what I do, though I have a step 0 which is to read the code top to bottom, just to get a feel for it, it's odd, but you can spot things just because they look funny


User passwords printed on paperwork at a dental office? My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork.

I asked on Law.stackexchange and it doesn't sound like this is a HIPAA violation, but I am really curious if this violates other regulations or goes against known best practices, as it seems really bad security-wise.

It doesn't feel right that they can even see my password.

Any thoughts / resources much appreciated.

If it is the password that you generated and that you use to access their portal, it is unacceptable that they know it. How do they know the password?
Did you provide it directly (verbally or otherwise) outside the sign-up process on the portal?
If not, this means that their portal database save users passwords in clear and they have full access to them, this, at least in EU,
can conflict with new privacy and electronic data processing rules: GDPR. I don't know what your nation is, but even if it were outside the European Union, I am sure that such behavior would violate some law.


GPG/Bitcoin usb gadget device My idea is to take a raspberry pi zero (or any embedded linux board) and shove GPG inside it to encrypt/decrypt/sign data with RSA/ECC (for bitcoin) via USB. Like a USB thing that holds your (encrypted) keys, you unlock them and you're ready to go. When the computer is trying to do anything (sign/encrypt or read/write to your keychain) a message will appear on the small physical screen of the device that will require you to press a physical button on the device to accept it.

The key generation will also take place inside the device.
The device will be completely air-gaped and will require user authentication to enter the system (via serial, no wireless communication at all)

Is it a good idea? Why?
Is it secure? I know that some1 can dump your memory while the device is running via ultra-leet X-Ray machine but I don't mean THAT type of security. I want to know that I'm safe even if I lose my device.
Is this done already? Where?

It sounds like you are trying to design a HSM that is custom tailored to work with Bitcoins. I believe these are called hardware wallets. There are already many existing implementations of them as well as designs for do-it-yourselfers.

As far as the security of such a device, the devil is in the details. You'll want a device that requires you to enter a passphrase to decrypt the data on the device.

For physical security, besides x-ray attacks, there are also cold-boot attacks, resoldering the board, and numerous other attacks. Various software and hardware strategies (eg: encryption) can make these attacks harder, but you'll never have full security without physical security.

It seems to me that the biggest risk for such a device is that of loss of your Bitcoins. If you device gets lost, damaged, or is otherwise unusable, you'll need a strategy for recovering your secrets and your Bitcoins. This is likely an offline, physical backup of some kind that you can store in a safety deposit box or something.


Is Google's password recovery by entering an old password a bad practice? When you try and recover your password on Google, you will eventually stumble across this screen, and it made me wonder:

Isn't this type of password recovery from Google essentially the same as allowing the user to log in with an old passwords? Thus making it impossible for the user to fix a compromised password.

How does Google secure this process? I assume they must have some additional check, maybe based on cookies or the client IP.

No. The correct/incorrect old password is just data used in a recovery process.
Google knows how you changed the password (via forgot password, via the normal change screen) and when, and how old the password is in numbers (eg you changed password 2 times after this old password).

So this data is used in a general scoring model to determite if you are a legitimate owner of the account.

So a example:

Entering the previous password, and that password was changed for a hour ago, google might allow you access with that old password immediately.

Entering a old password changed for a month ago, might direct you to the screen that allows recovery by secret question.

Entering a very old password, might get you to "get a SMS code to recover your account" procedure.

And entering a outright incorrect password might send you to the screen that require customer service interrogation Before recovering access.


Why are self signed certificates not trusted and is there a way to make them trusted? I have locally made a Root CA certificate. I used the CA cert to sign the IA cert and used the IA cert to sign the server certificate. When I try to access the local server which uses the server certificate, it gives me a security risk warning. Is there a way to make it not give the warning?

All I basically want to know is, is it possible to make self signed certificate trusted?

You need to import the root certificate into the trust store for the browser. Once the browser knows you trust this root certificate, all certificates signed by this will show up as trusted.

Note that this will only make the connection trusted for you, any others who don't have the root certificate installed will still receive an error.


What are the recommended directory ownership & permissions for hosted websites? So, I'm not sure what are the recommended directory ownership and premissions for directories of my websites.

└── var
    └── www
        ├── website1
        │   └── public_html
        └── website2
            └── public_html

So the owner of var and www is already root:root.

└── [root     root    ]  var
    └── [root     root    ]  www
        ├── [user1     user1    ]  website1
        │   └── [user1     user1    ]  public_html
        └── [user2     user2    ]  website2
            └── [user2     user2    ]  public_html

It should be like above?

Or:

└── [root     root    ]  var
    └── [root     root    ]  www
        ├── [root     root    ]  website1
        │   └── [user1     user1    ]  public_html
        └── [root     root    ]  website2
            └── [user2     user2    ]  public_html

For premissions i did like this:

└── [drwxr-xr-x]  var
    └── [drwx--x--x]  www
        ├── [drwxr-xr--]  website1
        │   └── [drwxr-xr-x]  public_html
        └── [drwxr-xr--]  website2
            └── [drwxr-xr-x]  public_html

For better orientation:

var 0755
www 0711
website1 0754
public_html 0754 or 0755

Any suggestion?

Giving the information you have provided:

I would always suggest that the user for your web application is www-data:www-data and the file permissions be NO HIGHER than 755.

if you are creating split hosting then yes of course you can user different users, www-data is just a common user to use, though set up correctly you can user basic users. never use root. if you need special privileges give your user specific powers (sudoers), not let that user have all the power.

With anything below your document root, in this case this would include your www folder (unless you have web assets stored there), I would keep the file permissions to another user, I would always advise against root but it wouldn't be so bad at this level.

You need to remember anything executed as root is dangerous regardless if you think you server is safe. your server isn't safe.

My tip is to keep root out of the picture as much as possible. I hope this helps.


What's recommended for performance & security : Server as PC or Server as HDD we are trying to find a file server for us.
we look for the best practices of the establishment of an efficient and secure server.
Therefore, my question is: What is recommended: server as a PC or server as a hard drive disk.

In theory a NAS (which I assume is what you mean by "server as hard disk") is no different from a traditional file server in it's operation. They are both computers running an OS with a bunch of hard disks. There is no underlying reason why one or the other might be more secure.

In practice, it all depends on you. A NAS comes pre-built, whereas you build a traditional filer yourself. So, if you are an expert, you can use the finer control you have over a traditional server to harden it against attack. However, if you are not an expert, it's much easier to make mistakes in setting it up and leave holes open for attack. A NAS is going to fall somewhere in the middle.

So, if you don't know what you are doing, a NAS is likely to be stronger out of the box.

If you do know what you are doing, then usually the decision of "NAS or traditional" is going to be determined by other factors, such as cost, reliability, capacity, ease of use, etc. etc. and you'll have to harden whatever you get.

If security is absolutely your number one priority and you do not care about anything else then you're probably going to want to build a traditional server yourself and hand craft every detail for maximum safety. But that is a very unusual requirement.


How can I get a fiddler-style trace of an iPhone / Android? I want to audit the HTTP and HTTPS activity of apps downloaded onto my mobile device.  What is the best way to do this?

I own the device, can add a root certificate, and can connect the running device using USB to a computer and run diagnostic tools.

I can also run in whatever developer mode exists to see the network IO.

The easiest way is to set an HTTP proxy. On iOS you can do this in your WiFi settings and there's a similar setting in Android.

Point the phone at an interactive proxy (probably Burp or Zap) on your laptop. This gives you an interface similar to fiddler.

To intercept HTTPS, you need to install the certificate from your proxy on the phone.

Some applications will refuse to operate like this. For example, if they use certificate pinning. There are move advanced techniques to get round this.


Is there a security tracker aggregated file for Ubuntu server like Debian has? Debian has a JSON file containing all CVE<->Fixed package versions map.
Link: https://security-tracker.debian.org/tracker/data/json

Does Ubuntu have something similar?

There is the Ubuntu Security Advisory. It provides a mailing list, RSS feed, and Atom feed.

There is no API for historical data, according to a similar question on AskUbuntu.


Console based PKI auth (Xubuntu Linux) Normally, I use my PKCS#11 card to logon to a secured site using a browser plugin which initiated a local software dialog to input PKI card PIN.

Is it anyhow possible to do the following?

Run some console tool
Tool ideally asks for PIN directly or at least triggers the standard dialog
Auth information can be submitted to the secure location site

I have tried so far OpenSC but it says the card is not supported.

This question focuses on how to perform the auth part with the PKI card, not how to use the API of the secured site.

UPDATE

Some findings so far based on @phl's answer.

To check for functions offered by the card's driver, I did the following.

# explore Debian package of the driver installer
dpkg -c <filename>.deb | grep .so

# list functions offered by the library and search for the target function
nm -D <library> | grep C_GetFunctionList

Here it was!

<hexvalue> T C_GetFunctionList

Then, I have tried to call this function from Python/ctypes.

from ctypes import *
cardfun1 = cdll.LoadLibrary("xxxxyyy.so")
print(cardfun1.C_GetFunctionList(None))

And the output is: 7. What then?!

Also, my impression is that is should be somehow possible to combine OpenSSL with the driver but in examples I can find so far people use the card to store the SSH key.

CONCLUSION

While OpenSSL is not possible with this card (no exported function bind_engine), with PyKCS11 it is anyway possible to use card's PIN and call its security functions. So the hint by @phl is the answer.

session = pkcs11.openSession(slot, CKF_SERIAL_SESSION | CKF_RW_SESSION)
session.login(<PIN>)

If your smart card supports PKCS#11, you have a PKCS#11 library/smartcard driver for your card. This library must export the PKCS#11 C_GetFunctionList function. You can link the library to the command line tool you want to develop and use the PKCS#11 API (PKCS#11 standard) to perform the authentication.


Will VPN on a mobile device hide location? I have installed a VPN on my phone from a reputable VPN provider (paid VPN service, publicly rated as top 10 globally),
Can my phone location (longitude & latitude) still be traced by third-party apps, or will instead the VPN server location be shared with third-party apps?
I basically want to avoid being tracked in terms of location: is that possible with a VPN on my phone?
Also, is there a difference in how well the VPN works whether I am connected to a WiFi, or whether I am using mobile data?
Thank you so much,

It depends on what kind of apps.
If you are talking about apps installed on the device, it changes nothing. If they have access to Location data, that data comes from the GPS subsystem on the phone, not from the internet.
If those apps are websites using Location API, it depends on the browser. If the browser have access to location data from the device and you grant location access to the site, it will be the same as before. If the browser or the site does not have location access, it will show geolocation depending on your IP address, and that IP will be your VPN IP.


It appears that Fail2ban fits your scenario perfectly. It is rather configurable so you should be able to setup what you need by consulting the documentation a little.


Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it TL;DR

I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption.

Context

In this question How can I double check security against a TLS on a public IP? the answers set clear that regular TLS does not typically do client authentication, although it seems it would be possible if the server requests it.

Let's suppose I have a server that is able to communicate via "plain text" or "on a TLS channel" (I can re-start the server with or without TLS), but if TLS is enabled, the server does not support checking client-certificates for auth.

The original question was for a docker registry, but I generalize the question to any server supporting TLS but not client-side certs.

What I'm thinking

I am thinking of offloading the "TLS part" to a security-specific software (much similar to what SSH port-forwarding tunnels are) and decouple the server and the TLS handling.

Probably there would be 2 processes involved:

The server listens in a firewalled localhost port or a linux socket in "plain text", but as it is firewalled it can never be reached from the outside.
Some kind of "security middleware" (Probably OpenSSL, but I'm not sure) -I think it'd be called a TLS terminator, but I'm neither really sure, too- to do this:

Handle the public-IP listening
Handle the server-side certs to secure the channel via TLS
Handle the client-side certs to check authenticity (probably against a set of public keys I'll have previously uploaded in the server)
If and only if the client belongs to a white-list of users, then forward the decrypted channel to the regualar plain-text server.

Questions

Would be this TLS offloading a normal setup?
If so, is OpenSSL a good handler for this offloading?
If yes, what documentation could be a good starting point for this kind of setup, where I can read on and learn?

Thnx.

Would be this TLS offloading a normal setup?

Offloading TLS to something else if your server doesn't support what you want is a normal setup.

  If so, is OpenSSL a good handler for this offloading?

I would not expect to build a solution for this directly with openssl.  Load balancers do this sort of thing all the time.  You can also do it with stunnel; here is an example setup, boiling down to these key config lines:

verify = 2 # This enables the mutual authentication
CAfile = /etc/ssl/certs/root-genfic.crt

Where client certs are signed by root-genfic.crt.

  If yes, what documentation could be a good starting point for this kind of setup, where I can read on and learn?

stunnel documentation and related resources are available at the stunnel web site.


Multi Factor and order of authentication I'm questionning the design and architecture around 2FA/MFA controls while authenticating to services and servers.

On major platforms(*), the end-user is:

first prompted for credentials (username/password) - something you know
then prompted for the second factor (Push, Time-based token, or Hardware keys) - something you have

This design allows a hacker to attack/test the password (the first factor).
If a password is successfully compromised (guessed, brute-forced[dict+perm] or sniffed/captured), the second factor would then hopefully prevent malicious access, however the successful password can then be used on other services where 2FA is not enabled (credentials stuffing).

Why is the time-based token/push or HW key not used as a first factor and the password as a second factor?

Is there a specific reason for this FA order (more intuitive to end-users?)
Other controls are in place to reduce the risk associated to passwords.
Is it because the developers or security specialists are opting not to redesign the initial login process (risk retention/acceptance)?

(*) examples include Twitter, Facebook, LinkedIn, Google, microsoft, dropbox, Box Sync, most banks portal...

The reason to prompt for the password factor first instead of the second factor tends to be either to prevent harassment of the user or to reduce costs associated with usage of the 2FA service.

For example, with Twitter they send a push notification to the user's device for login verification.  If it didn't require the user's password first to authenticate them then attackers could spam their device with login verification requests all day long.  Or if they used the SMS option the same thing would happen with texts to their phone, plus I believe Twitter has to pay SMS gateway providers for each text they send.  This would disincentivize users to enable 2FA.

There are 2FA factors which can be implemented so they aren't intrusive to users or expensive to providers, like TOTP/HOTP.  If a system prompted for the one-time password token along with the username they could verify this first before asking for the user's password.  From what I've heard this is actually done with Norwegian BankID.  Hackers can still annoy the authenticating site by flooding it with username/OTP guesses, but the site can also deal with these problems in a similar way to password guessing attacks.

Authentication based on WebAuthn would also work well with a stronger factor first design, or without a second factor password at all.

I assume there are probably some usability issues with switching the order.  You would have some people typing their password into the OTP field if you start prompting for that before their password.  That could lead to some account lockout issues.  However, you could probably reduce this to a manageable level with training and effective UI design.

I also agree with you that there are just traditional app design issues influencing some of these decisions.  You would likely need to ask a user for their username alone and then determine what next step to prompt them for (password or other factor) based on a lookup of their 2FA enrollment status.  Google does this already, but I haven't seen this design pattern implemented a lot by other sites yet.  With time we may see others adopt this same approach.

Most sites are primarily concerned with preventing account intrusions against their users and not as much about whether an attacker happens to figure out a user's password can work elsewhere.  After all, the attacker could still actually try their same password guesses against the user on all those other sites.  Beyond combating this with normal password guessing prevention controls, I don't imagine many administrators spend time worrying about that possibility.


Is Recon-ng still relevant? I noticed that Recon-ng is part of PWK/OSCP syllabus.
I decided to give it a try. However, the module google_site_web doesn't seems to work anymore.
[recon-ng][default] > modules load recon/domains-hosts/google_site_web
[recon-ng][default][google_site_web] > options set SOURCE vulnweb.com
SOURCE => vulnweb.com
[recon-ng][default][google_site_web] > run

-----------
VULNWEB.COM
-----------
[*] Searching Google for: site:vulnweb.com
[!] Google CAPTCHA triggered. No bypass available.
[recon-ng][default][google_site_web] >

Is there any solution for this?
Also, I noticed that the last update for Recon-ng was on Jun 24, 2020. Is this tool still relevant?

Relevant? Absolutely. Most tools don't just go out of relevancy (unless they're replaced/upgraded). They all have a place in a wider methodology hence why it is in the PWK materials.


Is Truecrypt still safe? I want to fully encrypt a disk on Windows 7, but I don't trust Bitlocker and Truecrypt has announced it is not safe (also many rumours about NSA being able to decrypt it and it's better to avoid it).

So what can I use? Open source is better, and what is the most secure encryption combination today?

I see many people still use Truecrypt. Are they at risk of anyone easily accessing their data?

Edit: October 3, 2015 An article in IT World for September 29, 2015 reveals the existence of, but doesn't describe fully, two serious flaws in the Windows driver that TrueCrypt installed.  It isn't clear from the article whether those flaws compromise the crypto or the underlying Windows OS, or both.  It also isn't clear whether that driver is installed only for full-disk encryption or at any time a TrueCrypt volume is in use.

Original answer below:

Older versions of Truecrypt are as safe as they ever were.  Unhappily, the safety of older versions has not been conclusively demonstrated, I think.  A code audit by others, of which phase one is complete, did not find any problems that significantly weaken the crypto algorithms, and I really doubt anyone, even the NSA, can crack AES unless there's a back door that hasn't been found.  (That's a back door in Truecrypt; I'm relatively sure that AES itself is safe.)

That said, I am still trusting an older install of Truecrypt.  For you to use Truecrypt, you'd have to put your hands on an old copy of the software.  There is what purports to be a copy of Truecrypt 7.1 on Github.  The Open Crypto Audit Project says it is verified, and I have no reason to doubt that.

There is also an open source successor, VeraCrypt, which I have not tried.


Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable? Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk.

It was for 3 seconds and I was in control of the MacBook the whole time.

Yes.
Android devices have the capabality to act as basically any USB device.
This opens up gates for all kind of Bad USB attacks like

Rubber ducky attack that types in scripts very fast (Almost un-noticable by the user) by acting as a keyboard (HID | Human interface device).
Then it could act as a network device and setup MITM

These two are done by emulating normal USB devices.

Also USB exploits specific to the OS or platform maybe used.

If you want to try these you can try NetHunter.
https://en.wikipedia.org/wiki/NetHunter
https://nakedsecurity.sophos.com/2014/08/02/badusb-what-if-you-could-never-trust-a-usb-device-again/


Is defending a server from BFA with 2 WAFs possible and common? I am not of the IS field and hence reference this to the experts here - My question regards to defending a server from a Brute Force Attack (BFA) with 2 Web Application Firewalls (WAFs). The question can actually be comprised of the following 2 questions:

Is it usually possible? (shouldn't there be some kind of obvious conflict)?
Is it common in the "industry"?

The reason I ask this is my curiosity to know if this could suffice extra security or at least as alternative defense in case one WAF malfunctions because of a temporary bug or a breach that isn't occurring in the other WAF.

This is not common at all, but certainly possible.

When you choose a set of protections for something, you have to balance the costs and benefits against the risks and threats that you have identified.

In this case, you would have to weigh the costs of installing, configuring, and running a 2nd WAF against the possibility of the first WAF having an unknown bug. Typically, this is seen as too costly for the risk. But you have to make that calculation for yourself.

The thing for WAF is that you would have to place them in series (one after the other), which means the 2nd WAF isn't going to be doing much protecting at all under normal conditions, but still needing to do all the work of the 1st WAF.

So, if you want to add protections in case one WAF fails, I'd look at other options (like alerting) instead of a 2nd in-line WAF.


Inspecting every packet leaving the system for sensitive information ? Is there a way to check every packet leaving the system for sensitive data like IP addresses, personal information (like logins) etc ?

A free (and preferably open source) program which does this for Linux would be great.

Otherwise, where would I start to go about coding something like this ?

What you're looking for is network data loss prevention.

There are some costly solutions from Code Green Networks, Symantec, etc.  One free and GNU GPL-licensed ones is MyDLP (specifically you'll want the MyDLP-Network product) that does this.


Web Application Firewall with based on an external decision to detect anomaly I have a theoretical knowledge about WAF but I do not have knowledge of the tools in the market. I wonder if there are any WAFs that base their decision making through a response from an external resource (true or false) when sorting an anomalous traffic.

My idea was to create a Machine Learning based for for example to make this decision and the WAF would just consult it.

Thanks!

This may not be a popular opinion (cue comments), but I am not a fan of Machine Learning being used in the security industry.

I'm always skeptical when it seems like the approach is "We don't know how to solve this problem. I know! Let's throw ML at it!!". There are of course niches within security where ML seems to be doing ok-ish, for example detecting malware and financial fraud, but even there, it's used with caution.

Remember that ML is part of the field of statistics: the science of detecting average-case behaviour. In ML you worry about telling the average dog apart from the average cat, and don't worry about the 5% that it gets wrong. Meanwhile security is the field of detecting worst-case adversarial behaviour. In security your system needs to continue being strong even if the attacker can reverse-engineer it and provide worst-case input.

Now consider the paper: "EXPLAINING AND HARNESSING ADVERSARIAL EXAMPLES" by Goodfellow, Shlens, and Szegedy:

  Several machine learning models, including neural networks, consistently misclassify
  adversarial examples—inputs formed by applying small but intentionally
  worst-case perturbations to examples from the dataset, such that the perturbed input
  results in the model outputting an incorrect answer with high confidence.

Here is the core graphic from that paper:

If it's that easy to "hack" an image classifier (arguably the best-researched subfield of ML), then what makes you think you can build an ML-based WAF filter that performs any better against adversarial hackers?

TL;DR: This has been my rant that ML shouldn't have a place in security unless it's by people who really really know what they are doing.


As a contractor how do I work on multiple client networks without data leakage? I am a contractor who does development for more than one client.  Let's call them Client A, Client B, and Client X.
I use my own laptop for all 3 clients.
Throughout the day, I have to work on and respond to emails and instant messages about projects for all 3 clients.
In order to work on Client X's project, I must be connected to their VPN.
Client X performs SSL deep inspection on the traffic on their network.  (I get errors from sites/apps that enforce key pinning)
I'm worried that information about Client A and Client B, (not to mention my own sensitive information)  might be exposed to Client X.  How can I prevent this, but still maintain my ability to communicate with A and B while working on X's network?
To be clear, all my clients understand that they are not my only customer, so I'm not trying to hide the fact that I'm working on other projects, just trying to ensure that each client's "back-room" information stays private.
I've tried giving each client its own VM on my machine, but the hefty resource requirements of the software I have to use (IDE) makes this prohibitively slow, to say nothing of the licensing difficulties.
Purchasing additional hardware (and the necessary additional software licenses) would mean a significant (to me) financial expense, as well as time & headache managing the extra devices, not to mention would be physically cumbersome, so I'd really like to avoid that route.

You could use a very small VM for each one, but keep the IDE on the host, not on the guests. Share a folder from the VM to the host, so you use the host and its resources to develop, and use the VM networking to access the client environment.
Most of the VPN software can run on Linux, so you could create a very light Linux guest with 256MB of memory and install only the VPN client and ssh server. To access the environment from the host, use SSH Tunneling to create a proxy (putty, for example, works very well) so you don't need VPN on the host.


Is it possible that a single handshake can have 2 TLS versions included? I am seeing different TLS versions (1.3 and 1.2) in the handshake and intermittently it fails with this error:
TLSv1.3 (OUT), TLS handshake, Client hello (1):.
2020-05-28T14:44:00Z.664        [thread-3752]   Info    TLSv1.3 (IN), TLS handshake, Server hello (2):.
2020-05-28T14:44:00Z.665        [thread-3752]   Info    TLSv1.2 (IN), TLS handshake, Certificate (11):.
2020-05-28T14:44:00Z.666        [thread-3752]   Info    TLSv1.2 (IN), TLS handshake, Server key exchange (12):.
2020-05-28T14:44:00Z.666        [thread-3752]   Info    TLSv1.2 (IN), TLS handshake, Server finished (14):.
2020-05-28T14:44:00Z.666        [thread-3752]   Info    TLSv1.2 (OUT), TLS handshake, Client key exchange (16):.
2020-05-28T14:44:00Z.667        [thread-3752]   Info    TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):.
2020-05-28T14:44:00Z.667        [thread-3752]   Info    TLSv1.2 (OUT), TLS handshake, Finished (20):.
2020-05-28T14:44:19Z.781        [thread-3752]   Info    OpenSSL SSL_connect: SSL_ERROR_SYSCALL

Due to backwards compatibility concerns, TLS uses a fake TLS version number in the record layer.
struct {
          ContentType type;
          ProtocolVersion legacy_record_version;
          uint16 length;
          opaque fragment[TLSPlaintext.length];
      } TLSPlaintext;

legacy_record_version:  MUST be set to 0x0303 for all records
      generated by a TLS 1.3 implementation other than an initial
      ClientHello (i.e., one not generated after a HelloRetryRequest),
      where it MAY also be 0x0301 for compatibility purposes.  This
      field is deprecated and MUST be ignored for all purposes.
      Previous versions of TLS would use other values in this field
      under some circumstances.

(from TLS1.3 RFC)
0x0300 is SSLv3, 0x0301 is TLS1.0, 0x0302 is TLS1.1, 0x0303 is TLS1.2.
Your tool displays this field and confuses you. Disregard this information, it is not useful. Replace or fix the tool, or just live with the fact that using TLS requires knowing about the backwards compatibility baggage.
In your transcript, it looks like the handshake succeeds, and then a syscall error happens. But that is not a logical error (like negotiation error caused by no common version or cipher suite, bad cryptographic authentication, etc). Instead that is a programming error, an error with the OS (probably socket) API. Help with programming errors is offered on stackoverflow.


kernel: Intrusion IN=ppp0 on my Fairpoint assigned router from IP in China I'm getting these user alerts:

kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=115.230.125.147 DST=xx.xxx.xxx.xxx LEN=40 TOS=0x08 PREC=0x20 TTL=107 ID=256 PROTO=TCP SPT=64316 DPT=9064 WINDOW=15500 RES=0x00 SYN URGP=0 MARK=0x8000000

And

kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=61.240.144.66 DST=xx.xxx.xxx.xxx LEN=40 TOS=0x08 PREC=0x40 TTL=235 ID=17780 PROTO=TCP SPT=53556 DPT=5000 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

The IP addresses appear to be from China. My broadband was off and on about every 30 minutes all weekend, about the same frequency as I get these alerts. How can I prevent this? I have changed my "root" default password and all other user profiles have been disabled. Any help is appreciated. I'm not that technical, but I can configure some basic stuff on my router.

From: https://superuser.com/a/330763

When I first read this I thought it didn't make sense because something cannot 'intrude' in a kernel. However Googling it I found similar posts (which also give the answer), but also list that the message was something like:

kernel: Intrusion detected from ...
which means something quite different.

The kernel (software) on your router is letting you know that somebody tried to connect ('intrude') to your WAN IP address.

This happens all the time, entire botnets are dedicated to trying to connect to random IP addresses at certain ports to try default user/password combinations to see if they can find weak security somewhere. However because the router denies this, there is no problem.

Summarizing: the 'intrusions' being detected are harmless, you should worry more about the ones that are not logged ;)


Most reduced types of DoS attacks As I understand it, there are generally only two common types of Denial of Service attacks in regards to the OSI model:

Network-Layer-DoS (NLDoS) on layers 3, 2 or 1.
Application-Layer-DoS (ALDoS) on layers 7, 6, or 5.

What about layer 4? Are there any generally common Denial of Service attacks available on this layer? Also, is my reducing attempt accurate?

Layer 4 (Transport) DoS attack is often referred to as a SYN flood.

Layers 5,6 and 7 of the OSI model are referred to as the application layer within TCP/IP. Which you mentioned as "Application-Layer-DoS (ALDoS), on layer 7". However, an application layer flood, could be referred to as XDoS. Unfortunately, besides DDoS Quick Guide by National Cybersecurity and Communications Integration Center, 29 January 2014 I could not find much regarding the OSI model for DoS. Instead, most documentation speaks about the TCP/IP model for DoS.

From DDoS Quick Guide I was able to determine these examples for the OSI Model though:

Layer 5 (Session) - Telnet DDoS attack
Layer 6 (Presentation) - Malformed SSL Request
Layer 7 (Application):

PDF GET request
HTTP GET
HTTP POST


Advanced techniques for detecting a proxy/getting original IP In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used:

Firefox with a proxy setting.
Python with mechanize.set_proxies.
Firefox in a virtual machine with a virtual machine router such that all of the VM's internet goes through a proxy.
TorBrowser (which uses Firefox as the actual browser).

The following things are behaviors I've noticed that are expected:

With all of these, if I go to http://www.whatismyip.com/, it gives the correct IP address (the IP address of the proxy, not the host computer).
whatismyip.com says "No Proxy Detected" for all of these.

Indeed, it seems like the websites I visit do think my IP is that of the proxy. However, there have been a few weird cases which makes me think that some sites can somehow detect my original IP address. I'm curious how they go about doing that.

In one situation, visiting a non-US site via Firefox with a non-US proxy, the site literally was able to print my originating IP address (from the US) and deny me access. Shouldn't this be impossible? Visiting the site via the virtual machine with that same non-US proxy, or the TorBrowser with a non-US exit node, though, the site was unable to do so.
In a similar situation, I was visiting another non-US site from a non-US proxy. If I logged into the site from Firefox within the virtual machine, or from the TorBrowser with a non-US exit node, the site would work properly. However, if I attempted to log in via Firefox with a proxy (the same proxy the virtual machine uses), or with mechanize, it would fail to log in with an unrelated error message.
In a third situation, using the mechanize.set_proxies option, I overloaded a site with too many requests so it decided to block access (it would purposefully time out whenever I logged in). I thought it might have blocked the proxy's IP address. However, when I ran the code from a different host machine, but with the same proxy, it worked again, for a short while, until they blocked it again. (No worries, I won't be harassing the site any further - I kept running the program as I thought it might have been a glitch on my end, not a block from their end.) Visiting that site with the Firefox+proxy solution from one of the blocked hosts also resulted in the purposeful timeout.

It seems to me that all of these sites, in the Firefox + proxy and mechanize cases, were able to find out something about the host machine's IP address, whereas in the TorBrowser and virtual machine cases, they weren't. My question is essentially: How are the sites able to gather this information? Another way to ask is: what is different about the TorBrowser and virtual machine cases that prevents the sites from gathering this information?

the site literally was able to print my originating IP address (from the US) and deny me access. Shouldn't this be impossible?

It sounds like you're expecting anonymity.

Proxies can be elective about whether or not they send the X-Forwarded-For header (which contains the originating IP).

A proxy that doesn't send this header, or record the originating IP in logs, is said to be an "anonymizing" proxy. In the case you mention, the proxy you were using likely forwarded this header to the endpoint you were accessing, so your connection was not anonymized.

There are multiple ways to detect whether or not your traffic is of proxy origin. Two easy ones are:

Presence of the X-Forwarded-For header (or custom data in forwarded headers)
Cross-checking known IPs of proxies or exit relays (TOR)

databases maintained by third parties (e.g. Quova)

There are other ways, possibly requiring additional intelligence on the server, perhaps to correlate requests across connections from different IPs, i.e. looking at user-agent criteria and timing of requests, cookies, LSOs in flash,  (one of the reasons you'd want cookies and Flash player disabled to really anonymize yourself).

In short, just "using a proxy" alone does not make you anonymous or untraceable.


Confusion about the software and also the digital signature getting modified I'm not sure what is very secure about digitally signing a software or firmware to distribute. I understand the benefit in that it can let the receiver know if the data accidentally got corrupted during transfer as the hashes will not match, or if the software or firmware itself was purposely tampered with and modified.

However, What if the software/ firmware and also the digital signature gets purposely modified to suit? The transmitted hash will now match the modified software/firmware. Let's ignore the public and private keys part for now. Won't the hashes will still match on the receiving end and we have a modified software that can still be accepted?

You can't ignore public keys.

Binaries are signed with code signing signatures from trusted certificate authorities and only they are trusted.

Windows drivers are signed with certificates issued by Microsoft and only they are trusted.

  However, What if the software/ firmware and also the digital signature gets purposely modified to suit? The transmitted hash will now match the modified software/firmware.

True, but you can't sign the binary with a trusted certificate (from trusted CA) if you don't have the certificate itself. Obviously, custom made signatures will not be trusted.

  Let's ignore the public and private keys part for now. Won't the hashes will still match on the receiving end and we have a modified software that can still be accepted?

How can you ignore PKI? That's the whole point. They do not trust the signature and they do not trust the binary itself.

Like this:


Locking the user account or returning the "Invalid username or password" We have an application where we are using OS users for authentication and using native OS libraries for authentication of that user credential. We have implemented an account lockout functionality where we can lock the user attempts after configured number of attempts.

Actually, Windows OS libraries does not return the difference between invalid credential authentication attempt of fake user attempt so that's why we have to insert such attempts in DB for account lock. But on unix platforms we used to get the specific return code if user does not exist in system and we only audit such attempts and does not insert the record in DB for avoidance of DDos attack. But now they want same behavior for *ix platform.

So my question what do you suggest from security perspective either we have to lock the user account or return the standard message "invalid username or password" so that hacker should not be able to know whether at least username is correct if an hacker is trying with fake username.

What do you prefer guys either return the message of account lockout which may give indication to user that username is correct only password is incorrect or return the generic error message of "invalid user name or password" .

We have implemented an account lockout functionality where we can lock
  the user attempts after configured number of attempts.

I cant help but wonder wont this result in denial of service?Why not try limiting password attempts by a specific system.But still at the end of the day you can only frustrate an attacker in an attack like bruteforce.

  What do you prefer guys either return the message of account lockout
  which may give indication to user that username is correct only
  password is incorrect or return the generic error message of "invalid
  user name or password"

Its always told to only show a generic "wrong username or password" error message so that the attacker cannot better their brute force in anyway.

If the application is security sensitive.Add 2 factor authentication or use key based authentication


Brute forcing an OnePlus 5 I've never done a brute force before and I wanted to try it out on my phone.
Considering there are 0-9 digits and 4 spaces, that gives me 10^4 combinations.

I wanted to know how I can connect my Mac to the phone through USB or something to run a brute force attack.

Note: This is for educational (curiosity) purposes only.

Edit: I see people are pointing out that the phone will lock me out after a few attempts.
So let's take a hypothetical case where it doesn't do that.
How can I use a USB or something to brute force some device?

P.S. - I was inspired by Gilfoyl brute forcing Jin Yang's smart fridge in Silicon Valley (TV Series)

As far as I know you cannot simply use your Mac as an USB keyboard. Emulating such keyboard is not a software-only problem but the hardware must be usable as USB gadget which is usually not the case with common PC hardware where all  accessible USB interfaces are behind an internal USB hub.

But, USB gadget interface is supported by systems like Rasperry Zero and similar projects (Orange Pi Zero etc). Using such systems it is possible to make the hardware behave like an USB keyboard and once you have this it is more or less sending different key combinations to the device in order to unlock it. This can be done with a short script as shown here.


How to test if TLS is enforced for emails sent through SMTP? We are planning to create a rule in Proofpoint to enforce TLS on all outgoing email. I need to test that the rule is working and emails are bouncing if the recipient SMTP server does not support TLS.

The question is, where can I find or how can I create an SMTP server that doesn't support TLS? Or an SMTP server where I can specifically disable TLS?

I looked everywhere, but I couldn't find any.

Within Proofpoint you should be able to set up a manual mail route (to override DNS/MX) to some external domain so that it uses only SMTP rather than ESMTP. You do this by prefixing the destination with "SMTP:", e.g.

 gmail.com → SMTP:gmail-smtp-in.l.google.com.

This will cause your side to issue an old SMTP "HELO" rather than a new "EHLO" and STARTTLS should not be possible. (This requires both sides to be protocol compliant, it is possible to attempt STARTTLS over plain SMTP in some cases.) If you have an enforced TLS rule for that domain, outbound email should fail.

Or, a network solution, you could use one of many TLS stripping/MITM tools (e.g. striptls),  this performs the
equivalent of the above by intercepting traffic to prevent STARTTLS being advertised/detected/enabled.

Otherwise, with any modern SMTP server supporting STARTTLS, if you configure only a set of ciphers that require RSA authentication (openssl ciphers -v aRSA) but do not configure a key and certificate then STARTTLS will not be supported.

There's a subtle distinction between TLS and STARTTLS, the latter is performed as an in-protocol upgrade: within the SMTP exchange the "STARTTLS" verb is issued and then TLS is negotiated (which is why it has security limitations).

With "regular" TLS the TLS happens first, and can be used for any protocol without first extending it to support that type of upgrade. There is was an old standard for SMTP with TLS, ssmtp subsequently smtps — it never caught on (just like HTTP with STARTTLS). SMTPS on TCP/465 has since been resurrected in RFC8314, but as Steffen notes this is not for MTA-to-MTA, it's only for MUA (client) submission.


How to prevent HTTP header injection attack in J2EE Web application? Is there any library (Maven dependency) available for this purpose? My J2EE application is vulnerable to HTTP header injection attack. I want to make it secure from this vulnerability. Also, I am searching if any library (Maven dependency) available for this.

I think that implementing a library for specifically 1 vulnerability like this, which has an easy fix, is overkill.
Is user input from the headers necessary? If not, then eliminate it.
If user input from the headers is necessary, can you whitelist this input?
If you cannot whitelist the input, can you sanitize the input by stripping newline (i.e. %0d%0a, \r\n) characters?
If you cannot strip newline characters, can you escape them?
If all above fails, you should look into a WAF solution.


A computer on the public network I was using was penetrated at a codejam. Am I at risk? I was at a code jam today for 12 hours.  At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack.  He was voicing this as I was finishing up and I stuck around to get as many details as possible.  He was on a Linux system.  This codejam was labeled a "hackathon" but in reality it was just a programming event, with $10k in cash prizes on the line.  Now I'm worried that I'm at risk.

I was running a Django project server on my Windows 10 machine periodically throughout the day.  When the accusations of real, actual hacking were heard it turned into a murder mystery.  I turned on my VPN but I have no idea if that would actually do anything.  Is my computer safe?  Do I have to nuke it from orbit?  Excuse my naiveté, but I don't think anybody at the event saw my team as a serious threat or competition.  How can I check my machine to see if there are any signs of intruder?  I don't have a shell log to read.

How do I check to see if my Windows 10 machine was compromised in the time that I was on a network where other machines where allegedly compromised?

The short answer, yes, you're always at risk. Should you be worried? Probably not, people like to be the center of attention and be charlatans, another time try to ask for technical details, how did he know that there were a compromise of his computer, what did he do to mitigate?

If your operating system and running applications was updated, you had newly updated security definitions for Windows Defender installed and haven't disabled your firewall you're properly safe. Also try to think it about it another way - what value do you have as a target?

If you still don't trust that you're safe, I would wipe my machine. You can do many things to try to get the feeling that you're safe, but if you're machine was compromised and infected with a rootkit or similar, you would probably not find it anyway.

For Django specifically you can find their security documentation here:
https://docs.djangoproject.com/en/stable/topics/security/

And current CVE's here:
https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=Django&search_type=all


How to identify L2 devices in a Wide Area Network? This is sample of a traceroute to google.com:

TraceRoute from Network-Tools.com to 216.58.194.46 [google.com]
Hop (ms)    (ms)    (ms)             IP Address Host name
1     0       0       0          206.123.64.233   -
2     Timed out       Timed out       Timed out               -
3     1       1       1          4.68.70.166     google-level3-3x10g.dallas.level3.net
4     1       1       1          108.170.240.129      -
5     1       1       1          209.85.242.53    -
6     1       1       1          216.58.194.46   dfw25s12-in-f14.1e100.net

Trace complete

It obvious there should be some layer two and layer one (physical layer tapping devices) network devices in between that we cannot trace or identify, but they have an important impact on the result.

These layer 2 & 1 network devices have many roles, including security.
There are many Agencies or Organizations that capture data on the physical layer or Data link layer like the PRISM surveillance program.

I am looking for theory or practical way to find a way to identify layer 2 devices in order to prove or identify data capturing.

Information from layer 2 are usually not propagated to the higher layers because they are not needed there. Exceptions are protocols like ARP but this is only visible inside the local network. This means it is not possible to directly detect layer 2 (link layer) devices unless you are connected to the same link or inside the same local network (ARP). You might try to infer the possible effects of such devices based on irregularities in the network or timing but most will probably be invisible from remote.


Can a file named "agreement.execds.pdf" really contain an executable file? What can anyone tell me about a file named "agreement.execds.pdf"?

My email filter will not let this file pass because it blocks incoming EXE files. Is this an executable file? The file is actually a signed PDF document and a Norton scan says the file is safe.

Would ".execds.pdf" be considered a valid Adobe extension for a signed PDF document? I have looked at the document and it appears that it is just a signed contract sent to my client that they were expecting.

I've seen this before, and it is a result of an unintelligent filter. It is picking up on the ".exe" in the middle of the file name.

agreement .exe cds.pdf

If you rename the file it should pass through easily.

It might seem silly that these filters will happily allow a real .exe to come through as a .jpg or whatever else, however they do still provide a level of protection. Your regular everyday user will still be largely protected because their attempts to open an exe with .jpg extension won't execute the exe, and will just give them an error.

The reason it plays safe and sill picks up the .exe in the middle of the filename is because users are dumb. They might realize that in order to view cool_cat_picture.exe.jpg they just have to rename it themselves. Without any .exe at all there is no prompt for the user and significantly lower chance of it being run.


HPKP for self-signed certificates On https://dev.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- ,

and https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning in the first yellow box,

it says that Google Chrome and Firefox disable pin validation for hosts (servers) that use a self-signed certificate. The server that I am connecting to uses a self-signed certificate who I trust by adding the self-created authority that signed it as trusted in my google chrome HTTPS/SSL settings. Is there a way I can still verify that the certificate presented to me is really from the server, and not from an attacker who uses a certificate signed by some other trusted authority (a hacked one for example, like in the DigiNotar schandal) ?

You have two solution:

Use HPKP and a trusted certificate
Keep your custom CA and use the Firefox addon "Certificate Patrol": https://addons.mozilla.org/fr/firefox/addon/certificate-patrol/


Is it possible to prove which public key was used to encrypt a message? Pretty much the title: If Alice sends a message to Bob that she encrypts with Bob's public key, is it possible for Eve to prove that the ciphertext was encrypted with Bob's public key, that the encrypted message is intended for Bob?

Update

Suppose the algorithm is RSA.

"Proving" depends on whether the recipient (Bob) cooperates (i.e. accepts to reveal his private key to the verifier), and also on the type of cryptographic algorithms and details of the key.

If Bob cooperates, then he may decrypt the message; this may show that the message "makes sense" when decrypted with Bob's private key, which is a rather strong hint that Bob was intended as the recipient, or at least as a recipient. This depends on what qualifies as "making sense", of course. Most asymmetric encryption systems are hybrid: an asymmetric key exchange yields a message-specific key shared between sender and receiver, and the key is then used to encrypt the actual message data. If the encryption uses (as it should) a MAC to detect alterations, then this can be turned into a convincing proof that the sender really worked with Bob's public key in mind (but it depends on the exact algorithms employed).

Note that, depending on the used algorithms, it can be possible for Bob to take an existing message, and compute his own key pair so that the message (as a sequence of bytes), when decrypted with his brand new private key, decrypts to a message of his choosing. Thus, asymmetric encryption cannot, in general, be considered equivalent to an ownership claim.

If Bob does not cooperate, things can be tricky. We are now in the model of traffic analysis, where an attacker tries to see through anonymous communications. In that model, Bob is not a potential attacker, but a potential victim. Hiding the recipient identity is not a primary property of asymmetric encryption and key exchange systems. If we consider asymmetric encryption with RSA, then the key size is leaked, since it matches the encrypted message size; this can reduce the number of possible recipients.

As a more extreme case, consider Diffie-Hellman. DH is computed in a given group, consisting of a prime modulus p, a subgroup size q (q divides p-1 and is normally prime) and a subgroup generator g (g has order q, which means that gq = 1 mod p). These values (the "group parameters") are part of Bob's public key. The message will first begin by a value B = gb mod p, with a randomly chosen exponent b: that value is a subgroup element. For a given asymmetrically encrypted message, it is easy to look at the header, see the B value, and check whether it matches a given (p,q,g) DH group specification: simply compute Bq mod p; for the right group, it will yield 1, but (with overwhelming probability) not for a distinct group.

So if potential recipients use Diffie-Hellman and each one generated his own group, then this simple test will pinpoint the actual recipient. On the other hand, if several recipients decided to generate their respective key pairs within the same group (which is allowed in DH and does not incur any security weakness), then outsiders will not be able to determine which recipient is the right one: doing so would entail solving the Decisional Diffie-Hellman problem, which is hard (we don't know of any way to solve DDH, in a normal DH group, except through Discrete Logarithm, which is thwarted by large enough p and q).

Also, pinpointing is not proving. Anybody can take a copy of Bob's DH group parameters (they are part of Bob's public key, thus public themselves) and generate his own key pair within the same group. Therefore, being able to recognize Bob's group in a given message does not demonstrate that only Bob could read the message; the message could be meant for somebody else whose key works in the same group.

(Having many keys in the same group is a very common occurrence when using the elliptic curve version of DH, because generating your own curve is hard work and severely limits interoperability.)


What SSL options should not be used? What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.

You should avoid the "weak" cipher suites:

Cipher suites with no encryption (with a NULL in the name).
Cipher suites with 40-bit or 56-bit symmetric keys (DES, DES40, RC4_40, RC2_CBC_40)(3DES is fine, though).
Cipher suites marked "for export" (with EXPORT in the name: they are weakened to comply with pre-2000 US export regulations).
Cipher suites with no server authentication (DH_anon).

No sane software will enable these by default, or at all. But it is safer to check explicitly...

You may want to avoid RC4 because of the bad press (it still takes some millions of connections with the same encrypted data to hit the known weaknesses, which is not a huge security margin, but the attack is not really practical yet). Some people want to avoid CBC-based block ciphers because they fear the BEAST, but it does not work any more. Similarly, use of MD5 in SSL/TLS is safe, but the idea that "MD5 is broken" is so widespread that using MD5 tends to trigger questions and justifications and endless debate. In practice, your system won't be broken into because you used RC4 or MD5 or AES-CBC or any other non-weak cipher suite; we are in the realm of public relations here.

Among possible options, you should avoid compression unless you make sure that it does not apply to your exact context; this is because encryption hides data contents but not data length, and compression makes length dependent on the contents. In a Web context (HTTPS), this is called the CRIME attack.

If possible (depending on your server software and server certificate), try to use the DHE cipher suites: they provide Perfect Forward Secrecy. Said otherwise: if you use a non-DHE cipher suite, and some bad guy manages to steal your server private key, then he will be able to decrypt past connections (connections which the attacker observed passively, from the outside, before the actual key theft). PFS is about avoiding that. (But, of course, PFS or not PFS, it is much better if your server private key is not stolen at all.)

Don't use SSL 2.0. In practice, SSL 2.0 still offers some decent protection against passive attackers, but active attackers can play nasty tricks. If your client and server software supports SSL 2.0 but not SSL 3.0 or TLS (1.0 or ulterior), then your software is more than 15 years old and almost certainly has a lot of other problems.


Does adding a randomized string in S3 file path has equal security to Google Drive shared link I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version.
I want that the firmware file in the S3 bucket is secret to only me and my devices. But I don't want to embed any credentials inside the devices. And I cannot use a pre-signed URL as it has a limited expiration time and I want to avoid creating another API or Lambda to generate the pre-signed URL.
I am thinking it would be great if I can generate something like Google Drive's shared link (in the picture below) in S3.

Then I realize that I could just put a randomized string in my S3 path and make only that file publicly accessible. For example.
my-bucket/firmware-v1.bin <-- private
my-bucket/firmware-v2.bin <-- private
my-bucket/QMeOvULdBEI0qGf0KFOl/latest.bin <-- public permanently

Then I will let all my devices remember the link https://<aws-s3-domain>/my-bucket/QMeOvULdBEI0qGf0KFOl/latest.bin to check for update.
I would like to know how secure is this method compared to Google Drive's shared link.

Is it as secure as a Google Drive shared link?  Yes, that is to say, not at all.
A shared link from Google Drive is not meant to provide security.  It is meant to prevent brute-force attacks from randomly guessing the link.  Your idea would provide the same functionality as well - but the problem is, your threat model does not consist of other internet users who know nothing about your link.  When you say:

I want that the firmware file in the S3 bucket is secret to only me and my devices.

I am assuming that to mean you want to keep the link secret from the users (consumers) of your devices.  This is futile, because the end user has any number of ways of getting ahold of the link, or the file itself after it has been downloaded to the device.
As long as the bucket is exposed on the internet, there is no way to validate that a request is coming from one of your devices and not from a user who has investigated the device to identify whatever criteria you are using.
That said, while nothing will achieve the exact goal you're asking for, there are some steps you might be able to take:

If you know where these devices are going to be deployed (such as if they're purpose-built for a site, or if your target market is only in the US) you can geo-restrict requests to the bucket.  This will prevent spurious requests from geolocations you know will not need to be supported.
You can rate-limit incoming requests.  If a user is sniffing traffic externally from the device, without breaking into its internals, they will only be able to see the SNI field of your requests (e.g., s3.region.amazonaws.com).  This would prevent brute-forcing based solely on the SNI.  This will, of course, not work if they are running a TLS MITM on their network.


Bruteforce using crunch and Aircrack (custom starting number?) I'm trying to do a Bruteforce attack on a handshake taken from my wireless network that is not WPS enabled. The reason I'm doing it is because I'm testing how strong a 10 digit phone number is as a password. I tried the following command

crunch 10 10 0123456789 | aircrack-ng -e NETWORK -b 60:C3:97:34:8B:E9 -w- hs/NETWORK.cap

But that took too long. I'm wondering if there is a way to start the attack after the first 3 digits of the password. Here they would be "760". I tried

crunch 10 10 7600123456789 | aircrack-ng -e NETWORK -b 60:C3:97:34:8B:E9 -w- hs/NETWORK.cap

But that starts with "777". Any help getting "760" first would be appreciated.

crunch 10 10 0123456789 -t 760%%%%%%% | aircrack-ng ...........

where 760 are the first three characters and the percents are any possible number. Meaning % stands for any number after 760

for lower-case letters replace % with @
for upper-case letters replace % with '
for symbols replace % with ^


What is zero-legged OAuth (or does it exist)? As I understand it, zero-legged OAuth is where the normally temporary token/secret codes are decided on beforehand and are made to not expire, so there's no  authentication step needed before you make "actual" requests of the backend REST API. To me, that seems to go against the standard. Am I right in thinking this?

The authentication is in practice no different- the same secret is used as in other flows by the client to create a signature or otherwise provide proof of  possession of the secret.

The difference is on the service providers side. Every service provider endpoint participating in zero-legged-auth needs to know how to access the provider's form of the client secret, to be able to directly validate requests signed with the secret.

This is a less capable, more monolithic and potentially less secure architecture- less secure because of the need to distribute the actual shared secret, rather than a limited-use token.


PKI management with easy-rsa I recently setup an OpenVPN server with easy-rsa and have questions about certificate revocation:

In the event that someone's private key gets compromised and I have to revoke the certificate with revoke-full, do I need to keep the revoked .crt/.csr/.key on the server?

I'm asking because I'm using the certificate owner's full name as the certificate name and was wondering how I would generate a new certificate with the same name if there is already a (revoked) certificate with that name.

No, easy-rsa does not require you to keep revoked certificates around.  The only reason I can come up with to keep them is to have some sort of poor mans audit log.

Just make sure to revoke the certificate before you remove it, because easy-rsa (at least version 2, which I looked at) seems to require the .crt file to be present to revoke a certificate.

Also, if you're still in the process of setting up your pki, consider switching to easy-rsa 3.  That is a complete rewrite, which adds a number of interesting features such as ECDSA support.


Anything to do about old gpg keys? Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block.  Now I have gone through a few new computers and OS's, etc. and lost the private keys and revocation certificates.  It's a good thing that I didn't create the keys with any expiration, so they can live on forever!

My question is this, are these keys going to be out their till the end of time? or at some point will they be erased?  Is it true that I can't get them removed without the revocation certificates?  Is their any issues I might run into with these keys existing out there forever?

"Privacy" had a different meaning when PGP got its name.  Keyservers and the implications of publishing the names and metadata of people who signed your keys wasn't a well understood issue back then, but today it is a pretty serious privacy concern.

Since email addresses change, and "identity" can be reasonably tied to legal name, birth date and city of residence, I have a PGP entry up there with a little too much information, and signatures from some interesting characters.

A reasonable study of signature dates can be used to figure out where I was on what date, with whom I met and what conferences I might have attended.  I would like to remove my keys and play my cards a little closer to my chest, but I can't.

To the best of my knowledge, there's no way to remove the information, even if you have the revocation certificate.  They'll just be stored with the revocation to indicate that your key was compromised.

I would be very happy to be wrong about this.

The downside to having unrevoked keys in the wild aren't too serious.  It can look a little unprofessional, make you harder to find on a key server, and can lead to people sending you emails you can't decrypt.  Aside from that and the normal concerns about your social network leaking through the web of trust, there are no serious issues.


Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password? I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness.

Before, I just grabbed the generated salt and put it as a parameter for Rfc2898DeriveBytes to take care of, but now I've changed my approach to the following, and I'm wondering if it's doing more good, or more bad:

Generate a random salt.
Append the password to the salt.
Hash the salt, using SHA-512.
Pass the hashed salt to Rfc2898DeriveBytes, so it can do its magic.

I'm aware that any salt I provide to Rfc2898DeriveBytes, as long as it's unique/randomly generated, is considered a "true" salt, due to the nature of how the method operates. Does that mean that it'd be just as good as to pass the generated salt without any of the above modifications? (appending the password to it, and hashing it)

For informational purposes, the hashing algorithm Rfc2898DeriveBytes uses, is SHA512.

Why is using the password as part of the salt a problem?

Because you need to store the salt separately from the hash of the password. You can either do this by encoding them in a specific way, such as storing them as $Rfc2898$iterations$mysalt$myhash or by using dedicated database tables.

If you would go with the scheme you proposed (crating a random salt, appending the password and hashing it with SHA-512), then an attacker would not need to crack the 100000 rounds of PBKDF2 at all. Why? Because you provided them with what is essentially SHA-512(password, salt). The fact that you later use this data as input for a more computationally expensive form of hash doesn't matter, because you need to save this data for further verification?

But what if I just save the random part of the salt and then mix the user input in on-the-fly?

Yes, you just proved that mixing in the password gives you no security gain whatsoever. All you need is the random part!


It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place? I have the following question regarding the decryption of SSL traffic.
The topology that I have in mind is like this:
User-------MitM Proxy--------WebServer
In the environment described earlier there is already a commercial proxy which is doing a man in the middle attack by replacing the original SSL certificate of the server with it's own.
Can I decrypt the SSL traffic between the user and the proxy and send them un-encrypted to a forensics/sandbox solution? I have a tap device between the users and the proxy  and the public and private key of the mitm proxy are available.

EDIT : If the proxy SSL certificates are already installed on the user computer then yes absolutely and here's the right answer. Otherwise keep reading...

Yes and no.

No because by replacing the SSL certificate of the server by your own, the user's browser will raise a big scary warning that the certificate is invalid and will warn the user that he should not proceed.

Yes because if the user still decide to proceed and accept the false certificate, then you will be able to decrypt everything since it was encrypted with your certificate.

Alternatives

If you are able to install your certificate directly on the user computer, then his browser will not raise any warning and you can decrypt everything. Check this link
Just replace the https by http. Most users don't take the time to check that it's really https so it's a very effective MitM attack.
Get a real certificate for a url that is similar to the url you are targeting.


Standard AES vs additional parameters with Rijndael - what is more secure? I know that Rijndael and AES are pretty similar and AES is just a subset of Rijndael, and I have read that Rijndael can have 256 bit blocks while AES has "only" 128 bit blocks.

The problem is that I have no real idea of cryptography my question is what is more secure? Is "standard AES" more secure or some of the tweaked options using Rijndael? Right now I am using MCRYPT_RIJNDAEL_256 in PHP which is (as far as I can tell) Rijndael with 256 bit block and key size while AES-256 has 256bit key but "just" 128 bit blocks.

The point is in the end whether to use AES or Rijndael?
Also what mode would be best for security/performance? Right now I have ECB since that was used in a tutorial at that time.
Is there another algorithm that is even more secure? It should be fast,  since I am doing a lot of crypto stuff using it, but still stay secure.

128 bit blocks are fine
Yes, larger block sizes have some advantages. If your blocks are larger, then can encrypt more data with the same key until you have to roll over to a new key.
But for practical purposes it's enough. (Re-evaluate once you intend stay safe past the petabyte barrier with the same key.)
ECB is bad.
Identical input blocks are encrypted to identical output blocks. This is bad.
Unauthenticated encryption is bad.
Attackers can flip bits in your blocks, delete blocks, resort blocks, insert blocks. This is bad.
Try to use GCM
GCM is an "Authenticated Encryption" mode of operation for block ciphers. It hides repetitions in the plaintext and it seals the ciphertext against manipulation.
I don't know if this is in PHP natively. This questions suggests something like this is doable via OpenSSL:

https://stackoverflow.com/questions/28290973/gcm-authenticated-encryption-function-for-php


How is HSM access gated? On the backend if I use a HSM (or even have the master key on a physical server), I need to do operations using that key. That means the app server is going to call into the HSM (or keyserver). What is the usual practice of authenticating calls to the HSM? Reading around, its usually done through a key pair that the HSM signs/knows about. But if the app server is compromised then an attacker could just relay the messages and perform the operations using the HSM and get valid data. I believe this is to be expected and par for the course, when the server itself is compromised.

I understand that the main idea behind using HSMs is to protect the key. But is there much thought/effort put into identifying compromised access to HSMs/Keyservers?

This can be accomplished in many ways. The most simple access control to a HSM is a physical button. So if a malware compromises the host computer, somebody still needs to be physically present to push the button for the HSM to do anything.

Then you have a whole range of different access protection, ranging from verifying the software in the host server "externally", to requiring a PIN (that the server will itself erase if it founds itself to be compromised).

A HSM can also limit operations on a key. For example, only allow a key to be used for signing and not decryption for example. Or require specific formats on the input data that is being signed or decrypted.

Another thing a HSM can enforce is rate-limiting, both for authentication attempts but also for operations. A server that usually decrypt lets say 1 message per 15 minutes can set to be rate limited to maximum 1 message per 10 minutes, which would reduce the usefullness of the HSM access from a compromised server.

However, the main objective for a HSM is not to limit access to the HSM itself. The main objective for a HSM is to ensure that the key itself, never leaves the HSM.
Here it ranges all the way from simple HSM that will only allow access through a simple interface, but it will not have any features that prevent physical compromise/attack, and the other end of the scale is very advanced HSMs that can resist a attack even if a adversiary has unmonitored physical access to the HSM for a very long time.

To make a analogy:

Imagine itself:
If somebody was being able to use your car key once, does it matter? Is your car compromised? No, because your car key was not copied. The adversiary gained a one-time access to your car. As soon as you have reclaimed control of the car key, the car key is fully secure and safe to use.

But if somebody COPY the car key, its effectively compromised and needs to be replaced.

Imagine the same thing with encryption keys. Some encryption keys can be hard or cumbersome to replace, and the process of replacing it can itself be vulnerable to permanent irrevocable compromise if the replace process involves the compromised key. (example: A attacker uses the compromised key to initiate the replace process to his own key. If the key managing system is distributed and not managed, the company or individual has permanently lost access to that record).

Here a HSM can also contain functionality to prevent the corresponding data for initiating the replace process (revocation certificate etc.) from being signed unless a specific PIN is entered, one which the server don't know.


Intercept traffic other than port 80 and 443 on burp suite I am trying to intercept traffic on port 8000. For example my application is running on abc.com:8000. I am unable to intercept this traffic on burp suite. How can I intercept this traffic in Burp?

In the screenshots below, I've assumed you want to intercept traffic at port 8080 (which is not the default port for the http protocol).

Start burpsuite and enable it to start intercepting network traffic from your machine by clicking on the "intercept"button as shown in the screenshot here:

Next, configure your browser to use burpsuite as the network proxy, see the config for Firefox, the configuration is similar for other browsers:

If you have traffic flowing via some other port number then change to it from 8080. Otherwise, you need to use the port no which you have chosen. In case you need the proxy for other protocols such as intercepting SSL traffic, then enable proxy for other protocols too.

As soon as you change the proxy config, all network traffic will start appearing in burpsuite for interception and modifications.


Is it possible to determine if some given data is not encrypted? Let's say I'm running a BitMessage node.  One possible attack against me would be to upload illegal content to my node, and once someone knows it's there, to tip off the authorities, who would then search my computer and discover illegal content.

However, all the content is supposed to be encrypted, and unless you have the private key because the message was addressed to you (or you want to try all possible combinations of all public keys to look for broadcast messages) then you can't actually read the content.

That being said, an attacker could send a message to other nodes that had an unencrypted payload.  Receiving nodes assume all messages are encrypted, and they try to decrypt every message with all of its private keys (or public keys of broadcast senders you want to subscribe to).  In order to defend against such an attack, the receiving node has to be able to reject messages that have an unencrypted payload.

Is this possible?  Will a test for randomness work?  What if the data was zipped, would that still work?

Edit

@Gilles - it's true that they could upload any message, even encrypted, and give the cops the key.  However, then you have plausible deniability.

However, there are ways to undermine plausible deniability.  First, an attacker can do what I described above and find some way to transmit lots of unencrypted content.  They could perhaps even release a customized BitMessage client that lets you read the messages easily.  Second, I can just send encrypted broadcast messages on the network and publicize the heck out of my BitMessage address, so everyone who wants to subscribe will find it easy to do so.  In both cases all you need to "read" the illegal content off my hard drive is a free and easily available piece of software.

The only way to fight that is with a BitMessage address blacklist, which isn't feasible because in order to check if a message should be blacklisted, I have to attempt decryption using every known blacklisted public key.  That would bring the network to a crawl.

Now let me ask you, if you had gigabytes of CP images on your hard drive, but you didn't have any software installed that could view them, even though you knew about the existence of said software if you wanted to view it, do you think any judge would not find you guilty of possession?

I don't see how this isn't a fundamental flaw in the BitMessage protocol.  (Technically it's a flaw in our laws, I realize that, but such protocols exist and are necessary because of such law.)

There are a few problems with the assumption that Bitmessage could be used as a kind of "Trojan horse" to introduce illicit content to your machine:

Individual nodes contain a mix of content from other users on the
network.  Therefore it is unlikely that an arbitrary node will have
all of the necessary pieces to reassemble illicit content.
Content is only cached for two days,  after this time the pieces of
content are removed from all nodes.
Bitmessage uses public key cryptography, such that only a recipient
of a message is capable of decrypting it.  Law enforcement should not be able to decipher the content on your machine unless you are the recipient.


How to expose a client's real IP address? As a forum administrator, how can I find a client's real IP address? Are there any third party tools or weakness that expose the real IP address?

If you run the forum software, then you implicitly know the IP of anyone who connects. Whether the forum software stores that information for you to see depends on the software, but it's always possible.

This isn't a weakness or vulnerability of the software, rather it's a necessary component of how the Internet works.

Note that questions on how to configure your specific forum to show you this information are not on-topic for this site.


Gmail account hack prevention and recovery I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back.

The associated phone number and recovery email can be changed, in fact I expect the attacker to change them immediately so there is no real value in them. Is there a way how to link my gmail account to my real life identity; a paid service maybe?

The hack preventing side is pretty much covered by the dual factor authentication that was recently introduced and the use of the "Always use HTTPS" setting (on by default in gmail) for accessing google, to avoid ssl-stripping attacks.

Now, when you have a compromised account and want to claim it back, Google has a structured procedure to verify you are the real owner of the account, in case the normal password recovery options do not work:

You have to complete a fairly detailed form and send it to them, and they say that it is a good thing to do so from an IP address that you have previously used to access the account - they obviously store those.

Among the details that they need you to provide are:

If you used Gmail with this Google account. If yes, what was the most recent mail recovery address you used (in case it has been changed). Also, what are the e-mails of your 5 most often contacted people, what are the names of 4 labels you have created in the account, if you created the gmail account using an invitation or not etc.
If you used your Google account with other services, like orkut, blogger or any other, you provide details about them, like when you first started using them. The details need not be 100% correct - I guess a real person is going to assess the situation at some point after passing obvious checks.
Other details you have to provide include an estimate of when you started using any google services at all (associated with the account), when you last logged successfully and what is the last password you remember for this account (so they must be storing password hashes of previous passwords).

EDIT: Just found a google article with more info about the reclaiming situation. http://knol.google.com/k/how-to-recover-a-hacked-or-compromised-gmail-account

EDIT2: Just noticed you mention paid services. There is Google Apps for Businesses that offers some benefits for a moderate fee, including live phone support that could potentially help in situations like that, although not sure. On the other hand, there are indeed commercial services, dealing mostly with the authentication part, like DIGIPASS by Vasco. There are several services like that in google marketplace.


What is the common practice to encrypt user's personal identifiable information I am trying to protect the data by using AES to encrypt all PII data before it is saved to database, and I think the general mechanism is something like below.

(This is what I think, not necessary correct)

User input data -> html sends data to web service via https -> web service encrypts the data using private key that is distinct to each user -> web service saves data to database

and on the other way:

User request data -> web service gets data from database -> web service decrypt the data -> web service sends back the data to user via https

For example, email is a PII field that is encryption protected. Say when user is registering, they provide an email and a password. Web service calculates a random private key and use that key to encrypt email, (Question I here.) and saves the encrypted email to database. When user wants to log in using the email and password combination, they again sends the email to web service (Question II here).

However the two questions arise:

Should I store the private key in database? Should this be encrypted? If so, how can it be retrieved and decrypted? Otherwise what should we do about the private key?
Assuming in question 1, we save the private key somewhere with user ID as PK. At the moment when user tries to login with email and password, the web app receives clear-text email without knowing the user ID. How should it decrypt the email without the user ID that is used to locate the private key? Without the private key, how can the system confirm the email is a valid email?

These may be basic questions but I just can't figure out... Wondering what the industry is using to solve the problems, or am I even on the right track?

Encrypting the private key as well really doesn't add much more security - ultimately you need to store some key unencrypted therefore it makes sense for that to be the PK.

Given the email address is encrypted (signed using the PK) you will need some additional information to perform the look up - the recommended solution is to use a public key. The public key is distributed to the clients and sent as part of the requests and used to lookup the PK and decrypt the data.


Is there a way to check later if a saved page originally served via HTTPS is legitimate? If a page is served to me via HTTPS and the certificate is OK, I know that the page is authentic.

What if I save the page? Can I check later if that page is authentic?

There is no technical way you can know that the page is authentic other than having to reload it, i.e contacting the server again and validating its certificate. And that's by design, because otherwise it would kill the purpose.

Think about it, if there was such a way then it would be easy to copy another page's "authenticity" and apply it to fraudulent pages.


Cowpatty handshakes vs Pyrit At the moment I have a strange problem: I captured a pcap-file, and pyrit and aircrack tell me that it contains a valid handshake. But cowpatty complains about not having a full handshake, thus making it unable to crack the pcap file. Why? Is there a solution?

I experienced the same issue in the past. I think you experience the same problem (it is described here)
Please answer the following :

What software did you use to capture the handshake ?
If you open the handshake with Wireshark, how does it look like (screenshot) ?
$ pyrit -r "yourcapture*.pcap" analyze give you what status (good/workable/bad)?
Did you 'clean' the capture using 'wpaclean' or other tool ? (In my experience it can damage your pcap rather than 'cleaning it properly')

The only solution I have found at the time was to capture a new handshake / or clean it myself.


Are the keys generated by ssh-keygen only used in authentication? After reading SSH Passwordless Login Using SSH Keygen in 5 Easy Steps, I come across the question: Are the keys generated by ssh-keygen only used in login authentication? I mean if I want to modify ssh-keygen to support a new public-key cryptography method, it won't impact the data transfer except login flow.

Sorry if it's a dumb question.

Yes the keys you generate are only used to authenticate who you are. The actual encryption is handled after you authenticate.

So the initial communication to authenticate is Asymmetric, using your generated keys to confirm who you are, then a set of Symmetric keys are generated to encrypt the actual session.

Rather than me make a mess of explaining the actual details here is an easy to understand breakdown: https://www.digitalocean.com/community/tutorials/understanding-the-ssh-encryption-and-connection-process.

Assuming you do change ssh-keygen as long as it is a supported cryptography method the server can understand it will not effect the integrity of the data in transit.


Is LastPass' locally stored One-Time-Password recovery a security problem? If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled.

The procedure is described here:

http://helpdesk.lastpass.com/account-recovery/

It goes along these lines:

Go to the account recovery page.
Enter the e-mail address you use as login to LastPass
You now receive an e-mail with instructions on how to proceed, and a locally stored One-Time-Password has been enabled.
Using this password you should be able to restore access to your password database without using your master password. (I don't know how this works, but maybe LastPass has a 2nd copy of your password database encrypted using this OTP in addition to the database encrypted using the master password.)

But as many people have their mail program setup to the mail account they use as login to LastPass doesn't this mean that if somebody gets access to your machine and manage to login then they can:

Enable the locally stored OTP using the recovery link.
Read the instructions sent to you by e-mail because the also have access to your local email program.
Gain full access to your entire password database.

And they can do so without knowing your master password?

Is there something I have misunderstood?

I have actually tried to use account recovery with LastPass just to test this on Mar 5 2014. Lastpass sends you a link good for 48 hours via the email account associated with Lastpass. You need to access this link from a browser with a Lastpass plugin installed. If this plugin was used to access the lastpass account with the email address used for the account recovery, and if One Time Password was enabled, you will be taken to your vault and offered the chance to change your master password. HOWEVER, if you don't change your master password, you will still be left in your lastpass vault, with your various logins visible. You cannot export them without knowing the master password, but you can look at (edit) the various individual logins. Thus someone could take for example your bank login information without ever changing your master password. You might never know this has happened. This presumes that someone has access to your email account, for example, if you left it open on your computer when you stepped away.

I think turning off One Time Password is a very good idea. And the One Time Password in advanced options in the plugin, is PER MACHINE. So any other browsers you use, or portable versions, or if you ever logged into lastpass from someone's computer using their browser and plugin.

I think LastPass should probably disable One Time Password by default, even though some users would probably forget their master password and lose access to their password vault. Lastpass should at least make the One Time Password account wide, not per machine. So you don't have to remember every machine you ever logged from.


Is is possible to decrypt 802.11 for WPA enterprise? So it is fairly trivial to decrypt 802.11 for WPA-PSK as explained in this link https://wiki.wireshark.org/HowToDecrypt802.11. Is it then possible to decrypt the same way for WPA enterprise?(Assuming that you do know the full credentials of the client whose traffic you are trying to sniff and that you managed to capture the full 4WHS)

The methodology I've always seen for this involves using Hostapd in a man in the middle style attack.  Essentially setting up an Evil Twin style attack on the enterprise network, failing but still gathering enough of the keying material to recreate the credentials.

It only works on certain EAP/PEAP modes (essentially things that aren't *TLS)  http://blog.gojhonny.com/2015/08/pwning-wpa-enterprise-with-hostapd-on.html is a good example of this setup.  Famously used by Moxie (along with shitty crypto) to break MSCHAPv2 (http://blog.erratasec.com/2012/07/the-tldr-version-of-moxies-mschapv2.html)


Why do we have to put the shellcode before the return address in the buffer overflow? I'd like to know why we have to put the shellcode before the return address in a buffer overflow. Logically the return address will point to the shellcode and will be executed, so the return address should be put before the shellcode. Can someone explain me?

The buffer overflow, by definition, needs to overflow the buffer. This is to overwrite the return address at the end.

This gives a convenient location in which to drop the shell code. If you tried to add it afterwards, you might overwrite another memory address and then the program would crash in a different way.

So adding the shell code before the return address enables the return address to be written to to trigger a jump to the previously written shell code. To sum up, the buffer you're overflowing is often the perfect location to write your shell code without overwriting another important bit of memory.