Why did the Papal conclave use a Faraday cage in 2013 when selecting the new pope? The Wikipedia article about Faraday cages has this anecdote:

  A Faraday cage was used in 2013 by the Vatican to shield the Sistine
  Chapel from electronic eavesdropping during the secret papal conclave
  to elect the next pope.

  Source: "Papal Election: Vatican Installs Anti-leak Security Devices at the Sistine
  Chapel".
  International Business Times. 2013-03-10.

My question is, what would this accomplish? I can see two motivators: they either don't want what they discuss to become public, or they don't want people to have any inclination as to what the decision is leaning towards before it is made.

If it's the first motivator, a Faraday cage won't help. Hardware could be recording and transmit when the cage is removed or be retrieved at a later date. If it's the second motivator, it's probably a better question for the Catholic stackexchange, but I do not know of any reason why this would really matter (are people making huge bets on the outcome? If so, why does the church care?).

Is there some other reason for the use of a Faraday cage I haven't thought of?

When you read up on the source quoted in the article, you will notice that it apparently isn't talking about a "real" Farraday cage around the Sistine Chapel (putting a whole building under a wiremesh dome would be ridiculous even for the Catholic church) but rather about a figurative one in form of:

  the installation of equipment which blocks any electronic signals from getting out of the Sistine Chapel.

The author doesn't seem to be very tech-literate (see second to last paragraph), but it appears like he is talking about GSM jammers or similar devices which make cellphone communication impossible though active interference, not passive blocking. Such device are available commercially over the shelf for affordable prices. By the way: such devices violate broadcasting regulations in many countries making them illegal. But the Vatican is a sovereign state, so they don't have that problem.

The main motivation for this measure was that during the last conclave in 2005, the election of Pope Benedict XVI was leaked to the media before the official announcement. This is what the Catholic church wanted to prevent from happening again in 2013 and this is why they took technological measures to prevent anyone inside the conclave from communicating with the outside world until the official announcement.

Leaking information later was a secondary concern.


REST security standards As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as:

XML-Encryption
XML-Signature
SAML

Are there any security standards for RESTful services?

OWASP has some very good guidelines concerning the security of REST services.


Does it take longer to brute force a password starting with z than one starting with a? I was wondering about the following:

If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ?
In this case assume the password is not salted, just hashed.

Does a Brute Force attack start with "a", try and then go on or compute all hashes first and then see if any matches?

In general, attackers are adaptive. They know what people think. If users tend to begin their passwords with 'z' then attackers will start their brute force with that letter.

Any specific strategy, such as choosing a 'z' as first letter, may give you an edge over the attacker only as long as the attacker does not know it; so talking about it on a public Q&A site is not the smartest move ever. Moreover, attackers always have the option to try passwords in a random order, which ensures a non-worst case for the attacker. When there are N equiprobable passwords, the average cost for the attacker is N/2 tries, and by trying the passwords in a random order, the attacker achieve that cost regardless of your choosing strategy.

The important point is that password protection is stochastic. For any specific password instance, an attacker can get lucky; he can also be especially unlucky. We thus analyse password resistance based on the password generation process, not based on a specific password instance: the generation process tells us what will be the average success rate of the attacker. "Average" is the crucial word.

Take note, too, that probabilities rule your life: whenever you get out of your home, you are taking the probabilistic bet that you will not be struck by lightning or bitten by an rampaging Rottweiler. You accept this because you instinctively perform a cost/benefit analysis and consider that such events are sufficiently improbable that they don't outweigh the benefits of being able to walk outside.

That concept just applies to passwords as well: you will rely on your password generation process having sufficiently high entropy, i.e. making attacker's success rate sufficiently low, that attackers will not even try (or won't succeed with high enough probability). In that sense, "aaaaaaaa" is not stronger or weaker than "zzzzzzzz", as long as the method you use to generate your password can produce both with equal probabilities. The strength of a password is not in what it is, but in what it could have been.


How Vulnerability scanners assign CVE codes to Vulnerability found I just want to know how CVE codes are assigned by the vulnerability scanners, while it found the particular vulnerability.

Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to the system under test.


Is it safe to install CCleaner now? About 4 or 5 weeks ago, i read a article on THN(the hacker news) that the ccleaner servers were hacked to distribute malware and as a result millions of computers were affected who had downloaded and installed ccleaner in month of August. I have also ccleaner installed on my older pc which i had downloaded before August and my pc is not infected.But I buyed a new laptop now, then it will be safe to install ccleaner now?

Is it safe to install ...

It is nearly impossible to be sure that some software is safe to install. It can always contain a back door, have bugs in it which might be exploitable from a remote system or similar.

All one can say that the specific problem with CCleaner was fixed according to Avast and that currently no other problems are publicly known with this software. If you consider this safe enough is up to you.


Manually exploiting blind SQL injection in SELECT statement in X-Forwarded-For header I am struggling exploiting this vulnerability in the code below:

<?php
ini_set('display_errors', 0);

define("INDEX", 1);
include '../db.php';

if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
  $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
  $query = "SELECT * FROM banned_ip WHERE ip='$ip'";

  $res = mysql_query($query);

  if(mysql_num_rows($res) > 0) {
      die('
Banned!
');
  }
}
?>

There is blind sql injection in X-Forwarded-For header in the code above.
I tried different payloads from OWASP Testing Guide and read this course on Pentesterlab but I still find it impossible to exploit this.

My assumptions:

banned_ip table is empty so this check: if(mysql_num_rows($res) > 0) returns false. There need to be a way to insert into this table or perform select from another table to return non-zero response.
Backend database seems to be MySQL $res = mysql_query($query); so there might be some commands that I am unaware of specific to MySql that can help

Non-working approaches (multi-query, insert/delete/update)

mysql_query doesn't support multi-query:

multiple queries are not supported

This means that appending another query via ; to delete, edit, or insert data will not work. You are stuck with the select query you have.

We can also see that the selected data is not displayed, so you indeed have a blind injection.

Unlikely approach: Write a Shell File

Theoretically, you could try to write data to a file, for example to get a PHP shell. It might look something like this:

' UNION SELECT '<?php passthru($_GET['x']);' INTO OUTFILE '/var/www/404.php' -- -

It is however unlikely that you have sufficient permissions for this. You would not only need an SQL user that has the permission to write to a file and a directory that the mysql user can actually write to, but the mysql server would also need to be running without the --secure-file-priv option, which isn't the case by default in modern systems.

Read Data Blind: Error Based

The above means that the only attack-vector is reading data from the database. If you are lucky, errors will be displayed to you.

If errors are displayed, you will simply need to create an error which contains the information you want to read. One way is to use extractvalue:

' or extractvalue(1,version()) -- -

Instead of simply asking for the version, you can select table- and column-names from the INFORMATION_SCHEMA. Once you find interesting tables, read the data.

Read Data Blind: Content Based

Maybe you were unlucky, and errors are not shown. You can still extract data by asking yes/no questions:

' AND substring(version(),1,1)='5

As you can see, the whole query including your injection will return true if the MySQL version is 5, and false otherwise. So depending on what happens - the script dies or it doesn't - you know what version MySQL is.

Instead of asking for the version, you can ask for other data, for example the first character of the password hash of the first user in the mysql users table.

You can optimize the approach by using ascii and asking if the value is larger or smaller than a certain number, and then narrow the window of possible character.

You will probably want to use a tool or custom script for actual exploitation though, as you will need a lot of requests.

Read Data Blind: Timing Based

Just for completeness sake: In case that you get no feedback at all (no banned message), you could still exploit injections into select based on the time it takes for a request to complete.

The idea is the same as content based exploitation, but instead of getting a different response, you will either perform a slow task or not:

' AND IF(SUBSTRING(version(), 1, 1)='5',BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null) %23


Why do SSL certs use saved private keys? If an encrypted connection can be compromised when a server's private key is stollen, why don't servers simply generate a new private key for each unique session. It seems like it would eliminate a point of vulnerability if it was just generated as needed.

I'm assuming that it has something to do with verifying authority chains, or performance, or something like that, but I was wondering if anyone knows for sure why it's not done that way?

When you connect to a server there are two types of encryption in play.

First, there's a public-private keypair associated with asymmetric encryption that is used to validate your identity.  Typically (in the case of visiting HTTPS websites), you create a long lived pair of keys (one public and one private), submit the public key part and identifying information to a trusted certificate authority (CA), prove your identity to the certificate authority's satisfaction (e.g., verify you control the domain the certificate is being issued for), and the certificate authority signs the certificate for you.  Now you post your CA-signed certificate publicly on your website.  Anyone connecting to the website for the first time, whose browser/OS already trusts the CA that signed your certificate, can verify the identity of the website you are connecting to by issuing challenges to the CA-signed certificate that you can only answer if you control the websites private key.  Note the certificate is only used for the authentication of identity (by relying on chain of trust with certificate authority) at the start of a conversation.

To actually transmit data, you don't use asymmetric encryption as asymmetric encryption is slow and only encrypts short messages.  Symmetric encryption is much faster and work well to encrypt arbitrarily large messages quickly.  For the symmetric encryption part, you use key exchange protocols like DHE to have both servers negotiate a shared symmetric key that will be used to encrypt and decrypt messages, and the key exchange protocol can negotiate a random symmetric key without actually sending the shared symmetric key over the network.

For an example of a key exchange protocol that doesn't send the full key over the network for Alice to send a message to Bob, first they both agree on two numbers generator (g) and modulus (N) and each picks a secret random number a and b (Alice generates a and Bob generates b; note Alice will never learn b and Bob will never learn a).  Then Bob send a message to Alice containing Kb = g^b mod N.  Alice calculates the shared secret key K = g^(ab) mod N by calculating K = Kb^a mod N.  Alice uses the secret key K to symmetrically encrypt her message and sends it to Bob along with Ka = g^a mod N that Bob will need to decrypt.  If a network eavesdropper Eve listens in on their messages, they see g, N, g^a mod N, g^b mod N and the encrypted message, but do not have a known feasible way to calculate K without additionally knowing a or b.  This key exchange however is still vulnerable to active tampering, where Alice could try sending a message to Bob, but instead Eve pretends to be Bob.  This is why in addition to forward secrecy at the start of the conversation you need Alice and Bob to identify each other (which is customarily done using the long lived certificates signed by CAs).

Forward secrecy does your suggestion of not reusing the random symmetric keys at all, but renegotiating them with each exchanged message.


Accessing Web Service via virtual private network I'm developing an Android application. My application is using a web service to retrieve information in JSON format which is then displayed on the app's view.

The requirement is that my client doesn't want any of their information being transferred over the internet. I'm therefore required to tailor the app to retrieve my data through a virtual private network. The idea is that the information fetched cannot not be accessed by any device which is not connected to the specific VPN.

How can I accomplish this task? Any point outs will be greatly appreciated.

I think this way:

Put the Server Application on local IP address in clients network
Make it dedicated network like 10.1.2.0/24 where only this service resides
In the VPN server, there should be rule which users can access this network, so some can access all network, some only this service
In the android app you can make detection if 10·1.2.0/24 is reachable, in particular, I'd check the route to it via /proc/net/route which is fast, application non-blocking check. You can use also library which can parse this file.
It may be that VPN would setup gateway to all sub-networks in 10.0.0.0/8 so that you may need to do some parsing and subnet calculation so that you can handle further VPN changes
Once your application assumes there's VPN connection, you can do the call to JSON API but since this is VPN the timeout might need to be increased, and because of that it may need to be non-blocking
Since establishing connections via VPN is slower especially on 3G / LTE networks, you might want to keep persistent connection, so this have to be configured on the HTTP client you use and on the server (like tomcat / httpd keep-alive timeouts). You can test persistent connections as well non-persistent to see what performs better. Keep-alive sometimes is "persistent connection", sometimes is "TCP keep alive", so look in docs what is what, both may be used.
You can monitor for VPN disconnection same way as looking for connection, so in case of disconnection you can make non-intrusive status change on the APP GUI
The server APP may need to allow only certain Subnets so you might need to firewall it so that not everyone can use it

This is quite difficult problem if you need to handle both VPN connection and HTTP sockets. I'd be careful with retries and keep the monitoring of the route every 1s.


How should I store and maintain secure configuration documents? We have many scripts that we call "secure baselines" that allow our server/desktop installation people to install operating systems using best security practice.  We test that the baselines have been successfully configured by using automatic compliance checking tools.

The problem we are facing is that the Word documents quickly become out of date as the security threat changes and we are finding them a little unwieldy to maintain and manage.

Current process:

server admin install servers to a secure baseline by following instructions in a Word document
or write jump start scripts to auto install OS's to a secure baseline based on the Word document.
Every now and then the Word document is updated when a new threat is recognised.

Is there a better way to store and maintain baselines? so that:

they are more easily auditable
easier to keep up to date acknowledging new and current threats
easier to record exceptions where some systems can't meet the best security principles
they are easily versioned.

As some people have recommended, use a configuration management tool like Puppet (recommended), Chef, etc. Use VCS like Git to store revisions of Puppet manifests. Using Puppet, you can define your secure baseline and simply apply it to any number of machines that you want. Add some comments to the Puppet code (Ops code) and you have your "configuration document".


Is it more secure to limit passwords that have two identical characters in a row? OWASP recommends this practice and so do some other companies. I think it makes sense at first glance but if you think about it, it actually limits entropy instead of increasing it. How many combinations would be reduce with this rule? I calculated their minimum entropy (10 characters, all 4 types) to be 3e19. Not having characters would limit it quite a bit I would imagine. I don't know how much but I would bet there would be a lot using the birthday paradox as guidance. If someone can calculate that for me and show me the steps, that would be greatly appreciated.

My point is that it would limit it regardless. So what's the benefit? Is there a gain elsewhere, perhaps in the password cracking methodology? As far as I can tell, there isn't much there that I can think of. Can anyone explain why it's benefits outweigh the negatives or perhaps maybe it is just a bad rule and why OWASP and others think like this.

The link you shared says:

  not more than 2 identical characters in a row (e.g., 111 not allowed)

so your limit would apply on 3 characters in a row.

Remember, any limitation enforcing a certain rule reduces the absolute search space for a password. For example, requiring four different types of characters removes the space for all-lower/all-upper/all-digits/all-special character passwords.

The hope with any such restrictions (3 consecutive identical characters / 3 consecutive digits / 3 consecutive digits plus a special character / 3 consecutive QWERTY keys ...) is to reduce the likelihood of users choosing a weak password (one that is more likely to have been already "discovered" and added to a rainbow table).

The benefit may not be apparent if you think of password-cracking as "dumb brute force", but may be clearer if you look at the proportions of cracked passwords from a large dataset that display these weak characteristics.


Credit card data security - hashing, truncation and encryption A question with a similar title has been asked before, but it doesn't answer my specific question here. PCI DSS permits storage of truncated and encrypted data, or hashed and encrypted data. It explicitly states that hashed and encrypted data should not be stored together due to the possibility of breaking the hash.

Truncated data is permitted to be first 6, last 4 of the 16 digit credit card number such that the middle 6 digits are masked.

If I were to store the first 6 and last 4 in clear text and encrypt the middle 6 only, is this less secure than storing the truncated data as well as the full encrypted PAN?

Assuming you are using a modern database and you don't care about the size of the ciphertext, as long as your are using strong encryption algorithm and have key management in place it doesn't really matter.

If you decide to encrypt only the 6 middle digits make sure you are NOT using a Format Preserving Encryption algorithm as it will limit the amount of possibilities and it would probably be possible under some condition to generate all the possible ciphertext.

This article might interest you regarding the FPE issue when encrypting only the 6 middle digits.


Practical non-government uses of Biba, Bell-LaPadula, etc. models For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't allowed to write to system (high) objects. Inevitably, this kind of fades away as the end user just starts clicking yes every time the dialog pops up, but at least the framework exists...

Some of this also appears in the Qubes project. (good blog entry), and that's something that one might actually use on a daily basis for their own integrity and security.

Any additional examples for applying these models to data that isn't in the traditional government intel / classified data realm?

Generally speaking, those models tend not to be used exactly as-is.  The problem is that very quickly "everything becomes low", because everything depends (through some long chain of dependencies) on something you got over the Internet.  As a result, you got a lot of false positives or annoying dialogue boxes.

However, there are widely-used systems which are partly based upon the ideas found in those models.  You mentioned Windows.  Another example is SELinux, which is widely deployed on Fedora Linux machines.  A third example (more loosely related) is taint tracking, which is used to detect vulnerabilities and protect systems against data-driven attacks.  Taint tracking is conceptually to the Biba model: untainted data is "high", tainted data is "low", and anything that depends upon tainted ("low") data is also tagged as tainted ("low").

So while the models have largely proven to be unworkable in their originally envisioned form (for general-purpose computing), less restrictive variants have had some impact.


Privileges separation over parent/children processes on UNIX systems? I was scrolling through a Google Research paper related to privileges separation and I felt lost while reading this :

  In Unix, every process runs within its own protection domain, i.e.,
  the operating system protects the address space of a process from
  manipulation and control by unrelated users. Using this feature, we
  accomplish privilege separation by spawning unprivileged children from
  a privileged parent. To execute privileged operations, an unprivileged
  child asks its privileged parent to execute the operation on behalf of
  the child. An adversary who gains control over the child is confined
  in its protection domain and does not gain control over the parent.

I can't figure out how this can be possible. If instructions are performed by the parent on behalf of the concerned child, why can't an attacker gaining access to the child process manipulate the parent process to execute privileged instructions, still on behalf of the child process ?

In a typical implementation, the child can only ask the parent to perform specific predetermined operations. It does not have a completely free hand.

So for example the parent might have the power to delete any file, but will only accept requests to delete files under a specific root.


Where to get an SSL certificate for personal website? I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL certificate to accomplish that (I thought it's all something that automaticaly enabled for each website, don't ask me why).

Then I went over to my hosting provider website and found out about the prices of these certificates... But I don't need something like that for my blog... I also found out that certificates can be self-signed, or obtained for free from certain certificate authorities.

What I'm wondering is - how should I approach this?
Since I'm the only one that's logging in there - should I generate my own certificate? Or get a free one from some CA? If yes - which CA? cacert maybe? Will it all stay transparent this way, or will I start getting warnings about custom and unverified certificate? Can I trust a solution like this?

Does it even make sense to try and do something like this if I'm using shared hosting? I mean, from what I've read - this certificate would have to be installed on the server, and not just put somewhere in my hosting folder (as I thought it would work).. and the hosting provider won't do this for free I guess because it's kinda not in their interest (in any case I asked them, and am waiting for reply)...

Should I just drop it, or is there anything I can do on my own?

I like using StartCom for a free certificate.  Until mid-2016, it was recognized in most major browsers and is better than using a self-signed certificate (No error prompts for users).

EDIT 2016: Major browser vendors like Mozilla, Apple, and Google have announced they (and their browsers) no longer trust StartCom as a certificate authority, due to recently uncovered sketchy behavior by the certificate authority (see links in vendors names for their announcements of this and reason why).

Edit 2017: Let's Encrypt is now a great option for personal use and seems to be accepted even more widely than StartSSL was. Downsides to Let's Encrypt are the relatively short validity of the certificate (3 months) but that is not overly burdensome if you are able to take advantage of the automatic renewal they offer through some of their tooling.


Does client side hashing reduce insider risk? One of the companies I worked for used client-side hashing to minimize risk when logging the password in the server logs. Can this be a good reason to implement client-side hashing?

Almost never.
As others have pointed out, this just replaces "SECRET" with "HASH(SECRET)". To make things worse they log the hash, which is now the password.
This is because the client is authenticated on the basis of the hash it transmits, alone; so, knowing this hash either by intercepting it at the client level or by lifting it off the logs, one can access the service at any future time until the secret is changed.
These two things together negate all logging security and create a problem (you are now logging "data, including personalised security credentials which can be used to carry out fraud", and this impacts your PSD2 compliancy).
Having a different hash on the client (for logging purposes) and on the server (for authentication purposes) would be tricky to implement, since the server guys would have no quick way of verifying that the hash is indeed correct, unless they knew the password (which would have to be stored in the clear somewhere). Using the same hash or a two-level hash might be used, I don't know, to diagnose whether the password was sent correctly (the client sends both the pass and its hash, the second gets logged and is the same as the hash stored in the auth records, or is the hash of that hash just to complicate things) -- but unless things go very wrong, this information is the same as the login status.
A better way to do this would be for the server to send a unique ID plus a timestamp, and for the client to hash together the password, the unique ID and the timestamp. The server could then send ID, timestamp and username to a black-box "oracle" that would only answer yes or no (or "OK", "NO SUCH USER", "BAD PASSWORD", "TIMESTAMP EXPIRED", "UNIQUEID REUSE DETECTED" and so on). This way:

the server does not know the password (the "oracle" does)
the log can safely contain both unique id and timestamp
the hash cannot be reused (the timestamp would go "stale" after some time)
the password never travels in the clear, only the hash does
unique id and timestamp act as salts of each other

You might be interested in looking at thinbus-srp.


How to secure VPN credentials on end-user devices? I have a VPN and PKI in place with MFA. My question is: What's the best method/solution for protecting the integrity and identity of end-user certs? I want to make sure that users only able to use VPN with company provided devices.

Cheers

What's the best method/solution for protecting the integrity and identity of end-user certs?

Install an HSM on their devices and use keys stored within it for VPN.  Expensive and difficult to set up.

  I want to make sure that users only able to use VPN with company provided devices.

Then instead of trying to control the keys, which is difficult, use VPN Posture Checking and disallow devices that don't match your required profile.  Depending on your VPN vendor, this may include things as explicit as Domain membership - for example, here's how to do it with Check Point.


Storing 2FA seeds in a password manager Does it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager?
If my password manager has a strong password and 2FA using a third-party app, is storing 2FA seeds for the accounts saved in my password manager poor practice?
Ultimately I would expect hacking my password vault to be much more difficult than any other account, so if someone could hack my password manager, surely they will already have the skills to steal the 2FA seeds even if they weren't stored in my passwords manager (e.g: by stealing them from the target company)

For the most part, the answer is yes. With conditions.
The specification for OTP systems in general doesn't give any particular recommendations for storage of shared secrets.
The HOTP specification provides a little more guidance in Management of Shared Secrets.

We also RECOMMEND storing the shared secrets securely, and more
specifically encrypting the shared secrets when stored using tamper-
resistant hardware encryption and exposing them only when required:
for example, the shared secret is decrypted when needed to verify an
HOTP value, and re-encrypted immediately to limit exposure in the RAM
for a short period of time.  The data store holding the shared
secrets MUST be in a secure area, to avoid as much as possible direct
attack on the validation system and secrets database.
Particularly, access to the shared secrets should be limited to
programs and processes required by the validation system only.  We
will not elaborate on the different security mechanisms to put in
place, but obviously, the protection of shared secrets is of the
uttermost importance.

The TOTP specification provides the following as requirement 7 (R7) of Algorithm Requirements.

The keys MAY be stored in a tamper-resistant device and SHOULD be
protected against unauthorized access and usage.

The same document then expands on this (regarding both serverside and clientside storage) in its Security Considerations section.

We also RECOMMEND storing the keys securely in the validation system,
and, more specifically, encrypting them using tamper-resistant
hardware encryption and exposing them only when required: for
example, the key is decrypted when needed to verify an OTP value, and
re-encrypted immediately to limit exposure in the RAM to a short
period of time.
The key store MUST be in a secure area, to avoid, as much as
possible, direct attack on the validation system and secrets
database.  Particularly, access to the key material should be limited
to programs and processes required by the validation system only.

There is no mention of the shared secret being separated from other credentials, either in the aforementioned specifications or in the OATH OTP MFA recommendations.
The reason for this is that, if your password manager meets the standards described above, then (as you intuit in your question) it's very unlikely than a successful attempt to steal your credentials would target the password manager itself. It's much more likely that your credentials might be stolen during transmission, such as by fooling you into typing your password into a bogus login page, or by somehow reading your authentication traffic.
OTP will protect you here. Even if an attacker were able to see everything you send with a login form, they would only get a single, transient code. The key does not get exposed when sending the password, and therefore your account is protected.
NB: It is not necessarily unreasonable to decide for yourself that you shouldn't keep shared secrets in the same vaults as their associated passwords.
The most rudimentary purpose of two-factor or multi-factor authentication is that a single breach would not be enough to compromise an account. For example, one of the earlier forms of 2FA is the PIN associated with ATM cards. If only the card gets stolen, your money is safe. If only the PIN gets stolen, your money is safe.
In this sense, storing your secret keys in the same vault as your password creates a single point of failure, militating the most rudimentary benefit of MFA. It is a very theoretical risk, given the extreme security requirements for the vault itself, but theoretically, the risk might become significant in certain threat models.


getting an error in aireplay-ng in kali linux When I was testing penetration testing on my router using kali linux, I followed all the steps from this link. In the step where you have to enter the router's bssid and client's bssid in aireplay-ng command I'm getting the following command
aireplay-ng -0 2 -a 10:FE:ED:2E:5E:20 -c 08:3E:8E:CC:14:A7 mon7

09:00:33 Waiting for beacon frame (BSSID: 10:FE:ED:2E:5E:20) on channel -1
09:00:33 Couldn't determine current channel for mon7, you should either force the operation with --ignore-negative-one or apply a kernel patch
Please specify an ESSID (-e) the channel is -1.

But the channel I was capturing was some other channel. I'm getting this every time I try. Please help with this -1 channel and how to fix this

From the kali forum: run it with --ignore-negative-one or --ig


How do I configure Symantec AV to permit pentesting tools without compromising my organization's network and my host computer? When performing penetration testing for work, I often have to turn off Symantec Endpoint Protection in order to use certain payloads with Burp Suite and I recently had to do this for something as simple as WPScan (in a Kali VM).

Here's the error that comes up:

I am aware that I am able to disable specific security risks within Symantec, but that is honestly a total pain. I have to wait about 10 minutes for the list to load before I disable a specific tool and then I have to disable specific payloads / payload types (ex: SQL injection = payload type vs. Shellshock = payload) in order to perform tests while keeping the antivirus on.

As a security professional, the words "just turn off your anti-virus" just leave a bad taste in my mouth - but I need to be able to do my job. I have to imagine that other organizations have sensible, practical policies on how to permit penetration testers to use security tools without disabling the entire defense system on the pentester's host computer. Although our policy states that you should not just turn off your anti-virus, I see other pentesters do it all the time just so they can enter ' or 1=1-- in an HTTP request.

I know I'm not the only pentester to run into this issue. What does your organization do to permit penetration testers to perform their job functions effectively without compromising on their own defensive security measures?

I want to hear your responses not just for my own benefit, but so I can understand how penetration testers can operate effectively within a large organization. Thanks in advance!

If you're doing true penetration testing then the goal is to see what your blue team can and cannot detect or prevent.
So you don't want to disable anything. Your pen tester must be skilled enough to find ways to bypass your security controls on his own.

It almost sounds though like your confusing a penetration test with vulnerability management. If you are just trying to scan for vulnerabilities, that is not a penetration test. Vulnerability scanners would be run from dedicated scanning systems that have the scanning tools whitelisted and allowed to execute.


How can IoT and other network devices access the internet if my router works as a firewall? My understanding is that routers act as natural firewalls. In that context, how can an IoT device receive commands from the WAN if they are not initiated from within the LAN? In a specific example, how does my smart thermostat know that temperature has been changed on my smart thermostat's app and change the temperature accordingly?

How does Nest, for example, manage to get through my router and speak to the thermostat? Ports haven't been configured and upnp is deactivated.

Could someone please provide a general explanation of the flow?

Is upnp absolutely required to have network devices that can be connected to from the WAN?

When you setup your Nest, you create an account for it and sync your devices to the account. So all the information tying your app to that particular device is saved in a Nest database somewhere on their servers. In your scenario you're asking how the Nest passes through your firewall to see what your account settings have told it to do. Your phone app can't always be on the wifi to talk to the device directly (and that would somewhat defeat the purpose of it) so UPNP doesn't come into it.

It doesn't look like Nest specify which protocols they use on their site - but there is nothing stopping it from using HTTP/HTTPS to connect to your Nest account once you've put it on the Wifi. Just the same as when your friend asks you for your wifi password - no Firewall rule changes required for them to go out to the internet once you give it to them.

Nest's own Support documentation advises that Firewall issues are still a problem.

  Is upnp absolutely required to have network devices that can.be connected to from the wan?

UPNP isn't even mentioned in the Nest support documentation. UPNP is for connecting within a network, not going out to the internet. So would be useful if you had multiple Nest devices and they had the ability to talk to each other within the Wireless Network - say if your thermostat and camera could work together to determine if there was a fire - but not for talking to your app on your phone.

  On an Asus router running Merlin, how do i find whats configured so that I can review it?

You could review your Firewall settings but assuming its already working, try installing Wireshark to monitor the outbound traffic coming from your Nest device.


Is my router spying on my network traffic? I got a new TP-Link router a couple months ago, and configured it to use the OpenDNS domain servers for basic content filtering across all household WiFi devices. Everything seemed to be great.

Tonight I pulled up the OpenDNS dashboard to make some minor adjustments, and skimmed the various stats out of curiosity. I was shocked to see a huge number of requests to tp-link.com, the manufacturer's website. In fact, the requests account for 40% of all network requests over the last 2 weeks!

I am running the latest firmware, and have double checked that I configured the DNS properly to use the OpenDNS IPs:

Is there any legitimate or overlooked reason for this traffic, or is my router just phoning everything home to China? There are no telemetry settings anywhere in the router management tools.
What are my options? I've blacklisted the site on OpenDNS now... should I also flash OpenWRT or something?

It most likely checks for updates.

I've noticed such behavior in many recent routers: they periodically check their home site for new firmware. If there is a new version available, it will notify you that an update can be done in the update menu.

On the one I have I was able to make the update directly via the router menu, without needing to download the new firmware locally.

In such a case, you should also have somewhere the option not to check for updates. Disabling update check may reduce that traffic or even make it permanently go away.

Of course, there may be the possibility of a compromised device, but in that case it will not try to connect to its official site, but to various C&Cs.

One additional thing that may be working there is a status check of Internet connectivity the router does. Some can indeed do that just by ICMP requests to their own home sites. If they see that's not working, the router could then report that your Internet connection is down if it does not make any other checks except that one (but the well designed ones should not relay on a single check-point for determining connectivity status).


Can infection effect a phone through it's wireless hotspot, also the usb tethering If I made a wireless hotspot from my phone and had computers infected with malware connect and use my wireless connection of the phone can any malware from the pc get into the phone?

If my phone was connected to an infected computer by the USB cable the first thing that happens when you connect to the computer is you get asked to allow or deny the computer access to the phone's storage. If I choose "deny" so storage isn't mounted and then use USB tethering for the internet would this be fine, to avoid the phone been infected?

Also would both my questions be at more risk if USB debugging on the phone was turned on? I know it allows the computer to run commands on the phone, I just don't know if USB debugging has risks with wireless hotspot, or if USB debugging can be used by the computer if I choose to deny access to phones internal storage.

It perhaps makes more sense if I paraphrase your question:

Can a router be infected by devices connected to it?

Yes, although in such a scenario the router and infected devices will typically have very different configurations and operating systems - implying that an exploit targeting the client device is unlikely to affect the router device. And it would be very unusual (but not completely impossible) for the router to be exploitable via the traffic it routes - more likely by services exposed on the router device for control, configuration or other purposes (such as storage).

If the router is a phone then it will provide additional functionality (such as storage). But it is unlikely to provide the remote configuration functionality one would expect on a dedicated router (having its own user interface and limited number of interfaces).

Using USB tethering rather than Wifi for connectivity changes Some things - by exposing different services on the phone to a (possibly) different set of clients - e.g. it might be impossible to invoke the telephony operations over wifi, but accessible via USB. Hence (except for the case of running an open hotspot) its impossible to say if USB offers any security benefit over wifi or vice versa.

  at more risk if usb debugging on the phone was turned on

Yes, you would be at more risk - there's a bigger attack surface.

There will always be a lot more infected devices on the internet side of the "router" than on the local network interface.


How would this be traced back? I was thinking about this, and I can't wrap my mind around it.

Assume a person with malicious intentions that has created malware in a virtual machine.

Then, this person, using the TOR browser uploads his malware to a file sharing website (which he doesn't own), and some victim downloads it, and reports him.

How would cyber crime investigators trace the person back? Even if they knew a virtual machine / TOR browser was used.

A virtual machine doesn't really affect the tracing, it's still going to have the same IP as the host machine leaving the network. TOR would make it probably unlikely that the user would be caught by traditional police work, it'd have to be a pretty serious attack or operation (think SilkRoad Admin level of important) in order to actually try to find a person who's using TOR. Which, if they are important, then it comes back to metadata analysis of the identity that person uses, find accounts that have the same or similar name/details, see if those were accessed outside of TOR.

Operational Security is the number one reason people who use TOR and do malicious/illegal things get caught, they slip up and reveal too much about themselves, or make a technical error and login to an account without TOR once. For some more concrete how they do it, check out the story of how Ross Ulbricht (the convicted SilkRoad creator) was caught even though his whole business was on TOR.


What should content-type be of encoded page? A security review replied that we have an incorrect content-type.
There was no content-type stated so it defaulted to text/html.

However the page was just encoded - Fiddler gives the option to decode it in this page and then it renders (as with the other pages) in normal text/html.

What should the content-type be of a encoded page?

The Content-Encoding of the page is unrelated to the Content-Type.
Content-Encoding specifies how the content is compressed (i.e. gzip, deflate, br...) and thus how it should be decompressed. Content-Type instead specifies how the content should be interpreted, i.e. as html, image, PDF etc. And for text data like plain text or HTML it can additionally specify the character set and encoding, i.e. UTF-8, ISO-8859-1 or similar.

If no Content-Type is specified browsers try to guess what the type and character set/encoding the content might be. This can have unintended side effects because different browsers might guess differently and specifically the dedected character set might also depend on various contexts like the character set of an embedding frame.

Thus you should always specify a Content-Type and also set the Charset parameter for text types. Additionally you should set the HTTP header X-Content-Type-Options: nosniff so that the browser does not try to guess the type even though the declared is differently from the guessed type.

For more information about the problem with MIME sniffing see also MIME Sniffing: feature or vulnerability, Attacks on browser-based content sniffing, Secure Content Sniffing for Web Browsers or
How to Stop Papers from Reviewing Themselves.


Why is monitor mode necessary on the NIC used to attack WPS with reaver and other tools? I am trying to get a deeper understanding about the inner working of WiFi Protected Setup and its active attack using reaver, bully and other utilities.

What I am really unable to realize is why it is necessary to set the network card on the bruteforcing device in monitor mode.
Monitor mode allows to inspect traffic from any network no matter if you're associated to them or not, and to transmit packets in any network as well - that is, packet injection.

Why is packet injection required for WPS cracking, though?
Since reaver do associate with the AP before starting to try PINs, to me it just looks it is behaving like any client trying to do the WPS pin exchange. Just, a quite insistent client :).

So, I can't realize why is monitor mode necessary for it.
Thank you very much for any clarifications.

Some of the options, such as Reaver's "ignore frame checksum errors" or Bully's "don't require ACKs" are technically violations of the WiFi spec, and can't be done by a device that's in managed mode.  Additionally, I suspect that being in monitor mode is required to see the beacon packets that 1) tell if the AP supports WPS, and 2) tell if the AP has temporarily locked WPS access.

In general, people developing tools such as Reaver or Bully want to maximize their control over the process, which means working in monitor mode.


Self-destructing e-mail Recently someone whom I more or less trust (let's call him John) showed me a screenshot of an email from someone else (let's call him Paul). It was bad and if it's true then it means Paul is bad person. These were screenshots showing this opened email from Paul to John. It looked like this was sent using MAXHERO program/extension or someting similar so it could not be read again after you once opened it.

Paul is claiming he never sent an email to John. John is claiming that it was self-destruct email and it disappered from his inbox once he opened it. Paul read something about this MXHERO service and he told me that the content of the letter could disapper because it is on mxhero's server the email itself should stay in John's inbox and even if he sent it to him, once it was delivered it would stay there. He is also claiming that he could get this email from different address and easily manipulate the screenshot so it would show his adress. Paul is using Gmail and John is using hotmail.

Is it possible that the email itself deleted from John's inbox (he does not want to show me this though...)?

Is it possible that the email itself deleted from John's inbox (he does not want to show me this though...)?

No, it cannot automatically delete from John's hotmail account. Maybe John decided not to take further action and deleted it and then changed his mind.

  He is also claiming that he could get this email from different address and easily manipulate the screenshot so it would show his adress.

That is true. It's also possible John made the whole thing up.

This is one of those situations where the truth is unknowable. Just mentally subtract 1 from the trust values of both of these guys and move on.


Get original e-mail sender server to circumvent spoofing I've posted this originally on SO, but it may as well be for here.

As you know, with many e-mail services, you can get tricked into believing an e-mail has been sent from a different address.

Using smtplib in Python, you can easily do the trick by manipulating the From argument.

gmail is not prone to that as they print the via argument which shows the original server.

However, what I cannot find anywhere is how do you retrieve the original (not manipulated) server name, the same as gmail does with their via functionality?

I've tried Python and its imaplib and email libraries, but there I can only access the already manipulated sender.

Any ideas?

Is that solely linked to the configuration of a particular provider (e.g. Google, Outlook, hotmail, etc.), or can something be done regardless of that - not only in Python, but perhaps in other languages, or in Kali?

Here is part of the code I'm currently using in Python (no success):

import imaplib
import email

obj = imaplib.IMAP4('imap', portn)
obj.login('username', 'password')

obj.select('INBOX')

uidl_list = [68720]

resp, data = obj.uid('FETCH', ','.join(map(str, uidl_list)) , '(BODY.PEEK[HEADER.FIELDS (From Subject)] RFC822.SIZE)')

I'm aware that this may be considered a duplicate, however in no other spoofing-related topics have I seen any discussion about how to tackle this.

That's perhaps because it is not possible, and it completely depends on the provider, but any clarification is nevertheless welcome.

First, Google does not know the original sender of the mail either. The original sender can only be known if the mail is signed by the actual sender using PGP or S/MIME and if the recipient can associate the key used for signing with a specific (usually the claimed) sender.

DKIM and SPF at least allow some approximation in that it can be checked if the claimed sender domain in the SMTP envelope is the correct one. But this envelope sender can be different from the claimed sender in the mails From header. With DMARC some kind of alignment of the domains between the envelope sender and the From header can be enforced. But, DKIM, SPF and DMARC need to be actually implemented for the senders domain, i.e. it works only if a domain owner explicitly implements method to protect his domain against getting used for spoofing. And of course it needs to be checked on the recipients side too. And it only checks the senders domain, not the sender inside the domain.

From my understanding of the description Gmail's via gets set if the sender from the SMTP envelope is a different one than the sender claimed in the From header. It will not be shown if both senders are the same, even if they are both spoofed. The envelope sender is usually added to the mail header as Return-Path header. Thus, to get a similar functionality as the via in Gmail just compare Return-Path with From header. But again, this does not necessarily show the real sender of the mail, since both envelope sender and From header can easily be spoofed.


How to get into RFID auditing? I would like to get more knowledge around RFID-systems auditing.

Does anyone have a basic guide step-by-step which I can use to set up a lab with proper RFID "sniffing" equipment?

I would like to know:

What equipment I need and where to get it (ebay and so on)
What software I need and where to get it (websites, books and so on)

The reason for this RFID auditing is that I'm getting more and more paranoid about all the chips in my home, car and wallet. I would like to look into them, and see what they are all about.

Have a look at Major Malfunction's (Adam Laurie) work in this area:

http://hackaday.com/2007/03/25/rfidiot-rfid-io-tools/

http://www.youtube.com/watch?v=3vAvesYoHeo

and many others - good fun stuff, not too expensive to get started

edit: Just spotted this post on Proxclone that you might also be interested in


How to decrypt a gpg file? I have a gpg file and a sha256 file. When I try to decrypt the gpg file using the gpg - d file.gpg command, it says that there is no secret key. I am absolutely new to this so I would appreciate any pointers.

GnuPG works by using two different kinds of keys: a private key and a public key. When you use the software, you create both a public and private key (called a keypair). You make your public key, well, public. Anyone can use it to encrypt arbitrary data, but that data can only be decrypted by using the corresponding private (aka secret) key. If it says there is no secret key, that means the file was not encrypted with your public key. In other words, it is not intended for you and you will not be able to decrypt it. You can only decrypt things that have been encrypted for you.

Is it possible that you want to verify the file instead of decrypt it? Since you mention a file with SHA-256 hashes, is this some sort of software you are downloading that came with a .sig file? If so, you need to import the public key with --import (you can usually find it on the download website for whatever you downloaded) and then use --verify instead of -d. See also:

Instructions for encrypting and decrypting
Instructions for signing and verifying


How can a bad process obtain root by waiting for a user to run a command as sudo? A comment on this answer states:

  The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for the user to run a command as sudo. The bad process now has root without ever being known to the user.

Frankly, this scares me - I was under the impression that sudo <command> would only give elevated permissions to run that command, and this method of strict permission management was what made linux much more secure than Windows. I didn't think that sudo could be "intercepted".

Are "bad processes" capable of watching the keyboard to obtain root access? If so, how would a process grant itself those permissions when they are for another process? An example of a bad process that could do this along with possible countermeasures would be really appreciated.

You're right that sudo only grants elevated privileges to the command you run with it.

What the commenter is referring to is that running processes in a Linux desktop session can watch the keystrokes on that desktop session without you knowing. So if you open a terminal window on your desktop, type sudo <some command>, and enter your password at the prompt, a malicious program could be keeping track of the keystrokes you typed in and then silently pass the captured password to its own instance of sudo to run whatever command it likes as root.

As a simple (non-malicious) example, the program screenkey is able to watch the keys you type without needing root privileges. Also, I would bet that global hotkeys (e.g. the Super key) work in much the same way.

This sounds pretty scary. As for possible countermeasures, I don't really know if there are any once the "bad process" is running on your system. So, all you can really do are preventative measures, like:

Practice good internet hygiene, i.e. don't download random untrusted executables from the Internet
Be careful which files you set the execute bit (chmod +x) on
If you have to run an untrusted executable, run it with the lowest possible privileges
(e.g. sudo -u nobody <untrusted program> will run <untrusted program> as nobody, which has no access to your user's X11 server and therefore can't watch your keystrokes)


What are the difference between IPS and WAF in terms of DDoS? I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS).  Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other.

An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is underway, and in some cases it may be able to block some of the traffic. The main benefit here is the alerting capability though, notifying operations people so they can swing into action and keep services up.

A Web Application Firewall will, if configured properly, filter DDoS traffic before it overwhelms the applications behind it.

In reality, unless the DDoS attack is pretty low-level neither is going to be that much help, as a powerful DDoS attack will overwhelm both. The most effective DDoS protection is at the perimeter of your network, using traffic filtering and rate limiting on your border network devices. It also helps to have a plan in place to contact your upstream ISP and ask for their help in filtering the DDoS traffic.


Chrome: Finding vulnerabilities using AddressSanitizer I'm reading about AddressSanitizer, a tool that can be used to find memory bugs for Chrome (and other C/C++ software). I'm a little curious about what the process of using the tool involves:

1) Is it just a matter of running Chrome compiled with AddressSanitizer, playing around with Chrome, and hoping for AddressSanitizer to flag a warning?

2) If the answer to 1) is "yes", can I use tools like Selenium to automate the process?

3) If the answer to 1) is "no", should I instead be scrutinising the source code of Chrome, and then AddressSanitizer using to confirm/exploit the bug? Or should I be using AddressSanitizer in some other way?

That's one way to use AddressSanitizer, but it's not the only way.  AddressSanitizer is just a tool.  It's up to you how you want to use it.

AddressSanitizer is much like Valgrind, if you're familiar with it.  (If you're not familiar with Valgrind, you could think of AddressSanitizer as being roughly similar to Purify, if you're familiar with that.)  It is a runtime tool that monitors the execution of the program and flags a warning if it happens to see something that looks like a memory-related bug.

If you want to use AddressSanitizer to find new bugs, it will be up to you to figure out how to exercise as much of the application as you want and how get good coverage.  You could do anything from "run it once" to "comprehensive fuzzing plus running on a detailed regression testsuite".
Yes, if you want.  It's up to you how you want to generate tests.

I suggest that you read about fuzz-testing.  There are lots of resources.  See, e.g., slide decks from Charlie Miller and the questions tagged with fuzzing on this site.  You might also check out this effort from Google and my experiments on how compilation flags affected fuzz-testing.


What are attribute certificates? Why would someone partition a certificate by reason codes? In "How Certificate Revocation Works" a brief mention of Attribute Certificate and Reason Code partition is made:

  If validated by a client that supports partitioned and indirect CRLs,
  the IDP extension enables the client to determine the necessary scope
  of a CRL when a CA certificate is renewed or re-keyed. For Windows
  Server CAs, the IDP extension can limit revocation information in a
  CRL to only end-entity certificates or to CA certificates. CryptoAPI
  does not support attribute certificates or partitioning CRLs by reason
  codes.

What are attribute certificates in this context, what are reason codes here?

Is this a new technology, or is it something that only experimental, expensive, or rare CAs offer?

Certificate Status and Revocation checking discusses a few of these options.

Partitioning

Although I don't know why one would partition a certificate, there is some interesting support issue with regard to Windows clients and servers.  Windows CA's don't support issuing partitioned CRLS at all.

When the Windows crypto system verifies a certificate it only checks IssuingDistributionPoint values of onlyContainsUserCerts or only ContainsCACerts.  No other fields are supported.  Furthermore, HoldInstructionCode, InvalidityDate, CertificateIssuer, or IssuerAltName extensions in the will be ignored if non critical, or fail if marked critical as per  RFC 3280.

Moreover in Windows, the “onlySomeReasons” and “indirectCRL” fields of the IDP are not supported.

CRL Reason Codes

The process of revocation invalidates a certificate before its end validity date using one of the CRL reason codes.

Note Windows does not support partitioning CRLs by reason code as either a server or a client.  I don't have further information as to what software supports partitioning (as a server or client) or why one would need it

When a certificate is revoked, it is possible for a certificate issuer to specify why the action was taken. This is done by specifying a revocation reason; these reasons are defined by RFC 3280 and include the following:

Key Compromise The token or disk location where the private key associated with the certificate has been compromised and is in the possession of an unauthorized individual. This can include the case where a laptop is stolen or a smart card is lost.
CA Compromise The token or disk location where the CA’s private key is stored has been compromised and is in the possession of an unauthorized individual. When a CA’s private key is revoked, this results in all certificates issued by the CA that are signed using the private key associated with the revoked certificate being considered revoked.
Change of Affiliation The user’s relationship with the organization has been terminated, indicated in the DN attribute of the certificate. This revocation code is most often used when an individual is terminated or has resigned from an organization. You do not have to revoke a certificate when a user changes departments, unless your security policy requires a different certificate be issued by a departmental CA.
Superseded A replacement certificate has been issued to a user, and the reason does not fall under the previous reasons. This revocation reason is most often used when a smart card fails, the password for a token is forgotten by a user, or the user’s legal name has changed.
Cease of Operation If a CA is decommissioned—no longer to be used—the CA’s certificate should be revoked with this reason code. Do not revoke the CA’s certificate if the CA no longer issues new certificates, yet still publishes CRLs for the currently issued certificates.
Certificate Hold A temporary revocation that indicates a CA will not vouch for a certificate at a specific point in time. Once a certificate is revoked with a CertificateHold reason code, the certificate can then be revoked with another Reason Code, or unrevoked and returned to use.

Note While CertificateHold allows a certificate to be “unrevoked”, it is not recommended to place a hold on a certificate, as it becomes difficult to determine if a certificate was valid for a specific time.

RemoveFromCRL If a certificate is revoked with the CertificateHold reason code, it is possible to “unrevoke” a certificate. The unrevoking process still lists the certificate in the CRL, but with the reason code set to RemoveFromCRL. This is specific to the CertificateHold reason and is only used in DeltaCRLs.
Unspecified While it is possible to revoke a certificate with the “Unspecified” reason code, it is not recommended, as it does not provide an audit trail as to why a certificate is revoked.


Command prompt randomly opens and Closes really fast Maybe I am just being paranoid but I suspect a malware or maybe a bitcoin miner. Command Prompts opens at random intervals and I notice random FPS drops while gaming (10-20 seconds long). I'm using a HP-15 Windows 10 x64 System and have Quick Heal AntiVirus (Paid Version) installed. Intel 4005U 1.7Ghz and Nvidia 820M .Full System scans yielded no results. System also feels a bit unresponsive. This and FPS drop might be due to heat but that still doesn't explain CMD's behaviour.

No other unusual behaviour or change in system file was noticed.

What steps do i need to take and can I log what CMD is doing?

If your version of Windows allows you to run Local Security Policy or Local Group Policy editor, you can enable advanced audit logging of process start and stop in the system, and the next time it occurs, look in the Security event log to see what process was launched.

To do this, run Local Security Policy editor (in "Control Panel"->"Administrative Tools") as Administrator (right-click on its icon and select "Run as Administrator"), and expand the left-hand tree "Advanced Audit Policy Configuration"->"System Audit Policies"->"Detailed Tracking". Select "Detailed Tracking", and on the right-hand side, double-click on "Audit Process Creation" to bring up the properties dialog. Tick "Configure the following audit events:", and "Success", then click on [OK] to save the setting. It should take effect immediately.

The next time the window appears briefly, record the system time (not the time on the clock on the wall), run Event Viewer (in "Control Panel"->"Administrative Tools") as Administrator (see above) and expand "Windows Logs" to select "Security". You should see a number of events; you're interested in the ones with Task Category "Process Creation" with Event ID 4688, at about the time that you recorded. You'll probably see a few events; look at the General tab in the details. You're interested in the Process Information bit, specifically the New Process ID, New Process Name, Creator Process ID and Creator Process Name. There should be a "C:\Windows\System32\conhost.exe" process, which is the Command Prompt window that you see. Its Creator Process Name value will tell you how it was launched. Look at the following events to find one whose Creator Process ID is the same as the conhost's New Process ID. That's the program that actually ran in the Command Prompt.

Hope that helps.


Circumventing a "freemail" account form filter I'll be honest - I want to download a free PDF from a website which requires me to enter my "non freeware" email address. I do have them, but I dont want to use one as I'm afraid of landing up on a spammer's list and having a hard time getting out.

How can I circumvent this filter and yet have a valid / email-able email address?

THe site is using a php script to check, no javascript... :(

I'd agree that you're likely to end up having your email address distributed when signing up for something like this.

My preference, in order:

A disposable address, as suggested by Karrax.  These domains are often blocked, unfortunately.
If you have the ability though a non-free mail address, add an alias.  That way you can delete it when you no longer need it, or when it starts to get spam, but until then, you can still receive confirmation emails and the like.  (This is how I personally manage sites that ask for email addresses.  I've accidentally discovered that it's also a really good way to figure out when a site has been hacked and email addresses stolen.)
A dedicated web email address.   This is an email address that you use whenever you need to sign up on the web, you check when you know you have a confirmation email or download link, and just ignore the spam that it collects the rest of the time.
The GMail style +suffix.  I don't like this option as well, because it exposes your real email address to anybody who's interested in looking, but it's better than nothing.


Security Testing AngularJS Web Application An angularjs application stores user input to local/sessionStorage and retrieves it later to fill the form fields or display that content later. If a javascript is submitted as user input, it gets stored in the web storage and is displayed back as required, but it doesn't get executed. I assume that angularjs does some type of output encoding while displaying the content back.

I have tried,

To use view source in browser, but it shows expression before it is compiled
Use inspector in Chrome - It displays the input as is.
Proxy like Fiddler - Wont help much since not request is made.

How do I see what browser actually renders? Or how do I intercept the user data before it is compiled.

P.S. I only have a very basic idea on AngularJS.

EDIT: This question is specific to web application security. I injected an XSS script and it is 'displayed' back as text. Now I need to verify if it is encoded or not. Three options mentioned about does not help.

AngularJS Batarang seems to be the tool you might be looking for. It's a Chrome Developer Tools extension that adds support for debugging and profiling AngularJS applications.

Other than that, you could also inspect values the standard way by accessing DOM element values by JavaScript. It might be a bit tricky to get a pointer to the exact element in question, so the easiest would be (for basic debugging purposes) to simply add to the element an ID and then access it that way. It would work in the Watch Expressions in Sources tab in Chrome Developer Tools too, but does not update on its own each time the value changes, so you could set an Event Listener Breakpoint (depends on the event type you're after) and refresh values this way in the debugger. If however you'd like to trap AngularJS own event listeners (replace existing ones, or also create new ones) then this thread on StackOverflow should have you covered (the answer for your use case is in the question itself).

But, the AngularJS Batarang is a lot more convenient, so no need to reinvent the wheel here. I'm not saying that you would, I'm saying that I actually did, before discovering the extension myself. Anyway, hope any of this helps ;)


Proper way to combine multiple secrets into one HMAC key? I am using HMAC+SHA256 to sign and verify claims in a web application.  Each deployment has its own crypto-random 512-bit secret that I can use as the HMAC key, but in some cases I want to mix in another secret as well.  For example, by mixing in the user's hashed password as part of the key, the token becomes invalid as soon as the user changes their password, which is useful for password reset links.

My main question is: What is the proper way to mix multiple secrets together to form an HMAC key?

One possibility is to concatenate the secrets together, but I've already hit the max effective key length of HMAC+SHA256 with my 512-bit instance-wide secret.  Is XOR a better alternative?

Or is there a better way to mix multiple keys together, such as nesting HMAC calls?  E.g. HMAC(HMAC(claims, secret1), secret2)?

As an ancillary question: Is it appropriate to do this in the first place? I like being able to say that if secret X changes, then the token is automatically invalid, without exposing the secret as a claim.  Signing the token with multiple secrets seems like a great way to do that.  Are there any concerns I should be aware of, using secrets (particularly the user's hashed password) in this way?

At first it seemed to me that XORing the crypto-random secret keys is a good solution because the resulting key is also cryptographically secure (ref. https://crypto.stackexchange.com/questions/48145/xor-a-set-of-random-numbers), i.e. HMAC(claims, secret1 ^ secret2). But for this to work you would need to share your deployment secrets - avoid if possible.

The advantage of nesting the HMAC calculations like HMAC(HMAC(claims, secret1), secret2) is that each deployment can calculate the HMAC w/o sharing its secret with any other deployments.

As an alternative, a better solution might be XOR of the HMAC results instead of nesting them, i.e. HMAC(claims, secret1) ^ HMAC(claims, secret2). This approach retains more information from the claims for each HMAC operation.


TLS 1.0 & 1.1 support by browsers stops in March, what will happen if I keep using it? In March most browsers will stop supporting TLS 1.0 & 1.1 my website already uses 1.2 but some external apis still use TLS 1.0. What will happen with the requests to those apis? Will they keep working as they are or will there be some sort of error?

The requests to those APIs will fail.

This is because browsers will try to do a handshake with the API server, and only accept servers who support TLS 1.2 or TLS 1.3. If those servers don't support either of those, the client will reject the connection.

As a result, you have several options on how to proceed now, each with varying pro's and con's.

Request the API providers to upgrade to TLS 1.2 or 1.3

This is the recommended approach, as it actually results in better security for every endpoint. The obvious downside is that you can't force the providers to do this, so you may have to look into alternatives.

Replace the API

If the providers of the API do not care about maintaining their service, then a valid strategy is to find someone who does. While the migration from one API to another is indeed a lot of work, the upside is that you work with a more stable API. This assumes that you can migrate to a different API. If the API you are consuming is the sole provider of the data or service you need, then you must find a different option.

Build a Proxy for the API

Simply put, your website provides a server that speaks TLS 1.2 and/or TLS 1.3, and simply relays all API requests and responses to the client. This may be a feasible solution, depending on the amount of clients requesting the API. It could also be used as a temporary workaround while the above mentioned API providers fix their TLS configuration.

Require users to use legacy browsers

This is an approach I am not a fan of, because it makes everybody less safe. However, in small environments, this could be a feasible quick-and-dirty (with the emphasis on dirty) workaround to keep things working one more day.


Can I use a vpn to securely use prototypes of webapps from my phone or laptop? I want to experiment with web development (using django) for both desktop and mobile. Server, phones and desktops could all be part of the same virtual private network. The VPN will be from some professional, commercial vendor. I'll be the only user of the apps. I'm trying to find the easiest way possible to secure the data in and access to the webapps. Is it possible to limit the use of a webapp to within a VPN? Will that alone provide decent security?

If not: Is there some other way to make decent security easy to achieve for a novice programmer given that I will be  (1) the only user of the webapp, (2) will only use it with a small number of devices, and (3) would be willing to spend some time and money on configuration (f.ex. setting up a VPN connection) and services (commercial VPN) for these devices?

I think what you are looking for is to set up your own VPN, not to connect to a VPN service that proxies your connection to the internet.  The purpose of a VPN is to extend layer 2 (LAN/Home) connections accross layer 3 (WAN/Internet) connections.  So in your case you want to set up a private network between only your development server and devices.  If everything was located in the same pace you would simply setup a switch between the server and clients and either firewall the server from the internet or simply not connect to the internet at all.

If you have a linux VPS somewhere in the internet and want to connect to devices on your own LAN then you may want to look into setting up your server as a VPN server.  For your clients you'll want to look into what VPN clients they can support to connect to your server.

A nice option to avoid having to configure VPN access across multiple devices is to setup a router that can be configured to connect to your VPN server.  Many commercial home routers can be flashed with DD-WRT which supports several VPN protocols.  Your devices could then connect to this VPN router using regular wifi or ethernet.  Additionally, you could setup a VPN router on both ends to connect to each other.

There are also apps such as hamachi that lets you setup a VPN between a number of systems while allowing traversal of NAT.

If you require both internet access and access to a VPN between your clients and server then you can setup static routes using DD-WRT on your router or directly on your clients/server.  Windows supports adding routes using the route command.  You'll have to research what each client supports.

Now if your development server is on the same physical network then there's really no reason to use a VPN.  You simply need to segregate the server to client traffic from the internet.


Is a 14 character password safe enough for regular purposes? (Using A,a,1,!- Caps/Lowercaswe/Numbers/Special#'s etc etc) ex: 9(ax4$3#AZz22Z I remember Truecrypt putting pressure on you to have at least 20 characters, but doing some research..... it seems even 14 characters is good enough (using Caps, Non caps, numbers, special #'s, etc)

So my question is: Is a 14 character password safe enough for practical purposes? (Using A,a,1,!- Caps/Lowercaswe/Numbers/Special#'s)
ex: 9(ax4$3#AZz22Z

It still seems it would take 204 million years to crack it according to:
howsecureismypassword.net/

According to password.kaspersky.com/
it would take 327 centuries

According to bee-man.us/computer/password_strength.html
5107806 years using Base 64

If (and a big if!) you choose the characters uniformly at random, from a set of 95, each choice independently from each other, then each of the 14 random choices has about 6.6 bits of entropy.  (By very coarse math that's worth memorizing: uniform random choice out of 10 possibilities is about 3.3 bits; out of 100 possibilities is about 6.6 bits.)

So:

6.6 bits/character * 14 characters = 92.4 bits.
6.6 bits/character * 20 characters = 132 bits.

It seems that TrueCrypt's recommendation is grounded on a choice to use a 128-bit encryption algorithm like AES-128—20 printable ASCII characters is the shortest length whose maximum security can live up to the 128-bit security level of the application.

I would say that you should consider using their 20 character recommendation, but you could just as well seriously consider using 14.  The Diceware Passphrase FAQ has an entry discussing recommended passphrase lengths for encryption, with advice that while no means definitive at least gives you some important perspective:

  A five-word Diceware passphrase has an entropy of at least 64.6 bits; six words have 77.5 bits, seven words 90.4 bits, eight words 103 bits, nine words 116 bits, ten words 129 bits. (Four words only provide 51.6 bits, about the same as an 8 character password made up of random ASCII characters. Both are breakable in less than a day with two dozen graphics processors.) Inserting one extra letter at random adds about 10 bits of entropy. Here is a rough idea of how much protection various lengths provide, based on updated estimates by A.K. Lenstra (See www.kelength.com). Needless to say, projections for the far future have the most uncertainty.

  Five words are breakable with a thousand or so PCs equipped with high-end graphics processors. (Criminal gangs with botnets of infected PCs can marshal such resources.)
  Six words may be breakable by an organization with a very large budget, such as a large country's security agency.
  Seven words and longer are unbreakable with any known technology, but may be within the range of large organizations by around 2030.
  Eight words should be completely secure through 2050.

  Pick your passphrase size based on the level of security you want.

Also, this bit further down is definitely fun and good food for thought:

  Another way to think about passphrase length is to consider what security precautions you take to physically protect your computer and data. Here is a list of possible passphrase lengths and commensurate security precautions. The list of precautions is not intended to be complete. I am not trying to discourage anyone from using longer passphrases if they feel up to it, but the added strength without comparable physical security for your computer is of limited value.

  [...]

  7 words

  Your computer is protected from unauthorized access at all times when not in your personal possession by being locked in a room or cabinet in a building where access is controlled 24 hours a day or that is protected by a high quality alarm service.
  Routine cleaning and building maintenance people do not have physical access to your computer when you are not present.
  You regularly use an up-to-date anti-virus program purchased off the floor at a computer store.
  You have verified the signatures on your copy of PGP or GPG, etc.
  You never run unverified downloaded software, e-mail attachments or unsolicited disks received through the mail on your computer.

  [...]

  8 words

  You take all the steps listed under 7 words above, and:

  Your computer is kept in a safe or vault at all times when it is not in sight of you or someone you trust.
  Your computer was purchased off the floor at a randomly selected computer store.
  All the software used on your computer was distributed with a strong, independently verified electronic signature that you checked, or was purchased off the floor in a randomly selected computer store
  Your computer has never been repaired or upgraded by anyone you do not trust completely.
  All disks and tapes used with your computer are either kept in a safe or physically destroyed.
  You take precautions against audio and video surveillance when entering passphrases.
  You change your PGP encryption key regularly (at least once a year).
  You have taken precautions against TEMPEST attacks. See the chapter "Commonsense and Cryptography," in Internet Secrets, from IDG Books Worldwide, for a discussion of what this involves.

I think these are perhaps a bit paranoid for most people (is the NSA or FSB out to get you?), but they do convey an important message: making your password super-strong has diminishing returns.  It only does you so much good to have the strongest passphrase in the word if you're vulnerable to much easier attacks.  That's how you'd justify the much more convenient 14-character password over the 20-character one.


Is all reflected XSS bad? I stumbled on a site today that was vulnerable to XSS. I was able to get an alert box to display via an input box and some JavaScript. I was about to report this to the site owner, but I realized there were no queries in the URL and this attack wasn't saved anywhere on the server.

Could this be malicious in any way? Is there any reason to fix it?

A common social engineering ploy which uses such reflective xss attacks is to trick users into entering obfuscated javascript code into the input box themselves. Usually under the pretense that it would be some secret trick to do something interesting on that website. But what it actually does is steal the user's login cookie and write a message to everyone on their friends list telling them to also try out the "secret code".

Another use of such a reflective XSS vulnerability is to combine it with a cross-site request forgery attack. An attacker would build a form on a website they control and have it submit to the same URL on the target website which the vulnerable form submits to. They would then lure their victim to their website. The victim doesn't need to perform an action on the attacker's website, because it's possible to submit the form automatically on pageload using javascript. This only works under the conditions that 1. the vulnerable form is processed server-sided and 2. the vulnerable website doesn't use the standard methods to prevent CSRF attacks (validate the user's Referer header for POST requests, use a sane CORS configuration for XmlHttpRequest's).

Should you report it as a bug even if you don't manage to find an exploit? Definitely. It's certainly not intended behavior and a sign of bad code.


Where is the PE loader in Windows? I have read that the PE loader is responsible for loading executable images from disk. When and where is the control flow exactly transferred to the loader? The PE format is well documented but there seems to be a little info regarding the functioning of the loader itself.

To answer your question, I need to cover the full description of how a new process created.

There's a great description of this in Chapter 5 of Windows Internals 6th Edition Part 1 (ch. 5 being available freely online on the Microsoft website) which explains exactly how all of this works.

I'll paraphrase an overview of what's said in the book, as copying it verbatim would probably have some copyright issues.

The PE loader is exposed by a set of user APIs in kernel32.dll, under the CreateProcess family. There are different APIs for doing different things, e.g. running a process under an alternative security context.

Here's how it works:

The user-mode API validates the input parameters, and converts them to their system (native) counterparts.
It then opens the executable file and loads it into memory.
Creates the executive process object in the kernel. This involves populating the EPROCESS structure and registering the process in various lists.
Creates the main thread of the process (stack, execution context, thread object)
Performs subsystem-specific initialisation - e.g. CLR init for .NET applications.
Start the main thread (unless it was created with the suspended flag set)
Load the appropriate DLLs in the context of the process.

Most of this is done at the kernel level, using the appropriate Ps-prefixed native functions. The full set of steps involved is rather complex (in fact, it takes up 15 full pages in the book) and involves a lot of different actions depending on the susbsystem used.

The tricky part with your question is that the "loader" isn't really something that gets control flow. The instant you call CreateProcess, you're technically running the loader.  However, the kernel part of the loader begins when ntdll!NtCreateUserProcess transitions into kernel-mode. If we're really strict about it, we might say that the first part of the loader is PspAllocateProcess, since that's what allocates the initial structures.


safe money transfer on open wifi VS vpn not allowed sometimes I need to do money transfer on my windows tablet when I'm connected to an open wifi, but I noticed that some of them don't allow VPN services.

This scares me, since I'm worried about session stealers and the consequent safeness of my payment sessions (while connecting into Paypal, for example).

I already use an antivirus safe zone (Kaspersky SafePay) but I'm afraid it's not enough.

Please note that I cannot use a live Linux distro nor an installed one because none of them does recognize the wireless adapter, but I have Whonix (Linux running on a Virtual machine) installed, so I could exploit this option too.

Is there any way to exploit VPN even when it's not allowed by the server? Otherwise can you suggest me any alternative method to avoid to run the risk of being monitored during a session on an unsafe network?

Banks do not block all VPN, but they might block known VPN which are advertised for anonymous surfing or similar. Because if such a VPN is advertised and used to hide the origin of the user then chances are high that it will be used for illegal activities too. This means an increased risk for the bank and it's users if the bank accepts orders for money transfers this way, because it's harder to verify the origin and legality of such transactions.

If you instead setup your own VPN so that it looks like that you connect from your own home then it should be no problem to use the online banking. If and how this can be done depends on your setup at home.


Are there any successful cases of timing attacks over the internet? Potential timing attacks are always brought up in one context or the other but I don't think I've ever read a case where someone has actually executed such an attack over the internet.

It might be tempting to assume that network latency (jitter) makes these attacks impractical. This is not the case because TCP timestamps are often used by the vulnerable machines, where the precise time the packet was generated is encoded into the TCP header. No matter how long it takes the traffic to arrive, the exact time it was created is still present. Even on systems with timestamps disabled, it is possible to get an accurate idea of the packet timing by repeating the test multiple times and averaging the result to account for network jitter. So, with that in mind...
Yes, timing attacks can be done over a network. The most prominent example was a long-lived vulnerability in OpenSSH that allowed trivial user enumeration. The issue was caused by the fact that an invalid user would trigger password comparison using Blowfish, the default. When a valid user was used, SHA-2 would be used instead. While normally the timing difference is minimal, sending a large password (several kilobytes) would cause the difference to be noticeable.
From the original bug disclosure:

When SSHD tries to authenticate a non-existing user, it will pick up a fake password structure hardcoded in the SSHD
source code. On this hard coded  password  structure  the password hash is based on BLOWFISH ($2) algorithm.
If real users passwords are hashed using SHA256/SHA512, then sending large passwords (10KB)  will result in shorter
response time from the server for non-existing users.

Attacks against these types of bugs often exploit the fact that a different code path is taken depending on the input you provide, causing a significantly greater timing difference than is typically seen with low-level architectural timing attacks where the differences are measured in nanoseconds and come from instructions not executing in constant time (flush+flush, etc).


How to prevent from memcpy, cause Heap Overlflow? I'm following Stanford CS155 security lesson's presentation to learn integer overflow. I learned today that memcpy() function may lead to overflow.
The presentation says, If I have a code something like below, second memcpy() function may overflow heap.

void  func( char *buf1, *buf2,    unsigned int len1, len2) {
  char temp[256];
  if (len1 + len2 > 256) {return -1}    // length check
  memcpy(temp, buf1, len1); // cat buffers
  memcpy(temp+len1, buf2, len2);
  do-something(temp);   // do stuff
}

How can I prevent overflow? What should I change in memcpy() so that it will not cause an overflow?

The problem is that you are adding the two integers before performing the length check.

if (len1 + len2 > 256) {return -1}    // length check

If len1 and/or len2 are sufficiently large, the addition will overflow, and the length check may go through even though the len1 and/or len2 are too large. To be safe, you must check twice:

if ((len1 > 256) || (len2 > 256) ||(len1 + len2 > 256)) {return -1}

For an example, try setting len1 and len2 to UINT_MAX/2+1. Then  len1 + len2 will (usually) be 0.


How do browsers import password data from other browsers? Specifically, how did the new Microsoft Edge (based on Chromium?) import my passwords from Google Chrome (which are synced to my Google account and supposedly secure)?

I'm on Windows 10. Does Windows have a standard password exchange medium? What is stopping a malicious program getting my passwords from Google Chrome, possibly decrypting them by asking me to input my Windows password for another fake purpose, and secretly uploading them somewhere else?

What is stopping a malicious program getting my passwords from Google Chrome, possibly decrypting them by asking me to input my Windows password for another fake purpose, and secretly uploading them somewhere else?

Nothing.

On Windows, a program running under your account can access anything that belongs to you. The defense is "don't run malicious programs". This is particularly common in desktop OS's; mobile ones are much better in this regard.


Choosing right way to secure access to server access via socket I have an application running on a server, that has an exposed socket to the Internet to communicate with client that is/are application(s) on a phone. How would one go about properly securing the access to the server, if one is not sure he could trust the client to store secrets?

What I mean by not trusting, is that for example if I don't want to store symmetric encryption key on the device, and I'm not sure encrypting messages with public RSA key is good enough since someone could just repeat message to the server..

TSL on the other hand seems to be geared towards client recognizing whether he can trust some server..

What would be a good way to start implementing a secure access from the client towards the server, and server to be able authenticate the client ?

Authentication is about reliably recognizing who is at the other end. Since, from the server, you "see" the client only through network packets, and since everybody can buy the same kind of hardware, you may hope to properly authenticate a specific client only if that client is able to compute things that other systems would not. This implies that the client must know some "secret". There is no avoiding it. If no secret can be stored client-side, then authentication from the server is hopeless.

Now, it so happens that in the case of a phone, the client system comes with an appendage usually designated as "human". There is a (loosely maintained) one-to-one relationship between a phone and its owner. This means, in your context, that the client-side secret can be stored in the device itself, but also in the brain of the human user. We call that, technically, a "password".

Alternatively, there is a reliably stored secret value stored on the phone side: it is the key in the SIM card. That specific secret is what is used by phone companies to distinguish phones from each other, and all the billing is based on it. You might be able to leverage that authentication, but only by integrating with the phone companies; you don't do that with a mere "server on the Internet". A practical implementation would be the following:

Client app connects to your server (with some appropriate protocol, typically SSL/TLS).
Server sends a SMS to the user, containing a random numerical code.
User reads the SMS and types back the code in the app.
The app sends the code to the server.
The server sees that the code sent from the app matches the one it just sent by SMS, and is happy.


Isolate Virtual Machines on host-only adapter I am performing malware analysis on VirtualBox. I want the VMs to only communicate with each other. Using host-only adapters, I have installed a Windows 7 VM (192.168.56.101) with the default gateway (192.168.56.102) and a REMnux VM (192.168.56.102).

My host machine is running on IP 192.168.1.3. But I am able to ping both the VMs. How can I prove that the virtual machine is isolated and does not have access to my host machine? Are there any steps that I can show to demonstrate isolation?

Or should I use internal network? But for some reason, when I use internal network my REMnux machine is not getting any ip address.

If you put host-only, your VMs can access, well, only the host. Your host machine is not isolated, but the opposite: it's the only machine they can access.

To isolate the VMs, you must use Internal Network. Using this network means:

The host can't access the guests
Guests can't access the host
Guests can't access the internet
Guests can access each other

If you use Host Only, the guests access the host. If you use NAT or bridge, they can access your entire network.