Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine? I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. When I went to finish the install after letting it sit like that for a week, I had noticed that someone had found the site, and inputted their own database information, and "took the site over". It was a blank slate, so not much to it.

I removed the wp-config.php file and re-ran the installation with my own values. I then looked around for anything suspicious in the WordPress directory. I had found a shell plugin they installed, labeled "UBH console". I couldn't get the console to run, I got a 404 error.

I assume this shell couldn't get them access out into the machine past the www directory the website was installed in?

In the past, I've always set the WordPress directory permissions with the following command:

chown -R www-data:www-data directory/

Is this the right way to set these directories? Upon further research, a lot of people run this and stay like this, but I've heard to change your permissions after running the installation. Running Debian on my machine.

If you run the WordPress as user www-data, an attacker can do everything the user www-data can do. That's usually quite a lot:

Wide read access. You could test what you can access e.g. using sudo su -s /bin/bash www-data.
Write access to all the other sites run as www-data. You should treat every site as potentially compromised.

To prevent that in the future (not limited to these actions):

Run sites as separate users using PHP-FPM pools.
Chroot jail the web sites.
Disallow potentially dangerous PHP functions.
Do not leave copies of WordPress waiting for installation anywhere.
Keep WordPress and its plugins up-to-date.
Consider adding a web application firewall (WAF).


How to prove my Gmail has been hacked? I believed that someone had hacked my Gmail because they were using information contained within my emails in an attempt to try to convince me that they were psychic. I told them that I didn't believe that they were psychic and knew they could only have obtained this information from reading my emails. I've not spoken to them since then, which was over a year ago. However, they have continued accessing my emails and they've been covering their tracks until recently. Recently, they've been forgetting to mark the emails they've read as unread after reading them, so when I loged in my new emails have already been read. Is there a way to prove that my Gmail has been hacked and file a police report especially being that I've already revoked access from devices and IP's that weren't mine?

This person is a self-professed hacker. When I told them that I knew they had accessed my emails they told me exactly how they had used a key logger back when we were working together to gain access to my account. My computer is secure now. All I need is to know now is how I can get information to file a police report.

Note: I don't have an account. I'm a public figure and I choose to be anonymous for a very good reason. Please stop removing my edits.

First things first, change your password and make sure the new password is secure (10+ characters, a number somewhere other than the last character, a capital somewhere other than the first character, not an iteration on your past password, etc). This is good to do periodically anyway.

GMail has tools for seeking suspicious account activity.  Specifically, look at your recent security events, which should list all of your active logins plus all logins from the last four weeks, including locations and browser fingerprints (e.g. one of them will say "CURRENT DEVICE" to represent your browser right now.  Are there others?).

Be wary about future attempts to obtain your credentials (somebody using your computer while you're logged in, a key logger, malware on your computer, or a phishing attack).


Why this XSS payload doesn't work? TOday I needed to demo DOM Based XSS, and I came across this page which is made for the same exact purpose.
I wonder why <img+src+onerror=alert(1)> works but <script>alert(1)</script> does not?

The page you refer to has the following code:

Hello, guest!

 should result in
Hello,
 which should in your opinion result in the script getting executed.

But this is not the case. The documentation of Element.innerHTML explains why:

  HTML5 specifies that a


Possible to detect an/or shut off CryptoLocker by limiting total network bytes transferred? Since a virus infected PC has to download (encrypt) reupload the entire file (to a file server), and repeat the process for every network drive, is is possible to detect this unusually high bandwidth event?  Is there a way to respond to it (via QOS or something?)

I'm looking for a way to detect and/or limit Cryptolocker encryption by monitoring how much data is transferred (as it is encrypting files) and possibly set a quota on this transfer (QOS?).

Is such a mechanism available for a Windows machine?  I haven't been able to locate this myself in default Windows settings but am open to alternative solutions.

Alternatively, such a bandwith-monitoring approach could be used to prevent a data leak, or an employee stealing company secrets.

Since a virus infected PC has to download (encrypt) reupload the entire file, and repeat the process for every network drive, is is possible to detect this unusually high bandwidth event? Is there a way to respond to it (via QOS or something?)

You're mistaken: the malware doesn't need to transfer the file. It uses asymmetrical encryption: the file is first (symmetrically) encrypted with a long, unique and randomly generated key and that key is the encrypted using only the public half of the decryption key.

Once that symmetrical encryption key is deleted, there is nothing left on your machine to decrypt the files and you never touched the key that will unlock it.

  I'm looking for a way to detect and/or limit Cryptolocker encryption by monitoring how much data is transferred (as it is encrypting files) and possibly set a quota on this transfer (QOS?).

Don't try to build your own: there are plenty of security systems that can assist you with detecting (and provide protection against) this and many other threats: antivirus scanners, IPS, IDS, NBAD, firewalls, etc. Any (smart) investment you make is these will be orders of magnitude more efficient than trying to jury-rig a protection on your own - especially if you do not understand the nature of the threat.


Fix vulnerabilities in ALL applications, or only client-facing ones? Given a setup where we have nginx sat in a DMZ serving static content, forwarding (REST/WS) requests through a firewall to tomcat running on a server where other applications are also running:

YOU <> [FW:443] <> (NGINX) <> [FW:8443] <> (TOMCAT)
                                           ( APP1 )
                                           ( APP2 )
                                           (  DB  )

Can I focus on just the nginx & tomcat applications in terms of patching CVEs/vulnerable dependencies, or must I ensure that all other applications are as 'CVE-free' as possible.

I believe this is different to this question about whether applications behind a public firewall need to be patched.

Prioritize fixing vulnerabilities based on whether they are exploitable remotely [at least theoretically]. Prioritizing 'front facing' components is not the right approach since there could be serious vulnerabilities on components behind the firewall which could be exploited remotely. For example an XML parser you are using behind the firewall may have a known XXE issue. Firewall may do nothing to prevent it unless it is a WAF and have a specific rule to block that. With your current prioritization you would ignore this vulnerability and it would result in the application being remotely exploitable.


media uploads and social sites group privacy etc On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat.

In the context of privacy and security on a social network, I'm assuming most people think these images etc. are secured. But are they?

Am I right in assuming that actually the security comes from the fact that an uploaded image just has some kind of extremely hard to guess guid that forms the url? The fact that an album is hidden, therefore projects the urls for it's contained images being seen, but if someone had the URL for a specific image they could view it regardless.

I know you can use scripts that generate an image (e.g a php script) whereby the image itself doesn't have an actual URL and is above the document root, but is more of $_GET parameter and the script could therefore enforce security. But something the scale of Facebook and Google where you would be relying on CDNs to deliver this content, a script handler for every image doesn't seem viable.

Am I right in assuming it's actually just security through obfuscation? Or do these sites employ some kind of sophisticated ACL to actually control access to individual images? How should this be handled in the context of social networks e.g more image based then truly sensitive files? (though obviously an image itself could be sensitive to the uploader)

This question dives deep into the AAA stack of identity and access management so we can start there.

Authentication
Authorization
Accounting

In a well defined AAA system you have to determine a method to evaluate the status and sensitive of many objects and entities. Users, computers, pictures, and other forms of data within a AAA system need to be properly protected through these methods. There are many ways to do this including the use of databases, file meta data, ACLs and more.

To make this example float, I'll use google drive as my main focus. On google drive, every document you create is given a specific URL which can be shared around the globe. However, as the file creator you get to determine who has what type of access. For example, you can state that the user must be logged into google through a specific account. You can further state that some individuals who are logged in only have read permissions while others have write permission. How this is stored is not the biggest concern, but I imagine they use some form of a database engine to track this ACL.

Continuing this example, I've now created a file with a specific AAA policy. I have created a policy that requires people to log into google (Authentication), and I've created a specific set of people that are allowed to view or edit the file (Authorization). Google, will then enforce this policy such that even a user with the correct URL cannot have access without first Authenticating and being authorized. Assuming there are no breaches of security, this file is now secure to the people I have authorized.

This is where security becomes a major factor. If google doesn't apply the AAA framework appropriately, my files can be exposed. In fact, Google actually had a recent data leak because they failed to enforce AAA properly. It's not that they couldn't have secured the data, it's that something was missed and users were able to see data they should not have because the Authorization mechanism was not responding properly.

So, in summation, AAA security is a lot more complex than having a GUID or URL when applied properly. Through various means, files and users are given attributes which can be used to evaluate who has access, what access they should have, and even why. It is then up to individuals, companies, and governments to hold the AAA system owners accountable for security and remediation of failures to prevent the implementation of poorly designed systems.


Cell phone monitoring device This Chinese company claim their device/sim card can track other cell phone locations, record phone calls and SMS. Is this possible without having access to the other phones first? What do you guys think? It looks like a scam to me. Here is the link to their website, and it is in Chinese.

http://www.ikl23.com/

Technically speaking it is possible. If the regulations permit it, they would have no problem to identify other phones (operated by this carrier), record calls and SMSs as well. After wrapping all that information up, it could be sold as a tracking service.

All the data above is flowing in their network, so there is not technical challenge here.

I don't know China very well, but I cannot believe that such a thing is allowed, since it hurts really bad the individual's privacy. Sounds like a scam to me too.


Is the common recommendation to obscure the existance of a username on login just security theater? It is a common recommendation to return "Username or password is incorrect" instead of "Username does not exist" when the given username does not exist and "Password is incorrect" when username exists but password is wrong.

The generally cited reason is that you don't want to provide an attacker with the knowledge that a username exists, to prevent online brute force attacks.

However, if username is used to login, it has to be unique, and therefore you will need to inform the user that a chosen username is taken while they are creating an account. So an attacker can easily determine if a username exists even if you only say "Username or password is incorrect" when logging in.

But even if no signup page exists, or other measures are taken to obscure the existence of usernames on registration, this recommendation still doesn't make sense. Usernames are not designed to be secret. Most people reuse usernames, and they are easy to find. And keeping them secret only improves security so far as it increases the total size of your secret, which can be achieved with longer required passwords.

And moreover, there are better ways to prevent online brute force attacks than longer secrets. Rate limiting users on login, which a properly slow password hashing algorithm like bcrypt already implicitly does, or providing a timeout after many incorrect attempts, solves this problem far better than a longer secret does.

Is there something else I'm missing? Even on this site I see people defending this practice, but I have yet to see a reason that isn't better solved with other methods.

Edit: As a follow-up, if this recommendation really isn't useful, why is it still common? And where did it come from?

Sometimes there is a legitimate reason for such a protection. To give one example I've personally observed (details elided), the website for a medical provider that specializes in a particular kind of treatment (possibly something stigmatized, like sex reassignment or hormone replacement, suicide or drug addiction counseling, abortion, STI treatment, etc.) should definitely have such protections, because merely knowing whether somebody has an account with the provider constitutes a breach of patient confidentiality (in practice, whether or not in law).

Of course, you also need to protect the registration page, in that case - maybe the registration page just never shows an error, merely says "check your email for next steps" whether or not the user is in the system, or perhaps registration requires some private info in addition to the usual email address+password - and all the other avenues of detecting existent accounts (forgot password pages, etc.). That's totally doable, though.

The same principle can be applied to other things where privacy is desired. Online dating services, "adult" toy/movie stores, any kind of social site where users are always under pseudonyms, specialized legal services, any kind of problem-reporting or similar service where somebody might want to retaliate (for example, whistleblower sites), and so on.

When you get right down to it, there's relatively few scenarios where you wouldn't prefer to have such protections (an explicitly non-anonymous social networking/collaboration/etc. site is the only class that immediately comes to mind). For most sites, it's probably not that big of a deal, but in general, unless you have a reason to make it clear who all is using your site, you should try to avoid leaking usernames. Enough people prefer privacy that it's at least worth keeping in mind, and even though in theory it should be the user's job to ensure they aren't using usernames/email addresses traceable to them across multiple sites, in practice people are bad at / don't know how to do that.

EDIT: I didn't read all the comments first; @schroeder gets it.


How can I give out a secret to the public that only I can decipher? I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with just one link. The way I thought about this specific layer, which is on top of your basic security, is, everyone who buys my product will get a copy of this public hash. As of now, I compute this hash with password_hash( 'mypassword', PASSWORD_BCRYPT, ['cost'=>20'] ), it creates a strong password, supposedly unbreakable.

When I'm trying to access their website with it, and so, I pass the plain-text in a password field, I simply do password_verify on the input. If the input provided matches (after hashing) the public hash, then it means the passwords match.

A problem with all of this, however. If one of my customers is running on HTTP only or an attacker tricked me into accessing his evil site, he'll see this in plain-text. Now, this password is cycled every 12h or on some triggers and on its own, it's useless, but is this really a good way of solving the issue?

In other words, if I "leak" my hash to the public, is bcrypt, 12 hours with resets happening on triggers such as if a customer's site is on HTTP enough to stagger attackers enough?

This is just an additional layer that adds an extra step for an attacker to work through.

You can do it with a public key, and a random challenge.

Ship your public key on your product, and keep the private key well protected. When you try to login:

Module generates a long (512 byte or more) random token
Encrypted token is sent to you
You decrypt the token, sign it, and send back
Module checks if the token is the same it sent, and if the signature matches

This way, you don't need to keep a secret on the client (the public key is public anyway), it is secure even over HTTP (attacker cannot forge another token, or the client will reject it), and your private key keeps secured with you.


Why isn't open WiFi encrypted? As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the same password.

If this is true, I don't understand why. Requiring a password for access and encrypting connections seem like totally separate issues.

Are they really linked this way? If so, is there some reason I'm not seeing? Can some routers be configured to allow public access with no password, yet encrypt the users connections to prevent Firesheep-style attacks?

Update

Some answers have said or implied that the password is a necessary "shared secret" that enables encryption. But it's not necessary. This problem was publicly solved in 1976.

  The Diffie–Hellman key exchange method allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure communications channel. (http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange)

The question (to most people) is an oxymoron. By definition, people will think that "open WiFi" means "un-encrypted WiFi. To me you seem to be asking "Why did the people that wrote the 802.11 standard way back in 1997 make the decisions that they did?"

The short answer - we can only find out by asking them (or seeing if there are any discussion documents floating around on the internet).

However, we can discuss the Firesheep portion of the question. A "Firesheep" attack is a specific type of attack where cookies that authenticate a user to a site are copied by an attacker.

The only requirement is that the cookies can be obtained by the attacker - and therefore WiFi networks using WEP, WPA, or WPA2 with a single pre-shared key are vulnerable, if the attacker has the key. And of course, many small businesses provide WiFi access using a single key.

Having "better" Access Points is an expensive way of fixing this problem, and will still leave users vulnerable to the above attack scenario (where the attacker can use ARP poisoning plus a man-in-the-middle attack against HTTP-only sites).

Therefore as far as solutions go, the best and most useful would be widespread implementation of HTTPS (as recommended by the creator of Firesheep, Eric Butler)


Hardware encryption for flash drives Could someone tell me the difference between hardware encryption and software encryption?
(With regards to flash drives, if it makes any difference).

From what I understand, software encryption is basically a program that runs when a flash drive is inserted and asks for a password. So what does hardware encryption do? Does it protect it in the same way?

If so, what is the difference between them?

Ultimately, there is no difference: both "types" of encryption will end up running some software on top of some hardware so this is mostly a marketing argument.

How an encryption stack works exactly depends, of course, from case to case and it is very important to review the details.

For instance, some hard drive will implement some encryption layer in the BIOS of their controller that will force every write done to the disk to go through that encryption layer no matter what the computer the disk is connected to supports or does. The same, however, can be achieved without any direct support from the hardware by using full disk encryption.

Both "type" of solution typically have the same performances since modern CPUs are fast enough to process the encryption/decryption streams faster than the read or write speed of even fast SSD drives (i.e. the encryption isn't the bottleneck).

Typically, all solution will offer roughly the same algorithm - frequently, AES in CBC mode using a diffuser: it's standard, royalty-free, well understood and has known security properties. The most important element to consider when looking at a disk encryption solution is the key management: how are encryption keys generated, stored, accessed and managed. This is where "software" based encryption usually shines: having access to a "richer" environment (especially so is there is some OS support or access to specialized hardware installed on the machine - like a TPM chip) which can lead to a better experience and more secure key management.


Authenticate-then-Encrypt: does the authenticity provide a benefit? First off: I know that encrypt-then-authenticate is better, however I want to understand the following for authenticate-then-encrypt. The underlying cipher is AES-CTR or AES-CBC for this consideration.
When using encrypt-then-authenticate, the authenticity of the of the cipher text can be proven, because both parties have the key for the authentication algorithm, e.g. HMAC.
When using authenticate-then-encrypt, one party can't prove the authenticity of the cipher text, as it has to decrypt it first. If it decrypts and then checks the authenticity digest and gets a match, then it knows, that the message has authenticity.
And here is my question: does an algorithm for authenticity, e.g. HMAC, that uses a key, provide anything more than the integrity a simple checksum like CRC-xx can also provide? If a party decrypts a message and gets a match on the checksum, that should mean, that the correct key was used, that only the two parties have and therefore authenticate the message.
Thanks in advance and BR.

It seems you are asking: If the receiver can correctly decrypt the message using the secret key, isn't that proof already that it was sent by the other party which also has the secret key?
AES and similar block ciphers don't really make distinction between succesful and failed decrypt operations. A message is transformed in a certain way, and that hopefully results in the plaintext. So we would need to check the embedded HMAC or CRC checksum to see whether the decryption succeeded.
An attacker would be able to manipulate the ciphertext so that the CRC is correct for the plaintext.
With certain ciphers, such as AES-CBC, an attacker can change the ciphertext in a manner that reliably changes the plaintext. If an attacker would modify the ciphertext, our HMAC or CRC checksum would no longer be correct. However, for a CRC checksum, the attacker can modify the ciphertext until the CRC is correct again. The attacker can flip bits in the embedded CRC, and can calculate what it should be.


Which of AES modes are safer and faster for transferring data over the network? I have using Crypto++ in Qt and use of AES Algorithm for encrypting files. I know about AES modes and their applications.

I have use of StreamTransformation method for encrypting files in CBC and EAX modes. Now I want to Transfer data over the network, but I don't know which of the AES modes are suitable for this application (which of them are faster and safer than others).

Also I research about RC4 algorithm, but I understand, this algorithm have lacks and known as an unSecure algorithm and RC4 should not be use in TLS protocol according to Mozilla and Microsoft.

You should always use an AEAD mode if you can, especially over the network. Crypto++ seems to support GCM, which is a good AEAD mode that has seen use in TLS 1.2. (There are others that are just as good, but TLS's "star power" lends GCM a lot of credibility.)

Importantly, AEAD modes authenticate "additional data." This is unencrypted data not included with the message, and is quite useful in network applications, as the additional data can contain a channel identifier of some kind (Either a TLS channel ID, a IP address and port combination, or something else appropriate to your protocol), and/or a timestamp. This prevents replay attacks by making the encrypted data only valid when it's sent over the original channel.


Do (uncompromised) passwords ever need changing, if I use a password manager? For instance, my Google account has a 32-character, random character password that I maintain with LastPass.

I regularly flash new ROMs on my phone or otherwise need to be able to manually type in my password. Not a big deal, but that password hasn't changed for quite some time now. I haven't memorized it, but that password is beginning to feel… familiar. And of course, the only secure password is the one you can't remember.

I'm wondering if this password, or any other passwords that have been in my LastPast vault, need occasional changing, even if the passwords have not been compromised. Something along the lines of the corporate "change-your-password-every-90-days" thing.

Do you know that they are uncompromised?  If you are absolutely sure, then there is no real need to change.  Obviously if they are compromised, then go ahead and change.  If you do not know, then it becomes more interesting.

That is the main purpose of changing your passwords, just in case they are compromised and that you are not yet aware of it.  So the whole 90 day password change policy is usually a risk based compromise between how likely is your password compromised, and how annoying is it to change and re-remember (or in the case of a password manager, update and start using).


localStorage for apps over https. What expectations are there? I run an online gradebook.  To keep student data private, I transfer all data over https.

Now, I'd like to use localStorage to avoid redundant calculations and server requests.  However, according to the HTML5 spec, local storage is unencrypted.

Is there an industry standard for handling user expectations here?  I could imagine prompting users with something like "Do you want to use local storage? It will make everything faster, but if your computer is compromised student data could be stolen.  If this is a public computer, choose 'No.'"

What trends are there for the UX side of this?

Local storage is a relatively new feature available to web applications, but some kind of 'industry standards' or best practices have already appeared. OWASP HTML5 cheat sheet considering your case states that:

  Underlying storage mechanism may vary from one user agent to the next. In other words, any authentication your application requires can be bypassed by a user with local privileges to the machine on which the data is stored. Therefore, it's recommended not to store any sensitive information in local storage.

No matter if the original page is delivered via http: or https:, local access to the machine (or XSS flaw in the website) can extract the information stored in it. So, simply put, you shouldn't put any sensitive / private information.

I'm not aware of any common user confirmation message text concerning confidentiality of local storage, but yours makes it quite clear. But still, I'd recommend against putting sensitive data in localStorage.

Disclaimer: I'm the coauthor of HTML5 cheat sheet.


Is face recognition a good security feature? I found that this guy uploaded some face recognition code with a comment that he'd like to use it "as a security feature". This got me thinking; is face recognition a valid security feature, or is it "cool", but not very effective way to secure something?

No, not really. At least not as primary form of authentication. Biometrics in general are not good for authentication, because:

You leave them all over the place, and there is no way to avoid that.
They cannot be changed in case of a breach.
You need to add a high error tolerance as to not cause usability problems. These tolerances lead to false positives, even without attacks, and make attacks possible.

In practice, when implementing the algorithms, they usually have to
balance between [false acceptance rate] and [false rejection rate].
This makes the efficiency of face recognition the lowest of all
regarding the table. Its security is also lower than other biometric
recognition system, especially compared to fingerprint scan.
— Your
face is NOT your password, Face Authentication ByPassing  Lenovo –
Asus – Toshiba
(2009)

I couldn't find a live demonstration for that paper, but here is one from a 31C3 talk about biometrics, which uses a simple picture, and can bypass required blinking. Here is an article from a person using a video to bypass a blinking requirement.
Here is a more recent paper using more modern approaches:

In this paper, we introduce a novel approach to bypass modern face
authentication systems. More specifically, by leveraging a handful of
pictures of the target user taken from social media, we show how to
create realistic, textured, 3D facial models that undermine the
security of widely used face authentication solutions.
[...]
In our opinion, it is highly unlikely that robust facial authentication
systems will be able to operate using solely web/mobile camera
input.  Given the widespread nature of high-resolution personal online
photos, today’s adversaries have a goldmine of information at their
disposal for synthetically creating fake face data. Moreover, even if
a system is able to robustly de- tect a certain type of attack - be it
using a paper printout, a 3D-printed mask, or our proposed method -
generalizing to all possible attacks will increase the possibility
of false rejections and therefore limit the overall usability of the
system.
— Virtual U: Defeating Face Liveness Detection by  Building
Virtual Models from Your Public Photos (2016)


Do browsers know domains that are supposed to be encrypted? Do browsers have a list with sites that are supposed to be encrypted?
Could a man in the middle attack be performed by presenting a user a http site instead of an https site? That way the server would not need to provide a certificate.
It wouldn't show up as a secure site in the browser but I think most people wouldn't notice it. And it wouldn't warn the user, because there are legitemate sites which don't use https.
Would such an attack be possible or does the browser notice that the site is supposed to use https but doesn't?

The short answer: they know a very limited number.
HTTP Strict Transport Security was introduced to provide better guarantees that a website is being served over HTTPS when specified by the operator.
This works well for websites you have visited recently as your browser will remember their HSTS policy and refuse a plaintext connection.
For example, if you visit your (previous visited from home) bank's website from an untrusted network that happens to have a man in the middle attempting to downgrade the connection to plain HTTP, your browser will refuse to connect because it remembers the website's security policy.
If you have not visited the site previously, the man in the middle needs to not only downgrade the connection security, but also remove the HSTS header (Strict-Transport-Security) from the response. This isn't difficult.
The problem you have identified is the major limitation: what happens if you are the victim of a downgrade attack during the first visit.
One solution browsers have implemented is to package a "pre-loaded HSTS list" of popular websites known to require HTTPS. Obviously this cannot be comprehensive and even with the list, attackers can still setup security downgrade proxies at slightly related DNS names.
You can submit a domain for inclusion in the HSTS Preload List at hstspreload.org.


Would encryption of RAID6 arrays of SSDs be secure? Given the uncertainty about data being left in the clear, I've hesitated to use SSDs where I need full-disk encryption. While some SSDs employ hardware encryption, they're quite expensive, and there is inadequate transparency about implementation.

I've been wondering whether RAID6 arrays of SSDs could be encrypted securely using dm-crypt/LUKS. According to Wikipedia, RAID6 "uses block-level striping with two parity blocks distributed across all member disks". Although some data might be left in the clear on each of the member SSDs, it seems unlikely that those remains could be properly assembled and decrypted. Is that a plausible assumption?

Edit: I would be encrypting the RAID6 volume, containing everything except boot, using dm-crypt/LUKS. The encrypted RAID6 volume is used for LVM2, with volumes for swap, / and home. A small (unencrypted) RAID6 volume contains boot.

Edit: In the cryptsetup FAQ, I see that the key problem with SSDs and dm-crypt/LUKS is that the SSD may move a sector holding key-slots and LUKS header to a pool of discarded sectors, and that these discarded sectors may remain indefinitely before erasure. That could moot disabling a compromised key-slot (passphrase) or making the entire volume unavailable by overwriting the LUKS header with random data.

However, there is apparently no risk of directly leaking encrypted data, because plaintext exists only in RAM. Only encrypted sectors would be discarded (except for key-slots and LUKS header, which obviously are not encrypted).

Edit: Upon reflection, I'm almost back to the original question. Given that key-slots and LUKS header reside on the RAID6 volume, only a stripe of them could remain in discarded sectors on any one member disk. Unless that occurred consistently on N-2 members, which seems unlikely, nothing would be recoverable. Right?

There is no security implemented in RAID6. From what I gather in your question you are suggesting that the arrangement of data across the disks might make it difficult to get meaningful data out, but not at all impossible. If it is a healthy array then it's entirely possible.

The main misconception about encryption on SSDs is that people believe it's impossible to achieve without 'data leakage'. This comes from the fact that, unlike on HDDs, the operating system cannot usually address sectors of the SSD directly for read/writes. This is because firmware on the SSD implements a wear-levelling algorithm which chooses where to really store data based on which flash blocks have or haven't been written to, in an attempt to spread writes to all the flash blocks as evenly as possible (thus prolonging your SSDs MTBF). This is performed regardless of where the OS requests it to go by way of LBA.

Ultimately this means if you choose to encrypt an SSD after it has already had data stored in plain-text on it, you as an outsider to the SSD firmware have no way of ensuring that data stored on the raw flash blocks don't have sensitive information. But if no plaintext data is ever written to the SSD, there can never be a leakage of sensitive information because the SSD never sees plaintext. Therefore it's irrelevant that the wear-levelling algorithm abstracts true data location information, because all the data is secured.

I believe other attacks on SSDs have been written about such as the ability to retrieve data from other VM guests in virtualised environments, but again if the VM container is employing  full-disk encryption (FDE) then without the decryption keys other guests will only see garbage.


Securing Client-Server Architecture with VPN or a SSL-connection? I developed a mobile application that runs on our company's mobile terminals. The mobile application connects to the company servers via GSM network.

We had a meeting to decide how to secure the communication between mobile application and server application. Our security team insists that we must install a VPN application on the mobile terminals, connect to our company network with VPN firstly and then our mobile application should connect to the server via https.

I could not understand their insistence. I think giving VPN rights to every mobile terminal owner is more dangerous than securing a connection with https. As I know, https connection could provide required security between client and server applications which I wrote both of them and they use https for communication.

Is there any security related information that my knowledge is not enough to understand? If I am right , how I could show them that https is enough for security and giving VPN is more dangerous. Any other convincing information is welcome.

The main advantage of a VPN over a simple TLS connection (which HTTPS is) is that the VPN authenticates the client. TLS can do this as well; just use mutual TLS (TLS with client certificates), which nearly all TLS server and client
implementations (including HTTPS servers and clients) support. Create and install a unique client certificate (with a unique private key, and the cert signed by an internal CA) on every mobile terminal, and you can use that to provide the same level of client authentication as a VPN. You can then use the client certs to tell which terminal is connecting, before they even send any HTTP traffic.

Another advantage of a VPN is that it can collect all traffic from the host, not just from one application. However, if you don't care about traffic from other applications (ether because they don't exist or because you don't want them routing through your servers anyhow) and the application itself is well-audited to ensure it never establishes a HTTP connection instead of an HTTPS one, the VPN provides no value in this way.

Other things a VPN can provide:

Client security / health checks... but those can be spoofed anyhow, because it's impossible to write a client that cannot be spoofed (although, for DRM purposes, much effort has been spent on finding ways to make spoofing hard).
Concealing multiple streams of traffic (such as multiple UDP or TCP/HTTPS connections) within one connection. If you care about this, you'll need to use VPN or another tunneled connection, yeah.
Concealing and securing DNS queries, which are otherwise sent in plain text and can be tampered with. Assuming you care about your adversaries being able to tell what DNS requests you're making - which you probably don't; if your VPN tunnel is only used for one thing then that's as good a level of information to an outside actor - this is a risk, but it can be mitigated by just storing the domain name -> IP mapping locally (perhaps in the device's HOSTS file) or by using DNS-over-HTTPS (which is new and may not be supported by your DNS client yet, but is available now through some providers). Alternatively, you can set up (and require) DNSSEC, but that only prevents tampering with the response, not an eavesdropper seeing what site you're requesting.


Opened port leads to a collection listing I've been doing some searching on a macOS server and have noticed that there's an open port that I am able to access outside the network. When I go to this port it will ask for a username and a password, once logged in it provides a Collection listing that looks kinda like the following:

Collection Listing
   Name                   Size   Last Modified      MIME Type
.calendarsystem_version     1   2014-Jun-09 09:51   text/plain
.well-used/                 ?                       (collection)
addressblocks/              ?                       (collection)
user/                       ?                       (collection)
apns                        ?                       text/html
.calendars/                 ?                       (collection)
.directory/                 ?                       (collection, addressbook, directory)
principals/                 ?                       (collection)
timezones                   ?                       text/xml (timezones)
webcal                      ?                       (collection)

My only problem is, I have no idea what this is. It seems to be some sort of listing for development, from what I've gathered with nmap it shows as 8443/tcp open https-alt.

I have two questions regarding this:

What is this port open for/what is it?
Would it be a good idea to close this port?

What is this port open for/what is it?

From Apple's support site TCP and UDP ports used by Apple software products:

  8443  - TCP - iCal service (SSL) -  pcsync-https
    Mac OS X Server v10.5 or later (JBOSS HTTPS in Mac OS X Server 10.4 or earlier)

Thus, it looks like a calender service which explains names like .calendarsystem_version.

  Would it be a good idea to close this port?

This depends if you need this service or not.


Value of authentication between services I am looking to understand the value of having a non-public service require authentication from other services that are part of the same product. Is it for when someone gains access to some other host and then attacks the service?

The benefits are:

If the user is already authenticated, then they seamlessly pass through onto the second system without needing to type in their credentials (i.e., username and password) once again
The user only has to remember a single set of credentials.
The administrator does not need to manage password synchronisation between the two systems.
More secure, because authentication is trust-based using public key cryptography, instead of sharing credentials between systems.


Why does Chrome not allow the modification of these headers by extensions? The Chrome WebRequests API mentions that specific request headers are not available to the onBeforeSendHeaders event, meaning that extensions cannot read and/or modify these headers. Here is an excerpt from the documentation:

The following headers are currently not provided to the onBeforeSendHeaders event. This list is not guaranteed to be complete nor stable.

Authorization
Cache-Control
Connection
Content-Length
Host
If-Modified-Since
If-None-Match
If-Range
Partial-Data
Pragma
Proxy-Authorization
Proxy-Connection
Transfer-Encoding

Is there a security reason to disable extensions from reading or writing these? How could an extension act malicious if it could read/write these values?

Clarification: I am aware why read access to some of these is a bad idea, most prominently any header featuring authentication data. However, other headers such as Host, Connection or Content-Length are a complete enigma to me.
Furthermore, it's unclear to me why some of these headers are completely inaccessible to extensions, instead of allowing setting a value or appending a value, even if read access is not granted.

I agree with the OP that, blocking access to only these headers does not make sense while allowing much broader data in terms of security. A malicious plug-in can do so many damage without them.
From the reading of the API documentation, it sounds like the reason for not allowing access to these headers is not necessarily because of a security concern but more because how current Chrome engine works. It sounds like Chrome's request processing pipeline continues even after the API modifications are done. One aspect of it how Chrome manages network requests and caching. Since those downstream components in the request pipeline can make different decisions and change these headers, I'm guessing that's why it's not even letting you read them b/c it cannot guarantee that they will stay the same.
This is based on how they explained it in the chrome.WebRequest documentation

(*) Note that the web request API presents an abstraction of the
network stack to the extension. Internally, one URL request can be
split into several HTTP requests (for example to fetch individual byte
ranges from a large file) or can be handled by the network stack
without communicating with the network. For this reason, the API does
not provide the final HTTP headers that are sent to the network. For
example, all headers that are related to caching are invisible to the
extension.
The following headers are currently not provided to the
onBeforeSendHeaders event. This list is not guaranteed to be complete
nor stable.
... the header list the OP is questioning ....

If you read further down in the page, it explains the cache issue little more. It sounds to me that Chrome doesn't prefer to expose some parts of the request pipeline (specifically things that affects network communication decisions, including caching) probably for some good technical reasons (maybe it requires a major design change).
Since these hidden part of the pipelines may make different decisions after your plugin modifications are done, Chrome does not let you read them because the downstream pipeline components may still change them. See how it talks about "in-memory cache" being invisible to the API. It sounds like a design challenge on Chrome's part (or a preference not to let a plugin affects its network performance). So I would conclude it's not necessarily because of security.

Caching: Chrome employs two caches — an on-disk cache and a very fast
in-memory cache. The lifetime of an in-memory cache is attached to the
lifetime of a render process, which roughly corresponds to a tab.
Requests that are answered from the in-memory cache are invisible to
the web request API. If a request handler changes its behavior (for
example, the behavior according to which requests are blocked), a
simple page refresh might not respect this changed behavior. To make
sure the behavior change goes through, call handlerBehaviorChanged()
to flush the in-memory cache. But don't do it often; flushing the
cache is a very expensive operation. You don't need to call
handlerBehaviorChanged() after registering or unregistering an event
listener.


Buy Two sub domain SSL Certificates from different SSL providers for same main domain I would like to know, is it possible to buy a sub domain SSL cert from different provider if other sub domains SSL  are already registered with another provider for example GoDaddy. Forexample I have following sub domains from Godaddy
server1.example.com
server2.example.com

Now my server1.example.com SSL is expiring soon and I want to buy this subdoamin SSL from different provider. Is it possible

Yes, there is nothing preventing you from doing that. As long as you can prove you own the site, you can get a certificate from any provider. You can even have multiple valid certificates at the same time, from different providers, for the same domain or subdomain.


Is it possible to search HTTPS messages using homomorphic encryption? We're trying to build a packet sniffer that can search and quarantine malware in encrypted transactions without decrypting said transactions.
At present, we're exploring whether homomorphic encryption schemes can help us look for patterns that match rules (which are also encrypted). We're thinking of creating an on-premise solution that acts as a proxy for an API gateway.
Since HTTPS transmission uses a padded RSA, we believe we need to use re-encryption to make the ciphertext feasible to compute on. However re-encryption requires us to have the secret key and I think sending the secret key to this proxy would be unwise. Is this a valid prognosis if we were to implement it this way? This seems like the only way to achieve what we want and I'm hoping someone here has a better idea.
See Can we proxy-re-encrypt using homomorphic encryption schemes? on Cryptography Stack Exchange.
We're also looking into the paper Practical Techniques for Searches on Encrypted Data.
Other methods have been released since the time that this paper has been published but I usually see something along the lines of homomorphic encryption or MPC. Since throughput is an important metric for us, we're less inclined to go for the MPC route but we're still open to ideas.
Is this possible? Are we headed in the right direction?

HTTPS works over TLS/SSL. The TLS/SSL uses usually RSA + AES. For RSA as well as for AES it is impossible to restore the pre-image, simply said, based on the encrypted message it is impossible to get any information about the contents of the original message, of course except of rough message size.
The paper you refer suggests a new encryption scheme. You could consider using it, if you had plain / unencrypted messages. But the messages are already encrypted with RSA + AES and there is no way to know the original message.
The same with homomorphic encryption. You could consider using it, if the plain messages were encrypted by some homomorphic scheme. But the traffic is already encrypted with RSA + AES and there is no way to know the original message.


Serving "less trusted" content on the same domain Let's say we run a web app at "example.org".  It uses cookies for user authentication.
Our website also has a blog at "example.org/blog", hosted by a third party.  Our load balancer routes all requests to "/blog" (and subpaths) to our blog host's servers.  We don't distrust them, but we'd prefer if security issues with the blog host can't affect our primary web app.
Here are the security concerns I'm aware of, along with possible solutions.

The requests to the blog host will contain our user's cookies.

Solution: Have the load balancer strip cookies before forwarding requests to the blog host.

An XSS on the blog allows the attacker to inject JS and read the cookie.

Solution: Use "HTTP-only" cookies.

An XSS on the blog allows the attacker to inject JS and make an AJAX request to "example.org" with the user's cookies.  Because of the same origin policy, the browser allows the attacker's JS to read the response.

Solution: Have the load balancer add some Content-Security-Policy to the blog responses?  What's the right policy to set?
Solution: Suborigins (link) looks nice, but we can't depend on browser support yet.

Is there a way to safely host the blog on the same domain?

Is there a way do safely host the blog on the same domain?

No. The Same Origin Policy is enforced on the client side. The SOP assumes that all content from the same origin can trust and interact with each other. There is currently no way to reliably fix this assumption on the server side. Note that  CSP is not sufficiently implemented by all relevant browsers.


How can TrueCrypt encrypt a System Drive on a live OS? When setting up whole disk encryption with TrueCrypt, one re-boot is required to test the operation of the TrueCrypt Boot Loader.  After this reboot is when actual encryption of the system takes place.  The encryption process takes place while the Operating System is running (and, indeed, other applications can be used meanwhile as well) and does not require a reboot to complete.

How is this done?  For any other application to do work on system files, it is generally required for the application to have some sort of pre-boot utility (which, by nature, necessitates a reboot) that can perform operations before the Operating System loads and locks the system files.  What is TrueCrypt doing differently, that allows it to bypass this requirement without causing system instability?

All applications (even the OS itself) talks through modules (called drivers) to speak to any piece of hardware, In windows this is called the Hardware Abstraction Layer (or HAL). So any request would be

Software making the request -> Hard Drive API in OS -> HAL for Hard Drive type -> Controller board on Hard Drive -> Bits on physical media.

What TrueCrypt does is it adds a new HAL driver so now the request goes

Software making the request ->  Hard Drive API in OS -> TrueCrypt Encryption driver -> HAL for Hard Drive type -> Controller board on Hard Drive -> Bits on physical media.

So to anything making a request to the hard drive nothing has changed, it sees the same API for talking to the drive, but underneath that layer you added your encryption shim.

The bootloader for TrueCrypt loads the driver when windows or linux first boots and then the OS takes over from there passing the information through the encryption driver.

P.S.

For drives that support hardware based encryption, it uses a sightly different model.

Software making the request -> Hard Drive API in OS -> HAL for Hard Drive Type -> Controller board on Hard drive -> Encryption firmware -> Bits on physical media.


Encryption laws in India -- is it allowed to use ssh and VPN? I have a very similar question to the one asked here (regarding Iran). However, I would like to use ssh and vpn while being in India. I found already this survey of cryptographic laws but I don't understand the implications for ssh and VPN.

Additionally it would be helpful to know whom to ask in the country. Do you think the embassy or a lawyer would know?

Many thanks in advance.

Professor Koops's excellent summary says that ssh and VPN are legal to use and bring into the country, but that you are required to provide your passwords and encryption keys to the authorities if they ask for them.

However, as a general rule, you should trust neither my nor the Professors advice and instead consult a lawyer, in India, who specializes in this area.

(Your lawyer in your own jurisdiction will have ways to find one.)


How To Track Down Who Initiated A Remote File Transfer Via TeamViewer If I Have Log File Walked into my office an hour into a Remote File Transfer initiated by an unknown user.
I disabled it right away and looked through the files they transferred, which include a blank check with my routing and account numbers, my personal CV, and a few other items including my Chrome User Folder (hopefully not any password files they can crack? UGH!)

Anyway I just opened the log.txt and see this:
296361708       11-09-2013 02:35:35 11-09-2013 03:26:42 116 Filetransfer    {9EC3C275-E1A6-4E8A-AF99-25CBE403D89D}

The 296361708 looks like the Teamviewer ID, but what about the numbers within {}, does this give me any identifiable info that can help me track this down?

Since this I've changed my TV password and enabled "Must Approve All Incoming Requests", but I'm concerned about them downloading my Google Chrome Cache and History files... and of course blank checks and my CV... along with a few database files that I was editing on my desktop =/ Not really sure what to do here. Thanks in advance for any insight or advice.

Firstly, if you used the password save function in chrome, your in trouble. Essentially, chrome has no security wrt the password save feature. Immediately change all your passwords! I would recommend also enabling 2-factor authenticaiton on any sites which support it i.e. google, itunes, dropbox etc.

I'm not sure what the number in {} is, the last part might be a MAC address. HOwever, as it is trivial to spoof both MAC addresses and IP addresses, you are unlikely to be able to track down the source. Even if you could, more than likely they are in a different country and trying to do anything legally will be near impossible. Certainly report this to your IT area (if you have one) and you can report the incident to the police, but don't expect much action. They are generally either under resourced or just overwhelmed with such cases to really do much other than record the incident for stats etc (which is important for things like getting more resources).

I would also be rather concerned about how they gained initial access. While you cought them in the act of downloading files, you can't be sure they haven't done other things or for how long they have had access to your system. In general, once a system has been compromised, the best thing to do is re-image it and start with a fresh known good system, though be careful restoring data from any backups you make as you don't know when you were first compromised and you may have backed up compromised files etc.

To be on the safe side, you should also report the incident to your bank. They may be able to put a watch on your accounts or may decide to change your account details etc. As you also lost a copy of your CV, watch out for any signs of identity theft. This could include unusual/unexpected contact from banking and other financial institutions, unknown bank or credit card transactions etc. One reason to report such incidents is to ensure it is on the record in case you run into identity theft issues at a later date.


Is saving a list of passwords in Acrobat XI with 256bit AES encryption as secure as something like KeePass? I would like to just have a single .pdf document that has all of my passwords and sensitive info included, but have it password protected so that I could store it in Dropbox and sync it to multiple computers/phones/etc. If I use the 256bit AES encryption with the latest version of acrobat, is this just as safe as password manager's technology? Is there any reason not to do this?

...is this just as safe as password manager's technology? Is there any reason not to do this?

I've done a little bit of security analysis on the keepass password manager, so I think telling you some of the things they have done to increase security will help you understand why this is a bad idea.

Even after decryption, memory is still protected (in Windows using DPAPI). This means that while your password DB is "decrypted" when you enter your password, all the passwords are still encrypted using DPAPI. This prevents memory scraping attacks where other processes read through their uninitialized memory to try to find interesting information.
When you copy a password from keepass in order to paste it into your browser window, for example, keepass gives you only a certain amount of time before it wipes the clipboard. This makes it harder for other applications to find passwords in the clipboard.
When you enter your master password into keepass, once it has decrypted the DB, it wipes the password from memory to ensure it doesn't leak. We don't really know if PDF viewers do the same.
Password managers do not store decrypted versions of your DB in temporary files, etc. We don't know if PDF viewers do that.

You can sync a password DB from password managers using Dropbox or another file syncing program. So, there really is no benefit to doing things the way you suggest.


HTTP Response to a SAMLResponse POST by user agent Looking at RFC2616, is it acceptable to return an HTTP 200 (page load) as a response to a SAMLResponse post to the SP? i.e. the user-agent loads a page instead of redirecting via a 302 / 303?

Looking for clarity on 3.4.5 here https://www.oasis-open.org/committees/download.php/35387/sstc-saml-bindings-errata-2.0-wd-05-diff.pdf - does the response to a SAMLResponse POST refer to point 2 or 5?

In other words:

The browser sends a request to the IDP.
The response is sent back to the browser - it is a form with an auto-submit to the SP, with a SAMLResponse field.
My browser does a POST of the form to the inbound SAML endpoint at the SP
The SP validates the assertion, authenticating the user, and then sends a 302 redirect back to the browser.

In step 4 above, are there any concerns or issues with the response being a "200" that loads a page? Is this step 5 of the above document, and effectively outside of the SAML flow at this point? Or is this step 2 or 4 that is still within the saml flow and should be maintained as a redirect?

I think you refer to the descriptions like "returned in HTTP Redirect URL to SAML responder, encoded into Location header". This talks about a normal redirect at the HTTP level, which consists of a Location header in the HTTP response header and a status code of 3xx, specifically 301, 302, 307 or 308. There are no semantics defined for a Location header with status code 200.

For more see RFC 7231, 7.1.2 Location and RFC 7231, 6.4 Redirection 3xx.


Are there file downloading programs that calculate checksums during the download process? Calculating checksums for large files, ie tens to hundreds of gigabytes is a lengthy process.

Are there file downloading programs that calculate checksums during the download process? I think some web servers have the ability to include checksum information in the response headers, but can the downloading process verify the information itself, rather than wait for the download to complete?

aria has some partial capability with some kind of files, but are there any with full capability built in?

A very similar question has already been answered on Unix & Linux Stackexchange.

  wget -O - http://example.com/file | tee file | md5sum > file.md5

Just replace the md5sum with sha1sum and it should work. Note that the proposed solution works only with *nix operating systems - getting it to work within Windows might be a challenge (but the Bash Subsystem for Windows or Cygwin might work for you).

Edit:

As I was asked in the comments how this works, I'll explain it here:

wget -O - http://example.com/file downloads the file (in sequential order) and outputs its content on the console. The pipe | allows me to forward this data to the next program: tee file stores the output of wget into the file file and forwards the data to the last program in the chain. md5sum > file.md5 calculates the md5-hash and stores it in file.md5.

Performance: (YMMV!)

Downloading a big file (4GB) from a local server takes roughly 80 seconds
Calculating the hash of the file (when stored locally) takes 70 seconds
Doing both simultaneously takes again 80 seconds, resulting in a speed boost of almost 50%.


My school wants to keep the details of our door authentication system a secret. Is that a good idea? So, I am designing a door authentication system (can't really go into more detail) for our school, so that only authenticated persons can go through a certain internal door. They hold that its inner working should be kept a secret, so that no one can reverse engineer it. I maintain that this would be Security through obscurity, which is bad. I have designed the system such that knowing how it works wouldn't help you get in, only having the key would help you get in, as according to Kerckhoff's principle. They still maintain that instead of more people knowing about it, less should.

Is it a good idea to go with a closed design? If not, exactly why?

P.S. They only told me it was a secret after I had designed most of it and told a bunch of people, if that makes a difference (I had no idea they wanted it to be a secret).
P.P.S. Although it is not open to the outside, the room it is protecting contains more valuable stuff than the rest of the school, so I would expect adversaries to be able to reverse engineer it anyways if we go with a closed design instead of an open one, but I'm not sure how to communicate that.

Obscurity isn't a bad security measure to have in place. Relying upon obscurity, as your sole or most substantial security measure, is more or less a cardinal sin.

Kerckhoff's Principle is perhaps the most oft-cited argument against implementing security through obscurity. However, if the system is already properly secure according to that principle, this is mis-guided.

The principle, paraphrased, says "assume the enemy knows everything about the design of your security systems". This does not in any way imply "tell the enemy everything about your system, because they know anyway".

If the system is already well-designed according to Kerckhoff's Principle, the worst that can be said about applying security through obscurity to it is that it adds little to no value. At the same time, for such a system, there is equally little to no harm in protecting the confidentiality of its design.


Finding Plaintext Password Repositories I came across a file, that was used by our tech support, to store all generic usernames and passwords in them for use with new systems. (Our company has been trained on the use of other Password storage tools, so this isn't a matter of training. The problem is that these files now exist on our network from before the team was trained. Generic accounts are already planned on being phased out as well.)

I noted this to our CISO and we have been trying to come up with a good solution as to how we can identify similar files in our network. We figured that since we have access to AD, we can probably search through all user accounts to find all instances of the first file. The problem is not necessarily what we know, but what we don't know. We want to make sure we find any instances of files used as password repositories. Are there any tools, open source or proprietary, that would accomplish this goal?

There are two approaches I would look into in order to accomplish this. The first is "Cornell Spider", it has the capabilities of looking inside of files for patterns. It's typically used to search for data such as social security numbers, PII, CC data. It is flexible enough that if the sheet you found has any patterns, you can hone in on those patterns and created a regular expression to search for.

An alternative way, is let's suppose that the file you found contains usernames and email addresses. Say: james.smith@mycompany.com You can use Powershell on a Windows machine to find files that contain those strings:

Get-ChildItem  -rec | ?{ findstr.exe
/mprc:. $_.FullName } | select-string
"@mycompany.com"

On a Unix based machines you could do the same thing but 1) it's really ugly, noisy, and long:

find / | xargs grep -i "@mycompany.com" >> /tmp/POSSIBLE-PII.txt

It all boils down to how that file has data structured. There are also commercially available tools that will do similar searches. Had I to tackle this, I would look for a commonality of what was in the file you found (usernames, amount of characters, domains, etc) and create a regular expression to look for files with those commonalities.

The issue with commercial tools, is they will likely be pre-populated with canned searches (SSN, CC, medical codes, etc). You are needing to find specifics. You could loop what you already discovered into another search. E.g., suppose the file you had was named passwordlist.txt you could iterate through every line, and have grep or powershell look for those instances in other files.


"Doxing" users on Social Media I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get.

Suppose the following

A user is posting libel and slander on social media (lets say Twitter for example). The posts may be misleading, propaganda or just downright lying
A user has suspicions and they believe they know who the user may or may not be in real life
The user is not as computer savvy, and most likely not security minded like a professional might be. They are using their home computer or telephone to post the content and are not connecting through proxy's or VPN's

How would you go about trying to prove the persons identity - assuming that the social media website will be of no assistance. There's no real plan of legal recourse...just want to prove that a person that we suspect is posting these things, is actually posting these things. Methods must be legal.

I assume that social engineering will be involved in some capacity - in fact, I would imagine this would almost all be done with social engineering. What I was thinking was trying to entice the user to click on a link pointing to a site owned by me, and linking the logged IP address to that of one sent from an e-mail (or something to that effect). How would you attempt to prove the identity of the poster?

If the user is not security minded then probably the easiest non-instrusive way will surely be to carry out old fashioned detective work. Using websites such as Pipl and google on the username used. From there you can see if the user has used that username in other websites and start to build up a profile based on the information you can gather.

If that username is no good, another way could be crawl through their previous tweets and see if they make any reference to a specific place more than once.

Another way is to see if they have posted any photos and see if they have GPS meta-data still embedded and see if that correlates to the suspected location of your user. As the FBI recently did on an unsuspecting Anonymous member.


How are hardware wallets and other hardware-based security devices audited? One selling point of the Trezor crypto currency wallets is that they are, supposedly, "open source".
It is not clear to me exactly what assurance this provides, since I do not know what relationship exists between the published open source code that I and others can inspect and the behavior of the physical device I have in my hand.
In particular, I can think of at least two possible vulnerabilities:

the software installed in the device is different from the published open-source software;
the device's hardware behaves in some harmful way (maliciously or not) that is independent of what the published open-source software specifies; (for example, how would I know that my Trezor or my YubiKey does not harbor a keylogger?)

My question is: how are hardware-based security peripherals (like hardware wallets, YubiKeys, etc.) audited to guarantee against such problems?
Of course, it goes without saying that if such a security hole ever comes to light would certainly doom the manufacturer's existence, but this consideration has little weight in the short term from the customer's point of view.  (As security becomes stronger, one can expect more and more extreme tactics to subvert it, including ones that would doom a company's existence.)

This is exactly the common problem of root trust in computer science.
You must trust someone/something to behave as advertised. It can be reworded "putting an anchor on trust", from which "trust anchors" are a common concept.
Basically you must trust both that Satoshilab, the maker of Trezor, sends the correct firmware to factory, and that the factory is not voluntarily altering the manufactured device (which is a problem for Satoshilab themselves).
There is no definite answer, as you wouldn't just be easily auditing yourself your own Intel/AMD-based computer. As @schroeder commented, you can ask the very same question about basically every single piece of hardware you buy and every single ISO image of binary software you download, open source fully included.
So external audits come into. An increasing number of companies are relying on trusted third parties to audit their code and their design process, and publish those reports without disclosing industrial/trade secrets. In this context, there is no trade secret in open source, but think about WhatsApp...
About Trezor, the best I could find is the CTO's answer on Reddit to the same question

The code is continuously being reviewed and improved by independent (e.g. Saleem Rashid, Sunny) and semi-independent (Jochen Hoenicke and Christian Reitter) security researchers. Even our competitors are looking at our every move and have sent us some reports and ideas for improvements.

Here is a report from security researcher Saleem Rashid about Extracting TREZOR Secrets from SRAM.
It's the company business to verify that neither firmware nor hardware circuits are altered by the factory.


sqlmap - Testing parameters when reading request from file After hours of trial an error I decided to ask here for some advice.
I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked.
The API states:

Method: GET
/users/>user_id</payments/>payment_token<

>user_id<: [int]
>payment_token<: [string]

Basically using the following command I can obtain information about a users payments:

curl -X GET 'https://123.123.123.123/users/2/payments/38d9f72f-cd26-fghf-a01f-804a9874eb0c' -H 'Authorization: Bearer abcdefghijklmop' -i -k

The token at the end is required for a valid request to perform any of the api requests. So what I did was logging the request by adding the -v at the end of my curl command.
This gave me the following request header:

GET /users/2/payments/38d9f72f-cd26-fghf-a01f-804a9874eb0c HTTP/1.1
Host: 123.123.123.123
User-Agent: curl/7.64.0
Accept: */*
Authorization: Bearer abcdefghijklmop

I want to now check all parameters for vulnerabilities, so I tried to put the request in a txt file and than ran sqlmap like so:

sqlmap -r "/home/user/Documents/Pentesting/Results/header.txt" --risk=3 --level=3 --force-ssl -v 1

However this doesn't find anything. What else can I try? How do I explicitly state that sqlmap should try to inject every parameter?

header.txt looks like so:

GET /users/user_id=*/payments/payment_token=* HTTP/1.1
Host: 123.123.123.123
User-Agent: curl/7.64.0
Accept: */*
Authorization: Bearer abcdefghijklmop

Any advice?

By default sqlmap tests all GET parameters and POST parameters.

Source: https://github.com/sqlmapproject/sqlmap/wiki/Usage (Injection -> Testable Parameters)

It would seem the issue isn't specifying that sqlmap needs to test all parameters.

I would suggest checking what the request headers look like, when you run your last command.

EDIT: I typically don't see variables replaced with asterisk in the file.


Is it safe to send Content-Security-Policy header for text/html content-type only? Is it safe to send Content-Security-Policy for dynamically generated pages with text/html and other hypertext content-types only or do I need to send this header for all files including static assets - images, JS and CSS files?

There are, cases where users can influence MIME type based on different factors. For example, IE can be fooled to render text/plain as text/html within certain circumstances. And, again there are various other MIME types which are rendered and can exfiltrate data. For example, even pdf files can execute JavaScript and so can Flash, SVG, XML or any other plug-in handled content types.

Therefore, it's best to apply CSP using configuration file on all rendered contents.

On a side note, always return correct content type with correct charset attribute along with X-Content-Type-Options: nosniff header.


NTRUEncrypt in TLS and GPG encryption Commonly used cryptosystems like RSA or ECC, on the other hand, will
be broken if and when quantum computers become available. - https://tbuktu.github.io/ntru/

How can we introduce NTRU in GPG and TLS to send NTRU-Encrypted emails and communicate over NTRU encrypted https protocols to be ready for the post-quantum age?
For example, could we just create a public and private keypairs with NTRU like now with SHA in GPG?

Edit: In fact, I really would like to use one of the possible quantum-safe encryption algorythms like Ring-LWE, NTRU or McEliece to encrypt my internet communication instead of continuing using an encryption, that is not PFS and will be decrypted in 20 years anyway.
So can I use any quantum safe algorythm for sending e-mails already?

Easy there cowboy, you've got about 15 years until this is really a problem. You are also making a massive assumption that NTRU is going to be the cryptosystem of choice for a post-quantum age.

NTRU is part of a collection of schemes called "Lattice-based crypto". Still within lattice-based schemes, many people prefer Ring Learning With Errors over NTRU for several reasons. In general, the expert cryptographers of the world agree that lattice-based schemes - as a whole - is a branch of mathematics that we don't understand well enough to trust them with any serious information at the moment.

There are also collections of crypto schemes called "code based" with McEliece being the leading candidate, and isogeny-based techniques, both of which are considered better than NTRU for reasons of security, key size, and speed.

Bottom line: none of the post-quantum algorithms are mature enough yet to be included in anything other than research code (although it wouldn't shock me if GPG included an experimental version at some point). Try again around 2020.

EDIT:

In response to your updated question:

  So can I use any quantum safe algorythm for sending e-mails already?

No, no you cannot. None of these algorithms are considered safe yet; they still need several years of research by basic mathematicians before we decide whether or not to trust them. Then we need to standardize protocols and stuff around them.

I understand that you read something on the internet and now you're on a crusade about it. Trust me, this is moving as fast as it can - in the world of mathematics research, sometimes a theorem takes 200 years to prove - by comparison 5 years for completely redesigning crypto is warp-speed. You'll get your GPG / TLS / Thunderbird plugins by the year 2020. Until then you need to chill out.


Make sure the data came from the server So a web app grabs data from a server with ajax. I'm interested to know whether there is some cryptography wizardy that would make sure the data came from that server. For example, someone can edit their hosts file and use a different server for the domain and pass different data to the web app without modifying it.

I'm thinking on something like this:

Server:
data_to_send // stringified json
integrity_code = getCode(data_to_send); //generates a code from the string.

The server outputs data_to_send and integrity_code

Then the client
if (checkCode(data_to_send, integrity_code))
  //all fine

I'm a total newbie to cryptography, but the idea is to have some secret algorithm on the server which no one can see and public algorithm on the client that determines if data is integral. Can something like that be done?

The simplest solution is to implement TLS encryption and use it when querying the server. TLS traffic between the server and the other server hosting your webapp is going to be encrypted and the authority of the server properly validated. Having SSL/TLS installed however, does not automatically mean your app is using it, you still have to change the endpoint URLs from http:// to https:// in your ajax requests.

Edit: pragmatically I recommend letsencrpyt if using linux, it's no more than 5 minutes to be installed for apache or nginx.


Why do we need to differenciate between External Interactor and a Process? In MS SDL Threat Modeling, there is an External Interactor and Process.
While the meaning clearly shows a difference between them, when threat modeling, one can't really threat model an external interactor as it impossible to enforce anything on it.

So why do we need an external interactor? In case we can analyze its threat and make assumptions and plan solutions for it, why/what is the difference from Process?

We differentiate so that it's easy to know what's in scope of the threat model and what's out of scope.

An external interactor is something that the component(s) we are modeling interact with, but which we do not want to cover in this threat model.  A process in a threat model represents a component (or collection of components) that we do want to cover.  When someone looks at your diagram, they'll very quickly know what's in scope and what's out of scope if you use these two denotations.

For example, if we are modeling a web browser and that browser does DNS lookups, we may not be interested in modeling the DNS server.  As such, we can denote the DNS server as an external interactor.  However, we are interested in the behavior of the web browser, so we denote the browser as a process.

We need external interactors because they provide input to the component that we are modeling.  In the case of the web browser, we are not interested in modeling the web server, but we do need to ensure that the web browser properly handles data received from the DNS server - for example, DNS names with 64 characters in a (sub)domain (between two dots) have historically caused browsers to crash.  If we leave the DNS server out of the diagram, then we are also leaving the inputs from the DNS server into the web browser off the diagram.  In the case where we are modeling a complex server application, and the client application is out of scope, if we leave the client application off the model then we miss the opportunity to discuss authentication and authorization controls around the client-server interaction.

We also need external interactors because they receive output from the component we are modeling.  If we leave the output off the model, then we lose the opportunity to discuss the content of these outputs, and that they are correct.


Is WhatsApp end-to-end encryption applied to images? I know that for text, WhatsApp messages are encrypted in a way no "man in the middle" could read them. But what about images?

Imagine you received some private image on your smartphone. Then you open WhatsApp Web on your PC, which uses an employer VPN.

Would the employer be able to "download" the image your Whatsapp Web just loaded?

According to WhatsApp's official FAQ, yes.

  Privacy and security is in our DNA, which is why we have end-to-end encryption. When end-to-end encrypted, your messages, photos, videos, voice messages, documents, status updates and calls are secured from falling into the wrong hands.

The WhatsApp FAQ

This would make sense since the underlying Signal Protocol does not discriminate between images or plaintext, so there is no technical reason to send images in the clear.

However, once the content is on your PC it's stored in plaintext, so if your employer has any monitoring software installed on your PC (or the PC of the person you're talking to) they can view the messages/images there.

For more information on when/how media sent through WhatsApp can be insecure, check out this investigation by The Verge: https://www.theverge.com/2019/7/15/20692184/whatsapp-telegram-media-files-android-messaging-encryption


Using public keys as universally unique ids When people want a universally unique id, tey usually use uuid or something similar to avoid collisions.

But new systems / protocols such as bitcoin and scuttlebutt use an RSA / AES public key derived from a private key as a unique id for the user or wallet.

What is the chance of a collision if you have billions of accounts?

A Bitcoin ID is an ECC public key using the curve SECP 256K1, which means it is 256 bit long. The question if one of your billion keys ($10^{12}$) collide, is solved by the birthday problem. The probability that a collission occurs is approximately $p(10^12;2^256) = 1-(\frac{2^256-1}{2^256})^{10^12\frac{10^12-1}{2}}$ which is approximately $4 * 10^{-54}$.


Is my Android device infected with a virus? I don't know if my device has a virus, but I will describe the symptoms:

My device suddenly reduces its performance, applications are lagging and reacting slowly while RAM is still free.
When I am googling using the web browser, it displays an error then immediately redirects to the result, or the web browser doesn't return a result altogether.
The ram consumption rises very fast
Many times the audio record folder is written into. Two fake audio files appear there. Those can't be played and their size reached 4GB.
Once, an audio file has been changed to 3gpp format without me doing it.

Are those symptoms related to any known Android virus?

Most likely you have been infected by some sort of malware.
We could talk about all the things that you pointed out, but that won't change the fact that you are most likely infected, and your personal data could be at risk.

My recommendation:

Factory reset your android device and move on. (Don't save anything from your phone at this point, some malware change files with malicious code, so forget about those (pictures, music, any sort of files))


WiFi security against spoofing attacks I am about to install some custom pi cameras that connect to my network via WiFi. I know people hack wifi through spoofing SSID.

My password is randomly generated and is impossible to brute force even without router protection and a supercomputer. Spoofing, on the other hand, could reveal my password. Auto-connect is disabled.

How can I protect my wifi network? Should I use some certificate? Replace my router with a specific secure model?

If you want to be really secure, you can just go with WPA-EAP-TLS RFC5216. You do need a RADIUS server for this, but it's one of the most secure solutions out there. It basically allows you to operate without a password, once you have the certificate setup on your device.


How to decrease the fraud level on SMS verification To prevent fraud, we require the users to link their account to a mobile phone number. We send a code by SMS.
Fraudsters use hacked social networks to convince "friends" to send them the code they will receive.
Even if the message clearly say not to give this message to an other person, they still do:
Verification code mysite.com: 12345 Never communicate this code to someone else!

How do you lower the rate of this issue? Or fight it?
EDIT: We run a classified ad website. We only allow national mobile numbers for account verification. We aggressively block virtual (shared) numbers. So Fraudsters use this technic to be able to validate their account with a legit national number. They use elite proxies so it is not possible to geolocate them precisely.

im not sure you can prevent this using your current mechanics.
one solution has a timer on the code, but this is also easily thwarted depending on the bounty ($$) of that code.

Verification code mysite.com: 12345 Valid for 15 seconds.


How to scan a list of RPM files for publicly declared (CVE) vulnerabilities? Couldn't find a reliable tool to scan a list of CentOS or RHEL RPM files for vulnerabilities (e.g. list CVEs found for each file).

The goal is to scan the RPM files for vulnerabilities before they are installed (well, shipped to our customers along with our software).

I think  you need to be clearer about what you mean by "scan for vulnerabilities".

If you mean search the CVE database on NIST for known CVEs that relate to the specific software that the RPM package delivers, then presumably you just want a script which will take the software name of each RPM and search for it.

If you want something that will try to find the actual flaws in the software that's obviously much harder and probably not viable to be honest.


Worst case scenario for compromised private key in server certificate? Assume that someone gains access to the password used for my key store containing my server certificate and it’s private key.
I guess without direct access to the server running my application the actual private key cannot be extracted?
So as long as no one can ssh or similar to the machine containing the keystore with the private key what is the worst that can happen?

Yes, seems right, unless someone get to your server and reach the private key eventually. Then he may be able to decrypt what cert encrypts.
Good practice is to rotate the passphrase once a while - so change it ASAP.
If you don't know whether the stack was compromised, renew the key and cert completely and scan system for indications of compromise.


How to hack a Win95 machine? While playing with old operating systems, I came across that there are no remote code execution exploits available for Win95 machines, running just file share (no IIS or anything else). Win95 neither has port 445, nor named pipes.

My scenario is that a file share for the whole OS disk is world writeable (empty password is set), and just by uploading/renaming/modifying files through the file share, I want to achieve instant code execution, without the need to restart the OS. So for example adding new entries to autoexec.bat is not a valid solution. I read tricks about replacing windows\rundll32.exe with a custom executable, but it did not work.

Could you please help me out, if there is any way to get instant RCE with these constraints?

I don't think so. You might try and see whether it's possible to exploit MS99-049 through a specially crafted SMB request, but it's a long shot, and anyway, the PC might be patched.

Other possibilities for hacking (not instant RCE) are creating an executable in the hope it will be launched on the remote system (something like StripPoker_Install.exe), or an executable containing a resource exploit against Explorer - again, someone has to open the upload folder on the remote site - or check whether some services are installed after all, e.g. DCOM.

As for the need to restart the OS, an unpatched Windows 95 will do that anyway sooner or later.


SCADA Operating System & Security Exploits So I have a basic question on the SCADA operating system, which the manufacturers do not disclose. From my experience I can see VxWorks running in some of them, and Windows or Linux in some of them.

Is there any classification for a specific operating system used for a specific purpose ?

I would appreciate it if you anyone could offer good input on their awareness of the operating systems they have come across in SCADA systems and possible some insight on the security vulnerabilities and exploits in them.

Is there any classification for a specific operating system used for a specific purpose ?

Yes, although SCADA has not quite arrived yet.

Do-178B is a standard used for qualification of system for aerospace. The FAA requires DO-178B compliance for software and systems on commercial aircraft. It is also typically applied to government and commercial satellites. There are operating systems which are DO-178B compliant: GreenHills Integrity-178B RTOS, Wind River VxWorks Cert Platform, HeartOS DO-178B, SYSGO PikeOS, DDC-I Deos, LynuxWorks LynxOS-178.

Theres is also the European Cooperation for Space Standardisation (ECSS). Although ECSS focus more on the process rather than the product.

NIST has a publication Guide to Industrial Control Systems (ICS) Security which says that Industrial Control Systems use "Differing and possibly proprietary operating systems, often without security capabilities built in"

Here are some highlights of vulnerabilities:

"Some ICS operating systems make setting secure passwords difficult, as the password size is very small and the system allows only group passwords at each level of access, not individual passwords."

"Many ICS protocols transmit messages in clear text across the transmission media, making them susceptible to eavesdropping by adversaries."

"Many ICS protocols have no authentication at any level. Without authentication, there is the potential to replay, modify, or spoof data or to spoof devices such as sensors and user identities."

"SCADA and industrial protocols, such as MODBUS/TCP, EtherNet/IP, and DNP318, are critical for communications to most control devices. Unfortunately, these protocols were designed without security built in and do not typically require any authentication to remotely execute commands on a control device."


Data overflow instead of hiding I was wondering, if instead of using a private way (like browsing incognito or even using TOR), is it a decent idea to use a program that visits as much random websites as possible (with a bandwidth limit setting of course) what makes it impossible for someone to know what websites the user really visited?

I do not think that would help much. Visiting pages randomly (and thus triggering all their ads and trackers) is totally random. Your real browsing, however is not random and follows a pattern - stuff you're interested in, at what times do you open the websites, etc. It would still be easy to tell the signal apart from the noise.

This could work against a small attacker like a site hosting their own ads or a tiny ad network without too much machine nor human time to analyze the data, but given how much money this crappy advertising industry has, the major players like Google and Facebook most likely solved this problem a long time ago.


How can I know that developers will be ethical and not record my password in plaintext I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email.

Couldn't they store their user's passwords in plaintext without the users knowing?

Is there any way for a user to detect/prevent this?

Of course they could, but then they could also just email themselves every time you change your password.

Now, depending on the type of system, there are plenty of regulations, audits, reviews, and processes that might be relevant to ensure that the developers don't do this, or many other types of malicious activity. However, you, as a consumer, usually do not have much insight into any of this - except for when it goes wrong, for example if they email you your original password when you ask to reset it.

But you're asking the wrong question here.
Yes, it is important that whatever systems you use are developed securely, but that will never remove the element of implicit trust you will always have in the system itself - and, in this context, the developers are equivalent to the system itself.

The real question you should be asking - and indeed you seem to be implying this - is how to protect your other accounts, on other systems, from a malicious developer or system.
The answer is simple, really - use a different password for each system.

Allow me to repeat that, for emphasis:

  NEVER REUSE PASSWORDS ON DIFFERENT SYSTEMS.

Create a unique (strong, random, etc) password for each site, and never ever enter your password for SiteA on to SiteB.
Because as you intuitively noted, if SiteB has your password for SiteA in any form, then that password is no longer secure from SiteB.

Just for funsies, here is an xkcd on this:

One last note, if you're starting to worry "How in heck am I going to remember a strong password independently for each different site??!!?" - take a look at this question here on passphrases, and also look into password managers (e.g. Password Safe, Keepass, LastPass, 1Pass, etc).


How can my bank issue a new credit card with the same pin number? I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for another bank account), and he told me it can have the same pin number as the previous card.

Does that mean that my bank, or Visa, is actually storing, or is able to access, pin numbers of every credit card they issue? If so, is a specific method used to ensure the security of this information?

Chip and pin (EMV) credit cards support online PIN verification, which means the PIN has to be stored somewhere (I don't know whether it's at a central location controlled by VISA/MasterCard or at the bank), I assume its hash is stored securely as VISA/MC are usually pretty up to date in terms of security, though it's still very easy to bruteforce a 4-digit PIN even when salted,

Now what I suspect is actually happening is that your bank also keeps the PINs on their side in encrypted format, though it's still reversible and someone working there will have no problems getting it out. Depending on the system on which they're actually stored, getting it out would be logged, but the encryption itself is still reversible.


Is it possible to fake the mail server address? Suppose that I send an E-mail to someone.

Is it possible to fake mail server address - for example, while I used my own local mail server, I send it as if it was sent from Microsoft mail server. (I know that I can fake my mail address - I am asking if it is possible to feign mail server.)

Yes. If you write a program that connects to an SMTP server, you can usually just set To and From variables to anything you want and the server will try to send the email.

Phishing attacks are usually done this way to get you to click on a link to a fake website impersonating a bank, eBay, etc. Email clients like Gmail try to determine the validity of the email (probably by IP/domain of known hosts) and can mark the email as spam.