Cracking passwords via hashcat or rainbow tables. Which is faster? This is more of a theoretical rather than a practical question. To give a bit of background, the discussion at work has come up with what to set our password complexity to and what the logistics would be if a DB was stolen (for this situation lets say I have 1000 passwords in md5).

I've done the following math (no idea if I'm correct)

hashrate (H/s)
GTX 1080ti  43750000000

Size    length              keyspace Total(comb)        build time in days
8       lower               26       2.08827E+11        5.52453E-05
10      lower+upper         52       1.44555E+17        38.24209152
11      lower+upper+numeric 62       5.20366E+19        13766.2859

hashrate(H/s)-https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40
8 gpu cards 3.5E+11

Size    length  keyspace        Total           build time in days
8       lower               26  2.08827E+11     6.90566E-06
10      lower+upper         52  1.44555E+17     4.78026144
11      lower+upper+numeric 62  5.20366E+19     1720.785737

Since hashcat is just brute forcing I can assume that the build time would be the same as my crack time? How can I calculate how long it would take rainbow tables to crack the DB

I can't speak to the precise time needed to generate a rainbow table. But I can address your question more generally.

If:

it's a single hash
it's an unsalted hash format
the password is known to be of sufficiently limited complexity and length, such that an equivalent rainbow table is available
the password is of sufficient time-dependent value to the attacker ("we gotta crack this hash in 20 minutes or the bad guy gets away" scenarios)

... then a rainbow table can be of specific limited value (and even then, it's a gamble).

Otherwise, as soon as either A) you have more than one password to crack, or B) the complexity of the password is not known, the usefulness of rainbow tables drops off rapidly. With a rainbow table, you can only look up one hash at a time, and that lookup takes a significant amount of time. In that amount of time, you can test trillions of potential passwords against millions of hashes with hashcat.

The modern, efficient option is to build an attack plan with hashcat that supplants (and goes far beyond) the equivalent rainbow table - because most unsalted hashes are so fast that you're much better off just using hashcat. Most passwords will fall to an attack using straight dictionaries, dict+rules, combinator/hybrid attacks, masks, etc.

tl;dr: hashcat is much more efficient for most of the common use cases.


Certificate warning when I enable DNSSEC I registered mydomain.net (with Google domain registration server). In the DNS settings on the google control panel, I say that mail.mydomain.net should go to the email cloud app (business.zoho.com in this case, but that's probably not pertinent). I used a CNAME record to do this in the Google domain DNS panel.

mail CNAME 1h business.zoho.com

At first it worked seamlessly, but at some point, I think after I enabled DNSSEC, I started getting a certificate error as obviously mail.mydomain.net doesn't match business.zoho.com. It all points back to DNSSEC being the culprit but I can't be sure. Does this make sense - and what would I need to do (in a general sense) to enable DNSSEC but not get the certificate warning in the browser?

It all points back to DNSSEC being the culprit but I can't be sure.

DNSSec just protects the DNS records against manipulation. The error message instead stems from the certificates subject not matching the domain name used for accessing the system. These two things are unrelated.


Teamviewer Investigations I have a situation where Teamviewer was used to remotely log into a computer and delete files. What are some areas where I can find evidence of file deletion and Teamviewer identity of the intruder?

What do do:

Check C:\Program Files\TeamViewer\ and C:\Users\UserName\AppData\Roaming\TeamViewer for the logs
Click on the tool kit symbol in the upper right corner click on the button Open Logfiles...
Create a support ticket on the TW site and send them the log

Relevant files for investigation:

Connections_incoming.txt - stores details of incoming connection that is established within the client PC. That means connected TeamViewer ID, the computer name from which connection established, time duration, connection type and connection unique ID - which is critical for any investigation.

TeamViewerX_Logfile.log -  stores each and every activity of TeamViewer with timestamps, remote system IP, TeamViewer ID and many other things. This log file is the complete history of all incoming and outgoing connections. Practically, it's everything you would need.

File deletion evidence you will find by comparing deletion timestamp with TW connection timestamp.


An adequate message authentication code for REST My REST service currently uses SCRAM authentication to issue tokens for callers and users.

Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required.  We also will be issuing 'infinite' tokens that have no expiry to simplify integration for individuals (who will use our service for personal use) and in preparation for a JSONP endpoint.

We have the ability to revoke caller privileges (the account to which the token is attached) and ban IPs, as well as impose quotas to any type of request across any time period.

One thing that I haven't implemented, however, is MAC for requests.  As I've thought about it more, for some requests I think this is needed, because otherwise tokens can be stolen and before we identify this and deactivate the associated caller account, some damage could be done to our user accounts.

In many systems the MAC is generated from the body or query string of the request, however this is difficult to implement as I'm using the ASP.Net Web API and don't want to read the body twice.  Equally importantly I want to keep it simple for callers to access the service, and I need to be able to support both desktop/mobile apps as well as web browsers.

So what I'm thinking is to have a MAC key sent to a user on registration, and have them calculate a request MAC on:

the url, possibly minus query string
the verb
the request ip (potentially is a barrier on some mobile devices though and definitely is in javascript)
utc date and time when the client issues the request.

For the last one I would have the client send that string in a request header, of course - and I can use it to decide whether the request is 'fresh'  enough.

My thinking is that whilst this doesn't prevent message body tampering it does prevent using a model request to use as a template for different requests later on by a malicious third party.  I believe only the most aggressive man in the middle attack would be able to subvert this, and I don't think our services offer any information or ability that is valuable enough to warrant that.

The services will use SSL as well, for sensitive stuff.  And if I do this, then I'll be using HMAC-SHA-256 with the key generated using a PRNG.

Does this sound enough? Have I missed anything?

I don't think I'm a beginner when it comes to security, but when working on it I always. am shrouded in doubt, so I appreciate having this community to call upon!

If you use SSL for transport, and do it properly, then any extra MAC is redundant; and, when it comes to it, so is SCRAM. A selling point of SCRAM is that it is supposed to resist situations where SSL is used improperly, i.e. without appropriate server authentication (unfortunately, it happens). But the security argument of SCRAM is rather weak in such a situation, because it will not prevent a man-in-the-middle attack; and, without a MitM, the basic plain-password-within-SSL is already good. The only advantage of SCRAM over a plain password is that in case of a MitM, the attacker does not learn the password right away. He still sees all the exchanged data, and can insert commands of his own, and he obtains enough data to perform an offline dictionary attack, something that very few passwords come through unscathed.

In your proposal for adding a MAC, you do not say where the MAC key comes from. This is critical. A MAC has any value only as long as the key is unknown to the attacker. But if the client and the server already share a key which is unknown to the attacker, why would they even bother with a password and SCRAM ? Let them use Pre-Shared Key TLS, i.e. SSL/TLS with the shared key as basis for mutual authentication and encryption: no certificate at all (so no certificate validation to get wrong), slick and fast operation.

Even better, if the client and server share a password, don't want to use certificates, fear offline dictionary attacks, and don't want the server to store the passwords as is, then the solution is TLS-SRP. Client and server authenticate each other relatively to a common password, the server does not store the password but only a hash-equivalent of it, and the password is safe from offline dictionary attacks, even in case of a MitM attempt (not only is the attempt thwarted, but the attacker does not even gain enough data to "try passwords at home").

The SCRAM designers were probably told about SRP at some point, because they added in section 9 of the specification the following paragraph:

  Authentication mechanisms that protect against this attack are
     available (e.g., the EKE class of mechanisms).  RFC 2945 [RFC2945] is
     an example of such technology.  The WG elected not to use EKE like
     mechanisms as a basis for SCRAM.

They give no justification whatsoever of why they reject PAKE protocols (which they improperly call "EKE", which is only the name of the first known PAKE protocol).


Does it make sense to scan localhost site? I was playing around with wpscan a little while ago. I was wondering if it makes sense to scan a site on your localhost server. I think that it is since there are examples like DVWA, but I imagine it does and doesn't for various other cases.

Would it make sense to do this? If so, when might it not?

I know there are a dozen scanning tools in a Kali, and I've seen the results be quite different about usually important things. Does anyone have any experience with what tools might work best for certain types of applications or known features?

When scanning over a network, the topology between the scanning software and the server you are scanning is very important.

Some tools need to be run on the server you are scanning.

Depending on the type of scan you are doing, some tools will require that you run them on the server you are analyzing. This is usually done in what is called white-box testing. By running the tool on the server, the tool will be able to read the source code of the application. An example of this kind of tool would be the Acunetix WP Security Plugin. This is a plugin that runs within your wordpress application.

Other tools should be run over the network.

You should position your tool so that it can reach your server similar to how your users reach your server. WPScan is this type of tool. For example, if your website is on a private intranet, you should be running your tools from an intranet connected machine.

Should I install wpscan on my wordpress server?

I can't see anything directly wrong with this. You should note that if you have load balancers or web application firewalls then your results from using WPScan locally may be different than if you ran them from another place on the internet. This can be helpful, as you may find vulnerabilities that your WAF may block, but still exist.

If you do have direct access to the server, you should look into white-box security solutions as well. White-box can often be more accurate since analysis can be performed directly on the code and not just on server responses.


How can I allow only authorized browsers to access a website? I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate).

The idea is that the users can only access the webpage in their office's computers (situated in different geographical areas, and they're different companies, so I cannot check IP or install something manually).

I was thinking in some installable private key certificate or something like that.

What choices do I have?

EDIT:

I'm using PHP

There's a very interesting use case in this other answer, using client-side certificates:

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

Another quick-and-dirty option might be implementing a VPN and shifting the domain of the problem from PHP to system administration. This might prove useful if, in the future, you need to give access not only to a website, but also to other resources such as shared folders, etc.


Is crimeware defined by anything other than intent? I'm learning about different types of viruses, and one category of virus is "crimeware." I read the wikipedia page for crimeware, and to me it seems that crimeware is just a specific usage of spyware.

Is there anything different in the design of crimeware that makes it different than spyware? Is there anything a network administrator needs to know specifically to defend against crimeware that isn't included in plain-old spyware?

First things first, you are slightly misusing the term Virus and since you said you wanted to learn I mine as well teach a little extra.

If you imagine types of malicious software as a tree, the very top of the tree (root node) is malware. Basically its the words malicious software gelled into one word. A virus is a form of malware that is defined by the way it re-produces. Viruses are defined as a virus because they can transfer themselves from host to victim in almost anyway including over a USB stick, email, internet, program download etc. and is a very generic term.

  I read the wikipedia page for crimeware, and to me it seems that crimeware is just a specific usage of spyware.

You are correct, what defines crimeware is exclusively the intention the attacker has for creating their malware. For example, a Trojan horse could be crimeware. The Trojan is the delivery mechanism (Hey look at this super cool flashlight app! Wow, so cool. Why does it need Internet permissions and file permissions? Ah don't worry about it.) but the real reason for creating this flashlight app you can only download off a third party website is because it is a Trojan horse delivery mechanism for some crimeware key logger. The flashlight app may contain a key logger that transmits back to a command server it's findings including all the passwords you type in.

This of course would be different than a Trojan horse flashlight app who's end goal it is to encrypt your entire phone's drive and demand ransom (Ransomware).

Crimeware is just a spin-off of Spyware and I imagine (although I have not first hand analyzed examples for comparison) that Spyware and Crimeware are near identical in how they are written, but may be delivered and behave slightly differently as they have different goals. For example, Spyware includes things such as watching people on their webcams whether that be for corporate espionage or for perverted reasons, you choose, both exist.

  Is there anything a network administrator needs to know specifically to defend against Crimeware that isn't included in plain-old spyware?

I would say no, not really. Crimeware is just a more tailored, targeted type of Spyware and the same sort of precautions should protect you. Keep un-needed ports closed, do not download un-trusted files, be careful with phishing emails, avoid putting potentially infected USB's in company computers and keep personal devices off the network.


Security auditing - disabling IP forwarding and ICMP packets redirects I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand auditing in depth.

I got to the part of ICMP packets redirect and had a tough time to understand why exactly should I disable it, same goes for IP forwarding.

What is the exact advantage an attacker may gain by not disabling these features?

Here are the links I read it from:

https://secscan.acron.pl/ubuntu1604/3/2/2

https://secscan.acron.pl/ubuntu1604/3/1/1

Clarification:

for ICMP redirects:

I'm having a hard time understanding how is it possible to alter the system routing tables:

"... bogus ICMP redirect messages to maliciously alter the system routing tables"

for IP forwarding:
How can an attacker exploit this if this were to be enabled?

"...will never be able to forward packets, and therefore, never serve as a router."

ICMP redirects are a "feature" of IP which allows a router to inform a host that there's a more efficient route to a destination and that the host should adjust its routing table accordingly. This might be OK on a trusted LAN, but on the wild Internet, where malice abounds, it may not be such a good idea to alter your routing table at someone else's whim. Nevertheless, ICMP redirects are enabled by default on Linux.

Text extracted from  https://www.agwa.name/blog/post/icmp_redirect_attacks_in_the_wild

About IP forwarding: The idea in disable it, is to avoid after partial control of a host (partial means here without root access) you are not able to use it as router, or masquerade some traffic, bypassing eventually a firewall or network gateway in general


PHP: if charset mismatches (htmlentities UTF-8) viewed by client as ISO-8859-1 (or vice versa) Short Question:

Question: Could any security vulnerabilities arise if a server runs htmlentities as UTF-8 but the client views the results as ISO-8859-1?

Assumption: No vulnerabilities exist when one consistent charset is used

Detailed Question:

Question: Could any security vulnerabilities arise if the server htmlentities a ISO-8859-1 string as UTF-8? (and the client interprets the result as ISO-8859-1?)

(e.g. $results = htmlentities($iso_8859_1_string, ENT_QUOTES, "UTF-8")

Assuming everything is coded in such a way that no vulnerabilities arise when just one character set encoding is consistently used.  (Ignoring if $results = empty string).

Perhaps if $iso_8859_1_string could contain any value, the results would be treated as either invalid UTF-8 (and return ""), or as valid UTF-8. For valid UTF-8, the UTF-8 sequences would be escaped as expected, but how would the results be viewed on the client interpreting the result as ISO-8859-1?  The characters results in the 0 - 127 range being escaped as expected (same as "US-ASCII"), some characters would resolve into html entities and could be displayed as expected. Are there valid UTF-8 characters in the higher 128+ range which do not resolve to html entities?  Would the client just see a bunch of garbled/garbage text/symbols but no characters which would cause the web browser to execute code or switch into a code execution context? (e.g. no tag characters such as '<' '>' symbols)?  (Assuming the $results are put into a "content context", and not in an "attribute value" or a "script" body).

Is this right line of thinking?

Note: I believe I've already worked out the vice versa case (i.e. if the server htmlentities a UTF-8 string as ISO-8859-1 and the client interprets the result as UTF-8)

(e.g. htmlentities($utf8_string, ENT_QUOTES, "ISO-8859-1"))

Answer: My guess is no security vulnerability on the client (for htmlentities as ISO -> client reads as UTF-8) because:

In ISO-8859-1, characters in the range :

0-127 (US-ASCII): are encoded exactly the same way in UTF-8,
160 -> 255 in ISO-8859-1 would all be encoded as HTML entities,
leaving just the 128-159 character range..., but according to Wikipedia's UTF-8 specification, http://en.wikipedia.org/wiki/UTF-8#Description, all UTF-8 bytes that are in the 128+ range are all part of "multi-byte sequences" which comprise a "leading byte" which is always 192 or higher, and "continuation bytes" in the 128+ range.  Thus, the htmlentities($utf8_string, ENT_QUOTES, "ISO-8859-1") could not output any "leading bytes" needed by UTF-8 to generate valid multi-byte sequences. So any characters in this range would appear in UTF-8 as a ? (i.e. an invalid character) due to not seeing any "leading byte".

I think this solves my question for the other direction.

Real-world situation: A PHP 5.3.x server with security backports uses ISO-8859-1 as the default encoding. Starting with PHP 5.4, UTF-8 is the default encoding.  http://php.net/htmlentities. I'm wanting to determining if the code works properly in either an all UTF-8, or all ISO-8859-1 environment, and ensuring there are no automatic security holes caused by encoding mistakes/mismatch.

I feel like I can rest assured that only usability is affected, but not security in these specific cases.

As far as I'm aware, there's no security issue.

The "dangerous" characters in HTML (less-than, greater-than, ampersand, single quote, double quote) all have identical byte values under UTF-8 and ISO-8859-1 (and virtually every other encoding you're likely to encounter, with the exceptions of UTF-16, UTF-32, and EBCDIC).  As a result, escaping them in one encoding will escape them in the other encoding as well.

The reason this holds true is that the vast majority of character encodings, including UTF-8 and ISO-8859-1, are "ASCII plus additional characters", and the structure of an HTML document only uses characters in the ASCII portion of the encoding.


Standards for hiring trusted personnel - American or Canadian Government? Is anyone familiar with an ISO standard outlining the hiring of labour for vendors being hired by DHS or Canadian government? I've found security standards but nothing for hiring practices.

Edit for clarification. Our company will be selling to the public sector for city engineering and emergency services. Since we're providing applications, we'll need to conform to standards for security. We've been able to find standards for software security, but nothing explaining labour practices (minimum pay, background checks, repeated background checks). I estimate it will take some research to find this information so if anyone has previous experience I'd be grateful to hear the insight. Thanks :)

Common Criteria is a system level standard used by both counties (along with many others depending on the accreditation plan) but that does not address your question.  If the issue is related to hiring foreign coders there may be a problem if the project touches International Traffic in Arms Regulations (ITAR) and Export Administration Regulations controls in the US.  This PDF may help http://www.bis.doc.gov/seminarsandtraining/training-modules/essentials_of_export_controls_modules_1_6.pdf   The technology used, if controlled, could present an issue even if the product is not for export as the knowledge is controlled from export as well.


Why do some sites enforce low-security passwords? I get that what comprises a good password is a bit of a moving target and not everyone agrees - just run a password through a number of checkers to see how it is rated differently depending on the criteria.
But a couple of things seem like safe bets and are widely acknowledged - length (as a method of achieving entropy, famously covered here: https://xkcd.com/936/), and size of character set, which doubles the number of possible combinations with each additional character.
So WHY DEAR GOD do some sites insist on limiting passwords to 8-16 characters, and/or disallow special characters? One example is WA state's GoodToGo toll road website, which does both.
This feels like it's one of three things, two of which are bad:

Developers using antiquated frameworks that impose this last-millenium restriction;

Developers still subscribing to the theory that long passwords are bad because they are hard to remember;

Some cutting-edge understanding of password security that makes this an actual best practice that I have just never heard of and can't comprehend.

I'm hoping that this is just fading away, but I keep running into it. We need a public shaming site that lists sites that do this, to force them into adapting reasonable password form practices.

There are a couple reasons:

Legacy software
You may not know, but the vast majority of financial data today are processed on IBM mainframes, running applications written in Cobol and not updated since the last century. IBM already have provided way better security to the mainframes, but as there are still businesses running Windows XP in the desktops, not everyone is using the new functions.

Passwords in the clear
Yes, they exist. Some places store password in the clear, and the password field is something like PASSWORD TEXT(16). This limits the allowed size of the password.

Sanitization of the password
Some developers sanitize the input, and that's good. But not so when the input is a password. If I want my password to be <script>alert('XSS!')</script>, what's the problem? If everything goes right, that value is going to be salted and hashed. But some people think special chars on a password will break their code, so they break your password instead.

Server-side encryption
The above is true here too. Some places encrypt the password with reversible encryption, and no matter how strong is the encryption, it's a terrible idea. Passwords are to be salted and hashed, anything else is wrong. But to prevent special chars breaking something, they disallow them. The 16-char limit is also because of this. If they are using a 128-bit key, the password must fit a 16-byte "packet" to be encrypted.

We need a public shaming site that lists sites that do this

Something like The Plaintext Offenders...


Is there a difference between encryption keys and encryption certificates? Learning about cryptography. Experimenting with attacking the algorithm it's self. My question regards vocabulary basically. Are encryption keys and certificates the same thing or are they different?

If they are the same, good, if not then how are they different?

I'm a newbie to this stuff but I'm pretty sure that I've been supplied with a symmetric AES certificate/key. I don't know what to call it. It's labeled certificate in the given file but my lack of understanding is hurting my research.

Certificates are used to create a Public Key Infrastructure (PKI). Generally the X.509 form of certificates are used, in which case the PKI is called PKIX, after the standard. The private keys that are part of a key pair are used to sign lower level certificates. This way a certificate can be verified by verifying a certificate chain where each certificate is used to verify the one below it.

PKI requires the use of public / private key cryptography, otherwise known as asymmetric cryptography. An example of an asymmetric algorithm is RSA. AES can only be used with a single secret key and is therefore part of symmetric cryptography: the same key is used for encryption / decryption or signature generation / verification. It's unlikely to the extreme that a certificate contains an AES key.

Encryption certificates are certificates that have been designated to perform encryption. This is performed by simply setting a specific key usage flag. So although the public key within the certificate can be used for any task (encryption or verification of signatures over data) the certificate indicates that it should only be used for encryption (or the function of any other flag that is set).

Asymmetric algorithms are however not efficient, so instead a symmetric key is established using the algorithm, e.g. by encrypting (or wrapping) a random symmetric key such as an AES key. This allows efficient encryption / decryption of the data. To decrypt the AES key is unwrapped in (preferably secure) memory and then used to decrypt the actual data. This is probably what you are expected to do: implement a hybrid cryptosystem using e.g. RSA and AES.

For asymmetric cryptography to be used to encrypt something you need to trust that the public key originates from the receiver. Certificates are used to establish the trust for the public key within the certificate.

Note that these are just the basics. If you have to send the ciphertext somewhere then you are trying to establish a secure transport protocol. That's very tricky, so generally you will be instructed to simply use SSL / TLS instead.


Why are we developing both DNS over TLS & DNS over HTTPS? Since both encrypt DNS queries, why are both DNS over TLS & DNS over HTTPS being developed? What does one offer that the other does not, if anything?

As the references for the wiki pages explain, the reason for having the DoH (DNS over HTTPS) protocol is to hide the fact that you are making a DNS query at all, thereby bypassing filters and DNS hijacking.


Setting up a Wordpress blog on another server pointing to a subdomain for security purposes I have an ecommerce site with thousands of customers registered. We wish to set up a Wordpress blog on this ecommerce domain name but wish to host the blog elsewhere for added security.

After reading what happened at Linux Mint, where an insecure blog led to file access on their entire server we hope for a more secure option by splitting where they are hosted.

Our future setup will be
ecommercesite.com - Hosted on server A
blog.ecommercesite.com - Hosted on server B

We will add an A record of blog.ecommercesite.com to point to server B.

Would this setup prevent any potential cross site vulnerabilities should the blog side get hacked?

I'm trying to piece together what you are asking, but it seems to me that you want two web servers (not just virtual hosts), serving different content, both pointed to by names under the same second-level domain name (such as example.com).

That is,

www.example.com points to one server that runs your main ecommerce site, with the web shop and all that, but nothing else
blog.example.com points to another server that runs your blog and nothing else

You can do that. In fact, it isn't even an uncommon setup. If you broaden your horizons to Internet-wide web hosting, it is exactly what's being done all the time. Granted, most often people consolidate their own content on a single server to save on hosting costs and make things easier to manage, but there's no reason why you have to.

The security properties of such a setup, assuming that the servers do not know about each other (though you can link and reference material back and forth between them using plain web links), for each site, will be essentially identical to if you'd had only that one site and the other server didn't exist at all. In other words, someone who finds a vulnerability in your Wordpress setup will, in an ideal world, not be able to leverage that to gain access to your ecommerce site, or the other way around, any more than, say, a security problem on blogger.com allows exploiting a page on wordpress.com.


TrueCrypt dataleaks that might betray the "Deniable File System" option Reading into "Operation Satyagraha", one would have to believe give all the resources used that the investigators had some reason to believe there was data to decrypt, even though in theory and in practice TrueCrypt volumes should offer a "deniable file system".

What are possible sources of TrueCrypt data leaks that might betray the "Deniable File System" option, and what are counter-measures to defeat them?

The article doesn't mention how did the investigators find the presence of truecrypt volume (that could be easily your answer then :) )

One of a couple of ways you can use Truecrypt is by making containers which basically is an encrypted volume, saved as a fixed size file on your disk.
While there are ways to try to detect a truecrypt volume (entropy analysis etc.), I haven't heard of one that can authoritatively detect the volume.

There can be other indications on the drive that could point towards presence of encrypted volume. Trivial examples could be:

Presence of a file (with a .mpg extension?) which doesn't really belong to any known data format
The aforementioned file being of exactly 1GB !! (or of a fixed size equaling to a whole number of MBs, KBs)
Recently opened entries in various softwares/logs indicating paths like P:\video.mpg (or /mnt/t/video.mpg in *nix) where no such fileshare/mount exists at the time of investigating. Or browser logs/cache of pages opened form that Truecrypt mount.
Programs doing auto-saves - saving your data in non encrypted disk cache while you are viewing/editing a file from encrypted volume which is currently mounted.

None of the above conclusively say the presence of a encrypted drive (not even when considered collectively), but they can consolidate your belief if you have reasons to believe that there is any encrypted volume.


Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt I had asked this question in the general forum
I think it is more adequate to place it here.

https://stackoverflow.com/questions/27606232/hydra-from-kali-linux-tamper-http-post-form-syntax-of-the-failure-login-attemp

Here it is the complete description:

I am doing a pentest of an internal  site, I would like to check how secure is this when using Hydra from (Kali) Linux as the password cracking tool.

I have used the mozilla Tamper add on to get the head options ( I think I do not have the correct ones)

What I tried is:
user=tech15 (technical user, users are known)
List of passwords where only ONE is the correct one = fakelist.txt

hydra -l tech15 -P fakelist.txt -vV www.mysite.com http-post-form "/members-login.php=:user^USER^&pass=^PASS^:S="

The string "/auth/ajax-login-frame.php?ajax-login-frame-id=register-or-login-overlay-ajax-login-frame&usernameAttempt=tech15"  is the failure page, when password is not correct
and it tells you  the user has tried to login.

When succesfully login, the page is redirecting to another page.

"/members-login.php" is the webpage

and the tamper just provided me with the following string, where the last part of the user attemt is not written

"/auth/ajax-login-frame.php?ajax-login-frame-id=register-or-login-overlay-ajax-login-frame"

I wonder if the information from tamper I have collected is correct, or I need to look after again.
Could you please help me to understand how to describe properly the syntax for the succesful login.

When executing the commands in hydra all passwords from the list (99 passwords) are valid, which is not correct and only ONE is the valid one.

[80][www-form] host: ip.number.X.XX  login: tech15   password: notcorrect
[STATUS] attack finished for www.mysite.com (waiting for
children to complete tests)
1 of 1 target successfully completed, 99 valid passwords found

Could you please take a look and point me in the proper direction
Is there any documentation for Hydra?

Regards.

New EDIT ---- 22-12-2014 ----

It is still not solved, but I think I have not the correct information

These are the chains I have at the moment.

When Failing

http://www.mysite.com/auth/ajax-login-frame.php?ajax-login-frame-id=register-or-login-overlay-ajax-login-frame&usernameAttempt=tech15

When Succesfull

http://www.mysite.com/auth/ajax-login-success.php?ajax-login-frame-id=register-or-login-overlay-ajax-login-frame

Cookie=PHPSESSID=9c77p1nhj530mpj4apun1mjv71;

But I still get all 99 paswords as valid ones.

Thanks,

Manual:

-v -V: be verbose
-L: user list
-P: password list
-l: username
-p: password
-s: server + port
“1:2:3:4”: 1=page, 2=body content, 3=failure (F=) or success (S=) message, 4: H= headers can be specified (optional). In headers, you do not have to escape the colon.

So, what you should do is add something next to the S= you have there. That something should be a word that appears in the page to which your site is redirecting after successful login (e.g. success, welcome, etc.). Something like this:

  hydra -l tech15 -P fakelist.txt -vV www.mysite.com http-post-form
  "/members-login.php=:user^USER^&pass=^PASS^:S=Welcome"

Of course, if you have a specific failure page (e.g. "login failed"), you could just replace the S= with F= and add "F=failed"


Purpose of TPM "ownership" and "owner password" I have a laptop with TPM 2.0, dual-booting Windows 10 and Linux. By default, Windows automatically takes ownership of the TPM with a throwaway password, but can be configured to store it in the Registry.

However, Linux seems to have access to the TPM even without the owner password – at least, I'm able to successfully seal a LUKS key against some PCRs, unseal it later, and not able to unseal it when the PCRs change, just as expected.

This, and in fact the whole "throwaway owner password" thing by Win10, leaves me confused about what exactly the purpose of an owner password is – what operations require it?

Also: if I have something that is probably the current owner password, how do I check/verify it using Linux TPM 2.0 tools, preferrably without making any changes to the TPM contents? (I have both the IBM and Intel userspace tools installed.)

Simply, 'taking ownership' creates a new Storage Root Key.  The password insures the user doing the 'owning' is the same person again should person wish to perform options associated with the ownership password, in command line mode.  The password is referred to as the 'shared secret' in the TPM docs and is required in the syntax of the command, required if a vendor wishes to conform to the TPM specs, whether it necessary or not in their implementation of TPM.  In Win 7 acommand was, which allows control of bitlocker as well as TPM, which bitlocker depends on:

manage-bde -tpm [-turnon] [-takeownership !Owner Password!] [-computername ] [{-?|/?}] [{-help|-h}]

A problem with TPM implementations is while the standard exist, the implementation by vendors varies and even how the commands behave.  I can only speak from Windows experience, it began with making procedure calls like you are doing now around Win7, to fully automated in Win10 or using less error prone management consoles, like tpm.msc.  When a user is personally present to take ownership, Admin privilege is enough in Win 10 to execute TPM.msc and use the Win10 generated password, that is unknown to the user, as this password is coordinated by various Windows maintenance consoles.  If the user PC is part of a network, its assumed the system Admin is the only one allowed to manage the security features and setting TPM.  If a PC user alters their TPM as a local or even as a system Admin and has trouble later, they simply repeat the whole ownership process; given subsequent keys wrapped it will take a while for the process to complete.  So in toto, in Win10, Admin can perform the tasks needed for ownership without knowing the previous password used for ownership.


Self signed signature in PDF I am asking for a very simple "dumbed-down" answer for a newbie.

Using Adobe Acrobat I can create a self-signed certificate and sign a document as anybody.  I can use anyone's name and anyone's signature image.

So what's the point?  If I can sign as anyone, what value does this add to the document.  Does it prove anything?

Self-signing a document is not meant to prove that you are you or that you wrote it. It provides a way for you and the recipient to be assured that you are using the same file.

In order for this to work, yes, there needs to be some sort of agreement between the parties that they are talking to who they think they are talking to, but assuming that is established, then the parties know that the file is the same.

Have you seen file downloads where they list the MD5 hash of the file? Same idea. By comparing the signature to the trusted, known source reference (the hash, or in this case, the digital cert) the recipient can be assured. For a file, where the source might ultimately not be known, by including a name, then anyone who receives the file knows who to contact to check on its authenticity.


Is it necessary to use PEAP for L2TP/IPsec? This is a sister question of Is EAP-MSCHAP v2 secure?.

Based on my understanding, IPsec should have authenticated the server (we're using PKI) and secured the rest of the protocols before the user authentication takes place, so there's no need to use PEAP (for L2TP/IPsec) right? (I.e. plain MSCHAPv2 should provide adequate protection for the passwords in this case?)

I think you are correct but it would be nice to know for sure. Microsoft KB article (2743314) dealing with MS-CHAP in PPTP-

Unencapsulated MS-CHAP v2 Authentication Could Allow Information Disclosure

Expand Suggested Actions and it says:

  Or, as an alternative to implementing PEAP-MS-CHAP v2 Authentication
  for Microsoft VPNs, use a more secure VPN tunnel

  If the tunnel technology used is flexible, and a password-based
  authentication method is still required, then Microsoft recommends
  using L2TP, IKEv2, or SSTP VPN tunnels in conjunction with MS-CHAP v2
  or EAP-MS-CHAP v2 for authentication.


How do websites prevent certificate forgery? I have recently developed interest about Wireless hacking, and I have seen in many instances in videos and stuff that people are (or more correctly, were) able to perform some kind of MitM attack using evil twin method against big websites like FB, GMail.

There are plenty of tools that automate fake AP creation and include additionally tools like SSLStrip and SSLSplit in order to try to bypass TLS/SSL and HSTS.

As long as I know HSTS to work, the client must have visited the same website at least once. But, this is not a big deal now, cause there is HSTS Preloading from browsers, and all the famous websites are already included there, so even if the client is entered to the website for the first time it still will run HSTS. On the other hand, I believe these websites also use certificate pinning (a concept that I'm not very familiar), which as long as I know means that instead of using the certificate trust chain, they directly specify for which certificate to look, and if the certificate is different just terminate the connection.

On the other hand, I believe the tools that try to bypass these technologies, use the idea that people don't type www.facebook.com, but instead type just facebook.com, so that the tools can redirect the request to let's say wwww.facebook.com, for which it is possible to forge a certificate. But, I believe this is no longer true. But what's preventing the attack from being able to forge the certificate for some nonsense subdomain of the official website, the certificate pinning or HSTS, or both? Also how does HSTS and certificate pinning work together?

The behaviour of HSTS is variable depending on whether the includeSubdomains directive is applied. In the case of HSTS without includeSubDomains, a user visiting www.facebook.com wouldn't protect them if they accidentally went to ww.facebook.com without an explicit HTTPS prefix. However, when the includeSubDomains directive is applied, visiting any subdomain (or the root domain) causes the HSTS rule to be applied across all subdomains. This can also be applied as part of preloading.

Pinning is a separate measure and can be achieved in a number of ways. The main two are preloaded pins in the browser (e.g. Chrome's pinning) and HTTP Public Key Pinning (HPKP). Another less-common way for pinning to be achieved is with a tool such as Microsoft EMET which adds additional pinning rules to the system. The goal of pinning is to store some identifier for the certificate (or its associated signing certificate) so that a false certificate from a compromised (or otherwise lax) certificate authority cannot be used to compromise communications.

In the case of preloaded pinning rules, the public key of the CA's root signing certificate or intermediate signing certificate is stored in the browser and the chain is verified when a certificate is presented for a matching domain. It is extremely rare to see leaf certificates (i.e. the actual specific certificate for the domain, rather than an intermediate or root certificate) in pinning rules due to the difficulty in maintaining this list when dynamic load balancing is in place.

In the case of HPKP, this feature works in a quite similar manner to that of HSTS. When a user visits the site, a header is returned which contains a list of hashes of public keys for valid certificates (either signing certs or the certs themselves). When the user revisits the site at a later date, the browser has cached this HPKP rule and can use it to verify that the newly presented certificate is still valid, and hasn't been spoofed either by self-signing or via a different (potentially compromised) CA. This feature also has the includeSubdomains directive, which can be applied to the HPKP header to state that all subdomains should be considered part of that rule. One additional feature of HPKP over in-browser pinning is that a "backup" signing key must be included as part of the HPKP rule, so that it can be used to update the HPKP rule if the original certificates expire.

With both of these features in place and the includeSubdomains directive applied to both, the following attack methods are mitigated:

Attackers who spoof DNS records to point to their IP cannot provide a self-signed certificate or any certificate with errors; browsers will not allow a click-through when the HSTS rule is in place, and the HPKP rule forces the certificate to match the given signing rules.
An attacker who compromises a CA, or who operates their own generally-trusted CA (e.g. nation states) cannot supplant the original certificate with their own, as HPKP forces a list of trusted CAs to be used.
Users who attempt to directly visit http:// are redirected by their client to https:// automatically; the browser will not communicate over plain HTTP with the server.
Attackers who spoof DNS records to a fake canonical name within the same root domain cannot spoof the certificate for this alternative subdomain; the includeSubdomains directive on each header causes all subdomains to be protected.


How do attacks on web browsers succeed? We all know that attacks on web browsers are entirely possible. This includes attacks such as drive-by downloads, MITB (man-in-the-browser) attacks and keylogger browser plugins/extensions.

However, although we know how these attacks are carried out, the question here is how do these browser attacks succeed in being carried out? Is it due to ignorant browser users? Unverified extensions? etc.

While there are still Drive-by-Downloads attacks which exploit vulnerabilities in the browser itself most of the web-based attacks today are different. This is because Drive-by-Downloads got harder since the major insecure technologies (ActiveX, Java, Flash) got mostly banned and the browsers themselves got more robust against attacks too.

The major attacks today are probably done by tricking the user, i.e. phishing.
There is for example credential phishing done (usually linked from mails or other messages) with look-alike sites or sites which promise import information after login. There are sites for (usually illegal) streaming or download of videos which claim to require some plugin or software update in order to access the content. And there are sites which create windows or popups which look like system error messages in order to trick users into downloading some fake antivirus or call some fake Microsoft hotline or similar.

There are also seemingly innocent browser plugins or extensions which later change the behavior into malicious ones, either because this was intended from start or because the ownership of the extension was transferred to some shady party.  Since extensions are usually updated automatically this attack is based on using the initial trust a user had in the extension for silently adding malicious behavior.

  Is it due to ignorant browser users?

While it would be simple to just blame the users for their ignorance it would not be fair. One cannot expect the average user to have lots of experience with detecting attacks. Most users are unable to properly cope with all the different web sites with different user interfaces and different behavior, sporadic error messages from web sites and from the operating system. They are used to get nagged by the various software they have to install updates before they can continue. All they want is to get things done. And in most cases they can do this by ignoring error messages or choosing the recommended option in a dialog they don't really understand.  The attackers can therefore rightly expect that enough users will do almost anything just to continue, especially if this involves just to click some button or to quickly install some software - since this is what they are trained to do anyway.

Educating users and keeping them alert can only go so far. While this might shift their behavior to be more suspicious this also results in being more suspicious to perfectly benign login prompts, dialogs or update requests, since it is often impossible for the average user (and sometimes for experts too) to properly distinguish good from bad. This therefore usually leads to accept even unexpected behavior in order to proceed since in most cases it is actually innocent.


resource on physical security that calls out doorknobs as being more secure than door handles A manager invited me to try and test the physical security of his office door lock (by non-destructive means, i.e. not ramming the door down).  I found that since the door opened from inside by a handle (which automatically unlocked the lock -- i.e. even if the door was locked, all you had to do was push the handle down from the inside to open it), and since there was a 1/2-inch gap between the bottom of the door and the floor, you could open the door by sliding a coat hanger under the door, rotating the coat hanger in order to loop a piece of wire over the door handle, and then pulling the wire from under the door in order to pull the handle downward.

OK.  But I've never seen any guidelines for physical security which explicitly say that doorknobs are more secure than door handles.  A Google search for
"doorknobs vs door handles security" turns up nothing useful.

Have you ever seen a list of guidelines for physical security that recommends doorknobs over door handles?  It seems like something that would significantly increase physical security of locked doors no cost.  If a list of guidelines doesn't include this, I would consider it incomplete.

(Obviously neither does much good against a smash-and-grab attack, but the coat hanger would be useful in situations such as (a) nobody's watching you, but there are other people on the same floor who would hear you if you smash the door open, or (b) you want to avoid the break-in being detected after the fact.)

I'm not sure that an official report exists, or that one would need to be written. It could be said that a lever is inherently easier to operate and more prone to accidental opening than a knob. Anyone with kids or jumpy pets can tell you that.

Another reason why one might not write a report on the security of the difference is that it might not matter because Accessibility laws might supercede any security considerations. Levers are easier to operate with a closed fist (which is one standard for accessibility).

What is strange to me in your question is that you are asking about a specific feature of that one door handle in which it automatically unlocked when used. That is certainly not a ubiquitous feature of door levers and not confined to levers. Doorknobs can do the same thing. So, in addition to the above points, you have set up a false comparison between the two styles.

You simply cannot state that levers are more or less secure than knobs because your boss' door had an automatic unlock feature. Instead, you would want to determine that a handle with an automatic unlock feature is less secure than a handle without that feature. And I do not think that you need an official report to make that conclusion.


Do I need to change my host OS to something like Tails if I already have Tails running in a VM if I want to be protected on the interenet? First let me say sorry if I sound like a script kitty, because I am. Now on to my question.

So I want to be protected on the internet when I go on the deep web, do banking etc. I use Tails to protect myself since it is a very secure OS.

I use SSL over OpenVpn to connect, and I run that on my VM and that seems to do the job. Currently my host OS is Windows 7 Pro Service Pack 1. Is it a vulnerability to use Windows as my host OS vs Tails (yes I do know that I could get a virus on windows and they could spy on my VM.)

I guess another way to phrase it is could someone hack me, who only sees my VM, and still get to my windows machine?

Also would it be better to use another flavor of Linux, such as Kali? I have it as a vm and it works well, but as stated previously I am a script kitty atm so I am not good at penetration testing.

It's best to create a bootable USB/CD for Tails and not run it through a VM. Tails forces your internet connection through Tor, so if there any vulnerabilities with Tor (exit nodes, etc...) then you will be compromised.

For internet banking and things that require more security, it might be best to install Linux (Debian is a good distro) alongside Windows, create an encrypted Debian volume and use this for tasks that require higher security than your Windows system can offer.

Note: As per Tails Documentation on Virtualization. It is not recommended to run Tails in a VM. Reference: https://tails.boum.org/doc/advanced_topics/virtualization/index.en.html#index1h1


Are all vulnerabilities security related? Are all vulnerabilities security related? When people talk about vulnerabilities and security vulnerabilities, are they the same concept? My understanding is that a vulnerability is the a weakness in the system that allow to have potential attack.

This is one of those "it depends" situations.  Systems are vulnerable to data loss due to power failure or disk drive failure or fire or water damage, for example, and so those could be considered "vulnerabilities" that are not "security related" because they do not result in unauthorized access to data or services or equipment and are not triggered on purpose by someone seeking to cause a denial of service. Then again, if the equipment in question is, say, operating a nuclear power plant, then equipment failure becomes a security problem of a different sort.  So it really depends on what you define as a vulnerability and what you define as security.

I think of security vulnerabilities as things that would allow someone to cause unintended operation of a system (which includes unauthorized access or denial of service).  I think of vulnerabilities in general as anything which would interfere with the proper operation of a service.  So I would say "no", not all vulnerabilities are security related.


What to do when one's server is being scanned very agressively I can see that my application, which is on several virtual instances, is being scanned; I guess the attackers are in "recon mode."

What I know:

I understand that we can block dirbuster, and other scanners in .htaccess,
(However, you could just change the name of the user agent and then this would not be suitable solution anymore)

I have also looked at a WAF, however this would require me to put some new features on hold, and re-work the development plan.

My question:

Is it possible that we could block these scans on a deeper level, so they can't do this? What would you guys do?

You can opt for protection from a scrubbing service by placing your applications behind a packet scrubbing service like Akamai or CloudFlare. These CDN's will take the hit for you normally before it reaches you.


How to sniff [possibly encrypted] TDS protocol data from the host the client application is installed on? Let's say, there is an .NET application on a windows 7 host where I have administrator's access rights.

The application works with remote MS-SQL server which I don't control, it also seems that the application in question uses integrated security to protect its traffic during transmission.
I don't have knowledge on its inner workings (but it's possible to decompile it, it seems, with tools like ILspy), and I don't have any access to network equipment either.

How can I monitor SQL queries it issues?
I presume that wireshark won't show anything as traffic will be encrypted. Is it possible to MiM TDS protocol's connection protected with integrated security in such way, that I will be able to see raw TDS stream? Or may be there are some monitoring tools able to hook into windows's protocol stack just beneath the application OSI's layer, like, before it becomes encrypted for transimition?

The best answer to "How can I monitor SQL queries" is to ask the SQL Server administrator to run Profiler.

However, failing that, on the machine you are a legitimate administrator on, you could run the app and a tool to look at your machine's RAM, the simplest example I know of being a simple Hex editor like HxD.

You can also use that same utility or a tool like Strings from Sysinternals to look for clear text SQL statements in the app's files themselves, wherever those files reside on your system.

Microsoft Message Analyzer can at least decode the TDS handshake.


Server-based PDF Signing using HSM I have some question about server side pdf signing using network-attached hardware security module.
my first question is: what is PDF Signing Certificate?
Certificates are public keys, how a certificate can be used for signing? from https://www.globalsign.eu/pdf-signing/server-based.html:

With the server-based PDF Signing, Certifying and Approving PDFs require a
GlobalSign-issued PDF Signing Certificate, stored and protected
on a Hardware Security Module (HSM), and an automated
digital signature solution to apply the
signatures to the documents.

my second question is about storing private keys: Can user's private keys be generated and stored on the HSM? is non-repudiation guaranteed with this solution?

Here "signature certificate" means "the signature private key and the associated certificate". This is a commonly used shortcut.

Since I did not find any technical details about the product I cannot give a final answer to your second question. But I am confident that the signature key is generated by the HSM and cannot be easily exported outside the device. Note that non-repudiation also depends on the security model of the HSM (who can generate the key? who can use the key? how is the key access controlled? etc)


Nikto giving incoherent results I'm running a scan with Nikto. The command I'm running is pretty simple:

nikto -h 192.168.1.15 -p 5050

It's a Node.js server. But I get a gazillion vulnerabilitites, for instance:

  OSVDB-19947: /apps/web/index.fcgi?servers=&section=alert(document.cookie): Zeus Admin server 4.1r2 is vulnerable to Cross Site Scripting (XSS).

It does not make sense. I even get ASP vulnerabilities! What am I doing wrong with Nikto here?

Here is a screenshot (the log is too long to be posted here):

Is the node server returning HTTP 200 OK for all the requests?
It looks like your scanner is going though a bunch of known vulnerable urls, if you server is returning 200 for these urls (or redirects to 200 pages) this might be the issue.


Is this spin on RSA algorithm possible? My main purpose of this question is that i do not want the receiver to know how to decrpyt the data which I included in the image using steganography. I wanted to use asymmetric type algorithm and not symmetric. Is it possible to create a system like RSA where instead of using public key of receiver to encrypt and private key of receiver to decrypt , I want to encrypt with receiver's public key and decryption is possible only with senders private key.
I am trying accomplish ownership.

I want to encrypt with receiver's public key and decryption is
  possible only with senders private key. I am trying accomplish
  ownership.

In RSA, private and public keys are mathematically tied together. You are mentioning senders private key and recieviers public key. These two are not related to each other and can't be used in a way you described.

What you can do is following (without going into too much details about each specific step):

Generate RSA key par (private and public) for sender and distribute public key to all participants
Generate symmetric key for sender and keep it secret to sender only
Encrypt the data with symmetric algorithm (AES for example) using the key generated in step 2.
Sign the ciphertext you got from step 3. with senders private key
Send signed ciphertext to the receiver
Receiver can verify the ciphertext came from sender by using senders public key to check the signature but cannot decrypt the ciphertext. Only sender has the key to decrypt the ciphertext.
For all subsequent messages go to step 3.

Please note there are many pitfalls in using cryptographic primitives. It's best to do research before you start writing the code. You can start here and here.


URIs in the subjAltName X.509 extension The subjAltTag extension for X.509 certificates can take in domain names, email addresses, URIs, etc.  I was playing around with an X.509 whose subjAltTag had just a URI in it doesn't seem to work.  Here's a screenshot:

The URI in the address bar - at the top - is the same URI in the certificate.  I updated my hosts file to point www.google.com to localhost.  They cert is pretty much google.com's cert resigned.

My question is...  why isn't it working?  Do browsers only support domain names?

The X.509 certificate and its corresponding RSA private key are attached:

-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQCaSBi+M4Gl/qWFOM24QrioNLplsW0MwLH/jDpWdckJIm979pPv/qUt6MUNgq7r
Di87poo6j8Ak726He6Br1bNJoRiTzHtbHqAFVgNp4Cxv5pade8zr4qBX8j9Pl76oq/MB2Yfcg7Rb
N/kblPBlsLwWNfrBt2nLZgn47pccUioNsQIDAQABAoGAFGJgOoktoRQDJJX7wFO4eCj3U8ZchSnU
mtIZRyEq3bUaC8PpifUYN/egSYexusbWAMihTNl/ZqHn9aik6nqCxIqYxgx9grybGOBo36qJzFSC
cszNWeEd1VAi7gJBHSZlSWhOrEHM0faYXh+DRisVTGSnmRsNIltu7Havf5KXua0CQQD9rJRF3lSB
ci3/d5c3Z+S52Lkv1zIvHhsFOYn39LCJVSUv9ufok5d2ktgFlYcVhsdr4La9ks4L8jQeiWQaWqiX
AkEAm7I5foaUX3P71dvaIH2fPXPLMF8h9jcK37YXTkaSeh1waKPUofSDcK2kJq86EZI3HA4bGVk9
QPvzmHGUzAI89wJBAMob0Pqlu+ByjzFmH+W18eccQ9dY9hPSQab1A/a5Tlnsq7c+WeDUjq2bK1+v
lbPR8VsC67W4nE+qRlo6DrZsmrsCQF36V+XdSdXL5miRybnu2Z14NV8/LPq3AqNCABNJWcTH3D/t
E72mH2h2By0qe3x7qzQN96F3UhfVfJW5iT0S5MUCQFhYfOylO4Yi13hpjOQb8M31sCKZUBUJIipP
c/8PFDyfJiTt61ZiMnYgIst5T2ai98S8+XZZwEvxNyu1uiQ2tbI=
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDaDCCAtOgAwIBAgIBCTALBgkqhkiG9w0BAQUwazELMAkGA1UEBgwCVVMxEzARBgNVBAgMCkNh
bGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNVBAoMCkdvb2dsZSBJbmMxGjAY
BgNVBAMMEXd3dy5mcm9zdGplZGkuY29tMB4XDTEyMDMyMTE2MzcyM1oXDTEzMDQyMTE2MzcyM1ow
azELMAkGA1UEBgwCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZp
ZXcxEzARBgNVBAoMCkdvb2dsZSBJbmMxGjAYBgNVBAMMEXd3dy5mcm9zdGplZGkuY29tMIGdMAsG
CSqGSIb3DQEBAQOBjQAwgYkCgYEAmkgYvjOBpf6lhTjNuEK4qDS6ZbFtDMCx/4w6VnXJCSJve/aT
7/6lLejFDYKu6w4vO6aKOo/AJO9uh3uga9WzSaEYk8x7Wx6gBVYDaeAsb+aWnXvM6+KgV/I/T5e+
qKvzAdmH3IO0Wzf5G5TwZbC8FjX6wbdpy2YJ+O6XHFIqDbECAwEAAaOCASAwggEcMAwGA1UdEwEB
/wQCMAAwOQYDVR0fAQEABC8wLTAroCmgJ4YlaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVNH
Q0NBLmNybDArBgNVHSUBAQAEITAfBggrBgEFBQcDAQYIKwYBBQUHAwIGCWCGSAGG+EIEATB1Bggr
BgEFBQcBAQEBAARmMGQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnRoYXd0ZS5jb20wPgYIKwYB
BQUHMAKGMmh0dHA6Ly93d3cudGhhd3RlLmNvbS9yZXBvc2l0b3J5L1RoYXd0ZV9TR0NfQ0EuY3J0
MC0GA1UdEQEBAAQjMCGGH2h0dHBzOi8vd3d3Lmdvb2dsZS5jb20vYXNkZmFzZGYwCwYJKoZIhvcN
AQEFA4GBAEWifm73z2rOJd9Io7egHEFRG+GNpUi+owYnSM07cStlwKg0UXesKxEO9Pud942WqwIt
TJUpYuUWyLupMh7R5ZfbrYsFfohwKqctKZLt/0+Lup2SNHDk79mJ0bsEql7ktMmSCSVE7AHt4j2t
hYm2aSTho/PLcjknV7Ul60csqVXJ
-----END CERTIFICATE-----

Here's the specific errors Firefox is giving me:

The certificate is not trusted because it is self-signed.
The certificate is not valid for any server names.

Any ideas?

When making an HTTPS connection, the rules used to verify the server's identity are still those given in RFC 2818 (Section 3.1):

  If a subjectAltName extension of type dNSName is present, that MUST
  be used as the identity. Otherwise, the (most specific) Common Name
  field in the Subject field of the certificate MUST be used. Although
  the use of the Common Name is existing practice, it is deprecated and
  Certification Authorities are encouraged to use the dNSName instead.

  [...]

  In some cases, the URI is specified as an IP address rather than a
  hostname. In this case, the iPAddress subjectAltName must be present
  in the certificate and must exactly match the IP in the URI.

In your certificate, no Subject Alternative Name (SAN) extension of type DNS (dNSName) is present. Hence, it falls back to the Subject DN's Common Name.

A more recent specification (RFC 6125) harmonises the host name verification procedure across other protocols. However, it is not widely implemented yet.

It allows for the use of URIs, and says this (amongst other things):

  [...] Therefore this
        document discusses Uniform Resource Identifiers [URI] only as a
        way to communicate a DNS domain name (via the URI "host" component
        or its equivalent), not as a way to communicate other aspects of a
        service such as a specific resource (via the URI "path" component)
        or parameters (via the URI "query" component).

Essentially, only the scheme and the host name are really used from that URI. This means it's only more specific than a DNS SAN entry by limiting the usage to a certain protocol (not even the port as far as I can tell from a quick read).

This specification was only finalised about a year ago, which isn't that long. It's not clear how widely it will be adopted. For clarification and harmonisation of existing practises, it's certainly worth the effort, but I guess CAs and implementors would need to know it better and find a demand for issuing certificates with URI SANs, since it doesn't map to the specification previously used (RFC 2818). I guess there would be little demand from service providers, since few clients support it anyway.

Many browsers don't fully implement RFC 2818 as it is (being more lenient on IP addresses in the CN of the Subject Name, without SAN, for example).

(As a side note, from a client-certificate point of view, you may be interested in the WebID project, which explores other ways than PKIX of verifying a client-certificate and make use of URIs in the SAN.)


Reason for writing Self-Decrypting Virus What is the rationale behind writing a self-decrypting virus? By this I mean a virus that has it's payload encrypted, decrypts at runtime and runs it.

How does this protect the virus from antivirus software?

Is it still a viable technique by itself nowadays or can modern anti-virus counter this kind of malware?

It is one of the obfuscation techniques employed by some viruses to mask their presence and avoid detection and facilitate easier spreading (affecting other systems).

Such viruses would encrypt (self-encrypt in case of metamorphic or polymorphic viruses that can mutate with spreading) their payload and as such prevent direct examination, which can result in reduced ability of antivirus software to detect, and/or clean them. They are difficult to detect by fast antivirus detection methods such as checking file signature against virus definitions tables, if the payload moves position within it, effectively changing file signature (metamorphism). Metamorphic viruses don't necessarily use encryption though.

Out of the self-decrypting bunch of the nasties, the hardest to detect are polymorphic viruses, which can change both the encryption scheme (and/or use a random encryption key) for the payload, as well as mutate decryption code itself (the part of the file that is not encrypted and decrypts the payload). Only reliable way to detect such viruses with antivirus software is by deep heuristics, inspecting signatures of smaller chunks of their structure, and/or by running them in a sandbox and inspecting what they actually do. Such scanning techniques are of course compute expensive, disabled by default for speed concerns (and possibly to avoid false positives) on consumer-grade software, and not many users ever enable this on distributions that are actually capable of such advanced detection methods.

So to answer your question, it is still a viable technique as it makes such viruses harder to detect on most systems they might use to spread to others, and increases their survival rate. If you're interested, this page lists most common virus obfuscation techniques.


Is it safe to hide secrets this way? I have n secrets to hide, my goal is to remember only a seed and derive them from the seed. Is this a safe aproach?

Calculate n keys:

k(1) = seed XOR secret(1)
...
k(n) = seed XOR secret(n)

Store these keys in an apllication, asking the user for a seed and compute the secrets using XOR.

The user will get a result even using a wrong seed and he doesn't know if he got the correct secrets.

What are the cons in storing these keys in a place where anyone can possibly look at?

Edit: based on replies and further readings I did something like this:

Use the seed as a password for a PBKDF2 to generate an AES key and IV
Write the secrets in JSON format
Encrypting the JSON text with AES key and IV generated from the seed
Ciphertext is stored inside the application
The seed is used as an input to compute the key and IV at runtime

Any other thought would be appreciated

This is unlikely to be secure for a number of reasons. Primarily XOR is only secure for a one time pad - you are reusing the key (your "seed" is the key here).

If a party knows any individual secret they can calculate the seed - and hence read all others. I.e. secret([known]) XOR [knownValue] yields seed. This entirely defeats the point of having multiple unique secrets - you could just as well use the seed value everywhere as your secret.

  The user will get a result even using a wrong seed and he doesn't know if he got the correct secrets.

Are the plaintext secret values random binary? If not an attacker can just brute force trying seed values then manually reviewing seeds that provide only printable characters for each key. If the secrets are words or phrases this becomes even easier.

Why are you trying to re-invent the wheel? You have basically described an offline password manager with very poor encryption. Why not just use an offline password manager which uses a modern trusted secure encryption scheme?


Advice on password vault software Do you have any recommendation on any password manager, which is used primarily as a vault? I don't need any browser extension, any special functions, just a regular vault with ability to structure passwords in folders and the ability to create multiple accounts with specific permissions to read specific passwords/password folders.

Until now we've been using a password protected Excel file hosted on DropBox and it suits our needs perfectly, but the amount of conflicted copies and not being able to stop some team members from seeing specific passwords forced us for an update.

I've tried Passwork, this looked absolutely perfect, exactly what we need, they have a browser interface and even a mobile app, it is a well structured vault. However, I am not able to verify my account using our e-mails, because as their support said "we are somehow in their blacklist", not to mention I was waiting for their support to answer for more than a week.

Then I've tried Myki, it looks good, but it is more of a real-time manager than a vault. Also, it is primarily a mobile app and every time I need to find some password in my vault I have to authorize my desktop device using my phone. Incredibly annoying.

Do you have any recommendation?

I'm using KeePass. But you wouldn't be able to create multiple accounts with different permissions there. You've mentioned a few online password management tools - I wouldn't trust any online tool to store all my passwords. If you need more then one person to have access and update the passwords database Keepass has a feature to synchronize with a file (in a network folder or in a cloud).


Issues with using a mail server that doesn't support authentication to send mail? I have noticed the mail server we use at work (provided by our web-host) doesn't require any authentication to send mail through.

I understand you easily spoof sender address' in emails, but I'm wondering what the consequences of not having authentication on a SMTP server?

The glaring one I see is that someone could send mail as a staff member or exec through that employees actual account without any kind of spoofing - is this worse than spoofing itself? Or would spoofing get the same reqult and thus there is no point trying to secure the server?

The security consequences of this server to you are likely negligible.  Sending spoofed email is trivial no matter what you do.  Even if you lock down or turn off this server, it will still be simple for anyone to send a spoofed email with a spoofed From: address.  You can't stop it by tightening up this server,  since attackers are free to send their email through any SMTP server you want, and there are too many other open relays in the world to stop this.

The consequences to the rest of the world are that you are arguably contributing, by a tiny amount, to the ease of spam.  You are running an open relay.  Open relays let any spammer send spam with a spoofed From: address.  For these reasons, open relays are considered a bit anti-social and generally frowned upon.

It's a bit like polluting: if you pollute just a little bit, the risk to your own health may be minor, but if everyone did that, our skies would be a horrid haze of pollutants, and everyone would suffer.  Therefore, for everyone's sake, the right thing to do is to avoid running an open relay.

The biggest risk to you is that spam-fighters may detect that your SMTP server is acting as an open relay and blacklist your server as a result.  This could cause email you send to others to be marked as spam by the recipient email system.  For these reasons, you probably don't want to keep your SMTP server available as an open relay.

You can test whether your mail server is configured as an open relay using any number of online testers.

I'm not sure what you mean when you talk about sending an email through this server without any kind of actual spoofing.  I'm not sure what distinction you are drawing.  Connecting to a mail server, pretending to be Alice, and asking it to send email from Alice is exactly spoofing.  In other words, what you're talking about is exactly how email spoofing is done.


Chrome is denying me access to the youtube website and it says incorrect certificate for host I've been trying to access the website of youtube but it keeps denying permission. It says
Incorrect certificate for host.

The server presented a certificate that doesn't match built-in expectations.
These expectations are included for certain, high-security websites in order to protect you.
Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery.

What do i do?

... ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN)

This error is due to a certificate provided by a peer not matching the expected certificate. This is probably due to SSL interception by some middlebox (firewall) or an attacker, which does a man-in-the-middle attack to intercept and decrypt the traffic to the server and re-encrypt it to the client. Since it does not have the private key of the original certificate it needs to use a different certificate for the connection to the client.

Mostly certificates are only checked by building a trusted path to any of the trust anchors (root certificates) built into the browser or OS and by checking that the name of the target matches the names in the certificate. But for important certificates modern browsers have hard coded the expected public key from the certificate. This technique is called Certificate and Public Key Pinning. This way a browser can detect SSL interception, even if a trusted CA certificate is used to re-sign the original certificate.

SSL interception might be used for legal and illegal reasons:

If you are inside a company you work for or in some similar setup, then they might be using SSL interception for security reasons, like scanning encrypted traffic for malware.
If this is the case you should contact your system administrator on how to setup your browser to accept the generated certificates from the interception device.
If you are at home and getting this error somebody might be tampering with the network, maybe by hijacking your router as done in this case. In this case you need to cleanup your network.
If you are at some public hotspot, hotel or similar setup and other requests to web sites work, then somebody might try to attack the network. In this case stay away from further using the network.
Also, there are some countries like Iran which do state-wide traffic control, which sometimes includes SSL interception. This happened in 2011 and was detected by a similar error you got. If you live in such country or travel to it there is not much you can do, except maybe use a VPN which is fully under your own control to route your traffic outside this country. But such VPN might be blocked too.


What does the tilde (~) mean at the end of a file extension? While I was playing some Capture the Flag (CTF), I couldn't solve a challenge because of this tilde ~. I'm playing on www.example.com/index.php but when I added (~) at the end:  www.example.com/index.php~ , a file with name index.php started downloading.

Could you explain to me what's the role of this tilde (~)?

It's just part of the filename, just like letters, numbers, and other special characters can be part of the filename.

It's conventional to create "backups" of files before editing them by appending a tilde, so in case you mess something up, you have a previous version to restore. In Bash this can be easily done with cp index.php{,~} which expands to cp index.php index.php~.

It could be on the CTF because people often forget about those files and leave them unprotected. Especially a file like index.php might contain database credentials.

In bash, a tilde at the start of an argument also expands to a home folder: ~ turns into $HOME (e.g. /home/yourusername), or ~username turns into that user's home folder (e.g. ~root typically expands to /root). That is not the case here, though, because it's not at the beginning.


Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure? I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode.

I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline Root CA if possible.

Given that I've never used a HSM before, and am lacking in concepts on how it's typically used, my efforts to find a "cheaper shortcut" to the same end may result in more pain than it's worth.

Can someone enlighten me on this HSM mode and what general steps are required to make this compatible with a CA, be it Microsoft CA, or any other one that can be acquired.

Technically no, although it depends on what you mean by "secure".

Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, this ensures that even if the host machine is fully hijacked by an attacker and/or the attacker has physical access to the CA machine, then the attacker will not obtain a copy of the private key. At best he will be able to use the HSM to generate arbitrary signatures, but if the HSM is physically recovered then the attacker can know longer use the private key.

YubiHSM does not do RSA or DSA or any other algorithm relevant to asymmetric cryptography. YubiHSM is symmetric only (AES...). Thus, if you used it for a CA private key, then it would have to be along these lines: the RSA private key would be stored encrypted, and the symmetric key stored in the YubiHSM. However, when the private key would have to be used, it would first be loaded and decrypted in the RAM of the host machine, and that machine would then use its CPU to generate the signature.

I am not aware of any existing driver (Windows CSP, PKCS#11 driver...) which would make the necessary glue, but, in any case, it would void much of the interest of using a "HSM" since it, by nature, allows the private key to live outside of the tamper-resistant hardware.

YubiHSM is meant to support things like one-time passwords, not X.509 certificate authorities. A cheap alternative to a full HSM would rather be a smart card: that kind of hardware includes cryptographic accelerators which allow for efficient generation, storage and usage of asymmetric key pairs.


Differences between brute forcing access versus decrypting password files or databases I was just reading about how it's better to use bcrypt to protect passwords instead of saving password hashes in databases, and that got me thinking about other aspects that hackers work on that I had never thought of before. Please correct any part of my questions as I have very basic understandings of cryptography and hacking in general. I'm just looking to learn the general aspects of these types of attacks, for myself.

I understand Coda's point in that salting your password wont save you if the attacker is just brute forcing passwords instead of trying to decrypt your hashes using rainbow tables, so we have two different types of attacks:

The hacker has a password file/database but does not have the code/program, or trying to gain access by brute forcing would cause account or IP blockage. In this case, they'd be forced to try and decrypt the password field of let's say the database. If you saved a hash, then they'd just try comparing the hash field to a rainbow table of different types of hashes of different words, right? What would happen if I stored the Hash of the Hash of the password? Are there rainbow tables for that?
On Coda's article, he mentions that you basically can rent computing power for cracking for cheap. Trying out millions of passwords per second. This would obviously be against a file or database I'm guessing, not a live site (unless they hacked the server, got the website code, removed the account locking mechanism and mounted their own environment, would they even try that?). If they are doing this against a password file, does each hacker write their own program who will craft requests to brute force or decrypt said password source?
When they are trying to brute force decrypt a password file, do they try with every possible encryption/hashing method? Or what is the most average or common way?

Thanks in advance for your responses

If you go through how Rainbow Tables work, I believe you'll be able to answer some of your own questions. Almost all questions that you've asked require a understanding of how they work, what they are and how are they created.

However, I'll try to answer your questions.

  If you saved a hash, then they'd just try comparing the hash field to a rainbow table of different types of hashes of different words, right?

Yes, but not its not that straightforward and its not different types of hashes. Rainbow tables are hash algorithm specific. Essentially they are just a time-space trade off. You still compute hashes when you use rainbow tables - a lot of them. How many do you compute before you crack the password depends on how big (and exhaustive) the rainbow table is.

To explain it in a very simplistic way, a rainbow table gives you hints. Say your password hash is "XYZ", rainbow table requires you to hash 'XYZ' multiple times (can be millions). After each iteration, you are required to check if the resulting hash is present in the rainbow table. If found, it'll will tell you to hash another string (start of that chain) n number of times (where again n can be a in millions) to get the password.

So again, rainbow tables just help you crack faster, they don't make it as easy as just a lookup in a large database (which is in fact one extreme end of rainbow tables, when basically you've just pre-computed hashes of all possible passwords).

  What would happen if I stored the Hash of the Hash of the password? Are there rainbow tables for that?

If you save hash of a hash, it'll be just one single more step in the way passwords are looked up in the tables. However, the attacker has to know that you are storing hash of a hash to be able to crack it.

As a note - people do hash a password multiple times and then save the resultant hash and apply related techniques. However it is not to make it more difficult to use rainbow tables. The basic concepts of rainbow table can still be applied to it.

  This would obviously be against a file or database I'm guessing, not a live site (unless they hacked the server, got the website code, removed the account locking mechanism and mounted their own environment, would they even try that?

Yes, you'd not try password cracking live on a website. The network latency and other factors just make it impossible. Normally all you need is a file of password hashes.

  If they are doing this against a password file, does each hacker write their own program who will craft requests to bruce force or decrypt said password source?

You could write your own program once you understand how the rainbow table is constructed, but normally the rainbow table vendor will give you the program that goes with it.

  When they are trying to brute force decrypt a password file, do they try with every possible encryption/hashing method? Or what is the most average or common way?

You cannot use a MD5 rainbow table for SHA1 hashes. So tables are tied to their hash algorithm. Also, rainbow tables don't work with hashed passwords. When I say don't work, I mean that you cannot use a generic rainbow table to crack a salted password. You can create a rainbow table that will crack all passwords salted with that particular salt but then as you can imagine, you'll need as many rainbow tables as the number of salts - which already defeats the purpose as rainbow tables are expensive to compute.

Also I will not invest my time in cracking a password unless I know the algorithm used to hash it and if there is anything done to obscure the hash. Essentially I am saying that I'd want to see the code used to come up with the hash rather than trying to crack it with random tables and presumptions.


Aren't permanantly logged in accounts inherently insecure? The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these identifiers are generally quite long, isn't it conceivable that an attacker could - forging a cookie - randomly guess identifiers until he got lucky?

On a site with a very large quantity of logged in accounts one would hit eventually

My thoughts on protecting against this are a token with a very large # of possible values, combined with logging each attempt a IP address attempts to autologin with a cookie; any attempt with an invalid token would be considered an attack and that IP address locked out.

Is this overkill? Am I worrying about nothing?

The trick is too make the "eventually" go beyond the predicted lifetime of the Universe. That's pretty easy because of exponentials: just use a long-enough cookie. Each added bit doubles the number of possible cookie values.

For instance, assume that you have 16 billion users (i.e. each human being, including babies, creates two or three accounts). That's about 234 accounts. Use 160-bit cookies (20 bytes, nothing to sweat over for a cookie). That's 2160 possible cookie values, so only one cookie value in every 2126 is linked to an existing account. Now, our attacker is really motivated and will try one billion values per second (that's really big because "trying a cookie value" means connecting to your server, so we assume that your server is sufficiently kick-ass to handle one billion connections per second -- presumably you could afford that, if the whole of Mankind is your customer). One billion is about 230, so the attacker will, on average, need to try for about 296 seconds before hitting a valid cookie value. "296 seconds" is an amount of time also known as "about 2500 billion billion years": that attacker is surely patient and dedicated.

So this is not a problem in practice: a few more bytes and attackers are thwarted by sheer numbers. There is no need to implement lockout features (especially since lockout features can sometimes backfire by hitting honest customers afflicted with any kind of browser bug that you were not aware of, or something bad like that). Of course this assumes that the cookie values are generated with a strong enough Random Number Generator; think CryptGenRandom() on Windows, /dev/urandom on Linux/*BSD/Solaris, java.security.SecureRandom with Java.

(The bit about the lifetime of the Universe is true only if the Big Crunch hypothesis holds true and there is no God [because eternity is kind of long, too]).


Securing a simple webservice against brute-force with mod-security I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a username and password as HTTP GET parameters or as fields of a JSON object given by HTTP POST. The service returns HTTP status code 403 on failed login attempts. I can think of two kinds of attacks to secure against:

Too many failed login attempts from the same IP in a given span of time
Too many failed login attempts for the same username in a given span of time

As far as I understand, mod-security is suitable to detect these attacks an block requests, but the tutorials I found are far to complex and the syntax mod-security puzzles me. Could you provide a sample set of rules to secure against the attacks specified above? In pseudo code I'd say something like the following, with appropriate numbers of n, m, and x:

<LocationMatch /login>
  IF response_status == 403 THEN
    user = fetch_user_from_request
    IF  ++fail_count_per_IP[IP] > n
    OR  ++fail_count_per_USER[USER] > m THEN
       block IP FOR x minutes
</LocationMatch>

There are rate-limiting rule set in ModSecurity CRS that does not directly correlate whether the authentication attempt was successful or not. Following is one of the Rule

SecRule IP:BRUTE_FORCE_COUNTER "@gt %{tx.brute_force_counter_threshold}"
"phase:5,id:'981042',t:none,nolog,pass,t:none,
setvar:ip.brute_force_burst_counter=+1,
expirevar:ip.brute_force_burst_counter=%{tx.brute_force_burst_time_slice},
setvar:!ip.brute_force_counter"

In the above rule we are maintaining a BRUTE_FORCE_COUNTER against some IP which is maintained every IP you can also maintained it against Session. Then we are maintaining a threshold that is number of legal attempts maintained in brute_force_counter_threshold. For every transaction we are increasing counter that is ip.brute_force_burst_counter=+1. After tx.brute_force_burst_time_slice that is time interval after which we refresh the counter


Different certificates for the same website? When I load https://objective-see.com in Safari, it shows me a certificate with CN=objective-see.com. However, when I retrieve the certificate using

echo -e | openssl s_client -connect "objective-see.com:443" 2>/dev/null | awk '/BEGIN CERTIFICATE/, /END CERTIFICATE/ { print }'

I get CN=AlphaSSL CA - SHA256 - G2

Why? Is this a CDN phenomenon?

openssl s_client does not use Server Name Indication (SNI) by default while the browser does. To force SNI use the -servername parameter:

$ openssl s_client -connect objective-see.com:443 -servername objective-see.com |\
  openssl x509 -text
...
Subject: CN=objective-see.com


Importance of Lastpass User Vaults Statement and Two-Factor Authentication The Lastpass breach statement reassures folks who had two-factor authentication enabled and recommends it for all users. I also note that they explain that there is no evidence that the encrypted user vaults were taken and later state as fact they were not taken in that same statement from Monday. The value of two-factor authentication appears to only protect normal online client access to the users' vault via their master password.

My question is: if they are mistaken about the user vaults not being taken then does the two-factor protection not become completely irrelevant?

As LastPass is a proprietary service, giving definitive answers about it can be difficult. I can say that I have seen no documentation that 2-factor authentication (2FA) would protect you from a side door attack where your data is stolen from the server. That said, 2FA does provide added security against an attack via the API.

So, it seems to me that the statement about 2FA is meant to reassure the public and encourage more secure practices rather than provide a strategy to protect against similar LastPass attacks.


How would rw permissions on an Apache directory actually be compromised? I have a directory on an Apache server dedicated to serving images, and I have those images rw for www-data (Apache process runs as www-data).

I've configured it like this, because in the authenticated part of the site (which runs Django), I have buttons with backend code that can change these images as needed.

These images are visible to the world, and are served directly through Apache (and not through Django).

How might an attacker use these permissions to change the images, or otherwise compromise my site if there is no WebdAV, no FTP, and no other SSH users on the server apart from myself?

A few possibilities, ordered by likelyhood:

Your django app may contain weaknesses that allows an attacker to execute arbitrary code as user www-data.
Django itself may contain a weakness that allows for remote code exection.
Apache itself may contain a weakness that allows for remote code execution.

In all three scenearios, an attacker gains access to the file system, or, in case you've chrooted your process, to the part of the filesystem in the chroot jail. An attacker being able to change your images probably isn't the biggest problem (depending on the nature and use of the images, of course). A much more dangerous problem is that he might place other code in your images directory, since www-data probably has write access to the directory. This means that

An attacker can now place arbitrary code and data on your server and
Access that code and data remotely, because it sits under the webroot of your apache server.

These two abilities are very useful for an attacker. He might start mining bitcoins on your server, or use it to send spam e-mails, or make it part of a botnet, or use it to distribute illegal material, and so on.

The image write permissions themselves are harmless in that they can't be exploited to gain access to your server, but they are a problem once an attacker has managed to breach your server, because they give him a place to stand on, so to speak.


What is the purpose of "g" -> generator of the multiplicative group I am currently beginning to studying the different security protocols and came across the SRP secure remote password protocol. I manage to understand the mathematic formulas behind it and the calculation but i do not understand the reason/purpose of using the "g" -> a generator of the multiplicative group.

Why is "g" a static value

why it should be predefined, why not dynamically assigned

why is "g" has the value of 2 in the most implementations i.e. why not 3,4,5,6,7,8,..

what is so important about this parameter that it needs to be included into the calculation,

what is the purpouse of the  generator of the multiplicative group  is there any special relation that i must be aware in the matematics

what happens when g is 1

I have read the wikipedia definition of the Generators  but i still do not understand what is the reason, WHY do we need to use them i.e. what happens when the group Z is cyclic, why is this an advantage or not.

SRP is one of the large collection of algorithms which operate in a cyclic group. A cyclic group consists in elements 1, g, g2_, g3_,... up to some value gr-1 where r is the group order (the smallest non-zero integer such that gr = 1). So g is "static" because it actually is part of the definition of the playground: SRP operates in the cyclic group generated by a given value g, using multiplication modulo a given prime N as group law. Note that both client and server must agree on g and N, and the same g and N must be used for a given user. It is easier for the server if the same g and N, i.e. the same cyclic group, are used for all users; and sharing the same group is not a problem for security.

For cryptographic purposes, we need a group such that discrete logarithm is hard, but computations are easy (these two conditions imply that we need a cyclic group, but just not any cyclic group). This requires that N is big enough, and also that r (the order of g) is such that it is a multiple of a big enough prime (at least 160 bits). SRP recommends that N be chosen as a "safe prime", i.e. N = 2q+1 where q is also a prime integer. If N is a safe prime, then the order of any g in the 2..N-2 range is necessarily q or 2q, hence appropriate.

If you choose g = 1, then you get a cyclic group of order 1 and all your values will be 1; any password will be accepted and there is no security at all. Similarly, if you choose g = N-1, then you get a cyclic group of order 2, which is not substantially better.

However, any value between 2 and N-2 will be good for g (if N is a safe prime). Then, we may as well use g = 2, which is optimal for performance (though the gain is slight when compared with a random g).