Does getting a challenge and response with hostapd-wpe mean that credentials were sent? I setup an access point to perform an "evil twin" attack on an existing WPA2 Enterprise network (I have permission to do this).

I am using hostapd-wpe. Within a short period of enabling the access point my devices see the network and attempt authentication and I receive a challenge and reponse.

When I take the challenge and response and attempt to run a dictionary attack on them I am unsuccessful. Even if I connect to the access point with a password of password or manually add a real password to my wordlist.

With jtr I am using the following:

john --wordlist=/usr/share/wordlists/rockyou.txt.gz hash.txt
john --format=netntlm-naive --wordlist=/usr/share/wordlists/rockyou.txt.gz hash.txt

When I try mschapv2 or netntlmv2 in jtr or hashcat it loads 0 hashes. hashcat provides an error regarding salt-length.

hostapd-wpe indicates that the challenge and response is mschapv2.

Looking for a simple answer but any advice is greatly appreciated. Does getting the challenge and response indicate that these machines just sent their credentials to the evil twin AP, and I am just need to keep working on figuring out how to crack mschapv2? Or does getting a challenge and response not necessarily mean success and I may need to continue working on the evil twin AP?

It seems the answer is yes getting a challenge response indicates the password was sent. My mistake was in cracking the password.

To successfully crack the password I created a new wordlist.txt with a couple of words in it and the actual password. I then used the following in hashcat on a windows OS.

hashcat64 -m 5500 -a 0 DOMAIN\username::::response:challenge wordlist.txt

I believe the mistake was the way in which I added to the word list I had

used echo password >> rockyou.txt

Which does not generate a new line... very simple mistake that cost me a few hours of banging my head against the wall.


What techniques do advanced firewalls use to protect againt DoS/DDoS? It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server application to scale-up very well. Other protection mechanisms is probably used by the firewall. I can think of black-listing IP-addresses, but I don't really know how it works. And there is probably other techniques that are used by the firewall to protect against DDoS attacks.

What techniques do advanced firewalls use to protect againt DoS/DDoS attacks?

My experience of DoS and DDoS attacks is based from being a Cisco engineer for an ISP and later as a Security Manager for a very large Global. Based on this experience, I have found that to effectively deal with large scale and complex attacks requires a good partnership between the organisation under attack and their ISP or DDoS mitigation partner (Yes there are now companies dedicated to this, in essence they are a very large ISP in their own right but use their global network to take on the additional traffic generated during an attack).

Below are some considerations if you face an attack that is outside of your bandwidth tolerance (aka bandwidth consumption) and you need help in responding.

Where no mitigation partner exists:
Establish a strong relationship with your ISP. Identify the right teams and contacts that you will need if there is an attack.

Use your firewall (or other logging device) to obtain evidence of the attack (source IP, protocol, packet length, etc) as this information can be hugely valuable to the ISP in deciding how to respond. It's not fun trying to trap traffic on a Cisco routing device from the command line at three in the morning! So any help is appreciated. :-)

With this your likely approach will be to filter out the traffic within the ISP cloud. If you have been able to provide enough information and the traffic is such then the ISP may well be able to filter out the malicious traffic and leave valid network traffic free to access your network. However if you are causing latency issues for the ISP then they are likely to black-hole your entire route at their BGP gateway and you will disappear from the net. Additional routing filters cause load on gateways, so don't expect your ISP to add multiple filters as this may well impact on their other users.

Using a mitigation partner:

I can only speak from the experience of one provider for this, so you will need to do your homework to decide if you require this and if so who would be best placed to provide.

The service was based upon BGP route advertisement and attack monitoring. Once an attack had been identified the mitigation partner advertises your route to pass through their network, where core routers are used to filter out the malicious traffic prior to passing on to the organisation.

My role in all of this was to test the implementation of a partnered approach to DDoS mitigation. This involved utilising a global team of security engineers to generate enough traffic to make for a valid test. We were testing both the ability to identify an attack and then to respond effectively. Based on this, we were very impressed with their overall approach and the solution worked.


user roles or access levels I am beginning a new project and I already know that I'll have various roles for various users, regardless of their access level. They just have different jobs to do.

With that in mind, I'm thinking that I'll have certain actions that can only be performed by those who have a certain role (like being in a group)

The other method that I thought of would be to assign each user a level number and assign each action a level requirement (probably admin=0 and untrusted = SOMELARGENUMBER).

Is there a reason to prefer one method over the other? (security / maintainability...)

Levels make everything tiered.  You can't have person A have access to one set of functionality and have person B have access to a different set of functionality but not the set A has access to.

Groups can be nested and you could even have levels within the group if you wanted to have a hybrid of the two.  Fundamentally it really depends on your security needs and how you want to approach it though.  Having security levels is far simpler from an implementation standpoint (you just store a number instead of a list of permissions to check against) if you can make it work for your needs, but it is also more limited.


Browser password manager vs third party password manager How usable and secure are 3rd-party password managers like Roboform, Lastpass, and 1password from the built-in Chrome and Mozilla password managers? What are the advantages of using 3rd-party password managers over browser password managers?

The basic features of auto-fill and saving of passwords are available in both kinds (3rd-party and browser) of password managers. Passwords are stored securely and can be synced by both of them. I don't see any considerable advantage of using a third-party password manager. Am I missing something?

There are three main areas of difference.

First, password management is a feature for browser developers, while it is the entire product for the third parties. So typically, the browser managers only offer basic core features. The 3rd parties add lots of useful stuff on top to differentiate their product. For example:

Storing other information apart from web page logins.
More sophisticated password generation features.
Checking sites against lists of breaches and warning you to change your password

Second, because 3rd party managers are not tied to the browser, there are some situations in which they are more flexible. for example:

You can have one password store that works with multiple browsers on your machine
The browser managers typically only use the browser's services for backup and sync. For example, Chrome only uses Google Sync Services, Safari only uses iCloud. If you want to use Dropbox, you have to go third party.
The portable/mobile versions of 3rd party managers will show you the password if required, so you can type it in on a temporary machine without having to configure the browser to sync all your passwords over and then remove them later.

Lastly, third party managers are usually targeted at the security-conscious and so usually better document their security practices and have security as higher on their list of priorities.


How long can X.509 certificate chains be? Usually, I only see certificate chains with a root CA, an intermediate one, and a third one for the particular SSL/TLS website; but can X.509 certificate chains be deeper than 3 levels? Is there a limit to how long they can be? Wouldn't using longer chains that are more interconnected with other root and intermediate CAs help make the chain of trust stronger, more decentralized, and less prone to a single point of failure?

This seems to be the idea behind okTurtles's DNSChain—a decentralized, blockchain-based DNS network that solves the problem of having to rely on a centralized network of CAs; thus, it is resistant to man-in-the-middle (MitM) attacks.

Theoretically, X.509 chains are unlimited in length. The Basic Constraints extension can apply a per-chain limit; this is used mostly for CA that agree to issue a sub-CA certificate but want to constraint that sub-CA to issue only end-entity certificates.

Implementations may have limitations. In fact, with some carefully crafted certificates, one can make a path-building application explore n! potential paths of depth n, and since factorials go up pretty fast, this can lead to huge denial-of-service attacks. Correspondingly, implementations tend to impose a relatively low maximum length (I know I used '8' for my own implementations).

In broad conceptual terms, trusts dilutes pretty fast upon delegation. When a CA issues a certificate to a sub-CA, it not only asserts that the sub-CA public key is owned by that sub-CA, but it also empowers it to perform that kind of verification on behalf of the parent CA. When a CA issues a certificate for an end-entity, it checks its identity; when it issues a certificate to a sub-CA, it also needs to make sure that the sub-CA won't be gullible. With a third level, the CA must ensure that the sub-CA is not gullible and won't issue a certificate to a gullible sub-sub-CA.

So the reflex would be to try to keep chains short rather than long.

Be wary of the "single point of failure" expression. It normally applies to operational continuity. Here, we are talking about security: a single rogue CA compromises security, regardless of how many other paths you create. This goes somehow in reverse with the SPOF rule: you avoid SPOF by adding redundancy, but in the case of certification, any involved CA is by nature able to compromise things -- the more CA you add in the mix, the more vulnerable you get.


How does the Mega-D BotNet send spam? I have just been reading an report that analyzed the Mega-D Botnet, but what I haven't fully understood is how they are used to send spam?

What email address is the mail sent from?
Does each bot send the spam through an SMTP server?
Does each bot have an SMTP server installed on it?

Can any one clear this up for me as no article that I have read seemed to shed any light on this.

From what I could find out about it in a few minutes of googling, Mega-D/Ozdok is a pretty typical smabot: It implements the STMP protocol internally and do handles retries to work around greylisting.

The email address used in the "from" part of the mail depends on the exact template that was sent to the bot. If you look at the fortigate description of the bot, you'll see what options could be used to built it and some samples. It doesn't seem to be using anything from the bot client's machine but it seems to often use the recipient's email in the from field (which means you can protect against these spam using SPF or DKIM).

The bots WILL send their mail through a SMTP server but that will be the recipient's SMTP server: what is referenced in the MX DNS record of their mail domain (or the A record if there is no MX but there is an A).

If you want an analogy to the real world, it's as if, instead of sending (regular) mail to your home through the postal system the spammer hired a lot of strangers to deliver it directly into your home's mail box.

As for whether each spambot has a SMTP server installed, the closer to an answer is: no, there is no SMTP server installed on the client that will accept and relay mail. However, it will accept spam templates from the CC servers as well as "job lists" containing the target email address and then act as a SMTP client to send these mails directly to the recipient's SMTP server.


Burpsuite: just passthrough firefox detect portal When I enable Burpsuite's Proxy I continiously get http GET requests for firefox's detectportal as seen in the following image:

How I can configure it to somehow just pass though theese requests silently and just load the target url?

I tried theese settings on Proxy's "options" tab with no desired result (just passing though the firefox's detectportal):

Disable Captive portal from firefox as seen in this link.

In order to do that open a new tab and type about:config, then search for network.captive-portal-service.enabled and set it as false then you are good to go.


Is XRY Forensic Tool able to extract data from iPhones? As far as I know this only DOESN'T work with iPhone 4S and iPad2 / iPad 3, because of the fixed Boot Rom. So, is it no longer possible to brute-force the passcode lock? Can anybody confirm this with some sources? Or does this tool do a jailbreak and make a disk image to extract the data?

Product:
http://www.msab.com/xry/smartphones

As far as I know you're correct.  For confirmation I had a look at their release notes here and on the second to last page at the bottom left it lists the iOS physical support and has a foot note which states (iPhone 3GS, 4 CDMA, 4 GSM, iPod touch 3G and 4 and iPad 1 are supported.)

From that I'd guess that iPhone 4S/iPad 2/iPad 3 are out of reach due to a lack of a current public DFU mode exploit.


Is sending personal information over email between different providers secure? For example, if I use Gmail, and use my Gmail account to send personal information, which I don't want others to see except the intended recipient, to a Hotmail account, both in the body as well as an attachment (PDF format), then who can intercept and read this information? Is it encrypted? I know the body and attachment are encrypted by TLS between my laptop and Google's servers, but what about when it is stored on Google's servers in my Gmail account? What about in transit between Gmail and Hotmail server? And all the routers and computers in between the two servers that form part of the many nodes of the Internet? What about once it is actually on the Hotmail server? What are Google and Microsoft's policies? What is standard industry policy?

Thank you!

Mail servers generally encrypt traffic between themselves. Gmail will actually warn you (albeit quietly) when you are sending mail to a server that doesn't support in-transit encryption. Here's what that looks like:

Note the little red lock icon on the right. If you mouse over it, you will be offered a link to this Google Support page, where you can learn more.

To answer your questions individually:

Google and Microsoft (and thus anyone who has a bug on their servers) can read your email. Their policies prevent any human actor from actually doing so, though their advertising bots will automatically read it. They could also be instructed to turn it over to law enforcement.
Yes, email data is encrypted when at rest, at least on Gmail and Hotmail servers.
It will be encrypted in transit between Gmail and Hotmail servers. So any snooping network switches between them will only see encrypted data.
Google's Policy. Microsoft Policy. There are many industry standards; I recommend starting by looking at the ISO 27000 series. The ISO 27017 and 27018 are specifically about cloud security and privacy (respectively).


Good resources on ACH/banking details security? In our web application, we allow customers to enter their bank account information as a method of payment (account number, routing number, bank name). This information goes nowhere at all; it's up to the client to process such payments using a separate system.

What, if anything, should we be doing to secure this data? And where could I be looking to find information about this sort of thing?

PCI doesn't have anything to do with banking information, and may not be applicable depending on your hosting situation. PA-DSS deals with web applications.

I would very seriously consider the risks involved in this, compared to the monetary benefit you derive as a result of accepting and storing this information. A data breach of this information may expose you to a great deal of risk and expense. For example over 30 states have their own beach notification laws, and timelines for how long you have to contact the state attorney general, customers, etc. You may have only a day or two in many cases and the legal fees alone would be very expensive.

Beyond that, you are often responsible to notify all affected customers in most of these states by mail. Many companies end up purchasing/providing free credit monitoring and you may be sued by banks or individuals whose accounts are compromised in order to cover actual losses, including actual funds and bank resources. You may face additional, personal liability if you don't follow industry best practice, which typically would include code and pen test review of all releases and updates, annual audits, encryption, file integrity monitoring, web application firewall usage, SIEM, IDS/IPS, and the list goes on.

This is not all to scare you, but to convey the seriousness of the undertaking. If you are determined to store banking-related PII I would strongly consider consulting a lawyer or an experienced banking industry IT security professional. At the very least, I would talk to a few of the larger banks in your area and ask what they would require if you were operating a service like this for one of their business clients.

Disclaimer: I'm not a lawyer, views and thoughts are mine and mine only, etc, etc.


What differentiates a CA cert from a server cert? From what I can gather, as long as a client trusts a particular CA root, and a server produces a valid chain that leads up to it, the client will trust the server's cert. This only makes sense if the root is saying not only "this intermediate cert is who they claim to be," but "this intermediate cert is allowed to issue new certs on my behalf." Otherwise anyone (with a cert signed by a widely-trusted root) could act as a widely-trusted CA themselves.
As best I can tell, any cert can be used to issue further certs. So the intermediate CA is special not in that it's able to issue further certs, but in that it's explicitly trusted by the root CA to do so.
I guess my question is: what is it about the intermediate (CA) cert that indicates this? Is there a field that says "I am a valid CA" (that of course the root has to sign)? Are there other differences between CA certs and server certs?

Whether or not a certificate can be used to sign another certificate is defined by the basic constraints field of the certificate. When you submit a CSR to a CA, the certificate returned by the CA should specify that the certificate cannot be used to sign other certificates in the basic constraints field.
Otherwise, this would open the door to anyone being able to create a fake certificate for any site. For example, I could create a CSR for mysite.com, get the certificate signed by a CA like VeriSign, then create a CSR for www.paypal.com and use the certificate for mysite.com to sign the certificate for www.paypal.com. Then, I would have a valid certificate for www.paypal.com. But, I'm not paypal.com.
Notwithstanding, many early SSL implementations in early browsers and even some early versions of OpenSSL did not check the basic constraints field of the certificates in a certificate chain, so this was a vulnerability that could be exploited. Security researcher Moxie Marlenspike was active in bringing this to the public's attention which forced browser makers to fix this. See http://www.thoughtcrime.org/ie-ssl-chain.txt here for more info.


What are the risk associated with granting full permission (Any) to DB Admin users to the Database? Usually in a well controlled environment, Database Admins are granted specific rights like Read, Modify...etc. No one has the right (ANY) to perform on any Database. Certain requirements dictate to give some users (ANY) permission to the Database they work on.

Q: What are the risk associated with the kind of permission given that all logs are maintained and reviewed on a regular bases and granting this kind of permission is well controlled?

It always comes down to the same thing, the principle of least privilege.

Why would you want to give anyone more permissions than necessary to perform his or her job efficiently? It's just unnecessary risk. Sure, you may have logs in place to track all the actions taken by a particular administrator, but who is going to monitor those logs? How will logs help you if a rouge admin steals your confidential data or drop your production database in the middle of the day? Sure, you can track who did what but the damage has already been done.


What will happen to decrypt a tampered message encrypted by a symmetric key There is a message M, it's encrypted by a symmetric key like Y=E(K,M). The message is sent to B from A. During the transportation of message M, if the message is tampered by C, then when B received the message and decrypted the message, what results will happen?

B decrypts the message properly but get a wrong plain text;
B cannot decrypt the message properly.

If the result is (1), even if the key is only known by A and B, B cannot confirm that the message is sent from A only by the key.

Depending on the encryption mode you would either get a slightly changed message, or a very changed message.  Encryption's job is to provide confidentiality.  This is the guarantee that C can't read/generate arbitrary messages sent between A & B.  What you are talking about is message integrity.  This would be the guarantee to B that the message he is reading is the same (unchanged) as the original author wrote it.  A final piece in the puzzle is authenticity.  This would be the guarantee that the message B is reading actually came from A.

See this answer for more info.


Are there lists of most common words or ngrams used in passwords and passphrases? I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are more common in passwords and passphrases than in general text.

In combinatorial dictionary attacks it seems to make sense to check more combinations using high frequency words (or ngrams) than the rest of the dictionary.

I gather there are lists of the most common passwords out there but are there also lists of most common words or ngrams known to be used in passwords and passphrases?

Oh, there are a few places that show the most common passwords as determined through website breaches. Some examples:

http://blogs.wsj.com/digits/2010/12/13/the-top-50-gawker-media-passwords/
http://www.whatsmypass.com/the-top-500-worst-passwords-of-all-time
http://blog.jimmyr.com/Password_analysis_of_databases_that_were_hacked_28_2009.php

No matter where you look, it seems that 123456 is the password to beat. For all those above and more, start with http://www.google.com/search?q=list+of+most+common+passwords


AWS Elastic GPU Compute vs WPA2 Looking at cracking a WPA/WPA2 handshake predetermined at 8 Characters long only. This means that there are: 208,827,064,576 possible combinations.

Looking at toms hardware page and Rockfish Sec shows you should be able to get over ~42000 H/s per GPU (potentially better).

Assuming you can get up to 8 GPU's per EC2 instance (I could not find out what the maximum is or what the GPU spec is on AWS) you  could enable up to 336000 H/s.

With 8 GPUs
208827064576/336000 = 621509 H/s
621509 / 60 = 10358 minutes (duration)
10358 / 60 = 172 hours (duration)
172 / 24 = 7.1 days (duration)

With 1 GPUs
208827064576/42000 = 4972072 H/s
4972072 / 60 = 82867 minutes (duration)
82867 / 60 = 1381 hours (duration)
1381 / 24 = 57 days (duration)

Please check my logic here as I have not done any of this in practice.
According to amazon  the cost of $0.400/hour for eg1.2xlarge. I am unable to figure out from AWS documentation what the compute power is with EC2 Elastic GPU.

So assuming $0.04/hour *8 (assuming 8 GPU) it would cost $550 or with 1 GPU it would cost $552.

I am looking at review of cost vs GPU/CPU compute power for brute force attacks.

So my question is two part one... can you double check my thinking and two if anyone can clarify the aws/gpu performance vs cost element.

I believe you have an error.
Each password key is not derived by applying a function that is based on a single hash in wp/wpa2 but rather several rounds of PBKDF2 (4096) each resulting to several hash invocations.

Therefore I believe the costs should be higher.


Can rootkits hide their internet usage from resource-manager and third party software in windows 10? If so, how? Lets say I have the latest windows 10 version. I also have DU meter for checking my network usage

I know that in windows there is a linked list of processes that many rootkits tend to remove themselves from to hide from the task manager. I'm not sure if this is still possible in Windows 10, or even if it is possible, will it make third party software not show the internet usage or not.

So I have two questions:

What are the methods that can be used to remove the internet usage from third party software and resource managers on Windows 10?
Is there anyway I can be sure that when there is no upload showing in my DU meter and resource manager then it means that there is actually no upload happening?

The resource manager or third party monitoring tools are software running on the computer. They could have vulnerabilities which a knowledgeable attacker could exploit with a malware in order to manipulate their output.

Besides malware acting on the computer it is possible that an attacker modified the source code of the monitoring tool or replaced its executable file in the repository and you installed already modified malicious software that will not report certain network activity.

So, it is impossible to guarantee that the numbers reported by resource manager or a monitoring tool are correct.

It is very likely that they are correct, providing that:

Your system is up to date,
You have an anti-virus software running,
You installed the monitoring tool from a trusted source (and verified its digital signature or a checksum posted on its Web site)

  Is there anyway I can be sure that when there is no upload showing in
  my DU meter and resource manager then it means that there is actually
  no upload happening?

Monitoring network activity by another device outside of your computer (a router, a proxy server, etc) could give you better assurance that the monitoring information is correct.


How to reliably identify a certificate as root certificate in a chain Assume you have a certificate (X509 v3) chain sent to you for validation. The chain sent to you may or may not include the root CA certificate. Is there a reliable way to find out whether this is the case?

Quite obviously only the certificate at the top of the hierarchy may be the root CA certificate, but how would I check this? I came up with a check for equality between issuer and subject, and this seems to work fine for all cases I found so far, but I'm not sure whether is foolproof.

Edit: This is not about a manual check or about which tool to use, it's about a programmatic check. So using openSSl to perform checks (as suggested in a 'possible duplicate' claim) is not an option. The question is which certificate attributes or extensions I can use in which fashion to reliably identify a root CA certificate in a given chain.

To make the question even more to the point: I suggested to check whether subject==issuer right from the beginning. The question is whether this is a foolproof approach. So is it possible to rely on the fact that this is true if and only if it is a root certificate? What happens if I create a root certificate and a derived intermediate CA certificate and, in the latter, just choose the subject equal to the issuer? Will that result in a valid certificate? (The authority key identifier may well correctly point to the key identifier of the root CA).

(Note that I did not ask how to check whether I should trust the chain. I want to know how to reliably identify a root CA certificate in a chain).

Simply check if Issuer and Subject fields for equality. If they are equal, the certificate is self-signed and represents root certificate. Otherwise, the certificate is intermediate certificate. Of course, public key in the root certificate must validate its own signature.

Edit to follow up OP edit:

  The question is which certificate attributes or extensions I can use in which fashion to reliably identify a root CA certificate in a given chain.

you must check that isCA attribute of Basic Constraints certificate extension is set to True in all CA certificates. And this extension SHALL be marked critical.

  What happens if I create a root certificate and a derived intermediate CA certificate and, in the latter, just choose the subject equal to the issuer?

there are two outcomes:

  The authority key identifier may well correctly point to the key identifier of the root CA

you will create a loop in the chain which is detected by most certificate chaining engines. Otherwise, the certificate will not be a part of your chain with root and intermediate certificate.


What flaws lie behind HttpContext.Current object i .NET? I'm into extend a authenticating service and like to ask about the security perspective of  HttpContext.Current. Let say you have a authentication serve websites / wcf and such (where http is applicable). HttpContext.Current are used to store the session and other info in the Items array, no need passing credentials around throughout the session.

How safe are HttpContext and can it be misused and exploit security flaws? There are a a lot of posts and blogs that talk about "don't put session or System.Web into your business layers". Some just state "don't let the user know about your business layer". What would the user know and where are the border for a "business layer"? I.e. a business layer is solely a ground for web sites.

Where are the danger those folks predicate for and what can be done by a user that want to break the authentication? Are there "too easy" to develope bugs that make the system behave unexpected or give more access then mentioned?

"don't put session or System.Web into your business layers"

The primary reason for this is because it completely makes unit testing a nightmare. Your business layer is supposed to be completely separate from your web layer, you should be able to take that BLL and put it into a desktop app and have it run fine.

Being as HttpContext.Current is a collection of objects (Request, Response, Session, etc.) and they each have their own sources (Request headers, Response buffer, Session tied to ASP.NET Session ID cookie) that there isn't one universal answer for just the HttpContext.

However, Sessions do have some inherent issues, hijacking and session fixation is one of them, mainly caused by the inability to rotate session IDs on log-in, Micrsoft has declined to fix this, and you'll need to implement security around that (say, Webforms encryption of your session ID on log in is one example I briefly looked into (you'll want to research it more), or as we use, an authentication cookie that is tied to your session that is HTTPS only and rotates when required).

As for items like User and Identity, those depend on your authentication methods, usually handled by Webforms, but if you use a custom one again, security is up to you to use standard practices.


What are the technical implementation differences between signature-based scanning and heuristic-based scanning? Signature-based scanning works by comparing something to a database. So does this basically amount to scanning a file x for string foobar?

I know heuristic-based scanning can detect new threats that aren't in a database yet. How does it do this? Does it use regular expressions, for example scans files for foo*bar where * is a regular expression operator?

I've also heard that heuristic-based scanning looks at the behavior of a file, but this sounds like something entirely different such as emulation or sandboxing.

Also how do heuristics apply to IDS and Firewalls canning network traffic?

Heuristic scanner (for a file) can look/do for various things, including:

sandboxing the application and analyse the behaviour (which files are created/deleled/modified, ...)
looking for hooks to functions (direct disk writing, TCP socket binding, ...)
strings like filenames (read/write of system files, ...)
memory residence ability
decryption of the program at launch
decompiled machine code analysis

The detection of one or multiple of these elements can point toward a possible threat. A program which is resident and modifies the hosts file, is very likely to be ill-intended.

As for network based analysis, I am not very familiar of it. But I'd say, if there is a machine dedicated to this, it would be possible to run analysis of captured file and/or reported files.

(possible interest in Rethinking Antivirus: Executable Analysis in the Network Cloud)


Why is HTTPS security allowed in most countries I have heard of some countries not allowing some type of encryption for data transfer along web applications, because the key length is too high (or other reasons), aka: "Datagram"...

Now, for HTTPS, I know that it uses RSA (with certificate, etc.) to initialize the connection, then AES-128/256 for payload transfer.

If it is allowed among most government policies (USA, Europe, ...), then does that mean that it is weak enough for specialized attackers to decrypt the data ?

How long would it take for an expert hacker to find the key ?

In addition to @Petris's answer.

In addition, here are a few reasons why government security services don't object too loudly to HTTPS:

They need to use it themselves
The cost to the country of not using secure comms for commerce would be immense
It is often just as easy to attack an end point than it is intercept the comms elsewhere.

In some countries, points 1 & 2 may carry less weight. 1 because they can do what they like without having to worry too much about public opinion. 2 because they centrally control the economy.

As it happens, point 3 is interesting partly because it shows the level of insecurity in modern systems. But even beyond the technology, much of spycraft has always been about manipulating people.

Even so, you will see repeated attempts by the US government (there is one happening right now) to try and add "secure" back-doors to encryption products. There are still far too many - mainly politicians but some spy managers too - who believe that it is possible for technology to create something secure in general use but with a back door that only a limited set of authorised people can access. This is rubbish of course as has been demonstrated time and again. Even if it weren't, who is in control of "authorisation" - obviously that cannot work properly, especially when only 1 country with some seriously vested interests is in charge.

If you are interested in this topic, the website Techdirt often has interesting articles.

In regard to your specific questions:

If it is allowed among most government policies (USA, Europe, ...), then does that mean that it is weak enough for specialized attackers to decrypt the data ?

There is no such thing as perfect security. Well implemented HTTPS is pretty secure but it is hard to implement it properly and easy to get wrong. If attackers cannot get in, they will go round. Realistically, you can only make security too expensive and/or time-consuming to bother with breaking, if someone really wants in, they are likely to eventually do so.

Of course, if you can slow down an attacker long enough then the value to them generally goes away. But even that is not totally a given. The NSA and others have been gathering a lot of information for a long time. They are probably forced to eventually throw most away due to the cost of storage but information encrypted a few years ago that couldn't easily then be broken can most certainly be now if the desire is there.
How long would it take for an expert hacker to find the key ?

There are other sources for this information, it depends on the implementation but plenty of research is available that will show you how long it takes to break specific implementations.

Once again though, don't forget that going through a different route (e.g. malware or other hacks on the end points) may well be a lot quicker than trying to directly crack HTTPS.

You should also do a search on "HTTPS vulnerabilities" which will highlight the many and ever changing issues with HTTPS that, in many cases, mean that attackers don't need to brute-force their way into it.


Most secure way to partition linux? I recently acquired a netbook to play with, and I want to install Kali Linux so I can start learning about network security and exploit development. I want to use this to learn as much about security as I can.

What is the best way to partition a linux box so that it is most resistent to a security risk? Is a single partition containing all of the folders in linux really that bad?

Extra points if you can go into details about the threats possible. I want to learn as much as possible.

Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you're working with, the information being protected, how the information is used within the organization, and the threats. Based on those answers, and possibly others, you can begin to determine which of the tenants are most important and what to focus on.

At the filesystem level you're typically most interested in Integrity and Availability. The Confidentiality of the information should probably be handled at a different layer, but how you lay our your filesystems and how you use them should make sure that the information is both trustworthy and is always available when it's needed.

One thing to keep in mind when laying out your partitions are failure modes. Typically that question is of the form: "What happens when partition x fills up?"

What happens if your partition storing the OS is full? Strange things sometimes happen when / fills up. Sometimes the system hangs. Sometimes no new login sessions can occur. Sometimes the system refuses to boot.

Of all the failure modes this one is the hardest to strictly characterize as its symptoms are the most likely to change based on OS, kernel version, configuration, etc. Some filesystems, particularly the ext line, reserve a certain amount of space when the filesystem is created. This reseved space can only be used by the root user and is intended to allow the systems administrator to still operate and clean out space.

What happens if your partition storing logs is full? You lose auditing/reporting data and is sometimes used by attackers to hide their activity. In some cases your system will not authenticate new users if it can't record their login event.

What happens on an RPM based system when /var is full? The package manager will not install or update packages and, depending on your configuration, may fail silently.

Filling up a partition is easy, especially when a user is capable of writing to it. For fun, run this command and see how quickly you can make a pretty big file: cat /dev/zero > zerofile.

It goes beyond filling up partitions as well, when you place locations on different mount points you can also customize their mount options.

What happens when /dev/ is not mounted with noexec? Since /dev is typically assumed to be maintained by the OS and only contain devices it was frequently (and sometimes still is) used to hide malicious programs. Leaving off noexec allows you do launch binaries stored there.

For all these reasons, and more, many hardening guides will discuss partitioning as one of the first steps to be performed. In fact, if you are building a new server how to partition the disk is very nearly exactly the first thing you have to decide on, and often the most difficult to later change. There exists a group called the Center for Internet Security that produces gobs of easy to read configuration guides. You can likely find a guide for your specific Operating System and see any specifics they may say.

If we look at RedHat Enterprise Linux 6, the recommended partitioning scheme is this:

# Mount point           Mount options
/tmp                    nodev,nosuid,noexec
/var
/var/tmp                bind (/tmp)
/var/log
/var/log/audit
/home                   nodev
/dev/shm                nodev,nosuid,noexec

The principle behind all of these changes are to prevent them from impacting each other and/or to limit what can be done on a specific partition. Take the options for /tmp for example. What that says is that no device nodes can be created there, no programs can be executed from there, and the set-uid bit can't be set on anything. By its very nature, /tmp is almost always world writable and is often a special type of filesystem that only exists in memory. This means that an attacker could use it as an easy staging point to drop and execute malicious code, then crashing (or simply rebooting) the system will wipe clean all the evidence. Since the functionality of /tmp doesn't require any of that functionality, we can easily disable the features and prevent that situation.

The log storage places, /var/log and /var/log/audit are carved off to help buffer them from resource exhaustion. Additionally, auditd can perform some special things (typically in higher security environments) when its log storage begins to fill up. By placing it on its partition this resource detection performs better.

To be more verbose, and quote mount(8), this is exactly what the above used options are:

  noexec Do  not  allow  direct execution of any binaries on the mounted file system.  (Until recently it was possible to run binaries anyway using a command like /lib/ld*.so
             /mnt/binary. This trick fails since Linux 2.4.25 / 2.6.0.)

  nodev  Do not interpret character or block special devices on the file system.

  nosuid Do not allow set-user-identifier or set-group-identifier bits to take effect. (This seems safe, but is in fact rather unsafe if you have suidperl(1) installed.)

From a security perspective these are very good options to know since they'll allow you to put protections on the filesystem itself. In a highly secure environment you may even add the noexec option to /home. It'll make it harder for your standard user to write shell scripts for processing data, say analyzing log files, but it will also prevent them from executing a binary that will elevate privileges.

Also, keep in mind that the root user's default home directory is /root. This means it will be in the / filesystem, not in /home.

Exactly how much you give to each partition can vary greatly depending on the systems workload. A typical server that I've managed will rarely require person interaction and as such the /home partition doesn't need to be very big at all. The same applies to /var since it tends to store rather ephemeral data that gets created and deleted frequently. However, a web server typically uses /var/www as its playground, meaning that either that needs to be on a separate partition as well or /var/ needs to be made big.

In the past I have recommended the following as baselines.

# Mount Point       Min Size (MB)    Max Size (MB)
/                   4000             8000
/home               1000             4000
/tmp                1000             2000
/var                2000             4000
swap                1000             2000
/var/log/audit       250

These need to be reviewed and adjusted according to the system's purpose, and how your environment operates. I would also recommend using LVM and against allocating the entire disk. This will allow you to easily grow, or add, partitions if such things are required.


How to delete YouTube zombie cookies Some days ago I noticed that YouTube knows the videos I watched even though I deleted my cookies. I also was not using a YouTube-account. When I noticed I used IE 11. After some research I found out that YouTube uses zombie cookies. For those who don't know: zombie cookies are cookies that don't get deleted if you use the "delete cookies"-function in your browser. In most cases they are flash cookies and you have to delete those to "kill" these zombie cookies.
But even after deleting my flash cookies YouTube still knew the videos I watched (I tested that in most cases on this site: https://www.youtube.com/feed/history This site shows you, how many videos you watched so far).
So my question is: How is YouTube identifying my, even after deleting flash cookies? How can I can delete the information YouTube has of me?

I do the following to force youtube to "forget" me.

Use firefox (just because I think it's better, but this shouldn't be required)
Configure flash to not store any data (right click on a flash app/video, select global settings, storage tab -> "block all sites from storing information on this computer")
Now when you delete the cookies, google won't be able to re-create them from any flash data.

If you do want to allow some sites to store data in flash, you can block just one site.
The reason why google can rebuild the history is (probably) because it has the data both in web cookies and flash cookies, so as long as one is present when you visit youtube, google can rebuilt the other cookies.

Source: I just tried this :)


Is same origin policy for web only useful because of cookies? There is a same origin policy in the browser to ensure that e.g. bad site won't read your data from Facebook. But it seems that the only problem that it tries to solve is that cookies are automatically sent with the request which authenticates the user (+ maybe some other authentication schemes like basic or maybe certificate).

So my question is: would we really need this policy if the browser would not send all the http auth details and cookies with this request automatically?

Maybe the best way is to allow cross-origin by default, but make sure that this information (cookie, http auth) is not transferred. In any case we can produce token based API now e.g. and so on if a cross-site request is required. And a 3d party caller would need to obtain a token the same way so that no CORS would be required.

No, the Same Origin Policy also protects against:

Cross domain manipulation in the DOM (e.g. a page manipulating another page from another origin loaded in an IFrame).
The response from AJAX requests being read when the origins don't match.
Images loaded from other origins from being read into an HTML5 canvas.

  So my question is: would we really need this policy if the browser
  would not send all the http auth details and cookies with this request
  automatically?

Yes we do need it for the above reasons.

It could work like that, but not now because of backwards compatibility reasons. It would break too many things suddenly changing a standard that most of the world's web is based upon.

In any case, what would happen in the case that the whole window is redirected? e.g. if there's as sensitive function that could be exploited via CSRF using the GET method, the attacker could simply redirect the whole page to https://example.com/delete_users in order to execute the attack.

How would the browser know not to send cookies in that situation? It appears the only thing you would achieve is to make the rules more complicated, and complexity is the enemy of security.


WHOIS Contact Details Abused The system for the internet and the way people can abuse it is getting worse and worse. I am having several issues with people abusing the information within my WHOIS, which if I remember is protected by international laws, or at least should be.

Thanks to an email and what I was taught when it comes to doing business online:

  Please remember that under the terms of your registration agreement, the provision of false Whois information can be grounds for cancellation of your domain name registration.

I am receiving phone calls, spam emails, and threats.

I do know that my information is public, but it should not be abused because of that? Yes, I do know that I can buy the packages of private registration, but I do not exactly have $10 extra to spare in a year for my website.

Is there a way to report the people who is abusing this information? Should I actually spend my money on the private registration, even though my information is being abused and most likely recorded on their computer? What is the best way to handle this abuse of my information?

people abusing the information within my WHOIS, which if I remember is protected by international laws, or at least should be.

I'm pretty sure there's nothing at all to that effect. There are terms and conditions put in place by service provider companies, but at best people are bound by them as far as they are enforced. There is very little "international law"; there are treaties, which various countries incorporate (or not) into their national legislation, but I doubt there's any international treaty specifically for domain registration "whois" information.

  I am receiving phone calls, spam emails, and threats.

What makes you think the spam has anything to do with you having published contact details in whois? You're doing business online, wouldn't phone calls be fairly expected if you have a company? If you aren't using specifically crafted contact details that you use only in your domain registration, how do you know that whois information is even the culprit? Threats, now that's more serious.

  I do know that my information is public, but it should not be abused because of that?

It should not, but there's no technical way to prevent it from being. For example, VeriSign / Network Solutions whois includes the following "terms of use" in the whois output:

  By submitting a Whois query, you agree to abide by the following terms of use: You agree that you may use this Data only for lawful purposes and that under no circumstances will you use this Data to: (1) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail, telephone, or facsimile; ...

This would seem to cover most of what you mention, but if no one enforces it, then there isn't a whole lot you can do about it. I'm pretty sure that text is mostly there to cover their rear, not really to meaningfully protect the customer.

  Is there a way to report the people who is abusing this information? Should I actually spend my money on the private registration, even though my information is being abused and most likely recorded on their computer? What is the best way to handle this abuse of my information?

If you are receiving threats, or are being harassed, you should contact your local law enforcement and provide them with any pertient information. As for spam, that's just par for the course on the Internet these days unfortunately; I recommend installing a good spam filter and training it well.


Struggling to profile the query behind a SQLi vulnerability I'm black-box pen testing a colleague's website for common vulnerabilities (mainly concerned with OWASP's top 10).

I've found a SQL injection vulnerability in a form since the use of special characters in one of the form field's values returns errors. The error specifies that an incorrect number of parameters were provided to some internal function - I suspect, given the purpose of the form, that some particularly complex query sits behind it.

I'm struggling to get any response other than this error. I've tried a browser tool to profile the query hoping it would paint a picture of what the query looked like ready for demonstration of how it can be exploited but it failed to identify a vulnerability at all.

How can I get a clearer picture of what the query looks like? Or is this entirely subjective and specific to this case?

An example answer I'd be after is a way of injecting SQL that, no matter where it sits, can be relied upon to test for vulnerability.

Note: If needs be I can simply outline the fact that I've found a potential vector, but I'd like to be able to explain the extent to which it may be exploited.

I've found a SQL injection vulnerability in a form since the use of special characters in one of the form field's values returns errors.

This is an incorrect assumption. Errors could indicate a poorly developed application which may or may not include a SQL Injection. To say that you have found SQLi at this stage is premature.

  The error specifies that an incorrect number of parameters were provided to some internal function.

I would strongly recommend searching for the error message and using it to fingerprint the application. If it is a raw error message, you could find out the app/web-server/DB component that generates it.

  I've tried a browser tool to profile the query hoping it would paint a picture of what the query looked like ready for demonstration of how it can be exploited but it failed to identify a vulnerability at all.

SQL Injection tools are now fairly mature. If the tool doesn't find anything, it is likely not a SQL Injection, or it is possible you are not using it correctly. Are the payloads generated doing what you want them to do (are they probing the form correctly)? What responses does the tool show?

OWASP's guide is a great place to start looking at for a manual testing methodology. Depending on what you observe, some kind of "blind" exploration is likely required, perhaps you should look closely at UNION, boolean, or time-based detection techniques. Alternatively, throw sqlmap or havij at it, if this is within the scope of the pentest.


How does a browser manage secure sessions and store session keys? I am interested in how a browser manages secure sessions. As I understand it this is the scenario when logging into a google account:

1) Browser (B) and google Server (S) perform a handshake to create a secure session by encrypting http traffic using TLS or SSL.

2) User (U) enters log in details

3) U is authenticated

4) U opens a tab to youtube, and is provided with an option to sign in using their google account.

5) U uses their google account, but is not required to enter any details as their browser still has a secure session with their google account.

My question is, how is steps 4-5 performed with respect to the browser, how does the webpage like youtube hoover up the passwords and session details to send to the youtube server? How does the browser store and manage this?

I am familiar with the operation of protocols like sso and federated identity, but here I'm interested in writing a webpage/app capable of picking up this information from the browser.

Secure session details per-website are stored in local cookies set by a response and sent to the server in future requests.

For cross-domain example, like you described with youtube (and a comment described), the standard method is OAUTH or OAUTH2. It is the same mechanism that you may allow other websites to access your facebook or twitter details.

This all manifests as a series of requests with parameters and responses redirecting to other targets.

OAUTH has some "implicit" flows that may allow auto-login across websites without the user explicitly approving it.

You can interactively move through some example requests here: https://developers.google.com/oauthplayground/


Non-cryptographic hash for message authentication? My application uses UDP. Typical Client-Server Communication consists of one packet (< 500 bytes payload) requests from the client and one packet answers to those requests from the server. In the case of packet loss the client has to resend its request.

To secure the "connection" an AES-128 PSK is used (previously transferred via TLS/SSL).
Now each packet will be encrypted using AES-128 in CTR mode. The packet will contain the nonce/counter, the message to be delivered and a hash of the nonce plus message:

MyPayload = aes128CTR(nonce + plaintext + hash(nonce + plaintext))

Can a non cryptographic hash function (e.g. Murmur3) be used as a MAC in this case?

Furthermore do I have to send the complete nonce (16 bytes) or will a smaller counter (e.g. 4 bytes) be enough to be sure the packet was indeed sent by my client instead of being a possibly IP-spoofed packet?

I suppose not, because the hash serves as a bias to your plaintext. Murmur3, DJB2 etc have very small fixed domains and take collisions into account, which you cannot allow on a counter mode block cipher.

Assume an adversary is aware of the symmetric encryption parameters and block mode operation used, it would only take the size of the nonce + hash domain to decrypt the ciphertext. This can be done in polynomial time. This also answers your second question regarding the counter size.

I would argue using a hash function the way you describe can weaken the ciphertext even further since you derive a relative small hash from the plaintext. I would suggest encrypt-then-MAC either way.

Update

If you have the computational power to establish a TLS session anyway, why not go with a GCM/GHASH variant? You might even want to chain the packets together and add the packet counter as AEAD in GCM.


Special form of file system to prevent recovering after secure wipe data I'm looking for file system with reasonably error corrections, but rugged against forensic after wipe.

Say, encrypted container via loop mounted like ext4 - journal file system. This is good performance and secure in many ways.

Wiping in this scenario is a destroying at least start of crypto-container(journal of ext4). It is fast. Recovering require huge of power: key + password + destroyed crypto-container's prefix.

Is there special file system with encryption and great wipe feature. "Great", I, mean fast and unrecoverable.

E.g. journal at start of file system contain not a addresses of files, but key - map of blocks randomly situated in memory area. Destroying of this key means destroying a sequences of whole file system.
File in such file system is lay in un-fragmented memory's sequence. Plus whole of file system encrypted.

Wipe require rewriting the journal(map) of the file system only.

Say, rewrite map and key 30 tries, and no NSA, no NASA, no CIA can recovery wiped file-system.

The right way to "wipe out" data is to use encryption: never let unencrypted data ever hit the disk. If you do that, then destroying the decryption key is sufficient to destroy the data. The decryption key is small and in many case you can keep it in RAM only (e.g. you type it upon boot, as a "password", which really means "a key that a human remembers"); if the key is in RAM and stays only in RAM, then destroying it is as simple as shutting down power (note, though, that RAM contents may resist loss of power for a few seconds or minutes).

File wiping is what you do when you did not do things the right way. You did write sensitive information on a physical medium, without any encryption. And you would like to "fix" that. There are three main problems with that:

File deletion does not overwrite the data on the physical medium; it just marks it as reusable for other files.
Sometimes, even writing over the data may not actually destroy it. This is where the so-called "file shredders" intervene, by overwriting the data several times with special patterns which ought to destroy all traces of the past data. However, such shredders are quite specific to the actual disk technology, and, in practice, quite specific to the technology used by disks 12 years ago; on modern disks, the shredders are likely to be useless and unnecessary. Conversely, with SSD, quite a lot of data can remain out of reach of the most thorough shredders. So file shredders are either total overkill or insufficient, with no middle ground.
Copies of parts of the file data can be stored in other areas. This may happen with virtual memory because the file data, before being in files, was in RAM. This may also happen with journaling filesystems (depending on the filesystem implementation and configuration).

So any solution based on file "wiping" is likely to be inefficient and incomplete. Anyway, despite this incompleteness, some people have tried to do some sort of automating shredding. This can be done at various level; this one does it by patching the unlink() C library function call (through an LD_PRELOAD trick). Statically linked process would still avoid it, though (but there are very few statically linked applications in a typical Linux installation). I would not recommend it (and the author himself is wary of it); notably, file-shredding on a SSD is not only ineffective (see above), but also noticeably shortens the lifetime of the said SSD.


Why are triggers not often used to secure a database? I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time user input was used in a SQL query.  At the time I heard talk about using triggers but didn't really know what they are.

Today in a class triggers were taught and if each time a SQL statement is called something happens, wouldn't that be much easier to make a trigger check for injection rather than "parameterizing" every line of code in the web app? I asked the prof and he said a two tired system would be needed for it to work because triggers don't work on the querries.

What does he mean triggers don't work on the queries and why aren't triggers used for securing databases from web-apps?

The web-apps were written in Cold Fusion and didn't have the cfquery param tags added. I'm curious, why can't the Cold Fusion engine add these automatically at run time, I mean there's never a time when one should not use cfquery param tags, right?

I think what is being talked about are "Stored Procedures". Triggers are fired internally in the database when actions are performed, but stored procedures are direct parameterized functions.

  Why are triggers (stored procedures) not often used to secure a database?

Sometimes laziness, sometimes it's just too restrictive. It's also the case that using parameterized SQL queries in your code also prevents SQL injection attacks. Jeff Atwood wrote a decent article about tradeoffs with stored procedures back in 2004.

That said, even with parameterized SQL queries, stored procedures still have a place in my mind, especially with passwords. There is no good reason for the application to ever query the password hash from the database system, only to ask the database system to compare an input value (such as a generated hash to keep the load off the DB server) against the hash. For that scenario, a stored procedure definitely adds security and I really wonder why nobody ever uses that.

  Wouldn't that be much easier to make a trigger check for injection

Well, let's consider this: if your trigger can check for SQL injection, then I presume your code could as well. Then you either have a whitelist of values, or a blacklist for detection. Blacklists are poor choices. Even then, if you're doing whitelists the enumeration factor could be immense if you don't trust any of the query input at all, including the structure. Then we're back to either writing a stored procedure for every possible operation or using parameterized queries... and generally, the second method is saner.


Why do mobile devices force user to type password after reboot? Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an authorized fingerprint is given.

My question is: why?

First:

password is used to get access to the full disk encryption key
fingerprint is used to unlock the screen (of an already "decrypted" device)

Encryption key retrieval must be:

accurate - on each entry, the device must transform the password through a key-derivation function into the one and only correct encryption key, otherwise the device won't be able to decrypt the data
secure - derived through a one-way function, not "unlocked" by comparing data provided by a user with a pattern stored on the device

Fingerprint recognition does not meet the above requirements, it is:

fuzzy - on each press the sensor provides the device an approximate image of a part of a fingerprint which is matched at a certain accuracy; on each verification attempt the actual data differs due to different position, skew, press strength
non-secure - recognition is performed by comparing the actual fingerprint with the data stored on the device - this data must be both readable and modifiable which makes it vulnerable to an attacker


Safe way of sharing a password with someone via email For a beginner, how can I encrypt a password text into a cipher text that I would send via an email to someone, such that they can decrypt locally (offline) and read the password?

To clarify, the intent is not to encrypt the whole email (irrespective of the service being used), but to just send the password itself in an encrypted format as opposed to a plaintext form, to be on the safe side.
Can OpenPGP be used here? (Say, for a Linux based OS).
I admit I don't know what key (and encryption protocol) I should share with the other party, so that they can decrypt, and how to share the key.

Any advice or pointers towards tutorials for such purposes would be highly appreciated.

Important details:

I don't have a public key from the recipient.
Nor do we have a pre-shared secret. (how can I establish that assuming I have other means of communicating with the other party, other than email I mean, for instance sharing a secret on a piece of paper, or via an encrypted call, etc.)

To do this securely, you'll need to either

Create a PGP certificate or S/MIME certificate, share it with the user, and then share content via email encrypted using PGP or S/MIME.

Or

Share a shared-secret with the recipient ahead of time - by phone is probably the easiest way. I'd recommend a 6 word or longer EFF Diceware password, but this will vary based on your threat model. A good tool for generating one can be found at https://www.rempe.us/diceware/#eff, although you can use whatever tool you want.

After you share this shared secret, you can use any number of file-encryption (or email encryption) tools to send a document encrypted using the shared secret. I'm partial to ProtonMail because of its ease of use, but truly any reputable file encryption or encrypted email solution is fine.

Alternatively, you can also use a tool like Sync.com or another file-sharing site that allows encrypted transfer and password protection. Truly, the important and difficult part is getting the shared secret out there in the first place.

If you recipient isn't computer savvy, #2 is probably the easier workflow. All they have to do is click an link and type a password consisting of only common English words.


Isolating Web application hosted on same web server I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web application Y. In short my question how can I isolate web application hosted on the same server ? What are the techniques that need to be in configured on the web server ?

If you have multiple websites on the same server then depending on the issue, a security problem with one site may well affect another.

Mitigating this essentially means increasing the separation between the two applications.  You could do this by using somthing like a chroot jail or if that's not enough isolation you could look at using VM guests on the same host to provide more isolation.


What advantages do Secret Managers offer in terms of authentication [API usage]? The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, thus the original problem is not fully solved because if that "master" key/creds are transmitted insecurely, stored in source-code, or otherwise compromised, then it compromises the secrets after all.

Can someone who is slightly more educated on the subject matter comment on how secrets managers tackle the authentication problem or otherwise make it more secure over traditional API-key authentication?

Some example systems: Thycotic Secret Server, Amazon Secrets Manager, Hashicorp Vault.

It always depends how critical is your software.

 Software
Yes, most of the times you still have to provide a key or credentials at some point, programmatically, or by giving access to a file only to a specific service and that file contains the secret. If you're choosing any of these ways, it is important to erase the value from the memory as soon as possible (immediately after the authentication if this is your purpose).
If your purpose is encryption or digital signing, you can always use public key cryptography, give the software the public key (and use that one for encryption/ digital signing) and use somehow else (offline/ stored separately) the private key.

Hardware
If you can afford hardware, then a solution might be storing the master secret on a separate device that you are sure enough it won't be compromised, and couple that device to a server in a secure cage/ data-center.


Just how much of a risk am I putting on my network by allowing UPnP I am facing a serious conundrum (to me at least). Whether or not to disable UPnP on my network. I understand the risk, an infected computer could punch a hole in my firewall, and more infections can follow. I would disable UPnP, but the people who are on my network are not really savvy enough to go to the router IP, and set up a forwarded port so their stuff will work.
But they has pretty safe browsing habits. No clicking on weird links, or "You won" buttons. (uBlock has really helped this, except on phones). Antivirus on all Mac/Windows devices, android and chromebook everywhere else.
I am not always able to do network stuff for lengths of time for a variety of reasons.

So as the title says, just how much of a risk would I be put on this network by leaving UPnP on? (This is not a business network, running servers that connect to the outside world, just a simple network for a few people in a building.

Bonus: I just realized UPnP has been running on my router for at least five years, and nothing has happened yet. I know that nothing in the past does not mean nothing in the future, but I thought I would mention it.

UPnP's authentication model is, for the most part, "did I get a UPnP packet? yes? cool, I'll do whatever it says". The reason that this is generally considered acceptable (at least in home environments) is that the UPnP server only listens on the internal network, which is considered trusted.

Problems with UPnP arise if your threat model includes an attacker who has access to your network. Many routing devices support a wide range of configuration via UPnP, including DNS settings and routing tables, which may enable man-in-the-middle attacks against your traffic if maliciously configured.

A common place you'll see dangerous UPnP configurations is small hotels and businesses offering free WiFi. The routers are often consumer devices left in their default state, with UPnP enabled, so anyone can configure them because, by business requirement, untrusted people have access to the network.

For the large part it makes sense to just turn UPnP off if you're not expecting to have lots of unknown programs needing dynamic port forwarding. You should also verify that UPnP is actually switched off when you disable it on a settings page; there are numerous cases of consumer routers where the UPnP disable functionality either does not work at all, or only alters the boot config to not launch UPnP on next boot without stopping the existing UPnP daemon.

If you're concerned about UPnP but do require it for administration, find a way to move the UPnP listener onto an administrative VLAN rather than the primary VLAN.


Why doesn't IKEv2 use L2TP? My guess is that with IPSec/IKEv1, since it doesn't support NAT, you either have to manually configure routes from your machine, or use a layer 2 tunnel (such as l2tp) to talk with devices on the network you're connecting to. With IKEv2 it supports NAT, therefore no layer 2 tunneling / routing is required (except with configurations by an administrator on the VPN gateway once).

Found this question here: https://superuser.com/questions/737046/ipsec-with-or-without-l2tp

  IPsec has been developed for IPv6, which does not know NAT anymore and using IPsec for IPv4 has always been some kind of hack. Not having NAT for the so called road warriors using IPv4 was a no-go. The only way to get it working in the 90th was to use L2TP, because L2TP works on top of UDP and NAT is possible.

My understanding is then this:

L2TP is used with IKEv1 for the 'road-warriors' / people needing to connect remotely to a network. It bypasses the limitation of IKEv1 not having NAT, or requiring the client to configure their own routing table to talk to clients on the remote network
IKEv2 supports NAT which enables the remote worker to talk to clients on the remote network, therefore L2TP isn't required. IKEv2 also has many other advantages.

L2TP probably isn't used for site-to-site VPNs, or for transport mode as routing tables are set up by administrators, or the communications are happening internally.
L2TP isn't used by itself since there's no encryption, so IPSec is secured to a gateway (with IKEv1), then L2TP takes over at the gateway through the IPSec connection to talk within the network.
You could technically use L2TP with IKEv2, it just isn't required. It would also have a performance impact, and probably other drawbacks, with no benefit.


Replacing Windows 7 security updates with anti-virus? Microsoft has announced Windows 7 will no longer be receiving updates after January 14, 2020: Here.

I hate windows 10's forced updates and telemetry so I have always stuck with Windows 7, but it may be as good as dead after the lack of security updates.

Linus Tech Tips did a great video covering this issue: Here.

With this massive change I was wondering if anyone knew of the real impact this would have. Can third-party Anti-virus successfully substitute Windows 7 security updates after they are discontinued?

Right now I use Malwarebytes and AVG, and I feel as though this would be enough but this is something you have to be sure about.

With Windows Vista I feel as though this has already been studied but, I am not clever enough to google the right words. So I have turned to the amazing community here for solid answers.

Is Windows 7 being left 4 dead, or is Y2K coming back for round 2?

Nope.

After Microsoft discontinue security updates for a version of Windows there is not a safe way to run that version of Windows.

Some people will promote Virtual Patching where you have a external firewall scan all your traffic looking for patterns of traffic that look malicious. I would not trust that, and it requires a seperate non-vulnerable computer.

A number of vulnerabilities patched by Microsoft are not the sort that anti-virus are good at catching. In the most recent example Google announced a Chrome Bug plus Windows 7 bug that caused visiting a site to remotely execute arbitrary code, this was being used in the wild. After end-of-life Microsoft will not patch this type of bug. (https://www.zdnet.com/article/google-chrome-zero-day-was-used-together-with-a-windows-7-zero-day/)


Seeding GPG keygen with a hashed secret Possible Duplicate:
  Tool for public key cryptography where password is the private key?

I was wondering if you guys could clue me in to potential problems with using a hashed password as the seed for GPG's key generator.  As far as why someone would ever want to do this, I can see two advantages:

Using a human-memorable password would eliminate the need to store the key on disk, protecting you from identity theft in the event of data theft.
Since the user's memory contains everything needed to regenerate the key, you don't need to worry about [electronic] data loss.  Dementia still applies.

As Stephen pointed out, reason 1 is weak because password protected RSA keys also have that benefit.  And RAM would still be vulnerable, but that's much harder to gain access too, right?  But assuming people aren't great about backing up (they aren't) and reason 2 is valid, are there potential systemic problems with using a hash as a RNG seed?

Digested passwords only have as much entropy as was in the password passed to the hashing function. GPG uses cryptographic sources of random numbers to generate the private key, and encrypts it with a user's password. This ensures that the encryption algorithms are allowed to use a key with maximum entropy, but also prevents a user's key from being compromised in the event of data theft.

It's the best of both worlds, really.


MITM on popular sites - DNS Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests?  Will the user notice something?

For instance:

Loading https://fb.com

The client requests IP (not through SSL by default) and the client gets the IP from the attacker's server. Will the attacker then by able to perform a MITM?

I suppose because the client typed "fb.com" in its browser that it will only accept a public key from a certificate that has "fb.com" in it. The attacker will be able to send the traffic through his server (redirect through DNS), but not make sense of it (because he won't be able to make the client accept his public key).

Am I wrong in this?

Suppose Victim A has your standard off-the-shelf Linksys wireless router which, by default, doesn't have encryption enabled on the wireless network which it broadcasts. Suppose Victim A never changed the default administration password either to gain access into the router's web interface to change settings (usually admin, admin).

These two situations are extremely common. All that Attacker A needs to do is setup a rogue DNS and web server on his laptop that has been connected to Victim A's wireless network, add forwarder addresses into his rogue DNS server (such as Google's public DNS of 8.8.8.8 and 8.8.4.4) so that all other domains Victim A tries to visit are still resolvable to their corresponding public IP address, then add a forward lookup zone for fb.com and facebook.com. Each of these 2 zones will need an A record for the root domain and an A record for www both of which point to Attacker A's local IP address of 192.168.1.1. Attacker A then logs in to the router's web interface (the default gateway address - usually 192.168.1.1 for Linksys). From there, Attacker A changes the ISP DNS settings on the WAN interface from the settings obtained via DHCP from the ISP to his laptop's local LAN address (say for example 192.168.1.101).

Now, on Attacker A's local web server, he takes Facebook's CSS stylesheets and login form with wget or any other website mirror tool, then injects some PHP into the downloaded page that saves a text file to his local web server's root directory that records any username and password submitted via the form. Bear in mind that this form looks exactly like Facebook's login form. From there, the attacker forwards this information to the real Facebook site and logs the user in so the user never even knows what happened.

When Victim A visits fb.com, facebook.com, www.fb.com, or www.facebook.com, the IP address with resolve as Attacker A's laptop LAN address of 192.168.1.101 given Victim A's DNS cache has been cleared after a period of time.

As mentioned, the only downside is that if Victim A has https://facebook.com bookmarked, the process will look extremely (ph)ishy as Victim A will get an invalid certificate warning. Also keep in mind that the attacker doesn't have to stick around for this entire process if he sets up a rogue DNS and web server on a public IP, forwards ports 53 and 80 on his firewall, and sets Victim A's router DNS address to Attacker A's public IP.


How do botnets communicate without being caught? This is something i have pondered about for a while now, but never really thought to ask. How is it that botnets can communicate with a controller of some sort to co-ordinate DDoS attacks and other nasties without it being traced back to the operator of the botnet?

Surely the botnet needs to know where to recieve its commands from to stay in sync with what the rest of the botnet is doing, how is it that this source cant be found and traced back to the perpetrator?

Another thought I had was that perhaps botnets work on a peer-to-peer basis, and that all bots know about all the other bots in their 'network', and all the controller needs to do is pose as another unwilling member of the botnet to make the controlling machine indistinguishable from the bot machines, but I cant see how this would work well enough to hide their indentity entirely either?

How is it they can get away with doing this without getting caught?

In additional to Jay's Answer about DNS Fluxing, another way to circumvent blacklists of domains is for a botnet operator to use a DGA (Domain generated algorithm).

The botnet will use a shared secret algorithm to generate the next check-in domain. This algorithm is kept secret to prevent law-enforcement or a rival C&C operator from determining the next check-in and taking control of the bot.

When a domain is taken down due to malicious content (or the domain is added to a blacklist), there is a chance that the bot cannot check-in with the server. The use of a DGA increases reliability of the communication between server and bot.

This is the method that was used by Conficker and was a back-up protocol used by Zeus.

More Information on DGAs:
http://resources.infosecinstitute.com/domain-generation-algorithm-dga/

Cracked DGA Algorithm leads to 200k+ domains takendown: http://blog.malwaremustdie.org/2014/02/the-takedown-of-209306-nuclear-pack.html


How can I prevent private data from being disclosed outside of my organization? I'm not looking to secure my internal network.

Our company keeps sensitive customer information. How can I prevent this information from spreading outside of the company?

How do big companies prevent to leakage of their information?

I seek a comprehensive solution for preventing information leakage.

This encompasses many security and access control practices companies follow. Generally you'll need to do this at many levels at many places.
There are a lot of Data Loss Prevention software that can help you prevent information theft.
A quick comparison is here.

To quickly answer your question, these are the things you'd normally want to do:

Remove write access to all media on corporate workstations, which includes USB and optical drives
Audit emails, both personal and official for attachments. There are software that can help you do this.

You can even intercept personal emails (gmail, yahoo) by playing MITM. Yes, companies do that !

Devise sophisticated snort/sourcefire rules to flag and trigger alerts when anything you think that is proprietary leaves your network.
No ssh/shell access to internal machines from outside the corporate network (specially internet).
Ban outgoing ssh, ftp connections as well. Remember banning outgoing traffic to corresponding ports(22, 21) won't help (one can run her home ssh server on port 80).
Access control: have a solid privileging system in your organization where restricted resources are accessible only to a set of authorized people.

Again this is not comprehensive. Lot of specifics depend on your network/organization/policies.
Basically you should spend a lot of focus on minimizing the exposure of sensitive data to a extremely small set of people.

There are a lots of ways data can be infiltrated. Someone can just upload a couple pictures to her picasa album and effectively steal lots of code. No IDS/surveillance  will be able to stop that. But proper controls and checks at all places can definitely reduce such occurrences.


Protecting peers communicating with WebRTC For reference: WebRTC Homepage

I've been really interested in these new RTC technologies that are coming out, specifically the fact that use the PeerConnection API to establish a connection between two browsers and receive media via P2P. So I have a few questions.

What security measures can peers take to ensure their privacy and security when using technologies like this?
Is there anything that a webmaster can do (programmatically or practically) to ensure peers are safe(r)?
What risks are posed to peers in general?

To state the obvious, you can serve your code over HTTPS.

The architecture diagram shows that it uses SRTP, the secure version of RTP.  It uses AES and HMAC-SHA1.

That leaves the question of key establishment for the SRTP session.  A quick search suggests this has been a sticky issue to standardize.  Clearly this is a goal of the project, but I don't know whether it's been settled yet, and whether there might be tradeoffs that you need to be aware of.  http://www.ietf.org/mail-archive/web/rtcweb/current/msg04050.html

Also see (seems to be focused on issues about UI and granting permission) https://wiki.mozilla.org/Security/Discussions/WebRTC

  Security for WebRTC is (with no surprise) becoming a real rats-nest for some of the use-cases, such as screensharing ala WebEx, remote assistance ala Windows or VNC, ongoing permission ala Skype, etc.

The general impression is that, since WebRTC is an incomplete draft spec, information about its security is incomplete and drafty.


Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker? Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd.

If an attacker gets physical access to the machine (while it is locked or shut-off), is it possible for him to boot using usb (with some other OS) to compromise (including reading and writing over) the victim's files? I believe that data confidentiality is still protected by bitlocker, but I hope to get some confirmation on the possible attack vectors possible.

I am also aware that there is an option to set a password to prevent changes to the UEFI settings or to disable booting from usb, but I am interested in attack vectors in the default scenario where the password is not set and the boot order is network -> usb -> ssd.

Thank you.

After conducting extensive research on the Bitlocker platform, I believe I can answer my own question.

Key reference: Bitlocker Drive Encryption Technical Overview

In our default setup (at least on MS Surface Pro 3), Bitlocker, UEFI and Secure Boot are on. There is TPM 2.0 enabled. The UEFI is not password protected, and the boot order allows USB before SSD.

Attackers have the interest in booting into an alternative OS because popular password cracking tools like Ophcrack run from Linux (actually it wouldn’t work on the Surface Pro 3 because it is a class 3 UEFI device that does not support Legacy BIOS mode). In addition, if the hard disk is not encrypted, the alternate OS has the liberty to read the files from the hard disk, and even “reset” the Windows password by messing around with the Windows SAM and registry.

In our scenario, since Bitlocker encryption is on, the hard disk partition is encrypted so an alternate booted OS will not be able to see our files.Also, the TPM will conduct an integrity check on the pre-boot components and will realize we are booting into another system, and thus will not release the keys needed to decrypt the hard disk partition.
Furthermore, one cannot simply boot a Live Linux USB, or install Linux on the hard disk, since Secure Boot would not allow that. Can we just turn off Secure Boot, since there is no password protection on the UEFI settings?

Yes, an attacker has the ability to turn off Secure Boot and boot into an alternate OS. However, that is not a concern because the default Bitlocker policy will use Secure Boot for integrity validation as well, and turning off Secure Boot will trigger the Bitlocker recovery key lockout. The attacker should not have the recovery key in his possession and brute forcing it is infeasible. Since the attacker cannot go past the recovery key screen, the hard disk will not be decrypted and the data remains protected. An intelligent user should also sense that something is up if he is prompted for the recovery key for no legitimate reason like a system update (in case we are afraid of Evil Maid attacks).

In the UEFI settings, the attacker could also turn off the TPM protection. This will definitely trigger the Bitlocker recovery key lockout because Bitlocker relies on TPM for its usual decryption keys. Therefore, it is pointless to do so.

Therefore, while it is possible to make the system “more secure” by password protecting the UEFI, it does not seem necessary to do so.

In addition, Surface Pro 3 is certified as a ‘Connected Standby’ device. In other words, we don’t have to go to the extremes of always shutting down the device or putting it to hibernate for added security in some configurations. We don’t really need to have pre-boot authentication also (i.e. just have TPM-only authentication). It does not have any DMA ports, so DMA attack is not possible. It is not susceptible to Cold Boot attacks, since system memory cannot be easily removed. See this reference article.

In his talk on ‘Building a Bulletproof Bitlocker’, Sami Laiho mentions that TPM-only authentication is good enough for 90% of people. If you’re interested, he talks about Bitlocker and added configurations that you could set up (for general devices, not just the Surface Pro).

Note that encryption does not prevent the attacker from writing over the hard disk with random bits.

Additional reading: Comments on Bitlocker

Note: there may be backdoors and implementation errors which are unknown. The answer here is based on available information from Microsoft and general knowledge about FDE systems. It also assumes that the TPM can be trusted and that brute forcing the encryption itself is "infeasible" without a very fast supercomputer (i.e. will take "too many" lifetimes to break at present time). That said, feel free to point out additional vulnerabilities so that we can be more aware of the potential threats and under which circumstances we should be concerned about them (i.e. assumptions about the attacker). I would just like to comment that a vulnerability in a part of the system does not immediately imply that an attacker can engineer a successful attack to extract information from it, although it indeed does increase the chance of success.


DNSSEC - does the domain owner owns a key? The purpose of DNSSEC is to prevent some attacks like cache poisoning so a client can be sure that the answer it gets from a recursive DNS server are correct (the IP is the correct IP). The root DNS holds a key pair that signs the keys of the level below it (e.g. .com), and so on (.com signs the keys for the example.com DNS serer).

When the client query the recursive DNS (the last DNS in the DNS hierarchy), he gets a signed answer. My question: who owns the signature key that the client receives? is it the domain owner (example.com)? and who provided the domain owner with this key? is it self-generated key pair that is signed by the DNS server above it (.com)?

Please, clarify to me the keys ownership and who generates them?

At each level, in each zone, records are signed by one (or multiple) key, that is itself (the public part) in the zone as a DNSKEY record.

Also in parent zone a DS record (signed in the zone like any other records in that zone) "points" to the DNSKEY below by the virtue of being an hash of it and the domain name.

This is repeated at each level.
So if you start from root with a fully trusted key (an anchor, that must exist in each recursive nameserver), you find a signed DS record for some key inside the .com zone where you find its DNSKEY record and all other records there are signed by this key, including the DS record of a key for example.com in which zone you will find a DNSKEY record which key signs all other records, hence generating RRSIG records.

(This is of course simplified as often you have separate Zone Signing Keys and Key Signing Keys but this does not change the general idea above).

The keys are typically auto-generated by the nameserver or some external tools at some frequency (typically counted in months or few years). They must absolutely not be handled/generated by the parent zone, each zone is responsible of its keys, how much it has of them, how often it changes them, where are they stored (like on an HSM offline for the KSKs or simply on the filesystem). Each zone only gives a DS record (one per key, specifically one per KSK, including those that do not correspond to published DNSKEY records yet, as a backup), to its parent zone, in order to build the chain of trust.

So it can be the owner of the domain or the DNSSEC signing (and hence key generating service) can be outsourced: some providers will give you a nameserver acting as a bump into the wire, it will serve a signed zone from your content by being a slave of your own nameservers serving an unsigned zone and managing the keys and signatures itself.

The signatures in example.com are owned in a way (depends what you mean by owned) by the authoritative nameservers on this zone. They are either pre-calculated or calculated when the requests arrive (both models exist). Signatures themselves have a starting date and an end date.

Use an online tool like https://dnsviz.net/ to graphically display the chain of trust for any domain. Pass your mouse on various parts of the picture, you have overlays with a lot of useful information.

You can also use dig +trace +dnssec locally. Or better now delv +vtrace or drill -S.


Create Evil Twin with encryption and intercept input I know how to create an Evil Twin of a WiFi network using Hostapd. However, I can only create an unencrypted network  with eventually a fake login page.

While this can be work with some kind of people, many others can easily understand something it's wrong with their connection.

So I was thinking: it's possible to create an Evil Twin with any type of encryption (standard UIs in OS doesn't show it at the moment of connection) with no /random password (and maybe username) being asked at the moment of connection and sniffed?

So the Evil Twin seems the "good" Twin even in authentication and it can sniff username/ password without login pages that doesn't appear in standard WEP/WPA/WPA2 networks.

The answer is no. On WEP/WPA/WPA2 the key exchange is done in a "secure" way and the password is not transmitted in clear text on a client connection. You can find more information about the key exchange on this another security stack exchange question: Four-way Handshake in WPA-Personal (WPA-PSK)

It has interesting links and documentation about how 4-way-handshake works (applicable to WPA and WPA2). WEP has also handshakes but they work in a different way.


How to check the integrity of my BIOS? Could it be possible that a virus rewrites my BIOS with some malicious code? If so, how could I protect against it, or at least how can I check that the BIOS hasn't been modified?

It is certainly possible. See this presentation for example: http://www.coresecurity.com/files/attachments/Persistent_BIOS_Infection_CanSecWest09.pdf

One way to achieve protection is by requiring a flash bios password that some implementations support.

Another way is by using a TPM which does almost exactly what you are suggesting: It creates a SHA-1 hash of the BIOS image before loading it - and if Secure Boot is enabled it compares it to a stored value.

Now, how to check if the BIOS is compromised:

The general idea is that you can take a BIOS backup image at any time and compare the hash of that image to the hash of a previous one - maybe one you took after flashing.

But, in theory, if the BIOS modification is malicious enough, it will serve you something that won't be suspicious - so you won't actually be able to check but only just re-flash (and this may not be enough if the flash procedure itself uses bios functions that are hooked).
Generally to check the integrity of anything, you have to perform the checking operation at a level lower that the level of the object you check. With BIOS this is pretty hard - and this is one of the reasons TPMs were invented.


Can someone explain in simple steps how WPA2-Enterprise authentication and encryption happens? When I try asking this question on other websites I get massive downvotes and am told "We're not doing your homework. Use google." Also I sometimes get banned.

Anyways, I've searched tens of pages of google and still can't get a grasp on it.

There's the authentication part, where Radius access request, accept, reject, and challenge messages are sent. And then AFTER that the wireless AP and the supplicant negotiate the encryption key by first getting the Pairwise-Master Key (PMK) using the Pre-Shared Key (PSK), then generating the Pairwise-Transient Key (PTK)?

Are those the total steps? An image would really help.

Second question: In case both sides are using certificates (EAP-TLS) then how exactly is the PMK generated? There is no PSK with certificates.

Final question: I read on a security website that: "The weakness in the WPA2-PSK system is that the encrypted password is shared in what is known as the 4-way handshake". But in other websites I read that neither the PMK nor the PTK are ever sent during the handshake. So which is it?

Below is the information on frame exchange which happens between Supplicant and NAS (Server)

The cipher suite is the algorithm or hash technique which is accepted by both STA and AS used for generating MSK.