Docker runs container processes as root - should I be worried? I am running a (QNAP) NAS with Docker functionality ("containerstation"). I thought it would be a lot safer to install apps via containers instead of apps from the store (or 3rd party stores).

Many packages are outdated in their official store and QNAP runs all programs and apps as root/admin (even the webserver), therefore I thought Docker would be a solution.

Now I have some Docker instances deployed and their processes appear to run also as root/admin.

Which makes me think: Is it a false sense of security I have at this moment? Or is using the docker containers much safer than "regular" root?

I assume you are concerned about containerized applications running as root.

root in container is a risk. It still interacts with the kernel as root. And if an application manages to break out of container, it has root privileges on host.

Though, root in container has restricted capabilities compared to root on host. E.g. it does not have capability SYS_ADMIN that is needed for mount. However, avoid root in container whenever possible to minimize risks.

If your containerized applications don't need root privileges, you can run containers with an unprivileged user. The easiest way is to specify option --user UID:GID in docker run.

But I assume you need root privileges for your containerized applications. Docker provides user namespacing to adress this.

I do not give an example setup here as I am not really familar with user namespacing. I set it up one time and can confirm it works. I recommend to read the documentation: https://docs.docker.com/engine/security/userns-remap/

For short: The user namespace setup accomplishes a "fake" root user in container that on host is mapped to an unprivileged user. If the application breaks out, it does not have root privileges on host.

Apart from that, you can reduce container capabilities to improve container security. Use option --cap-drop=xyz and drop everything your container does not need. Or even better, use --cap-drop=ALL and add only capabilities that are really needed with e.g. --cap-add=CHOWN. Look at https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

Another option to improve container security is --security-opt=no-new-privileges.


Is there a benefit to having SSL connections on localhost? I have a mail server with a MySQL database back-end.  The mail server and MySQL DB are both installed on the same Windows machine.  Is there any benefit to using SSL connections between the two applications on localhost?

I think the connection is using TCP and not local sockets.

Based on this question about SSL on a trusted LAN, I don't think there is any benefit for local connections.  It seems like an attacker would have to be on the machine to read the traffic, and if attackers can get on our machine they can probably get whatever they want.  But this setup was already using SSL when I joined the team.  I performed a MySQL upgrade and now I'm having trouble with the SSL connection.  I'm wondering if I would be correct to convince the team that we don't need SSL on localhost anyway.

If you don't have other users on this machine you might be right. If you have other accounts with the ability to connect from remote they might be compromised. If the attacker is able to completely own the machine you are busted anyway. But even if the attacker cannot get root he might be able to make mysqld crash and then take over the port (default port is 3306 which does not need special permissions). In this way using SSL could help a bit, because the identity of the (hackers) server cannot be verified.

So it does not help much bit it might help a bit.


How could a bind shell open a port on a firewall in front of the target? Is it possible for a software to open port in the router for my local device without permissions to access router setup page?

If it's not possible then how does a bind shell work?

A typical bind shell payload will not be able to open ports on firewalls in front of the targeted system.  It would be possible to include a UPnP client in the payload which would open firewall ports on firewalls where UPnP is enabled.

As Arminius mentioned, reverse shells are generally preferred to bind shells because most networks have far more liberal egress rules than ingress rules.  However, there are some cases where bind shells can be quite effective:

There are no firewalls between you and the target.
There is a legacy firewall rule (perhaps a decommissioned FTP or Telnet server) that you can make use of.
You've already compromised the firewall and are in the process of lateral movement and will open your own port on the firewall.

The biggest advantage for a bind shell payload that I can think of is that you can change where your connection is coming from (pivot, change attack boxes, etc.), which makes it quite useful when testing from e.g., the client's WiFi network.  Additionally, it makes forensics harder if they did not capture the traffic -- a reverse shell will have the IP it tries to connect to in the payload, the bind shell leaves the DFIR team without that.


Have there been successful class action lawsuits due to infosec breaches? Whenever there is a major security breach affecting consumers, often large costs are quoted (e.g. 35 million for TalkTalk). One reason given for these large costs is the potential for affected people to sue the company.

Have there been cases of people successfully sueing, or getting a settlement? I'm particularly asking about consumers sueing a company; I presume company-to-company legal action is common but shrouded in secrecy. Hence asking about "class action" - or the equivalent in other jurisdictions.

Yes, and a high profile one was Sony's PSN breach which Sony settled for $15million, one report here.

Though the headline figure does not appear as bad when you realise that it is not an actual pay out, it is mainly free games and memberships for those affected.

From a purely UK specific perspective related to the Data Protection Act (DPA) compensation:

In terms of risk management decisions and the potential legal cost of a breach (and its part in deciding appropriate security measures) there was an interesting decision made in the court of appeal earlier this year in the on-going Hall v Google case...

Court of Appeal judgement

The DPA rules for compensation are such that compensation for distress can only be pursued where actual losses have been incurred i.e. distress in isolation does not entitle compensation. In the Hall v Google case the Court of Appeal decided that this aspect of the DPA was inconsistent with the EU legislation and was therefore not applicable, which could set a precedent depending on how the rest of the case plays out.

In my opinion this is something to keep an eye on because the implications are potentially huge!


Use of distributed ledger/blockchain to stop data exfiltration? If all our identities, our data (emails, pictures) are on distributed ledgers/blockchain, can the use of distributed ledgers/blockchain stop data exfiltration for good?

Not at all.
The ledger is public, but information on the ledger does not need to be cleartext. It can be a collection of encrypted blobs. So Gmail for example would become a bery large blob of encrypted blobs, and only the owner of the respective private key would be able to decrypt his blobs, and nothing else. The BlobMail.
Having data public everywhere would help on accessibility, but not on stopping exfiltration. After all, data is everywhere but not accessible for those without the key. And that single piece of information is the difference between no data leak at all, and all past data public immediately.
I explain. If I have a 10 year history on "BlockMail", all my emails are there, but encrypted and protected by my key. But as soon as my key is compromised, all my emails since always are public, because everyone have access to the ledger, and anyone with the key can access all history. Unlike when my email password leaks, I cannot change the blockchain, and I cannot change the key that encrypted those emails ten years ago.
You could even have a master key that generates a ephemeral key for every sent message, or change the master key from time to time, but it does not change the fact that the key is a single point of failure, and it fails hard.
So if the data is always encrypted and no key ever leaks, data is secure. But as soon as the key leaks, all data is immediately and irrecoverably leaked, forever.
And even if those difficult conditions are met, nothing stops anyone from compromising your computer and stealing your decrypted data and posting it anywhere, in cleartext.
In the real world, this blockchain against data leaks would backfire. It brings no additional security, makes failures catastrophic, and does not stop the ways people already leak data.


How can a browser hijacking attack change the browser's default homepage? Some attacks on web browsers consist simply of advertising, so the default homepage of the browser is changed (which is just a small aspect of browser-hijacking).
My question: is  installing (malicious) add-ons (via drive-by download attack) the only way to modifiy the browser's homepage?

Unfortunately, installing addons is not the only way.  There have been a number of javascript methods over the years, many of which are no longer supported by most browsers.

However there is at least 1 method still possible that works on modern IE browsers: http://msdn.microsoft.com/en-us/subscriptions/ms531418(v=vs.85).aspx

There are probably others.


Suspected fake torrent peers with "client_test" ID For a fair number of torrents I'm dealing with (qBittorrent 3.3.7 here), I see a number of entries in the "Peers" list (it apparently only shows peers that are currently connected) with client_test/1.0.6.0 in the "Client" column.

They appear to stay connected for extended time but not participate in uploading/downloading - and probably skew the numbers in tracker stats, too. They are predominantly US IPs while the "normal" peers for these torrents tend to be from the former Eastern bloc.

Is there any information/investigations on them out there? Are they fakes and should be banned/reported or something?

I think it refers to iknowwhatyoudownload.com

This site made by russians and collects information about what you downloading and publish it. They are most often connecting via DHT and PEX.


I need a good cryptography algorithm that can be encoded and decoded I have realized some time ago that we should not put the login/password for accessing a remote database server directly into a executable file because of the reverse engineering and memory decoding. I do not know if this is what everybody already do, but I prefer to first access some encrypted API with a key or phrase and then receive the login and password (also encrypted) to start accessing the database.

What I do not know is of a good encryption system that can be decryption with the right key or phrase that we use to encrypt the data at first time.

So what I am asking is if it exists and where can I see the solution for working with systems that uses Delphi, PHP, Java and JavaScript? Because there are these different parts of the system that may communicate with that kind of encryption.

I am not talking about something like SHA/MD5, that can't be recovered.

If you're putting a binary on an untrusted computer, and that binary needs to access sensitive information like database passwords, there is literally nothing you can do to ensure the privacy of that information. You can slow attackers down, but if an attacker could do significant damage with those database credentials, your architecture is fundamentally flawed.

For instance, the best you can probably do is to use something like AES-128-GCM to encrypt the credentials. But you also have to disguise the key: typically, this means obfuscating it by "generating" the key through a deterministic process like performing some computations, XORing the result against some fixed data, and appending and shuffling that with the results of other computations.

But now you still have problems. The key itself will be in memory, and once decrypted, so will the database password. And you really can't stop a user from viewing the contents of their own computer's memory.

Again: you can make the problem harder, but if your architecture requires putting incredibly sensitive information like database passwords onto untrusted computers, you are already screwed.


Why do I need both root password and user password in Fedora Linux? I am just now installing (for the first time) a shiny new Fedora 18. I set up a strong root password, installed the whole thing. Now it is asking me to create a user account and a password is obligatory.

What is the purpose of this password?
Provided I selected "Automtic Login", when will this password be asked of me?

The user password ought to be asked when doing an administrative operation (which more or else maps to a call to sudo or something similar). Out of a lot of reasons (including Tradition with a capital 'T'), you should never use the root account directly (except for emergencies); instead, you connect as a "normal user" who is registered (in the /etc/sudoers file or equivalent) as "capable of doing administrative tasks provided he enters his password".

Asking the user password explicitly for administrative operations avoids or at least reduces the nuisance implied by some cases of "lunch-time attacks": when someone forgets to lock his system, and a facetious coworker decides to abuse the situation.


UFW appears to block connections from remote address, but NAT is disabled on my router I'd like to understand what the following line means exactly, because similar lines can by found in my system log pretty often and I would not expect any.

[UFW BLOCK] IN=enp2s0 OUT= MAC=72:8a:bd:21:93:eb:00:02:2a:00:6c:c5:08:99 SRC=45.32.243.178 DST=192.168.0.75 LEN=28 TOS=0x00 PREC=0x00 TTL=241 ID=50074 PROTO=UDP SPT=60000 DPT=52346 LEN=8

UFW has the following status, all my ports should be closed:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

My PC has a local IP (192.168.x.x) and is behind a router facing the public internet that has no rules enabled for NAT, so I suppose all ports are closed and no traffic is supposed reach the local network. I'm not sure I understand that line in the log, but it looks like it blocked a connection from a public IP on the internet to the local IP of my PC. How is this possible, given that my router should not let any traffic in? Is there an explanation, or are there any tests I could run to check my setup? In the past I've had to explicitly open ports (with NAT rules) on my router if I wanted somebody to connect to a service running on my PC, so I'd say I'm pretty sure it should be blocking everything by default now, unless something is very wrong.

As your question isn't precise on some points, I'm making a few assumptions here:

Your "router" is a COTS router, actually a NATing device, not an actual router.
You do have more than one device within the network.
You have not configured the COTS router in a specific ways, leaving it at default settings (maybe apart from changing the WiFi password).

There are several possibilities that can lead to this kind of logs and I am partly incorporating comments on the question in this answer.

Your router might be compromised and have enabled port forwarding without you being able to see this in the GUI.
Another machine in your network might be compromised and sending UDP packets with spoofed IPs.
Your machine might be compromised and opened that forward by sending a packet first (yet, this doesn't usually work out of the box for UDP).
Your machine (maybe for legitimate reasons like peer to peer networking) may be requesting an ephemeral portforward from the router via uPnP.

Generally speaking, you shouldn't rely on a NAT as a kind of firewall. While it generally provides (some of) the effect, it's not designed for security but for usability. On the other side, you seem to be using a local packet filter - which could be configured more rigiously in regards to outgoing packets - that can help reduce risk significantly.


What are some options for a small company on a budget to maintain a bug bounty program? I work for a B2B SaaS startup that doesn't have a lot of money (we're 6 people, 2 developers, have about 6 months of runway, and $25K monthly revenue, < 50 customers).

Common advice that I've seen for small companies/startups is to "do enough" for security (a balance of risk/reward). For us, however, it's at the forefront of our thinking when we're writing code (e.g. we include a security review as an explicit step in our code merge review process, we only use prepared SQL statements, etc.).

Recently a security researcher contacted us about a few vulnerabilities. I told them we don't have an official bounty program, but we're willing to compensate. I said that Slack's program could be a guide of how we could pay (it really depends on the issue and the impact/risk to our business).

The first reported issue was a CSRF attack that could allow a victim to accidentally add the attacker to their account and get full admin access to the victim's account. This was POC since it needs a little bit of work to exploit. We believed that if exploited, it could expose all users of our user's data. Even though it was POC, it could potentially destroy our business. We rewarded them $500 as well as mailed some swag. When we went to pay them, they requested $550 because of PayPal fees. I told them that if we were listed on a site like HackerOne, PayPal still takes out fees regardless of the amount.

They reported an issue for an IDOR attack that could allow any authenticated attacker to "disable" any user in our application. Disabling a user in our application just sets a flag that they can't log in. This attack doesn't disclose any information, and is easily reversible. Right now, we believe that the actual business impact/risk is very low (since it can be reversed and doesn't expose customer data). We fixed this vulnerability immediately. The security researcher was very pushy with their expected reward in their initial report. They quoted $15000 for an IDOR attack on Uber, and $1500 from Slack. I responded and said we're going to internally discuss the reward because we feel the impact is low. They sent a response saying how critical this issue is and how it can cause havoc on our business. English isn't this person's first language (and the reports are dramatic/low quality in terms of communication), but I've cut through that and only focused on the business impact (not the report/reporter).

We want to encourage vulnerability reports and we want to reward/compensate reporters with market rates. However, we don't have a lot of money since we're a startup without any investment. I'm having a large internal struggle of compensating for vulnerabilities vs being out of jobs because our money is going to payouts for vulnerabilities. We don't want to pay nothing, but we want to encourage white hat reports.

Right now, I'm in the mindset of "pay what we feel it's worth for risk/impact of the business". For the second vulnerability, we discussed to be worth $150. When we sent a response with our amount, they've tried to haggle us to $500, and $300 claiming it's unfair.

What advice would you give a small company for creating/maintaining a bug bounty program?

It may not help with your current situation, but consider registering with someone like bugcrowd and posting your reward range.  If someone contacts you asking for something over and above your posted range, politely redirect them to your bounty page and let them know that's all you can afford.

Legitimate researchers will look at your site and decide whether or not your rewards are worth their time.  Smaller rewards may mean less experienced testers will gravitate towards your site; but this way nobody will be surprised.


Do the 'bad guys' create honeypots? I know companies, governments, and other organizations create honeypots (ex: SQLi pages, Open Access Points, Open Ports, etc.) to lure in the bad guys. Are there any examples of the bad guys creating honeypots?

'Good guys' have to limit their actions to things that are 'good,' in order to remain 'good guys.'

'Bad guys' have no such restriction. They can get away with creating honeypots, telling the truth occasionally, and even saving puppies, and as long as they still do at least some 'bad' stuff occasionally, they are still 'bad guys.'

That's a bit sarcastic, but there's some truth to it. I think 'bad guys' do pretty much everything. It's a less restrictive title. Also, 'bad guys' don't exclusively go after 'good guys.' Honeypots can be used to gather information in order to exploit other 'bad guys.'


Is it Possible for a Java Applet to Record Cursor Movements Inside the Applet? I am using my mouse to interact with a Java applet in a browser. Clearly the party that owns the Java applet can record where I click inside the applet. What I'm wondering about now is whether it is possible for that party to also record the movements of my cursor (i.e. the paths I take when I move my cursor around) within the Java Applet. Is this possible?

I know that it is possible to track user mouse movements within the browser window using JavaScript.

Yes, it is possible to track mouse movements with Java:

http://docs.oracle.com/javase/tutorial/uiswing/events/mousemotionlistener.html

Or

https://stackoverflow.com/questions/18321877/tracking-mouse-movement-in-java

Or

http://mrbool.com/creating-a-simple-mouse-analyzer-with-java-swing/24507


Low priv users for Windows Services This is about secure configuration of Windows Services. I've noticed many many times that software developers, when designing software for the Windows platform, don't spend enough time on the principle of least privilege. Because it is so easy and quick, they install their services to run as LOCAL SYSTEM even though lower privileges would do fine, say, access to the file system and registry for binaries and configuration and network access to accept incoming connections and connect to a database. On Windows, there are, however, the users LOCAL SERVICE and NETWORK SERVICE.
Here is my question: Could I run a simple server (like described above, access to file system/registry, network access) as NETWORK SERVICE? Are these 2 users provided by MS for such a situation? Or am I as a developer supposed to investigate myself every single time which privileges are needed even if my service doesn't do anything extraordinary? If e.g. NETWORK SERVICE is not sufficient, which tools would I have to use in order to create a user in order to still follow the principle of least privilege?
I find this extremely relevant. If you succeed to inject code into a php application running on apache as www-data you still need a tedious privilege escalation to fully compromise the machine. On linux this particular issue is solved a lot better by default.

Here is my question: Could I run a simple server (like described
  above, access to file system/registry, network access) as NETWORK
  SERVICE? Are these 2 users provided by MS for such a situation?

Yes you can and you should. The network service account is (as I remember it) the least privileged machine account with limited permissions.You actually will get an Insufficient  Exception, if it turns out, your application requests resources for which the Network Service account does not have the rights to. You would then simply grant rights to what ever resource you're trying to access and then build on that, but for your high level requirements you describe here, access to file/registry and network it should be sufficient.

True, if your application creates a new eventlog source or registry key, you would need to explicit grant the rights to the network service account, should be no big deal for you/devops.

You could also consider using a domain account, say if you want to isolate your application/service from how shall I say it: an over time fragmented permissions changes to the general Network service account.

I would suggest you read up on those accounts in general:
https://msdn.microsoft.com/en-us/library/windows/desktop/ms686005(v=vs.85).aspx

  If you succeed to inject code into a php application running on apache
  as www-data you still need a tedious privilege escalation to fully
  compromise the machine

regardless of priv. esc. of (www) is tedious or less tedious (personally I think it's pure fun), if you're at that point where you found a bug in your service that can be priv. escalated, it usually boils down to poor patch management on your box and not so much your service at that stage.


Is storing a user's IP address, in their browser, a security concern? I need to get the users IP address on the server. For technical reasons it's a lot easier for me to just pass it in from the client in the form of a query string.

So, on page load I would store their IP address in a JavaScript variable. Then when it comes time to call the server I'll send it back.

I can imagine if someone was using TOR or a VPN they might not want their IP address to be included in the URL of an AJAX. But my users don't have extreme security concerns like someone who his using TOR. Still, I don't know if it's bad practice to store their IP in JavaScript and then pass it to the server as part of a query string.

This is like asking can you safely store someones mailing address inside a postcard from/to the person.

No, this isn't a security concern unless the user is using something like TOR and even then its not the end of the world because it will be the exit nodes IP.


Meterpreter connections If i setup a meterpreter reverse_https payload and send to multiple targets and they execute the payload whithout my handler running, when I setup the handler will they connect or do I have to have the handler always running for the targets to connect?

After the introduction of transport resiliency in the meterpreter stagers, it will attempt to connect to the handler every 10 seconds (by default) in order to establish a connection with the handler. You can control this through the SessionRetryTimeout setting at the time of generating the stager. This behavior will be repeated till the current time is less than the SessionRetryTotal setting. By default it is 1 hour.

So in short, if listener is not available when the stager is executed at the targets, in the default state it will attempt to connect to the handler every 10 seconds for a period of 1 hour.

Further details are available in the Meterpreter Timeout Control wiki.


memorable word and answers to security questions when resetting password? Context

We have a situation where we are allowing our users to login using either using Username & password + Memorable word OR Username & Password + answer to Security questions depending on configurable options by the client.

When user requests a password reset they are sent an email and linked back to a password reset workflow.

I fully understand that both memorable word & answers to security questions are sub-optimal solutions at best.

A couple of questions:

when a user initiates a password reset should they be required to reset answers to their security questions & Memorable word as well?
Given that both additional steps ( either answers to security questions or Memorable word) are actually less secure than username & password what are the merits of reseting them?

You should send the password reset link (or code) to a predefined email address (or phone number). This is the only protection in this scenario.

So called "security questions" are not "less secure" they are totally insecure and if used incorrectly they decrease security as discussed here Do security questions subvert passwords?. The only reason to use them might be preventing bots from proceeding through password reset page.

Regarding your second question: asking users to reset them each time will likely only increase burden on your help desk, because after third password + "security question" reset users might start putting things that they cannot easily remember and will look for other ways of contacting your company.

In addition (I know you are considering this requirement only for "forgotten password" option), if you'd require users to perform too much manual processing when changing passwords, you might turn down more security-conscious users who use password managers to automatically update their passwords.


Is there an equivalent of npm audit for nuget packages? I'm working on a couple of large .NET web apps and would like to audit the packages used in them. For node projects I've use npm audit. This checks whether your npm packages or their dependencies have any known vulnerabilities.

Is there a similar project for .NET?

Another option is my project: https://github.com/RetireNet/dotnet-retire

It only reports Microsoft packages and works only on .NET Core projects. It does include runtime vulnerability checks, though.

I wrote about it here:

https://blogg.blank.no/hunting-for-vulnerable-nugets-in-net-core-3c37f30e467a
https://blogg.blank.no/automatic-reports-for-vulnerable-asp-net-core-runtimes-426ebcd93ad0


Single domain SSL certificates, actually support 2 subdomains? While browsing for SSL certificates, specifically domain validation type (the cheapest), I noticed that they advertise as valid for a single domain/subdomain, but then I noticed that they are valid for a single subdomain along with the root domain.

One of the certificates advertise as Secures 'www' & 'non-www'.

Is that common for domain level validation certificates ?, and should I expect all domain level validation certificates to be able to secure the root domain and a single subdomain ?

I have seen it too -- my own server uses such a certificate, with two names in it: example.com and www.example.com.

The notion of "domain certificate" is not technical; it is a marketing term. From the technical point of view, an X.509 certificate contains a Subject Alt Name extension which may contain zero, one, two... or really many names of type dNSName. It is up to each CA to decide what it sells and at which price.


Why should one not use SSL? I see a lot of posts all over the web asking whether or not they should be using SSL to secure their website, or if it's really necessary to do so when the content of their site does not contain or request sensitive data.

Let's make the assumption here that the cost of the certificate is not the issue, considering it's not extremely expensive to get an SSL certificate.  Why would you even want to host a page that isn't secured with SSL?  Most all web servers support SSL out of the box, and it's usually quite simple to get it setup (especially with IIS.)

There are a number of reasons not to use SSL, none of which being a good reason in itself, but cumulatively they can explain a lot of things.

The main reason not to use SSL is an effect of the strongest force in the Universe, i.e. laziness. However easy setting up SSL is, not setting it up will still be easier. This alone explains why so many sites still use HTTP only, not HTTPS. A great many sites can get away with it, and not being attacked, because there just are not enough attackers around to attack every site, by a long shot (and attackers are no less lazy than everybody else).

Among other reasons, one can cite the following:

Hosting several HTTPS Web sites with distinct names on the same IP address has long been difficult, especially when the various sites don't know each other (either the server uses a certificate with all the names, but this can result in apparent and unfortunate associations, or the server relies on SNI, which does not work with Internet Explorer on WinXP).
SSL prevents some types of caching, in particular the transparent proxying that some ISP are quite fond of. This implies extra bandwidth requirements for the server (hard data on the increase is difficult to come by, and depends on the site type; for instance, a Web-mail interface like Gmail would be unlikely to benefit from heavy caching anyway, contrary to a picture-heavy site).
In (much) older days, HTTPS Web sites were not indexed as thoroughly as non-SSL sites, resulting in a widespread idea that you get better indexing by shunning SSL (that one has been wrong for quite some time now, but old ideas are hard to eradicate).
Some people still have the feeling that SSL implies a heavy computational cost (that one isn't correct either, but still common).
As an ironic twist, some people fear that using SSL would project the impression that they do care about security, thus increasing the reputation backlash if (when) they get hacked. The idea being that if you never claim or let it believe that you ever gave any attention to the concept of security, then maybe people will be more indulgent when they discover how much indeed you disregard it.


Session hashes - how it works? There's a website I visit and I can't understand fully the login process and session hash it creates and uses to keep track of logins and such.
Would someone help me understand what goes on in server and what happens to session IDs and login info? (saved in a cookie file)
I enter my username and pass, a cookie is saved to my PC named PHPSESSID.
It contains a 32 character hash (MD5?)
It says it expires when session ends.
If I logout and login again (even using the same username) this hash changes. Needless to mention, logging in with other usernames also makes this hash change.

If this hash is made from my username and pass, why it changes?
Is the subject of salts related to my question?
If salts are used in generating this hash, and if salts are random, how the server side compares the hashes in their database, to the hash made from my user/pass+random salt?

It seems my questions are quite far apart in category, sorry about that.
This website I'm talking about has a history of mixed logins (though rare). Like when I login using my username/pass I accidentally go to another users session.
Where is the security weakness of this procedure? (which probably is the reason for the mentioned mixed-session logins)

A session is data stored on the server corresponding to some client. To know which data to access, the client gets a cookie with a session identifier. The value of this identifier is not meaningful, it is just a token to obtain the correct data. For example, if your session identifier is abcd1234, the server will look in /var/sessions/abcd1234.txt for the session data.

The session identifier you mention is likely randomly generated and not derived from the username, password, or salt.


Browser blacklists & the Symantec-Google Certification Debacle Background:
As explained e.g. on this Google company blog, Google writes that:

  On September 14, around 19:20 GMT, Symantec’s Thawte-branded CA issued
  an Extended Validation (EV) pre-certificate for the domains google.com
  and www.google.com. This pre-certificate was neither requested nor
  authorized by Google.

According to this newer Google blog entry, it looks like the issue of fake certificates has been even worse:

  Symantec performed another audit and, on October 12th, announced that
  they had found an additional 164 certificates over 76 domains and
  2,458 certificates issued for domains that were never registered.

  It’s obviously concerning that a CA would have such a long-running
  issue and that they would be unable to assess its scope after being
  alerted to it and conducting an audit.

In that newer blog entry, Google states that they are requesting additional information from Symantec on how this could have happened.

However in their official report about this it looks like Symantec is downplaying the severity of creating these certificates. In the "Addendum - October 12, 2015" section (starting on p.4) the company refers to these as "test" certificates (emphasis mine):

  On October 8, 2015, after follow-on questions from industry partners,
  we reopened our investigation, and identified a set of test
  certificates that were not included in our original analysis.

  While our current investigation is ongoing, so far we have found 164
  additional instances where test certificates were inappropriately
  issued. All of these test certificates have been revoked. These test
  certificates were spread over 76 domain owners whom we are in the
  process of contacting.

On p. 2 of the report (before this addendum section was added to it), Symantec says that:

  Most importantly, these test certificates never posed a risk to anyone
  or any organization, as the certificates never left Symantec’s secure
  test labs or the QA test machine, and they were never visible to any
  end user. [...] One of these test certificates with a
  CN=www.google.com was an Extended Validation (EV) test certificate and
  was logged to public Certificate Transparency (CT) log servers which
  is standard practice by default for EV certificates issued by CAs.
  Logging to a CT server did not in any way make the test certificate
  usable – it was only detectable by CT monitors.

Above explanation seems(?) to clarify how Google was able to find out about the certificates (through the CT monitors) if they never left the Symantec test labs.

On one hand it looks like Google is making quite a big deal about this incident, while Symantec is acting like it was just some 'testing thing'.

The questions I would like to ask are however about this section in p.2 of the Symantec report...

  The list of organizations impacted by these test certificates includes
  Google, Opera, and three (3) other organizations who have not
  requested or approved disclosure of their domains.

...and this section on the last page where the report says:

  We have received requests from the Browser community for the
  certificate details so they can update their black lists accordingly.
  The certificate details are available here for their reference...

...after which the report provides two links:

"List of Test Certs of Owned Domains", and
"List of Test Certs of Unregistered Domains"

I am not sure but it seems that the domains of those 3 "other organizations" that did not want their domains disclosed would not be on the blacklist.

The questions are:

Why would browser community need/want a blacklist if these "harmless" certificates
never left the Symantec test labs?
On another hand, if this is a more some serious thing, it would be helpful for browser users to have a blacklist of affected domains. In this case, why would 3 organizations not want their
domains disclosed?

(Update: re-wrote the 2nd question to ask specifically about the reasoning why the 3 organizations might not want their domains disclosed.)

Why would browser community need/want a blacklist if these "harmless" certificates never left the Symantec test labs?

These are certificates for official and even critical domains. There were created and signed by an official CA. A certificate is just some data which can be easily copied. So how do guarantee that they never left the lab? Should you really trust the claims of a CA which  obviously has not enough control over its internal processes to make sure that such certificates gets not issued at all?

  If this is not some serious thing but part of some internal testing inside Symantec, why would 3 organizations care about if their domains are disclosed or not?

This is serious, see above.


Session Identification Hashing - How to make it more Secure and Robust I wrote a PHP class which handles Session and store them in DB instead of normal Files in the server, you can find it on My Session Handler Class

In that post a user by name @AnotherGuy has raised some security concern/flaws about my Session Fingerprinting methods, which seems valid to me, and I am quoting him below :

  Now to the last thing I will talk about. As said in the start I am no
  security expert, but I feel like your fingerprint solution is fishy.
  Imagine two different people from the same company using your site.
  The company uses a load balancer, which makes their IP address the
  same. If all company's browsers/clients are the same your fingerprint
  for these two people would be identical. Even though you are checking
  HTTP_X_FORWARDED_FOR headers you cannot rely on load balancers to send
  the header. I cannot tell you how to properly detect sessions using
  the fingerprint idea.

He was referring to the functions getFingerPrint() & _isSuspicious($fp)

    /**
    * [_getFingerPrint generates session fingerprints md5(USER AGENT + SECURE SESSION + IP ADDRESS)]
    * @return [strings] [encryted session info fingerprint]
    */
    private function _getFingerPrint()
    {
        return md5($this->_user_agent.self::SECURE_SESSION . $this->_ip_address);
    }

    /**
    * [_isSuspicious check for possible session hijack attempt, by comaparing encrypted user system specific values against exoisting records ]
    * @param  [string]  $fp [session fingerprint]
    * @return boolean
    */
    private function _isSuspicious($fp)
    {
        return ($fp != $this->_getFingerPrint()) ? True : False;
    }

I am using getFingerPrint() to generate a session hash using user agent + salt + ip address, and _isSuspicious() to check the fingerprint generated again against the fingerprint stored in Database.Well it seems to address security risk upto same extent, but when users are in Local Network(LAN etc) and also use same browser agents they seems to br viable to the security risk of session hijacking.

Also I am using the below function to get user's IP address,

/**
     * [_getRealIpAddr Get the IP address of the user]
     * @return [strings] [IP address of the client]
    */

    private function _getRealIpAddr()
    {
      if (!empty($_SERVER['HTTP_CLIENT_IP']))
      {
        /*check ip from share internet*/
        $ip     =   $_SERVER['HTTP_CLIENT_IP'];
      }
      elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
      {
        /*to check ip is pass from proxy*/
        $ip     =   $_SERVER['HTTP_X_FORWARDED_FOR'];
      }
      else
      {
        $ip     =   $_SERVER['REMOTE_ADDR'];
      }

      return $ip;
    }

Now how can I make make this session hashing more robust when users share same network pool.
The first solution comes to my mind is adding a COOKIE(random salt/number etc) to the hashing which will be particular to user specific system and in spite of having same User agent & ip address two users will have different Local Cookies. Anyone has any other better solution/options or completely different way to handle this situation ?

Edit 2 : What about using EVERCOOKIE [ but what if javascript is disabled ? ] !

A lot depends on what it is your trying to do and what the risks are associated with session hijacking. Generally, if you have a real need to ensure the session is actually owned by the right user, you would add additional checks, such as username and password etc.

The EFF has been doing a bit of work on how you can do browser fingerprinting to track people. It is possible that this work may provide you with some ideas/pointers on how you could increase your fingerprinting techniques.

See PanoptiClick


Should I activate HSTS with Let’s Encrypt Certificates? I recently set up a web server that—among others—serves ownCloud to some of my users. I got a Let’s Encrypt SSL Certificate because I didn’t want to use a self-signed certificate like the one ownCloud uses out of the box. I configured Apache to rewrite all HTTP traffic to HTTPS correctly.

Now ownCloud shows me a message constantly, asking me to enforce HSTS (HTTP Strict Transport Security). Given that Let’s Encrypt Certificates are only valid for 90 Days and that my HTTP redirection already works, should I really enforce HSTS?

Yes, you should activate HSTS.

HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect to your website over SSL after their very first visit (trust-on-first-use) and until the specified timeout is reached.

The choice whether to activate HSTS or not doesn't really depend on which CA you're using rather than if you are sure you will continue to support HTTPS in the future. That is, as soon as you disable HTTPS again, any user whose HSTS timeout hasn't expired yet will be unable to connect to your site. If you are unsure about how long you will keep SSL support, you might want to start with short HSTS expiry times to avoid locking out your visitors for too long.

Don't confuse HSTS with HPKP: A HTTP Public Key Pinning header tells the browser to associate a specific public key with your site. Here, pinning for the wrong or expired certificates can make your site unavailable to previous users. But for HSTS, the particular certificate chain doesn't matter and you can change it as needed.


Iterated salted sha256 hashes hashcat I have a hash which was generated by concatenating a password to a salt, then repeating hashing 10000 times.

The description for salted sha256 in the output of hashcat -h is

1410 | sha256($pass.$salt)                              | Raw Hash, Salted and/or Iterated

but I was unable to find any examples online as to specifying an iteration count for iterated salted sha256. Is this possible with hashcat? If it is, how would I specify the command line options to hashcat for this?

There's currently no support for arbitrary iteration in hashcat.

The iterations that hashcat does support are either only exactly as shown in the hash type:

2600 | md5(md5($pass))
4500 | sha1(sha1($pass))

.... or else - for the subset of hashes that natively support it - as embedded in the hashes themselves (rounds=10000, etc.)

It sounds like your salt is only concatenated once, not on every iteration? If so, you can concatenate it manually - and then you only need to find a tool that has support for simple iterations.

If you know enough C, you could add your rounds to the appropriate hashcat module.

You can also do arbitrary iteration with MDXfind, using its -i parameter.

$ cat test.hash
2f9b999e6ec7fe0964bc3827baf33eda331f154056c9c9686bcd77c5395ec597

$ cat test.list
PASSWORDPARTsaltpart

# MDXfind hash type (-h) is a rough regex filter, so you have to anchor the regex
# at both ends to only include exactly that hashtype (and not other hash types
# that happen to include the string 'SHA256')

$ mdxfind -h '^SHA256$' -f test.hash -i 10000 test.list
Iterations set to 10000
Working on hash types: SHA256
Took 0.00 seconds to read hashes
Searching through 1 unique hashes from test.hash
Maximum hash chain depth is 1
Minimum hash length is 64 characters
Using 4 cores
SHA256x10000 2f9b999e6ec7fe0964bc3827baf33eda331f154056c9c9686bcd77c5395ec597:PASSWORDPARTsaltpart

Done - 1 threads caught
1 lines processed in 0 seconds
1.00 lines per second
0.01 seconds hashing, 10,000 total hash calculations
0.85M hashes per second (approx)
1 total files
1 SHA256x10000 hashes found
1 Total hashes found


Debating between architecture options for offline updating of Linux machines in a vertically segregated network My coworker and I are discussing the pros/cons between two potential architecture options, and I would like to gather feedback on which option is better and why.

First, a description of the environment:  We have a vertically segmented network into multiple levels.  Level A is our internet facing level, with a firewall controlling boundary access from level A to the internet and vice versa.  We then have Level B which is seperated with a firewall controlling access to and from level A.  We then have level C which is seperated with a firewall controlling access to and from level B.  Therefore, level C is more trusted than level B, which is more trusted than level A.

In an effort to reduce the amount of cross firewall traffic, as well as tighten the firewall rules associated with what can communicate between levels, we have decided to implement an ubuntu mirror in each level, from which machines on that level will update (e.g. Level B machines update from the level B repository, level C machines update from the level C repository, etc)

Now the options:

Option 1: create a mirror on level A which mirrors from archive.ubuntu.com, then create a mirror on level B which mirrors from the level A mirror, and then create a mirror on level B which mirrors from the level B mirror.

option 2: create a mirror on level B, which mirrors from archive.ubuntu.com, then create a mirror on Level A and C, both of which update from the Level B mirror.

Both of us have discussed the pros/cons of these methods, as well as our justifications for both of these options, however I do not want to introduce any bias, so I will not post up our justifications for either of these two options.

Many thanks.

My personal vote is that those are pretty much equivalent. Presumably in both cases only the ubuntu mirror host is allowed to reach out, and only to the official mirror site. Whether the B mirror is allowed to reach out directly, or has to proxy off the cache in A seems like splitting hairs. Either way it's getting the same cryptographically signed data from the same source.

I feel like you almost certainly have better things to spend your time locking down than this -- how's your VPN setup? Have you manually verified the GPG keys in APT? Are there packages / services on those machines that don't actually need to be there? etc.


How trustful are KeePass plugins? KeePass is great, I love it but after several years using it, sometimes I wish to install a plugin but I don't because I'm scared of what this plugin can really do without my consent.

The documentation about plugin development is really short. I downloaded and compiled the source code but I don't understand where is the API list of functions plugins have access to.

As said in the documentation, the PLGX format is a "not yet compiled" format

  Instead of compiling your plugin to a DLL assembly, the plugin source code files can be packed into a PLGX file and KeePass will compile the plugin itself when loading it

So it should be possible to read these files. How to do this?

Let's take the example of Favicon downloader or even Password counter. These 2 plugins clearly show that they both have access to internet and my passwords. So how can I be sure they don't steal them? I mean they could just send all my information to a server and I'd never know it.

So if there is no way for me to read the PLGX files, the only way to ensure an optimum security is to develop my own plugins by myself?

So in short, the only way to ensure an optimum security with the KeePass plugins is to review their codes by yourself.

The only problem is that some of them are open source, some others are not. Moreover in case of an open source plugin, you can't be sure the PLGX file you downloaded really correspond to the public available source code. Therefore either you generate the PLGX file by yourself or you review the code of the PLGX file directly.

I chose the second solution as it also allows to review the code of non-open source plugins.

I modified a tiny bit the code of KeePass 2.35 in order to achieve that. The project with installation instruction is available at https://github.com/jmevel/KeePassPluginsSourceCode

The code is quite simple and resides in the KeePass/Plugins/PlgxCsprojLoader.cs file only.

I won't provide you the keepass.exe file directly because it doesn't make sense, you have to compile it by yourself. Otherwise how would you know what this .exe file is really doing...?

Happy code review everybody!


How Hole 196 actually works ? What WPA parameters does it exploit? While dealing with wireless set I came across the term Hole 196. Got to know that preventions too. But can it still bypass Client isolation and standard preventive approach if packets are crafted at raw level or by exploiting gtk renewable procedure?

Are non RSN and TSN networks too vulnerable?

The hole 196 flaw consists basically in take advantage of what page 196 of the standard says... it says that messages sent with group keys, ie keys intended for broadcast communications, do not have protection against spoofing. Thus, an attacker can send a message with a GTK key with the IP that he wants.

The point of the attack is to send a message with a GTK key but directed to a target MAC instead of a broadcasting MAC address. By doing this, only the victim will process that broadcast packet and, therefore, unless the ARP table has static resolution for the MAC of the gateway, IP poisoning will occur which will allow the router to be supplanted.

Since that moment on, when the victim communicates with the Gateway, the PTK keys associated with that IP will be used, which the attacker will kindly deliver to make the MITM. Simple but functional.

It doesn't care if is a Robust Secure Network using WPA2 and AES. It can be performed anyway but with client isolation you can avoid the problem. Anyway, performance will be compromised.


How secure can IP based login be? From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. One of the reasons is obvious, multiple actual users can use the same IP address.

Our idea is not new: we want a one-time validation and from that moment on allow any computer in a certain IP-range certain light-weight editing access to a website (consider: all employees of a company that are within that range). Plus we want to be able to configure this beforehand on the receiving server.

I understand it is possible and easy to spoof an IP address
A spoofed IP address cannot receive an answer from your server
When behind a proxy or router, is there a related way that allows me to identify the user/original source system, i.e. something similar to the HTTP X-Forwarded-For header?

I'm particularly interested by the second item. According to Wikipedia, it is very hard but not impossible to catch the answer packet of a spoofed IP address. It doesn't specify what's needed though.

What would you recommend provided the requirement is to be able to configure this IP-based (or related)?

First of all, I need to emphasize that IP address can never be used to authenticate a user, it can only be used to (attempt to) validate a host. Even if IP address were perfectly tied to an exact computer on an exact network port, we'd still have no guarantee that a particular user was at the console of that computer at that time. So if you are trying to ensure that the resources you are protecting can only be accessed by a particular user, you need to be doing user-level authentication of some kind.

Now it may be that you only want to limit access to, say, people who work at a certain business, or who go to a certain school, or who live in certain house. So you believe that IP-only validation is worth the additional risk. Even then you can't guarantee your data is going to the right place.

A wireline example I can think of is this. Let's say I am a cable internet subscriber and I want to intercept my neighbor's IP traffic. Our cable provider uses DHCP to assign addresses to us from a pool of addresses set aside for dynamic IP addressing. Conceptually, I can intercept his address by discovering his IP address; discovering his MAC address; setting my MAC address to be a clone of his MAC address; rebooting his cable modem (e.g. by interrupting power or cable to his house); issuing a DHCP request.

Since many DHCP servers usually try to assign MACs the same IP they had previously, the cable provider will assign your IP to me. Now this won't work forever - the cable provider will eventually see an IP address collision and investigate the issue. But by that time I may have already stolen your data.


Does HTTPS protocol leak HTTP body length? It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead).  Besides that, does the HTTPS protocol also allow the hacker to recover the length of the HTTP body (either compressed or not)?

I ask because this is related to whether or not "adding a string of random length to the HTTP header" can hide the compressed HTTP body's length, to mitigate (but I know cannot totally prevent) a BREACH attack.

If the answer is no, does anyone know other risks in placing the random-length string in the HTTP header, instead of in HTTP body, to mitigate a BREACH attack?

Distinguishing header from content is usually not the hardest part of cryptanalysis. This is because headers usually come with a specific structure, common length range and limited value variety.

Yes, SSL/TLS is leaking length details which might be used for multiple classes of attacks. In some cases an attacker might be even able to determine content information. Check the Bicycle Attack for some details: https://www.scip.ch/en/?labs.20160317

Padding is a good idea to prevent such attacks. There is no notable downside by definition regarding security adding such a feature.


Where can I get a list of "bad" IP addresses that are likely to be used by attackers or spammers? Is there an open source project or a list of "bad" IP addresses or ranges that are likely to be used by attackers or spammers?

UPDATE: ideally I want it to be a service call so I can call it using HttpClient or with JSON from my web page and get a yes/no
(I find it hard to believe that no one has yet created such a web service)

Is there an open source project or a list of "bad" IP addresses that are likely to be used by attackers or spammers?

What you looking for are open source Threat Intel feeds. There are a number of them you can subscribe to or likely query. Here are a handful I know of and should lead you in the right direction.

Collection of long list of lists on GitHub.
Emerging Threats
AlienVault
Zues Tracker
Palevo Tracker
Abuse.ch
Malc0de List
Binary Defence List


Does plain text mode offer complete protection against e-mail malware? As far as I know, malware can spread with an email message either via an attachment file or a link that a user deliberately opens and via vulnerabilities in the email client in the JavaScript (if enabled) or HTML engine. So considering that the user:

Does not click on any link or opens any attachment in the malicious
mail.
Disables JavaScript execution.
Enables plain text mode.

Will this offer a complete protection against e-mail malware?
Is this depending on what email client someone is using? (ex. Thunderbird, Evolution). Can vulnerabilities in the email client still be exploited, even in plain text mode?

Before HTML and Javascript were even invented, attackers were using ANSI escape codes in email bombs.

Silly: such as turning your terminal into a blinking rainbow of text

Annoying: gunking up the terminal so badly it couldn't be used without a reset

Embarrassing: nobody wants to be that guy in the lab whose VT-100 won't shut up

I don't know that code execution was ever a product, but don't underestimate the damage somebody with a termcap man page can do.


Why can't cookie hijacking be prevented by associating cookies with IPs? I just started reading about cookies and all the ways I can get them wrong and allow cookies to be hijacked which allows attackers to do things like impersonate a logged in user.

I don't understand why this can't be solved by simply having the server add to each cookie a signature determined by the rest of the cookie, a secret key on the server, and the IP of whoever is making the request. Stolen cookies would then be mostly useless for anyone who can't receive a response at that IP. Any readable data in a stolen cookie itself could still be accessed but stolen cookies couldn't be used to impersonate someone else.

Why doesn't this work? Is there some way to receive packets bound for an IP address that you don't control? I know that on my local network I can read packets meant for other computers on my local network but I don't think there's any way to send a copy of all the packets meant for stackoverflow.com to my residential IP.

If this was our only means of security you could still send spoofed requests but you couldn't trick the server into sending anything back to your own IP (I think) which still seems useful.

I didn't find anything about associating cookies with IPs on google so I figure this doesn't work but I don't know why.

If the cookie gets stolen inside a public Wifi Hotspot all users of the Hotspot have usually the same public IP address.  This means binding to an IP would not help against an attacker in the same local network.

Apart from that if the public IP of users changes like it is the case with moving between networks (Mobile, WLAN university, WLAN at cafe, WLAN at home...) they would need to login again and again.


What's the best web application security program to learn XSS? I am learning web application security testing; specifically XSS. With so many web app programs, I wonder which is easiest to setup/configure, which is easiest to learn XSS, and which application the InfoSec community prefers? Thanks in advance

OWASP's security shepherd is really good for learning, and you can configure it to only show challenges for specific types of vulnerabilities if XSS is all you're focusing on right now. You can download a VM here and get it up and running in less than 10 minutes. If you're looking for less structure, there's BeeBox, which has pages where you can play around with vulnerabilities at different difficulty levels. That can be downloaded here.


Meaning of mod_ssl cipher suite put together and order of preference I read cipher suite description of mod_ssl, and understood the meaning of alias and keywords like ! + etc. But I am unable to understand how to read ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW completely specially when it comes to priority using +.

When I try to use openssl to undestand how ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW is interpretted by Apache then still there is not much help, because ALL: suggest me that ALL ciphers should come, but it is not.

Also, in the below o/p is cipher suite is listed in order of preference they would be chosen by Apache?

[apache1@hagrawal conf.d]$ openssl ciphers -v 'ALL!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW'
DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-DSS-AES256-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA1
AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-DSS-AES128-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA1
AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1
KRB5-DES-CBC3-MD5       SSLv3 Kx=KRB5     Au=KRB5 Enc=3DES(168) Mac=MD5
KRB5-DES-CBC3-SHA       SSLv3 Kx=KRB5     Au=KRB5 Enc=3DES(168) Mac=SHA1
EDH-RSA-DES-CBC3-SHA    SSLv3 Kx=DH       Au=RSA  Enc=3DES(168) Mac=SHA1
EDH-DSS-DES-CBC3-SHA    SSLv3 Kx=DH       Au=DSS  Enc=3DES(168) Mac=SHA1
DES-CBC3-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=SHA1
KRB5-RC4-MD5            SSLv3 Kx=KRB5     Au=KRB5 Enc=RC4(128)  Mac=MD5
KRB5-RC4-SHA            SSLv3 Kx=KRB5     Au=KRB5 Enc=RC4(128)  Mac=SHA1
RC4-SHA                 SSLv3 Kx=RSA      Au=RSA  Enc=RC4(128)  Mac=SHA1
RC4-MD5                 SSLv3 Kx=RSA      Au=RSA  Enc=RC4(128)  Mac=MD5
KRB5-DES-CBC-MD5        SSLv3 Kx=KRB5     Au=KRB5 Enc=DES(56)   Mac=MD5
KRB5-DES-CBC-SHA        SSLv3 Kx=KRB5     Au=KRB5 Enc=DES(56)   Mac=SHA1
EDH-RSA-DES-CBC-SHA     SSLv3 Kx=DH       Au=RSA  Enc=DES(56)   Mac=SHA1
EDH-DSS-DES-CBC-SHA     SSLv3 Kx=DH       Au=DSS  Enc=DES(56)   Mac=SHA1
DES-CBC-SHA             SSLv3 Kx=RSA      Au=RSA  Enc=DES(56)   Mac=SHA1

Second question:
Generally in Apache cipher suite is specified as SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW but can it be specified as SSLCipherSuite TLS_RSA_WITH_RC4_128_SHA, which means instead of specifying the alias and connecting them, directly specifying the cipher I want to use. If I try this can it blow something on my Apache?

I tried using SSLCipherSuite TLS_RSA_WITH_RC4_128_SHA and I got below error. At least Apache should have started, no?

[Tue Aug 18 07:53:02 2015] [info] Configuring server for SSL protocol
[Tue Aug 18 07:53:02 2015] [error] Unable to configure permitted SSL ciphers
[Tue Aug 18 07:53:02 2015] [error] SSL Library Error: 336646329 error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match

I am trying to build the below preference of cipher suites.

SSL3-RSA-RSA-NONE-0-MD5
SSL3-RSA-RSA-NONE-0-SHA
SSL3-RSA-RSA-RC4-128-MD5
SSL3-RSA-RSA-RC4-128-SHA
SSL3-RSA-RSA-DES-56-SHA
SSL3-RSA-RSA-DES3-168-SHA
TLS1.0-RSA-RSA-AES-128-CBC-128-SHA
TLS1.0-RSA-RSA-AES-256-CBC-256-SHA
TLS1.2-RSA-RSA-NONE-0-SHA256
TLS1.2-RSA-RSA-AES-128-CBC-128-SHA256
TLS1.2-RSA-RSA-AES-256-CBC-256-SHA256

Don't write, generate.
Use the Mozilla SSL Configuration Generator
Gory details
You get 20 lines of cipher suites. On my version of OpenSSL I get far more cipher suites.
As of today, I've got a total of 139 to pick from:
$ openssl version
OpenSSL 1.0.2d 9 Jul 2015

$ openssl ciphers -V 'ALL' | wc -l
131

$ openssl ciphers -V 'ALL:COMPLEMENTOFALL' | wc -l
139

Yeah. ALL does not in fact mean "All".
Now let's build the cipher list one option after the other and see how the numbers change:
$ openssl ciphers -V 'ALL' | wc -l
131

$ openssl ciphers -V 'ALL:!ADH' | wc -l
117

$ openssl ciphers -V 'ALL:!ADH:!EXPORT' | wc -l
110

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2' | wc -l
106

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA' | wc -l
106

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH' | wc -l
106

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM' | wc -l
106

$ openssl ciphers -V 'ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW' | wc -l
106

The numbers didn't change at all for the last 5 options. So this suggests to me that that cipher string has been constructed for a different version than mine. And/or is just wrong/pointless.
EDIT2015-08-19: Wrong. As @dave-thompson-085 helpfully pointed out: the cipher suite count is not supposed to change for any keyword with the + sign in front. It only sorts what's already there. (I mistakenly thought that it both added and then sorted.)
But then again I've got no idea what the original author of the cipher suite string intended to do.
OpenSSL Cookbook
Ivan Ristic of SSL Labs publishes a free chapter of his "Bulletproof SSL and TLS" online. This is called the OpenSSL Cookbook (archived here) and does a good job of explaining the dreaded cipher suite string in the Cipher Suite Selection section.
TLS_RSA_WITH_RC4_128_SHA

If I try this can it blow something on my Apache?

Yeah. You'll lock out anybody who has blocked RC4 client side. (Such as Google Chrome. And Firefox is also moving in that direction.) Not a good idea. But easily fixed. Just put the old string back and restart Apache.
By the way: OpenSSL command line option parsing is terrible.
$ openssl ciphers 'RC4'
ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AECDH-RC4-SHA:ADH-RC4-MD5:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:PSK-RC4-SHA:EXP-ADH-RC4-MD5:EXP-RC4-MD5:EXP-RC4-MD5

$ openssl ciphers 'RC4:!OPENSSL:+OPTION:PARSING:!MAKES:+ME:A:!BIT:+SAD:SOMETIMES'
ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AECDH-RC4-SHA:ADH-RC4-MD5:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:RC4-MD5:PSK-RC4-SHA:EXP-ADH-RC4-MD5:EXP-RC4-MD5:EXP-RC4-MD5

Yes, that's the same output both times. And no error messages.
EDIT 2015-08-19: How to get Cipher Suite names
You listed some cipher suite names that don't actually exist.
Here's the general recipe on how to get the OpenSSL names: You list everything and then grep for the bits that you want. Like so:

SSL3-RSA-RSA-NONE-0-MD5

$ openssl ciphers -V ALL:COMPLEMENTOFALL | grep -i 'kx=rsa' | grep -i 'au=rsa' | grep -i 'Enc=None' | grep -i 'mac=md5'
      0x00,0x01 - NULL-MD5                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=MD5

So the only cipher suite that satisfies these criteria is NULL-MD5. (That's the OpenSSL name. The official IANA name of this would have been TLS_RSA_WITH_NULL_MD5.)
Here's another example:

SSL3-RSA-RSA-NONE-0-SHA

$ openssl ciphers -V ALL:COMPLEMENTOFALL | grep -i 'kx=rsa' | grep -i 'au=rsa' | grep -i 'Enc=None' | grep -i 'mac=sha1'
      0x00,0x02 - NULL-SHA                SSLv3 Kx=RSA      Au=RSA  Enc=None      Mac=SHA1

And so on.


What is it that makes public wifi so insecure? What exactly is it that make public wifi so insecure?
Is it because about anyone can connect to the network and that my device will be visible to people just as it is visible to other devices in my home network?
And what is it that's supposed to make 3g/4g connections more secure?

Many public access points have no security at all. This means anyone within range (and with the right antennas and amplifiers that can be several hundred meters) can read all traffic.
Many of those that do use WPA2. Anyone with the password can decrypt all traffic.
Even if your traffic was safe from other users do you trust the owner of [random cafe] not to read or mess with your traffic?
With a device like a WiFi Pineapple you might not even be connected to the network you think you are.

3G/4G wise data traffic is encrypted with a per user key. Although it has its own problems - see my answer here.

With any network you do not fully control you should use a good secure channel over the top - for web access either HTTPS/SSL (remote server identity verification and hides content but not who you are talking to) or a VPN.


Why are PID suffixed temporary files a vulnerability Why is this a security issue?

> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820331
>
> very predictable temporary files (like
> /tmp/cronic.out.$$) that depends only on PID:

> OUT=/tmp/cronic.out.$$
> ERR=/tmp/cronic.err.$$
> TRACE=/tmp/cronic.trace.$$

> "$@" >$OUT 2>$TRACE

Use CVE-2016-3992.

Security through obscurity never slows down modern hacking software and always makes debugging harder.

With the /tmp directory always having sticky bit set (drwxrwxrwt), doesn't that prevent deletion and replacement by a malicious user?

Update 2016-05-08

Based on Lie Ryan's Answer, have experimented with the following results...

System
  Puppy Linux 5.2.8 (based on Ubuntu 10.04)

Privileged User
  root
    /etc/passwd
      root:x:0:0:root:/root:/bin/bash
    $PATH
      :/root/bin::/src/bin:/root/bin:/bin:/usr/bin: ...
    > groups root
      root : root tty
    > id -nG root
      root tty

Unprivileged User
  spot
    /etc/passwd
      spot:x:502:502:Linux User,,,:/home/spot:/bin/sh
    $PATH
      :/root/bin::/src/bin:/root/bin:/bin:/usr/bin: ...
    > groups spot
      spot : spot
    > id -nG spot
      spot

Owners, Groups, Permissions
  > ls -l /bin/busybox /bin/cat
    -rwxr-x--- 1 root root 637960 2011-08-17 11:04 /bin/busybox
    -rwxr-xr-x 1 root root  50820 2011-08-17 11:04 /bin/cat

  > ls -l /usr/bin/less
    lrwxrwxrwx 1 root root 17 2011-08-17 10:49 /usr/bin/less -> ../../bin/busybox

  > ls -l /home/spot/myless /home/spot/text
    lrwxrwxrwx 1 spot spot 13 2016-05-08 12:23 /home/spot/myless -> /usr/bin/less
    -rw-r--r-- 1 spot spot 12 2016-05-08 13:01 /home/spot/text

Expected Behavior
  Thus, unprivileged user 'spot' should be able to run 'cat', but not 'less'.

Attempt to run 'less' via the symlink (indented for clarity)

  root@LX03:~  su spot

  spot@LX03:~  pwd
    /home/spot

  spot@LX03:~  echo $PATH
    :/root/bin::/src/bin:/root/bin:/bin:/usr/bin: ...

  spot@LX03:~  ls -l myless text
    lrwxrwxrwx 1 spot spot 13 2016-05-08 12:23 myless -> /usr/bin/less
    -rw-r--r-- 1 spot spot 12 2016-05-08 13:01 text

  spot@LX03:~  cat text
    sample text

  spot@LX03:~  myless text
    sh: ./myless: Permission denied

If I understand correctly, the vulnerability of tmp files with pid suffixes would be of a malicious program creating "a symlink to a privileged file" (presumedly an executable) in order to be able to run it, though the owner of the malicious program does not otherwise have the permissions needed to do so. Is this a correct understanding?

If so, I'm missing something.

Ownership, group and permissions (OGPs) are on the actual file, not the directory entry. A symlink is a directory entry pointing to another directory entry.

I don't understand how a symlink can open a vulnerability.

As I understand it, and my experiments support, OGPs are global to the entire filesystem regardless how a file is located. It doesn't matter if the file is accessed by a symlink, by searching the $PATH directories or entering the entire path directly.

The only way I see an executable can be used to access directories and files that the executable's owner has access to, but the user running it does not, is if the executable has SETUID or SETGID enabled.

What am I misunderstanding?

The issue is that the attacker can create a symlink before a vulnerable program can. For example, you could write a script that watches the process list, and as soon as a program with the right name shows up in the list, the script would race to create a symlink to a privileged file before the vulnerable program can. If the vulnerable program is running as privileged process (as cronjobs often are), this may allow the attacker to write to files that the attacker doesn't have privileges to write to.

In some cases, you can even start creating the symlinks before the program even started, because PID is assigned sequentially and if you know that another program always/often starts before the vulnerable program starts, you can preemptively create a few PID files ahead of time.

Once the file is created, the vulnerability isn't an issue because of the sticky bit.


SVG virus/ malware with an extension on Google Chrome (one) This question is about the SVG virus malware I got through Facebook, which adds a malicious Google Chrome extension. It's called one or ubo. Some articles write that it is ransomware.

I think I was infected by this, but I am not a programmer or a computer talented person, so I can just guess.

This question suggests that it adds a file to each page/ directory you are looking at via Google.

So what about my Google Drive? Will it take over Google accounts that I have had open in the time before I realised that I might be infected?

Over the past 2 weeks I kept using the computer over Google Chrome. So it knows my bank, Google accounts etc.

I opened my Google accounts using Google Chrome the other day, and they are locked, but they are not locked if I go via explorer.

The extension, which was in the Chrome store, is the Nemucod downloader, which harvests credentials and is capable of spreading malware.

If affected remove the malicious extension from the browser, run an antivirus scan and change the Facebook password afterwards. You should also notify any people who received a malicious file from you.


Can a mobile number ring if the person has not inserted their simcard into their phone? I dialled a cell phone number and it rang but with no reply. I asked the person later why they did not answer and they said the Sim card was not in the phone. In fact, it was in a purse.... Is this possible? Can a Sim card that is not in a mobile ring?

I don't think this is a security question.

But anyway I think your person lied to you. Everyone knows the voice telling something like The person you have called is temporary not available. If a cellphone has no contact to the network or is switched of or the sim is not in the cellphone you get either this message or the mailbox.


What is the difference between CBC and CBC3 cipher suites? Consider below  cipher suite TLS v1.0

TLS_RSA_WITH_DES_CBC_SHA                **DES-CBC-SHA**
TLS_RSA_WITH_3DES_EDE_CBC_SHA           **DES-CBC3-SHA**

Wwhat is the meaning of CBC and CBC3, and what is the difference between them?

DES-CBC-SHA is DES encryption, SHA-1 as HMAC.
DES-CBC3-SHA is 3DES encryption, SHA-1 as HMAC.


Encrypted files storage. How to simplify the password management scheme? It's probably dublicate but I can't figure out the correct keywords for search. You can help by just telling me those words, I'm rather good with Google :)

I want to develop somewhat like file storage with encryption of every file. There is only one user, and all the data (and code) is stored on his local machine. User is able to import some files in and read the formerly imported ones.

Requirements

Main attack vector is unauthorized data reading. No need to protect from illegal importing files.

In addition, I'd like to implement plausible deniability. It will look like this: there's two storage actually, one of them is encrypted with empty password and it's OK to expose it's contents to anyone. It is used to obscure the fact that there's something hidden. Just an additional shield.

The key that the whole system's security is based upon is that user's password is stored inside his head only, i. e. not reachable programmatically (unless there's keylogger, telepathic software, or satellite with hi-res camera that can see you typing).

Implementation

For now I've end up with the following scheme.

User's password is a key for encrypting/decrypting the random generated level 2 password(s). Symmetric cypher is used (e. g. AES which is considered secure for the moment).
Level 2 cryptography is asymmetric. Encryption (public) key is used when importing unencrypted files from external sources. Decription (private) key is used for reading files. As asymmetric algorythms are slow, these keys are actually used to protect the session key (unique for each file). Private key is available in memory as plain text only when encrypting session key.
Level 3 uses symmectric cryptography, AES again or some secure stream cypher (only in case of much much better performance because security is preferred). It is used to actually encrypt/decrypt file contents.

You've finally read it to the end :) Here are the questions:

How to simplify this scheme not harming the security?

In short: remove middle level. Still have to use two levels though, to prevent cypher fatigue/enthropy exhausting and to satisfy my paranoia :)
How to enhance it's security? I know there are bugs here, crypto is a tricky thing.

Many thanks to @DeerHunter to point out potential flaws.
What to google and to read about this? No fundamental things like Shneier please :)

Well, I've got enough terms and concepts to dive into. For now, at least.
I'm still not sure whether I should use asymmetric cyphers (in level one). I thought that it would help to split the risks: decryption (private) key is spawned as plaintext just for a moments, while encryption (public) key can even be exposed to everyone. But in comparison with symmetric syphers, I still have one key to secure in RAM, and there's additional (public) key to worry about.

EDIT1. I don't want to design my own standard, it's far beyond my knowledge. I'm gonna use things that are proved secure where possible. E. g. what I'll do by myself is just combine several classes from Crypto++ to work together. I only need the right design to do it.
For now I don't think that full-disk encryption is suitable in my case. I've thought about TrueCrypt etc but it doesn't allow to hide the presence of the encrypted data. I'd prefer solution (crypto standard or protocol) for per-file encryption.

EDIT2. Rearranged text to split requrements and implementation, added deniable plausibility req.

EDIT3 There's one more question left about asymmetric crypto.

The first and probably only way to make such things secure is not to do it yourself. Implementing properly a cryptographic protocol without leaking information everywhere is hard; designing a cryptographic protocol is harder.

Since the user imports the files himself, and reads it, then there is no need whatsoever to invoke asymmetric cryptography. Asymmetric cryptography is for when there are (at least) two players with distinct rights (e.g. a signer and a verifier; or a sender and a recipient); here, there is the user and himself: same guy, hence no need for asymmetry. Another way to see that is that asymmetric cryptography was designed to solve the problem of sharing secret information between several people. A user has no problem sharing secret information with himself.

So the basic structure is to encrypt files with a key derived from a secret which fits in the user's brain (the password). This points to tools for full disk encryption, which exist for many operating systems. Some recent Windows versions come with BitLocker. Good Linux distributions have their own system. An oft-recommended third party product for full disk encryption is TrueCrypt. Use one of these and you will live longer and happier.


How can I force certain the webclient to honor or remember certain parameters from the webserver? HTTPS is subject to several MITM attacks, that is clear.  However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted sites.

Based on my (average) knowledge of MITM vectors, it would be beneficial to secure specific domains  with client/browser behavior that forced any of the following settings :

Only use HTTPS when connecting domain X
Require an If-Modified-Since header.  Ideally, I want cached content to never expire, regardless of what the "server" says.
Require SSL Only Cookies.  I am looking for a way for the browser to require SSL Only cookies by DNS domain name, and possibly by cookie name.
Ignore 30x redirects.

Ultimately, I would like to take the recommendations and format them into a security guide for the end user, or actually deploy them internally to all internal clients, when connecting to a secured list of websites.

HTTP Strict Transport Security (HSTS), a feature introduced by Chrome (http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is a nice move towards security against MITM.

Other options you mention would be sure to break many sites. Requiring secure-flag cookies for instance (and thus ignoring those without?) would break a lot of sites, as would ignoring 302's.


Firmware backdoor in external hard drive without a specific driver possible? I heard that researchers found some external hard drive with embedded backdoor (into the firmware).

I don't know if an external hard drive backdoor can be executed only by using a generic driver.

My main thought is that if the OS wants to read a file from the hard drive, the firmware will respond with the embedded backdoor code.

Is this possible?

Possible: Technically yes.

Let me state it this way: I got some hardware and I can do with it whatever I want. I them give or sell it to you with it configured to perfectly act like an external hard drive.

Would you be surprised if it had an undocumented command which would give me access to the data?

I am guessing we both agree that the answer is: No. Ofcourse we could not be surprised.

That leaves generic drivers. I also see not problem there. The generic driver will support all the normal commands, and we could for a combination of them and trigger on that. E.g. if someone reads sector 3, 14, 15, 92, 65 and 35 and thus this 42 times with a delay of at least 5 seconds between sector reads.  (or make up your own unlikely access pattern, maybe using a special value when setting a system protected area or anything else a normal user would be unlikely to do).

That means we have extra capabilities ont he drive and a way to trigger them, causing the drive to do whatever we want. Which could include returning the entryption password of the drive, or the raw data written to a sector.

Thuis the answet to the question: Is this possible? is a big yes.
Which is not the same as is this likely. But technically: sure, it is possible.


IAT Hooking questions? I have researched IAT hooking by malware and i still have a few questions:

If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a api hook?
How are these detected i have read the question here: What are the methods to find hooked functions and APIs? but i am still confused could you please provide a basic step by step explaination?
Is there legitimate uses for api hooking other than antiviruses which could lead to false posatives in a detection tool?

Detecting a rootkit is by nature difficult, this is because rootkits often employ methods to evade detection. A well written rootkit ought to be undetectable.
However, rootkits that are badly coded may leave traces of their activity in the system (failing to delete logs etc).

Unsigned Dynamic Link Libraries Loaded into (all) processes
Random code checksums
General malware detection methods

Also see: https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Rutkowska.pdf


What kind of protection does Port security offer? I don't understand the benefit of port security (limiting the amount of MACs that can be connected to a single port of the router), what is the problem that motivates using this?

Port Security defends against the following attacks:

CAM table overflow
DHCP starvation
MAC spoofing (partial)

The first two rely upon the ability of the attacker to flood the network with requests from bogus MAC addresses, so Port Security directly inhibits them.  The latter is only partially mitigated; an attack which only needs to spoof one address (and not use a valid address too) would be able to bypass Port Security.  However, that rules out some attacks - for example if the attacker needs remote control of the endpoint on valid IP/MAC "A" and wants to spoof IP/MAC "B" in an attack - can't do both at once.


Man-in-the-middle packet injection I'm currently studying the possibility of a man-in-the-middle attack in a network consisting of a switch and 3 computers:

Server/Host
Client
Man In The Middle

The server and the client will change data (actually, the client will only download a file from the server using a specific protocol that is written over TCP/IP), and via ARP Poisoning, I've made it possible to eavesdrop the data exchange, however I was wondering:

Is it possible for the MITM to get the file being transferred, make a few changes and then send it to the client as it should be done?

In theory, yes. You'd need to disable IP forwarding so the data doesn't pass through the attacking machine. You'd need to forward the client's download request and then intercept the download as it bounces off the attacker.

Once you have this file, modify it as you wish and send it to the victim while spoofing yourself as the server.

NOTE: This process will not work if the connection is secure. In that case, you'd need to find a way around the encryption such as a DROWN attack or SSLStrip. Please also note that these attacks are circumstantial, and are not guaranteed to work (just like any other attack).


Hacked site - encrypted code Couple days ago I gave noticed that almost all php files on my server are infected with some encrypted code and in almost every file is different. Here is the example from one of the files:

http://pastebin.com/JtkNya5m

Can anybody tell me what this code do or how to decode it?

I am not finished and I don't know whether I ever will.

However my current results: The code itself is quite advanced (from my point of view).
The code itself is shellcode http://en.wikipedia.org/wiki/Shellcode that tries to load a payload from a remote server.

The code has at least one level of indirection.
At first it looks like those are the server providing the payload:
"33db9538", "9507c4e8", "e5b57288", "54dfa1cb"
These servers, when appending .com results in fake sites all registered by Maksim A Nesterov in Kiev, Ukraine.
However digging deeper it looks like those servers act only as a distraction since later in the shellcode those are replaced by another set of servers:

$arr = array (
        0 => '54dfa1cb',
        1 => '33db9538',
        2 => 'e5b57288',
        3 => '9507c4e8',
      );

Those servers are again under the control of the owner in Kiev. I suspect those may be the servers hosting the payload.

(Note: The names are all parts of a md5 hash and are generated in code)

Now the code gets ugly. I am already dissecting the code a second time and I may be wrong. But from the array above it looks like only the first or second is randomly chosen, not the other two.

Then the script merges a lot of client properties into some large hash with some arbitrary number:
http://  54dfa1cb.com  /366666?Fa2q8rOQ86kIwU7ZiX2Hcz0C53nhh8xfGo%252F11suKdoVhXxb98vt%252B95qlKnJaCZYUOzf1RgGHfWjAq%252B5wlthnTuM%253D.MLak6%252BXTvfVJjh2SzlyLbz8B%252F33vqvcSAw%253D%253D.bPf%252Br%252BzSo7QOwUzK.MLak6%252BXTvfVSghudzkePdDdD82Ws.d6q%252F9rrT9PNehFGAzl%252FAbTEd

This does however result in a 404 since I may have overseen something. I forged the request query but the server may still refuse my request.
Either the servers I've located are still decoys or I haven't replicated the full request environment correctly. As all the md5 hashed data is sent to the server I would expect it to validate that by recreating parts like USER_AGENT and referrer.

The observable result of this when running it in your code would be adding extra code at the very end of the body or the html (typically body) that does something. The code does not execute when some keywords in referrer or paths are used, e.g admin, google, etc, so the shellcode is not indexed by search engines.

Blind guess: The shellcode will load some binary executable code onto the user's machine and try to execute it.

While I was faking a Firefox User Agent there is no way to properly now what exactly the server expects. It may just react on Internet Explorer to use some known security hole and report 404 on every other case or require a windows operating system, etc.

Do not execute the code to see what happens!

This shellcode was designed for the servers mentioned above and this is no noob work. There is quite an effort in this obfuscation of the code. It has several layers of eval and preg_replace with the e-modifier to resist reverse engineering.

Executing this code in a dummy environment is a security risk as the shellcode could potentially gain access to the machine on which it is running.

Edit: This part addresses your question on how it was possible etc:

(Disclaimer: I have little to no knowledge about encryption, security, hacking etc. I just have some knowledge in PHP programming and always wanted to get my hands on some real world shellcode to understand what and how it does things.
Coincidently a machine at home has been infected for quite a long time resulting in stolen logins, etc and I am trying to guess what the attack vector on those logins was, which is nearly impossible for me.)

There are so many possibilities for your issue at hand (attack vectors) that I bet I forgot some and due to lack of experience I am unable to pin the most probable one.

Depending on how your hoster stores the log in data it may be possible that an attacker obtained the database, shadow file, user account file etc with logins and hashed passwords and were able to perform some sort of attack on it to obtain plaintext passwords (dictionary, brute force attack, etc). It may be even possible that the passwords are stored in plaintext. Unlikely but that did already happen, afaik.
Your machine might have been compromised. Even with proper AV and firewall drive by infection, email attachments, the use of cracked software or any other entry point may have resulted in a trojan that obtained log in data for your server, email etc. Many people store their passwords in a password manager like firefox or chrome etc, which may be easy to access once malware gained control (http://www.digitaltrends.com/computing/lay-off-chrome-firefox-has-the-same-password-security-flaw/)
The probably most unprobable way would be some attacker wiretapping your network data by gaining access to your Wi-Fi (I mean beside the NSA which does that already :) ). This way requires monitoring network packets and filter them. I don't know how likely that is.

The ways above require quite some effort and after that you still need to get onto your server and infect your php files.

I think more common ways for your issue are:

One of your PHP files is vulnerable to code injection (http://en.wikipedia.org/wiki/Code_injection). An attacker was able to execute arbitrary code on your account. This might be done by (but not limited to) careless use of "eval", "create_function" or preg_replace with the e-modifier.
(Sidenote: May not apply here but many beginners learning sql and php tend pass script arguments into sql without proper escaping, resulting in (http://en.wikipedia.org/wiki/SQL_injection)
Much worse but unlikely on professional hosting sites: Your account typically shares a physical or virtual machine with other users. The path to your files on a machine are like /var/www/1234, other accounts may be /var/www/1235 and /var/www/1233 (sorry linux guys if the path is not plausible :)). If a hacker gained access to script files  of lets say /var/www/1233 and therefore to the file-system and the server is not properly configured an attacker may use the file-system to access all other file-locations, e.g /var/www/1234 (yours) and /var/www/1235 (some other poor guy). Such scenario is not controlled or influenced by you as you have no point of influence here.
A very common case is using a CMS, Wiki etc that is not up-to-date. Such systems tend to expose a way to execute arbitrary code on them. Typically a dev detects the issue and patches it. But if you do not check for updates daily or regularly a security issue may go undetected. An attacker now just probably need to do a google search for let's say some CMS got a hole fixed at version 1.5. If you search the web for "CMS 1.4" you will find all sites using the CMS before the hole got fixed. I've read an article how incredible easy it is to use a search engine to locate sites with security holes suitable for injection or finding cms or other types of software where critical files (containing passwords, etc (bad way!)) are publicly visible.

What I would do (and am currently doing, as I have a similar issue):
* Remove backdoor code first.
* Get a rescue CD (I got avira's, avg's and kaspersky's) boot your machine with one or all of them and do a scan. Clear everything infected. It might be wise to reinstall windows.
* If you do not reinstall windows than you will need to repeat the rescue cd part after some days to check, whether new threads were detected, if true, you may have malware that causes a re-infection of the system and then you will need to reinstall-windows anyway.
* Keep AV software up-to-date (daily updates)
* Perform full scan at least once a week
* After you have no malware on the system. Change all passwords on all accounts.
* Check whether your php files are infected again. Removing malicious code should be priority 1 but as you might have done that on a possibly compromised machine it may get reinfected there. It's even possible that you infect yourself with the backdoor on your site if you visit it.

As a matter of fact observing the result of an infection is easier than the fact when you got infected. That' like real life. You know when you have a flu but you cannot be sure where and when you got infected.

Again Disclaimer: No security background, just things I would do and things I have observed during my time in the web.
If anyone sees obvious flaws in my explanations, please correct them.


Why is HMAC truncated in IPsec? I'm having a look at IPsec standard and I realized that integrity and data authentication check is based on 96-bit truncated version of HMAC algorithms. For example, in IPsec v3 we can use HMAC-MD5-96, HMAC-SHA-1-96, AES-XCBC-MAC-96. What is the reason behind this choice?

For the answer to this check out RFC 2104, em mine:

  A well-known practice with message authentication codes is to
  truncate the output of the MAC and output only part of the bits
  (e.g., [MM, ANSI]).  Preneel and van Oorschot [PV] show some
  analytical advantages of truncating the output of hash-based MAC
  functions. The results in this area are not absolute as for the
  overall security advantages of truncation. It has advantages (less
  information on the hash result available to an attacker) and
  disadvantages (less bits to predict for the attacker).  Applications
  of HMAC can choose to truncate the output of HMAC by outputting the t
  leftmost bits of the HMAC computation for some parameter t (namely,
  the computation is carried in the normal way as defined in section 2
  above but the end result is truncated to t bits). We recommend that
  the output length t be not less than half the length of the hash
  output (to match the birthday attack bound) and not less than 80 bits
  (a suitable lower bound on the number of bits that need to be
  predicted by an attacker).  We propose denoting a realization of HMAC
  that uses a hash function H with t bits of output as HMAC-H-t. For
  example, HMAC-SHA1-80 denotes HMAC computed using the SHA-1 function
  and with the output truncated to 80 bits.  (If the parameter t is not
  specified, e.g. HMAC-MD5, then it is assumed that all the bits of the
  hash are output.)

Truncation also reduces the amount of data transmitted over the wire so bandwidth requirements are reduced.