Google's Certificate Fingerprint doesn't match with the Fingerprints in the Chrome's "net-internals" configurations As you may know, you can query chrome's HSTS/PKP sets for a domain in the page chrome://net-internals as below:

As you see above, there are four SHA256 hash values (in the middle of page and in base64 format) for www.google.com.

If we convert those values to hex format, we will have the following values:

ebra@him:~$ echo "iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0=" | base64 -d  | od -t x1 -w32
0000000 8a 27 b5 55 7b 4b ec 7c c0 30 5f bf 3d 53 d1 f7 1c d3 f3 49 10 c5 d6 5e 27 ec dd b8 20 77 ba 3d
ebra@him:~$ echo "h6801m+z8v3zbgkRHpq6L29Esgfzhj89C1SyUCOQmqU=" | base64 -d  | od -t x1 -w32
0000000 87 af 34 d6 6f b3 f2 fd f3 6e 09 11 1e 9a ba 2f 6f 44 b2 07 f3 86 3f 3d 0b 54 b2 50 23 90 9a a5
ebra@him:~$ echo "7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=" | base64 -d  | od -t x1 -w32
0000000 ec 72 29 69 cb 64 20 0a b6 63 8f 68 ac 53 8e 40 ab ab 5b 19 a6 48 56 61 04 2a 10 61 c4 61 27 76
ebra@him:~$ echo "IPMbDAjLVSGntGO3WP53X/zilCVndez5YJ2+vJvhJsA=" | base64 -d  | od -t x1 -w32
0000000 20 f3 1b 0c 08 cb 55 21 a7 b4 63 b7 58 fe 77 5f fc e2 94 25 67 75 ec f9 60 9d be bc 9b e1 26 c0

The question is that: why I can't see none of these values in the current loaded Google's certificate in the other tab?

The four hash values you see are SPKI hashes. While the fingerprint you see when looking at the certificate is computed over the whole certificate the SPKI hash is only computed over the SubjectPublicKeyInfo, i.e. the public key contained in the certificate. See Mozilla:HPKP for more details including ways to compute the SPKI hash using common tools.

Apart from that these SPKI hashes do not necessarily specify the leaf certificate (i.e. the one you were looking at). Instead at least one of the SPKI hashes for a site should match one of the certificates in the certificate chain, i.e. from leaf up to and including the locally trusted root certificate. This matches the behavior of the HPKP header which is described in RFC 7469 as follows:

  ... compute the SPKI Fingerprints for each certificate in the Pinned Host's validated certificate chain ... check that the set of these SPKI
     Fingerprints intersects the set of SPKI Fingerprints in that Pinned
     Host's Pinning Metadata

To manually do the checks one might export every certificate from the browser, compute the SPKI hash (see first link on how to do this) and then check if it is in the list of preloaded SPKI hashes. For the connection I get to www.google.com I get the following chain (note that I get a different leaf certificate):

[0] www.google.com
cert fingerprint: 27:4C:3B:05:9F:30:5C:C3:C7:EE:23:98:E5:33:21:EE:56:34:E0:40:96:09:1E:87:BE:F0:9D:AF:A7:44:39:12
SPKI hash: He1hxIXPpsnamgIS9IH1HC45P2yj45Py1fi0/JI6JBo=

[1] Google Internet Authority G3
cert fingerprint: BE:0C:CD:54:D4:CE:CD:A1:BD:5E:5D:9E:CC:85:A0:4C:2C:1F:93:A5:22:0D:77:FD:E8:8F:E9:AD:08:1F:64:1B
SPKI hash: f8NnEFZxQ4ExFOhSN7EiFWtiudZQVD2oY60uauV/n78=

[builtin] GlobalSign Root CA - R2
cert fingerprint: CA:42:DD:41:74:5F:D0:B8:1E:B9:02:36:2C:F9:D8:BF:71:9D:A1:BD:1B:1E:FC:94:6F:5B:4C:99:F4:2C:1B:9E
SPKI hash: iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0=

As you can see, the last SPKI hash from the builtin root CA intersects with the preloaded SPKI hashes which means that the validation was successful.

If you want to know what the other SPKI hashes are for you might have a look at the source code for Chromium where it shows the following definition for the PIN set used for the Google domains:

  "name": "google",
  "static_spki_hashes": [
    "GoogleBackup2048",
    "GoogleG2",
    "GeoTrustGlobal",
    "GlobalSignRootCA_R2"
  ],

The last item GlobalSignRootCA_R2 is the one found in the current chain.


What order is best for nesting VPNs? if anyone is available to give me advice on a VPN situation I'd appreciate it.

So the story is, I have one Swedish VPN which I trust not to log, and which I've connected to with my real IP, and I've connected to things like Facebook with the VPN.  The problem is that this VPN uses a fairly weak symmetric cipher and no PFS.  This VPN service is run by one person in Sweden, although it is medium sized.  I trust this VPN pretty well, it seems very honest and not out only to make money, and the TOS is extremely tiny and lenient.

There is another VPN which I plan on buying so I can nest the two.  The new VPN is a larger company, and the exit nodes are not in as friendly a country as the first.  However this VPN takes pride in being very technologically knowledgeable in how to secure their servers, and they a strong cipher and kex, and implement PFS (which is a huge plus side).  A problem is that they say that their small staff will do anything they can to prevent child porn from going through their network.  While I am not going to send that through, I don't know if by "stop" they mean simply block access to those sites, or to temporarily enable logging (which is not good), or what.  And I don't want my anonymity to be damaged if I accidentally come across jailbait.

So here's my dilemma...  Should I do "me -> old VPN -> new VPN -> www" or "me -> new vpn -> old vpn -> www"?  The most important things for me is having PFS so if my ISP logs, they will not get anything out of it if the private keys are compromised, and that the exit nodes do not log.  My adversary is primarily government, so that if any one of the two VPN's private keys are compromised, or if any one of the two VPNs turn on logging for LEA, it will not automatically destroy my anonymity.

My thought is that it should be "me -> new VPN -> old VPN -> www" because I trust the old VPN's intentions more (so I want it to handle my plaintext exit traffic) and the exit nodes are in good countries, but I trust the new VPN's technical skills more (so I'd like for the connection going through my ISP is encrypted with it).  I'm hoping that if I do it this way, I'll get the best of both worlds.

tl;dr
I have VPN A, and am about to buy VPN B.  I trust VPN A's intentions more, but I trust VPN B's skills and encryption more.  In what order should I nest them?

What should I do?  Is there anything else I haven't taken into account?

If you want to connect to the old VPN through the new VPN, it's best to start by canceling your account with the old VPN. Get an account with the new VPN, and use it for a month or two.

Then get a new account with the old VPN, without revealing any connection to your old account. Never connect to their website or VPN servers except through the new VPN. Use a new email address that's not linked in any way to your old VPN account. Pay for the new account with your old VPN provider using cash through the mail, or with thoroughly anonymized Bitcoins.

It's very easy to anonymize Bitcoins by using mixing services (such as the Blockchain wallet, BitLaundry and Bitcoin Fog) via Tor among multiple Multibit clients in Whonix instances.

It's easy to nest VPNs, as Pseudo Reality noted, by using one in a VM host machine, and another in a VM. For more complex configurations, one can use pfSense VMs as VPN clients, and combine them with Whonix and other Tor gateway VMs.


Why does getting a password wrong takes more time than not I type my password to login to Win or Linux.

Case 1: I get it right. Almost instant reaction.

Case 2: I misspelled it. It takes a while, and then rebounds.

Why does it takes longer to identify a wrong password vs a correct one? shouldn't the time to identify be the same?

It takes the same time to verify a wrong password and a correct one. But, when the password is wrong, the operating system makes you wait a bit. This is a security feature, to discourage people who try "potential passwords" (in particular people with some electronic skills, plugging in some circuitry which the computer will consider to be a keyboard, but which in reality tries a lot of passwords real fast).

Such things don't work as well in a network context (if the attacker wants to try 100 passwords quickly, he can open 100 connections in parallel) but the password verification code is often shared between network and local logon.


How would I find an IP address range of a website or domain? I would like to find the IP range of a few domains so I can block them in my firewall but I am not quite sure where to start.

You could find the IP addresses currently used by a domain by doing a DNS lookup. For example with dig A www.example.com gives you all IPv4 addresses the DNS server returns for this domain and dig AAAA www.example.com the IPv6 addresses. But you need to be aware that getting the IP address this way and then configure blocking based on this has serious problems because:

The mapping is specific for only a specific hostname, i.e. www1.example.com and www2.example.com and example.com might all return different results.
The mapping between name and IP address might be changed any time. Sometimes this list depends on the location you ask from (i.e. geo-specific DNS), sometimes on the load on the servers and especially malware delivering sites will often change the IP address once an address they used is added to a blacklist.
There might be several domains sharing the same IP address so blocking by IP address will block access to these as an unwanted side effect domains too (overblocking).

Thus a better way would have such block at the DNS level or at the HTTP level with a URL filter. But this (more advanced) functionality might not be available in the firewall you use.


What is a visible example for a mandatory access control (MAC) I can see clearly how discretionary access control (DAC) works by checking the properties of a file on my MSWindows machine, the file has attributes and the owner of the file can do almost anything with it like making it available for everyone to read, transfer the ownership to an other user or even delete it

However I cant find any visible example that I can actually see in a GUI that might help me to understand how mandatory access control (MAC) works? can I create a file under MAC? How does the file get its attributes? and how is it possible that I don't own it?

There are a couple of places that you can see Mandatory Access Control (MAC) systems in operation in consumer OSs, that spring to mind.

SELinux is installed on a number of linux distributions and can be set in enforcing mode which would show an example.

Also windows Mandatory Integrity Levels are another example.

Seeing an example of this could be done by getting a Windows 8 machine and trying to modify files within a windows 8 store programs installation directory (under the hidden directory c:\program files\windowsapps).  Even as an administrative user you will be prevented from changing these files via standard OS tools even after you have "taken ownership" of the file, which in a DAC system would usually allow you to modify it..


How secure is Splikity There's a password app called Splikity. It features:

Military-Grade Encryption
Encrypted on Your Device
Strongest Security in the Industry
Continual Security Tests

Although I'm sold on the fact that it uses AES256 and SHA256, I know that security is not only dependent on the tools one uses, but also on how he/she uses them.

So my question is: Is Splikity actually secure? Is there a way to know how secure an app like that is?

There is no way to be completely certain it's secure.  There's no way we know of to be completely certain anything is secure.

Failing complete security, there are several ways to be reasonably assured that the security level is adequate.

The best way it to have the product audited by people who are knowledgeable about such things...Both the cryptography side, and the secure software development side.   Additionally, not only does the current implementation need to appear to be reasonably free of flaws, but they need to have plans for maintenance and patching to ensure it stays that way, and that if issues are found in the future, they can be swiftly remediated.

If you can get a through audit done, it's also reasonable to expect that something built by respected members of the applied crypto and secure software communities is probably alright to use.   I don't know if this is or not.

So, if you don't have insight into the software itself, or at least the creators of the software, then no, there is no good way to adequately determine if it is well designed and implemented or not.

That said, the "military-grade" marketing bullet aside, there are no glaring flaws in the approach they describe.   AES-256 is a fine choice.   PBKDF2 is not as good as scrypt or bcrypt for this purpose, but perhaps more likely to be already correctly implemented on the platforms they're using, and it's good enough.  They make it clear that decryption is only done client side, and there is no master key recovery process, which is good.  They claim all communication between server and client is done via SSL (hopefully really TLS) which, if done properly, is correct.

There are things we can't know from the description alone.   Are they using AES correctly?   Is the number of PDKDF2 rounds really adequate for the purpose?  Are they managing the decrypted data, password and key materially securely on the client?   These are a few of the questions that I would want answered before choosing a product like this...Though really, I would be hard-pressed to pick an also-ran in this market space over something like KeePass or Password1 in any case, without a specifically compelling reason.   There's just less chance that it'll get the appropriate scrutiny and that any issues it does have will be brought to the surface for resolution.


Is TLS flawless enough to prevent eavesdropping carried out by an ISP? I would like to "secure" my email, http servers and desktop client by connecting exclusively over TLS, be it email, in/out:80 or just regular "web surfing" traffic.

Will that prevent ISP and potential mans in the middle from spying on the traffic?

Yes, assuming the following conditions

your web browser/email client is properly checking for valid signed certificates from trusted CAs with a valid chain of trust that have not been compromised and use strong encryption (e.g., 128-bit or greater symmetric key; 1024 or greater asymmetric key),
the CA was not fooled into signing a certificate (intermediate certificate) to the wrong organization,
you aren't fooled to go to a different site with a properly signed certificate but is actually phishing you, (e.g., you want to go to https://www.yourbank.com but instead get a link to go to https://www.yourb.ank.com which has a valid certificate for ank.com),
the servers at the other end do not have compromised private certificates and are not willingly sharing your traffic, and
there's no flaw in TLS that your ISP knows about that the rest of us do not.


How can I make my java application trust connection using a domain (self) signed certificate? We have a windows AD domain with servers and clients. The domain also has a Windows Certificate Authority (AD CS). The CA is trusted in the domain by publishing it's public key in the local certificate store for all machines.

We  have a website that uses a local address (https://mysite.corp.net) that uses a domain signed certificate. Most clients on the Windows Machines trust the connection, since it is signed by the CA that is trusted by Windows.

Now I have a java client application, that doesn't trust the domain signed certificate, and thus refuses to connect.

How do i tell the java application to trust the certificate for this site, or better, to trust the CA?

I can't 'overrule' or 'ignore' the certificates.
I need to make sure that the certificates are up-to-date, so that a revoked certificate (or even CA) will not be trusted.

The comment from Steffen above should be the listed answer, so i'm adding it here:

  Java has its own key store and does not use the central windows trust store. Thus you need to add the CA certificate to the java key store. See for example Adding a Certificate to the Java CA Certificates Store. Apart from that you cannot revoke a CA, only distrust it in which case it needs to be removed from all trust stores.


Do high-level programming languages have more vulnerabilities or security risks than low-level languages? Do high-level programming languages have more vulnerabilities or security risks than low-level programming languages and if so, why?

Image source: http://a.files.bbci.co.uk/bam/live/content/znmb87h/large

Major Caveat upfront:

It is possible to be insecure in any language, any time, and only developer attentiveness/awareness can fix this. SQL injection is still a thing. Higher-level languages generally have eval, and if you're dumb enough to eval user input you get what you get.

That being said, its the other way around. Having garbage collection avoids entire classes of security risks related to memory management like buffer overflows. Higher level languages tend to be more concise, less code means fewer places for bugs to hide. Anything that's tedious (and coding in lower-level languages certainly is that) is error-prone.

Because lower-level languages lack the same expressiveness, one has to write a great deal of boilerplate code not just at the beginning but all throughout the codebase. That means, because its not always easy to tell from a glance what the code is supposed to be doing (in business-logic terms), that it will be less self-documenting and will require more documentation in the form of comments or external documents. That introduces another source of error: if the documentation is not updated when the code it references changes you can write other code that is insecure due to the obsolete assumptions in the documentation of the related code.

Lower-level languages lack strong typing, so there are fewer errors a compiler can catch. There have been a few interesting attempts like Nim and Rust to address this, but neither is super-popular yet.

Last, but certainly not least, the real difference between high-level and low-level languages is that high-level languages shift the burden from the programmer to the interpreter/compiler. Those interpreters/compilers are written and maintained by some of the most brilliant lights in the industry, are routinely audited for vulnerabilities, etc. Application code on the other hand, is written by mortals. So shifting the burden from lots of application code written by average programmers to comparatively less code written by exceptional programmers should improve security because there's less code to audit written by more able people. So which would you rather trust, the JVM or Joe Blow's by-hand buffer management in C?

All of this rather begs the question about why people still use low-level languages if they are harder to use and less safe. There are a number of reasons:

1) The golden hammer. 'We have a bunch of C programmers, and oddly enough all of our code is written in C'.

2) Performance. This is usually a red-herring, its almost never worth the tradeoff of safety and speed of development, but in cases like games where you need to eke every bit of perf out of the hardware it can make sense.

3) Obscure platform. Along the lines above, its a whole lot easier to write a C compiler than a Rust compiler or a JVM. If you have to implement the compiler first, starting with C looks a lot more appealing.


Does shellshock produce a comprehensive local privilege escalation vector? If setuid scripts take arbitrary environment variables, apart from a few black-listed ones like LD_LIBRARY_PATH, from the caller, does this not mean that any setuid script running #!/bin/bash directly or indirectly is a vector for local escalation of privilege?

A good answer would be an explanation of why this is or is not the case.

For example, many (most?) unixalikes now do not honour setuid on shell scripts (though they did when this bug/backdoor was introduced). But binaries may call shell scripts indirectly, so unless they explicitly clear the environment first is this not still a problem?

Yes!

Binaries with a setuid bit and calling (directly or indirectly) bash through execve, popen or system are tools which may be used to activate the Shell Shock bug.

If these commands aren't taking care of clearing *env prior to run bash (or a shell script) then these binaries may be used to run any command (for example bash) with the privilege of root.

popen and system don't let the programmer the possibility to clean
*env.

Here is a first draft easy audit to estimate this risk:

find /  -perm +4000 \
    -exec /bin/zsh -c "ls -dluT {} ; nm -a {} | egrep '(popen|system|execve)' && strings {} | egrep '/bin/(sh|bash)'" \; 2>/dev/null

This isn't a proof of risk, since the *env might have been cleaned before the fork of the shell. The only way to be sure is to read the source code.

And here is the result on an actual version of an highly used Unix:

-rwsr-xr-x  1 root  wheel  910848 Sep 29 16:31:18 2014 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent
             U _popen
/bin/bash

(Here the last time used is not a proof of an attack but of my own previous "draft audit".)


Security concerns in disseminating database design? I work for a government agency, and we've been requested via a freedom of information request for the layout of the tables of one of our systems, a data dictionary and schema design request.

What are the dangers in sharing this? My initial concerns are need to know concerns, making SQL injection attacks much easier, and a bunch of starting information for future vulnerabilities (ie, maybe a bug is introduced later that only affects varchar columns over 500 bytes in length... here's a handy list of all of ours!).

What else is of concern?  I don't want to be an obstacle for the sake of being an obstacle, but as a DBA, this makes me REALLY nervous.

It's probably not a security issue.   For context, think about open source software.  When you have an open source application, the application source code and database schema are completely public; anybody can take a look and review them in as fine a detail as they care to. Organizations stand up and run instances of that very same open source software all the time, and no intrinsic security vulnerabilities are introduced merely by the public nature of the code/schema. It's true that vulnerabilities can be found by reviewing source, but even in this case I'm hard pressed to think of a security issue that has ever been found solely in a database schema and/or data dictionary.

So, as long as things like the table and column names, and data dictionary definitions don't intrinsically contain sensitive information or data, I don't see a security concern here.

That said, you may have an out in any case.  Your schema is probably not subject to FOIA. It looks like application source code (and similarly a database schema) is generally not considered an agency record, and so would not be eligible for release under FOIA.


mathematically / theoretically, what is the chance that 2 different inputs would have the same results of 2 different hash functions? mathematically / theoretically, what is the chance that 2 different inputs would have the same results of 2 different hash functions?

As an example, i will use 2 weaker hash algorithms, the MD5 (Collision Vulnerabilities)and SHA-1 Collision Vulnerabilities. So I have a password. I hash it with MD5 then I hash it with SHA-1. mathematically / theoretically, what is the chance that there is another input with the same SHA hash and MD5 hash as my result?

Mathematically?  100% probability.  There almost certainly exists some other input with the same MD5 and SHA hash.

Practically?  0% probability.  While some other input exists, there is no known way to find it within the lifetime of the universe.

You are asking about second pre-image resistance.  As far as I know, at least SHA1 (and probably MD5 as well) are believed to provide strong pre-image resistance.  Hence the comment that there's no known way to find another input with the same hashes, within the lifetime of the known universe.


Collision rate for different hash algorithms Is there any collision rate measure for popular hashing algorithms (md5, crc32, sha-*)?

If that depends only from output size, it's quite trivial to measure, but I suppose that depends also of distribution and algorithm's internals (and it demands some kind of formal proof, i think).

If I try to create collisions for MD5, I can make one every 14 seconds (on average) on my PC, using a single core (Core2, 2.4 GHz). This exploits the weaknesses in the internal structure of MD5. If I only try random data and wait for collisions to appear, well, I will wait for quite some time: the first collision is expected after about 264 hashed messages (give me a thousand PC, and I should achieve a collision in about 20 years of full-time computation).

For currently unbroken cryptographic hash functions, there is no known internal weakness (that's what "unbroken" means), so trying random messages is the best known method to create collisions. Chances to get a collision this way are vanishingly small until you hash at least 2n/2 messages, for a hash function with a n-bit output. This means that with any proper hash function with an output of 256 bits or more, the collision rate is, in practical conditions, zero (you will not get any and that's the end of the story).

Wikipedia has some pointers on the subject. See also chapter 9 of the Handbook of Applied Cryptography (page 369).


Network and Security Associates v.s. CISCO Security Associates My college is expanding the Information Technology department to include Networking and Security as well as the CISCO Security. In my research online I have found different information for each everywhere I have looked. What I am wondering is: in a nutshell what is the difference (beyond one being CISCO focused, I get that much), and which one would be more beneficial. Because they are new programs that haven't been formalized my school cannot give me any information beyond what classes I can take now that are guaranteed to be in them. Thanks.

Without further information we can't tell you which is better. However, by name, I guess the first one is better.

Why? Because it seems to be general whereas the second is only Cisco related.

You can do the first one and then get certified in Cisco.


Where is cross-site scripting code processed? Where does the snippet or Javascript get processed when we enter that in input box of HTML page or any URL?

Does it go to the server and come back or does the browser process it?

Does it go to the server and come back or does the browser process it?

Actually, both. When you enter some data in a form field and send it, the server does something with this data (it typically saves it into a database). If the data contains Javascript code, the server doesn't care, it just saves it as if it was normal text (remember that Javascript is a client-side language, the server cannot execute it).

When you want to view this information that has been saved in the database, the server sends the requested data back to the user. This data is handled by the browser, which will care about rendering the webpage. If the requested data contains Javascript code, this will be executed in this moment.


Advice on buying an encrypted disk How do I find an encrypted disk to buy?
What factors should I be aware of in selecting one?
Is there any proof that buying one likely to draw any attention?
How do I know there's not a backdoor?

To answer your points:

In terms of finding one - there are a number of vendors who sell already encrypted disks. A quick google for 'encrypted hard drives' will give you a current list - the normal vendors have them (my quick search gave me this useful guide but it may be out of date)
In terms of what factors you may need to be aware of, these would be my criteria:

physical security: is the case resistant to attack; does it have a kensington mount
authentication mechanism: on device or on PC; fingerprint, PIN, passphrase
speed: well, it's got to perform, right?
encryption: strength; is the encryption on board or at driver level?
I would feel safest with the PIN/fingerprint on the device itself, and encryption enforced on the circuitry.

I don't think buying one will cause any suspicion - they are becoming more and more common for individuals to protect themselves in everyday life.
And as for your final point - you don't. There isn't likely to be a way to prove it, but best assume that unless you are an important target, it would be very unlikely that your drive would be compromised.


Can SIP registrars and VOIP providers eavesdrop? An e-mail provider provides people with usernames for e-mail accounts. That normally means that they have access to your e-mail if it is unencrypted.

Likewise, do sip registrars have access to people's conversation when they voip each other? Or when you use your sip account to call a regular phone through a third party voip plan?

I also asked here the same thing about the voip providers, but the question was closed as a duplicate. It isn't a duplicate. My doubt is both about sip registrars -- those whose give you an address that looks like email -- and voip providers -- those whom you pay so you can not only make sip to sip calls but also sip to regular phones.

So the general question is: when you use sip for voip, who can listen and how to protect yourself?

When you do a call from SIP to a regular phone line, somewhere in the middle it will exist a gateway which translates the phone call from IP network to a PSTN. So it is doable someone in the middle intercept the communication (in the IP network or PSTN), at least, to lawful interception.

Only if two SIP peers call directly is less possible the have a eavesdrop.


What lightweight sandboxing options do I have on linux? What can I use to avoid running a full-fledged VM that gives me comparable security?

Possibly, something like https://coreos.com/rkt/ but I don't know what their security properties are.

Classic VM: There are two kernels, the hypervisor uses CPU feature to emulate a hardware, and the guest kernel is generally unaware that it is running on a virtualized system. This is generally considered to give the best isolation, however giving restricted access to the guest system can be tricky as many security features needed to be enforced by the guest system.
Paravirtualization: There are two kernels, the guest kernel is aware that it is being virtualized and it uses a paravirtualization driver that is specifically designed to talk to the host kernel/hypervisor for hardware access instead of trying to access an actual hardware. This is middle of the road in terms of isolation and flexibility.
Container: There's only one kernel, the kernel creates a namespace for each container so that the containers can't see each other. This gives you the least isolation, as any security bugs in the kernel can break out to the host system, but also most flexible if you need to define complicated access restriction. For example, with container you can define an SELinux policy that will be applied to the guest system but enforced by the host system.

If you want to run a known malware, I suggest using a full blown virtual machine. As currently implemented, container technology like rkt and docker isn't intended to be unbreakable by privileged processes running inside the container. However, note also that there are a certain class of malware called blue pill malware that are designed to break out of classic virtualization by exploiting flaws in the hypervisor. While these are quite rare, it makes it not advisable to run malware samples if you have zero clue what it is supposed to do.


What is the real danger of not putting a login password in Windows in a small company except that of allowing anyone to go physicaly on your computer? My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks that we have nothing to hide and also because it's work related computers, not personal computers.

But as an IT in this company, I'm a little bit curious about security here. We always hear that you should put a password on our computers. But what about a small company where there is almost always someone at our desks for surveillance of use of computers by any third-party, except some delivery people or clients that could potentially pass by our computers.

So, is there a substantial danger, besides that of someone physically accessing your computer, in leaving your computers without any password? I mean, if your SMB port is open and vulnerable to Wanna Cry for example, it doesn't matter if you don't have password, right? The worm will still get in once your computer is turned on. If a virus tries to get into your system and you have no password, is it easier for it to elevate its privileges to admin? If the UAC control is independent of your Windows password, you will still have this protection in place to thwart any attempt of privilege escalation, right?

Thank you

In a nutshell, besides physical, local access - there is no more of a risk of not having a password than having one. Besides, the obvious risk of anyone being able to walk up to your computer and log in.
There are a number of risks however that come from fraud and fraud prevention. Since anyone can walk up to any computer and log in, if anything malicious were to happen (and it does) you would have no way to prove who it was.
EDIT: if you're on windows 7 you can use autologin: https://technet.microsoft.com/en-us/library/ee872306.aspx
FRAUD AND FRAUD PREVENTION
Typically, an organization would have controls in place to prevent fraud from occurring in the first place. The idea being that the more difficult it is to prevent fraud, the more unlikely it will be that it will occur. I'll outline a rough scenario at the end if that helps clear it up for you.
A common control method is proper passwords, so that someone couldn't walk up to a computer, use it for some malicious activity, and then walk away. Keep in mind that this person may be from outside the company as well - ie. could be a repairman, could be an auditor, health inspector, etc. depending on your line of work, not just someone from inside the company.
SCENARIO
An organization has no passwords on their computers - An employee, Jane, was one of three employees let go due to work force reduction from a budget cut. Her job was to manage the company account for making purchases from new suppliers.
A few weeks after she was let go, her replacement noticed some irregularities in the accounts that she was in charge of. An internal investigation was launched, which found that almost $5000 had gone missing over the past 18 months. An external auditor was called in to assess the situation and a fraud investigator acquired them to find out what happened.
They discovered that the Janes computer was used to move the money, however it was always during her out of office hours. They also discovered that no-one in the company uses passwords on any of their computers, meaning that it could be anyone who would've had physical access during those 18 months. They also found from conducting an interview that Jane left with no issues, and left them with little reason to think it was her.
So who could it be?
SCENARIO 2
Same as above except employees use passwords -
They discover that Janes computer was used to move the money, and it was always during out of office hours. However it was not her login details that had been used, but rather the hiring manager for the floor.
An investigation was launched and found that he was having some issues at home with his spouse, which could be a potential motivator.
etc. etc.
The point being that in each of these situations, even with passwords being used its difficult to say who it was that committed the crime. However, in the case of scenario 2 - the hiring manager would have to explain why he logged in with his details outside of normal hours, or how his credentials had been potentially 'hacked'.
Hope that clears things up a bit. I can expand further if not.
EDIT: Just to add since @Sayan's point - it is known in security as non-repudiation - or being able to prove that something happened by whom


Test firewall rules (Linux) I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface.

I added an IP Table rule:

sudo iptables –A INPUT –i eth0 –j ACCEPT

I need a practical prove that this interface accept all kind of packets.
Does anyone know a specific way or tool which can help me.
I can't find anything better than

nmap -p 80 <ipAddress>

or

nmap - sU <ipAddress>

Or maybe somebody can propose a better solution to prove that the interface accepts all kind of packets.

In most cases doing an nmap -p 0-65535 -PN <ip> works well for testing a remote firewall's TCP rulesets.  If you want something more advanced you can use a packet crafter like hping which is designed to test firewall rulesets.  Here is some information on building packets with hping.


Can sites which check your password as you type pose a security risk? Some sites that I use check my password as I type it into the login (not registration) form.  So, for example, to begin with I might have:

Username: sapi ✓
Password: passw ×

and by the time I've finished typing, the site already lets me know that there were no mistakes:

Username: sapi ✓
Password: password123 ✓

Submission of the form is still required to actually log on.

Let's assume that this is not done on the client side (eg, by informing the client of the hashing algorithm and target hash); such an approach would obviously be unsafe, as it would allow you to obtain an arbitrary user's hash.

Assuming that the communication is encrypted, can checking the password letter by letter as it is typed pose a security risk?

My main area for concern is that doing so involves repeatedly transmitting similar (sub)strings:

some overhead data + the first letter of the password
some overhead data + the second letter of the password
...
some overhead data + the entire password

This makes the plaintext of each communication to some extent deterministic (or at least, related to that of the previous and next communications).

I know that some encryption algorithms are vulnerable to known-plaintext attacks, although I'm not sure if SSL is one of them.  I also don't know whether the level of knowledge gained here (which is obviously much less than for a known-plaintext attack) is sufficient to decrease the entropy of the output.

I guess I have two questions:

Is this a security risk with standard web encryption algorithms (basically https); and
If not, is there a class of algorithms for which this might pose problems?

I've added a clarification to the question that I'm referring to a login form, not a registration form.  In other words, the client cannot simply validate the password against known length/complexity rules using JS; the account already exists and the checkmark only appears for a correct password.

Modern cryptosystems are generally not susceptible to known-plaintext attacks.  In terms of encryption algorithms, there are basically 3 algorithms commonly in use in TLS:

AES
RC4
DES (in 3DES)

All 3 of these are believed to be resistant to known-plaintext attacks, and have been well studied for such attacks.

The one thing I would wonder about are side-channel attacks.  There's (potentially) several bits of information being leaked about your password, but the ones I can think of all require an attacker who is able to observe your traffic (of course, so would the known-plaintext attack you asked about).

If TLS compression is enabled (which it really shouldn't be, given the CRIME attack) and an attacker is able to correctly guess all of the other data sent in your request (which is not hard if there are no unique cookies) then it's possible they might be able to figure out your password by sending substrings and seeing which ones compress to the same length as your password.
Timing attacks.  Depending on how quickly the JavaScript sends requests to the server after you type keystrokes and your typing patterns, an attacker may be able to discern (or at least narrow down) what characters you're typing based on the intervals between packets (which indicates the intervals between keystrokes).  This attack was demonstrated against SSH by Song et. al. in 2001, so it's not exactly novel, just novel for HTTPS.  (HTTPS is generally not real-time, but what you're describing makes it approximately real-time.)
The length of the password. The attacker could measure the number of packages sent to the server and their sizes, and make a good guess about the length from the number of typed characters. Knowing the length of a password reduces the base by 1. So instead of having to guess 11^5 passwords, the attacker only has to guess 10^5 passwords for numeric passwords.

Overall, this isn't what I would worry about.  It's far more likely this website is vulnerable to XSS, SQL injection, session management vulnerabilities, etc., than it is that an attacker will use this back-and-forth technique to compromise your account.


Where does mutation engine resides in Metamorphic \polymorphic viruses? I was reading about Metamorphic & polymorphic viruses ..

to what i understood ; they both uses mutation engines  to avoid detection by anti-viruses, as the polymorphic encrypts\decrypts its code , and the metamorphic generates a logical equivalent code.

According to what i know , viruses are parasitic  male-ware. i.e. it needs a host to produce copies of itself and cannot act independently like worms .

So my question is , during the virus's typical life cycle (infection - duplications- activating payload- etc   )  , where is the mutation engine in all this ? And when a virus moves from its host to another PC what happens to the engine ? And what happens at the next host in the first cycle , how can it achieve its mutation ?

The mutation engine is contained in the virus body.

It is just another module of the virus. Viruses typically have a file scanning module, an infection module, a mutation module, a payload module and many others. On infection, the mutation module is used to mutate all of its modules and pass them to the infected host.

Mutation engines are mostly targeted by antivirus engines because they have typical behavior and are often used for multiple families of infector malware. They are targeted also because they are weekly mutated. That is because "mutating" the "mutator" can lead to bad "monster mutations" :)


How does a nonce reset allow for decryption? I'm sure that by now most InfoSec-lovers have heard about KRACK.
If you haven't, check out this great explaination by a fellow StackExchanger.

It's a new attack on WPA2 which allows for decryption and forging of packets in certain (and certainly quite a lot of them) scenarios by abusing a flaw in the 4-way-handshake.

Reading the research paper, I still don't understand why this attack is possible. I understood how we may abuse retransmission of message 3 during a 4-way-handshake to force key reinstallation.

Why does key reinstallation (or more specifically a client nonce reset) allow for decryption or forging?

This is because of being able to figure out the keystream for a given key and nonce when you can get both to be reused and the stream contains predictable information.

In many ciphers, a key is used to produce a series of ones and zeros that are xor'd with the data to produce an encrypted value.  This string of ones and zeros is known as the keystream.  If you are able to reuse a nonce and the keystream isn't altered based on the content of previous plaintext blocks, then you can look for known packets to appear in the content.  When these known packets occur, you will see a predictable pattern occur and will be able to determine that you know that portion of the keystream.

By repeating the process, you eventually can gain more and more knowledge of the keystream and can then read or manipulate anything found on a known portion of the keystream.  RC4 is EXTREMELY vulnerable to nonce reuse as it is a pure xor'd keystream.  Similarly CTR modes of AES will be extremely susceptible.  AES CBC-MAC will be a bit less impacted, however doing constant key resetting could potentially bypass the chaining due to always using the same set of initial blocks, so some information leakage would potentially still be possible, especially for the attacker faking a new client where racing will not be a factor.


What is the standard way, if any, to announce via e-mail that you have a public PGP key and what it is? I'm making an e-mail system/client. I'm trying to correctly detect incoming e-mails which can be replied to with PGP encryption. This means finding out their public PGP key. I currently do:

Parse the e-mail body for a PGP public key block.

I suspect that these could be done:

Check for attachments with some kind of standard file name?
Check for a special hidden header which either spells out the public PGP key directly, or links to an external resource where it can be fetched?

Thanks in advance for clarifying how one properly detects/sends PGP public keys in e-mail context for maximum support.

There's no one particular way to do this. Just signing all outgoing mail is one way people advertise that they support PGP provided their key is on a public keyserver.
Enigmail (Thunderbird plugin) has an option to include a public key as an attachment in all outgoing mail.  It has a type of application/pgp-keys and the name is 0x<KEYID>.asc where <KEYID> is the key ID in hex.
There are several clients which support Autocrypt, a protocol for opportunistic encryption by storing public keys in headers.


Pin required for accessing (smartcard) Card Authentication Slot So let me set the stage:

I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html

I made a couple changes, instead of the Digital Signature slot, I used the Card Authentication slot.  The reason for that is, by the spec and Yubikey's documentation it appears:

  This certificate and its associated private key is used to support
  additional physical access applications, such as providing physical
  access to buildings via PIV-enabled door locks. The end user PIN is
  NOT required to perform private key operations for this slot.

So that seems great, however it appears in order to interact with this slot, my openssl/pkcs11 configuration requires a PIN anyways.  I could simply include the PIN in any scripted interactions with the CA but this just doesn't seem correct.

Has anyone experienced this, and or worked around it?

The sole purpose of a CA is to issue digital signatures, specifically to sign the public keys of subordinate certificates;
Choosing a key function other than "digital signature" is contrary to this purpose.

Shouldn't you have the CA cert in the Digital Signature slot, and then a subordinate certificate (trusted by the EAPOL device) in the card-auth slot?


What is the point of AES key wrap (with JSON Web Encryption)? I'm looking at JSON Web Encryption (JWE) and am left a bit confused about why you would use AES key wrapping.

The document even talks about using matching key algorithm strengths:

  Algorithms of matching strengths should be used together whenever
     possible.  For instance, when AES Key Wrap is used with a given key
     size, using the same key size is recommended when AES GCM is also
     used.  If the key encryption and content encryption algorithms are
     different, the effective security is determined by the weaker of the
     two algorithms.

Essentially I'm wondering why you would use AES key wrap at all.

Example

So for an example comparison, using the A256GCM encryption algorithm I need a 256-bit key. Just to be easy my key will be "secret0123456789secret0123456789" and I'm encoding "Test".

DIR

Using direct (DIR) key algorithm (so using my key as the content key), I get:

eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..Vlf_WdLm-spHbfJe.RxMPrw.5VC8Y_qSPdSubbGNGyfn6A

This breaks down as:

         JWE Header:  {"alg":"dir","enc":"A256GCM"}
Encrypted key (CEK):  (blank)
                 IV:  Vlf_WdLm-spHbfJe
         Ciphertext:  RxMPrw
 Authentication Tag:  5VC8Y_qSPdSubbGNGyfn6A

A256KW

Matching the key wrap algorithm with the encryption algorithm, I'll use a AES 256 bit key, which yields:

eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIn0.66xZoxFI18zfvLMO6WU1zzqqX1tT8xu_qZzMQyPcfVuajPNkOJUXQA.X5ZL8yaOektXmfny.brz-Lg.xG-EvM-9hrw0XRiuRW7HrA

This breaks down as:

         JWE Header:  {"alg":"A256KW","enc":"A256GCM"}
Encrypted key (CEK):  66xZoxFI18zfvLMO6WU1zzqqX1tT8xu_qZzMQyPcfVuajPNkOJUXQA
                 IV:  X5ZL8yaOektXmfny
         Ciphertext:  brz-Lg
 Authentication Tag:  xG-EvM-9hrw0XRiuRW7HrA

As I understand it, the content key is encrypted using JSON Web Key (JWK), but essentially what this is doing is:

creating a random 256 bit content encryption key (CEK)
encrypting the actual data with this CEK (and a random IV)
encrypting the CEK with my supplied key

The encrypted CEK, IV, and encrypted data are all part of the resultant JWE object (all base64url encoded).

Direct JWE results in a smaller payload to be sent over-the-wire, and I would presume it's slightly faster to both encrypt and decrypt because it's skipping a step.

Does using AES key wrap yield higher security, and if so, why? If not, why would you use it instead of just direct content encryption?

If you need to store a large amount of data, the advantage of wrapping the key within an encryption layer means that if you needed to change the key at a later time then you would not have to reencrypt all your data. You simply change the KEK (Key Encrypting Key) and reencrypt the CEK without having to transfer all the ciphertext again.

For example, say you were using JSON in order to transmit data to your server for safe storage. You could transmit all this data using A256KW and your server at the other end simply stores this.

That is, the following is transferred and then stored server-side:

Encrypted key (CEK):  66xZoxFI18zfvLMO6WU1zzqqX1tT8xu_qZzMQyPcfVuajPNkOJUXQA
                 IV:  X5ZL8yaOektXmfny
         Ciphertext:  brz-Lg
 Authentication Tag:  xG-EvM-9hrw0XRiuRW7HrA

If you needed to change the key you could simply pull the CEK to the client, decrypt with the old KEK and encrypt the CEK with the new key and then send it back to the server to update all relevant records.

For short-term transmission purposes only, this is not important and it would be easier to use Direct for a smaller payload.


Why should I expire validator links after a while? There are few kinds of links which validate something. For example when you create an account on a website, that website sends you an activating-link. You have to check your inbox and click on the email to activate your account.

As you know, that email isn't valid forever, it will be expired after a while. Why? What's the benefit of expiring links? In other word, what's wrong with keeping them valid until the user uses them?

[1] Efficiency:

Assuming you issue a new token for each link for every registration attempt, you will end up with a with a number of tokens that you have to keep track for an indefinite amount of times. For practicality terms I would suggest you set a time/date expiration period depending on the nature of your application.

[2] Security:

In the case of password reset function you want fresh tokens to minimise the likelihood of your token to be guessed or stolen by an adversary. Let's say for example we have a web application that issues a 6 digit password reset token that never expires. It will allow an attacker to initiate the password reset process and guess the correct password via bruteforcing all possible combinations. A time/date expiration will significantly minimise the attack window.

Creating a static token that is valid forever is bad practise. For all the reasons stated above depending on the nature of your web application, tokens must be adequately complex, fairly random and valid only for a reasonable amount of time.


Do I need to create a user in my database? I am building a web app, which uses a backend WebApi (requiring authorized users).
The system simply stores some input from the user similar to a post on facebook.

The front end (Angular) allows only social/external auth.
My backend can then use JWT Middleware to check that their JWT is valid for every request.
Assume my scopes are set correctly to always get the email claim.

So my question is, do I even need to register the user anymore?! I know this sounds crazy, but from now, isn't it just fine to let the user create posts in my system, and use their email address as the UserId? Am I missing something?

This question could be interpreted many different ways:

should my Database use a non-root user

Yes, you should create a non-root user (one for each unique app accessing the database to prevent your wordpress-db-user (do to some random wordpress exploit that comes out in the future) from having full access to your super-fancy-custom-web-apps-db and getting a full list of all of your users emails that you have been collecting.

should I create a user's table in my databse

Authentication or no ... this is kinda a no-brainer.  If you want to be able to link johndoe@qmail.com to his preferred alias super happy fun guy ... or one of your users decides that qmail sucks and they want to change there accounts email to johndoe@qahoo.com ... a users table with an internal UUID per user might be very useful.

do I need to store user-password-hashes for login

Yes and no ... putting full faith in some other websites authentication might save you from having to worry about having your local db hacked and having to report that a few thousand of your user's password hashes are out in the wild.  But at the same time, if a vulnerability is found in this third party's authentication it could very well leave you in a worse situation since you have no control over the third party patching it ... and nothing to fall back on if this third party decides to charge for this auth service or just discontinue it all together.

This is more of a business decision than a security decision ... there are lots of pros and cons of going each way.


WPA2 Security for Security System/IoT How safe are WiFi modules/devices for use in security systems or even IoT?

How effective are dictionary and brute-force attacks in cracking WPA2? Online tutorials I've seen such as this claim to be able to crack passwords in a matter of minutes using the GPU.

If I were to include WiFi in a security or IoT system, would using a very complicated SSID and passphrase, which would be changed regulary, keep me safe from attacks like those?

A complicated SSID does not determine the security strength of your network. However, the password complexity would decrease the time cracking the encryption key. I have been doing loads of GPU cracking attacks on WPA2. With a single and decent GPU I was able to go through the famous rockyou.txt wordlist (14 344 392 password) within a hour. Imagine the speed if the attacker rented a password cracking machine. These are not too expensive and are actively being used by attackers. A long passphrase with the use of upper, lower, special characters and numbers would mitigate the risk of being cracked significantly.


how to identify all packages in a Linux distribution which requires root access? To help me to prioritize security issues and be compliance with a patch-management policy, and to reduce the exposure to risk, I would like to have a list of all packages in
a Linux distribution (rpm based) which need high privilege to run and which have listen(3) capabilities and therefore, possible candidates for root exploitation.

Note that I don't want to map just the installed packaged, but all the possible packages
in distribution (given the packages come just from the official repositories and the package set is finite)

There is any way to get this information via RPM spec file?

There is any Distribution which provides this information?

There is any work/reseach done already in this direction?

To some extent, it is infeasible. You may run a firewall to manage such problems. If you want to do some, the comments other users have given to you are the most you can really think to do.

There are reasons why such classification is generally infeasible.
Then there are a few packages which files are encouraged not to be run but with high permissions.

You always need to refer to the specific system you plan to install the package into; therefore, such classification cannot be solely per-package. Examples:

File permissions may differ -after- the installation.
Even if the permissions won't change throughout the package's files, you can allow non-root users to use (some of) them by simply modifying your system groups.

You cannot rely uniquely on file permissions, but you shall know specific behaviours and semantics of binaries and scripts. Examples:

Take a simple HTTP server. Generally, it opens a port 80. Port 80 is below 1024 and you need advanced permissions. But if you change some conf file to a high port, then you won't need advanced permissions any more. Yet, the package is the same.
Moreover, how will you know IF the package has got what configuration files? If more than one?
What if you have a service accepting input from file rather than socket? (The file may be in a remote filesystem).

Finally, some package is intrinsically ambiguous by the classification you aim to do. Example:

If you want to make partitions your USB stick using some foo application, likely you are not gonna need any high privilege. However, the very same application foo may be used to change the partition table of the running system, which is likely a high privilege operation.

Perhaps there are other reasons, but I cannot think of them right now.


Building my own Darkspace I have searched through the internet about creating a darknet and there is a confusion.

There are two definitions, the first one is network used for private p2p (like freenet) and another one that refers to the "blank" IPs of a network and a way of protecting it by learning who is scanning the blank IPs.

I guess the tor and freenet are some darknets, but I want to create my own darknet.  So is there a guide of how to create a darknet-network on my own(the second definition), for the sake of network security testing?

This answer is based on my personal experience building and participating in a number of darknets. I haven't interacted with them in a security perspective, but I have been involved heavily in one (Anonet) and helped found another (Underlink, which is now mostly defunct).

The most important thing to know about a darknet is the definition. My definition of a darknet is a private network with internet-like routing between peers, often on the infrastructure of the actual internet. This is not an all-encompassing definition, this is just the one I am most familiar with.

In practice, what you need to start a darknet are direct connections between machines. These machines will be peers. You can plug an ethernet cable from one computer to another (but usually the machines are hundreds of miles away), or you can setup point-to-point virtual tunnels (I have used quicktun, sigmavpn, and openvpn in the past).

Now that you have two machines directly connected, they need to do some kind of routing. The clients on your darknet are going to want to send packets to arbitrary IP addresses and expect them to get them. This is where your routing comes in. The darknets I have participated in typically use BGP routing. Each server interested in participating in routing typically gets its own ASN (e.g. AS3090). When two machines peer, there is now a connection between the two machines, and the BGP routing daemons you run will be configured to advertise it.

A sample network map will look like this (this is an old visual map of the actual BGP setup on Anonet6):

Each bubble represents a machine doing routing on Anonet. Typically each machine here would get a /24 (the above map is of ano6, but I'll use IPv4 terminology because it's the same idea), and be free to assign addresses inside that however it wanted; that machine would handle final routing for them.

So let's say that AS3090 (lex, in the middle) is a dedicated machine in some datacenter. All of my computers, though, connect to that server using some standard VPN software (OpenVPN, in this case), and are given addresses on AS3090's /24. If one of my machines connected to AS3090 wants to send a packet to a machine in AS31416 (far right of the map), it has a few simple options:

AS3090 (lex) -> AS1112 (UFO)     -> AS31416 (JCS)
AS3090 (lex) -> AS404 (chris)    -> AS31415 (JCS) -> AS31416 (JCS)
AS3090 (lex) -> AS404 (chris)    -> AS405 (chris) -> AS31416 (JCS)
AS3090 (lex) -> AS2323 (achedaz) -> AS1112 (UFO)  -> AS31416 (JCS)

(this is just a subset of possible paths)

This is all part of the BGP routing framework (fwiw, I used bird and bird6 to handle BGP routing advertisements, but there are many other programs that will do this; it's not necessary that peers use the same software, either).

The first path in my list is the shortest (in number of hops, not necessarily in terms of latency, since each hop could be, and often is, located on a different continent), so the packets will take that path there. The response packets may well take a different path back, but that's not important; as long as they get to the origin server, they can still talk.

The beauty of this setup is that it functions just like the real internet (in fact, core parts of the internet use BGP routing just like this). If AS3090 (lex) loses its connection with AS1112 (UFO), then the packets will automatically choose a different path to AS31416. It's redundant in this way.

This also makes darknets very good for anonymity. If I am AS12345 (dBZ, top middle), the only person on the entire network who knows my true IP (in the case of virtual tunnels over the internet; otherwise, this applies with direct connections or so) is my only peer, AS1 (r101). The rest only see my internal IP inside AS12345's subnet. For authorities, or anybody else, to find out AS12345's location/IP, they have to follow the chain of peers and break each one to find out who they're connecting with. This can be extremely expensive on large darknets, since peers often cross borders (in Anonet, we actually planned out to cross borders for additional anonymity).

This stuff is pretty easy once you understand it. The hard part in growing a network like this is that it's decentralized. Anonet split in half multiple times during its life. The peering between AS3090 (lex) and AS757 (Vutral) could break at any minute, and those two halves of Anonet would completely cease to be connected. But the people in each half would still be able to talk to eachother. You can cut the darknet in half and it still survives.

But typing in a friend's IP address to access their services (websites, file sharing, whatever) isn't fun. You want DNS, right? Well, that requires some central authority to make sure nobody is infringing on eachothers' claims. On Anonet, the way we "solved" that was with something called "resdb": a git repo containing a set of claims. Anybody could make claims and commit changes. The key was to get others to accept your changes into their copy of the git repo. This meant that different people had different versions of the repo, so for some people a domain doesn't exist, for others it does, and for others it might exist but point somewhere completely different. (resdb contained a set of files and scripts to generate zone files for BIND and similar so that anyone could run their own DNS server for the ano. TLD).

But you don't just need DNS reservations to be unique. IP allocations should be unique, too. Wouldn't we all like to be 172.160.0.0/24? If multiple people are using that, we get conflicts, which means that those go in resdb as well and you need to convince people to accept your claims. You also need to handle AS number reservations and a dozen other things that ICANN handles on the internet. It turns into a big mess and it's very hard to scale since there is no central authority which has the final say on reservations.

I hope this gave you a bit of an idea of what a darknet is. Again, this is not a full definition, it's just based on my experiences, and a lot of it isn't really relevant to your goal. I know, for example, that some people have attempted to create darknets by using consumer routers flashed with DD-WRT (to connect geographically close peers together) rather than using the existing infrastructure on the internet.

If you have any questions, please feel free to ask for clarification. I'm no expert, but I have played around with this stuff quite a bit just out of pure interest.

You can read more about Anonet here (some of the information is outdated, though).


Security risk of copying I need to back up an encrypted drive, if the data gets corrupted I'd have another copy

I don't have another drive that I trust not to have been compromised right now.

My idea is to copy an encrypted image of the drive to the possibly compromised drive, and when I need it, I copy the image back to a secure drive. The data never gets decrypted on the possibly compromised drive, would I be vulnerable to any attacks?

Yes, this leaves you vulnerable to attacks involving diffing the ciphertexts on the two drives. Instead, you should create a new encrypted container on the backup drive, and then copy only the inner image from the primary to the backup.


Is a netcat server without -e exploitable? This is related to a college assignment.

I have an Ubuntu server I am trying to do a penetration test on. The server is running a netcat server which when I contact it sends me a nice info message from the lecturer. The question is, can I exploit the fact that there is a netcat server listening. It is not running with a shell using -eoption. When I recreate the environment on my own machines, everything I type on the client appears on the screen on the server as is expected but obviously the command (e.g. ls) are not executed.

I can't tell what version of netcat is running so I don't know if it has known vulnerabilities however all other services are fully patched so I suspect this is also (I have access to the apt logs). It's listening on a UDP port if that is of significance.

This is the script running on the server.

#!/bin/sh
(echo "Hello World"; cat) | nc -ul 3456

All the searching I have done tells me how to set up shell access using netcat using -e.

I you look at:
https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem
you can see that there are possibilities, if you are unable to alter the execution, it may be harder.

Note that it requires root, since you need to make a named pipe for sending raw terminal input to the other machine.


Access point uses different BSSID and deauth attack fails I'm using airgeddon (https://github.com/v1s1t0r1sh3r3/airgeddon) to perform a deauthentication attack on my wifi network.

When i put my wireless interface in monitor mode to scan the network from the outside I found the router's BSSID, which is 10:13:31:F1:48:8D, and then I tried to perform various deauthentication attacks on the network but all of them failed: my computer can successfully send packets but the network is not affected (since my other devices can access internet normally).

Then I ran Zenmap from inside of the network to check if my router's BSSID was correct and I found that all the devices connected to wifi shown a different BSSID for the router, which is: 10:13:31:F1:48:8C: the difference is in the last digit.

So I tried to perform the attack on the 8C BSSID manually (because it is not detected by airodump-ng) but the attack fails.

This is what I used for the attack:

aireplay-ng -0 0 -a 10:13:31:F1:48:8C wlp3s0mon

and the result is:

00:03:55 Waiting for beacon frame(BSSID 10:13:31:F1:48:8C) on channel 1
00:04:05 No such BSSID available.

using the channel 1 for the attack (the same attack works with 8D and channel set on 1).

There's a way to perform the attack on the correct BSSID?

Edit -------------------------

I've check if I'm currently injecting packets correctly , using

aireplay-ng -9 wlp3s0mon

and the output says Injection is working!
Then I put the security measures of my router in "low mode" but the attack is failing again and again.

I tried to impersonalize another device using -s option but then I recive 0/64 ACKs while attacking computer or phones.

The only devices that seems to be vulnerable is a linux wifi printer which gives me 64/64 ACKs but i can't check easily if it's actually working.

Whilst very similar, the base station's BSSID isn't the same as its MAC address.

What you observe on your wireless scanning and deauth attacks are BSSIDs which correspond to individual SSIDs, usually very similar to the interface's MAC address only incremented by one per SSID *:8D, *:8E, ... Notice that each radio on a base station is its own interface, so there could be multiple BSSIDs per SSID.

Once associated and port scanning, what you are seeing is a kind of ethernet network and the base station presents itself as a layer 2 device with its own MAC address *:8C.

For your attack you should definitely target the correct BSSID, not the interface's MAC address.

Possible causes for the attack failing are:

Your interface is not injecting packets properly;
You could be injecting on the wrong channel or radio band;
Some access points have counter-measures against basic attacks like broadcast deauth, so you'll probably need to issue a deauth whilst impersonating the target connected client;
In case of enterprise deployments, multiple APs will triangulate your position and compare it to the location of the victim, and decide to ignore your deauth packets;
Protected Management Frames (802.11w IIRC) could be required by the AP;


Are outputs of this random string generating software safe to use as strong passwords? Over a year ago, I've created a small form-based software.

It's purpose, as the title states, is random string generation.

It has options to combine numerical, small caps, large caps and special characters within the ASCII character set (94 in total). It will have support for UTF-8 soon (and will be marked as optional/experimental, because some websites do not allow anything but ASCII for passwords).

It uses RNGCryptoServiceProvider class and it's methods (GetBytes() and
ToString()) to produce an output.

If we select all options (entire ASCII), we have 94 characters.
We specify we want our output to be 64 characters long.

Our strength in bits is: 94^64 or log (base 2, 94) * 64 = 419

EDIT: Example: 4Ed(R{MQ_U9pQ#?9k'V2p1bpW+UrEBkebif9w'Qsp>n7i~PF,]DCdV18sqilN(ou

Question 1: Is it safe to use this output as a strong password?

Question 2: Is there anything else I should implement to enhance security?

Programming language: C#

IDE: SharpDevelop 4.4

Framework: .NET 4.5

The naive way of doing this:

... {
    result.Append(chars[b % (chars.Length)]);
}
tbOutput.Text = Convert.ToString(result);

will produces a password with non uniform character distribution, which is a weakness.

One way to generate unbiased output (untested, and I'm not a C# programmer, so some of the syntax might be off), note that this is probably not the most efficient method for doing this:

RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
System.Text.StringBuilder result = new System.Text.StringBuilder();

// assumption: chars.Length < ulong.MaxValue
ulong bound = ulong.MaxValue - (ulong.MaxValue % chars.Length);

while (result.Length < desiredPwLen) {
    // assumption: ulong is 64-bit
    ulong rndNum;
    do {
        byte[] rndBytes = new byte[8]; // assumption: 1 byte is 8 bits, so 8 bytes is 64 bits
        rng.GetBytes(rndBytes);
        rndNum = BitConverter.ToUInt64(rndBytes, 0);
    } while (rndNum >= bound); // rndNum above bound is biased, so we discard them, and roll again

    result.Append(chars[rndNum % chars.Length]);
}
string password = result.ToString();

Answer to your Questions:

  Is it safe to use this output as a strong password?

Probably yes, while your password encoding method has the weakness I mentioned above, if the length of your password are long enough, then it would have compensated for the bias.

  Is there anything else I should implement to enhance security?

I've provided above an improvement that fixes the bias.


Firewall Security vs Anti-Virus Overview of my question

I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily available, I feel as though they are not the best method for me to engage in. I want to explore my other methods.

Current Idea(s) for Alternative Methods

I am not too concerned about being "attacked" as my computer's are mainly gaming and internet (Social Media etc.) however on the rare occasions where I need to do some work, it is often involving sensitive information. This may vary from legal documentations, source code, financial information, databases etc. I want to know your opinion on how I handle this:

The first port of protocol is a firewall. I am currently looking into reliable firewall's for home use. I know there are many dependent firewalls such as Comodo, ESET and Kaspersky, but I am looking for just firewalls. I am thinking of reviewing one of these Firewall Packages. Now I know what you're thinking - why not just use an Anti-Virus plus Firewall? I am not too concerned with people getting in, I am more concerned with them extracting data - so I believe the AV is the last option to prevent this.
After the firewall, I usually password protect the documents with a
generic password (E.g. Pa$$w0rd), and then in a .7z encryption.
Being paranoid, I also lock them in a virtual drive. For this, I
have been using Symantec PGP Disk Encryption. I have been looking
around for other data encryption packages, but have not found any
decent competitors.
Network Monitoring is the next step/tactic I employ. Whilst this is highly ineffective, it's something that helps me sleep better at night. At present I use Network Magic. It lets me identify who is connected to the current Router/Internet Feed, lets me change the security method and the password in the event it has been compromised.
I guess the next thing I do, and possibly it makes absolutely no difference, is I continually change my IP address to prevent tracking. Like previously stated I am more concerned with people extracting the data from my computer so at any means, I will make it more difficult. (or at least attempt it!). Using the TOR network is painful, but if needed I will do.

What I need from you!

Basically (if you are not aware) I just want a secure way to prevent data theft (both cyber and physically). I do not necessarily want an AV, but I do need to employ some sort of security to help prevent access. I highly, highly doubt I'd ever be a target, but it is better to be safe then sorry.

I just want to know, if the above methods are worth employing, if they are effective, and how to maximise their functions. If you require more information please let me know.

Today (windows) computers are usually are fairly good locked against direct attacks from the network by default, at least if you specify that you are on a public network. That means they have a firewall, don't expose unneeded services to the outside etc.

  I am not too concerned about being "attacked" as my computer's are mainly gaming and internet (Social Media etc.)

Unfortunately that is exactly the activity which makes you vulnerable. Lots of current attacks just require you to surf to some web site and then you get infected by drive-by-downloads, which typically exploit vulnerabilities in Java, Flash, Acrobat Reader, but also in Microsoft Office or the browser itself. You don't even need to surf to shady or illegal sites, because most of this malware is spread by hacked normal sites or through advertising (malvertising).

What helps here are modern browsers with multiple protection layers (sandbox etc), which are up-to-date all the time. Of course the rest of the system should be up-to-date too and you should not install any software which you don't really need - because they might associate itself with some file types and then get automatically executed if you access specific content from the web.
What also helps is to block advertisements etc to reduce your attack surface (and lots of malware comes with the help of ad networks). And finally a virus scanner will help too.

And once the attacker got access to your system through malware all your local password protection might not be much worth, because the attacker can watch you, install key loggers etc and thus get access to these information.

If you have really sensitive data you might better use a separate throw-away system like a linux live-system or a virtual machine to surf the web, which should have only limited access to the outside (that is you get get data from this potentially compromised system put it can not push data to the main system).

Apart from that lots of web sites are vulnerable against web based attacks like cross-site-scripting or CSRF. These vulnerabilities can be used by other sites open within the same browser (not necessary at the same time) which can cause exposure of login information or other ways of identity theft or identity misuse. So you should not share the same browser profile for normal and for critical sites (like online banking).

If you follow all these tips you are not fully secure, but this helps more than installing some form of firewall, at least for how you use your computer.


If CSRF tokens are embedded in meta tags, how do they offer security? If someone is using my website, and they close a tab, then the CSRF token is now gone on the client side, because it was embedded on the page. If that same person opens the site in a new tab, the page will be delivered with the CSRF token in a meta tag. They didn't need to send the CSRF token for the page to be delivered, because the CSRF token was gone.

If a malicious website was somehow able to send my website a cross origin request, then what would stop it from simply requesting a page and then scanning through the response data for the CSRF token?

They are safe because of the Same-Origin Policy: an origin A (site.com) cannot read a resource from another origin (other.fr) unless you've whitelisted that using Access-Control-Allow-Origin.

In case of basic CSRF, the attack does not consist in reading the response, but it consists in tricking the server to do an action that was fired by a victim user without this victim being aware of it.

So in basic CSRF, the victim has a token that attacker cannot know (Same-Origin policy prevents it). When victim requests something from the server (/user/delete?id=15 but in real world, do not pass the ID by GET but by POST since it's changing server's state), then the server will check if that token is present and valid. If not (because it's fired by the attacker, which cannot know the token) then the server refuses to process it and the user 15 is not deleted. When token is here and valid, the server deletes the user and returns the response (that one can still not be read by attacker).

So Same-Origin prevents attacker from reading the response, while CSRF token prevents the server from processing an unwilled request.


What happens if a Dropbox folder is encrypted by WannaCrypt / WannaCry? Does one's Dropbox "data in the cloud" also get encrypted?

If your local files get encrypted and synced they will also be encrypted in your online folders. Luckily Dropbox supports file versioning (https://www.dropbox.com/help/security/recover-older-versions) so if you happened to have your files in Dropbox get encrypted you can restore them easily.


How can I prevent reflected XSS in my JSON web services? I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response.

This is open to XSS if the response is rendered as HTML by the browser since someone could add arbitrary HTML to the request object.

What is the standard way to mitigate this? Current options I can think of are:

Only allow requests with X-Requested-With: XMLHttpRequest header to stop attacks that rely on non-ajax requests to my service
Send the response with content type application/json and hope the browser refuses to render this as HTML
Encode unsafe characters in the response (how do I do this? using \uxxxx?)

I have been unable to find a concrete reference on this.

Encode unsafe characters in the response (how do I do this? using \uxxxx?)

Yes. < to \u003C in particular.

There may be an option in your JSON encoder to do this already (eg in PHP, JSON_HEX_TAG); otherwise, it's a simple job to do a string replace after the encoding. (This is safe as there is no place a < may legally be used in JSON other than in a string literal.) At this point you can also include the leading chaff to prevent cross-origin script inclusion.

I would send as application/json as a matter of correctness, but I wouldn't trust every older browser to necessarily honour it. Relying on the X-Requested-With header is generally problematic as it doesn't play well with caching, though that may not be a concern for you.


Company device on home wifi I was surfing some risque sites on my home computer, then I realized that my company's Phone was connected tonthe same wifi.  Can the company phone "see" or record what's being done on another computer?

Short answer: no. Long answer: If there's no reason to investigate, you're probably good. They could in theory, but it is highly unlikely. If they have installed monitoring software on the device, even then they will usually not directly see what sites you visit at home. That is only easy and legal on their network. What sites you visit on your private network is your private information. Maybe your history logs can be read out, but if you've used private browsing for this it its not a problem.


Risk and probability from CVE How can I find risk and probability from CVE (https://cve.mitre.org/)? I read an article and it says (pg 14),

  The cost is derived from the attack tree, and risk and probability are
  based on CVE

The article is about DoS attack and IoT networks.

CVE is not going to provide that level of information, as you probably saw. CVSS, on the other hand, does. CVE often links to the NVD, which uses CVSS scoring, so it might be an easy mistake to make.

Many information security people confuse "risk" with "impact". So, if we assume that they meant "impact and probability are based on CVSS", then everything makes sense.

Here's an example:
https://nvd.nist.gov/vuln/detail/CVE-2017-14888

Impact
CVSS v3.0 Severity and Metrics:
Base Score: 7.8 HIGH
Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (V3 legend)
Impact Score: 5.9
Exploitability Score: 1.8

Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

The long string of codes helps to define the problem.

Impact and probability are often determined directly from the "Impact Score" and "Exploitability Score" of the vulnerability. Whether they should do that is another issue entirely. But it is a common practice and a straightforward thing to do for consistency in a research paper.


How are "Certificate Signing" key usage certificates restricted to what domains they can sign? Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate Signing" key usage attribute. However I've noticed in some cases that the intermediate certificate is simply granted to "Company Name" and there is no mention of anything related to a domain name. How is the company prevented from signing certificates for any domain name other than its own?

The certificate chain for Microsoft has no mention of domain name anywhere other than the last certificate in the chain.

You have just shown why operating a CA is a position of responsibility, and why manufacturers of operating systems and web browsers limit the list of trusted CAs to around 100 world-wide by default.

When a CA delegates signing to a subordinate CA, the parent CA will typically impose name constraints or other policy constraints on the subordinate CA (for example, a subordinate CA descending from "US DoD CCEB Interoperability Root CA 1" may require the issuing CA to only sign Machine Authentication certificates if the SubjectCN and SubjectAN entries end in ".mil"). The parent CA may also limit by policy the chain length, preventing a subordinate CA from delegating additional subordinate CAs.

Much of this is documented and curated as standards and best practices by the CA/Browser forum. Additionally, Entrust's whitepaper about peer cross-signing of CAs has some interesting and accessible information about policy constraints.

Hope that helps.


Sharing passwords through email can be considered insecure? I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need to tell me it or I should change it and tell him. In any case, the password has to be send.

So far I've been using email, but I'm not sure whether this is an appropriate way. Web services usually send your password to your email, but also you are allowed to change the password. In this case, it's for intranet applications and in order to change the password, always someone else needs to know the password as well.

When the new account is for someone placed at my location, I just approach him and tell him his login information, but there are many locations within this intranet, so often approach the new user is impossible.

PS: colleagues were using Skype as well.

Email is insecure. Emails can be lost, misdirected, eavesdropped and faked. Sending a password by email is a big vulnerability.

"We" do it nonetheless because in some situations alternatives are just worse for usability reasons. And we apply mitigation measures:

The password is temporary and does not allow access directly; it only gives access to a "password change" interface, this time through some protected tunnel (HTTPS...).
If the temporary password has not been used within a small amount of time, it is deactivated, and an alarm is raised.
The temporary password is deactivated automatically after usage.
Users are trained to raise alarms when they fail to receive an expected password by email, or when they try to use it and find that it is already deactivated.

Using Skype messages to transmit the temporary password might be a better idea. Skype messages are less routinely eavesdropped by amateur attackers, because they are encrypted, making the spying harder (details are not published but that's still better than no encryption at all). On the other hand, there is suspicion that Skype messages are routinely inspected by some governmental agencies (of various governments) who were given some backdoor access. That way, you get to choose the kind of attacker who can spy on the temporary passwords...

Spelling out passwords by phone may be a good idea, too. Phone lines are no safer against eavesdropping than Skype, but a phone call is synchronous: you can make the user apply the temporary password and choose his new password while he is talking to you. This may greatly reduce the window of vulnerability.


Identifying a Cheater in Public Voting Campaign A local brewery recently ran a photo contest where the grand prize winner is determined by a public vote using a third party platform/administration. One of the entrants reached out to us because they suspected that someone was using a platform or application to enter multiple votes at one time. In the last hour they got an additional 200 votes. When I pulled the file, sure enough, there were spats of votes coming from the same IP address.

Is there any way to look up the owner of an IP address? Are you familiar with these types of voting platforms? Can they mask or give a dummy IP address?

The only information that we took when consumers voted was first name, last name and email. We can see that this person cheated but we need hard evidence that leads the cheating back to this particular person. Partly, because we believe a staff member may also be involved.

My question is, is there anyway to lookup the owner of an IP address?

Yes, search for Reverse IP Lookup and you will find a couple free services with varying amount of information. It won't be that useful anyway, because unless you can subpoena his ISP, you will not get his name and address. And the ISP will not be willing to cooperate.

  can they mask or give a dummy IP address?

It depends heavily on the platform. Usually the IP returned is the IP used for accessing the form, so you probably can trust the information on your file.

  Any insight would be helpful, if you have any thoughts!

Your priority is to bring fairness to the contest, not bring the cheater to justice. Don't waste any time time to unmask the person behind the cheat, only the cheating votes.

You have a collection of emails, right? Send an email to every address with a confirmation link, linking to a page protected with a good CAPTCHA, and ask again the first and last name for confirmation. This can reduce the amount of duplicate votes you will get, because will increase the work needed to the cheater.

And don't disclose publicly how many votes the contestants have, so you can remove the duplicate votes on the background without the attacker knowing their votes were disqualified. You can then remove all duplicate votes from the same IP address, silently, and have a fairer contest.

But if one of the staffers are involved, it's going to be more difficult to protect the fairness of the contest.


Do I need a new CSR for a certificate renewal? I want to renew my expired certificate I'm using in Tomcat for SSL.  Other posts indicate that to renew my certificate I need to create a new CSR and obtain a new certificate and import into my keystore.  However, if my private key is the same, why can I not just use the original CSR to request a new certificate?

The short answer is that while yes you can reuse the CSR, it doesn't mean you should.

It's worth considering that encryption methods can improve over time (e.g., generating RSA keys @ 2048 or 4096 vs 1024 awhile back, sha256 vs. sha512, etc) so it's probably best to just generate a new one considering how trivial it is and increasing the private key strength if it's outdated.


Who are some renowned academicians or PhD guides in Information Security? The question might seem opinion based, but I wish to know who are some people who are academicians or PhD guides in the field of Information Security?

Here are a few

Dr. Ron Ross NIST Fellow
Dr. Whitfield Diffie, Cybersecurity Advisor
Dr. Dan Geer, In-Q-Tel
Dr. John McLean, Naval Research Laboratory
Prof. Angela Sasse, University College London
Prof. Fred Schneider, Cornell University
Mr. Phil Venables, Goldman Sachs
Prof. David Wagner, University California at Berkeley
Dr. Jeannette Wing, Microsoft Research
Dr. Matthew Green
Bruce Schneier
Eduard Karel de Jong


What is the right way to implement Keyed Password Hashing? As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given

a password (of course),
a salt (generated Cryptographically Secure Random Number Generator.
iteration count (chosen high enough to be secure while balancing your application's usability tolerance)
Hash size (length of the hash to be computed)

/**
     *  Computes the PBKDF2 hash of a password.
     *
     * @param   password    the password to hash.
     * @param   salt        the salt
     * @param   iterations  the iteration count (slowness factor)
     * @param   bytes       the length of the hash to compute in bytes
     * @return              the PBDKF2 hash of the password
     */
    private static byte[] pbkdf2(char[] password, byte[] salt, int iterations, int bytes)
        throws NoSuchAlgorithmException, InvalidKeySpecException
    {
        PBEKeySpec spec = new PBEKeySpec(password, salt, iterations, bytes * 8);
        SecretKeyFactory skf = SecretKeyFactory.getInstance(PBKDF2_ALGORITHM);
        return skf.generateSecret(spec).getEncoded();
    }

Now my question is :

How should the Keyed hashing for the password be implemented ?

Based on my reading, this is my line of thinking. Please validate.

Keep the salt argument to the method pbkdf2 (in the code snippet above) secret (obtain it from a highly secure HSM as opposed to storing it in the database alongside the password hash when needed).
Since the salt is meant to be random (to protect them from the rainbow tables / dictionary attacks), the salt provided to the pbkdf2 should be a concatenation of the key and a random bytes generated from a CSPRNG.

[salt] = [secret key] + [random bytes from a CSPRNG]

Finally, I will dare to ask a silly question (will dare to ask since high iteration count is posing a serious usability issue since we need to authenticate for 90% of the use cases in our application)

Can we reduce the iteration count OR do without it since we have added an additional layer of security through the Keyed hashing ?

P.S: I am aware of the value that slow hashing algorithms add by reducing the possibility of passwords getting compromised through brute force attacks. Just want the experts to comment on the security value addition through Keyed Hashing VS having a Slow Hashing algorithm with non-secret salt.

One way to combine password hash with a secret key is to have a separate device (i.e. HSM) which encrypts password hashes sent from auth server using a key only known by the device itself.

At user login, your auth server calculates a slow hash (say, bcrypt) with proper cost setting (whatever is tolerable for the server/situation, 5ms, 20ms, 100ms?) and passes the resulting hash to the encryption device, which in turn returns the encrypted blob which you can verify on the auth server (auth server stores hash identifier, cost, salt, possible "encryption device key identifier material" and the encrypted blob).

The "encryption device" will not allow the auth server to decrypt hashes, only encrypt and return the encrypted blob to auth server.

The separate key adds another layer of security if it is not under the same thread model than the auth server/hash database.

Using a separate, narrow access device which holds a strong key defeats attacks that get hold of the leaked user database (and auth server files).


What are the common features to identify CSRF attack from Apache log file? I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log entries in access log.

127.0.0.1 - - [15/Dec/2018:22:01:21 +0530] "GET /DVWA/vulnerabilities/csrf/?password_new=abc123&password_conf=abc123&Change=Change HTTP/1.1" 200 4303

If any authenticated user will try to change the password, then same entries will be there in log file.

I want to know that what are be the common/expert features in log file which will identify that CSRF attack has been performed.

Note - I am doing log analysis in order to write an algorithm which will increase the accuracy in finding out the suspicious users through log file based upon the features of CSRF. I want help to find out the features.
I have read this important link's information about CSRF features in Log file.
Your help would be appreciated.

If you do not have CSRF protection in place, you can gather from the logs that a page has been spontaneously accessed, without going though an expected set of pages (each of them bringing in its CSRF token).

Unfortunately if your site is being scanned and walked though, this out-of-band approach will not work easily, and in that case the volume of queries may be an indication (possibly of an attack / reconnaissance, not of a CSRF attack specifically)

In other words, there are no clear indications of a CSRF attack being performed.

If you do have CSRF protection in place, it depends where the token is.

If it is in the body of the request (specifically, the headers) - you will not see it in the logs either.
If it is in the URL arguments, then you can search in the logs for URLs which do not have the token.


NMAP reporting all ports open I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between.

I tried the SYN scan, and when I check the traffic in WireShark I see the SYN/ACK reply for every port. Same goes for the TCP Connect scan, I see the full handshake, etc..

If I for example try to connect to 5900 using vnc viewer, I receive the connecting message but that's it.

I'm looking for a reliable way to check for open ports.

If you are getting SYN/ACKs, then the ports are open. The firewall may be responding to all ports on behalf of the server behind it if there are no forwarding rules configured.

If you mean that you want to know if there are legitimate running services on those ports, then you need to do what you just did: connect to them and "banner grab".

Nmap can do all that.