Practical advantage of requiring VPN for SSH I have some VPS servers which I manage through ssh. However there are many ports which I want open during development, therefore I also have OpenVPN on them.

Now I am wondering if it would make sense requiring a OpenVPN connection for ssh access. Is there any practical security advantage on a ssh connection through a VPN (same server) vs a direct ssh access?

The first response that comes to mind is: "Only if you want to slow down your SSH sessions even more."

OpenVPN and SSH perform very similar tasks in very similar ways. Assuming that you have set up your SSH in a secure way, you are not increasing your protection against the typical threat scenarios.

That said, if you are extremely paranoid about your encrypted connections getting decrypted (by government alphabet soup, et al.), then tunneling your tunnels might delay them further. But, this threat is the only one that I can imagine that SSH in an OpenVPN tunnel would protect against.


SMS Spoofing not available in kali Has the SMS Spoofing option been removed from the Social Engineering Toolkit ? I run 3.14-kali1-amd64. I get only the options shown below. Tried updating both kali and SET but i  still dont get the option. Is there a separate package i can i use for it ?

Select from the menu:

Spear-Phishing Attack Vectors
Website Attack Vectors
Infectious Media Generator
Create a Payload and Listener
Mass Mailer Attack
Arduino-Based Attack Vector
Wireless Access Point Attack Vector
QRCode Generator Attack Vector
Powershell Attack Vectors
Third Party Modules
Return back to the main menu.

This is the current state of the menu definitions from their GitHub repo. It looks like the SMS module was disabled May 30th, 2014 in this commit. No explanation of why. You could file an issue on their GitHub and ask.


Missing DEK-Info header when converting from P12 to PEM using OpenSSL 2.8.3 I'm using openssl to convert an exported *.p12 file into a *.pem file that has a certificate and an encrypted private key.

The P12 file was exported with a password, this is the command that I'm using to generate the PEM file:

openssl pkcs12 -clcerts -in exported.p12 -out both.pem

When I run that command I provide a PEM passphrase, the contents look like this:

Bag Attributes
    friendlyName: Some Friendly Name: com.example.org
    localKeyID: 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99
    ... other attributes omitted ...
-----BEGIN CERTIFICATE-----
MIIGijCCBXKgAwIBAgIIQzWHsGhNz0wwDQYJKoZIhvcNAQELBQAwgZYxCzAJBgNV
... contents of certificate ...
-----END CERTIFICATE-----
Bag Attributes
    friendlyName: My Name
    localKeyID: 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99 99
Key Attributes: <No Attributes>
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIQ9XzwbRcn0ACAggA
... contents of key ...
-----END ENCRYPTED PRIVATE KEY-----

After I have that PEM file; I'm trying to load it using Go's crypto/tls and crypto/x509 package, like this:

var block *pem.Block
for {
  block, bytes = pem.Decode(bytes)
  if block.Type == "PRIVATE KEY" || strings.HasSuffix(block.Type, "PRIVATE KEY") {
    bytes, err := x509.DecryptPEMBlock(block, []byte(password))
    if err != nil {
        return nil, err
    }
  }
}

However that snippet returns the following error:

Error: fromPEMBytes: x509: no DEK-Info header in block

Reading a bit on the DEK-Info header it seems that it should look like this:

-----BEGIN ENCRYPTED PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,5B01E932988DC66B

EPESt4ZVIrxnQXxxWWVa7cCR+vgNZ/4vTu4mdq6pjaW7jMZoB8HV+mA745mQkQw7
... contents of private key ...

However I can't seem to figure out how to get OpenSSL to add such headers to the PEM file, I'm using the following OpenSSL version:

➜  ~ openssl version
LibreSSL 2.8.3

Am I' missing something obvious?, any help is really appreciated!

That's not any version of OpenSSL. LibreSSL is a fork of OpenSSL and has its own version numbering and history that is now separate from OpenSSL, although it continues to use the same external interfaces including the program name. However, the fork started from OpenSSL 1.0.2-something, which is greater than 1.0.0, and in all OpenSSL versions from 1.0.0 in 2010 up pkcs12 (import) writes the privatekey in 'new' (2000!) PKCS8 formats rather than the 'legacy' or 'traditional' formats from about 1990, which is what your software apparently wants.

In OpenSSL you can use the rsa subcommand to write a traditional-format file:

openssl rsa <p8file >oldfile -des3 # or other supported -$cipher

I can't guarantee LibreSSL retained this functionality, but it's worth a try.

FYI the encryption, or more specifically the password-based key derivation, used in traditional-format files is extremely weak. Unless you use a very strong password -- i.e. one strong enough a normal human can't rememeber it -- this file can probably be broken by an adversary who gets their hands on it. That's why PKCS8 is preferable and it was used at the first opportunity for an incompatible change. This has been asked and answered dozens of times on security.SX and/or crypto.SX; if interested searching for EVP_BytesToKey should find you many of them and links to more. (This issue also affects the enc subcommand, possibly excepting version 1.1.1, so you may need to skip over questions about that.)


Is it possible to disable NFC on credit card? I have credit card with wireless payment.

For low prices it does not require to enter pin code.

An attacker with 100$ device can take these money whithout my knowledge.

Of course, I can configure day limits but as I know wireless payments can be made offline (?)

Can i completely protect card from such cases with some kind of package (made of foil or some material which block radiowaves)?

To answer the question briefly, and if we're only talking about wireless payment, yes it is possible. You can ask your bank for a non-NFC card, or simply to not allow NFC payments, which would be the first step. Or it can be physically disabled by placing it inside a NFC-blocking wallet, whose actual efficiency varies, or even sabotaged by making a cut into its antenna with a pair of scissors, and using a flashlight as displayed below is the best way to find where to cut, though I would only recommend this if you really know what you're doing:

Now the technology used for a specific card is dependant on the bank, and the country, not everyone uses the same technology. Some cards plainly transmit their PAN and expiry date, some keep the CVV separate, some rely on different information, some generate temporary tokens, some have a CVV that changes every hour... the technology solutions are many, you may as well check yourself using a NFC-capable device, like many smartphones today, and see which kind of information gets transmitted.

When it comes to payment security, your first resort is local law. Some countries hold banks liable for any card fraud caused by their negligence, and a card that dispenses its information too generously is in fact a negligence. Your second resort is bank policy, some banks will cover damage caused in the event of card fraud, others won't. It is up to you to figure out how much you are covered on both fronts, and decide if it's worth it. And then, you have to hope you're not liable. The general baseline is that as long as the card wasn't stolen nor lost, and is still in your possession, and you haven't publicly and consciously disclosed its information, you won't be considered liable, but things aren't as easy anymore. While higher security cards reduce the risk of fraud, it comes at the cost of making you more liable; fraud became much harder, but so does justifying it is an actual fraud, and neither bank policy nor local law may cover you. I'd go as far as claiming many of these technologies claiming to be "safer" only serve to make you more liable, because these is no greater safety than law and policy.

The best solution remains to request your bank not to use NFC, because disabling or sabotaging a NFC card will only prevent you from using it, but it won't prevent the card information from being very valid and usable. Simply ask your bank, they should have no issue disabling NFC payments, no need to even reissue a new card. Some banks even provide you the option in a smartphone app.

As for actual fraud, well it happened to me. I can easily see why, my card provides all information via NFC, but I am 100% covered, and I like how this primitive and unsafe technology relieves me of any liability, as long as I don't lose it. It's all about mitigating risk, similar to how this kind of fraud isn't very profitable, but very unlikely to get investigated.


SSH password vs. key authentication I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took care to use different passwords for different servers (pwgen generated passwords; they are reasonably difficult to brute-force, but guaranteed to be written down by the user). So I'd like to ask:

Does using password make more sense for administration (non-root with more or less sudo capabilities) full shell login. Given that passwords are different where the key probably wouldn't be and the password than used for sudo as well.
Was it OK even for special account for sftp upload (restricted to particular directory) where the password ends up in a file on some other server, because the upload needs to be unattended? The public key would end up stored unencrypted on the same other server.

It's kind of like this… I am divorced and have a vitriolic ex wife. I also have three great boys, who like most boys can be forgetful, lose things, and who also love their mom. When my boys got old enough to need a key to my house, I had a decision to make: do I use a keyed lock or one of those numeric key pads? If I use the keyed lock, it was certain that my sons would regularly be losing keys; I would be getting calls to come home from work to let them in; and there was a big possibility I would have to replace the lock or have it re-keyed from time-to-time because the number of "lost keys" (or probability my vitriolic ex wife now possessed one) reached an uncomfortable limit.

While not maybe the safest in the world, with the numeric lock I had no concerns about the keys being lost; I could text my sons the combo from work (without coming home) when they forgot it; and I could periodically change it when I felt it was compromised. I could also decide how long and/or complex I wanted it. If I thought my ex had it, I could change it as well. A lot simpler and less total cost of ownership.

The keyed lock is like PK. The numeric lock is like passwords. In the end, I can tell you, I am a lot safer with the numeric lock, because I choose my own destiny and can do so as dynamically as I want. And remember, the reality is that the door is just one of the ways into my house.


Authenticate tracking device with TCP server I am building a tracking device and am looking for a secure authentication method to use when the device wants to establish a connection to the server.

The server is a TCP server that we open a connection with over TLS. We use TLS to encrypt traffic between the device and the server to rule out the chances of having the data being sniffed by a hacker. The device establishes a connection with the server using mobile network data from the onboard SIM.

If the device is physically compromised, this isn't a problem (we're not bothered about preventing this, as if they've lost the device it's not their location anyway). Also, as we're using TLS, we don't have to worry about someone scanning communications between the device and the mobile network. The main concern is to stop someone from spoofing/emulating one of the tracking devices. We don't want hackers setting the location of another user's tracking device.

Would it be sufficient to provide a device ID and a secure hash password that we send to the TCP server for authentication (obviously unique for each device) when a connection is established? I am unsure of authentication methods here and would appreciate any guidance.

BOUNTY EDIT: Some comments mention the best way to do this is through client certificates. I do not have any knowledge in this area and if this is the best option, would be interested to see an answer explaining this in more detail. Also, on a complete sidenote, would it be a bad idea to stop using TLS in our devices and use another method that doesn't include encryption? We're aware of the extra overhead that we incur when using TLS so if there's another method for securing authentication that doesn't use encryption then I'd love to hear it. After all, what are the chances of somebody actually sniffing traffic between one of our devices and a mobile network, and then using the device's identity to send malicious/fake coordinates?

Universally Unique ID v 4 with device pre registration sounds about right for this sort of application. When a device is in the factory you flash it's firmware with a UUID in it. Then you register that UUID with the DB. If the UUID exists, you generate and flash a new one.

This should be exactly what you want because now if someone grabs a device, they have NO IDEA what other devices have ever been created or how to impersonate that device without making as many guesses as there are atoms in the universe. Better yet you can encrypt this UUID in some sort of permanent user side cookie(Like JWT) that gets sent over and can only be decoded on the server and never needs to be modified by the client.

Now the best a person who stole one can do is to impersonate that device... and the question then becomes to what end? You've already stated if that happens you no longer care.

Device pre-registration is kind of similar to private client keys and serves almost the same role. They're just easier to implement since you don't have to run an extra check in SSL. You just have to decode the cookie that gets sent and never changed and verify it as the device in a data-store somewhere. Better yet you could even have a way to update the value of this cookie in OTA updates to change it every so often with some sort of garbage data that doesn't change the UUID.

And if you're worried about overhead, this can be done with a script that generates the UUID, check if it's in the database, regenerates if need be or stores, then generates the cookie, and finally modifies the firmware and flashes the value into the permanent cookie space. Then it just becomes a push button operation.


Authentication followed by storage decryption on login? I got a typical login setup: Username/password that is passed to server, hashed/salted with PBKDF2, then compared to hashed/salted entry in login database. After that, JWT token is generated and returned to client.

However, after login an AES-256 encrypted SQLite database file needs to be accessed for that user. I obviously don't want to use the stored login hash as the key, especially if they are in the same location because it might as well be plaintext. What if I stored a separate hash/salt operation on the password, then mixed it with a private key stored in a vault, and then used that as the key to open the SQLite file?

Am I making this too complicated? Or should I be pursuing a simpler solution and just putting everything in a vault?

It's usually a bad idea to encrypt user data with a key based on their password. What if they forget their password?

If you really want to, the "KDF" in "PBKDF2" stands for Key Derivation Function. So you could use that again to derive a key for the database. Remember to implement a mechanism to change the password as well. Depending on your setup, this might mean encrypting your database with a fixed random key per user, then encrypting that key with the one derived from the password. No PKI required.


Is sha256 a good function to derive 256 bit keys from a secret of sufficient length and entropy? Assuming I have a secret key of sufficient length and entropy (I get to decide the length and have a good random source).

I would like to generate 256 length keys by hashing the root key with the name of each key, ex:

key1 = sha256(rootKey +"key1")
key2 = sha256(rootKey +"key2")
...
keyN = sha256(rootKey +"keyN")

Is the sha256 hash a good choice ?

If yes, what length should the root secret be ? I'm thinking 256 bit is pretty good, but it wouldn't cost much to make it bigger...

Assuming the input key is sufficiently entropic by itself, and both the input key and the identifier have a fixed length, you can safely use SHA-256 to derive extra keys. A fixed length is required to avoid length extension attacks which affect all non-truncated Merkle–Damgård hashes, including SHA-256. A safer way to do this, however, is to use HMAC for key derivation, which makes this scheme more flexible so length extension attacks are not a worry. When using HMAC, the input key is used as the HMAC key, and the identifier is the message to be hashed. You can also use a standard KDF such as HKDF.


Attackers posting large HTML pages - just spam? or something more sinister? More and more, lately - I've seen attackers posting complete HTML pages that seem to have nothing malicious - to php pages that aren't even listening to their POST (sometimes, it's a contact form, which blocks spam, anyway).

So, my question is - is there any other malicious purpose that such things could be crafted for, other than spam?

Whenever this type of attack happens, the attacking IP will post several pages before it stops... so, perhaps it is trying to do some type of buffer overflow?

Here is a pastbin of one of the most recent examples -
http://pastebin.com/2b2N2337

It's pretty big - but, i don't see any scripts or anything obviously malicious. Just looks like spam...

Any insight on this matter is greatly appreciated.

From the sample you provided, it looks like forum spam where the poster is trying to advertise. I was unable to spot anything malicious at first glance, although the target sites might host malware.

It IS possible that they might be trying to trigger a DoS scenario by clogging your forms, but there are more efficient ways to do that.

Just looks like simple spam.


What is the point of certification authorities that are not trusted by browsers (=trusted by Root CAs)? See here: https://www.cacert.org/index.php?id=1

Chrome, Firefox and Internet Explorer warn that it is not trusted, essentially making the entire thing useless. If I want some kind of ssl certificate, I can just as well create my own with makecert.exe, the effect would be the same, wouldn't it: every browser would warn with huge red letters that it's not valid.

What am I not getting about this system?

One theory is that, ideally, the end-user should manage his own store of trusted root CA, making an informed decision based on the published Certification Practice Statements by existing CA.

Theory and practice match only in theory, though. It is not surprising that most users cannot and will not handle such a management process, if only because it relies on highly technical concepts (not only cryptographic concepts, but also and most importantly legal concepts). Therefore, OS and browser vendors take it upon themselves to decide on a list of "default root CA" that they will put in their browsers, and will be trusted by the overwhelming majority of deployed clients. These vendors do that as part of relatively complex procedures with heavy requirements on the CA, e.g. insurance and detailed procedures in force at the CA side. (See this answer.)

Right now, CAcert is a "wannabe" CA which tries to become a "trusted CA by default", but has not yet reached wide acceptance by OS/browser vendors. Part of the problem is that procedural requirements for a secure CA have a strong financial counterpart: the physical security requirements are not cheap (you won't put a serious CA "in the cloud"; you need secured premises), and the CA must demonstrate that it has the means to keep on working for a long time, or at least to do a "clean closure" in case of cessation of activity. Money is the key. The CAcert stance of "let's give away free certificates" does not help in making enough money for that.


How reliable/secure is QCaptcha? QCaptcha is an alternative way to protect a website from bots.  It required a drag and drop action like this:

Question

How reliable is this implementation when compared to others mentioned on this site?

Here's how QapTcha works:

The JS creates a hidden input field and populates it with a random value.
When the user drags successfully, the JS posts that random value to a PHP script and clears the value from the form. It then creates a hidden input whose name is the random value.
The PHP script verifies that a session variable hasn't been set, and that the random value has been posted, and sets the session variable to the random value.
When the user posts the form, the script verifies that the randomly named hidden input exists.

This is kind of a neat trick, since it exploits the fact that most bots quickly fill out the form and don't parse/run JavaScript.

However, it's relatively trivial to bypass - we just fake the functionality of QapTcha completely. First, we grab the HTML of the page. Then, we send a POST to the initialisation PHP script, containing the random value. Finally, we send the POST with the random empty field set. Bam!

This is somewhat of a security-through-obscurity captcha, because any bot that knows about it can bypass it. However, it's reasonably safe to assume that it'll stop most non-targeted "drive-by" attacks, until QapTcha is prevalent enough to be worth bot developers' time.

An extension of this idea is the zero user interaction captcha, which, instead of testing the user, tests the browser. It tests whether the browser can properly use JavaScript, Flash, CSS, etc, and polls for mouse movement and keyboard presses. This data is sent with the form's POST, then analysed. For each test that is passed, the score is increased. If the score fails to reach a minimum threshold, action is taken, e.g. block the action, place in moderation queue, present with an image captcha, etc. There's also a trick using CSS where an input box is z-ordered behind other elements, which a user would never fill in but a bot would. There is a working example of this scheme somewhere, which someone presented at a talk a few years back, but I can't find it right now.


What do you do to protect data on a Macbook in the event of theft/loss of the device? What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device?

I'm specifically interested in Macs here, rather than laptops generally, and in concrete recommendations rather than what's theoretically possible. In particular the new MBAs, as these don't seem to have a way to physically lock the device to anything.

I'm interested in addressing attacks that a reasonably sophisticated attacker who was interested in obtaining the data on the device, rather than the device itself, might attempt (e.g. booting an alternate OS from a USB key, trying to put the Mac into target disk mode, physically removing the drive, etc.)

As everyone else has covered encryption:

don't put data on the MacBook in the first place if you don't need it. I use an iMac as my regular work machine, and synchronise the files I need on my MacBook when I take it out.
firmware password will make it harder for people to boot into other operating systems / recovery disks. Interestingly the FireWire drivers on OS X also deny DMA requests when the firmware password is enabled. This stops someone dumping the memory of your live laptop.
Kensington lock when you're settled into your working location.
automatic, and hot-corner-activated, screen locking requiring password to unlock. To reduce the chance that when they make off with your laptop, it's unlocked. For similar reasons, change your keychain password and set that to lock automatically too.

May as well say that I summarised a lot of this a couple of years ago in a paper for Sophos. I no longer work there.


PHP: decrypting a file directly to a stream using the defuse/PHP_encryption library I have for a while been using the excellent Defuse PHP Encryption library for storing encrypted data strings in a database.

I have an extension of this need where I now have files that need to be uploaded and secured at rest. these files are typically no larger than 500Kb documents.

I have been looking into the Defuse / PHP Encryption File class and the system appears to work perfectly for saving newly uploaded files.

However, I'm exploring the best method for opening these encrypted files. The Defuse\Crypto\File class obviously can decrypt the files but it seems to only be able to decrypt them to another, plaintext file.

Is it possible to decrypt the file and output to a string only?

If for instance someone opens an encrypted file, it is decrypted then for as long as they're on that page (the file contents would be viewed/downloaded via a PHP intermediary page so the file location itself is never presented to the user) the plaintext file would be sitting on the server and potentially accessible to anyone who can reach it.

With this in mind I have some queries:

Is there any possibility that - Using Defuse PHP Encryption - an encrypted file can be decrypted to a (PHP) stream / string so avoid a plaintext file sitting on the server for any amount of time?
I have (just) considered an approach of saving a plaintext file to the server, then using file_get_contents and then unlinking the plaintext file. (This is my preferred approach at the moment but I have only thought of it while writing this question)

On Linux servers I believe it would be preferential to overwrite the filedata such as with random_bytes before unlinking the plaintext file. Is this correct?

My thoughs on this come from unlink only deletes the link to the file and  so (potentially) the file may still exist in practise (albeit harder to reach) until the local disk does its usual cleaning up.

Is there any advantage -as a concept- to instead loading the plaintext file data from the upload and encrypting that data string with Defuse\Crypto\Crypto and then saving this Crypto encrypted data blob into the storage file?

Research links

I've read the github for the library, and also read the issues and comments surrounding decrypting files to streams but these issues/comments faced more about excessive file sizes, (and the fact the whole file needs to be read). These won't apply in my case.

I have also read a top post from the PHP unlink manual page which seemed to confirm my thoughts on unlink.

I tested out encrypting with the File class, then reading the file contents and decrypting with Crypto::decrypt(), however they are not compatible out of the box.

So I ended up writing a small wrapper class in the vein of your third idea -- read the plain file, encrypt the string, and write the encrypted data to disk.  It includes this function (note that $this->key() is loaded/unlocked elsewhere in the class):

use Defuse\Crypto\Exception as Ex;
use Defuse\Crypto\Crypto;

public function encrypt_file($source, $destination, $password = "") {
    try {
        if(is_file($source) === true) {
            $string = file_get_contents($source);

            if($password == "") {                   // Key object-based encryption
                if(file_put_contents($destination, Crypto::encrypt($string, $this->key), LOCK_EX) !== false)
                    return true;
            }
            else {                                  // password-based encryption
                if(file_put_contents($destination, Crypto::encryptWithPassword($string, $password), LOCK_EX) !== false)
                    return true;
            }
        }

        return false;
    }
    catch(Ex\EnvironmentIsBrokenException $e) {
        return false;
    }
}

Now I can read it with a file_get_centents() and a Crypto::decrypt(), and it's easy to dump the plain file back to disk if I really want to (which I generaly don't).


HTTP security headers on non HTML (images, JavaScript, etc) Let's say, the HTTP security headers below are applied to all HTML pages of a site:

HTTP Strict Transport Security (HSTS)
X-Frame-Options (XFO)
X-XSS-Protection
X-Content-Type-Options

Is it OK to not put those HTTP security headers on non HTML resources (images, JavaScript files, etc) but those headers are applied to all HTML resources.

Any security risks for that?

Depends. If the website accepts user-submitted content, it's best to keep the XSS and nosniff headers on, in case they provide a loophole.

Lack of HSTS is also fine; however ensure that you have your cookies separated from HTTP and HTTPS, just in case.


How can one guarantee that a Diffie-Hellman initial key exchange is not stored? I might have missed parts of the technicality when it comes to the initial state of the key exchange. However, If I'm not wrong, if the initial key exchange is done over an insecure channel, how can one be sure that this first encounter is not "wiretapped"?

I've read someone say here that its like having a box, encrypting it with a key, sending the box, forcing the receiver to encrypt it with a key and returning the box. First sender then removes her key and returns the box. But how can one remove your key from something that has been encrypted again by someone else? How do identify what is yours?

The analogy of the sending of the box is not quite accurate in any public/private key algorithm. It is only as good as it is something that would work in the physical world. With that out of the way, lets get to Diffie-Hellman key exchange.

Diffie Hellman does not actually exchange keys, it exchanges some information to generate the keys. However it only exchanges part of this information, the rest is kept by each user. Lets go through it, we'll call our users Alice and Bob ;) :

Alice and Bob agree to use a prime number as a modulo p, and a base which is a primitive modulo root of p which is g. These mathematical properties must hold for the discrete logarithm problem the mathematics is built on to hold.
Alice and Bob each choose an integer they keep to themselves, lets call them a and b, then each of them runs the same calculation on that integer, first they calculate g to the power of the integer modulo p. And they send this to each other.

  ga mod p
  gb mod p

Now here is the clever bit, neither now can find out what the others secret integer is, but if they take what they got from the other one and raise it to their own integer and calculate modulo p of that, they both get the same number S:

  (ga mod p)b mod p = gab mod p
  (gb mod p)a mod p = gba mod p

4) Shared number is now used to derive some encryption key for further information.

Without knowing one of those secret integers an attacker can not generate the same number and therefore the same key. Schors algorithm on a quantum computer can solve the discrete logarithm problem to get back those secret integers from the data that was exchanged, but past that or getting Alice or Bob's machine to send them (in which case you can get them to send the derived key, or the unencrypted messages sent/recieved instead).

However if that information did not actually come from the other party but the attacker themselves then without other checks (this is what SSL/TLS certs are for) the attacker can decrypt, re-encrypt and relay the data on.


What assembly should I learn? I want to learn assembly, but I am not sure what instruction set (if that is correct term?) I should learn?

I have prior experience in programming, and I did a degree in Computer Science but amazingly it was never covered.

I need to be taught the basics, a pointer at what resources I should learn from.

I want to learn: terminology, setting up environment, hello world, which instruction sets to focus on for the reasons I detail in the next paragraph.

I will use this with my C/WinAPI experience for Malware development (I do Red Team engagements), and for reverse engineering. A brief background of the different instruction sets would be great, but my focus is 99% on Windows at the moment.

I like to see what the "big boys" are using in terms of Stuxnet, or how huge products like Photoshop are reverse engineered.

EDIT:
I might be wrong but this tutorial seems to make a program in assembly that works on every CPU?

  https://www.codejuggle.dj/creating-the-smallest-possible-windows-executable-using-assembly-language/

So now I am very confused!

My advice would be to first learn MIPS to wrap your head around how exactly heap and stack and OS calls work and then move on to x86 since you want to focus on developing malware for Windows.

EDIT: Why would you think it works on every CPU? The article itself only alleges that it works on all Windows versions and nothing more.


Can just clicking on a malicious link lead to hacking of my device? I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it.
If I just click on a malicious link it might open a new tab, or it might download something. When it opens a new tab, it might download certain things in the browser cache, which should get deleted after restart, and which should not have executable rights.
Secondly, if the tab offers to download something, by browser would ask me what to do.
So, I can't understand how can I get hacked, just by clicking on something malicious?

Yes, you can get hacked by just clicking a link.
Consider what happens when you install an extension in your browser? That's a link. Also, who said that your browser cache and history is completely secure? Most of us have our bank account details and other sensitive information stored there. You click a link and foreign code is downloaded and run on your computer -- horribly dangerous behaviour if you ask me. Any weakness in your defenses, or flaw in your security models, and you could be open to exfiltration of sensitive info and have your entire life ruined.
Are there any disclosed vulnerabilities in browsers that would allow such an attack? Maybe, maybe not, but the impact is high enough that even a small risk causes this to be a major concern.
Ok, I'm overplaying things for dramatic effect. Most people won't get hacked this way and the web is for the most part safe. It is likely that such hacks will take the resources of state-sponsored hackers. But, if you're in a sensitive job, maybe state-sponsored hackers are interested in your data and you should be very careful about which websites you visit. Even if you're not, then you should be aware of which part of the web you're browsing -- news outlets, programming sites, entertainment, probably all safe, but if you're looking for hacking tutorials and dark-web resources, then caveat emptor.


Can I use BIND in place of DNSCrypt? I was using DNSCrypt on my personal computer (linux). I uninstalled it, and now I'm getting errors reinstalling. I believe development on DNSCrypt was being abandoned anyway, because Cisco/OpenDNS bought it.

I was looking into BIND as a replacement for that, to choose my DNS and utilize DNSSEC. I want to be able to use DNSSEC providers (https://dnscrypt.info/public-servers/).

Am I wrong to think I can use this on my personal computer?

I was using DNSCrypt on my personal computer (linux). I uninstalled it, and now I'm getting errors reinstalling. I believe development on DNSCrypt was being abandoned anyway, because Cisco/OpenDNS bought it.

DNSCrypt is a protocol not a software. It has multiple implementations. The specific implementation you refer to is dnscrypt-proxy which was last updated 2 days ago. DNSCrypt is not related to OpenDNS.

  I was looking into BIND as a replacement for that, to choose my DNS and utilize DNSSEC

Bind is not a replacement for DNSCrypt. DNSSec does not encrypt DNS but only adds signatures to provide an authenticated response. Signing in DNSSec is done by the owners of the domain (i.e. the authority) whereas with DNSCurve the signing is done by the DNSCurve server (which is not the authority for the domain).

  I want to be able to use DNSSEC providers (https://dnscrypt.info/public-servers/).

There are no such thing as DNSSec providers. DNSSec simply works like normal DNS. Servers for the DNSCrypt protocol can not be used by normal DNS software.


Disabling SMEP on x86_64 I have recently been doing some research into kernel exploitation on X86_64. A problem I have run into is that I have found Intel's SMEP to be killing my contrived example of a kernel NULL pointer dereference which I have been working on.

Can you/how do you disable SMEP on linux? I have managed to remove SMAP (Security Mode Access Protection) on Linux kernel 3.8.x by disabling the functionality in the .config file but my problem still persists. I assume SMEP must be disabled differently from SMAP, given that after disabling it, execution of my mapped NULL page is still instantly killed as soon as execution is diverted within kernel-space.

I have already set mmap_min_addr to 0 so please no comments telling me to alter this value in /proc/sys/vm :).

SMEP is activated by bit 20 of control register CR4 while SMAP is bit 21. Disabling it can therefore be done, at least, by patching the kernel code in order to remove the setting of this bit.

The relevant code seems to be in file arch/x86/kernel/cpu/common.c, around line 269:

    if (cpu_has(c, X86_FEATURE_SMEP))
            set_in_cr4(X86_CR4_SMEP);

Just comment that out, recompile, reboot. (I have not tested it.)


PGP multi-key encryption for large, dynamic groups viewing static documents Suppose I have N users who should be able to decrypt a subset of documents D1...Dk. N is very large and users are often being adding and removed so it is impractical to encrypt a given document Di using all of their public keys.

As I've read, a common solution here is to create a group G with its own key pair, and its public key is used to encrypt the document.

What I can't figure out is how to give all users coming in and out of G the ability to use G's private key without storing it on the server.

I thought about encrypting G's private key with the public key of all its members, but what happens when a new user joins? I feel as though I would need to encrypt the private key again, this time with the new user's public key mixed in, however as the server I no longer have access to the unencrypted private key.

The closest solution I've seen is to create a new key pair for G and re-encrypt Di, but for a large number of documents this too becomes very impractical.

I should add that the system shouldn't be allowed to decrypt user's documents.

Is there some pattern using PGP (or any other standard really) that can help me out here?

I provided an answer to a similar, but not identical question, here: https://security.stackexchange.com/a/159962/60823

about dealing with this for an email list.

Your specific solution will obviously have to conform to your own, unique, threat model and business requirements, but essentially it will look something like this:

Encrypt D with a one-time, symmetric key (e.g. something like AES-256) cipher.  Encrypt that key with the PGP public key(s) of each member of the group G.  Add, and remove PGP keys as membership changes.

At least one key (belonging to an admin maintaining the group, or a central identity managing daemon) will have to decrypt the session key (not the whole document though) and re-encrypt it with the newly added public key.

Of course, removing people from the group won't help if they have copied the unencrypted data locally, but that's outside the scope of your question.  If you want to "lock them out" assuming they haven't already accessed the plain text, you could re-encrypt D with a new session key, and re-encrypt that to only the remaining current members of the group G.  But again, that's no help if the person leaving the group already accessed the plain text.


Is this data policy sufficient for my nomadic small business? This might be the wrong place to ask but I thought I would give it a go: I know nothing about data security and I have tried to educate myself over the past couple of weeks and I have come up with a data security policy/protocol for the small business that I am starting. The major hurdle that I have is that I am starting this company without access to a secure network because I am working remotely and traveling for the next few months.

Just a little info about the small business before the policy: its a small business (1-3 employees) that does data analysis, visualization, and data management and processing. The data that we will be working with could be highly sensitive, but it does not need to be HIPAA compliant (at this point).

Here is the draft of the policy...

  How you can safely get your data to us

  We recommend that you send us your data files via the secure file
  transfer service we employ. This file transfer service complies with
  multiple state and federal privacy regulations including HIPAA,
  PCI-DSS and EU-US Privacy Shield. The system uses 256-bit encryption
  on SSAE16 and SAS70 certified data centers. All data are deleted from
  their system after a fixed and short time using a proprietary deletion
  process. More information can be found at the file transfer service
  provider’s website (SendThisFile.com).

  How we store your data safely

  After we receive your data, we temporarily save your files to an
  encrypted folder on a fully encrypted computer system. This system is
  then disconnected from the internet and your data are transferred to a
  highly-secure external hard drive that is protected by 256-bit AES
  hardware encryption, and a brute force self destruct feature. Next, we
  permanently delete your files from our servers using overwriting
  practices to ensure they are truly unrecoverable.

  How we keep your data safe during analysis

  When it comes time to analyze your data, we disconnect our computer
  system from the internet before we connect to the encrypted external
  hard drive. All temporary and permanent data files are directed to the
  encrypted external hard drive.

  How we safely get your data and results back to you

  When it comes time to send your results or reformatted data back to
  you, we save the files from the encrypted external hard drive to an
  encrypted folder on a fully encrypted computer system. The hard drive
  is disconnected, our server is reconnected to the internet, and your
  information is sent via the secure file transfer service. As soon as
  your data are sent, we permanently delete your data files from our
  computer system. Once your project is completed, we will retain your
  data on our encrypted external hard drive for one month, or for a
  pre-determined period, before we permanently delete your files from
  our encrypted hard drive.

  How we protect our communications

  As an added security, all of the emails we send, including email
  attachments, are protected using end-to-end encryption through
  Tutanota.

What you've cited probably would have impressed some customers. It certainly wouldn't impress me. I won't delve into implementation details or whether you need security policy or privacy policy, because you've missed the most important item:

You don't give the end users a way to determine if their precious data is safe.

As of now, the added value of your proposition is from user's perspective just a piece of impressive text. A ten-mile-high view of it is "you'll have to trust me and only me". That's it.

For me, a minimal policy is:

  Dear customers,
  your data will be protected from misuse. External auditor will check
  the implementation (yearly/quarterly/just once). The certificate of
  compliance will be available to you at
  https://example.com/current_audit_result .

Expand on that, add the details. But don't remove the audit, because it's of major importance to users. Generally, the goal of security is to decrease the total amount of trust and/or to spread the trust among many parties. That's because "to trust somebody" is a near synonym of "to be vulnerable to somebody". Users want less of that.

For example take all your propositions like "we disconnect our computer system from the internet" and say they cover all probable attack vectors. Rational customers assume that you will actually do as promised 60% of the time. With audit, this estimate is maybe 80%. This factor multiplies every freakin point of your proposition. In scope of such example, lack of audit means twice the risk. That's a lot.


How would you explain CSRF token to a newbie? How is it safer than cookie based approach? I have a pretty basic understanding of both approaches but just looking for a better explanation I guess.

I have seen some examples of CSRF attacks, using CSRF tokens, how frameworks like Ruby on Rails, Symfony2 etc have built in CSRF protection in forms. Still I somehow fail to explain someone how an attacker might inject malicious data into scripts, how would the token based approach will prevent that.

Also, even after all this an attack is possible, I read. So, how would you make it fully secure?

Ignore obscurity in my question if you notice it.

I think you might be misunderstanding a little. Injecting malicious data into scripts isn't really relevant to CSRF. Its sometimes used in conjunction with it, but that would more accurately describe XSS. A CSRF token wouldn't prevent something like this.

A CSRF vulnerability is when you are able to trick a user to perform some action that only they are authorized to perform, without their knowledge.

Lets say you are logged in to your banking website and there is a form to transfer money to somebody where you enter the persons account number and the amount you want to send them and then push submit.

That form will be POSTed to a particular url and the request will look something like this.

POST /transfer

Host: bankingsite.com

Cookie: xxxxxxxxx

Sendto=12345678&amount=1000

Now the application will look at your cookie to determine which account to pull the money from.

Now imagine on my website I create a form that posts to bankingsite.com/transfer that sends 1000 to my personal account and I overlay it with a "Click here to win a free iPad"

Now if you were to click on it, it would generate the same exact post request if you were logged into the banking site because your browser would determine that you have an active session with bankingsite.com and it would add your session cookie to the request.

Bankingsite.com has no idea that you didnt fill out that form on their website. They think it is a legitimate request and they proceed to transfer your money to me without your knowledge.

The problem here is that the session cookie is sent along with the request. A CSRF token is different than a session cookie because the CSRF token wont be sent along just because the destination domain matches.

So lets say you code up your banking application to send a csrf token back using a custom header when the user loads the transfer money form. Then when the user submits the transfer form, you pass along the csrf token as a hidden field and validate it on the backend before you authorize the transaction.

Now you have just made it impossible to execute the attack scenario above. If somebody clicked on that free ipad button, the request would contain the cookie and post data, but no valid csrf token because the attacker doesn't have access to it and the request would be denied.


Potential risks of allowing custom javascript I'm planning a tool that will allow users to publish collections of their writing for publish consumption.

Any modification of content or account settings will be done through a secure management / admin server foo.com.

When users choose to publish a collection, they will be allowed to choose a subdomain from a different TLD, reserved specifically for published content: <subdomain>.foo.pub.

I'd like to offer users the ability to inject custom javascript into the published HTML. This way they could modify their theme, or include 3rd party comments, for example.

Since the published collections are on their own subdomain of a TLD that's completely separate from the management server, I think that users would be protected from XSS attacks.

What other risks, if any, would I be exposing readers to by allowing custom JS execution?

Being able to execute custom code in someone else's environment is the very endgoal of most web exploits. Your design consideration bypasses any pretense of security and facilitates this by default.

The service you'd actually be offering is a platform for anybody to publish malware, adware and drive-by downloads, or to use your service as a node in a botnet.

There are better ways to do what you want to do than allowing execution of arbitrary code.

Theming can be handled through some degree of custom css (look at the subreddit css system).
Comments and hitting third-party APIs can be facilitated through the use of approved widgets or plugins that you write and author based on popular demand.

It's just a bad idea, and there's a reason only a limited few sites (jsfiddle, etc) allow execution of arbitrary code-- they're sandboxed to hell and back again, and implement modified interpreters that don't allow execution of potentially malicious commands (eval(), etc).


Does Rehashing a weak hash with a strong algorithm make it strong? Imagine the following situation. We're making a web application which should be really safe

Now the accounts/users are not directly added by us but they receive a letter with a logincode. We get a file every now and then containing an unsalted SHA-1 hash of this logincode, and some other really basic info.

Considering SHA-1 is now a days seen as a liability, and the software generating these hashes is not under our control (it's also probably old software not capable of better hashes)

Would it be a solution to hash the received hash using Bcrypt. This should fix the problem of it being unsafe/too fast if i'm correct? Should I also add a pepper?

Are there any other problems i might have missed?
Or should we push back the problem and have them fix their software for better hashing functions?

Clarification:

Our client is an employee of a company and needs approval for this project.

The third party made a system for the company of our client that handles sensitive information about the customers of our clients company.
They want to give some of their customers the ability to login to our application, this has to happen through their system because that's what the employees of our customer know and if they would have to add users manually in our application our client would not get approval.

Also if there is any leak or breach (even though technically we have 0 access to any sensitive information, even in our own application there is no name or any identifying info about the user) this could still attract unwanted negative attention that would hurt both the client and us.

Problem is, the system the third party made can only do unsalted SHA-1 Hashes. So my question is to try and see if we can work around this. Or if we are forced to tell my client to force the third party to implement a better hashing system,  which they might just say answer with no we don't want to. Or it might cost a lot more money.

I hope i explained it a bit better while still being vague. :)

Yes, hashing it again with bcrypt is a good idea. Do note, though, that it will not give your login code more entropy, it will just make it take longer time to crack. So if it is really low entropy to begin with you might need a very high cost factor to make it unfeasible to crack.

On a side note, in general it is better to just hash with one good hash function than playing around with many, as explained in answers to this question. But you don't have that option, so the arguments there are not really valid for your case.

As for using a pepper, I would recommend just encrypting the hashes instead. It gives the same kind of protection, but offers more flexibility. But it is no replacement for salting.

This and this might be interesting reading for you. Also, Roshan Bhumbra has an interesting suggestion about rehashing with just one function after the first login.


Why does Debian security guide recommend md5 hashed passwords? I am reading the Debian Security How-To and came across a section that I found odd: it recommends to use md5 hashes for /etc/shadow passwords (http://www.debian.org/doc/manuals/securing-debian-howto/ch3.en.html#s3.5).

This document was most recently updated April 2012, so I am curious why they would recommend md5 as the password storage facility still. If I understand correctly this is actually md5-crypt and is using 1000 iterations, but that still seems quite concerning for a modern day server.

Can someone give some insight as to why they would make this recommendation?

As you can read in this manual that very part dates 2002:

 At the end of the installation, you will be asked if shadow passwords
 should be enabled.  Answer yes to this question, so passwords will be
 kept in the file `/etc/shadow'.  Only the root user and the group
 shadow have read access to this file, so no users will be able to grab
 a copy of this file in order to run a password cracker against it.
 You can switch between shadow passwords and normal passwords at any
 time by using `shadowconfig'.

 Read more on Shadow passwords in Shadow Password
 (http://www.linuxdoc.org/HOWTO/Shadow-Password-HOWTO.html)
 (`/usr/share/doc/HOWTO/en-txt/Shadow-Password.txt.gz').

 Furthermore, you are queried during installation whether you want to
 use MD5 hashed passwords.  This is generally a very good idea since it
 allows longer passwords and better encryption.  MD5 allows for
 passwords longer than 8 characters.  This, if used wisely, can make it
 more difficult for attackers to brute-force the system's passwords.
 Regarding MD5 passwords, this is the default option when installing
 the latest `password' package.  You can change this anytime after
 installation by doing `dpkg-reconfigure -plow passwd'.  You can
 recognize md5 passwords in the `/etc/shadow' file by their $1$ prefix.

 This, as a matter of fact, modifies all files under `/etc/pam.d' by
 substituting the password line and include md5 in it:

            password required pam_unix.so md5 nullok obscure min=6 max=16

 If `max' is not set over 8 the change will not be useful at all.  For
 more information on this read Section 4.10.1, `User authentication:
 PAM'.

 Note: the default configuration in Debian, even when activating MD5
 passwords, does not modify the previously set `max' value.

This is not the default way passwords are hashed in debian anymore.

In the chapter 4.11.1.1 Password security in PAM you can read that the default option is sha512 from Debian Squeeze (2009).

  You have to make sure that the pam_unix.so module uses the "sha512" option to use encrypted passwords. This is the default in Debian Squeeze.

  The line with the definition of the pam_unix module will look
  something like:

   password   [success=1 default=ignore]      pam_unix.so nullok obscure minlen=8 sha512

The problem with these manuals is that there are some parts that are outdated. Community tries to fix these kind of problems if you report them, and you can also volunteer yourself to fix that part of the documentation.


How can I secure my log files? I have a cool tool that displays my syslog and kernellog on my mac's desktop. This has me concerned about what is written in them - I'm staring to feel like they are creating a hole in my privacy. I have seen filenames from when I was looking around in finder; someone was generating thumbnails and logging the full filename; I have also seen names of servers I have connected to using smb.

So I have some questions:

Can I clean my logs or limit a program's use of them? How?
Are these logs used/read in computer forensics?
What can an attacker get out of them? i.e. passwords or exploited vectors
Are there any tools to extract the interesting data out of these files?

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like.

As far as I'm concerned, logs are a security professional's best friend.  The more logs you have the more information you have to pull from (at the same time, there's more data to crawl through, which has more to do with your last question).  Logs are one of many resources when dealing in forensics.

When it comes to attackers gaining access to logs, it's more of a concern about them modifying logs to cover their tracks.  If an attacker has access to your log files, they already have your system, so there's not real reason to worry about them gaining direct information from logs.  On the other hand, trending data can be used for other means.  For instance, if an attacker can gain access to the logs on a workstation in a corporation, they may be able to deduce what the average working times of a user may be (which, again, seems to be a moot point for most cases seeing that they already have access to the box).

As for your last question, tools to correlate these logs are very helpful.  The main tool you're looking for is a SIM/SEM.  This is a tool which takes logs and, based on profiling and traditional attack trends, alerts the administrator/security professional running the tool of the potential issue.  Some good example of a SIM/SEM or SIEM (which i guess is the more common term) are arcsight, loglogic, alienvult/ossim, and logrhythm.

I've never thought of logs as being anything but good.  So please think twice before deleting logs or even removing any data from your logs.  The more you mess with your logs the less valuable they become.  I wasn't able to find a security incident/event manager designed for a Mac with my limited search, but it still can be done.

Reading back over my answer, my thoughts were fairly narrow minded, so I apologize if I missed some other log oriented tools that are possibilities.  Let me know if you want clarification on anything I said, I'm still waking up :-).


How to verify that Google's apt signing key change is not malicious? I have an Ansible script that setup google chrome apt repo. I keep Google's signing key together with the scripts (rather than download it every time) because I think it minimizes the chance of getting malicious key (TOFU security model).

Now the key no longer works:

W: GPG error: http://dl.google.com/linux/chrome/deb stable Release:
   The following signatures couldn't be verified because the public key
   is not available: NO_PUBKEY 78BD65473CB3BD13
E: The repository 'http://dl.google.com/linux/chrome/deb stable Release' is not signed.

The url from which I've originally downloaded it points to a different key (as in: the files differ). Moreover, I tried getting the key by fingerprint from a different source:

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 78BD65473CB3BD13
apt-key export 78BD65473CB3BD13

And I got yet another, different file. Which one should I use? How do I make sure that I can trust it? Is there a way to check that the old key just expired and the new one is a valid successor?

I'd get in touch with the maintainers and ask for the fingerprint of their valid key and whether it has (or should have) changed.

The short answer, given this security model, is don't use the new key until you can verify it.


How can I extract the MD5 hash of a password protected MS Office Word 2000 document? AFAIK, the compound file format identifier is D0 CF 11 E0 A1 B1 1A E1, which is located in the offset 0 of the header, which has a length of exactly 512 bytes.

However that is not enough to get the boundaries of the md5 hash of the password. After that I plan to find a preimage in order to recover the document.

Can someone help me please?
Thank you in advance.

You link the word97 specification for your 2000 document.  I'm not sure if the file format changed, but luckily the encryption is the same.
I don't think you need the md5 hash (if there is one), you just want to break the encryption.  It looks like there are word 97/2000 decryptors on the web (paid or freeware).  My basic google search indicated that it's easier to break the proprietary hash + encryption (partially rc4) than to brute-force the password.
I wasn't going to link the page, but it wasn't hard to find.

Initially a unicode password is taken and some bytes appended, this password is passed through a varient of the standard md5 hash algorithm.
The non standard hash is tricky, and Im far from sure what benefit over standard md5 the modified md5 hash has.


Can someone check internet usage using MAC Address If I were to briefly connect to a network for like 2 mins would they be able to see everything i've browsed from my home network? If they knew my mac address?

Sounds like a stupid question but am not tech savvy.

It depends, but the answer is generally NO.
First, I will pinpoint your question (as it follow from comments):

I use my laptop both at home and at work. In both cases I connect to to the network (and - possibly to the Internet) by its WiFi adapter, so in both networks I have the same MAC address.
Is it possible for my employer to use my connection to the business network to obtain info about my previous activities within my home network?

If you have no publicly shared folders and your employer don't employ (illegal) sophisticated hacker activities to obtain access to your computer, the answer is NO.
It is your computer and you control, whom, when, and how will be allowed the access to the (part) of your stored data (including your browser history).


Flask/Jinja2 SSTI to get RCE.  not in object subclasses I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI).

RCE is usually obtained by uploading the reverse shell script on the target, thanks to a file reference, accesses by using the object.__subclasses__() method.

URL with Payload

http://0.0.0.0:5000/%7B%7B''.__class__.__mro__[1].__subclasses__()%7D%7D

Breakdown

{{''.__class__}}  => <class 'str'>
{{''.__class__.__mro__}}  => (<class 'str'>, <class 'object'>)
{{''.__class__.__mro__[1]}}  => <class 'object'>
{{''.__class__.__mro__[1].__subclasses__()}}  => [<class 'type'>, <class 'weakref'>, <class 'weakcallableproxy'>, <class 'weakproxy'>, ...

Response page

Oops! That page doesn't exist.
http://0.0.0.0:5000/[<class 'type'>, <class 'weakref'>, <class 'weakcallableproxy'>, <class 'weakproxy'>, <class 'int'>, <class 'bytearray'>, <class 'bytes'>, ...

Unfortunately, in the output I get, there isn't any file reference , so I'm not able to upload the reverse shell.

What am I missing?

After further research, I think I figured out why. It seems that the latest versions of Python are not vulnerable to the metodology briefly explained in my original post.

The Flask web app I was using as target was indeed running inside a Docker container, with the latest version of Python installed.

A simple way to check it out:

Python 2.7.10

>>> object.__subclasses__()
[<type 'type'>, <type 'weakref'>,..., <type 'file'>, ...]

Python 3.7.1

>>> object.__subclasses__()
[<class 'type'>, <class 'weakref'>, ... ] # no <type 'file'> or <class 'file'>


what an attacker can do if he/she got access my router admin panel? Today I found that anyone can access my router from outside my lan using my public ip. Then after some study, I came to know that the problem was not only with my router but it is a bsnl vulnerabilities, and most of bsnl routers can be access by its public ip (by simply entering public ip in url bar).

Now my question is:

if anyone have been able to access my admin panel(brute force username and password or if i leave delult username and password or whatever any other method) what further attack can be done by an attacker

Is it possible for an attacker that he/she can access my connected devices

or

he/she can able to land me on a malicious page by dns spoofing.

Yes she/he have to simply change your router default DNS settings and forward any lookup to a DNS server that is under her/his control. With that she/he can start various attacks.

Some ideas:

Proxify your traffic so she/he can inject malicious code on every
HTTP resource you are visiting.
Push back-doored updates to some
programs.


Change of DNS in MX records in a Wordpress site I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since it contains no sensitive information, and I've been interested in finding the vulnerability.

Now, Wordfence reports "a change in the email server (MX) records of your DNS configuration". I suppose this means they're attempting to redirect qtechtheory.org to their own site, or intercept/spoof emails to/from our domain. The new records have a blank domain.

So, my questions are

What exactly are they now able to do?
How much 'access' must they have had in order to effect this change? Could that access really be elevated from PHP injection in e.g. some plugin?
Can I reverse this change without having to recreate the site? Otherwise, is this a change which would persist if I restored a backup of the site?
Does this indicate a problem I can't fix by nuking / re-creating the wordpress site, and which I'll have to take up with BlueHost?

Finally, are there any tips for finding the vulnerability so as not to recreate it? I use around 13 plugins, which is too many to scrutinise.

EDIT

I found an SSH account which I wasn't sure the role of, named 'ss-a76cde51202b8a78'. I deleted it after discovering in the FTP access log:

/home2/ldjovumy/public_html/MMprobe-3et5u.php b _ i r ss-a76cde51202b8a78@qtechtheory.org ftp 1 * c

(note I couldn't find MMprobe-3et5u.php). The command was from IP 52.10.88.182, the same reported in these attacks. I suppose that answers the who-dun-it.

Thanks for the help!

Changes to MX records are very unlikely to have occurred due to an attack on the WordPress site, with the exception that if your DNS is running on the same server, it might be possible. That wouldn't be a typical configuration: if you bought a domain name, it's more common for the DNS records to be associated with that provider's infrastructure, even if you bought it from the same provider as hosts the site.

Given that, it's likely that unauthorised changes to the DNS records would have resulted from the account with the hosting provider being compromised, rather than the site itself. Therefore, I'd advise looking at whether it is possible that the provider account has been compromised, and, since it wouldn't be unheard of, whether the provider has made some updates to their mail environment which required changes to the MX records.

Assuming that the changes are malicious, the attackers would be able to control where email sent to addresses on the domain actually went. Typically, they don't care much about the bulk of mail to most inboxes, but they are interested in password reset mails for more valuable accounts, material which could be commercially sensitive, or material which could be used for blackmail purposes.

It is possible that access details to your provider account were available within the Wordpress environment: if they were shared with an FTP connection, or a mail server, for example. If that was the case, the compromise of the site could be linked, but it's equally possible that the hosting provider was compromised, or that the account used a guessable password, and they got lucky.

This change would persist through restoration of the site, PHP changes, or even a complete reformat of the server (barring exception above), since it isn't on that server. The DNS records point to the web server and the mail server, but these can be from completely unrelated providers.

You'll need to take it up with whatever company runs your DNS records. This is usually the company you bought the domain from, unless you have specifically changed to a third party service. If you have changed, that provider will be the


Stateful vs Stateless *host* firewall - is there any advantage? In the case of a firewall device seperate from a server host, I believe there is a clear benefit to using a stateful firewall.

But in the case of a host firewall, where the services in scope are well defined, what specific scenarios would be prevented by a stateful firewall that would not be blocked by a stateless firewall?

Consider a policy for a web and ssh server, connecting to a database...

allow any source IP/port to local IP address on ports 80 and 22 (local as server)
allow ports 80 and 22 on local IP to any destination IP/port (local as server)
allow local IP/port to mydbserver.example.com, port 3306 (local as client)
allow mydbserver.example.com, port 3306 to any local IP/port (local as client)

A stateless firewall configured as a above, could in theory be subverted. A spammer might bind a mailgun client to port 80 on a local IP and fire SMTP traffic out across the firewall. However the privilege required to achieve this would, in all cases I've come across, also give him the rights to change a stateful firewall config on the host.  Hence for this threat mode, there is no advantage.

Let me take a stab at this question...

The term Stateful is often associated with both "Deep Packet Inspection" and "Stateful Packet Inspection":

Deep Packet Inspection: The ability to look into a packet and see what command is being
used.  So, for example, I'll allow incoming FTP request, but not
allow the PUT and DELETE commands from FTP.  This would make my FTP
essentially read only.
Stateful Packet Inspection: The ability to remember a connection.  Many protocols (like HTTP)
have a well-known port (like port 80) for the outgoing "request", but use a
"public" port (>1024) for the incoming reply.  SPI can remember the
return port number and specifically allow it.  Without the ability
to remember the connection, you'd have to allow all incoming IP addresses on
all port number >1024 in order to get the reply

So, as Marcus has pointed out... these are very common features of most "personal firewalls".  Although Microsoft's personal firewall does SPI a little differently than a perimeter-based firewall would.  That's because at the host, you can include the application or service that the connection is associated with (something that a perimeter firewall wouldn't know about).  So, for example, I wouldn't have to allow for all incoming IPs and ports >1024 for all packets... just only those packets associated with IE.  Yeah, that's not quite as good as the more formal approach, but it's something.

So, yes... the Microsoft software-based "personal" firewall that appears in modern versions of Windows is (just barely) a Stateful firewall.


How to prevent users from retrieving the Java source code from a jar/exe file that I am distributing openly? I guess Java jar files can be reversed back to the source code and I want to prevent it from happening that easily. What I did was to convert the jar file into a Windows native exe file using launch4j.

Since the Java program has now been compiled into native machine language is it safe to say that it would be mostly impossible to reverse engineer the source code out of it?

You should research code obfuscation, because that's what you want.

Obfuscating the code will never prevent it completely and let me tell you that it's impossible to stop a programm from being reverse-engineered. But obfuscating the code will stop most script kiddies and make it at least harder to reverse-engineer your application.

There are a lot of those obfuscators out there and it will become opinion based to tell you which one is best or better.

So here is what you should do:

Research code obfuscation
Implement it in your application

Here is an SO link which could help you to get a start of it.


Can a meterpreter session be reopened? I tried to hack multiple android phones using .apk files but everytime the session lasts 5-10 seconds:

  [*] 94.243.71.172 - Meterpreter session 1 closed.  Reason: Died

Then, to open a new session I need to uninstall and then reinstall the .apk file again. But it's impossible to do this on the victim's phone (I don't have physical access to it).

So how can I open a new session without reinstalling the .apk file on android, and why it lasts so few?

That's because you created the apk in the wrong way I think. Usually if you create a apk using Msfvenom, the meterpreter session is not opened on install. It's opened once app is launched.

Anyway, the result of creating a Meterpreter apk using Msfvenom is too suspecting... an app what is doing apparently nothing with a blank screen... you better should try to decompile an existing apk and then inserting the meterpreter code inside it and repack. The meterpreter session will remain while the app is open. To do that try this manual (two parts):

https://techkernel.org/2015/12/11/embed-metasploit-payload-in-apk-easily/
https://techkernel.org/2015/12/19/embed-metasploit-payload-in-apk-manually/

Good luck


Privilege seperation when using the same login credentials? While thinking about preventing ransomware attacks on my machine I stumbled across the following question:

Assume I'm on a Windows (10) PC.
Assume further that I have two (local) accounts, one with admin privileges and one without where the second is the one I use day-to-day.

Now assume that both accounts use the same login credentials.

Is this as secure (against malware and such) as using different credentials?

If needed (I prefer a general answer) it may be assumed that the shared credential is a smart card (using different certificates for both accounts).

Please note: The threat model only includes things that can happen while the (standard) user is logged on. I totally understand that if somebody can get hands on the credentials he'll be able to just log-in as admin.

If I understand your question, your credentials are not strictly speaking the same. Normally your credentials consist of the identity name (account name) as well as the authentication credentials. It sounds to me that you have two different sets of credentials, but which happen to have the same authentication credentials?

If that is the case and given the limited scope you outline, I would suggest there is no significant risk and would argue it is certainly a big improvement over just adding admin rights to your normal operating account (which seems to be the most common user 'convenient') solution.

It would not be an approach I would normally recommend as I think there are other issues (ruled out in your scope statement). If you think about it, on any large server it is quite likely you will have two accounts which have the same password, but this doesn't reduce the security of either account.

The main danger I would see here is with being logged into the account with admin privileges by accident or without realising it - different authentication tokens is often a convenient safety net to ensure you are logged into the account you meant to - finger memory and automated processes when in a hurry can have interesting side effects - probably not an issue if your authentication is managed by smart card, in which case, this is probably a nice compromise compared to having to carry two smart cards!


Can we use network hub as an MITM sniffing device? My intention is to analyze all network traffic which is coming to and originating from a network connected device I have. From the configurations of the device I am able to proxy all the HTTP traffic originating from the device but I believe the device communicates over other protocols too.

The device and my machine both are on a switched network and I do not want to perform ARP cache poisoning to route all the packets through my machine. I am looking for a simpler solution where I would be able to replace the printer with a hub and then connect the printer to one of the ports on the hub. I want to connect my laptop also on one if the ports of this hub I introduced to the network. Technically, the hub would be flooding all the packets to all the ports and I should be able to sniff it from my laptop on promiscuous mode using wireshark.

A problem I identified to this approach was when I started searching for a 'hub'. The search itself gives results for 'switches' which are layer two devices. I am confused regarding the popular usage of the words switches and hubs. What should I buy for this purpose? Should it be a hub or a switch(Technically only a hub can be used for the purpose, but I want to know if the devices listed on websites are actually hubs) ?

An alternative to purchasing a separate hub is to get a regular consumer router/switch combo and install OpenWRT (or any other firmware with mirroring type functionality).

This will copy all traffic on the router to a specific IP. Attach your laptop to the router and sniff with promiscuous mode.

There's several ways you can do this. You can run tcpdump on the router and stream that to your laptop see here for instructions.

Or you could use the iptables TEE extension

To answer your original question, yes you can use a hub. Most devices sold these days are switches, or even routers with switches built in.  You may have better luck looking for a used hub, especially at a second hand store where older devices are common.


Is it possible for the firmware of an SSD be infected by malware/malicious rootkits via the internet? I am asking this because based on Snowden's relevations, bad actors "interdict" (intercept) shipments of routers, HDDs, SSDs, servers, etc., install malicious rootkits and spyware in the firmware and then send the infected hardware to their intended targets.

Yes it is possible, as long as the firmware on your device is updatable. That depends on the vendor, but most do have updatable firmware. If the bad actor had enough resources he could reverse engineer the update utility and firmware itself to insert anything they wanted there, as long as it was small enough to fit on the tiny flash memory in the SSD/HDD.

If you're interested in hardware hacks, there has been one that (supposedly) compromised the supply chain of Supermicro motherboards recently: here


ChangeCipherSpec Authentication According to RFC 5246, 7.1. Change Cipher Spec Protocol:

  The ChangeCipherSpec message is sent during the handshake after the
  security parameters have been agreed upon, but before the verifying
  Finished message is sent.

And 6.1. Connection States:

  A TLS connection state is the operating environment of the TLS Record
  Protocol.  It specifies a compression algorithm, an encryption
  algorithm, and a MAC algorithm.... All records are
  processed under the current read and write states. The security
  parameters for the pending states can be set by the TLS Handshake
  Protocol, and the ChangeCipherSpec can selectively make either of the
  pending states current, in which case the appropriate current state is
  disposed of and replaced with the pending state; the pending state is
  then reinitialized to an empty state.  It is illegal to make a state
  that has not been initialized with security parameters a current
  state.  The initial current state always specifies that no encryption,
  compression, or MAC will be used.

ChangeCipherSpec is not covered by the Finished message. From 7.4.9. Finished:

  Note: ChangeCipherSpec messages, alerts, and any other record types
  are not handshake messages and are not included in the hash
  computations.

Forgive my ignorance, but how exactly is the ChangeCipherSpec authenticated?

The ChangeCipherSpec is not authenticated. However, this is not a problem: its contents are unimportant (there is only one kind of ChangeCipherSpec message), and it may appear only at specific moments. When a client or server receives a ChangeCipherSpec message, it actually expects it. Thus, that message does not convey actual information; therefore, it has no need for any protection.

The main purpose of the ChangeCipherSpec message is to force implementations to start a new record. In SSL/TLS, handshake messages are stored in handshake records, but not with a 1-to-1 relationship: a handshake message can be split over several records, and several handshake messages can be stored into a single record. In the conceptual handshake workflow, encryption should be activated right before sending the Finished message; since encryption is record-based, a new record shall be opened. The ChangeCipherSpec message forces that new record, thus making both implementation and specification cleaner.


Nessus report shows iSCSI vulnerability The IT Manager (my boss) has been running a vulnerabilities scan on a network of servers we have. The report has come back with some interesting vulnerabilities. The one I can't seem to find a lot on is "iSCSI Unauthenticated Target Detection".

What is this vulnerability? How can I fix it?

Without sounding pretentious or even giving you a dummy answer that sounds too simple, what you need to do to really see the "meat" of the vulnerability, as well as mitigation solutions and other details, is to drill down into the hosts that contain the vulnerability.  Click on the vulnerability itself and then on the plugin ID#; this will give you a generalized idea of the vuln.  Next, click on an IP address of one of the hosts that is affected and it should tell you last time this vuln was observed, as well as how to mitigate it based on Tenable's recommended actions.


Is my data secure if my iPhone is locked? I've probably a simple question, but could not find a (detailed) answer on the internet yet.

If my iPhone is locked (i.e. with TouchID or a PIN), is my data secure? So, can hackers or law enforcement get access to my chat history for example?

Or is it fully available in the RAM and the RAM can be read?
Of course I know that there are ways to fake a fingerprint, it's more a general question.

By default all data stored on IOS filesystem is encrypted with the filesystem key which is specific to the device and securely stored. When the device is powered, the file system is unlocked for access with this key. This key is also how remote wipe works - it just destroys this key.

Files can be encrypted at rest as required using the data protection api, so this is application dependent.

RAM is a different story, applications won't be encrypting all of their data while it is in memory and RAM can be read in various ways with various tools but they would mostly require direct and privileged access to the device or for it to be compromised.


Appending multiple Google dorks in a single query My goal is to look up multiple vulns in a single google search for a particular site. (Because google makes me pay for more than 100 search api calls per day).

Let's say I have 3 dorks:  index of /htdocs and "Below is a rendering of the page up to the first error." ext:xml and "[function.getimagesize]: failed to open stream: No such file or directory in"
I would like to see if either of those messages has been indexed in Google for example.com.

Using OR in between those dorks doesn't seem to give me the required results.(I tried variants of dork1 OR dork2 or dork3 AND site:example.com)

Using brackets around the dorks separated with '|' and using AND operator for the sitename would do the trick.

For example, the solution to the example problem in question would be:

("index of /htdocs" | "Below is a rendering of the page up to the first error." | "[function.getimagesize]: failed to open stream: No such file or directory in") AND site:example.com

This would search for those three dorks in example.com.

Answer credit


Wrap key operation in Azure Key Vault - symmetric keys Could anyone explain why the bolded part of the wrap key description?

Wraps a symmetric key using a specified key. The WRAP operation
supports encryption of a symmetric key using a key encryption key that
has previously been stored in an Azure Key Vault. The WRAP operation
is only strictly necessary for symmetric keys stored in Azure Key
Vault since protection with an asymmetric key can be performed using
the public portion of the key. This operation is supported for
asymmetric keys as a convenience for callers that have a key-reference
but do not have access to the public key material. This operation
requires the keys/wrapKey permission.

AFAIK, all the keys in Azure Key Vault are stored at rest in HSM modules. Why is key wrapping necessary for symmetric keys? What does 'protection' mean in this case? Using a public key to encrypt data?
If HSM are securing all the keys in Key Vault (using its built-in symmetric key), then why would encrypting a symmetric key be necessary as quoted?

Key wrapping is a class of algorithms meant specifically to encrypt symmetric keys.
The reason for the wrapping is not the security of the vault itself but rather the security of the key once it leaves the vault.
The way wrapping is typically used is:

client A requests WK = wrap(K)
client A sends WK to client B
once needed (immediately, or in the distant future), client B asks vault for K = unwrap(WK) and uses K.

This short example shows some of the benefits of wrapping a key:

protect the key while in transit (sending from A to B) or in storage (stored by B)
assign permissions to unwrap the key (client B must have permissions to unwrap the key)
set a lifetime on the wrapped key (some vaults allow lifetimes on a wrapped object, or the key that encrypted it)

All of the above assume that the client will only store the wrapped key and not the result of unwrapping. If client B decides to store K itself, we're back to using a plain unwrapped key.


Why not use Diameter over RADIUS? The name of the protocol is a play on the word Diameter, which is twice the RADIUS of a circle - in other words, the author is trying to say it is twice as good and has more features.

It seems like the pros outweigh the cons, and according to this website the pros are pretty good (note, I can't vouch for all of the information, I was referring to the table).

For example, Diameter uses TCP, has good scalability (which is aided by TCP), supports IPSec and TLS for clients, and has an error reporting scheme.

However, I've never heard of the protocol until today. The book says that many companies are upgrading to Diameter. I also couldn't see any reference to Microsoft supporting Diameter OOTB, and I know they are not backwards compatible. I would think that Microsoft would want to move to Diameter, and that it would be possible to have a transitioning phase to support both protocols.

However, I do know Microsoft has an RFC for Microsoft Vendor-specific RADIUS Attributes but I'm not sure how relevant most of it is since it's mentioning CHAP (not v2) and was written in 1999. However, if RFCs are your thing, go you.

The books says more organizations are moving to Diameter over RADIUS, but I've never heard of it. Is there a reason people aren't doing so or am I just out of the loop?

Diameter was designed to supersede RADIUS. There is no doubt Diameter provides superior functionality. Unfortunately, upgrading old RADIUS environments can be tricky.

  “There is a large RADIUS deployment base out there and unless a proper migration plan that includes deployment of translation agents and co-existence of RADIUS and Diameter, migration to Diameter will not be simple.” [1]

The “translation agents” mentioned above are software or devices acting as adapters between new Diameter servers and legacy hardware that only supports RADIUS. Translation agents could relieve the effort required to upgrade, but they bring their own problems too.

  “... there can be many variants and implementations of translation agents in proprietary non-IETF manners. Also due to the simultaneous standardizations of RADIUS and Diameter, various RADIUS messages may be handled differently by different translation agents along the process, while none of those translation agents can be assumed to have access to complete and accurate session state information.” [1]

That sounds hard. So RADIUS extensions have proven to be the easier option.

  “… The uptake of Diameter has been very slow though, and RADIUS still remains the de facto standard for the foreseeable future. A major reason for this is probably the fact that the many enhancements that Diameter was supposed to bring are already covered by the various RADIUS extensions. There is, for instance, the RadSec protocol that transports RADIUS over TCP and TLS.” [2]

Of course, there are limitations to RADIUS extensions. Diameter can provide far superior support for 4G LT-Advanced mobile networks, for which RADIUS would be a very poor choice [3].

TACACS+ is also available, but

  “TACACS+ overall function is similar to that of RADIUS but RADIUS has enjoyed a more widespread use since it is not a proprietary (sic) of Cisco.“ [3]

Some also argue that TACACS+ is more suited to network administration than general network access for a large user base (e.g. ISP, Telco) [4].

I appreciate that some of my references are old and my be out of date. Although, I have recently seen new, small-scale network deployments choose RADIUS over Diameter/TACACS+. In these cases, the staff know RADIUS; extensions provide required security; and RADIUS has no ties to Cisco.

I think it's matter of time before Diameter overtakes RADIUS, but it's very hard to tell just how much time.

[1] Nakhjiri, M. & M., AAA and Network Security for Mobile Access: Radius, Diameter, EAP, PKI and IP Mobility, Section 7.4, John Wiley & Sons, 2005

[2] van der Walt, D., FreeRADIUS Beginner's Guide, Packt Publishing, 2011

[3] Håkan, V., Diameter: Next generations AAA protocol, Institutionen för systemteknik, 2001

[4] Woland, A., RADIUS vs TACACS+, retrieved from http://www.networkworld.com/article/2838882/radius-versus-tacacs.html


Snort Rule Comparison As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits of one over other? Pro's and con's? Thank you,

It depends on your reqirement, where you are going to use your or snort IDPS. It means, If your DMZ or network is getting attacked more frequently then you should go for Emerging Threat Pro rules because it will be updated every day so you will get protected by new attacks or might be zero day. In the other hand snort VRT paid version rules will be updated ones in a week. So there might be a chance of your IDPS can be evaded by new attacks or threat.
Snort paid version rules covers all types of threat like malwares, viruses, and well known L7 protocols which is  mostly used attack vector.


Compromised Issuing CA I'm configuring a PKI infrastructure with an offline root CA and several issuing CAs. Among other topics, I'm struggling to decide how the revokation of an Issuing CA certificate works.

My Root CA will issue CRL once a year, and as far as I know, a machine with a CRL cached won't download a new CRL until the current one expires. But, what happens if let's say, the current CRL expires in November 2016, but the Root CA revoke an Issuing CA certificate in January 2016? Does this mean that a machine will trust the Issuing CA certificate until November 2016 although it's been already revoked by the Root CA? Is there a way to force the update of the cached CRL?

Thank you!

You guessed well: revocation is asynchronous. When you revoke a certificate, this becomes really effective only when the last pre-revocation CRL expires. If you issue CRL that are valid for one year, then a revoked certificate may still be trusted by other systems for up to one year.

One should envision CRL as a damage containment feature: with CRL, you can have an explicit boundary on how long the compromise will impact your systems. Long-lived CRL are easier to issue (since you do that less often), but correspondingly take more time to contain the damage. This is a trade-off.

The only mitigation, within the context of an X.509 PKI, is to issue CRL more often, with a shorter life. However, since your root CA is offline (and that's, all other things being equal, a very good idea), issuing a CRL implies a manual operation, hence costs. I am aware of two workarounds:

You could make an indirect CRL: while the root CA is offline, the power to sign a CRL could be entrusted to a distinct, online system with its own key pair. X.509 has support for that, with relevant extensions (see this answer). Unfortunately, indirect CRL are not well supported by existing software.
One could make the root CA half-online. In a setup that I have helped develop and is currently deployed in production, the "offline" root CA produces a CRL on a weekly basis, and sends it over... its audio output. The idea is that the "line out" plug is physically one-way, so even if there is a wire going from that plug to the "line in" plug of another (online) machine, the root CA can still be considered to be "offline". Moreover, a visual inspection can easily notice that the wire is in the right plug (the green one).

This solution requires some software to encode the new CRL as sound, and decode it back on the other end; the simple code I wrote offered very bad performance (about 300 bits/s), but it was very robust, and the weekly CRL is very short (since it is, under normal conditions, completely empty). Since there is no acknowledge (the link is really one-way), the sender must send the same file repeatedly, again and again, with a recognizable header for synchronization, and a checksum for error detection (for a CRL, you could verify the signature; that's as good as any checksum can get). That way, you can have an offline root CA and still get automated CRL publication on a weekly basis (it could even be daily).

(My initial design called for an actual speaker and a microphone, but that could prove problematic in a noisy environment, and server rooms are very noisy. People with some electronics skills could build a circuit with a LED and a photodetector. Yet another way is to use a twisted-pair ethernet cable with only one pair connected, but this may fail to work with ethernet interfaces that try to do medium detection; and it is harder to visually check, since you have to unplug the cable to check the wiring.)


Some good resources on viruses/worms? I am searching good info on sophisticated viruses/worms. One example would be STUXNET and the very good analysis made by folks from Symantec. Any ideas?

Celebrity malware like Stuxnet, Confiker, Zeus will get the kind of attention you're referring to. Any list of those sort of reports is going to get out of date very fast though.

Many organisations inlcuding Symantec, Trusteer, Microsoft, SRI and Sophos publish malware analysis reports. There aren't any RSS feeds of these resources and some organisations spread the content all over their web presence in blogs, press releases and the like (Microsoft is particularly bad at this). You'll also have to wade through some promotional content from the commercial vendors and other research output from the pure research outfits. The easiest way to keep up with most of the publications in this area is to follow the SANS Internet Storm Center who publish links to a lot of the papers.

Shallower but more immediate analysis can be found from the VirusTotal community or ThreatExpert.


What measures can I take to secure a MacBook Pro connected directly to a modem with no router? This question has been asked before, but in hypothetical terms, and it received hypothetical answers: connecting a secure computer directly to the internet without a router

I recently bricked my router doing a firmware upgrade (ironically, because I recently learned of a security vulnerability in my router model that the upgrade would fix). I ordered a new one online, but it will take several days to arrive. I would like to actually use my Internet at home until it gets here.

I have exactly two uses for wired internet:

Watching Netflix and YouTube videos
Pulling data from my company's MySQL server

I have two distinct concerns about these uses.

The first is that, by plugging my machine directly into the Internet, I am exposing it directly to any attacks that might arrive at my IP address. I am aware that OSX has not one but two firewalls  that come with it. How can I configure these correctly so that bad things don't happen while I'm watching The Bridge on the River Kwai?

The second is that I  don't believe my company's database server is as secure as it could be. What steps, if any, can I take on the client side to protect our data? Or am I equally at risk in this case regardless of whether or not I am behind a hardware firewall?

I followed the suggestion in the question I linked to run netstat -an, and noticed a large number of entries like

tcp4 0  0  *.88  *.*  LISTEN

Does this mean that my computer is listening on port 88? How do I know which ports are necessary to connect to and browse the Internet, and how should I secure them?

Edit: Running without -n leads me to believe that my computer is listening for Kerberos authentication. I unchecked all of the "sharing" options, which removed the Kerberos and SSH entries, but several of these "Active Internet Connections" remain

If you're not running any service in your workstation (which you're not) then you can simply block (drop) all incoming connections.

Usually simply enabling the firewall is enough since the default is to drop all incoming.

The rest will depend on your context, but usually you don't need outgoing filters on a workstation, so that's a lot less to worry about.

Incoming drop. Outgoing allow. Adjust as needs arise.


Decrypt TLS traffic on same machine (Mac + mitmproxy/other) I have a Mac-only application that I need to network-debug, but the application uses TLS. Is there a way I could debug the network traffic of that application with mitmproxy (or any other software) without using another physical machine?

The first thing I thought was to create a transparent proxy with another Mac inside a virtual machine and make that VM use the host machine as a proxy, but the performance is too slow to get the application even start.

As the system proxy settings seem to affect the application, you can run any intercepting HTTP proxy (I'd recommend Burp proxy, but you can use mitmproxy, too) on your mac.

Set your system proxy settings to 127.0.0.1 and port 8080 and start the application.

To decrypt TLS, you also need to import the root certificate of the proxy into your trusted certificates.