How do rainbow tables solve collisions? I get the gist of it. It's like a middle ground between brute force attack and lookup table, it stores the starting plaintext and ending hash for each chain where a chain is made by reduction and hash.

What I don't get is:

It's said that rainbow tables solve collisions, but why are collisions such a big deal to begin with?
It's said that rainbow tables solve collisions by using a different reduction function for each column in the chain, but how does this prevent collisions? Aren't reduction functions just random characters you take from the hash? So what difference does it make if you take the first 8 characters instead of the last 8?

The current highest voted answer doesn't really seem to give a proper response to your question. I'll try to answer both your questions simultaneously.

Same reduction function in every column

Say, you use the same reduction function for every column and have a basic table with 2 rows and 3 columns.

P1  --R-->  P1'  --R-->  P1'' --R-->  P1'''
P2  --R-->  P2'  --R-->  P1'  --R-->  P1''

Here, an --R--> represents a hashing followed by a reduction. And P1, P2, P1', ... represent passwords.
As you can see, there was a collision in the second chain. The value P1' has already been encountered in the first chain.

Notice what happens afterwards.

Since the hashing followed by the reduction of P1' is exactly the same as in the first chain, we get a value that has already been computed. If we continue this even further, the part of the second chain starting from P1' becomes an exact copy of the part of the first chain starting from P1'.

So in effect, this is why collisions are bad. The second chain merged into the first. We have duplicate results in our table, resulting in wasted storage space and computation time.

Different reduction function in every column

This time, let's see what happens if we use a different reduction for every column.
A reduction is represented by --RX--> where X is the column number.

P1  --R1-->  P1'  --R2-->  P1'' --R3-->  P1'''
P2  --R1-->  P2'  --R2-->  P1'  --R3-->  P2''

Again, P1' was encountered in both chains.
However, since the reduction functions are different, the value calculated after P1' in the second chain won't result in P1'', as it does in the first chain. This effectively solves the merge issue from the first example.

Note that this doesn't solve every chain merge though. Watch what happens in the following example:

P1  --R1-->  P1'  --R2-->  P1''  --R3-->  P1'''
P2  --R1-->  P1'  --R2-->  P1''  --R3-->  P1'''

This time a collision happens in the first column of both chains. Since it happens in the same column, every next reduction function will be the same and the chains are merged once again. The probability of this happening is lower though.


Floppy disk partition showed up when USB Flash drive inserted For one of my course's midterm lab portion, the professor provided us flash drives to put our project in. Everyone had their named labeled on one, so she gave me the last one left out, which had a name that I was not able to find in our school's e-mail list. My AV asks scans any USB drives that get inserted into my laptop, and when I inserted the flash drive into my laptop, it scanned twice. I was wondering why till I went to my "Computer" screen, where it shows all the drives. I saw that there was a removable drive (The flash drive), as well as a Floppy Disk drive. The thing is, my laptop doesn't have a floppy disk drive. When I right clicked to safely remove the drive, I noticed the flash drive had a submenu, which showed another flash drive.

I ran a quick scan on my laptop afterwards, and nothing came up. Could this have anything to do with BadUSB? I'm running Windows 7; is there anything you guys suggest I do?

If the USB sticks are second-hand, it is possible that you obtained a wiped one that used to have encryption software. They would frequently have two partitions, an unencrypted one to handle the authentication, and once you were authenticated, the software would mount the encrypted partition for use. USB Devices are also serial-bus, so you can have multiple devices plugged into one port at the same time. (Beautiful isn't it?)

First thing, if you were worried about sticking the thing in your computer to begin with, I wouldn't have done it. (It's actually kind of insensitive/rude for the professor to hand out USB sticks that could be infected with malware to all of the students just for his/her convenience...) Since we're past that stage, here are some options you can take: Format the bugger. Just wipe it clean and all will be forgiven. You can also try to use the Windows Disk Management software (or FDISK in the command-line) to re-partition the drives together, but that may not work if they are both genuinely different devices stuffed into the stick.

Enjoy your project!


Purpose of Decrypting & Scanning HTTPS traffic Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer
chrome://pippki/content/exceptionDialog.xul

After enabling Decrypt & scan HTTPS traffic from the firewall rule, all the clients cannot go to www because they don’t have SSL CA Certificate.
So they have included the SecurityAppliance_SSL_CA (.pem format) and installed on to the client machines from the Microsoft Management Console (MMC) i.e, from the Trusted Root Certification Authorities > Certificates. Performing Import *.pem file
And also included a private key specific to the static IP address identified unique specifying the Friendly Name to be SSIS Master Service
It's very clear that they are not using any proxy server.
Firefox detected a potential security threat and did not continue. Because
Peer’s Certificate issuer is not recognized.

HTTP Strict Transport Security: false
HTTP Public Key Pinning: true

I do own an Anti-Virus software from Sophos Endpoint Security and control for my personal PC, with Web protection enabled. But I don't get any sort of messages from the FireFox

So my question is what is the purpose of doing this? and Does our passwords gets decrypted in an encrypted websites via MITM decryption or store logs?
Is there any way to get around this?

what is the purpose of doing this?

The antivirus wouldn't be able to detect a virus/exploit that was delivered through https. Breaking the https connection would allow it to detect and block such threat.

  It's very clear that they are not using any proxy server.

No. There may not be a configured proxy server, but the aforementioned firewall is acting as one, apparently in combination with a Sophos instance (this will be a transparent proxy).

  Does our passwords gets decrypted in an encrypted websites via MITM decryption

Yes. Anything that goes through the MITM connection will be decrypted and then re-encrypted

  or store logs?

You should ask to the person that configured this system performing a MITM

  Is there any way to get around this?

Disable the "Decrypt & scan HTTPS traffic" rule? It may be possible to configure specific destinations that shall not be subject to MITM.

Also, it could be that connecting through a proxy / VPN allowed to bypass this specific security setting. But in this case I don't think it would be appropriate. If you are allowed not to go through this filtering, you should get this rule disabled. If you are not allowed to bypass it, it seems unwise to work around it without authorization.


Electron Framework vulnerability - Explaining remote code execution Electron is a "web application writing platform" used by software such as Skype and Slack for Windows (among many others). News articles from today are purporting that these applications are now vulnerable to remote code execution due to  vulnerabilities in the Electron framework itself.

I am running Skype on my Windows machine. It registers itself as the default handler for a protocol (lets say skype://). It is not running as a service. How am I susceptible to remote code execution if the software is not running as a service? What steps would need to happen for RCE to happen... namely would I have to click on a link? Would an attacker have to initiate a skype conversation with me in order to trigger the exploit?

Further is the attack mechanism the same for every piece of software affected or is it a different attack vector for every piece of software?

EDIT:
Looking through the release notes and source code commits, I noticed this change.

It seems to imply the attack vector would be a specially crafted 'launching' uri (taking advantage of the default handler). If that's true though it makes me think the user would either have to click this link or visit a website that redirects to the link. Can somebody confirm?

According to the CVE RCE is triggered when a specially crafted URL is clicked that will be handled by Electron. The vulnerability is only for Windows, and does not affect macOS or Linux. See the Electron team's blog post for more details.


Is it feasible to encrypt customers personal data? (name, address etc...) Seeing the Sony Personal data kerfuffle unfold has gotten me thinking about the encryption and securing of personal data - obviously credit cards can (and should) be encrypted, making data breaches of this sort much less of an issue for the end user.  That said even if customer credit card details are secure, the other personal data which can be leaked is potentially just as damaging.  In this case the data leaked was:

Your name
Your address (city, state, and zip)
Country
E-mail address
Birthday

In fact, in some cases this information can be more damaging - you can cancel your credit card with a single phone call, but the above combination of information still leaves you open to many forms of identity theft and it is far more difficult to change your address or name.

Hence my question: Is it feasible to protect customers personal details using encryption in the same way that credit cards are protected? (So that the effect of the entire database being compromised in this way are mitigated).

What about applications where searches are performed against this customer data? (for example to look up a customer by their name and address)  Can the data be encrypted in a way that still makes searching possible and isn't prohibitively expensive in development costs?

Update: To clarify, I'm interested to know if there are techniques that can be used to securely encrypt personal details so that they are still "usable".  For example it is a common requirement to be able to search for customers by their name or addresses, however this is potentially difficult to do if these personal details are encrypted. (Is it possible to reliably search on securely encrypted data?)

Simple answer - yes, it is feasible - if by that you mean 'can it be done?' as you can encrypt pretty much everything stored.

However the extra computational overhead (especially on encrypted databases) is usually looked on unfavourably, as is the cost to recode, updating procedures etc etc. Obviously you can't just hash if you want to allow partial searches on names, addresses etc., so everything has to be encrypted to a key, which then needs to be protected etc.

Before regulation such as PCI-DSS, many organisations didn't want to encrypt credit card data, due to the costs involved, and even now, PCI hasn't managed to persuade every handler/storer of credit card data to do this correctly.

So the long answer is - No, it is not going to get any budget until it is mandated.


Work on fuzzing of PDF file format What work has been done on fuzzing of the PDF file format?  I'm looking for work that focuses specifically on PDF, and is aware of the PDF file format.  Has there been past work that builds format-aware tools for fuzzing PDF?  Perhaps format-aware mutational fuzzing or generational fuzzing?  And are any of the tools or test suites publicly available?  The PDF file format is incredibly complex; I'd like to avoid re-inventing the wheel.

There is work on the topic, at several levels.

fuzzing of the internal tables - very easy, and doesn't really work
fuzzing of internal codecs such as z-streams
fuzzing of internal formats, e.g. fonts, JPGs, TIFFs etc. - I'm aware of some buggy implementations of CCITT "fax" monochrome picture that are still used by some fax-to-PDF machines, i.e. the companion application uses a buggy libTIFF decoder; one of these turned out as BugTraq 46-658, but there are more)
fuzzing of "extensions" such as Javascript. One tool that does this is pdffuzzer.

You will probably be interested in reading about j00ru et al.'s work (updated). An effort in Python can be found here.


Why do browsers allow custom root CAs? At my work all browsers have a custom root CA installed, which then allows them to snoop on all https traffic while the users get the false impression that they are browsing a secure https page.

Why are browsers allowing such easy defeat of https, and not warning the user about it?

EDIT: Based on the answers/comments I realize that I was perhaps incorrectly emphasizing the wrong part of my confusion. I understand that there are some legitimate needs to want to change the CA list, what I don't understand is why you wouldn't want to warn the user if such a change has been made. Doesn't not warning the user defeat the point of the green box next to the address? Do I really need to go through multiple clicks, and then perhaps do a (compromised) search to figure out if the root CA is a real one or not for any computer that I don't own and/or if I let someone else touch my computer?

As pointed out in comments and answers, there are plenty of legitimate reasons why you would want to add a CA to your browser's trust store, and the mechanisms for doing this require admin access to the machine / browser.

You're implying a trust model where you don't consider your administrator (or past you) to be trustworthy and would like the browser to visually distinguish between a certificate that is publicly-trusted (ie issued by a CA in Mozilla's publicly-trusted list) and one that is privately-trusted because it was explicitly added to the browser's trust store. Maybe the usual green with a warning symbol for privately-trusted?

Good idea! It would also solve my problem of needing two copies of firefox installed: one for testing products that need me to install certs, and one for browsing the internet. You should see if Firefox already has an enhancement for this, and if not, suggest it :)


Role of derived keys in EAP-PSK in WPA-2 I'm currently trying to understand WPA-2 and I've discovered that it's built on the EAP-PSK protocol which sets up some keys derived from the SSID name and a password.

I assume that the keys derived from EAP-PSK, namely AK and TEK, are used in the 4-way handshake to verify that the 2 parties have generated on each derivative level the correct keys (KDK vs MSK and EMSK). (see the RFC)

What I don't understand is which type of key is used for message encryption in WPA2-PSK after the 4-way handshake is successful. Is it through extended authentication with TEK key?

Edit: I am aware of this question and the book presented in the voted answer. Unfortunately, the book has different notations compared to the RFC and I'm looking for a more precise answer that tells me exactly which is the key used in the encryption after the handshake is successful.

What you have to understand is that EAP is less of a protocol, and more of a framework.  The terminology from this answer is valid because of the following quote from the IEEE 802.11i wiki page:

  To derive the PMK from the PSK, the PSK is put through PBKDF2-SHA1 as
  the cryptographic hash function. If an 802.1X EAP exchange was carried
  out, the PMK is derived from the EAP parameters provided by the
  authentication server.

So when EAP-PSK is configured a four-way handshake occurs with a client to essentially establish authentication to the AP.  The result of that authentication is essentially the PMK.  This link explains the difference between using WPA2-PSK and WPA2-PEAP.  I know it's not exactly the same, but you can see that a separate exchange occurs before the WPA2 four-way handshake.

The entire EAP-PSK process outlined in RFC4764 is only used to establish authentication and secure channels to relay the PMK to the client. Which I believe is the MSK/EMSK since they're not mentioned at all in the RFC after derivation.  Then that's used as the basis for the rest of WPA2 setup.

I agree this is confusing, and wireless technology is really just black magic with dragons taking your packets to places.

Now the libtins library uses the PMK and PTK terminology.  Their WPA2 session keys are derived in src/crypto.cpp.


Can I use my old SSL certificate with websites in subfolders? We have a single domain SSL for a website that looks like this:

www.website.company.com

We are going to expand and do following:

www.website.company.com
www.website.company.com/dk
www.website.company.com/no

Since it's still same domain, do we need to change anything regarding our SSL?

Since it's still same domain, do we need to change anything regarding our SSL?

Since the domain is the same and paths are not stored in the certificate, you can continue using your old certificate.

  Even if dk and no is folder names in our IIS virtual folder?

The internal configuration does not matter here (the client verifying the certificate does not know anything about it anyway), as long as the web server delivers both sites under the same domain name (which is what you described).

If you'd use subdomains, things might change (if you haven't got a wildcard certificate, which is not the common case and not best practice). So if you'd be using dk.website.company.com and no.website.company.com, you would either need a wildcard certificate for *.website.company.com or a certificate matching all that domains (also consider www.website.company.com in this case).


What camera resolution is required to identify human faces? I've been asked to recommend an IP-based security camera in attempt to prevent, or at least record, repeated acts of vandalism occurring at the front of a property.

Budget is a concern (The damage is minimal but frustrating) and there are plenty of cheap home/soho models around that offer all the useful connectivity functions for a reasonable price. The one thing that conerns me is that the low capture resolution, coupled with what are likely to be poor quality optics won't be enough to be able to identify the subject from much more than a few metres.

Assuming decent lighting and that we get a front-on still of the subject, what would you consider to be the useful range of a 640x400 camera for producing something that the police might reasonably accept as proof of someone's identity?

This is more of a legal question than a technical one, so before I answer I'll provide the usual disclaimer: IANAL.

From my (unfortunately rather extensive) experience with this, the police usually already have a good idea of who's responsible. They just have to prove it. Unfortunately, criminals these days are smart enough to wear scarves or bandanas over their face, so that only their eyes are visible to CCTV. This makes identification difficult, if not impossible. You've just got to hope that you've got a dumb one! In such a case, even a low-res blurry image of someone's face can be enough evidence to issue a warrant to search their premises, to find further evidence of graffiti or damage. It generally depends whether they can convince a judge (or the CPS, in the UK) that what they have constitutes reasonable evidence.

If you're dealing with spray-paint graffiti, they can ship paint samples off to a lab and have them matched by mass spec / IR spec. This actually resulted in a conviction in a particular case I know of, where they ended up matching the tag to a string of other graffiti incidents. The guy ended up with a hefty fine and a long suspended sentence.

However, from a technical standpoint, you're not really looking for higher resolution; you're looking for better quality pictures. Sadly, the camera industry has been pushing "MOAR MEGAPIXELZ!" as the standard for better quality, but it's simply not the case. What you're looking for is a camera with a good quality lens, decent nighttime performance, reasonable framerate, and low chromatic abberation. I'm not a photographer, so I can't really give you advice on what specs to look for, but the hard truth is that quality costs money.

My suggestion would be to go for something with a decent framerate, over something with a larger image size. See if you can arrange a demonstration with a salesperson to see what the image quality looks like, and decide for yourself whether you consider it clear enough to produce a quality picture. Also keep in mind that there's nothing to stop the vandals from attacking your camera, so don't blow a load of money on it and be surprised when it gets stolen / smashed.

Finally - get a motion-sensor light (PIR). They're cheap, easy to replace, and make vandals stick out like a sore thumb at night.


Can handwritten captchas be used? Suppose a user has just created a new account on some site. You ask him to submit an image of a para of neat handwritten text, along with a typed version of the same text. Then this is kept secret.

If some time in the future, there is a doubt as to whether a computer is accessing his account, you show him the handwritten text (one or two words) that some other user uploaded. Suppose he types correctly. He is now asked to type out one or two words from the text which he himself submitted. Only if both tests are cleared, the user is identified as human. He will have 4-5 attempts to clear test 1, but only 2 attempts to clear test 2, failing which, his account will be locked.

Is this system a fail-safe verification of human users? And does anybody use it? Why/ why not?

The second test is easily defeated because the user knows the original image.  A bot could easily compare the selected words against the original image and determine which is the best match.  In fact, they could submit an image which is intentionally easy for a computer to detect, such as installing a digital watermark or other stenographic content into the image.

The first test is interesting but has some oddities to it:

You presume everyone can read eachother's handwriting.  Good luck reading mine!
You presume it is safe to send user generated content from one person to another (there are some images that many users would like to not see)

In all, the first part reminds me a lot of the CAPTCHA which had users writing phrases from books out of Google Books archives, which doubled as a service for digitizing otherwise hard-to-transcribe books.

In all, the only fail-safe way to determine if someone is a human is face to face contact, and even that is drawn into question as computers get more powerful.


How to protect the company VIPs Environment: small engineering company (<50 employees) and everyone is local administrator on their computer, including everyone in the management group.

Setup: Some standard security features are in place: NGFW, (N)IDS, (H)IDS, DLP, segmented network, anti malware on each client, local FW, Windows update, automated third pary software updates on each client, lock out policy, OSSEC agents on all servers.

Problem: when malware hits (and it does!) infection is much worse when user is admin.

Sought solution: protect the VIPs in the management group from malware infection (or rather: malware infecting the entire computer). Since they are in high risk of being "spear fished"

First step is of course to make them standard users. So far so good, but they demand admin rights in case they need to (without calling helpdesk). I'm willing to give this to them in a transaction period but it can't be as easy as to give them a local admin account as well since they will most probably only use that account all the time. I'm thinking some kind of OTP solution or similar to give them a big enough hurdle to get over if they absolutely need to be admin. Suggestions?

I realize that malware infections will still be a problem for the engineering group but that's a future project.

This is a common issue, and the one thing that you have to keep in mind is that InfoSec serves the company. Your management team runs the company, so their needs are the company's needs.

Your job is to educate, educate, educate, not only with technical detail, but with financial impact and risk analysis. But, in the end, it's their call.

If they still decide to maintain local admin rights, then you need to have a plan in place to mitigate the risks of that happening, and educate them on the costs and risks of that plan.

It can be easy, as technical folks, to preach the "best practice", but the company's interests need to be served, even if you don't agree with it. Educate, build relationships, and create backup plans, but in the end it is the management's call.


Does the GHOST vulnerability affect Macs? Although the vulnerability targets Linux, I have read that it is really a glibc vulnerability, and some sites suggest that one should install a fix on any platform.  I know that there are a lot of packages out there that let you install glibc software on a Mac (such as homebrew, port, etc.) but I am not sure if a stock OS X install uses glibc.

I tried compiling the GHOST.c program given in the vulnerability notification, but get the following error:

$ gcc -o GHOST GHOST.c
Undefined symbols for architecture x86_64:
  "_gethostbyname_r", referenced from:
      _main in ccwPC2Tn.o
ld: symbol(s) not found for architecture x86_64
collect2: ld returned 1 exit status

But this doesn't make me feel much better, because I'm pretty sure there are other compilers besides gcc - in fact I don't think XCode even uses gcc any more. (Update: on closer inspection, it appears that gcc is a synonym for clang.)  Perhaps the bug is still there but the function has been renamed?

So what can/should a Mac user do to determine if his or her system is affected, and if it is, how can it be fixed, given that the vulnerability may or may not be in binaries supplied by Apple?

OS X is based on a BSD derivative, Darwin, which does not typically use GNU libc.  So my expectation is that the answer is "no".  That the _gethostbyname_r function, defined by glibc, is not available on OS X reinforces this hunch.

Let's see if some basic inspection of the library can help.

On a CentOS host:

$ strings /lib64/libc.so.6 | grep -i gnu
gnu_dev_makedev
gnu_get_libc_release
gnu_get_libc_version
gnu_dev_minor
gnu_dev_major
GNU C Library stable release version 2.12, by Roland McGrath et al.
Compiled by GNU CC version 4.4.7 20120313 (Red Hat 4.4.7-4).
        GNU Libidn by Simon Josefsson
<http://www.gnu.org/software/libc/bugs.html>.

yet on a mac:

# otool -L /usr/bin/gm4
/usr/bin/gm4:
        /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 159.0.0)
# otool -L /usr/lib/libSystem.B.dylib
/usr/lib/libSystem.B.dylib:
        /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 159.1.0)
        /usr/lib/system/libcache.dylib (compatibility version 1.0.0, current version 47.0.0)
        /usr/lib/system/libcommonCrypto.dylib (compatibility version 1.0.0, current version 55010.0.0)
        /usr/lib/system/libcompiler_rt.dylib (compatibility version 1.0.0, current version 6.0.0)
        /usr/lib/system/libcopyfile.dylib (compatibility version 1.0.0, current version 85.1.0)
        /usr/lib/system/libdispatch.dylib (compatibility version 1.0.0, current version 187.7.0)
        /usr/lib/system/libdnsinfo.dylib (compatibility version 1.0.0, current version 395.7.0)
        /usr/lib/system/libdyld.dylib (compatibility version 1.0.0, current version 195.5.0)
        /usr/lib/system/libkeymgr.dylib (compatibility version 1.0.0, current version 23.0.0)
        /usr/lib/system/liblaunch.dylib (compatibility version 1.0.0, current version 392.35.0)
        /usr/lib/system/libmacho.dylib (compatibility version 1.0.0, current version 800.0.0)
        /usr/lib/system/libmathCommon.A.dylib (compatibility version 1.0.0, current version 2026.0.0)
        /usr/lib/system/libquarantine.dylib (compatibility version 1.0.0, current version 36.0.0)
        /usr/lib/system/libremovefile.dylib (compatibility version 1.0.0, current version 21.0.0)
        /usr/lib/system/libsystem_blocks.dylib (compatibility version 1.0.0, current version 53.0.0)
        /usr/lib/system/libsystem_c.dylib (compatibility version 1.0.0, current version 763.12.0)
        /usr/lib/system/libsystem_dnssd.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/lib/system/libsystem_info.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/lib/system/libsystem_kernel.dylib (compatibility version 1.0.0, current version 1699.24.8)
        /usr/lib/system/libsystem_network.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/lib/system/libsystem_notify.dylib (compatibility version 1.0.0, current version 80.1.0)
        /usr/lib/system/libsystem_sandbox.dylib (compatibility version 1.0.0, current version 1.0.0)
        /usr/lib/system/libunc.dylib (compatibility version 1.0.0, current version 24.0.0)
        /usr/lib/system/libunwind.dylib (compatibility version 1.0.0, current version 30.0.0)
        /usr/lib/system/libxpc.dylib (compatibility version 1.0.0, current version 77.17.0)
# strings /usr/lib/libSystem.B.dylib | grep -i gnu

libsystem_c looks suspicious there, but let's check everything.

# for dl in /usr/lib/system/lib*.dylib; do echo $dl; strings $dl | grep -i gnu; done
...trimmed...
/usr/lib/system/libunwind.dylib
malformed DW_CFA_GNU_negative_offset_extended dwarf unwind, reg too big
...trimmed...

I started with gm4 since it's a GNU tool, and used otool to trace down its library dependencies.

So I think the answer is a fairly safe "no" as far as the Apple-supplied system goes.  As the question states, it's certainly possible to install glibc with third-party tools (although port search glibc doesn't find anything - note that glib is totally NOT the same as glibc).


What are the differences between "identifying threats and vulnerabilities" and "risk management"? I am struggling to appreciate the differences between the 7 steps of the NIST Framework for Improving Critical Infrastructure, which should help an organisation implement it.

Step 1: Prioritize and Scope. The organization identifies its
business/mission objectives and high-level organizational priorities.
With this information, the organization makes strategic decisions
regarding cybersecurity implementations and determines the scope of
systems and assets that support the selected business line or process.
The Framework can be adapted to support the different business lines
or processes within an organization, which may have different business
needs and associated risk tolerance. Risk tolerances may be reflected
in a target Implementation Tier.

Step 2: Orient. Once the scope of the
cybersecurity program has been determined for the business line or
process, the organization identifies related systems and assets,
regulatory requirements, and overall risk approach. The organization
then consults sources to identify threats and vulnerabilities
applicable to those systems and assets.

Step 4: Conduct a Risk Assessment. This assessment could
be guided by the organization’s overall risk management process or
previous risk assessment activities. The organization analyzes the
operational environment in order to discern the likelihood of a
cybersecurity event and the impact that the event could have on the
organization. It is important that organizations identify emerging
risks and use cyber threat information from internal and external
sources to gain a better understanding of the likelihood and impact of
cybersecurity events

In particular, I am having a tough time distinguishing between steps 2 and 4.
Step 2 includes the statement 'The organization then consults sources to identify
threats and vulnerabilities applicable to those systems and assets', however, this feels like it should be part of step 4 ' Conduct a risk assessment'

You've made a common mistake in risk management: threats and vulnerabilities are not risks.
The common (and debated) risk calculations are expressed as some form of:
Risk = likelihood x impact
Risk = (threat / vulnerability) x possibility of occurrence x impact
Risk = Threat capability x Vulnerability x consequence

Risk includes a consequence and a likelihood for that consequence to materialise.
So, the steps are in the correct order: identify threats and vulnerabilities (Orient), then determine the likelihood and impact of those threats acting against those vulnerabilities (Risk Assessment).

There's a hidden meaning in the wording in that list. "Orient" is a subtle reference to the OODA Loop. The OODA Loop is not often overtly referenced in risk management because, I think, it would be too difficult to explain while also trying to explain risk.
However, anyone dealing with risk is well-served to get to know OODA on a deep level. Once you understand OODA, then the NIST steps make so much more sense.


What can I do to find out who is remotely accessing my PC? Twice now I have left my home laptop active and logged in on my desk to return and find the mouse moving around the screen, the first time browsing through Xbox smartglass and the second time in the act of closing photoshop. I haven't waited around to see what it will do before force shutting the thing down. No damage was done the first time and I have yet to check from the second time. Whoever is doing it doesn't appear on my wifi network. Programs I had open when my PC was compromised both times were XAMPP, chrome, and text editors, (running Windows 10). It's quite unpleasant knowing my PC can be hacked at any moment I'm not using it and I wonder if there's anything I can do to find the person behind it or prevent these attacks in the future?

Here are some things which might help:

Turn off/Unplug your router, then boot up your computer.
Open settings and go to Apps & Features, look through the list for programs like 'TeamViewer'. I suggest you google search some top remote access programs and try to identify any you might have installed
Uninstall those you find, and also anything else you don't need. If you don't know what something is, Google the name first to find out.
Go back to the main settings window, and go to System > About. In the Related settings list on the right, select System info.
Click Advanced System settings on the left, and go to the Remote tab
Untick 'Allow Remote Assistance connections to this computer'
Back in the settings main window, open Update & security
Ensure both Windows and Windows Defender are up to date, if they aren't reconnect to the internet and update them.
Run a windows defender scan.

If those steps don't work or you want to be extra sure, you will unfortunately have to Nuke it from orbit, but after doing so I suggest you step back through the above to untick the Windows built in 'Allow Remote Assistance connections to this computer'.


Doubling up or cycling encryption algorithms I've occasionally read the suggestion to enhance security by either doubling up on encryption algorithms (encrypt a message once with one algorithm, then encrypt the ciphertext again with a different encryption algorithm) or by periodically cycling through a list of encryption algorithms.

I suspect that this is not appreciably more secure than a single, well-chosen and well-implemented encryption algorithm, but I'm not sure that I could argue my case.

Does doubling up or cycling encryption algorithms improve security?  Why or why not?

Cascading or cycling encryption algorithms increases implementation complexity, and that's really bad for security. Algorithm intrinsic security (provided that you use published, well-analyzed algorithms, not homemade designs) is invariably far greater than implementation security: most implementations may leak various elements, including secret key bits, through execution timing, cache memory access or insufficiently strict behavior when encountering incorrect data.

If you have covered all the implementation hazards, then it becomes time to worry about the algorithms themselves; at that point, you are a trained cryptographer and you know better than relying on irrational tricks such as cascading or doubling. Basically, the one thing that algorithm doubling or cycling guarantees is that whoever makes the suggestion is not overly competent in the area of cryptographic implementation, and therefore you do not want to use his code.

Historically, cascading or cycling are ways to cope with weak encryption algorithms; this is about assuming that any algorithm will be broken, and you try to do damage control. This somehow negates all research on cryptography since the 70s'. In practice, security issues are in how an algorithm is used (e.g. chaining mode with block ciphers), how an algorithm is implemented, and, most importantly, how keys are managed (creation, storage, destruction...). In order to have the algorithm itself be a weak point, you have to make huge efforts (e.g. designing your own algorithm, as the DVD consortium did). As an example, when modern game consoles are hacked, the algorithm themselves (AES, ECDSA...) are not broken, but circumvented (for ECDSA and Sony/PS3, this was a downright implementation bug).

What you do want is to have algorithm agility: you define the protocol such that the used algorithm is a configurable parameter. Therefore, if a given algorithm turns out to be flaky (which does not happen often at all), then you can switch to another.


How does having a custom root certificate installed from school or work cause one to be monitored? I was reading an article which said that if you install custom root cert from a third party then they can decipher all communication between you and others.
But that doesn't make sense. What I understand is that root cert allows SSL mechanism to verify if a certificate provided by connecting party is legit or not.
So unless someone(company, work, hacker, etc) really tries to impersonate by doing mitm. Only then the compromised root cert will come in play as that would be used to pass fake cert as valid cert.
otherwise just simply having a custom root cert isn't like decrypting all your ssl traffic. Unless the same org has also installed a software that acts as a proxy for all internet traffic. It requires active intercepting, decrypting, and re-encryption of all traffic. So either by installing malware on the computer or monitoring internet traffic.
correct?

I was reading an article which said that if you install custom root cert from a third party then they can decipher all communication between you and others.

I have no idea what you were reading (citations would be helpful). But you are right in that it is not sufficient to just have a custom root CA certificate installed as trusted - the school/work also has to be an active man in the middle in the traffic and use this CA certificate for SSL interception.

So either by installing malware on the computer or monitoring internet traffic.

Not only malware installed on the computer can monitor the traffic. It is actually common that trusted programs like antivirus or parental control software do this.
And when being directly inside the company (or school) network the path to the internet is usually through the companies firewalls and proxies anyway. Even when connecting from remote with a VPN or other access software the traffic  is routed and inspected through company controlled firewalls/proxies, either in the company directly but more often also somewhere in the cloud.


Not able to get response via OWASP ZAP I have performed the below steps to capture request/response in ZAP :-

Generate the dynamic certificate in ZAP.
Add the Certificate to the browser (FireFox).
Set the local Proxy to 127.0.0.1 and port to 8090
set the outgoing proxy in connection tab (options-> Connection) to proxy.abc.com and port to 8080
Enter the attacking url in browser after that i am getting below error

  Access Denied (authentication_failed)

  Your credentials could not be authenticated: "Credentials are
  missing.". You will not be permitted access until your credentials can
  be verified. This is typically caused by an incorrect username and/or
  password, but could also be caused by network problems.

But few urls are able to open with same configuration

If I apply similar settings in Burp the browser(firefox) is able to load the webpage with intercept on/off.

Set the Proxy chain and authentication  in
Options->Connection


How can I safely test malware in a VM? This question has probably been asked several times here, but I'll ask it a bit differently.

I am trying to learn about malware and how it infects computers and how to disinfect a computer if one gets attacked. I've seen several people use virtual machines to test malware in (I've been using VirtualBox for a few years now) and I've contemplated on doing it too, but I fear that the malware might "leak out" of the VM and ruin my host computer and all of the computers on my network.

The questions I have are:

Can I test malware in VirtualBox with access to the Internet within the VM without harming my host computer or any of the other computers on my network?
If I use a real computer to test malware on (I have a junky Dell XP tower kicking around), will formatting afterwords be enough?
Can my Dell XP tower also have the Internet enabled without the malware effecting my other computers?
Even if I can't have both the Internet enabled and use malware within the VM at the same time, can that malware still "hop out" of the VM and attack my host computer?
Since I will also be 'pranking' some of those cliche Windows scammers (well, not really pranking, just testing ways that they can get in and do damage), would it be safe to use a VM, or can I even use that junky Dell of mine?
Will it also be necessary to mask my IP and MAC addresses so that they aren't logged and sent out to whoever could receive it while I'm doing the malware testing?
If I can safely execute malware within a VM, what steps are necessary for keeping my real stuff safe?

If this helps, my host computer will either be a Mac running OS X 10.8.5, or a tower running XP (not my Dell one).

And the guest will be any OS, but mainly Windows (yes, from newest to oldest)

I hope I explained this well enough for you guys.

Any and all help will be greatly appreciated.

Thank you!

1/3/4/7-Access to the Internet? Not a good idea as depending on what it does, your VM could release it "into the wild". Running it in a VM should be perfectly fine if it is not connected to the internet.
This answer from The Bear will go into a lot more detail regarding the malware escaping a VM. Here

2-Formatting should be fine for 99% of malware. Some can attack to other areas other than harddrive though so keep that in mind and research what you are playing with.
More information here

6 - You could use a proxy, but as Munkeyoto stated, to properly analyze, you need to see the traffic.

As for your question in the comments...
-Yes it is. You shouldnt have any issues with just formatting. There is extremely sophisticated malware that can reside if MBR, bios, firmware, but this would be above everyday malware. UNLESS you have peripherals attached (USB drive for example).


Whitelisted, encrypted, signed e-mails: how could they be tricked? There is a company that has problems with Phishing (try to defend against it). Using internal mails.

The big question: What security problems can occur when trying the following solution?:

  All mails that are NOT signed and encrypted are NOT accepted/bounced.

  If given user will never communicate with the outside word via e-mail
  then mails sent/received to/from the public internet need to be
  bounced back.

  Of course only a valid users key is accepted, not *, so allowed keys
  are whitelisted.

Can this solution be tricked somehow?

We can only think of that a valid users machine would be hacked from outside and thus the attacker would have a valid keypair.
Or if trying with S/MIME, there could be a CA that would offer bogus certs.

Be careful that you don't bounce a bounce message. Otherwise, you can self-DDOS your mail server.

It may be safer, at least in the first few months of trialling this, that instead of bouncing emails, you'd accept them but deliver the message with a big warning that the email was not signed properly, and may have been an attempted phishing, and that the recipient must not act on the email unless they verify any information therein through other secure means.

If an attacker managed to obtain a user's private key, then they would have been deep enough in that person's machine that anything that person does would be suspect, whatever system you're using. So this is not an issue you need to worry about. Additionally, requiring signatures gives you the ability to identify the person who leaked their private keys and discipline/retrain that person. You can also revoke that key easily, while the attacker would have to look for someone else's system to break.

A CA aren't supposed to issue an email certificate unless they can prove the email address control. All public CA publishes their Certificate Practice Statement, which details how they validate someone's identity before signing a certificate for that person. You can choose a CA that have an acceptable CPS and limit your attack surface so your mail server would only trust that particular CA for mails within your domain. If you distrust any public CA, you can also run an internal CA so that you don't need to rely on a third party for your internal employee identification.

  Of course only a valid users key is accepted, not *, so allowed keys are whitelisted.

Rather than whitelisting user keys directly, I'd suggest white listing trusted verifier (CA/Web of Trust) keys instead. Only servers whose public keys are certified by the verifier would be accepted by the mail server. This separates the responsibility between verifiers and mail server administrator, and allows you to add/remove people without mail server redeployment/reconfiguration. For example, you can train HR to become your identity verifier, and they'd be responsible for signing and revoking certificates as people come and leave the company.


Is Signal still more secure than WhatsApp? WhatsApp has "recently" deployed end-to-end encryption using the Signal protocol, which is of course also being used by Signal itself. The related white paper (PDF).

Now this raises the question:
Is there still any security benefit to use Signal over the much more widely deployed WhatsApp, now that both have good end-to-end encryption?

The threat model in this case includes basically anyone not having access to the phones at the ends. It especially includes the service provider and law enforcement.

There are still a couple of security functions, which may matter to you, which Signal does better than WhatsApp.
Client-Side Fanout
When you use a group chat in WhatsApp, you send your message to the server who in turn distributes it to all the group members. This way WhatsApp learns all the social structures and can in theory perform traffic analysis to deduce quite a bit of information from the message volume exchanged.
In Signal on the other hand, group chats are actually normal peer-to-peer chats with a special flag, which is set inside the end-to-end encrypted frame. So this way OpenWhisperSystems (the makers of Signal) doesn't learn your social group structures. However they can still see that three messages are going to three different people at once and can guess that this is due to a group chat.
The blog post for Signal. The server-side fan-out is stated in the white paper (PDF).
Private Group Metadata
Because the previously mentioned approach of everyone just directly sending the group messages to each other is messy with regards to privileges - as achieving consensus in an asynchronous distributed system is hard - Signal has deployed a new system to enforce access control and privileges in groups without learning anything about the group structure - only about the existence of a group and a guesstimate of its size based on the size of the server-stored ciphertext. See this blog post for details and this post for the deployment announcement and this post for how group links factor into this.
I was unable to find documentation on how WhatsApp handles this data. Though given they know the group membership to distribute messages, they may just store this in the clear.
In-App Encryption
Signal offers to encrypt the past communication at app level, which WhatsApp  lacks completely. Obviously this can protect your messages in case of theft however you probably won't gain that much security because most people will probably not choose good passwords here for usability reasons.
Use of the OS keystore
Modern mobile operating systems provide a place for you to store your keys so they aren't unencrypted in the filesystem. The OS will usually either encrypt them with some hardware backed mechanisms, like iOS's secure enclave or Android will use things like ARM TrustZone for increased difficulty of key extraction. Additionally Apple is famously known for doing a really good job at the security of the iOS keychain backups. Signal uses these security features (iOS, Android), whereas WhatsApp (likely) does not.
Optional Read and Typing notifications
WhatsApp notifies you when somebody is typing and it notifies you when somebody read your message - and you can't turn it off for group chats. This however allows WhatsApp to deduce app usage behavior and your habits. Like "Do you check your WhatsApp messages at 1am?", combine that with the other meta data WhatsApp is harvesting and you can make some useful guesses about people's lifes. Additionally the "typing" notifications can be used to deduce potential contents based on context and default keyboard suggestions and other factors.
Signal doesn't enforce this. Here's the original discussion on it on GitHub. As a more recent development, Signal adopted read notifications, but they're default-off (for pre-existing installations) and aren't forced-on in Group conversations. For groups I think they work indidually with each member, that is if a member and the sender have them both enabled, the sender will get the notification, which is much more privacy-focused than WhatsApp's solution.
Backup Security
WhatsApp offers you to backup your messages so you can recover them when your phone is inacessible or destroyed. However due to the very nature of this, the backup (which must (also) be hosted on Google Drive) cannot be encrypted / secured other than with your username / password for that account (which WhatsApp doesn't know). So as soon as that Google Drive account is breached or some government demands access, all the end-to-end security is gone if either party of the communication had backups enabled. As for iCloud (as opposed to Google Drive) a similar argument applies - especially as the kind of data WhatsApp is saving is not sensitive enough for Apple to use their stronger security mechanisms as they would e.g. for passwords.
Even though the backup feature of Signal isn't as convenient as the one of WhatsApp it doesn't automatically store (plaintext?) copies of messages on Google servers, but rather allows you to (automatically) create a local (encrypted) file and push this one manually around. It is unclear though of WhatsApp's backup feature profits from the recent security enhancements in Google's backup infrastructure (on android at least), so they might actually be secure.
Auto-deleting Messages
Automatically deleting your own old messages is good from a security standpoint. It means that if an attacker manages to break into your phone / backup that (s)he can't access all messages but only the recent ones. Auto-deletion is especially nice if you consider that you won't read all the really old messages anyways and that it will save you some storage. As of now, WhatsApp does not implement this.
Signal on the other hand does.
No meta-data storage
Signal was recently hit by a Subpoena. They complied (of course) but could only contribute very little, which confirms that they're holding true to their privacy policy.
At the same time WhatsApp is sitting on a large(r) amount of meta data and would be much more useful if hit (and if it's being disclosed). This is especially obvious if you compare what WhatsApp logs and what Signal logs.
Private Contact Discovery
WhatsApp uploades your entire adress book to their servers to compare which of the listed users have WhatsApp accounts. Obviously during that process WhatsApp learns your social graph, that is who you know, including people who don't use WhatsApp.
Signal now on the other hand, has somewhat recently deployed a much smarter solution, using fancy modern cryptographic techniques paired with Intel's SGX technology so that OpenWhisperSystems actually doesn't learn your adress book (only the SGX enclave does and that doesn't leak it), but only needs to keep on-record who their users are and thus they also don't learn anything about which users you may know but don't chat with using Signal and which people you know but don't use Signal (yet). The details of this can be read in their blog post.
Registration Locking
While both Signal and WhatsApp support registration locking which forces you to enter a pre-determined PIN whenever a new device is added to an account, it is unclear how security is enforced. That is, how many tries one gets for the PIN before hitting the lock-out and whether this lock-out can be overriden by the service operator. Signal is currently beta-testing using SGX to have a verifieable upper limit on the tries you get for this.
Private Link Preview
Signal goes out of its way to hide which URL you're accessing from Signal when generating link previews and hiding your IP from the server.
WhatsApp on the other hand has a less stringent stance on the topic though it is only "worse" than Signal in that regard by leaking the sender's IP to the service.
Sender Hiding
Signal has a feature that allows you to hide your identity from the server when sending a message. That is, the app can send a message to the server that will be delivered without revealing from who it is exactly. So what the Signal servers see is that somebody with a given IP sent a message to a well specified user.
From what I know WhatsApp doesn't implement anything similar and instead relies on user authentication for sending to prevent impersonation and similar issues.
Encrypted Profiles
In Signal your profile picture and chosen name are only ever transmitted using end-to-end encryption. Also see the introducing blog post. This means that the server doesn't learn how your picture looks or what string you use to identify yourself to others.
In WhatsApp however the picture is less clear. It seems highly likely that if you set these information to public they are indeed stored in the clear on the servers. However if you set it to contacts-only, it is much less clear whether WhatsApp uses its end-to-end encryption for the transport of the image or whether it's just an access-controlled API functionality on the server. At least this (unofficial) blog post claims that the end-to-end encryption is not used for profiles.
Ephemeral Messages?
They're a feature supported both in WhatsApp and Signal - messages that are deleted on the receivers end after some condition is satisfied. However there's no real security impact for their implementation as the rule "if you can see it, you can photograph it with a different device" applies.
So TL;DR:
The remaining security differences (after the protocol update) are mainly that WhatsApp generates a lot of meta data to be convenient while Signal tries to avoid meta data.


Relying on openssl's certificate authority list or provide my own My apologies if this is too subjective, but I am looking for advice on best practices.  We maintain a small program written in Python that runs on our customers' servers and communicates back with our servers.  We are using Python's ssl module which relies on openssl to protect this communication back to our servers.  This program is run on older Linux systems (think RHEL5) as well as Windows variants.  (Yes, the ssl module doesn't come by default with Python 2.4, but please ignore that issue for the sake of this question.)

Our plan is to include a file with the program containing the certificate authority that issued our current SSL certificate, as well as some other authorities that we may use in the future.  That way, we know that no matter what is on the customer's servers, our certificate authority will be trusted.

Is this reasonable, or does openssl provide a good enough list of certificate authorities even for old openssl versions that we should not need to worry about this ourselves?  Are there any issues we should also consider with regards to providing our own certificate authority list, beyond just locking us into that list for future SSL certs?

OpenSSL does not come with a list of trusted certificate agencies, it only has a default path where it looks for these CA. On Linux and *BSD this path is usually populated by the OS, often based on the list Mozilla uses in the Firefox browser.

But, there is no such list on Windows, because OpenSSL can not deal with they way windows stores the certificates. There is also no such list on OS X, but Apple added a hack to OpenSSL as shipped on Mac OS X to somehow integrate into their native key chain.

This means, if you want to have a controlled behavior you better ship with your own list of trusted CA. And if the program should only connect back only to your server it might be the best to include only the CAs relevant for this task.


Patient Hashes for Compression and Security Are there any front-running approaches to using server-generated hashes to encapsulate patient condition in a concise manner while maximizing security?

For example, a system to represent current med profile in a hash that can be used to check for contraindications without revealing the specific component prescriptions?

None that I know of. And I believe this is because.. I don't think the solution (implied by the question) is a good solution/proposal.

Not only because hashing function may have collisions (even if it has a very low probability, the impact would be major, so why should we add such a risk ?) but also because you have another problem prior to hashing: unless you solve something that has not yet been fully solved (i.e. semantic interoperability), in a med profile you can -for instance- find/formulate the very same medical concept in several different ways (i.e. different text sequences may mean the same thing/medical concept) so in those cases you would get different hashes referring to the same concept (!) . How would you manage that ? Will you be able to map all those different hashes to the same medical concept ? (type of allergy or whatever). How would you say that two hashes really mean two different things.. and which things should they be ?. I believe you won't be able to predict all the possible different ways in our language we could express the same concept and the resulting hashing values will be severely flowed in semantic terms.

Even if you choose to use the best terminologies and controlled vocabularies or coded information to be used in the med profile, they will still need continued maintenance and revision over time (because of versioning etc. e.g. aliases, new concept in, deprecated concepts out etc.) all things that will impact severly on the effectiveness and reliability of your "decision support system" based on concepts hided by hashes values. So I don't think it is a good idea to hide a medical concept  behind hashes and taking decisions based only on the hashes values.

Besides, if I authorize my Doctor to access my medical record, I want him to see it very clearly what my allergy is in terms he can understand. Can you imagine your Doctor watching hashing values supposed to be mapped vs. some medical coded information having absolutely no way to really verify the real concept that may be behind ? Not a good idea. You want compression ? Use compression algorythms. You want security ? User encryption with two ways functions and authentication infrastructure etc. (keep in mind that hashing is a "one-way" function). Just keep using hashing for those things we use them today (to index, retrieve items more efficiently, for digital signatures etc.) NOT to hide/store medical concepts. I would not innovate this way. But may be I am wrong. Is there a better answer to this?


How to crack passwords without revealing them? I would like to check for weak passwords (they are dumped from Active Directory) without actually ever seeing the password (*). I just need to know that a given username has a weak password and inform him or her accordingly.

John the Ripper would be my first choice but I did not find a way to just list the cracked accounts.

I could parse the result file to extract the usernames but this still leaves open the possibility of seeing a password (inadvertly, by sending a SIGHUP to the process etc.)

Is there a functionality of John the Ripper which could be used? (I did not see it in the docs)

Alternatively: is there cracking software with such functionality which could be used instead ?

(*) This is mostly to follow EU regulations on privacy which are not only restrictive but also vary from country to country. This is also the reason why I am looking for a bulletproof solution.

I am not a lawyer, and my answer assume that you are in a professional context, meaning that what you are trying to crack testing are professional accounts given by an organization to its employees. As the general security of the organization could be weakened by poor passwords, I think that it can ask its employees to use not too weak passwords. I do not know a technical way to only disclose account with weak passwords without actually disclosing the password, so I would use a more than 2 eyes procedure:

at least 2 persons (a technical admin and a senior manager) must be involved in the operation, each one controling what the other does
you run john that way (assuming a Unix or Linux system):

john password_file > /dev/null 2>&1
john --show password_file | sed -e 's/:.*//' > user_list.txt
rm ~/.john/john.pot

The user_list.txt file will contain only the name of the users for which the password was discovered by John The Ripper, but none of the persons running it has ever seen any password.


how can my bank have a wrong phone number entered with my personal account information? the other day at our bank, while my wife and i were transferring some funds between accounts, we found that on one of the accounts, a phone number that has no relationship to either of us was listed as being her personal contact number. the bank officer seemed to be unaware of how this might've occurred and didn't seem particularly alarmed by it, but it made both of us uneasy, especially when later we did a google search of that phone number and on at least one website it came back as being associated with her as well...we tried calling the number but only reached an answering machine, so are wondering who might be the best person to contact to discover whether or not and to what degree anything malicious is likely to be behind the situation...

Most probably, there was some human error upon entry, probably by an anonymous operator at the bank. If the number is also on a Web site associated with your wife's name, then the most plausible explanation is that the bank sold some of your personal information to third parties, as they are prone to do. Have you ever wondered how all the people who call you in the evening to sell you new windows, subscriptions to magazines, or eternal salvation, obtain your name and phone number ? Well, wonder no more: they simply buy personal information from companies and other institutions who have it. Information from banks will be especially well appreciated on that market, because it can come with some annotations such as "tends to use credit cards a lot" or "filthy rich".

Whether banks (and other institutions) are morally allowed to sell your information is an open debate; but legally speaking banks tend to be well-covered.

In the case of your wife, the error on the phone number should be fixed because, unfortunately, some banks use the phone number as an identification element. But as soon as the number is fixed, this particular vulnerability is removed (at least as much removed as it can be). Otherwise, look at your bank accounts to see if anything weird occurred; if nothing is wrong, then you can cease to worry.


Difference between whois of a hostname and an IP I was reading through No Starch's Metasploit book when I came across a segment which showed the results of running the 'whois' command on a hostname and then on it's corresponding IP only to yield different results.

> whois secmaniac.net
[*] exec: whois secmaniac.net
Registered through: GoDaddy.com
Domain Name: SECMANIAC.NET
Created on:..
..

Then, using Netcraft, the IP for this domain was found.

> whois 75.118.185.142
[*] exec: whois 75.118.185.142
WideOpenWest Finance LLC WIDEOPENWEST (NET-75-118-0-0-1)
75.118.0.0 - 75.118.255.255
WIDEOPENWEST OHIO WOW-CL11-1-184-118-75 (NET-75-118-184-0-1)
75.118.184.0 - 75.118.191.255

How exactly do these two yield different results? If my understanding is correct, hostnames and IPs are two sides of the same coin with the DNS server playing Harvey Dent.

This is normal. The ownership of most domains will not match the IP addresses they point to.  Where they will "match" is for ISPs and very large organisations. They will generally not match for small companies and personal domains.

The reason for this is that ISPs and very large organisations will actually own their IP addresses but smaller companies generally rent them from an ISP. This is by no means guaranteed.  Even large organisations can still rent thousands of IP addresses from another company.

Although I own my domain, I point it at an IP address that is owned by Amazon.
Stackexchange points their domains at IP addresses owned by Fastly.

IP addresses can exist and be owned even if there are no domains pointing to them.  Domains can point to IP addresses that don't exist or even IP addresses that can't be owned, such as 127.0.0.1. Domains can point to multiple IP addresses.

In addition to all of this, the definition of "matching" is not clear. Even when a company owns both the domains and the IP addresses, the record returned by a whois command is still different and requires a bit of intelligent fuzzy matching to determine that it represents the same entity. For instance Amazon:

whois of the domain:

Domain Name: AMAZON.COM
Registry Domain ID: 281209_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2014-04-30T19:24:35Z
Creation Date: 1994-11-01T05:00:00Z
Registry Expiry Date: 2022-10-31T04:00:00Z
Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740

whois of one of their IP addresses:

OrgName:        Amazon.com, Inc.
OrgId:          AMAZON-4
Address:        1918 8th Ave
City:           SEATTLE
StateProv:      WA
PostalCode:     98101-1244
Country:        US
RegDate:        1995-01-23
Updated:        2017-01-28
Ref:            https://whois.arin.net/rest/org/AMAZON-4

And Google:
whois of google.com:

Domain Name: GOOGLE.COM
Registry Domain ID: 2138514_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2011-07-20T16:55:31Z
Creation Date: 1997-09-15T04:00:00Z
Registry Expiry Date: 2020-09-14T04:00:00Z
Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740

whois of a Google IP address:

NetRange:       172.217.0.0 - 172.217.255.255
CIDR:           172.217.0.0/16
NetName:        GOOGLE
NetHandle:      NET-172-217-0-0-1
Parent:         NET172 (NET-172-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS15169
Organization:   Google LLC (GOGL)
RegDate:        2012-04-16
Updated:        2012-04-16
Ref:            https://whois.arin.net/rest/net/NET-172-217-0-0-1

Even the fields are not consistent across different whois servers.  Amazon sends OrgName while Google sends Organization.

They may not even be consistent within a single organisation. This is owned by Facebook:

NetRange:       69.171.224.0 - 69.171.255.255
CIDR:           69.171.224.0/19
NetName:        TFBNET3
NetHandle:      NET-69-171-224-0-1
Parent:         NET69 (NET-69-0-0-0-0)
NetType:        Direct Assignment
OriginAS:       AS32934
Organization:   Facebook, Inc. (THEFA-3)
RegDate:        2010-08-05
Updated:        2012-02-24
Ref:            https://whois.arin.net/rest/net/NET-69-171-224-0-1
OrgName:        Facebook, Inc.
OrgId:          THEFA-3
Address:        1601 Willow Rd.
City:           Menlo Park
StateProv:      CA
PostalCode:     94025
Country:        US
RegDate:        2004-08-11
Updated:        2012-04-17
Ref:            https://whois.arin.net/rest/org/THEFA-3

This is also owned by Facebook:

inet6num:       2a03:2880::/29
netname:        IE-FACEBOOK-201100822
country:        IE
org:            ORG-FIL7-RIPE
admin-c:        RD4299-RIPE
tech-c:         RD4299-RIPE
status:         ALLOCATED-BY-RIR
mnt-by:         RIPE-NCC-HM-MNT
mnt-lower:      fb-neteng
mnt-routes:     fb-neteng
created:        2015-09-24T12:59:37Z
last-modified:  2016-04-14T10:48:51Z
source:         RIPE # Filtered
organisation:   ORG-FIL7-RIPE
org-name:       Facebook Ireland Ltd
org-type:       LIR
address:        4 GRAND CANAL SQUARE ,
                GRAND CANAL HARBOUR ,
address:        D2
address:        Dublin
address:        IRELAND
phone:          +0016505434800
fax-no:         +0016505435325
admin-c:        PH4972-RIPE
mnt-ref:        RIPE-NCC-HM-MNT
mnt-ref:        fb-neteng
mnt-by:         RIPE-NCC-HM-MNT
abuse-c:        RD4299-RIPE
created:        2011-04-07T13:16:29Z
last-modified:  2017-10-30T14:51:29Z
source:         RIPE # Filtered


is there a term for encryption where decrypting with the wrong key will still result in an intelligible message? Suppose you encrypt a list of names of Americans with a 512-bit secret-key algorithm.  Currently no supercomputer can break it, but someday a supercomputer might exist that could iterate through all possible keys and find a key that decrypts the list to what sound like American-sounding names, and when you find that, you know you've probably got the right key.

Is there a term for secret-key encryption where many possible keys will decrypt the ciphertext to realistic-looking plaintext, so the encryption can never be brute-forced, because even if you find a key that decrypts to one of the realistic plaintexts, you won't know if you got the right one?  (And thus, presumably, the encryption could be done with a shorter encryption key, since it can't be brute-forced anyway.)

A one-time pad would have this property, of course, but presumably so could other systems.

Say, instead of storing a list of American names, you come up with an index of every American first name and every American last name.  Then when storing the firstname-lastname pairs, you store them as pairs of numbers.  Then any key that decrypts the ciphertext to a list of numbers will thereby decrypt to a list of names.  (Except, you'd need to do more work than that, because some names are more common than others, so the attacker could try to find a key which decrypts to a list where the names follow the expected distribution.  But that's the idea.)

So does this have a name?  Many-plaintext encryption or something?

That reminds me of the concept of encryption that offers Plausible Deniability, aka "Deniable Encryption" which has the following property:

  Deniable encryption makes it impossible to prove the existence of the plaintext message without the proper decryption key. This may be done by allowing an encrypted message to be decrypted to different sensible plaintexts, depending on the key used. This allows the sender to have plausible deniability if compelled to give up his or her encryption key.

The commonly-cited use for this is at airports: have two operating systems steganographically overlapped on the same hard drive. When airport security asks you to boot up your laptop, enter the decryption password for the "innocent" OS. Even if they forensically examine your laptop, nobody would guess that there's a second OS hiding in plain sight.

Thanks to @JamesMishra for pointing out in this post that:

  TrueCrypt had a similar hidden operating system feature where the TrueCrypt bootloader would accept two different passwords, giving access to two different operating systems. The hidden operating system was concealed with a bit of clever steganography.

Second, let's talk about this:

  someday a supercomputer might exist that could iterate through all [2512] possible keys and find a key that decrypts the list

I see where you're coming from, but brunt computing power alone isn't enough. See this answer of mine for math showing that counting from 0 to 2208 would require you to consume the energy equivalent of the sun.

The YouTube channel 3Blue1Brown has an excellent video showing just how mind-bogglingly large the number 2256 is.

How secure is 256 bit security?

In summary:

2^256 = (4 billion) x (4 billion) x (4 billion) x (4 billion) x (4 billion) x (4 billion) x (4 billion) x (4 billion)

Counting from 0 to 2256 would require: a GPU capable of doing 4 billion ops/s x 1 kilo-Google's worth of servers x 4 billion people each having their own personal kilo-Google's worth of servers x 4 billion copies of the planet Earth x 4 billion copies of the Milky Way x 37 time the age of the universe. And we're still missing one more factor of 4 billion. Yeah, 2256 is an unfathomably large number.

Your intuition is not entirely wrong though; over time we do get better at cracking encryption keys, but that has more to do with advances in understanding the mathematics of a specific encryption algorithm that let us narrow in on likely keys, but brunt computer speed alone won't even get us there.


How to know when to install a certificate? How do you actually know when a certificate is issued that your system doesn't recognize, whether to trust it or not? When I was setting up Outlook for Gmail I got prompted to install the following certificate which looks legitimate

I guess I trust google, but one thing I never understood is why can't the certificate be spoofed and not actually be coming from Google?

Here is the prompt from Outlook 2013

Contents of exported certificate:

-----BEGIN CERTIFICATE-----
MIIEgDCCA2igAwIBAgIIS9Sb0M/irpgwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE
BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
cm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMTEyMTkwMzIzWhcNMTYwMjEwMDAwMDAw
WjBoMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEXMBUGA1UEAwwOc210
cC5nbWFpbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3ppZG
9jxYdfN51OCDbRbY5q4w5i8iQLWrbKONSE1iPiK1RB2Dqg01I1kat9MJyQ468iuN
t3mJSrG4O+gCVAnkhID3JnzQqbRlwuBJq8crv7nXDfhWy+m/V9WJdgAmX0EyBpi5
5z+MVjUWEyqqPcEqJy9ETr9flPSiDkCEYRxl++UaIRm/JhZaRjmbn6sWK4cs1qkn
bFzQffMoalMOnfmKDGHxzdgzD8ODdkV3QxVtiLG1joOpw2zzTVnPyu9wdkRazCqB
e/B1UYAZYxImb6O0F7wOLNCH4I0FVQ+z+5gCKoI2EsK4vxwegE3BFmHq5B8B6h3m
Q+60PYV21kk3aUvdAgMBAAGjggFLMIIBRzAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
KwYBBQUHAwIwGQYDVR0RBBIwEIIOc210cC5nbWFpbC5jb20waAYIKwYBBQUHAQEE
XDBaMCsGCCsGAQUFBzAChh9odHRwOi8vcGtpLmdvb2dsZS5jb20vR0lBRzIuY3J0
MCsGCCsGAQUFBzABhh9odHRwOi8vY2xpZW50czEuZ29vZ2xlLmNvbS9vY3NwMB0G
A1UdDgQWBBSfeOyCPcmqprmS+YLrehM8K2VWjTAMBgNVHRMBAf8EAjAAMB8GA1Ud
IwQYMBaAFErdBhYbvPZotXb1gba7Yhq6WoEvMCEGA1UdIAQaMBgwDAYKKwYBBAHW
eQIFATAIBgZngQwBAgIwMAYDVR0fBCkwJzAloCOgIYYfaHR0cDovL3BraS5nb29n
bGUuY29tL0dJQUcyLmNybDANBgkqhkiG9w0BAQsFAAOCAQEAMXMXOrEPQnNdaVCG
M7AL6Vn988DDJkrcnKtrElFkITNeQWzMdeNH4AQs9r7z0KDvjZKEs8dbPZam1puN
oW4FvklUAa8jY8KhxmFok0jJnLhlsAG4HXWanoNz9n18tRcvtjUifnqTyIjPM2Iu
5ZulNvP/E4Gu+G0rAek78CqzFScOs0/Mkk4L8dFpWeAmUVFmC+HG2Gek0Pjl6ZAO
O4l7u4/2sNQHbstExnbCDnMBE/HdGcTlxJvLMCll2MArSOXWaq5Uwtahxt+CuV2R
jKWChefft/VOdek51MmXrJH3H8FjJkDcnnPsy6cft/w2mK24tXADPqmYpcF4tU4q
Pnox+A==
-----END CERTIFICATE-----

Cert is fine.
Cert is fine. (It chains up to good root CA. I checked manually on Win10.)
This certificate is valid ONLY for smtp.gmail.com. (See below.) So if you access by ANY other DNS-Name or IP, then this is going to fail.
What name do you use? How is the proxy involved?
$ openssl x509 -in smtp.gmail.com.cer -noout -text

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5464163569050496664 (0x4bd49bd0cfe2ae98)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
        Validity
            Not Before: Nov 12 19:03:23 2015 GMT
            Not After : Feb 10 00:00:00 2016 GMT
        Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=smtp.gmail.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b7:a6:96:46:f6:3c:58:75:f3:79:d4:e0:83:6d:
                    16:d8:e6:ae:30:e6:2f:22:40:b5:ab:6c:a3:8d:48:
                    4d:62:3e:22:b5:44:1d:83:aa:0d:35:23:59:1a:b7:
                    d3:09:c9:0e:3a:f2:2b:8d:b7:79:89:4a:b1:b8:3b:
                    e8:02:54:09:e4:84:80:f7:26:7c:d0:a9:b4:65:c2:
                    e0:49:ab:c7:2b:bf:b9:d7:0d:f8:56:cb:e9:bf:57:
                    d5:89:76:00:26:5f:41:32:06:98:b9:e7:3f:8c:56:
                    35:16:13:2a:aa:3d:c1:2a:27:2f:44:4e:bf:5f:94:
                    f4:a2:0e:40:84:61:1c:65:fb:e5:1a:21:19:bf:26:
                    16:5a:46:39:9b:9f:ab:16:2b:87:2c:d6:a9:27:6c:
                    5c:d0:7d:f3:28:6a:53:0e:9d:f9:8a:0c:61:f1:cd:
                    d8:33:0f:c3:83:76:45:77:43:15:6d:88:b1:b5:8e:
                    83:a9:c3:6c:f3:4d:59:cf:ca:ef:70:76:44:5a:cc:
                    2a:81:7b:f0:75:51:80:19:63:12:26:6f:a3:b4:17:
                    bc:0e:2c:d0:87:e0:8d:05:55:0f:b3:fb:98:02:2a:
                    82:36:12:c2:b8:bf:1c:1e:80:4d:c1:16:61:ea:e4:
                    1f:01:ea:1d:e6:43:ee:b4:3d:85:76:d6:49:37:69:
                    4b:dd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Alternative Name:
                DNS:smtp.gmail.com
            Authority Information Access:
                CA Issuers - URI:http://pki.google.com/GIAG2.crt
                OCSP - URI:http://clients1.google.com/ocsp

            X509v3 Subject Key Identifier:
                9F:78:EC:82:3D:C9:AA:A6:B9:92:F9:82:EB:7A:13:3C:2B:65:56:8D
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Authority Key Identifier:
                keyid:4A:DD:06:16:1B:BC:F6:68:B5:76:F5:81:B6:BB:62:1A:BA:5A:81:2F

            X509v3 Certificate Policies:
                Policy: 1.3.6.1.4.1.11129.2.5.1
                Policy: 2.23.140.1.2.2

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:http://pki.google.com/GIAG2.crl

    Signature Algorithm: sha256WithRSAEncryption
         31:73:17:3a:b1:0f:42:73:5d:69:50:86:33:b0:0b:e9:59:fd:
         f3:c0:c3:26:4a:dc:9c:ab:6b:12:51:64:21:33:5e:41:6c:cc:
         75:e3:47:e0:04:2c:f6:be:f3:d0:a0:ef:8d:92:84:b3:c7:5b:
         3d:96:a6:d6:9b:8d:a1:6e:05:be:49:54:01:af:23:63:c2:a1:
         c6:61:68:93:48:c9:9c:b8:65:b0:01:b8:1d:75:9a:9e:83:73:
         f6:7d:7c:b5:17:2f:b6:35:22:7e:7a:93:c8:88:cf:33:62:2e:
         e5:9b:a5:36:f3:ff:13:81:ae:f8:6d:2b:01:e9:3b:f0:2a:b3:
         15:27:0e:b3:4f:cc:92:4e:0b:f1:d1:69:59:e0:26:51:51:66:
         0b:e1:c6:d8:67:a4:d0:f8:e5:e9:90:0e:3b:89:7b:bb:8f:f6:
         b0:d4:07:6e:cb:44:c6:76:c2:0e:73:01:13:f1:dd:19:c4:e5:
         c4:9b:cb:30:29:65:d8:c0:2b:48:e5:d6:6a:ae:54:c2:d6:a1:
         c6:df:82:b9:5d:91:8c:a5:82:85:e7:df:b7:f5:4e:75:e9:39:
         d4:c9:97:ac:91:f7:1f:c1:63:26:40:dc:9e:73:ec:cb:a7:1f:
         b7:fc:36:98:ad:b8:b5:70:03:3e:a9:98:a5:c1:78:b5:4e:2a:
         3e:7a:31:f8

(Side note: I didn't this certificate in the two useful certificate repositories that I like to use. Neither at ssl-tools.net. Nor at Crt.sh. But maybe it'll eventually find its way into those two useful repositories.)
No need to install it though.
You should not really have to install this manually. Otherwise something is wrong. It's correctly signed by a well known CA and should work out of the box on all modern operating systems.


Are machines patched against WannaCry protected against the ongoing Petya attacks? Our environment has a few Windows 2012 R2 servers which is already patched against the WannaCry ransomware. The update installed was KB4012213.

Is this good enough to protect against the ongoing Petya attacks?
Anything else we should be doing other than disabling SMB service if
unused?
Does it spread itself through networked computers without user intervention?

Making sure that SMBv1 is disabled is a good start to protecting against the Ethernalblue exploit.

The malware also uses the WMIC and PSEXEC tools to infect machines that are fully-patched Windows computers. Disabling WMIC is advised see here on how to disable WMIC: https://msdn.microsoft.com/enus/library/aa826517(v=vs.85).aspx

I have also seen people saying to block remote use of local accounts via GPO but I have not seen too much on that yet.

There are also reports saying that paying the ransom will not reward you with the decryption key as the email that is used has since been blocked.

There have also just been some reports that if you power off the machine right as the message appears than it will not encrypt the files.
https://twitter.com/hackerfantastic/status/879775570766245888

UPDATE: There seems to now be a kill switch found to stop the attack all you have to do is create a folder C:\Windows\perfc

https://twitter.com/TheHackersNews/status/879782531146461185


How does the KeeLoq block cipher work? Note: This question is follow-on from comments on this answer that were broad enough to be a separate question.

As far as I understand, KeeLoq is a block cipher designed for use in the automotive industry, specifically for keyless entry systems where one master receiver (the car?) needs to be able to register and authenticate transmitters (key fobs) in the field.

Re-quoting manufacturer documentation from the linked answer:

  The Normal key generation scheme is the common key generation scheme for KEELOQ technology systems. During Normal Learn, a master key is used (known as the “manufacturer code”). When using the normal learning mechanism, the decoder uses the manufacturer code and the serial number to calculate the decryption key for each transmitter. Using the serial number of each encoder and the manufacturer code, the unique encryption key for each encoder is calculated. The encoder stores only the serial number and the calculated encryption key. The decoder needs to be programmed with this manufacturer code in order to be able to calculate individual encryption keys.

So my question is: how does this cipher work? More specifically:

How is a derived key calculated from the master key and serial number?
Serial number of what? Does the receiver need to be told the serial number of each key fob that it is paired with?
Any other details that make KeeLoq unique and interesting.

I am aware of wikipedia/KeyLoq, but it's a bit of a stub article.

how does this cipher work?

Assuming you are talking about the classic (broken) algorithm, KeeLoq is a 528-round block cipher utilizing a 32-bit non-linear feedback shift register (NLFSR) and 64-bit circular shift register (the key register, initialized with the key data). It has a 32-bit block size and takes a 64-bit key. Below is a diagram of a single KeeLoq encryption round, showing the NLFSR and key register:

  How is a derived key calculated from the master key and serial number?

The key is derived from the seed, a more-or-less random value usually including bits from the non-secret serial number and some padding, and the hardcoded master key. Depending on the version of the protocol, the key may be derived either by directly XORing the master key and the seed, or by decrypting the first and second half of the seed with the master key using the KeeLoq algorithm itself:

The seed, depending on the version, may contain 0, 32, 48, or 60 random bits. This seed is shared out-of-band with the remote when it is programmed during the "learning" process. If the manufacturer key is known, then decryption is as easy as brute forcing the seed which, as mentioned, contains anywhere from 0 to 60 bits. However, according to this paper, where much of the above information was found, all ICs analyzed by Eisenbarth et al. used a seed composed of only the serial number, with no random bits. As a result, the key used by those ICs is based only on the hardcoded manufacturer key with the unique per-device serial number, making theft of that key sufficient to decrypt communications.

Section 2.2 of another paper goes into more detail about the key derivation scheme.

  Serial number of what? Does the receiver need to be told the serial number of each key fob that it is paired with?

The serial number is that of the remote. It is encoded in plaintext with every transmitted packet. The receiver obtains the serial number each time a button on the remote is pressed. Below is a diagram of the 66-bit packet used by the protocol showing the 28-bit serial number being transmitted in plaintext:


Can I decrypt files encrypted by Odin ransomware? My system, excel, rar and zip files are encrypted by Odin ransomware and my ethics never allow me to pay ransom to thieves.

I tried recovery softwares but only recovered old deleted files - no solution to encrypted file.
Restore points are also deleted by ransomeware and I have no system image to recover system restore points.
I tried to create a decryption key but language in encryption is a mixture of Korean, Japnees & Chinees. So I failed to create a decryption key.
Another solution is to wait for any antivirus organization to find a solution and provide decryption to Odin but I am not sure when that solution will be in the market.

Is there any solution to decrypt or recover my files?

You won't be able to get your files back by any trivial means, sadly. You may be able to remove the ransomware itself, but you will not be able to retrieve your files without paying the ransom, for now, regardless of the language it was written in. The method used to encrypt these files makes them effectively useless unless you have the private keys, which they definitely won't give you, and you definitely won't guess. For anyone who is curious, Odin uses RSA-2048 bit and AES-128 bit ciphers.
Eventually, as you mentioned, there may be some sort of decryption tool for this strain of ransomware. Companies like Kaspersky and Sophos have already released tools for older varieties of ransomware. But until the time when a tool exists for this version of Odin specifically, you do not have many options.
Cold storage/offline backups are the best method for dealing with ransomware right now after the fact. Not to kick you while you're down, but avoiding malicious links, untrusted websites and downloads is the best way to avoid ransomware. Although I'm sure you've learned this lesson by now.
If you are on windows you could always try something like ShadowExplorer, you may have file backups you weren't aware of (hopefully).
The long and short of it is, your files are stuck in limbo until you pay for the decryption key, magically locate backups, or a method for decrypting this strain of ransomware becomes available, if it ever becomes available.


Is storing sensitive data in files instead of a database safe? Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of the file and open it via a web browser (http://example.com/php-app/hashed_passwords.txt).

However, I was wondering about the level of security this would provide using a few different methods:

Security through obscurity: giving the text file a nonsense name that would be hard to guess (hashed_password_wefhbweifvbewuivgbwueigfvu4gf.txt)
Giving the text file a certain file extension (hashed_password.secret), and instructing the web server to return a 403 when it is requested
Encrypting the text file with a key hard-coded into the PHP application
Storing the information in a commented-out part of a PHP file, so it can only be read from the back end (and will return a blank file in a web browser)

Compared to a database, are any of these methods more or less secure, and could they provide a reasonable level of security (about that of a database) against attackers?

The best measure to do this is to store such file on a directory outside the web root.

Basically, all of the solutions 'solve' the problem, in making the password file not available. Their differences stem on the kind of configuration error that needs to happen for it to break.

Surprisingly, such misconfigurations do happen from time to time, (e.g. when updating or reinstalling a system) and thee solutions simply vary on how robust they are to them. Also, sometimes these configurations are set in .htaccess files, but then a config changed at the server and they were not applied.

Breaks if the web server generated an Index list.
Fails if the piece configuring the web server not to serve .secret files was not added/applied, or if an editor left a backup file with an unprotected extension
Would fail if the PHP files were not being interpreted (mod_php not loaded?) or if the password was not changed from the default.
Would also fail if the PHP files were not being interpreted

Placing the file outside the web root (eg. /etc/php-app/hashed_passwords.txt) makes it harder that it gets downloaded by a malicious actor.

Obviously, nothing stops you from combining several of these methods (although at some point that would win you little).

Note: if using the .php route, you shall make sure that a malicious user cannot insert code into the generated files, leading to a code execution vulnerability. Generally this means you will die at the beginning (e.g. starting the file with <?php die(1);). You may also use __halt_compiler to ensure that no part of the rest of the file is interpreted by PHP.

The main difference I see on using files vs connecting to a database server (note you would face the same dilemma of how to name the file if you used SQlite) would be on its robustness for race conditions. Suppose that a user is performing a change password action at the same time that another one is signing up. A naive implementation using files would be vulnerable to a race condition where the recently created user would be lost when replacing the file with the new password hash, whereas a database would automatically care take of that (a naive implementation would be vulnerable to SQL injection, though).

Other differences would be at permissions, backups and scalability:

If the app connects to a database, the code itself could be read-only at the filesystem, whereas the files with information stored need write access there (and if you are using .php files, they need to be able to write into a file where code could be executed if written into, so a file-writing vulnerability would automatically become an execution vulnerability).
If there is already a system in place to backup the database server, that is easiest, rather than having to do a custom backup of a weirdly named file. On the other hand, using a file means that simply copying the directory results in a full backup, no need to dump the db separately.
If you may end up scaling horizontally, it is better to go with a normal database. Often simply making several nodes point to the same database make them all work  (you should share the sessions, too). If you used a file database, that means you would have to share that file (by nfs, perhaps?) and have it writable by the multiple nodes (with all the added complication of race conditions, just with more nodes and a less capable filesystem layer).

And obviously, running a database server imposes certain overhead. If there isn't already a need to be using one, and the server resources are constrained, it may be preferable to use files simply to be lighter.

As you see, mostly the reasons that would lead your decision of using a file vs a database server are not about security, since you could have an equivalently secure app in both cases.


Is there a software that would scan the ports automatically, then predict if there are any malicious activity going on, on my Win10 PC? I've got this malware(or spyware as Kaspersky detected), from the USB storage device by purely a lack of focus. After scanning and defecting all the drives that are connected to my computer with Kaspersky & Malwarebytes, I still feel unsatisfied that I might be still using a potentially dangerous computer.

I really don't bother about OS corruption, my only concern is that if there's someone somewhere leaking out information from my computer or from it's hardware anyhow.

Is there a way to scan all the ports for malicious activities?

Sadly, there is no such thing. The reason for that being because it's extremely difficult to tell with a reasonable degree of accuracy what is benign and what is malicious.

Telling what is good from what is bad is a very general problem that Anti-Virus vendors have been trying to solve for a very long time. I won't judge how successful they were at doing so.

The underlying problem is that exact matches for behavior are extremely rare. Exact matches are only possible for very primitive malware, and even then only malware that has already been encountered in the wild.

What if my scanner is too permissive?

Simply put, it won't detect all the malware. And since you are the defender, defending successfully 99 out of 100 tries just isn't good enough.

What if my scanner is too restrictive/paranoid?

Imagine an anti-virus scanner that would alert you for every file you open, because it contains a 4-byte long match for some malware signature. Your operating system would effectively become unusable. As a result, you would become "numb" to any and all warnings from your scanner, thinking it's going to be yet another false positive.

What about ports specifically?

Since you mentioned port scanning specifically, I want to go into more detail about that. A port scanner is basically an application which tries to connect to many ports and see which ones answer and which ones don't.

More sophisticated port-scanners attempt to communicate with the application behind the port to see what the application does. If the port scanner sends an HTTP request and receives an HTTP response, the application is likely an HTTP server of some sorts.

The reason why this would not work for malware scanning is that such scanners can easily be tricked. An application can just choose not to reply, and the scanner would have to report "Sorry, I don't know what that is". Since this is extremely common behavior, it is likely not suspicious. Reporting it as "potentially dangerous" would lead to a "What if my scanner is too paranoid?"-scenario.


Azure Ad B2C Users access resources in other directory I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains employees in our company. This second directory which I mentioned, also contains resources such as Key Vaults. These key vaults should be accessible for both employees (Directory 2) and for customers (Directory 1).
The idea was to add the users object_id into the access policy of the Key Vault, so that he could only access that specific Key Vault, and not modify any others. But since some of the users (The ones from Directory 1) are located somewhere else, this is not possible.
Does anyone have a beautiful solution for this problem?

Customers who need direct access to your key vault will need to be added as Guest users in your primary tenant (the one with key vault). B2C users cannot be granted access to resources in another tenant. Adding them as Guest users technically makes them "B2B" users. https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal
Your other option, depending on your architecture, is to have them access key vault through a lightweight proxy API and use the Graph API to access Key Vault SDK or Graph API to access key vault. This won't allow you to manage access directly in key vault though.
API Options
Authorize B2C users in Web API: https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-web-api-dotnet?tabs=app-reg-ga
Authorize B2C users in Functions App: https://codemilltech.com/adding-azure-ad-b2c-authentication-to-azure-functions/
Key Vault Access Options
C# Azure Key Vault SDK: https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-net
Graph API for Key Vault: https://docs.microsoft.com/en-us/rest/api/keyvault/
The last option of using Graph API also requires an app registration with key vault access in the primary tenant and you can get a token using the client credentials grant with Microsoft Graph as the scope as described in https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow)