How do I differentiate a DDoS attack from a DoS attack? My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (website, SSH, SMTP, etc...) except the port attacked.
The service that runs on that port is using 8-10% CPU and about 900 MB RAM  (which is normal, even lower) DoS definition?
My provider has detected it as a DDoS attack and sent my server to the mitigation infrastructure.
I have tried to block all incoming traffic from that port using iptables allowing just my IP address with no success, the service was still unavailable (I tried to kill the process -9 and starting it again with all connections blocked).
iptables -A INPUT -p tcp --dport xxxx -s myip/32 -j ACCEPT
iptables -A INPUT -p udp --dport xxxx -s myip/32 -j ACCEPT
iptables -A INPUT -p tcp --dport xxxx -j DROP
iptables -A INPUT -p udp --dport xxxx -j DROP

The weird thing is if I open the service on another port, everything is fine. The server responds as if it wasn't being attacked, the same happens with all other applications.
tcpdump detects tons of UDP packets like:
No: 6610
Time: 3.517741
Source: 84.35.69.7
Destination: My server
Protocol: UDP
Length: 46
Info: 18926 -> xxxx Len=4

I'd like to know how do I diagnose this kind of attack since I am still new to this networking world or if I am missing doing something.

The main difference between a DoS and DDoS is that a DDoS (distributed) requires multiple hosts to flood one or multiple target servers, in other words, the volume of a DDoS is quite heavier. In your case, if your server can provide other services other than the targeted port and is taking few physical resources, chances are you are currently victim of a DoS, which means one specific computer has scanned an open port and is trying to saturate it at the moment (it could be for example a brute-force attack trying multiple combinaisons of credentials onto a service in order to login or a SYN flood attack, there is a wide choice of possibilities). Also, if you were involved in a DDoS attack, it would be probable that the entire server would not be able to provide any kind of service at all.


In the Kerberos protocol, what prevents clients from decrypting a service's secret key? I'm studying the Kerberos protocol at a high level of abstraction. As I understand it- when a client wants to request a service, it first receives two messages from the TGS.

A: encrypted with the TGS/service long-term shared key. Will be re-sent unchanged to the service.
B: encrypted with the TGS/client session key. Contains the client/service session key.

The client is meant to be able to read B, but not A. However, both messages contain the client/service session key. Therefore, the client knows substantially everything contained in message A.

What prevents the client from reversing message A to recover the TGS/service long-term shared key?

Tl;Dr - nothing, you can crack it. It is called keberoasting.
The TGS shared secret can be cracked, but there are some issues trying to do that.
Since the common case is that that the shared secret is the machine account password, getting that password allows you access to that specific machine (via silver tickets) or in the case of a DC to every domain password (via DCsync) (service accounts are the uncommon case and are a prime target of kerberoasting)
The password is changed automatically every 30 days, it's encrypted with aes(normally) and is a binary (256 options) randomly generated password of up to 32 chars hashed with md4, with a specific salt when traveling as part of a kerberos tgs request. Meaning that a true brute force is needed and the end result isn't as rewarding as the other quicker and easier options.


Rate limiting API with PBKDF2 challenge? Assume I have a public API endpoint which I'd like to protect against abuse. I'd like to implement a solution that ensures that the client spends some computational time before allowing the request to succeed.

What would be the problem with having the server choose a random hash and a variable cost of say 200,000, wherein the server would send the hash and the cost to the client, and the client would be required to run the hash through PBKDF2 200,000 times, which should take some number of seconds. The client would then send the result back to the server with their request, and the server verifies that 200,000 iterations of the hash indeed matches the client result.

This would in theory seem to severely limit the number of requests a spammer can execute.

But the idea sounds too simple to be effective. Am I missing something, or would this be a viable solution?

There are two potential problems I can think of:

The spammer can force our own server to waste computational time on calculating these hashes, but we can precompute certain hashes with certain costs and dish out a random entry from our table to any requester.
Client devices may be less powerful than a potential abuser's machine, and thus we might require a cost of say 2,000,000 to be an effective deterrent, but that cost would be too high for an average client device.

Try to use a Proof of Work algorithm, like the one used on bitcoin: send the client some data, ask for it to send back data:padding where SHA1(data:padding) starts (or ends) with an arbitrary number of zeroes. Client will have to calculate the requested hash a lot of times, and you will have to check only once.


Apple bluetooth keyboard insecure connection? From time to time, I see this dialog box pop up on my MacBook Pro screen. It typically happens as the computer wakes up from sleep.

  Magic keyboard is trying to connect using an unsecured Bluetooth connection. Unsecured Bluetooth accessories can be used to control your computer or gain access to your data.

At this point, the bluetooth keyboard is still connected. Usually, I select "Don't Allow" in that dialog box, after which the bluetooth keyboard is no longer connected. Then I go to Settings and select the device and connect.

I am partially aware of some problems with bluetooth devices. Is this something I need to worry about, especially given that an Apple computer is complaining about an Apple keyboard. Could this particular keyboard be "special"?

Sounds like your keyboard is trying to establish an unencrypted connection.

This allows any attacker (with physical proximity) to sniff the connection with the keyboard and logging the keys, thus enabling him to steal passwords and login information.

An attacker could also hijack the connection and start controlling the computer as if he had the keyboard in his hands.

Such things can be achieved by using tools such as https://github.com/virtualabs/btlejack

You can fix this by pairing the keyboard with your mac.

Try forgetting the keyboard using the Bluetooth menu, then connect the keyboard using a physical USB cable, this should initiate a secure connection.


Is there any point to adding additional security inside SSL? If I were to add additional encryption inside my HTTPS stream, would I be making worthwhile improvements?

Problem:

The NSA stores a massive amount of data, perhaps most of it is encrypted and at some later date they may be able to decrypt it.

Possible solution:

Generate a private/public key pair on the server, use the public key client side to encrypt the sensitive data and send back to the server over HTTPS.

This means that you're encrypting it twice with public key cryptography, once with HTTPS and a second time via a library such as Stanford Javascript Crypto Library

In the case that the SSL certificate is compromised, the second layer of encryption protects your data.

Question:

I am not asking how to do this, I am asking is it worthwhile to do this? Another way of asking this question is:

"If SSL is compromised by the NSA now or in the future, and we know that the NSA is collecting all the internet traffic, is it wise to add another layer of encryption?"

A bit opinion-based, but I'd say No.

If the NSA can read TLS because an error in the protocol and/or implementation: While TLS has and had problems, it also has the whole world using it. Homebrew solutions are unlikely to be better.
(To start with, This means that you're encrypting it twice with public key cryptography is wrong. TLS doesn't encrypt the whole data with a public-key-scheme. That would be insane.)

If the NSA can read TLS because they have enough compuation power to crack everything in a reasonable time: One or two times doesn't make much difference anymore.

If the NSA is using malware, bribes etc. to get access to certificates and/or directly inject something to Apache etc., another layer of transport encryption won't help.

And so on...


Monitor with two simultaneous, seperate inputs: can an OS read from both inputs? For example, if you have two computers connected to one monitor, at the same time: can the visuals being sent from computer #1 to the monitor be received by computer #2 ? In any kind of simple way ?

I am aware there are more niche vulnerablities in monitor output, such as the ability for analog VGA signals in the air to be read by a dumbphone.
But for this question I mean more: is there something built into the monitor's firmware, which would allow it's current content to be sent backwards to a malicious OS ?

While there isn't a way to do this as you've asked the question, there is a simple way to do it.

If I'm correctly interpreting what you're after here, you have a display connected to computer A, receiving a signal from it. You want to connect up a cable from computer B to the same display and see what is shown on the display from computer A. No, this isn't the way displays generally work, at least not without some fairly heavy customization.

However...

This is actually a fairly common ask for people that work with video. What we need to do it split the video signal coming from computer A before it gets to the display so we can get a copy of it on computer B. Easy peasy.

In between computer A and the display, we put a video splitter. One side of the splitter feeds the display as usual, the other side goes to a video capture card in computer B and we capture any video that we care to.

Additionally, building a splitter into a display would not be an onerous task. We'd likely want an older display, so there was a little space in the housing to work with, but it could be done.

On the positive side

This would be very difficult to detect without physically eyeballing the hardware
Its a relatively simple setup that we can put together with off the shelf components and software
Gaining access to log on to the target system itself would not be required, as all the components on that side are hardware

On the negative side

Visually inspecting the hardware would turn this up almost immediately, unless we buried the hardware in the display housing -- even then there would be an extra cable leading to another (extra?) system nearby
Running video captures for any period of time would result in huge output files -- you couldn't reasonably leave it on all the time

More than likely, you would be better served with something like a keystroke logger, presuming you could get on the system in question.


Does netdiscover spoofs ip address? I am trying to discover hosts in my network. So I have connected external TPLINK wireless card to my virtual computer for internet and when I do ifconfig, it gives me IP address, 192.168.2.6

I used netdiscover and works perfectly. Out of curiosity I wanted to see on wireshark how the scan happens. What amazed me was requests are sent from completely another IP address which is not even in the network. My sender IP address in wireshark is 192.168.2.67. If you look at the first request to my router, thats the only request sent using my ip address, i.e 192.168.2.6

1) Why is that?

2) and, how this works?how the reply comes to me even if the sender ip is different than the original one?

netdiscover forges ARP packets, and one of the fields of an ARP packet is the source address. To ensure that the packet appears to be from a host on the current targeted subnet, netdiscover chooses an source address ending in 67 (not really sure why 67 was chosen). It's not actually changing the address of your adapter, it's just the content of the crafted packet.

The reason you are able to see the reply is because netdiscover is listening for responses, and your actual MAC address is what other devices will reply to. Here, the IP address is fairly irrelevant.


Java AES encryption output length I am trying to encrypt few database columns (string values) using Java AES algorithm. This is to protect certain sensitive data. For some users these data should decrypted.

In Java AES encryption, if my input character length is 60, I am getting encrypted string length as 88.

But I don't want a change the length of the encrypted data. We have huge amount to tables and many applications are using those tables. We want to minimize the impact of encrypting certain fields in the tables.

Is there is any recommended solution? OR is there is any recommended algorithm, code sample, etc?

Thanks, Prabakaran N

What is described in the question is Format Preserving Encryption. However, expect a steep learning curve, and a severe lack of ready made implementations.


Four eyes authentication for command execution on Linux. (OS level) I reached the end of the internet with no success, so now I turn to you guys.

What I'm after is a way to implement four eyes principle on the OS level for certain commands in Linux.

Example :
The admin group has 10 members.
The reboot command should not be allowed to be performed by any one admin alone, but should require a second admin to enter his/her credentials as well.

Work-flow :
Admin A runs "sudo reboot".
Terminal prompts for Admin A password.
Terminal prompts for Admin B username and password.
If both users are in the admin group, the command will run.

I have started to look into PAM, but couldn't find any immediate way to do this.

Does anyone know how to do this?

I don't know of a packaged solution to do this. I expect it would be quite tricky to do, as you need a two-step request/approve system, and there is nothing like that in standard Linux systems.

One possibility is to use an out-of-band two-man system. For example, the reboot command could require an additional password. One half of the admins know that password; there other half have the rights to run reboot. To actually do a reboot, two admins would have to work together. Even this is a bit tricky - and flawed if the second admin writes down the password.

I've never seen this done in practice though, and I'm not sure it's a sensible thing to try and do. In general it is almost impossible to lock down admins, as they need high level rights to do their job. What is more practical is locking down administrator access, e.g. an admin's account is normally disabled; it is only enabled (by a separate team) when the admin is dealing with an authorised change or incident.


How to protect myself against paid DDoS services? I am domestic user and I am getting attacked regularly by a guy that hates me.

Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP based on my Skype ID. He does that because I have dynamic IP, so whenever I go online and sign in to Skype, he discovers my new IP using the Skype resolver. Now I know I could avoid this by creating a new Skype ID (which I did) or by using a proxy service for Skype (which is not always convenient), but I wonder how I could prevent the attacks if he discovered my IP through other means.

What I know for sure is that he is using 2-3 paid DDoS services, so he's not conducting the attack from his PC. I have 100 Mbps download and upload capabilities, my CPU is a Core i7-920 (2.7 GHz quad-core) and I am using the Jetico Personal Firewall, and I am on Window 7 x64. When I am getting attacked, there is not much bandwidth use, but the CPU gets stressed up to 50-60% and I am not able to access any internet resources (browsing doesn't work, chat clients go offline, etc.) The firewall does its best to reject the attacks (as you can see in the screen shot bellow), it doesn't crash or hang, but it is not enough. My Internet connection is bridged, so he's not attacking a router, all the packets hit my system directly. Either way, I don't think a router could do better.

As you can see, all the packets are incoming 40 bytes TCP packets, sent through port 1234 and hitting port 80 on my system (I do not have any service listening on that port, and even if I were, I wouldn't let it be accessed from the outside). I think that the source IPs are spoofed addresses as they come from all over the world. During an attack I get millions of such packets and the only way to stop the attack is by disconnecting from the internet and reconnecting (with a different IP).

My question: is there any way I can protect myself against such an attack without having to disconnect from the Internet and suffer major CPU stressing?

Have a dedicated router or firewall to do the filtering.

The reason your CPU is being stressed is that the software firewall on your system is attempting to handle way more packets that your system can tolerate.

Having a hardware router or firewall drop packets before they hit your computer should do the trick. Of course, there IS a limit even to dedicated routers or firewalls. So it really comes down to how much resources the attacker is willing to use to DDoS you.

Besides that, there is really nothing else you can do to stop an attacker, besides coordinating with your ISP to block the incoming packets or reporting the matter to law enforcement.


How could a public DNS server return bad results? I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people).

In our country, YouTube, Twitter, Facebook and many other sites are blocked by default and we can only access them through VPN.

But there is one thing that should work: DNS. If I set my DNS to 8.8.8.8, theoretically it should return the right IP address for www.youtube.com and that IP address should get blocked by the ISP.

But it is not. It looks like our government is manipulating the DNS servers, even the public ones.

I have Ubuntu 18.04 (Bionic Beaver), and I have disabled Network Manager DNS. I have disabled resolvconf and systemd-resolve, by which I mean that no entity in my own system can change the file /etc/resolv.conf.

I changed the content of /etc/resolv.conf to:

nameserver 8.8.8.8

and only this name server. So now every application uses this server by default, and they should query this server for the IP address of websites, but unfortunately they are not doing so!

kasra@ubuntu:~$ nslookup google.com
Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
Name:   google.com
Address: 216.58.214.110
Name:   google.com
Address: 2a00:1450:4001:812::200e

kasra@ubuntu:~$ nslookup youtube.com
Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
Name:   youtube.com
Address: 10.10.34.35
Name:   youtube.com
Address: 10.10.34.35

kasra@ubuntu:~$ nslookup twitter.com
Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
Name:   twitter.com
Address: 10.10.34.35
Name:   twitter.com
Address: 10.10.34.35

kasra@ubuntu:~$ █

10.10.34.35 is the intranet IP address for the filtering authority.

How is the ISP achieving this? Are they really stealing and MITM-ing the traffic of 8.8.8.8? Is it some kind of BGP hijack?

How can I get around this without a VPN?

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8?

They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and answer the query themselves. This is not that hard to do.

  How can I get around this without VPN?

A properly configured VPN (i.e. no DNS leaks) can get around this (unless they block VPN too). Also using a HTTP proxy or SOCKS proxy can help (make sure to configure external name resolution for the last one) for HTTP and HTTPS traffic. And DNS privacy techniques like dnscurve, dnscrypt, DNS over TLS and DNS over HTTPS (supported already by Firefox) will help too.


How to use Java method override to attack? I have seen various resources that warn the potential harm of method override in Java (see reference below).

https://www.securecoding.cert.org/confluence/display/java/OBJ57-J.+Do+not+rely+on+methods+that+can+be+overridden+by+untrusted+code

http://faculty.salisbury.edu/~xswang/Research/papers/serelated/ieeesoftware/mso2008010013.pdf

I am not able to see the thread model of this kind of attack, i.e., what kind of capability does the attacker need to have?

Example 1: If I wrote a java app and compile it into a jar file, then is this jar file vulnerable to this kind of attack?

UPDATE:
Given the first example is potentially broad and people are coming up reverse engineering attackers. I will put a more constraint example in the question.

Eample 2: When I run some java application on my machine and the attacker only has access to my java API interfaces, can he launch this attack?

When you create a .jar file, deploy it on a system and run it, it's per-se not more or less vulnerable than any other application developed with any other technology.

The attacks described in these articles are relevant when the attacker can already inject Java code into your application. For example, when your application loads classes at runtime with a ClassLoader from a source which isn't under your (or your user's) control. The articles just reiterate what every application developer should already know: Do not load and execute untrusted code. When you don't do anything like that, there is nothing you need to worry about.

The articles mostly debunk the misconception that it could be possible to build a sandboxed plugin execution environment by relying on JAVA visibility features. Let's say you want to build a Java application where users can download extensions from the web. This works by downloading the .class file and load it at runtime with ClassLoader. But you want to limit what these extension can and can't do. Could you just declare any data you don't want these extension to access as private? No, that doesn't work, because there are tricks to subvert these access modifiers.


Checking for hardware vulnerabilities (like Intel Management Engine) semi-automated? Is there a nice semi-automated way that I would just paste output of my /proc, lspci, or any other hardware description and get suggestions to what kind of vulnerabilities a given computer may be subject to (and hints how to fix them)?

CHIPSEC is arguably the most comprehensive tool for analyzing firmware security to date.

The first answer provided resources for detecting whether or not INTEL-SA-00086 affects you. There is another, the CHIPSEC framework, which scans your BIOS/UEFI for various security issues and reports it to you. It is frequently updated in response to new information. From their Github page:

  CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities. It can be run on Windows, Linux, Mac OS X and UEFI shell.

It is capable of providing information on various capabilities of your firmware, and whether or not it is configured to resist modification from software. There are many ways to overwrite firmware with privileged access, and your firmware has to lock itself down properly. Even missing one detail can result in firmware which can be modified at runtime. It can also provide details on specific vulnerabilities, and on more mild issues such as whether or not your keyboard buffer contains keystrokes entered while in the BIOS, which could disclose your BIOS password.

Note that CHIPSEC output can appear rather arcane at times. It is designed to be used as a framework by researchers and firmware vendors, so it does not go into detail about the implications of various issues it has found. The manual gives more details about the purpose of each module, and this page provides information on some of the more common modules and vulnerabilities. You can also expand its functionality by writing custom modules. It is a framework, after all.

Example output from the common.bios_wp module:

[+] imported chipsec.modules.common.bios_wp
[x][ =======================================================================
[x][ Module: BIOS Region Write Protection
[x][ =======================================================================
BIOS Control (BDF 0:31:0 + 0xDC) = 0x2A
[05]    SMM_BWP = 1 (SMM BIOS Write Protection)
[04]    TSS     = 0 (Top Swap Status)
[01]    BLE     = 1 (BIOS Lock Enable)
[00]    BIOSWE  = 0 (BIOS Write Enable)
[+] BIOS region write protection is enabled (writes restricted to SMM)
[*] BIOS Region: Base = 0x00500000, Limit = 0x00FFFFFF
SPI Protected Ranges
------------------------------------------------------------
PRx (offset) | Value    | Base     | Limit    | WP? | RP?
------------------------------------------------------------
PR0 (74)     | 00000000 | 00000000 | 00000000 | 0   | 0
PR1 (78)     | 8FFF0F40 | 00F40000 | 00FFF000 | 1   | 0
PR2 (7C)     | 8EDF0EB1 | 00EB1000 | 00EDF000 | 1   | 0
PR3 (80)     | 8EB00EB0 | 00EB0000 | 00EB0000 | 1   | 0
PR4 (84)     | 8EAF0C00 | 00C00000 | 00EAF000 | 1   | 0
[!] SPI protected ranges write-protect parts of BIOS region (other parts of BIOS can be modified)
[+] PASSED: BIOS is write protected


Is there any legitimate reason to install yourself as a root CA? Follow up from comments on another question.

Is there any reason as to why you might install yourself as a root CA on your own network? The only reason I can think of is forcing computers in the network to trust your own self signed certificates instead of getting them digitally signed by a 3rd party CA.

A custom CA is required if you want to use https on your corporate intranet. 3rd party CAs can only give you certificates for public domains. They won't give you certificates for intranet.local or any other hostnames which are only routed in your own network. So when you want to have a certificate for your intranet or for the web interface of your own servers, you need to add a custom CA and sign it yourself.

You might ask yourself "Why would I use https on my own network"? There is currently a trend to implement everything as a browser-based application. This means more and more processes are handled through internal web interfaces, including sensitive ones. For example, our company is currently implementing a web-based intranet application to view our own payslips (and hopefully only our own). But in larger organizations, the internal network can become so large and complex that you can't really speak of a private LAN anymore. Eavesdropping from internal attackers becomes a possibility which can not be handwaved away, so internal encryption becomes a reasonable precaution.


Specific Dangers in Joining a Linux Botnet? Between the PHP-as-cgi-bin problem, and shellshock, I've seen 4 or 5 different Perl scripts that, when run, purport to make your machine part of some scary, heinous botnet.

What, specifically, would be the problem if you went through the Perl script, defanged it so that any eval or shell out or TCP or UDP or HTTP flooding or Google "dork" searching is removed, and then ran the script. Generally, the code is not confusing or complex, so I'm confident in my ability to defang.

Will the IDF Unit 8200 or PLA Unit 61398 or the FBI come and kick down my door? If my entry in the botnet doesn't send spam, or DDOS someone or whatever (because I neutered it), am I running afoul of anything?

been there, did that, faced a massive DDOS against my company afterwards. i'd suggest: take the script, setup an aws-instance and run it there.

never ever run that script on a server that could be linked back to any production-system or your company. try to stay anonymous, because you dont know whom you deal with.


Patent free symmetric-only key exchange protocols? I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the server.

What patent free protocols exist for securely distributing an authenticated session key using the existing symmetric key? (with no trusted third party)

Janson-Tsudik 2PKDP looks ideal, but appears to be patented.

Key exchange protocols break up into two major categories.   Server-Based key Establishment and server-less key establishment (I think I'm going to buy that book.). Within these two categories you'll find protocols that use symmetric or asymmetric ciphers or both.   There are lage number of Key exchange protocols documented on Security Protocol Open Repository(SPORE),  which is a very cool resource.

A good choice for server-based key Establishment is the Needham-Schroeder Symmetric Protocol which can be performed entirely with AES and is used in Kerberos.

For server-less key establishment you should look at Lowe modified BAN concrete Andrew Secure RPC.  It is old,  however I do not believe this protocol has been compromised.

You should use SSL/TLS whenever possible,  but it will require more than 1kb of memory.


Does Windows Embedded OS supports Microsoft Bitlocker? Does Windows Embedded OS supports Microsoft Bitlocker? If yes what are the list of versions and does the windows embedded OS comes with bitlocker?

Bitlocker is a Windows Embedded Standard 7 feature included is a feature pack.  For details see http://msdn.microsoft.com/en-us/library/ff794262%28v=winembedded.60%29.aspx


What to do after rejecting an invalid CSRF token? I'm implementing CSRF protection (using Symfony's CSRF library), and I'm wondering what response to send to clients upon receiving an invalid token.

Currently we have a session that lasts 30 days, and we'd like the CSRF token to expire after 12 hours (I'm keeping track of the expire time in the backend, not a cookie). So there is a possibility that a user may leave a page open all day and try to submit a form.

I've seen this happen with JIRA when I return to my computer a day after leaving a page open, as their session is long lasting as well, but the CSRF token only lasts a day or so. My plan right now is similar to that flow — to send a 403 error, and then a new token will be sent on the next GET request (assuming their session is still valid).

Also, what is the recommendation for data the user filled out in HTML forms? Should I keep track of it and repopulate the form with data they already entered when they finally get back to that page?

I take it that this is for the "synchronizer token" pattern, and not "double submit cookie", since tokens don't really expire in the latter case.

You can mitigate the problem by making your CSRF-tokens more long lived. Only have one token per session (as opposed to per form), and make it as long lived as the session. So if the CSRF-token has expired, so has the session. And then the request should be rejected anyway.

That said, if for some reason you get a request with a valid session but an invalid CSRF-token, what should you do? As you say, status 403 is a good choise. For an API, you could respond with some kind of error object or message explaining to the client what went wrong. Or just an empty body, if that is how you deal with errors.

For classical form submissions, it's a bit trickier. If you want to play really nice, you should respond with the form in the same state as the user tried to submit it, plus an error message. This is a bit of a hazzle to implement, but perhaps you have a similar system in place already for other errors.

Note that you can return the new token (as a cookie, or form field, or whatever) already in the reply to the first request with the expired token. No need to make the client make another request just to get it.


Is browser history an important factor when considering security? I discovered something I consider a major vulnerability in a SaaS product that includes the username and password in the query string of the URL on registration and every login attempt.

The technical support of the service has told me they consider the vulnerability insignificant, as the only way to exploit it is to gain access to the user's browser history.

Were they correct in their decision? I'm fairly new to information security, but it still sounds like laziness on their part.

I did skim through this question, but having read the most upvoted answer I'm now even more concerned about this being overlooked, as the data is sent via GET and the credentials are displayed in plain text.

Yes, this is a vulnerability. You can point them to such august bodies as

OWASP Top 10

https://www.owasp.org/index.php/Information_exposure_through_query_strings_in_url
https://www.owasp.org/index.php/Top_10_2013-A2-Broken_Authentication_and_Session_Management

CWE

Information Exposure Through Query Strings in GET Request https://cwe.mitre.org/data/definitions/598.html
Insufficiently Protected Credentials https://cwe.mitre.org/data/definitions/522.html

StackExchange

https://stackoverflow.com/questions/26671599/are-security-concerns-sending-a-password-using-a-get-request-over-https-valid

The common problem is that the credentials are stored on the client-side in the clear (browser history) and on the server side (webserver connection logs) and there are multiple methods to access that data.

Yes, it is laziness on their part. They are thinking of their code alone, and forgetting the client-side and the infrastructure.


Why aren't we scared of our signing key being stolen with JWTs? With the traditional session system where only the session ID is stored on the client possibly even encrypted, the user won't be able to assume the identity of another user or escalate their privileges without accessing the database or the session store directly.

But with JWTs, it seems once the attacker gets a hold of the private signing key they can do huge amounts of damage. If we store user IDs in the JWT, couldn't they simply sign themselves a token for an arbitrary user and act on their behalf? Contrasting this to say an SSL certificate being stolen, which would allow MITM attacks this seems almost an order of magnitude worse. They would not even have to sniff any traffic or modify requests, they could just pick whichever user they want, and completely undetected access the system.

I do realize that private keys are meant to be private, and if I lose my SSH key and the attacker takes over my SSH key they can do whatever they want. But IIRC there have been many cases of SSL certificates being leaked (or stuff like Heartbleed), but that at least doesn't directly allow the user to assume arbitrary identity. With JWT it seems like we're putting everything into one basket and nothing happens to it.

Is this a real security concern? Are there ways of mitigating the issue, other than not using JWTs altogether? Or am I missing something?

I really like the idea of passing around a token with claims between services, but at the same time it feels a little like encrypting all your company's private data, posting it publically on reddit and thinking I hope they won't break the encryption.

You ask actually multiple question within a single post:

Risks connected with unauthorized access to private key
You are mixing different processes: message/authorization signing (in JWT) and securing communication channel (SSL)
Trust to encryption strength

To signing and private keys: Of course there are risks. There is whole industry around this, with standards, practices etc. It is impossible to name everything related to it. How to mitigate risks? Again, too broad question. Just some random hints: limit physical access of persons to hardware, "need-to-know" principle, access control and regular reviews, identity management, audits, layered security, short living certificates for JWT signing keys , e.g. 1 month, and their CA chain long living.

To encryption strength (quote: I hope they won't break the encryption): Of course, except one time pad there is no perfect encryption. I'd suggest you to ask about reliability at another site, Cryptography SE, not here. The guys will explain you why one can rely on AES, RSA, ECC and what are conditions for this (particular modes of operation, role of randomness), what are the risks.


Re-run nmap OS fingerprint match with existing subject fingerprint I have a collection of nmap subject fingerprints (described here), but have updated my local (private) reference fingerprint database since they were collected. Is there any existing way to re-match these subject fingerprints against the updated database without requiring a complete new scan? I've searched the nmap source code and haven't found anything yet.

There is not a public tool to do this, but you can cobble one together pretty easily with a few functions from osscan.cc:

Load the fingerprints from nmap-os-db with parse_fingerprint_file.
Parse the observed fingerprint you want to test with parse_single_fingerprint.
Check for a match with match_fingerprint.
Print the results.


Understanding brute-forcing algorithms I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to.

The way I understand it, a 'simple' brute-forcing attack for a password with 4 numbers would start with 0000, then 0001, 0002, etc. etc.

In theory, then, can you assume that if 0000 takes 1 second (just to keep things simple), and 0001 takes 2 seconds; then 9999 would take 9999 seconds?

Based on this, it would seem that --for example-- if you set your PIN code to 9999, it would take 9 times longer to crack than 1111?

Of course, this is an over-simplified example, but if we were talking alphanumeric passwords with symbols, wouldn't the safest password theoretically be a combination of the highest numbers, highest letters, and highest ASCII values for symbols?

I hope the question is comprehensible and someone can shed some light on this issue for me.

Any practical brute-force algorithm will take into account the method a password was generated with.

If a password was randomly generated. You should assume brute-force algorithm also to be truly random. You don't know what it is, you can't claim one password is faster to find than the other, you can only tell that on average passwords would be discovered by checking half of the available pool.
In case of a password known to be generated using a random number generator with a vulnerability (some numbers more likely, some impossible), an attacker will modify the brute-force algorithm accordingly.
If it is known that passwords are human-selected (a type of weakness in the generating algorithm), an attacker will use methods applicable for such weakness including: common words, substitutions, repetitions, inclinations, order reversal, known methods, tips, tricks, padding, etc.

It's a human mind vs human mind contest. Sequential checking is statistically least effective and drawing conclusions about a given password strength based on the assumption that an opponent will use the least effective method is a fallacy.

To attack a vulnerability of human-generated password, one might use sociology (some passwords methods seem cooler than the other in respective population). Another attacker might use statistics (take millions of leaked password, analyse, apply). Yet another might consider mechanics (keys and key combinations easier to type on a certain device would be tested first).

In an example of a 4-digit number, I would start guessing with 1999, go down to 1900 before testing 2000 - 2016. Definitely I would check 9978 long before 6853 (really inconvenient to type on a PC keyboard) and 5683 (well known "love") long before the two. Someone informed might use more effective method (yes this is an exampleーthe one used in the questionーplease use it to draw a general conclusion, not to dispute the example).


Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms? I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice addition, I would like to sign it (and, ideally, some additional data) with my public key

Parties do not communicate in any way prior to transferring the blob (except for them sharing their public keys), so various schemes involving DH or something similar do not fit in this scenario.

Obviously, I don't want to invent my own container for that.

What container do I use so that it allows me to use encryption / signing with industry-standard algorithms which don't have known flaws?

The obvious way would be to go with CMS/PKCS#7. Even the ideal scenario could be achieved by doing Encrypt-then-Sign with some manual arrays concatenating, like:

encryptedMessage = createEnvelopedCms(cleartextBlob, recipientPublicKey)
signedMessage = createSignedCms(authenticationData.Length + authenticationData + encryptedMessage

However, CMS has two significant drawbacks:

1) It seems that it only can be used with RSA/DSA/ECDSA keys, and of these three, only RSA can be used for encryption. However, RSA is not futureproof (as it is not quantum-safe).

2) It seems that CMS only supports AES in CBC mode, which also has its flaws.

Then there is GPG container, but I cannot find information on what specific algorithms it uses, and it does not seem to be configurable to the same extent as CMS.

If I was inventing my own container (which I'm not), I'd probably do something along these lines: generate random AES key + IV; encrypt blob using these in AES-GCM mode (adding the required authentication info); encrypt AES key and IV using recipient's ECC public key; concat encrypted keys + authentication info + encrypted blob and pack these in a CMS message signed by sender's ECDSA key. Is there any industry-standard container which would allow me to do all this?

RFC 5084 solves the issue of using AES in GCM mode within a CMS message. And the CMC specified by RFC 5652 does not restrict you from using any public key algorithm.


Why did a subdomain from a trusted website download a file? I clicked on a link for the subdomain of a trusted website (the subdomain slackin.brilliant.org of the website brilliant.org), and instead of being directed to another page, a file called "download" simply downloaded onto my computer. I deleted the file right away, so I don't know its contents, but I  was worried that maybe the file had malicious contents (could Brilliant.org maybe own a domain and not have control of this subdomain, therefore allowing perpetrators of malware to capitalize on this?).

Nothing malicious is going on. The file is empty.

This happens when there is a misconfiguration of the webserver and instead of serving a page to display, it transfers the target as a file. In this case, there was nothing to transfer.

This sort of thing was a lot more common in the early days of the web, but I'm shocked to see it these days.


OSCP (Offensive Security's PWK) Requirements I wanted to ask a few questions, mainly referred to those who completed OSCP or who know about it.

I want to take the course, I know that understanding of TCP/IP, IP subnetting and addressing and routing is needed, and also bash skills, and knowing python is a plus.

I wanted to study python from learnpythonthehardway.org (referred by Offsec), but I have a question about the networking part: is implementation of sockets in python needed, for instance?
Or only understanding of how TCP/IP, subnetting, routing, addressing work and operate is enough?

Also is Ruby needed (I know it's used for creating metasploit modules, is it needed?)

And lastly, is knowledge about Nmap needed? or is it taught throughout the course?

Absolute statements regarding OSCP

You DO NOT require coder kind of skills. (Therefore, one is wasting his time learning hardcore programming for OSCP. Although It's always a plus if you have some coding skills in your arsenal.)
Basic scripting is needed. (It is also limited to python and shell scripting.)
A complete Networking Nerd. (You should be able to eat and digest the entire TCP/IP)
Love Linux (My choice would be to enslavement! but a decent knowledge of Linux usage is enough)
Exposure to Exploits/pentesting methodology(In my view this part is more important because this one tells you "How to go about your business")


Putting my PGP ID/link on printed business cards I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well.

After doing some research I found that using the short ID is not a good idea.

What is the best way of doing this - or should I forget about it?

Considering that your public key is only usable by a computer1; you can remove clutter from your business card by having all electronic data accessible online and referred to by a QR code.

The link could refer to a vCard file stored on, say, a public Dropbox. As the vCard format can store any business or contact information including OpenPGP keys.

Alternately a high resolution QR code could store the entire public key on the back of your business card. Which has certain security advantages.

1. Hand ciphers notwithstanding.


Why intruder number of threads has an effect on the time delay of indiviual requests I was solving SQL injection lab on Portswigger, and the lab was asking to exploit blind SQL injection by triggering time delays, using that to retrieve administrator password.
I was making 720 requests by Burp intruder, to test (a-z, 0-9) payload on each position of password whose length was 20. If my condition is true, ex. substring(password, 15, 1) = 'g') , then make a 2000 ms delay by executing pg_sleep(2).
The solution of the lab mention that you will need to make these requests using only one thread instead of 5 (the default). That's my question, why number of threads matters here, I think it will matter if we are calculating the whole delay of all requests, but it will not matter on the delay of the 5th request for example.
If the request take 100 ms, and the number of threads was 5 or 1, the delay of this request alone will not change.
The point is, I made it with 5 threads to see how it will work, but I found that the requests that have a subtring(password, 20, 1) = 'q' and substring(password, 20, 1) = 'c', both have a delay exceeds 2000 ms, although it was supposed to have only one of them is exceeding 2000ms, as only one of them is true and pass the condition and execute pg_sleep(2).
Can someone explain to me why number of threads matters here?
Edit:
I'm talking about synchronously processing of the requests, not asynchronously.

when doing blind timed SQL injection, timing is everything!
if you do this multi-threaded, you need to take care that thread switching does not interfere with your timing attack (both on your client as on the server).
since you have no control over how the server is implemented or how it handles treading, the default advise for any blind SQL injection based on time is to have only 1 tread of it running.
E.A. using multi-threads makes it easy to shoot yourself in the foot with false positives / negatives.


Can a zipped malware execute? I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute itself in Windows?

Unless you have some program that is able to run compressed programs from archive, no it can't.

You inability to suppress the file is more likely due to the fact that the file itself is being used or access restricted by some program (e.g. antivirus quarantine).


Are wedge attacks on EMV cards still viable? I was looking around to see if wedge attacks on EMV cards are still viable or a solution has been implemented, and if so, have attackers found another way around the solution?
The latest literature or post I can find goes back to 2010-2012.

Wedge attack was applicable on DDA cards (Dynamic Data Authentication) which were being superseded by CDA cards (Combined Data Authentication) at the time when vulnerability was disclosed.
The researchers behind the vulnerability proposed a solution to fix DDA cards in his write-up: Defending against wedge attacks in Chip & PIN but there's no track record of which banks globally enforced this solution or even cared to address it.
CDA partially resolved the problem with DDA but it was itself open up to a vulnerability called No PIN attack. The wedge was used even in this attack but the method of exploitation was different than that of DDA as explained in their research paper, Chip and PIN is broken.
Their proposed solution as mentioned in the paper fixes CDA and only Barclays Bank UK PLC is known to fix No PIN attack (52:20).

One possible work-around is for the terminal to parse the IAD, which does include the result of PIN verification. The card can change its CDOL to request that the CVMR be included in the payload to the Generate AC command.

Unless the CVMR is included in the CDOL it may not be integrity protected, so a second man-in-the-middle between terminal and acquirer (perhaps installed with co-operation of a corrupt merchant staff member) could tamper with it too.

EMV Book 4, 12.1.1 - Authorization Request  - Table 9 contains the new data elements specifically created for an ICC transaction. It is added in the book in November 2011, a year after the vulnerability is disclosed. Now the terminal can also send CVMR (Cardholder Verification Method Results, specifies which cardholder verification method the terminal believes was used) optionally with the transaction approval request but unlike IAD (Issuer Application Data), it it is not integrity protected. The issuer then validates CVMR against IAD to ensure both the card and terminal have the same perspective on how the transaction is happened.
A year after the vulnerability is disclosed publicly, a criminal ring was caught performing this attack which the Cambridge researchers believe that the French criminals worked out the attack independently.

The ENS and CEA forensic researchers note that the vulnerabilities used by the French fraud they analyzed have since been fixed—at least in Europe—though they declined to fully detail the new security measures.
The French researchers who investigated the case write in their paper that EMVCo has since created new countermeasures to the vulnerabilities the fraudsters exploited and implemented them both in card readers and in banking networks. They also note that other protections have been added to the system at the network level, which they decline to detail for fear of tipping off criminals.

I doubt all the banks globally have implemented this solution as another decade old vulnerability is again discovered to be lurking around in some banks: Researchers create magstripe versions from EMV and contactless cards: Banking industry loophole reported more than a decade ago still remains open and ripe for exploitation today.
The only reason they are not seeing frauds is because most of them enforce online PIN verification. But as the specification was updated in 2011 and most banks outsource the production of EMV cards, they might be coming with a fix particularly the new ones in countries where EMV is recently mandated.


Is web site in-scope for PCI even though it redirects to a 3rd-party for card transaction? Even though the web site never sees the cardholder data or sensitive authentication data in the clear, and never has access to the encryption keys, I would think the web site is in-scope because it could affect the security of the data.  If the web site is hacked and changes the redirect to go to a hacker site, data can then be stolen.

In the case I am working now, the web site is owned by a service provider that a merchant is working with.  The service provider is not the 3rd party that deals with the card data.  If I am correct it leads to a slightly weird situation where there is no CDE (cardholder data environment) at the service provider and they only have this one web server that is in-scope.  Although there is a question of whether other servers on the same network "segment" as the web server should get pulled in-scope too, but that is a different issue.

Yes. You are still in scope, although a lower level of compliance may apply to you. Read the following:

Q2: To whom does the PCI DSS apply?
A: The PCI DSS applies to ANY organization, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data.
Source: To Whom does PCI DSS apply?

You may qualify for one of the less restrictive levels of PCI-DSS.  To find out, check this link: Which SAQ is appropriate for me?
Here is a good reference to get you started on your own compliance: ComplianceGuide.org.


What sites are still vulnerable to FireSheep? Am doing a Firesheep Demo in a few weeks as a security awareness project. However I can't seem to get it working, and I'm wondering if it's just because the handlers it ships with are now outdated because everyone has fixed their sites.

I am going to continue to troubleshoot from the promiscuous drivers etc. side of things, but was wondering if:

Anyone could tell me which sites are still vulnerable to Firesheep?
Could someone share the handler scripts that work against those sites? (I'll of
course try writing them myself, once I can tell that it's working as
expected).

Edit: Thanks for the comments. I do understand what makes a site vulnerable, but it would still be great to have some examples from those who have a currently working install of Firesheep, just for some certainty. And a sample of a known working handler script would be fantastic!

Bottom line, anything that does not use HTTPS for all connections is vulnerable to Firesheep.

I can imagine that a lot of the original handler scripts no longer work because a large number of sites have fixed their sites to use HTTPS.  Or if they were really lazy they just modified things slightly to obscure things.

I tried out Firesheep when it was released and I couldn't listen to public traffic with my laptop's built-in wifi card.  If that is the problem you are having it is probably because it doesn't support monitoring mode. A 10-20$ usb wifi dongle will solve that problem.
 I have an ASUS USB-N13 that supports monitoring mode. I believe it goes for 20$ or so now.

As Rook mentions, the whole Stack Exchange network of sites is vulnerable.  In fact, last time I checked the creators of Stack Exchange don't even think it is important.  Or at the very least it was not important enough for the difficulty involved.

Firesheep is intended to show the well known insecurity of not using HTTPS.  It did it's job well as many website started using HTTPS right after its release.

There is another use for Firesheep that is a little less known.  It can also be used over encrypted WPA2-AES networks to show the "Hole196" vulnerability in WPA2.  I don't believe the original version of Firesheep includes this functionality but modified versions exist that do.  The creator of Firesheep thought that including the WPA2 feature was too dangerous, and I agree. (citation needed)


Granularity for data assets when determining risk during software development We're currently constructing a security development lifecycle in our software development corporation. Our main idea is to have an asset-driven approach, where we:

Enter assets into an asset inventory as the system is constructed;
Determine security goals for each asset (and implicitly the criticallity of the asset);
Follow the critical assets throughout their lifecycle and apply appropriate mitigations where we deem necessary.

While assets such as hardware and the general infrastructure are mostly secured following system hardening and other checklist-based activities (as well as physical security), we are particularly concerned with electronic data assets, used and manipulated by the software.

As the system is quite large and there is a lot of data going around we found that maintaining the asset inventory can be a strenuous activity. Namely, there are a lot of data assets which require high integrity as this is a critical infrastructure system, so we can't afford to overlook these data assets.

In our approach each asset has an owner, a person who is responsible for introducing the asset to the inventory, and this is most often an architect who understands the broader picture of the component. However, our developers are free to add new minor data assets in the form of data structures for holding calculation or partial calculation results. The question then becomes - should these be added to the inventory?

Essentially, this is a question of the granularity of data assets in our inventory. If we go too much into detail we create documentation which is not maintainable, but if we group specific assets into categories of assets we risk missing out on specific assets which might turn out insufficiently protected.

What would be an optimal level of granularity? How would you reason about this?

Additional information regarding our previous software-centric approach

The MS threat modeling method (described in Threat modeling: Designing for security) was something we initially implemented. We developed training materials and used the MS Threat Modeling Tool in the process, which was taught to our software architects. Unfortunately, the project wasn't a success due to several factors, most notably proper funding.

We found several issues with this approach, which we couldn't properly address (due to our lack of experience). This includes:

Security assurance - it was hard to convince the client that particular data assets were protected without tracking the assets;
Risk analysis - without examining the assets that a software component was manipulating (and how a threat might endanger a security goal of that asset), we weren't able to reliably determine the risk level.
Threat modeling priority - without assets we weren't able to determine which components were "more critical", meaning which components required deeper threat analysis and the help of the very limited resources of the security team.

Once again, all of these issues might have been caused by our inexperience with the method, and not by any fault of the method itself.

The way I'd reason about this is to go back to the initial decision, which was to focus on assets.  Asset-driven approaches to threat modeling tend to end up with a problem like yours, which is "Make a list of everything."  That long list makes it hard to focus.  (The other problem they encounter is "what's an asset?")

Most engineering groups find it easier to make changes in the areas that they're making changes to the system, and so focusing on the software/system that's in scope for the current sprint/iteration helps you find threats that become actionable.

If, rather than focusing on the asset, you focus on the software, and ask "does this expose us to new threats" then your question is easier to answer.  For minor modules, that question can be focused on "does this add an API, change an API arguments, or change the data this module is processing?"

If so, you can use a mnemonic like STRIDE to look for spoofing, tampering, repudiation, info disclosure, denial of service or elevation of privilege to examine the changed elements.

Additional Answers
(SE lost my previous attempt at this; this is shorter)

First, if your client is demanding that you provide a threat model focused on assets, then that's your answer to what matters.  You absolutely run the risk you identify, "we risk missing out on specific assets which might turn out insufficiently protected," but if you have no budget, you face that risk anyway. SE cannot tell you what asset categorization rules will make your customer happy.  (bold text added here to fix an edit failure)

Second, it sounds like you're trying to do something like risk=probability*impact.  Neither input is defensible. You need to fix the easy stuff, and then focus on having a dialog about the potentially difficult fixes.

Lastly, your third question puts the cart before the horse.  You threat model to determine what's important,  not determine what's important, then threat model that.  If you're focused on assets, what assets does your active directory hold?  What does your firewall hold?  I bet both are important to keeping your system secure, not because of the assets they store.

Lastly, if your issue is budget, the changes you're making, as you document, are not fixing that problem. You need to find a way to get some quick wins, and use those to justify appropriate budget.


Prevent external script from loading using Burp I am using free edition of Burp Suite to analyze some requests. Suppose, website is https://www.example.com.

Now, there is a javascript file in https://www.example.com/templates/scripts/xyz.js. I want to prevent this file from loading while intercepting the requests.

Is there any way in Burp, so that I can drop this resource file?

You need to add a "match and replace" rule. Under Proxy > Options > Match and Replace, click the Add button, and fill in the necessary fields so that if the request body contains that URL, Burp will remove it from the request.

You could also remove all JavaScript resources by ticking the Remove all JavaScript field under Response Modification.


How to bypass PHP username and password check in this CTF challenge? I'm preparing for this CTF challenge I'll be participating in next week, and I ran across this problem online which I can't manage to solve.

I only have control of the variables $user and $pass that the challenge function gets which I can send as a part of the POST request. I need to make the challenge function return true.

I tried sending an empty array as the password (by changing the password fields name to pass[]) but the regex function won't let me through.

<?php
//by Mawekl
//more challenges coming soon ;)

function validateuser($user)
{
    #Check username
    if(!preg_match('/^[A-Z][a-z]{1,15}$/',$user))
        die('Are you stupid hacker? Don\'t try inject my script!');
}

function validatepass($pass)
{
    #Check password (injection attempt?)
    if(!preg_match('/^[A-Za-z0-9_ ]+$/',$pass))
        header('Location: http://piv.pivpiv.dk/');
        #kick away stupid hacker!
}

function challenge($user, $pass) //Objective: return TRUE
{
    $users = array(
        "Admin" => $_VeryLongPasswords[0],
        "Mawekl" => $_VeryLongPasswords[1]
    );
    validateuser($user);
    validatepass($pass);
    return ($users[$user] == $pass);
}

?>

Since the script does not check that the user exists using some non-existing username with an empty password succeeds in my test:

 echo challenge('Foobar','') ? "MATCH\n":"nomatch\n";

 PHP Notice:  Undefined index: Foobar in ...
 MATCH


How does malware hooks ASEPs? What are the operations made by malware to hook the auto start extensibility points in order to be able to run at the startup of the computer that runs Windows operation system ?

There are lots of ways for malware to hook into Windows auto start.  There are simple cases where the registry is modified to load modules on start.  Here is the a list of auto start locations in the registry. And a bit more info on Windows startup paths.

There are more advanced techniques, Target a driver.  Drivers are loaded fairly early on in the boot process and are run with Ring 0 privilege.  Microsoft only has 2 rings of protection, Ring 0 and Ring 3.  The example I linked to targets drivers loaded before by the Session Manager (SMSS.exe).

Or you could depend on Windows itself to load your module.  When processes load libraries that are in their import table they try a specific order of paths to find the module they're looking for.  If you insert your DLL at a location searched before the normal DLL?

This really just scratches the surface, but you get the idea.  Malware is creative, and there are lots of ways for it to enable persistance.  A lot of system processes will load modules by default, and all Malware needs is a load!


How to Securely Implement a "Remember Me" Feature? Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let's say 30 days)?  This time period should be strictly enforced; ie, I don't think a valid solution would be giving a cookie an expiration date and hoping the user's browser deletes it in a timely manner.

Details of the existing login system:

A user must enter a user name and password
The database stores usernames as well as strong_hash_function(password + user_specific_random_salt)
Login forms are loaded and submitted over SSL, as are all subsequent pages

There are many examples out there and many with obvious security flaws.  Let's use PHP as the target language but the concepts should be applicable to any language.

My answer is incomplete and has a nontrivial flaw, in some situations - please see @Scott's answer instead.

There are two parts to my answer:

First, assuming your threat model does not worry about exposure of client side cookies, you can generate and store a nonce on the server side, hash that with the username and other info (e.g. client ip, computername, timestamp, similar stuff), and send that in the cookie. The nonce should be stored in the database, together with expiry date, and both checked when the cookie comes back.
This should be a "rememberance" cookie only, NOT a session cookie - i.e. when you get that cookie without a session, reissue a new, regular session cookie. Also note that like the session cookie, this should be delivered only over https, and using the secure and httpOnly attributes, and of course have the cookie scoped properly etc.

Second, for users that were remembered, you should (probably, depending on sensitivity) invoke a reauthentication process for certain sensitive operations. That is, sometimes they would need to put their password in again anyway, but seldom, and only for sensitive operations. This is to prevent attacks such as CSRF and shared desktop exposure.


Is this email asking me to sent them $100 for details on a security flaw in my website a scam? I've just received this email. Is it a standard practice or a scam?

  I'm a Security Researcher running a vulnerability identification
  service for a small group of private clients, and I accidentally found
  some vulnerabilities in your infrastructure.

  For a small fee, I will share the vulnerability details with you
  (includes POC, screenshots, and suggested solutions).

  Paypal instructions:

  Recipient: REDACTED GMAIL ADDRESS
  Paying for an item or service (covered under PayPal Purchase Protection for Buyers)
  Amount: $100
  Add a note: [redacted, my domain name]

  After I receive your payment, within 48 hours, I will send you an
  email with all the vulnerability information.

This certainly is not standard practice. Even if this person has found a legitimate problem on your site, it's a form of extortion.

There is proper "responsible disclosure" and professional "security researchers" don't start off asking for cash. Bug bounty programs exist for a reason.

The problem is that you do not know if the vulnerability is worth $100 to you.

This is very, very likely a scam, but on the off-chance that you are dealing with a legitimate professional with poor communication skills, you could ask for details, like where the problem is ("infrastructure"? that's odd for a website), and any details about who they are and proof of their professional work in security research.

If they ramp up the emotion or extend the extortion, then you know it's a scam. Don't install or open any files they send you. If they are legitimate, they will work with you.

To give you an idea, I am not a professional tester and I do not do bug bounties. But once in a while, I discover a vulnerability in a site. I first contact the company asking for the person who would handle site vulnerabilities with a 1-sentence rundown of the general issue. I do this to make sure I get to talk to a responsible person, and not an unauthorised person who might abuse or mishandle (or fail to understand) the information I am about to give them. I also give them proof of who I am so I do not come across as a scammer.

When I am talking to the best person I can, I give the full break down, with my process to repeat the problem, URLs, parameters, etc., and the reason for why I think it is a concern. I answer whatever questions they ask, but I never, ever, give the impression that I need or want them to do anything with any urgency. I let them work out their risk assessment. That's their job. It's their site.

I also don't ask for money, but if I did, it would be after I did as much as I could to help their team resolve it. And I would not expect to get money or any form of reward, even if I asked.

Either the site has a bug bounty program that defines the expectations and relationships for everyone involved, or the site doesn't, and I'm just helping out and maybe getting something out of it, or not.

That's how a professional would approach a site with a vulnerability they discovered.


Securely retrieving and exposing configuration within Docker It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a comment quoted Docker as saying the opposite.

We don't have access to the 'secrets' functionality of Docker, either, as far as I know.

We are using Amazon Web Services (AWS) Elastic Container Service (ECS) with the Fargate launch type, which automates scaling for us. We are storing secrets in the Parameter Store, inside Amazon's Systems Manager utility.

There are two options proposed:

Pull down the unencrypted* secrets as part of starting the process. These values would then be placed on the environment variables file (.env) and imported into the process when it is started.
Start the process, and load the secrets within it.  This will be done either directly from the AWS SDK or via another of our authenticated services.

The second option ensures that the secrets stay within the process's memory, preventing the use of the inspect flag on a Docker console.  However, in either case, I'm not familiar enough with the actual setup of ECS to know what security vulnerabilities may exist if it is done this way.  I want to ensure the safety of my secrets.

In either case, this would currently run once, at process start.  The second option would be nice for triggering refreshes, but that's a different discussion.

* I know that I could pull down the encrypted values in the first option, then have the process use the AWS SDK to decrypt them, but at that point it seems less work (cpu + network) to do option 2, with all the values returned decrypted.

Generally the best approach to secrets management in containerized environments is to make use of some form of secrets management software.  In essence most of these solutions comprise an encrypted database and a mechanism for containers to be provided with specific secrets at run time based on a provided identity.

In Docker this can be leveraged in swarm mode using the docker secret command.  Another alternative to this would be to use Hashicorp Vault or one of the other secrets management tools that are available.

Also within an AWS environment it's possible to use something like their CloudHSM feature from within Docker containers (more information here)


"Phishing" red flags and countermeasures Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to spot and react to a "phishing" attempt.

While the most common and prominent avenue for phishing is by e-mail, these social engineering attempts can really take on any form.  If Oscar has all of Alice's contact information (as may be the case in recent high-profile attacks) he may try to manipulate her via e-mail, phone call, SMS, or even by postal letter.

Oscar's attacks can be further augmented by intimate knowledge of Alice's more personal details.  (Again, these may have been gained in some recent incidents.) Such details may include credit card numbers, purchase histories, birth date, dependents, "security questions and answers", etc.

Still, regardless of the attack vector and complexity, there are a number of features that often set phishing attempts apart from legitimate vendor correspondence.  Additionally, there's a number of preventative and reactive measures which can be taken to protect oneself from falling victim to these attacks.

What are some "red flags" that are commonly found in phishing attempts?
What are some ways Alice can verify the identity of a suspected phisher, if she believes the contact may be legitimate?
If a suspect message includes a request for actions to be taken by Alice, and she believes the message may be legitimate, how should she follow up?

Again, answers are welcome for all attack vectors which may be used by someone with complete contact information for the target, possibly including:

E-mail
Phone number

Voice call - "vishing"
SMS messaging - "smishing"

Physical address

Postal mail
Door-to-door solicitation

Note to moderators - This thread might be a good fit for Community Wiki.

Phishing "red flags":

Any un-solicited communication regarding any account you have.  Certainly, this criteria is the easiest one to have a false-positive hit on, and probably shouldn't be the only clue you act on,  but it's also your first clue.
Any un-solicited communication regarding any account you don't have.  There's definitely something wrong, if it appears that an organization with whom you have no business relationship is contacting you.  These require careful consideration, and may necessitate additional defensive actions.  Generally, a communication of this type is one of three things:

Spam
Phishing
Evidence of identity theft

Un-solicited, or unexpected e-mail attachments.  Anymore, I actually get a little irritated by anyone who sends me an attachment in e-mail without advance notice or request.  There's so many other ways to share data over the Internet and across intranets these days, that e-mailing it as an attachment is rarely an actual necessity.  If there's a form that you must fill out, or document you really need to read, most legitimate organizations will post it on their official website somewhere that you can access it with an appropriate level of security.
Requests for you to send your username and/or password, or other personal details.  No legitimate organization should be requesting any of this from you, via a contact that they initiated.  Also, no legitimate organization will ever ask you for your password via any person-to-person contact.  Common phrases used here are "verify your account" or "confirm billing information".
Proliferate spelling, grammar, or factual errors.  Some phishers are getting better about avoiding this, but it is still a common hallmark of cheap phishing attacks.
An overwhelming emphasis on urgency.  Phishers often want you to think you must rush to action, so that you might not take enough time to realize their scam.
Overly formal, yet very generalized salutations.  Stuff like "Mr/Mrs" or "Dear Sir or Madam" or "To Whom It May Concern".  Unless this is a message you're expecting, and the tone is appropriate for the context, the unnecessary cordiality is probably just being used to warm you up to buy snake oil.  Most legitimate organizations know their audience, and will customize their greeting to either identify you by your first and/or last name or username, or will have a greeting that specifically identifies you as their customer.
Anything "too good to be true".  You know the old saying.  This is also another very general indicator that should set off anyone's alarms, regardless of how the "deal" is conveyed.
FROM addresses that don't match the REPLY address.  This is another criteria that may be prone to false positives, but should still raise your level of suspicion.  Many legitimate organizations that send mass e-mails will more than likely be doing so from an address dedicated for that purpose.  So, a legitimate e-mail will probably include either non-e-mail-based follow-up instructions, separate follow-up e-mail addresses, specific instructions for replying to the e-mail (keywords for subject and/or body), and/or a specific notice stating that direct replies to the e-mail will neither be received nor answered.
Hyperlinked URLs whose targets do not match the link text.  Before you even think about actually clicking on any hyperlink in an e-mail, hover your mouse over it for a second to see where it really sends you.  If the link text is http://google.com/ but the link actually points you to somewhere else like http://lmgtfy.com/*, you probably don't want to go there.  Such link may appear like this:  http://google.com/  (Mouseover to see actual target.)
Hyperlinks that use shortened URLs.  This criteria may have a lot of false-positive hits, but still warrants some cautionary measures and perhaps a raised level of suspicion.
Hyperlinks with very long and complex targets, even to "legitimate" websites.  These may possibly be cross-site scripting attacks.

*http://lmgtfy.com is actually a benign website, and was only used to provide an example of URL link-text not pointing to where it says it's pointing.

Phishing countermeasures:

Stop, breathe, and think.  No matter what they tell you, don't let yourself get into any rush.  If someone is initiating a contact with you, taking time out of your day, they can stand to wait a few minutes (or even hours) while you sort things out for yourself, and decide what you're going to do.
Do not offer any information.  This is what phishers want.  Even if you're not giving them the specific information they're asking for, you may still be giving them something else they can use against you later.
Do not open any e-mail attachments.  Just.  Don't.  Do.  It.
Do not follow any hyperlinks or URLs.  Again, just don't.
Do your own research.  Google.  Wiki.  Snopes.  Repeat.
Do not do anything they ask, in the way they want you to do it.  If it's a legitimate communication, you'll be able to find your own way of doing what's asked of you without them.  For e-mails wanting you to go to a specific URL, instead go to the known-good-and-trusted HTTPS website of the organization and find your way to the requested function from there.  For phone, mail, or other interactions, end the conversation and go use Google or the organization's known-good-and-trusted homepage to find (or verify) the correct contact information for follow-up.
Do not reply.  This goes along with not doing what they ask, how they ask it.  Again, if the contact is legitimate, you should be able to follow up without actually answering back to the solicitor themselves.  Even if the e-mail appears to come from an address referenced on a legitimate website, do not use the reply function.  Instead, use a link or form on the known-good-and-trusted site, or manually fill in the e-mail address on a new message.
Just say no.  To drugs, and solicitors of every kind.  Whatever service they are offering is not one that you need them in order to acquire.  If the offer is legitimate, you will be able to find a comparable level of service via your own research, and likely through safer and more secure mechanisms.  If they really insist that they need to get credit for the service, take their information and do your own research and validation before doing any business directly with them.
Ask a pro.  When in doubt, ask someone you trust who's "in the know" about these things.  This may even just be part of the "Don't do what they ask." step - the purported organization's help desk (which you'll look up yourself) should definitely be able to tell you if the contact was legitimate.


How do I get back to a Meterpreter shell after backgrounding it? Curious if any of you have an answer to this Metasploit question. It's an issue of a Metasploit session within another Metasploit session.

In this lab I'm doing, I need to compromise a machine (10.10.50.8) and then use it to pivot to another machine (10.10.51.21). I spark up Metasploit (instance #1) and get a Meterpreter session going on 10.10.50.8. I use plink to setup a reverse ssh connection on port 21 to a ssh server on my Kali box. That gives me a new bash shell where I can now do things like nmap 127.0.0.1 from my Kali VM to probe 10.10.51.21's FTP port. All good so far.

Now that I have the reverse ssh connection, I can access 10.10.51.21 via localhost. I spark up a new instance of Metasploit (instance #2) and attack 10.10.51.21 using exploit/freebsd/ftp/proftp_telnet_iac. I launch the attack and get a message about a port conflict followed by an exploit failed message. So I had to background Metasploit session #2 so I could determine the port conflict. I go back to Metasploit session #1 and sure enough port 4444 was being used when I compromised 10.10.50.8. With that I went back into my Meterpreter session to get back to Metasploit session #2 (to compromise the 10.10.51.21) and couldn't figure out how to get back to it. Running sessions -l only shows the Meterpreter session used to compromise 10.10.50.8.

Anyone know how?

And yeah this is a little bit of Inception going on here. :)

Regarding the original question, I found the answer to how to restore the backgrounded session. I have to use channel -i <channel id> to get back to the specific backgrounded session.


Is it okay for API secret to be stored in plain text or decrypt-able? Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they store it in plain text or at least in a decrypt-able format.

Isn't it better if API secrets were treated as passwords that you should type-in to create then hashed in the database instead of being handed to you in plain text? If for some reason their API secret database were compromised it will easily open the flood gates for many applications that are using their API. However if it was hashed in a non decrypt-able manner then all is not easily lost.

No.  The API keys need to be stored in cleartext.

They are not passwords: they are cryptographic keys.  These keys are used for things like authenticating requests (using SHA1-HMAC).  The server needs to know the crypto key to apply the cryptographic algorithms.

Therefore, the API key needs to be stored in cleartext on the server.  If the server stored only a hash of the API key, it could not verify the authenticity of messages from the client or authenticate messages sent to the client.


DNS zone transfer attack Can anyone explain what is DNS zone transfer attack or give any link, paper?

I have already googled, but could not find anything meaningful.

DNS Zone transfer is the process where a DNS server passes a copy of part of it's database (which is called a "zone") to another DNS server. It's how you can have more than one DNS server able to answer queries about a particular zone; there is a Primary DNS server, and one or more Secondary DNS servers, and the secondaries ask the primary for a copy of the records for that zone.
A basic DNS Zone Transfer Attack isn't very fancy: you just pretend you are a secondary and ask the primary for a copy of the zone records. And it sends you them; DNS is one of those really old-school Internet protocols that was designed when everyone on the Internet literally knew everyone else's name and address, and so servers trusted each other implicitly.
It's worth stopping zone transfer attacks, as a copy of your DNS zone may reveal a lot of topological information about your internal network. In particular, if someone plans to subvert your DNS, by poisoning or spoofing it, for example, they'll find having a copy of the real data very useful.
So best practice is to restrict Zone transfers. At the bare minimum, you tell the primary what the IP addresses of the secondaries are and not to transfer to anyone else. In more sophisticated set-ups, you sign the transfers. So the more sophisticated zone transfer attacks try and get round these controls.
SANS have a white paper that discusses this further.


Does encrypted content in a database need to be signed? If a user is logged into a website and they submit sensitive info over HTTPS, which is encrypted and stored in a database, does it matter if the info is not also signed?

Given that signing requires a private key, if a hacker has access to the server and they wanted to tamper with the data, couldn’t they also resign the data with the same key?

...  they submit sensitive info over HTTPS, which is encrypted and stored in a database,

HTTPS only encrypts data in transit. This means the server as the endpoint of the HTTPS connection is also the endpoint of the encryption done by HTTPS and thus has access to the plain data. It also means that the data in the database are not encrypted due to HTTPS. Instead the plain data need to be encrypted again by a key known to the server. The alternative would be to encrypt the data on the client with a key only known to the client (and kept on the client side) in which case the server would have no access to the data, no matter if HTTPS is used or not.

In any way encrypted data should be protected against manipulation so that decryption should fail if something was changed on the encrypted data instead of returning different data. Some encryption algorithms provide this itself while in others an additional MAC is required. A MAC is not a signature and does not need a private key of the client.

A signature is only needed if you not only want to protect against data manipulation but also need a proof that the data where provided by a specific client. HTTPS does not help here, this signature need to be done instead on the client side with a private key only known to the client. Note that a signature does not need to imply encryption, i.e. it is possible that the server has access to the unencrypted data but gets only a client-generated signature which provides proof of who provided the data.


Is it possible to gain control of a Windows computer with no browser notifications when a user clicks a URL? If so, how? Currently working on a spam filter for a large company and trying to determine the level of risk involved with this. We run many different Windows versions.

This CNN video seems to imply that it is possible, but my understanding is that you have to convince a user to download a file and attempt to open it before the code to take control of the computer would run:

http://money.cnn.com/video/technology/2015/12/06/hackers-social-engineering.cnnmoney/

Yes, using any browser exploit.
https://en.wikipedia.org/wiki/Browser_exploit
http://krebsonsecurity.com/2010/01/a-peek-inside-the-eleonore-browser-exploit-kit/

What current browser exploits exist is anybody's guess however. No spam filter will be able to filter out all malicious URLs though. You will need to educate your users.


Using cat to overcome 'Stack smash detected' I'm trying now buffer overflow exercise from the site pwnable.kr
I found the string that should be entered to the gets frunction but got "Stack Smash Detected" then I found a solution in
rickgray.me

They suggest
(python -c 'print "A" * 52 + "\xbe\xba\xfe\xca"'; cat -) | nc pwnable.kr 9000

which works,
Somehow adding the "cat -" command overcomes the canary.
I don't understand why is that

This avoids the stack smashing detection because the checking of the stack cookie/canary happens only at the function's epilogue.

Since the challenge you posted requires smashing something on the stack directly that is used in a logic check in the same function, the canary isn't checked by the time you receive your shell.

The canary mainly prevents against stack smashing to overwrite the return address.

The comment on the question about the cat command being present to allow input/output redirection is correct, otherwise the shell opens and is immediately closed.


Security of master password in a derived password manager I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no database to store, only that the database doesn't store any secrets.
Using some key derivation function KDF
With master password provided from elsewhere
Password requirements are the rules of what are allowed by the site,
    i.e. length, allowed character classes, required classes

# To register with a new site
With username provided from elsewhere
With password requirements provided from elswhere
Create a salt
Store site,password requirements,username,salt
Create key by KDF(salt, master password)
Convert key to generated password to fit password requirements
Give username and generated password to site
Register

# To login to a site
Retrieve password requirements,username,salt by site
Create key by KDF(salt, master password)
Convert key to generated password to fit password requirements
Give username and generated password to site
Login

Let's say an attacker acquires both the store and the plaintext generated passwords.

Does this design make it any easier for the attacker to find the master password than by a brute force attack?
Is a brute force attack on this design easier than a brute force attack on an encrypted password store?
Is this in any other way easier to attack than encrypted password managers that derive the encryption key from a master password?

Of course the list of sites and usernames itself is important information. I'm only wondering about the security of the master password.

(1) Does this design make it any easier for the attacker to find the master password than by a brute force attack?

No. Not that I see.

(2) Is a brute force attack on this design easier than a brute force attack on an encrypted password store?

Yes. There is more ways for an attacker to obtain the data that they need for a brute force attack. At least that is the case if we take your notion that there are no secrets in your database.
Suppose I set up a server for, say, MyCuteKittyPictures.net, and I store passwords on that server in plaintext. There are plenty of plaintext offenders out there anyway. An evil site operator or anyone who compromises a plaintext offender, is able to learn your password for that site.
This gives them everything that they need to launch a brute force attack except the salt, but you have said that the database file is not a secret, and therefore I should assume that the attacker has access to the salt.
In my example, I talked about a single plaintext offender (and a malicious one), but data from any plaintext offender puts the attacker in a position to launch a brute force attack. And so there is more opportunity to an attacker obtain enough data to launch such attacks

(3) Is this in any other way easier to attack than encrypted password managers that derive the encryption key from a master password?

This is going to depend on some fine details. But on the whole encrypted password managers will generate passwords that are truly independent of each other.
Also what you are calling encrypted password managers will have the ability to encrypt the site, and username, and other data which a user may wish to keep private. I may not want to world to know whether I have a login for ToenailChewersAnon.org or that I am user fluffybuns on some other site.
So you really aren't gaining anything by pursuing yet another attempt at a derived password manager. And you are losing other desirable processes.


Does the Dreamy Smurf tool really exist? Dreamy Smurf is a program that allows its user to activate a target's phone when it is apparently turned off. Is it real or not, and how can this work?

It is impossible to turn on a device that is COMPLETELY powered down, however I have heard of some bugs that can prevent the device from completely powering down; thus making it possible to wake them from the fake "shutdown."

Sources: Personal experience and Link


Choose a good password for full disk encryption I have recently decided to encrypt my Gentoo Linux installation. I am going to use cryptsetup with LVM. LVM filesystem will be placed inside encrypted dm-crypt partition. I have problem with forgetting passwords. I don't want forget password to cryptsetup because I can lose all of my data. I'd prefer hold backups on encrypted external hard drive. How is your recommends to choosing a good password for full disk encryption? I'm not sure if backup unlocking key on USB will a good idea because in case of necessity of disclosure data and disk keys or passwords I would like to prevent beware leaking it.

Here's a new method I've started using recently:

Pick 4-5 random words: piano, abstract, ruler, ivory, stream
Put them together with spaces in between: piano abstract ruler ivory
stream
Make some letters uppercase: Piano abstract ruleR ivory stream
Substitute some letters for numbers:
Pia4o abstract r0leR ivory
stream
Substitute some letters for symbols:
Pia4o abs#ract r0leR ivor! stre&m

New password:
Pia4o abs#ract r0leR ivor! stre&m


MIME types that allow XSS in modern browsers Assume that it is possible to host arbitrary files on goodguys.com, which are delivered with an attacker-controlled MIME type and X-Content-Type-Options=nosniff. Which MIME types allow for XSS when used as src of an iframe, target of a link or in other ways in reasonably modern browsers? I know of at least text/html and image/svg+xml, but are there others?

Edit: I want to stress that a blacklist approach based on MIME types is not a good idea. The motivation for the question is that I could use interesting answers as convincing arguments in favor of MIME whitelists.

You won't be able to assemble a comprehensive list of dangerous MIME types.

While it's straightforward to block text/html, text/xml, image/svg+xml, etc., there are many obscure legacy or vendor-specific MIME types that aren't widely known and might work in some browsers. E.g., the MIME type application/vnd.wap.xhtml+xml is understood as XML in Firefox while it won't trigger in Chrome at all. Proof of concept:

data:application/vnd.wap.xhtml+xml,<x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(1)</x:script>

Also, there are MIME types that don't immediately lead to XSS but have side effects. E.g., an attacker might want to trick a user into installing a Firefox plugin by supplying content with a application/x-xpinstall MIME type. (This attack will have some additional hurdles, but you get the idea.)

Finally, third-party vendors might also register their own custom MIME types (think Flash applets with application/x-shockwave-flash, JAVA applets, embedded media players, etc.) some of which have the ability to execute script code. It will be hard to keep track of these on your blacklist.

In conclusion - if you're planning a real-life implementation, you should whitelist harmless MIME types instead of blacklisting dangerous ones.


How to decrypt SSL traffic with a packet sniffer when I have the private key? How you do you decrypt ssl packets (traffic) with the private key? I tried to do this with ssldump and openssl but nothing worked.

Ssldump is supposed to be able to do that, but it appears to be unmaintained (in the source archive of the latest version, the date of last modification of all files are in 2002 or before) so it is quite possible that it won't support newer SSL/TLS; actually, it is highly implausible that a software from 2002 could process the new encryption formats defined in TLS 1.2 (AES/GCM). TLS 1.1 was published in 2006, and TLS 1.2 in 2008.

OpenSSL is a library that implements the protocol, but is not meant for analysing a recorded session.

You may have better chance with Wireshark, which has ample documentation on how to use it to decrypt recorded sessions.

There is an important parameter to mind: decryption of a passively recorded session (with a copy of the server private key) works only if the key exchange was of type RSA or static DH; with "DHE" and "ECDHE" cipher suites, you won't be able to decrypt such a session, even with knowledge of the server private key. In that case, you will need either the negotiated "master secret", or to use the server private key to actively intercept the connection (in a Man-in-the-Middle setup).


Bruteforcing blowfish I am quite new to encryption and recently played around with blowfish (openssl's implemenation).

I am using a 23 character password (case-sensitive alphanumeric random). I estimate the entropy to be roughly 128 Bit (-> wikipedia password strength).

My question would be:
If someone would acquire my encrypted text, how long would it take him/her to bruteforce it?
How would yout answer differ if it were a big player (three letter agencies...)

Edit:

Also, blowfish seems to be quite old, Wikipedia states that Bruce Schneier would recommend twofish instead (though not available via openssl).

What does this mean and does it have any practical conseqeunces?

"Four rounds of Blowfish are susceptible to a second-order differential attack (Rijmen, 1997);[1] for a class of weak keys, 14 rounds of Blowfish can be distinguished from a pseudorandom permutation (Vaudenay, 1996)." [src: https://en.wikipedia.org/wiki/Blowfish_%28cipher%29"]

The difficulty of brute-forcing your ciphertext depends on what key size you used when encrypting: Blowfish has an adjustable key size, ranging from 32 bits to 448 bits; this size is independent of the complexity of your password.  At the 32-bit end of things, your ciphertext could be decrypted in a matter of minutes, while at 128 bits or larger, it would take longer than the remaining lifetime of the universe.

What your quote means is that simplified versions of Blowfish have attacks that are faster than brute force.  From a practical standpoint of attacking it, it means that for longer key sizes, an attacker is better off researching attacks than trying to guess the key, because there's a good chance they'll be able to find a practical attack.