How does a merger formally impact an ISO 27001 certification? Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification.

What are the formal impacts of the acquisition on the ISO 27001 certification?

I am interested in two cases:

Right after the acquisition when nothing changed yet in Organization A.
→ My understanding is that the certification is intact as

The scope has not changed; and
The means to handle the requirements (patch management for instance) has not changed either.

Organization B integrates Organization A and the means to handle the requirements have changed. To take the patch management example above, it is now ad-hoc, uncontrolled, in one word not suitable for ISO 27001 requirements.
→ Does the ISO certification still hold?

Another way of looking at it is whether the certification is a snapshot checked every year (with the hope that things are correct over the year), or whether any negative change over that year automatically invalidates it.

If the latter, how does this invalidation happen?

You are right with answer 1. The certification is always only for a specific scope. I know many companies which only certify some branches and still put the certificate on their website.

There is no automatic invalidation. The certification can be revoked after the yearly check but usually only if major flaws are detected. Most of the time you will get several months to fix the issue, and during this time you still hold the certification. If you, however, fail to improve during that time you will have to re-certify.

Changes in processes are completely normal and have to be treated as described in ISO 27001.


How do CAs generate public keys without the private keys? When creating a CSR so you can later paste it to a CA to generate a signed TLS certificate, you first generate a private key:

openssl genrsa -out your-key.key 2048

With the private key, you can then generate the CSR:

openssl req -new -key your-key.key -out your-request.csr

If you want to extract the public key from the CSR, all examples I've seen require the private key to be present in the openssl command:

openssl x509 -req -days 365 -in your-request.csr -signkey your-key.key -out your-public-key.crt

I assume CAs do something similar to sign the certificates and therefore create a public key. However, when filling the request form you are only asked for the CSR, not the private key.

My question is: how do they do it to create the public cert from the CRT without having the private key?

How do CAs generate public keys without the private key?

CAs do not generate any public keys. They create certificates which contain a requesting party's public key (from the CSR).

The private key is not necessary to extract a public key from the CSR. To do it execute:

openssl req -in your-request.csr -noout -pubkey

On the other hand, the command you included in the question (claiming its purpose is "to extract the public key from the CSR"):

openssl x509 -req -days 365 -in your-request.csr -signkey your-key.key -out your-public-key.crt

creates a self-signed certificate.

CA signs the certificate with their private key, not yours, hence they do not need yours.

The role of the CA is to provide a proof that a public key belongs to the entity claiming it belongs to.

CA might need to verify the domain of the requestor (domain-validated certificates), it might need to verify the documents of the requestor proving its identity

But CA does not need to verify the private key of the requestor because it's mathematically tied with the public key. If someone encrypts the message with their private key, it will be decryptable only by the corresponding public key.


what position should I apply to be an ethical hacker? I am a fresh graduate with a degree of BS computer engineering. I want to be in the field of information security. What position should I apply to be in this field? Thank you!

Job titles tend to be a bit unreliable. I'd do a search for "security", then read over the resulting job postings' descriptions to see if they fit what you want to do. And when you contact the company, be explicit about your interests, so they can quickly tell you whether this is a good position for you or not without wasting either their time or yours.


Does Google hand over captcha IPs to webmasters? Google gets to know a user's IP when someone enters a captcha even if they are using tor (see http://www.wired.com/2014/12/google-one-click-recaptcha/). So, If I go to a non-google website, such as cnn.com, and it asks me for a captcha for submitting a particular form, will it hand over my IP to cnn?

NOTE:I have only used CNN as an example and this question is NOT about cnn.com

To actually answer your question, no, Google does not provide the IP address of the user back to the original website. According to the developer documentation, Google will supply the website with a JSON object basically containing either true or false.

{
  "success": true|false,
  "error-codes": [...]   // optional
}

But none of this really even matters, because recaptcha does not have any special powers that allow it to get a user's real IP address when behind Tor. Even if it did supply the user's IP address, it would only know the IP address of the Tor exit node, which CNN already has from you visiting the page.


Network UTM firewalls, are they really worth it? I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs).

However, from what I have observed in recent months, there has been an increasingly worrying trend of attacks which the network firewalls might not be able to address and I am starting to look at UTMs as the next security solution for my organization.

While I understand UTMs are essentially all in one security devices, I have a few concerns on

1.) Effectiveness:
How effective they are in terms of mitigation of security threats like:

virus mitigation (a lot of them claim they do this effectively, but I am skeptical)
email spam (not sure how this is done since the mail server isn't run by us)
content filtering / management
network intrusions (IPS)

2.) VPN performance :
Currently I am using Cisco ASA type firewalls to run my VPN tunnels, would there be a hit in terms of VPN performance if I replace them with UTMs? (given that they are multi-functional devices)

Just a bit of back ground of my organization setup:

I have about 4-5 outlets, 2 offices and 2 data center sites.

I am thinking of having low-end/tier UTMs installed in the outlets (since they serve a limited no. of users), something mid-range for office and data center sites.

Management is very concerned on the running costs of such an implementation in terms of operating costs (licensing and etc), but I think given the trend of attacks I am seeing, it's time for us to seriously look at Network UTMs.

I have Googled a lot on the effectiveness of UTMs, but I can't seem to find  neutral write-ups, so I am keen to hear from people in the community.

Also I would like to hear about some Network UTMs you would personally recommend given my situation. Ideally something with low licensing costs and relatively easy to set up and manage (centralized).

This is not a forum for product recommendation. But to give you some things to look out for:

Phrases and Buzzwords: UTM, NGFW, IPS, IDS, Firewall, Secure gateway... are just words and say nothing about the technology used and of their limitations. And there are lots of limitations: sometimes because of the underlying technology and sometimes to make it faster and cheaper.
Marketing: Everybody claims to be the most secure, the fastest and the cheapest. Often not the best product wins but the one with the best marketing or the lowest price, because normal users can't tell the difference anyway: it's a lemon market.

And what product is best depends on what level of security you need. If you are not dealing with sensitive data it might be enough to protect against ransomware and against malware which integrates your company into a botnet. As soon as you deal with customer data, do interesting research, maybe have connections to government organizations you get more interesting for an attacker because it might be worth to steal data from you or to use you as a trampoline for attacking some more important organization.

Protection against low level DOS is different from protecting users surfing the web. For the first a fast packet filter is needed and for the second you need application level filtering. And it is not only important if the device can do web (or even web 2.0 like lots claim) but how deep they look into the traffic. Simply blacklisting URL's is much easier than actually analyzing the payload but also provides less security. The deeper a device looks into the traffic the more protection it can offer but the slower it will get and the more it will cost. There is no magic sprinkling around this simple fact, even if it is called "next generation firewall" or "unified threat management", "cloud security"...

No NGFW, UTM, whatever will fully protect the network. Thus you need to use isolation between different parts of the network to limit the impact of malware. Do not simply let mobile devices into the critical production network, because you don't know how infected they are. Simply think how you would behave if you know that somebody visiting you might have an infectious disease.

The more you know about your network the better you can protect it, because you can restrict it to what it should do in your opinion and detect any violations. Security is not simply installing some device and forget it, but monitor what's going on in your network, adjust the rules so that they are as tight as possible etc. And you probably must hire somebody to do this for you or outsource the management of the firewall. The best firewall will not help if the person maintaining it has no real understanding of the problems.

Maybe you better don't buy directly from a vendor but go to an independent security company which sells competing products and often also can do the management for you. They will know more about the abilities and limitations of each of the products than a single vendor is willing to tell you. But of course some will simply try to sell you the product where they make the most profit instead the one best suited to your environment.

Sounds hard and expensive? It is. You only know that it might have been smarter to invest in better security (products and also training) if your data are lost, your identity is compromised and the customers look somewhere else in the hope that somebody can keep their data more secure.

  I have Googled a lot on the effectiveness of UTMs, but I can't seem to find neutral write-ups, ...

There is no general effectiveness of UTM, because UTM differ a lot both in features and quality. Today you will not find much products which don't claim to be either a UTM or NGFW (or even both) even though they don't differ that much from the previous firewall, IPS or secure gateway products of the same company. Technologically you will often find at the lower end simple packet filters (like Linux iptables) with maybe some IDS (like Snort) and maybe some proxies (like Squid) with added Antivirus and blacklists but there are also more advanced solutions. They differ a lot between the quality of AV which range from open source ClamAV to commercial products of different quality. Same is true for the quality of blacklists, IDS signatures and how fast the vendor responds to new threats.

Bypassing the components of an UTM is often trivial because in edge cases of the protocols the data are interpreted differently in the UTM and the clients (browser etc) - this is a general problem of perimeter firewalls. Sometimes such bypasses can be done at the packet layer already (see Stonesoft Evader 2013), sometimes at the application layer (see my research 2015) or also at the layer of antivirus analysis as in this research from 2012.

Thus you should not expect too much security from these devices and better implement defense in depth, i.e. use additionally host based antivirus and isolation between networks with different security levels. But in any case most of them will probably be an improvement to what you have now.


Antivirus connects to their server over port 80 I ran a netstat and noticed that my computer has an always-established connection with my anti-virus (Avast) over port 80.  I haven't gone as far as to parse through it in Wireshark, so I can only assume that the connection is there to pass unknown hashes or files back up to their database for analysis.

My question is twofold:

What other types of information does Avast (or any anti-virus for that matter) collect from their users' machines?

and

Does this pose as a security risk? If someone malicious were monitoring my traffic, would they be able to glean anything of value? Also, if there were a malicious file on my computer, would they be able to modify that traffic before it got to the antivirus' servers to keep the antivirus from flagging that file?

Though it is over HTTP, and the ideal would be over HTTPS, any software providers communicate over HTTP and sign the communication. Let's take a step back and answer what SSL (and TLS) provides.

Encryption of content
Validation of non-tampering

To prevent tampering, may software providers digitally sign the content with a certificate or a GPG key and send it over HTTP.

The question then is why? Why not just use TLS? Oftentimes, this is because of network infrastructure can't support TLS or the mistaken belief that HTTPS is slower than HTTP.

What's the risk? Generally, if the content is properly signed (and validated), there isn't much risk. It's still not ideal, but the big part is repudiation of content.


Is lack of wildcard DNS entry a security vulnerability? A friend of a friend received an email from a security researcher that looks legit. Researcher submitted several vulnerabilities, one of the them reads like this

  Vulnerability # ...

  Title : Lack of wildcard DNS Entry!

  Description :
  The risk of attackers knowing the wildcard which could thus result in
  DNS Hijacking and further threats. There are several issues related to
  this. The most common i can think of is phishing. Wildcard DNS is a
  handy feature, and phishers are apparently using it to bypass
  filtering. Phishers use wildcard DNS to get around filtering since
  filtering, in many cases, is based on exact host name and domain name
  combinations. With wildcard DNS Phishers can generate any number of
  differing URLs on the fly and often evade filtering technology.

  On the Web server side, a simple bit of code can parse the URL to find
  which hostname was used to land on a site, and then redirect the
  visitors as necessary.

  And there is no wildcard entry so attacker easily enumerate your
  secret and Public Subdomains.

Then comes a proof of concept with an output from DNS brute-force tool knock.

Just to clarify, the website in question does not have a wildcard (*) in the DNS entry and recursive sub-queries to the DNS are not allowed (e.g. AXFR query doesn't work). The website treats DNS sub-domains as public information anyway. IMO, this is not a vulnerability - it's by design, just want to cross-check with the community.

Question: is lack of a wildcard entry in the DNS a security vulnerability?

Based on the context you've provided I don't see a significant threat.

I'm assuming you're running a pretty typical internet facing web service and from that perspective the explanation your security researcher provided seems a bit muddled.

  The most common i can think of is phishing. Wildcard DNS is a handy
  feature, and phishers are apparently using it to bypass filtering.

I don't see how this is a direct threat to you seeing as presumably an attacker can't modify your DNS records. I can see how it might be a threat to your users (being a subset of internet users in general) who might be vulnerable to DNS poisoning or phishing in general, but this is far beyond your control.

  With wildcard DNS Phishers can generate any number of differing URLs
  on the fly and often evade filtering technology

Again, this is true... but only on an arbitrary domain they control, not on your domain.

  And there is no wildcard entry so attacker easily enumerate your
  secret and Public Subdomains.

I guess maybe there's some validity here if an attacker found it difficult to distinguish between a legitimate service and a fake/honeypot one. In practice you would need a lot of fake servers running fake services to make it significantly more difficult for an attacker to identify the legitimate one.

Plus, there's more effective ways of protecting public facing services besides simply obscuring them more.

There may be additional attack vectors to consider if your scenario is not what I assumed. For example if you're running an internal network with private DNS that serves records for publicly resolvable domains that someone else might control. This doesn't sound like the case though.


What would be reasonable approach for sandboxing new project to be protected against security holes made by chance? As a regular developer I'm curious about looking at new projects. Let's say today I want to contribute to open source project in Python. This project is on GitHub and I a kind of confident in people behind this project. The only thing that bothers me is some mistake that could be made by chance by some developer which could potentially lead to unintended leakage of data from local machine. Like some mistake with paths / unintended copy from some random location / unintended upload / typo in pip dependencies which downloads some malicious library from pip. I'm a bit paranoid on these things especially when the project is new for me and I don't yet know code base and history.

What would be reasonable layer of protection there? I'm thinking about running project from docker sandbox under non-root user mounting only project source tree as a volume. Is it sufficient or what would be more reasonable?

If you're looking to run untrusted code on your system, then it does make sense (if possible) to sandbox the code, which reduces the impact of that code being malicious.

I'd say that running inside a Docker container as an unprivileged user is a good step.  If all you're worried about is inadvertant leakage of information then Docker is a reasonable fit, as it provides the running code an isolated environment so any leakage would not affect the underlying system (unless you had mapped that directory in from the host OS via Docker run's -v switch)


Explaining information leak to Lead dev Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI."

It looks to me that the leaked information could be used to aid an attack.

Does it provide a security risk?
If so, how can I explain this to the lead dev and advice on providing a fix?

Much appreciated.

PS: (Apologies for not copy and pasting the message. I did a screenshot and couldn't reproduce the error easily. Please click on the image to see it enlarged.)

Any information about the internals of a system or application helps an attacker craft a specific attack. For instance, that error message includes table names, which means it becomes far easier to craft a SQLi attack.

In addition, with detailed error messages, I could try to trigger different errors to map out the function of the backend, and even find vulnerabilities much faster.

In general, detailed error messages are a no-no. Use them only on a QA instance for debugging.

That said, there is a reason why "info disclosure" is not regarded as an automatic "high" finding. It is possible that even the details of the application or system would not help an attacker, but that is up to each and every system. So, the risk needs to be evaluated in each instance (which doesn't provide you with a quick answer to your lead dev).

As an evaluator, though, when I see highly detailed error messages like the one you posted, I know that the devs have not been careful, and I can assume that the application is not properly coded, and likely with a lot of vulnerabilities. In short, if I see a message like that, I pull out all the guns to find the holes there are likely to be, and I have all the details I need to precisely exploit them.


Resources for determining if Metasploit has exploit for given CVE Are there any reliable resources for finding whether or not a Metasploit exploit exists for a given CVE?

I have found CVE Details to be woefully out of date with regards to keeping this information up to date.

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist:

You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.:

http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=&filter_exploit_text=&filter_author=metasploit&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=[CVE]
You can use OSVDB.org to search by CVE e.g.:

http://osvdb.org/search/search?search[vuln_title]=&search[text_type]=titles&search[s_date]=&search[e_date]=&search[refid]=[CVE]&search[referencetypes]=CVEID&search[vendors]=&search[cvss_score_from]=&search[cvss_score_to]=&search[cvss_av]=*&search[cvss_ac]=*&search[cvss_a]=*&search[cvss_ci]=*&search[cvss_ii]=*&search[cvss_ai]=*&kthx=search

and check the references section for a Metasploit URL.

It's worth noting that both those sources are usually a day or two behind the Metasploit repo.


Is there any mechanism that using multiple keys encrypt and decrypt a shared document? I wanted to achieve the following mechanism to encrypt a document

each person in a group of N (user a, b, c...)has her own key;
user a and user b somehow decided to encrypt document M, and they can read M in plaintext, and anyone other than a and b can't read the document M
user a, user b and user c somehow decided to encrypt document N, and they all can read N in plaintext, but anyone other than a, b, c can't read the document N

Is it possible? If so, how to achieve such functionality? (I feel PGP can't solve this problem)

You can achieve this even using just symmetric encryption.

You generste a random master key. Make a copy of the master key for every user that should have acces. Each user then encrypts his copy of the master key with his own key.

If the user keys are not available, encrypt them with their public pgp key instead.

When working with the document, user decrypts his copy of the master key and uses it to decrypt the document.

If a user that has access to the doc wants to grant access to another user, he just makes another copy of the master key. If you want to revoke users access, you change the master key and redistribute the keys only to users who should have access.


Password Verification Server I posted a question here...

Protecting Password Hashes with Store Procedures?

...where I asked about denying a website's database user CRUD access to the tables that store password hashes except through stored procedures which only check equality, and don't return the hashes. This would seem to make it impossible to dump the hashes via SQL injection.

The user who posted the answer I accepted, though, mentioned a "dedicated password verification server." I tried to find more information about this but I couldn't...

What are some dedicated password verification server solutions for ASP.NET and what companies use them? Can anyone point me to some information about how they work?

He's probably referencing a Hardware Security Module (HSM), which is a single-purpose dedicated hardware device designed to store secrets in a way that protects data even if an attacker has unrestricted physical access to the device.

The idea of these devices is that you pass it data, it encrypts or hashes it, then stores it in a secure storage device. When you want to verify a value, you pass the data to it and it performs the checks for you. That way it doesn't reveal the data at all - it just checks the password for you.


Security research on Operating system security measures, where to start? I am researching on operating system security, And I don't know where to look for more information on this.

I could find the following sources, but I need more guidance.

Sources:

  Microkernel security evaluation[2012 Kevin C. Kurtz]
  Operating System Security and Secure Operating Systems
  Linux kernel vulnerabilities: State-of-the-art defenses and open problems[2011]
  Evolution of the Windows Kernel Architecture [Dave Probert, Ph.D 2009]
  Can we make operating systems reliable and secure? [Tanenbaum, A.S 2006.]
  Monolithic kernel vs. Microkernel
  Hybrid vs. monolithic OS kernels: a benchmark comparison [2006]
  An Evaluation Framework for Kernel-Mode Security Modules
  Protecting Commodity Operating System Kernels from Vulnerable Device Drivers
  The Pros and Cons of Unix and Windows Security Policies
  OPERATING SYSTEM CONCEPTS ABRAHAM SILBERSCHATZ  9ed
  A Multiple-Criteria Approach to Ranking Computer Operating Systems
  Choosing Secure Platforms in the Enterprise
  Linux vs windows total cost of ownership comparison
  XNU: a security evaluation

website links:
http://pastebin.ca/3160959

I am looking for questions like,

Is there any theoretical Operating system architecture that is inherently secure?
What have been done in making operating systems more secure?
If we are to assess an operating systems security, is there any guideline or standard measures to do so?
Is there any theoretical parameter to make an operating system secure?

Is there any parameter for benchmarking OS kernels and rank them?

For example :multics OS has a different design and implementation of stack that makes very hard to do a buffer overflow, or code injection, etc.

Is there any parameter like OWASP Top 10 to rank and benchmark a kernel, or how do I have to gather them?

The issue is that "security" as a standalone notion doesn't exists. You have different threats, and you can have specialized OS designed to address these threats.

A possible threat is that the OS code contains a bug opening the possibility for this code to act in an unexpected way (no matter if this "unexpected" behaviour is exploitable or simply a bug).

This threat is mostly a concern for specific embedded software. It is addressed by micro-kernels based OS. Micro-kernel having less code, this leave less room for bugs but also opens the possibility to formally prove the OS kernel correctness.

Another threat is information leakage from end-user general purpose environments (think about trojan, exploitable software, etc.).

This threat is address by OS compartimentation: it will divide the desktop  environment into several containers, restricting the communication between the container themselves and the communication between the containers and the external environment (network, USB, drives, etc.). Example of commercial solutions implementing this are PolyXene and Bromium, a free alternative is Qubes OS.

Otherwise, more general solution can be achieved using an hardened version of an already existing OS. Here again, the question will be "Hardened against what threat?". This will provide an OS modified in a certain way to address a certain threat (Is it a server environment protecting against remote exploits? A multi-user environment protecting against one user accessing other user's data? Etc.).


Pros and cons of disabling TCP timestamps So, lynis informs me that I should unset net.ipv4.tcp_timestamps.
I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or they could use it to figure out my update schedule and try to attack in the brief interval during which the machine's restarting but before the firewall comes online, or something else I haven't thought of.

I understand it's not ideal.

However, according to RFC 1323 (and this):

  The timestamps are used for two distinct mechanisms:
   RTTM (Round Trip Time Measurement) and PAWS (Protect Against Wrapped
   Sequences)

Those also seem like nice, useful things to have. That having been said, IIRC from my networking classes that RTTM method definitely isn't necessary for determining RTT, and TCP's sliding window makes sequence wraparound issues unlikely, but since this isn't one of the joke RFCs I'm assuming they had a good reason for proposing these things and implementors had a good reason for implementing them.

Are there any (likely) disadvantages / negative usability or security implications to disabling this feature?

Additionally, is there any way I can both have and eat my cake (by, for example, telling the kernel to initialize with a random value and introduce jitter into the period of the timestamp updates, or initializing it with some of the bits of the system clock, so they can't use a sudden, large change in timestamp to tell a reboot recently occurred)?

The disadvantage would be that the TCP sequence could wrap. This is a risk on very high speed networks. You can randomize the initial timestamp, however, just as you asked. It's a very simple patch, so any rejects will be trivial to fix. It requires the grsecurity patchset to already be applied.

From https://grsecurity.net/~spender/random_timestamp.diff:

diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
index 3abaf02..700e56c 100644
--- a/grsecurity/Kconfig
+++ b/grsecurity/Kconfig
@@ -925,6 +925,16 @@ config GRKERNSEC_RANDNET
      here.  Saying Y here has a similar effect as modifying
      /proc/sys/kernel/random/poolsize.

+config GRKERNSEC_RANDOM_TIMESTAMPS
+   bool "Add random offset to TCP timestamps"
+   default y if GRKERNSEC_CONFIG_AUTO
+   help
+     If you say Y here, a simple change will be made to TCP timestamp
+     behavior that will prevent the system from leaking the jiffies
+     value remotely to an attacker who has not been persistently
+     monitoring the system since boot.  The jiffies value can be used
+     to remotely determine system uptime.
+
 config GRKERNSEC_BLACKHOLE
    bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
    default y if GRKERNSEC_CONFIG_AUTO
diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
index ae6c028..c7dbe97d 100644
--- a/grsecurity/grsec_init.c
+++ b/grsecurity/grsec_init.c
@@ -7,6 +7,11 @@
 #include <linux/percpu.h>
 #include <linux/module.h>

+#ifdef CONFIG_GRKERNSEC_RANDOM_TIMESTAMPS
+__u32 random_timestamp_base __latent_entropy;
+EXPORT_SYMBOL_GPL(random_timestamp_base);
+#endif
+
 int grsec_enable_ptrace_readexec;
 int grsec_enable_setxid;
 int grsec_enable_symlinkown;
diff --git a/include/net/sock.h b/include/net/sock.h
index b2948c0..ccbeda9 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2296,4 +2296,8 @@ extern int sysctl_optmem_max;
 extern __u32 sysctl_wmem_default;
 extern __u32 sysctl_rmem_default;

+#ifdef CONFIG_GRKERNSEC_RANDOM_TIMESTAMPS
+extern __u32 random_timestamp_base;
+#endif
+
 #endif /* _SOCK_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 44a58b0..fcdca06 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -684,7 +684,11 @@ void tcp_send_window_probe(struct sock *sk);
  * to use only the low 32-bits of jiffies and hide the ugly
  * casts with the following macro.
  */
+#ifdef CONFIG_GRKERNSEC_RANDOM_TIMESTAMPS
+#define tcp_time_stamp     ((__u32)(jiffies) + random_timestamp_base)
+#else
 #define tcp_time_stamp     ((__u32)(jiffies))
+#endif

 #define tcp_flag_byte(th) (((u_int8_t *)th)[13])

diff --git a/net/core/dev.c b/net/core/dev.c
index f3e28ec..8b1cf12 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6986,6 +6986,10 @@ static int __init net_dev_init(void)

    BUG_ON(!dev_boot_phase);

+#ifdef CONFIG_GRKERNSEC_RANDOM_TIMESTAMPS
+   random_timestamp_base += prandom_u32();
+#endif
+
    if (dev_proc_init())
        goto out;

Note that newer kernels have integrated something similar to this in the time since this was posted.


Is biometric security viable in the long term? Obviously biometric security is a hot-button topic. I happen to attend a university with a well known biometrics department. (Which I'm not a part of.)

My problem is, biometrics has a large caveat: it can't be changed.

Once my fingerprint has been compromised, it is no longer useful as a security measure.
Realistically, we each leave fingerprints everywhere.

Now at the current time, people aren't out in droves stealing fingerprints. Arguably, however, it is not yet profitable to do so.

With advances in general technology, researchers have successfully stolen fingerprints using a high-resolution camera:PCMag Article

Theoretically that idea could be expanded to retina scans as well. (3-D printing, anyone?)

Even a heartbeat detection system would need changed if the user experienced a cardiac event.

So then, my question is: Do standalone biometrics have a place in security?

If a database is compromised with some sort of hash of my fingerprints, what am I supposed to do for every other place they are in use? It just seems like a major flaw.

You've asked a lot of questions in one go.

The big factor in your question is when you only use biometrics as an authentication mechanism. Typically, the biometric data is combined with other data (e.g. a password) in order to provide authentication data. In this way, fingerprints are viable because they are not the only thing a person needs.

As for the stolen database of fingerprint hashes, you are protected in that the hashes will be unique for that system. Just as passwords are hashed and salted to be unique, so would your fingerprints. If the database was stolen, then in theory, no one would be able to recreate your fingerprints.

As for changing biology over time, the typical scenario if the biometrics of a person changes (cardiac event, amputation, etc.), is that you simply reregister the info in the system. That's not a big problem. There was one prototype system that a person wore that would characterize the person's cardiac profile constantly over time, so it would slowly adjust as the person aged.

So, yes, just as a standalone password has a place in security, so does biometrics. Yes, there are challenges, but biometrics are a convenient way to bolster authentication security.


How to convince a university to address a serious security threat? Tl;Dr: I found a serious security threat in my Math department's grading system and I am not sure how to convince them to take it seriously.

I was a bit bored during a lecture so I decided to test my University's Math department grading system. I entered my username, I'll call it "Foo" as well as my password, "Foo123". The system logged in normally. Next, I used "Foo" again as username and "Foo1234" as a password. To my surprise, the system logged in! I was very intrigued at this point and so I tried again with "Foo123wkfjdbwkefbkwdhfbwkfbwkdbw" and again it logged in!

I think that the department saves the password in raw format(instead of a hash) because they clearly use a version of x.contains(real_raw_password). For example, when I posted "Foo123wkfjdbwkefbkwdhfbwkfbwkdbw", I am guessing the back-end did something along the lines of:

if ("Foo123wkfjdbwkefbkwdhfbwkfbwkdbw".contains(ActualPasswordString)):Login()
This is a very serious security threat that I think they should address, both because 1) They store the password as raw text and 2) They use a .contains on the actual string sent, when in reality I can send a string with different combinations of passwords and it would return true if any substring returns exists in it.

However, I am not sure how to approach the department and convince them that they need to address it. Any tips on how to approach it especially that it is not a CS department?

Most universities have a cyber security team or at least person, often attached to their IT department, to report findings like that. If all else fails, Call their help desk and ask who to report computer security problems.


How is a root CA offline? I'm told a root CA keeps they public/private keys totally offline. Not sure how this works with the chain of trust:

Root CA signs CA2's certificate, verifying CA2's public key
CA2 signs Bob's certificate, verifying Bob's public key
Bob uses his private key to send message to Alice, and includes his certificate
Alice wants to ensure message came from Bob, and that Bob can be trusted
Alice trusts root CA
Alice uses CA2's public key to verify Bob's certificate was trusted by CA2
Not sure: How does Alice know she can trust CA2 without verifying CA2's certificate using Root CA's public key?
Alice now trusts that Bob's certificate is trusted, and can use Bob's public key, contained within, to validate the message hasn't been tampered with.

I'm told a root CA keeps they public/private keys totally offline.

It is not a question of online vs. offline but secret vs. public. The private key is held private as the name suggests, i.e. it is only known to the CA. The public is public like the name suggests and it is included in the public certificate. This certificate is then installed on each client as trusted root. Insofar the public key of the root CA is not transferred during the TLS handshake (i.e. kept offline) because the client already has a copy of it and uses it as a trust anchor. But since the certificate is publicly known anyway it does not matter if it gets transferred through the internet (online). Still the client should only use the locally trusted CA as trust anchor and not some random CA transferred over the internet.


Using Remote Desktop to bring a 3rd party application to all my employees Recently I have been approached by various SaaS (Software as a service) providers offering me different scenarios to deliver their solutions.

One in particular has my 50 employees accessing the software via a remote desktop connection 100% of the time. Keep in mind that the software is the main tool our employees will use 8 hours per day. It handles CRM (Customer Relationship Management), Operations, AR and even payroll...

What are the risks?

With Remote Desktop, the application is not actually running on your computers, but on theirs. Your data is there. This implies a lot of things, including:

In case of loss of network connectivity, business stops.
If the SaaS provider ceases activity, you lose your tools and your data.
Any disaster (flood, fire...) affecting the server centre of the SaaS provider will impact you dearly.
All security decisions with regards to your information assets will be taken by the SaaS provider.
If you handle data classified as "personal information" then compliance to applicable regulations depends on what the SaaS provider does.
If your network connectivity is not top notch, especially with a low latency, then your 50 employees will hate the Remote Desktop immensely.

On the other hand:

Disaster on your site won't harm your data.
You might benefit from the infrastructures of the provider; e.g., the provider may offer an efficient and comprehensive backup solution for your data.
You may relocate more easily your premises, and employees may possibly telecommute.

Globally, going SaaS to that level is like marrying a polygamous man: you trust the provider exclusively with your business, but you know that the provider has some interests elsewhere as well.


XSS when some keywords are prevented on the server side When I scan website with burp suite pro, I encountered a XSS. This XSS is

When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters can't pass. For this reason burp suite report only  parameter.

As you know this means

a can be replace img
b can be replace onerror
c can be replace alert

But this parameters(img ,onerror, alert) prevented on the server side. For fix this XSS problem, input validation can be solution.

According to burp, this is XSS. Is it really dangerous XSS?  What problems might I encounter when I ignore this XSS ( )?

The problem is that there are a whole load of ways to get XSS in such a case:


Securely changing Veracrypt password How can I change a Veracrypt (master) password efficiently and securely?

Based on the answers here, it is not safe to use system --> change password due to various reasons.

I cannot simply image the device to my hard drive as it does not use FDE (I am in the process of moving towards full encryption); doing so would allow attackers to get the master key that is encrypted with a weak password from the hard drive (rather than from the device that will use a complex password).

The best solution I have come up with so far is to:

create a Veracrypt container on the hard drive using a strong one-time password (that is used to temporarily store the image of the device)
image the device and store in temporary Veracrypt container
delete old Veracrypt partition (with a weak password)
create a new Veracrypt partition on top (with a complex password)
move files from image to new Veracrypt partition

Your solution should work well enough and I believe it is the best one possible currently without destroying the USB flash drive. The problem is that the old container may leave remnants for the same reasons, why it is insecure to change the password. Namely wear-leveling.

If these remnants include the header, the attacker may be able to retrieve some files, that were not overwritten. If you are really really serious about having the data 100% secure, you should put the new container on a new flash-stick and properly destroy the old one with the container with weak password.

Alternatively, as ThoriumBR mentioned, you may decrease the chance of the remnants surviving by writing random data to the flash drive (for example making largest possible empty VeraCrypt volume and also choosing the secure deletition). This does not guarantee the data will be destroyed properly, but it increases the chance somewhat. Repeated writing to the flash memory will however lower its life-expectancy, so the flash drive will be more likely to fail.


Validate database column and table names to prevent SQLi? There are some types of software, such as ORMs and query builders, that has to concatenate column and table names into SQL queries. Since developers apparently put untrusted data in all sorts of places without seconds thoughts, a sane strategy for such a library would be to validate that the provided name is in fact a name, and not an SQLi attack.

A simple way to do that would be to match against a regex like /[a-zA-Z_]+/. However, this would limit what column names can be used. Many DBMS are quite liberal as to what column names they allow, and I don't want to introduce artificial restrictions.

So, what I am looking for is an approach to validate or sanitize database column and table names. It might be a tall order, but ideally it would:

Work for all major databases - Postgres, MySQL, Oracle, MSSQL, etc.
Limit what column names can be used as little as possible.
Be immune to SQLi.

Compromises can be made with regards to #1 and #2, but not #3.

I think your best bet is quoting.  The SQL-99 standard specifies that double quote (") is used to delimit identifiers (but your mileage with various DBs will vary). This question  has some more info on how this is handled across databases.

Oracle has a specific function for this DBMS_ASSERT.ENQUOTE_NAME - but if you're looking to go cross platform you will need to do this yourself.  Double quote the name, but check for double quotes in the string and reject the string if they aren't escaped (paired).


Why is it dangerous to open a suspicious email? I would like to know why is it considered to be dangerous to open an email from an unknown source?

I am using Gmail and I thought it's only unsafe to download an attachment and run it.

The first thing that came into my mind was what if the email text contains XSS JavaScript code but I am sure that every email provider has protected their site from getting XSS-ed.

What is going on behind the scenes when you get infected just by clicking on email and reading its content, for example on Gmail?

There is a small risk of an unknown bug — or a known but unpatched one — in your mail client allowing an attack by just viewing a message.

I think, though, that this very broad advice is also given as a defense against some types of phishing scams. Social engineering attacks are common and can lead to serious trouble. Making sure people are at least suspicious is a first line of defense. It is like telling an elderly grandparent to never give their credit card info over the phone — okay, sure, there are plenty of circumstances where doing that is relatively safe, but when they keep getting scammed over and over, it's easier to just say: don't do it.

Likewise, not opening mail keeps you from reading about the plight of an orphan in a war-torn region who has unexpectedly found a cache of Nazi gold and just needs $500 to smuggle it out and they'll share half with you, and your heart just goes out, and also that money wouldn't hurt.... Or, while you know the rule about attachments, this one says that it's pictures of the cutest kittens ever, and how can that be harmful — I'll just click it and okay now there are these boxes saying do I want to allow it, which is annoying because of course I do because I want to see the kittens....


Cookies "Secure" Flag How do cookies' "secure" flag work to determine whether cookie itself should be included?

e.g. on an HTTP (unencrypted) connection...

user has no cookie yet and tries to log in;
user logs in successfully, server should send "secure" cookie to client;

Will the server send cookies to the client via HTTP?
Is server the one who is responsible to check the connection and decide to include "secure" cookie?
Or are cookies with "secure" flag rejected on HTTP level?

The server can ask the browser to set cookies with the secure flag on over HTTP, but the browser should only include them in responses via HTTPS.

But you should never present a request for authentication over HTTP direct responses to authentication requests over HTTP. The former may be tampered with to copy the credentials elsewhere, while the latter can be sniffed.

Mixing and matching HTTP and HTTPS is not a good recipe for a secure site. They should be clearly delimited.


Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it? The unix read permission is actually the same as the execute permission, so if e.g. one process has write access it's also able to execute the same file.

This can be done pretty easily:First this process has to load the content of the file,which shall be executed, into a buffer. Afterwards it calls a function from a shared library which parses the ELF in the buffer and loads it to the right addresses(probably by overwriting the old process as usual, when calling execvp). The code jumps to the entry point of the new program and it's being executed.

I am pretty sure Dennis Ritchie and Ken Thompson were aware of that issue. So why did they even invent this permission, what is the intention behind it and what's the sense of it, if it can't prevent any process of any user having read access from executing? Is there even such a sense or is it superfluous?

Could this even be a serious security issue, are there any systems, which rely on the strength of rw- or r-- permissions?

There's an even easier way to bypass the "execute" permission: copy the program into a directory you own and set the "execute" bit.

The "execute" permission isn't a security measure.  Security is provided at a lower level, with the operating system restricting specific actions.  This is done because, on many Unix-like systems (especially in the days of Ritchie and Thompson), it's assumed that the user is able to create their own programs.  In such a situation, using the "execute" permission as a security measure is pointless, as the user can simply create their own copy of a sensitive program.

As a concrete example, running fdisk as an unprivileged user to try to scramble the hard drive's partition table:

$ /sbin/fdisk /dev/sda

Welcome to fdisk (util-linux 2.24.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

...

Changed type of partition 'Linux' to 'Hidden NTFS WinRE'.

Command (m for help): w
fdisk: failed to write disklabel: Bad file descriptor

That last line is fdisk trying to get a "write" file descriptor for the hard drive and failing, because the user I'm running it as doesn't have permission to do that.

The purpose of the "execute" permission is two-fold: 1) to tell the operating system which files are programs, and 2) to tell the user which programs they can run.  Both of these are advisory rather than mandatory: you can create a perfectly functional operating system without the permission, but it improves the user experience.

As R.. points out, there's one particular case where the "execute" permission is used for security: when a program also has the "setuid" bit set.  In this case, the "execute" permission can be used to restrict who is permitted to run the program.  Any method of bypassing the "execute" permission will also strip the "setuid" status, so there's no security risk here.


How to successfully report DoS attack coming from a big ISP? A few weeks ago I reported a small botnet which is coming from the network of a big Internet provider.

They asked me for more details which I provided. But the attack is going for weeks already and from our side it looks like they haven't done any action to stop it.

Because traffic follows very specific patterns, we managed to split and block most of it with fail2ban, but still every day we are adding new IPS to block - so far we have banned around 1700 IPS.

I expect them to inform their customers about being part of the botnet and also stop the bad traffic hitting our servers. Is it a reasonable expectation?

How long does it usually take for bigger internet providers to perform any actions against botnet?

How to successfully report DoS attack incoming from Big ISP?

I would like also to hear how in reality such requests are processed by bigger ISPs. From my current experience (it's not the first time) looks like abuse reports are to great extend ignored.

ICANN has a good article on this. Read it.

But because you seem to only be under attack from a specific ISP, I can tell you some more.

Most people have dynamic IP addresses. This means that their IP changes after at most 24 hours. So everything you banned more than 24 hours ago shouldn't be banned any more because for every given IP banned more thin 24 hours ago, now someone else has the the banned IP and can't access your service even though they didn't do anything wrong. So your policy doesn't make sense.

A better approach would be to ban all IP address blocks of the ISP you have trouble with. Then no one using that ISP can access your service and you don't have to worry about the DDoS attacks.

However, a smarter approach is to ban dynamically and for a short period of time. Enforcing a ban forever hurts others and makes your list of banned IP addresses very long, therefore it takes a long time to compare the IP address a request came from to your list.


One way Hashing: Salts' randomness or Globally uniqueness For the same input, hash functions always produce same hash everywhere globally.

This is the key point of using hashing in password verification.

If the hash for the same input is same globally then the salt must be unique for it globally. If salts are unique globally, then how hashing is safe to use? So are the salts unique globally or they are totally random? If they are totally random, then how could they still produce same hash for the same input?

It seems as though you understand that hashing is a one-way cryptographic function. A string hashed without a salt using a specific algorithm will always produce the same result. Hashes are not meant to be decrypted, they are meant to be compared to.

A string of password hashed in MD5 without a salt will always be 5f4dcc3b5aa765d61d8327deb882cf99. When the user enters their password to enter the super secret website, their password value (in this case password) is hashed, and compared to the hash that exists in the "users" table for that user. If the two hashes match then access is granted.

Because we know that a string's hash will always be the same without a salt, massive amount of strings hashes can be pre-computed in to what are called Rainbow tables. If a database gets compromised and no salt has been used, it is often trivial (depending on the algorithm and complexity of the password) to determine the password by comparing it to a hash that exists in the rainbow table.

By adding a randomly generating salt to the string and then hashing it, you make things exponentially harder to attack the hash with pre-computed rainbow tables. To do so, the attacker would have to guess what the salt would be, then generate their rainbow tables again. This becomes very inefficient and removes this as a viable option for password compromise.

So if our web application for my user-record has a salt of Sup3rS3cr3tS@l7, when I log in or change my password that salt will be appended to the password string. The value that is then hashed is Sup3rS3cr3tS@l7password and the MD5 hash becomes 8e28474b10084728115870bcae270298

Salts do NOT need to be used globally - a salt can be randomly generated at account creation and stored in a column in the users table.

DISCLAIMER Don't use MD5, as this was purely for demonstration purposes.


Can you make a digital signature using the receiver's public key? My question is, can you make a digital signature using the receiver's public key and then have the receiver verify the signature using his private key?

I always thought that in order to create a digital signature, you must use your private key and then the receiver uses the sender's public key to verify it.  However, on page 4 of this paper, the authors are saying that you can make a signature using the receiver's public key and then the receiver verifies it using his private key (see steps 4 and 5), which to me does not make sense as it does not provide any proof that the sender is who he claims to be.

This is the URL of the paper:

http://web.archive.org/web/20120916202812/http://www.msba.ca/web/images/mue09-2d-barcode-mobile-payment-final-1.pdf

Yes, this could be done, but what would the point be?  It wouldn't verify anything about the document.  A signature (slightly simplified) is just an encryption of a secure hash of a document using one of the keys in the pair.  The private key is used to prove that only the private key holder could sign it.  In the case of signing with the public key, anyone could alter the document and sign it, so it doesn't prove anything.  Not only that, the only person who would be able to verify the "signature" would be the holder of the private key, so there is absolutely no use to it.

Reading the paper, I can't see how they expect the process to work and it appears to be using the term signature in error.  What they are likely describing is protecting the session ID as a secure token by use of encrypting with the public key and then decrypting on the server with the private key.  The use of the term signature is incorrect and would not provide the necessary security in their use case.  The paper isn't very well written and has some other poorly worded sections.  I wonder if it may be a poorly translated paper where English wasn't the original language since I see one author is from Taiwan.  Though the US co-authors should have proofread it so I wouldn't trust the paper too much.

Update: On further reading I now understand what they are saying in the paper.  It is a very poorly worded summary.  They are using a system where both the merchant and the purchaser have a key pair.  The merchant provides a signed invoice which the client can verify is from the merchant.  They then sign their purchase order which includes the invoice which they are ordering.  The merchant then verifies that the client signed the purchase request and verifies that their invoice was unaltered.  It's rather a bit more convoluted than it seems to need to be, but it is accurate when you take the appropriate instances of public and private keys.


How to make sure that no one is watching you through webcam? I have heard that intelligence agencies and hackers can illicitly gain access to a computer's webcam and microphone and keep a close eye on people using suspicious programs or malware.
Is there any way to check if such thing is happening to you and are there any mechanisms to avoid it on platforms like Mac OS, Linux and Windows?

If, despite the implausibility of it, you are worried that the FBI has hacked your camera, then I'm afraid there won't be much you can do to gain back control of your camera. Therefore I can only suggest a low-tech solution: a camera cover.  This is the sort of thing you are looking for:
https://www.amazon.com/C-Slide-Sliding-Computers-Chromebooks-Consoles/dp/B00AZ639VG


Security aspect vs Security goal What is the difference between a security goal and a security aspect ? I know about the three network security goals Confidentiality, Integrity and Availability. But I do not know much about security aspects.

When you look at something from a security perspective, its security aspects emerge. That often refers to the security-related principles and concepts which are part of a particular technology. (This technology doesn't have to be about security itself.)

Examples:

  Anonymity is an important security aspect of wireless communications and has continuously attracted significant attention.

(Source)

  We know that establishing a person's identity is an important security aspect of government transactions.

(Source)

As opposed to overall security goals, security aspects are specific to a product or technology and can't be generalized in the same way.


How can I secure Wifi against these specific attacks? I have found myself in a situation where I need to setup a somewhat secure Wifi network. I am primarily concerned about these attacks, however I welcome any advice about other attacks that I should be concerned with as well:

An unauthorized party gaining access to the network without any prior knowledge (eg. by a neighbor brute-forcing the PSK)
A user that is authorized to use the network as a user (eg. no access to the router's admin panel or the RADIUS server) decrypting another user's data to violate their privacy
A 3rd party attacker (or an authorized user) that sets up an evil twin attack and is able to get the PSK (or RADIUS credentials) and/or the data itself, thus violating all users' privacy and/or accessing the network without authorization

My research tells me that the normal standard that I have used for years, WPA2 PSK with AES, is vulnerable to all but the first attack. Upon further reading, I have discovered WPA2 enterprise and that it is supposed to be more secure against these types of attacks. It appears to have many different modes, however (eg. What is the difference between EAP, PEAP, and MSCHAP?), and I am finding conflicting and incomplete information about whether or not it is vulnerable to the middle (conflicting information) and last attack (no information).

As such, I ask, what is the best way to setup Wifi to be secure against all three of these attacks? I suspect that some sort of SSH-style key will need to be given to each client, along with an AP/server key that the client can use to defend itself against evil twin attacks, but I can't find anything that precisely describes how to set this up. I am looking for instructions as precise as something like this, for high quality TLS.

An unauthorized party gaining access to the network without any prior knowledge (eg. by a neighbor brute-forcing the PSK)

If you have a sufficiently strong password, such as }H/,uj^kGbtQ(WtqjdY{KCdQT[_G@[R>Bm+~\Sb[X(3na, then the chances of an attacker recovering this password with brute force are negligibly small. Note that this doesn't prevent an attacker from gaining access to the password in other ways, such as social engineering, but it protects you from an attacker capturing a handshake and cracking it offline.

  A user that is authorized to use the network as a user (eg. no access to the router's admin panel or the RADIUS server) decrypting another user's data to violate their privacy.

WPA2-Enterprise with endpoint certificates will solve this.

  A 3rd party attacker (or an authorized user) that sets up an evil twin attack and is able to get the PSK (or RADIUS credentials) and/or the data itself, thus violating all users' privacy and/or accessing the network without authorization.

This answer by Matthew Peters excellently describes how an Evil Twin attack can be mitigated. It also includes using WPA2-Enterprise.

  But what if my client device does not support WPA2-Enterprise?

Many consumer devices, and even some business devices, are not built to support WPA2-Enterprise, such as some phones, printers, handheld game consoles, various "smart" devices, etc.

In this case, your only option lies in using WPA2-PSK, with all its associated risks. Again, using a long, randomly-generated Pre-Shared Key is the best option you have.


Running virus from real folder in Sandboxie What if I download a virus to my real folder but only execute it in Sandboxie, is it less secure that if I download it directly from SB?

What if I download a virus to my real folder but only execute it in
  Sandboxie, is it less secure that if I download it directly from SB?

Simpy downloading a virus should not pose any real threat until it is executed.That goes without saying that it doesn't matter if it is an executable or any other file format.If it is a different file format again as long as you have only downloaded it shouldn't pose any threat.That is of course assuming the browser download function isn't vulnerable in some way.


Can I add 'user-identifying noise' to MP3 files to determine which user shared my file, if I find it later on the internet? Problem
I'm streaming MP3 files to users. Users are not allowed to share these files. I know that it's in the end impossible to not let anyone download the files. That's not the problem, people can download if they really want (but still I will try to prevent it as much as possible).
No, my problem is that if someone from the network still decides to download or record the file and share it on some public space like Youtube, there's no way for me to get to know which user this was.
I have an idea to make this possible, but it has limitations and I'm not even sure if it will work.
My idea
Add 'user-identifying noise' to the MP3 files. My idea would be to add some very little noise to the MP3 file, and for each user add slightly different noise. For example, for every frame we could increment its value or not, depending on a random, repeating bitstream which is unique for each user. This is a very small difference, so no one would actually hear this.
This technique would be preferable over adding frames before or after the file itself, because this could be cut off if the user who's going to share it sees in an audio analyser that the beginning or end is 'weird'. Accidentally incrementing frames will go almost unnoticed. If it's a concern that the average may get abnormally high, we could increment for a one in the bitstream, and decrement for a zero.
Also, it wouldn't be enough to just add some value to the ID3 properties of the file, as they can be seen and removed easily.
If someone shares the file...
Now, suppose we have set everything up as described: we added some noise that can identify the user. What we have to do is subtract the values of the original MP3 file from those of the file he shared. That way we get the bitstream with which we can find the user.
Limitations
This setup will not work if a user plays the file on his computer but records it with his phone, as there will be some background noise that makes it impossible to reconstruct the user-identifying noise. It will only work if the user uses some program to record the sound his computer is making directly (thereby not introducing noise).
Also, it may be difficult (I'm not sure) to add this noise on the fly, which would be the best. If that would not be possible, it would be necessary to keep different copies of the MP3 files for each file for each user, which will cost a lot of disk space in the end.
Basically any kind of messing with the MP3 file by the user (excluding splitting, as we're using a repeated string) will break the system: speeding up/down, adding noise themselves, adding a second stream, etc.
There may be more limitations that I'm not aware of.
Questions

Will my idea actually work?
Am I reinventing the wheel? If so, what are common ways to do this?
Can something be said about how possible exactly it is to add this noise on the fly?
Do you see any possibility to make something like this work even if the user records the audio with his phone from his computer?

This method is called Audio Watermarking and it's around for a while. It's not as easy to use/implement as you think, and it's not very effective.

If you want to try, I can sugest two sites with some information on methods to watermark mp3 files.


Turned out the verbose events (about each packets) is because of the "-v" option.  After removing it, I don't see them.

The alert shows up in a file "alert" in the default directory /var/log/snort.  One can change it by the command line option -l <new directory>.

I don't know why snort is not sending the syslog using UDP socket.  "strace" command showed me it's actually using UNIX socket. Specifying the destination in configure file (emerging.conf) output alert_syslog: host=192.168.181.1:514, LOG_AUTH LOG_ALERT didn't help.  Had to put a workaround by using a script that listens on unix socket and send it using UDP socket.


DDOS - security or operational risk? The chief security officer of a medium sized IT company (400-500 employees) recently released a bulletin in which he stated that DDOS attacks are not a security risk but an operational one.
Also I was told that in a previous meeting he denied that DDOS or related attacks are his responsibility.

From my understanding security comprises three major themes:

Confidentiality, Integrity, Availability

In my opinion DDOS attacks are clearly a security risk as they directly target availability of a service - and thus are also clearly within the responsibilities of a chief security officer. So who is right?

Are DDOS attacks a security or operational risk?

I think that is a false dichotomy, and your CSO is being plain silly.

Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "responsibility" are obviously not productive, though it might fit into the general corporate culture.

While there are various ways of qualifying the realm of security and their responsibility - the CIA triad is one, but there are others - a mature, responsible CSO would at the least be pushing for a solution.

I have heard some say that the distinction between "security risk" and "operational risk" is whether there is a potential threat actor, or merely accidental or misuse.
While this does make a lot of sense, I think a more pragmatic approach would be to simply accept that there is substantial overlap between the two - and that just means there are more resources to work on the problem, not that everybody gets to abdicate responsibility.

That said - in this specific case, the process I would recommend is having the CSO (or technical people in his department) drive the mitigation procedure, define a framework for levels of risk, etc - and then hand it off to operations to implement a fitting solution. Perhaps the security folk can recommend a solution, or maybe they should just define metrics that the solution should meet, depending on how technical / hands-on the team is.

In this way, the company can handle the fact that while the risk is a security risk, the solution is an operational one.


Why can't I pretend to be someone already connected to WiFi? I mean, i know it's not possible because first there is the handshake but i'm not really 100% sure about what's happening here.

I just need clarification of why couldn't i just spoof my MAC adress to pretend that i am some PC already connected and doesn't need to enter password to WiFi. I know that i would need to know some keys but again, I'm not really sure which keys.

I asume you are talking about WPA2-PSK here - the protocol commonly used for WiFi at home or at a coffeeshop.

During the four-way handshake, when the connection is set up, both the client and the access point prove to each other that they know the Pre-Shared Key (PSK), that is "the WiFi password", without actually exchanging it. With the help of the PSK, a Pairwise Transient Key (PTK) is derived. This is a temporary symmetric encryption key that is used to encrypt all further communication between the client and the access point.

So why can't you impersonate a computer already on the network by spoofing your MAC address? Because you don't know the PTK. Everything the access points sends  will be total gibberish for you, since you can't decrypt it without the PTK. Likewise everything you send will be total gibberish for the access point, since you can't encrypt it without the PTK.

For more information on the four-way handshake, I recommend Wikipedia.


File encryption design I'm building an app and a server. The server is a node.js API with a Postgres backend.

Images created in the app will be stored at Amazon S3. Metadata about the files will be stored in Postgres.

I have zoomed in at two possible solutions for encryption keys. Both involve Amazons Presigned URLs. These URLs are generated by Amazon as a result of a call from my server.

Photo taken in app
File metadata saved to Postgres via my API
The server gets presigned URL from Amazon for uploading the files
The URL is given back to the app as a result of the call in step 2.
The app uses the URL to post the file to Amazon S3

As for the file encryption I could choose to use Amazon Key Management Service (kms), i.e. Amazon generates and keeps track of individually salted encryption keys for each file. My server would need to use the master key to get the presigned URLs generated.

Or I could choose to generate individual encryption keys for each file at my server and store these keys with the rest of the metadata in Postgres. Amazon would still do the encryption/decryption, but I would pass each individual key in the request for presigned URLs instead of passing the master key.

KMS, pro:

No encryption keys stored with the file metadata in Postgres

KMS, con:

The master key unlocks every file at S3 (but the master key can be rotated)

Custom generated keys, pro:

Easier to implement an extra user key by XOR:ing the keys. If a client won't trust my key handling they could add an extra key which only exists on the device, probably in the iOS key chain.

Custom generated keys. con:

If the Postgres database is compromised, the files at S3 might also be compromised.

I'm a programmer, not a security expert. If I need to I will consult an expert, but I thought that the experts on this forum might be able to give some more insight first.

Of course other security measures have been taken. The app only talks to the API via HTTPS and the app is authenticated with the API (using Oath2 and JWT).

I really like the presigned URL concept, as this alows the app to be clueless of any keys needed for S3 upload/download.

Should I use kms or generate keys myself?

Thanks!

Just to summary the discussion:

you need to know what kind of attacks you want to protect keys against. As we discussed you correctly mentioned pros and cons of both solutions.

I recommended to mix them up so you will use two keys - KEK (key encryption key) and DEK (data encryption key). You will have just one KEK and as many DEKs as of data stored in the database.

When you will be storing the data to the DB you will generate DEK, encrypt the data with the DEK, encrypt the DEK with KEK and store the encrypted DEK together with the data in the database. For reading, you will get data and encrypted DEK from the DB, you use KEK to decrypt DEK and DEK to decrypt the data.

DEK is supposed to be used only in memory of the application. It should not be never stored unencrypted anywhere else. And you should take care of its secure disposal from the memory immediately once it is not needed (i.e. rewrite byte buffer with zeroes and release it - be careful about strings as those are usually immutable).

The correct way of storing and using the KEK should be storing and using it inside of the HSM (KMS) in order it can't be revealed by somebody, even by server / application administrators.

The dark side of it is probably the AWS KMS price. If you would store it in config it can potentially stolen by attacker and later used decrypt the database dump. But ye, you are probably not securing an army site ;)

It is also necessary to mention that if you will ever need to change the KEK you have to re-encrypt all DEKs stored in the DB.


Is using Cloudflare, and other services that proxy your site, a security hazard? If I understand correctly, they can see all the requests that are coming in to your server. So, all POST requests (user credentials, comments user posts, and many more) can be seen by Cloudflare (responses are protected if your site just allows https). How is having one entity not a security hazard not just for your company, but for the whole internet in general? Or it's not and I'm misunderstanding something?

Your understanding is a little confused, but to address the central question first: Sure, but so is running your server on hardware owned by Amazon or Microsoft or Google, much less ever running apt install or pulling something from NPM or whatever. Just using an operating system you didn't write (or at least audit) yourself, on hardware you didn't personally create, introduces some risk... heck, I bet you even trust Let's Encrypt to have actually verified that the site you sent your password to was owned by StackExchange, rather than just issuing a cert for StackExchange to anybody who wanted one!

People trust Cloudflare for a few reasons:

The people behind Cloudflare have a reputation. It's a lot harder to get started in a field like that but once you are known to be trustworthy it's your company's most valuable asset.
It would be devastating to them, as individuals and as a business, if they were ever caught abusing that trust. The amount of money it would take to be worth more than the business as a whole or even any individual stakeholder's share is a lot.
They make a lot of legally-enforceable guarantees about how they use the access they have to your connections. Again, any breach of that would have to be tremendously valuable to make up for everything they'd lose.

At the end of the day, you have to choose who you trust. Using Cloudflare is definitely exposing yourself to some risks, but they also provide benefits (including security ones).

Not really the topic of the post, but you've got some things wrong about the risks.

If you don't use Cloudflare's proxies to any site with sensitive content (and just use them for DNS configuration and as a caching layer for your static content, with the option of quickly enabling DDOS protection if needed), Cloudflare can't see any of your requests or responses.
If you enable their proxy for a site, they can see requests and responses involving that site, regardless of whether TLS (HTTPS) is used between the user and the proxy, the proxy and your server, or both. Their proxies have to decrypt the user's request to provide the services you want (like caching responses or dealing with some kinds of attacks), and that means they also need to encrypt the response and could read or edit it before doing so (the user's TLS session is negotiated with Cloudflare, not with your server).
Putting Cloudflare in charge of your DNS in general, and particularly pointing your DNS entries at their servers and providing them with a valid TLS server cert for your domain names (which is how the proxy works), means Cloudflare is "same-origin" as your actual domain as far as the browser is concerned, and that means Cloudflare could make arbitrary requests against your server and see the responses (even if they somehow weren't visible to the proxy anyhow) just by injecting a script that makes XHR/fetch calls.

Also, Cloudflare has competition. Many cloud providers offer at least some of what Cloudflare does (though often only for back-end server hosted on their cloud), and there exist other companies that provide cloud-hosted reverse proxies for security, reliability, metrics, and/or performance benefits.


How to remove Write-Only on 'encrypted USB' from Laptop My laptop has been policy enforced to write only on Encrypted USBs like Kingston DataTraveler 4000. Other USBs are read-only and not writable.

Are there any tweaks to have this removed.

I read one from Is it possible to restrict USB keys to only certified ones, and block that key's access on other computers

If your laptop is policy-enforced, then you must petition whoever has created your policy to change it. There is no known exploit to change this (other than getting admin access, which isn't really an exploit).

I would strongly recommend against trying to break out of your policy because these protections are usually put in place for a reason, even if that reason is silly. Besides, if there is a way for you to break the policy, malicious actors can also break the policy which is a serious security risk. Regardless, the question you have linked seems to be the best way to do things.


How issuer's certificate is found to verify a given certificate? I'm trying to understand how digital signing using x509 certificates works. I read a few articles and related answers on the web, but still there are a few questions left to confirm my understanding:

This great answer of PTW-105 explains how certificate trust chain is being verified. But what is missing is how the verifying party can get the issuer's certificate which was used to sign some derived certificate. The only idea I have is that it is embedded into derived certificate as other information. In this case certificate size would grow with each level of the certificate trust tree. This was already asked as a comment, but still left unanswered.
How do client applications such as the browser or MS Word know which certification authorities are trusted root authorities? Are they just hard-coded into every application? How big is the list of root certification authorities and who manages it? What if some application developers forget to include one of the authorities (or just a new one is registered) - their certificates won't be considered trusted, will they? So is it possible that some site is trusted in Chrome, but non-trusted using Firefox (it can be derived from here).
What if an attacker manages to include his self-issued certificate into some trusted storage: it might be victim's computer trusted root certificates list, or her enterprise domain trusted certificates. I know it's unlikely scenario, but would it work?
Similar scenario to #3: patch client's application such as MS Word (or share patched version on the web for everyone to download freely) so that it considers attacker's certificate to be root certification authority. Would that work?

How verifying party can get the issuer's certificate which was used to sign some derived certificate.

The browser has a database of trusted certificates, who are known to verify identity before signing. If the derived certificate is signed by one of those, then it checks out.

However, there are some CAs known as 2nd level. In this case a certificate chain is used.

The server provides the certificate that needs to be verified.
The server provides the issuer certificate.
Following the chain, we reach the top-level certificate which is already in the browser's database of trusted certificates

Naturally, the top-level certificate issuer will be very careful about authorizing 2nd-level CAs. There is quite some process, but the important thing is that new CAs can be signed by existing ones for compatibility with older devices.

  The only idea I have is that it is embedded into derived certificate as other information.

Yes, the certificate to verify does indicate the fingerprint or similar identification of it's CA certificate. This way the browser knows which CA cert to use.

In the case of chain certification, the whole certificate is included. (#2 above) (not just the fingerprint) That certificate has the fingerprint of a top-level CA (#3 above) that is (hopefully) already in the browser's keystore.

  In this case certificate size would grow with each level of certificate trust tree.

If there are 2-3 certificates in the certification chain then yes it does take more space, (which could be considered 'certificate size') but that's hardly a problem.

As for the ever-growing browser certificate store, there is actually only a limited number of CAs, even accounting for the ones that are not top-level, so this is not a practical problem either.

  How client applications such as browser or MS Word know which certification authorities are trusted root authorities? Are they just hard-coded into every application? How big is the list of root certification authorities and who manages it? What if some application developers forget to include one of authorities (or just a new one is registered) - their certificates won't be considered trusted will they? So is it possible that some site is trusted in Chrome, but non-trusted using Firefox (it can be derived from here).

Some 2nd-level CAs could be trusted in one browser, and not in another. So the CA who issues your certificate often provides intermediate CA certs so that the apps will always be able to trace back to a top-level CA in their store.

Who manages this database? I don't know. I've heard of Google deciding to stop trusting a particular CA after they had a breach of their private key.

The CA must keep their private key secret, or else it can be used to sign any and all domains. CAs are trusted because it is known that

They have good security measures to protect their private key.
They verify ownership before issuing a certificate.
They have some means to issue certificate revocation (good topic for separate question)

  What if attacker manages to include his self-issued certificate into some trusted storage: it might be victim's computer trusted root certificates list, or her enterprise domain trusted certificates. I know it's unlikely scenario, but would it work?

If an attacker can access a victim's computer (presumably the victim has bigger problems at that point) and inserts a trusted certificate, then that attacker has means to successfully MiTM the https connections. Eavesdropping, or altering the connections at will, if he can get a device in between the victim and the server. (i.e. WiFi interception, or physical network connection)

  Similar scenario to #3: patch client's application such as MS Word (or share patched version on the web for everyone to download freely) so that it considers attacker's certificate to be root certification authority. Would that work?

Yes, but presumably if you can patch the client application then the victim has lots more to worry about.


It's there a way to bypass https nowadays? It's there a way to bypass https (using mitm attacks) on browsers like chrome, firefox, etc?

I know it could be done in some way, exploiting the NTP port, but we need the interaction of the victim. And for this interaction to happen we need a dns spoof, which we can't do because all the modern browsers are patched against this attacks.

So it's there a way?

This depends on the capabilities of the attacker and the target website. If the target website was never visited by the victim with the current browser or if the target site did not employ HSTS then attacks using sslstrip are still possible.

Beyond that stealth MITM-attacks are still possible if the victim has a CA installed as trusted on its system where the private key is known to the attacker. This could be certificates installed by the vendor, like in the case of the SuperFisch software installed by Lenovo or the CA certificate installed by Dell. Usually such known compromised CA certificates are blocked but the recent disaster with a software for secure communication between lawyers shows that even large vendors are still unaware of these problems and thus will install new CA certificates on the system with a badly secured private key. And such CA certificate could also be installed by (often ad-injecting) malware, like in case of the recent OSX/MaMi malware.

Apart from that there are attacks possible using browser extensions which simply bypass breaking HTTPS since they have access to the plain traffic. In the past multiple innocent browser extensions changed their behavior and went rouge, like described in When Browser Extensions Go Rogue.

And then of course the attacker might use vulnerabilities of the system or use social tricks to make the user install some malware, which might install a new browser extension, hijack the browser or just replace it. This way the attacker too gets access to the plain traffic.


WordPress site is infected with malware, cannot find dropper I am in a bit of an annoying situation. I inherited responsibilities of a WordPress multisite once managed from from other contractors and that site has been infected with virus dropping malware.

I am however, in a black box. The site is hosted by yet another contractor and I can't get access to their server.

They did give me a DB dump, a copy of the entire WordPress install, and a copy of the quarantined virus and scanned it myself. When I scanned it, avast and AVG found 3 BackDoor.shell with the object names of "revslider\love.php" "revslider\arhy.php" and "revslider\xxx.php"

The thing is tho, the revslider plugin is not installed. I searched the entire WordPress install for "revslider" "revolution slider" and "revolution" and didn't find anything anywhere (I was looking in the themes too).

Why would avast and AVG both tell me that revslider has something to do with it if its not installed?

What else can I look for?

Notes -
I should note that that this site is in a VM on a shared host.

Also - I have read through http://codex.wordpress.org/FAQ_My_site_was_hacked and have searched for the usual suspects:

“eval(base64_decode(…..”
“edoced_46esab…”
“getMama…”
“115,99,114,105,112,116….”
“document.write(‘

but didn't find much. I found something the this premium plugin xyz-popup but when I downloaded a fresh copy it was there too. (I am getting rid of that plugin anyway)

I am also rebuilding the server with fresh copies of plugins and themes while I investigate this.

If I understand what you mean by object name, most AVs use an object name that refers to a "class" of viruses. It may not be that the attack is specifically in revslider since you don't have it installed, but perhaps it was found using the same heuristic as is used to find the revslider virus.

I'd start by comparing the source code of the site against clean copies of wordpress and any installed plugins. That would be the quickest way to sniff out any modified code.  If that doesn't work check the database data.

Wordpress stores posts and pages in the database. These are by design allowed to hold arbitrary html/javascript. If an attacker got into the system they could have altered pages in the DB to include malicious scripting.


How many passwords does the average user know? Looking for research on the count and complexity of passwords that an average user is actively using.

Note: Also, just to be clear, by research, this is not a request for you to respond with an answer entirely based on opinions, rather than facts, references, or specific expertise. Likely the best answer would be based on analysis that is founded in statistically significant analysis on the topic.

This is a bit old (2006), but may be helpful towards your goal.
http://usabilitynews.org/password-security-what-users-know-and-what-they-actually-do/

It is based on a study of 328 undergraduate and graduate level college students from Wichita State University volunteered to participate in the survey, and these students were also regular users of the Internet with one or more password protected accounts.

  Overall, 74.9% of respondents (236) reported that they have a set of predetermined passwords that they use frequently, of those 98.3% (232) reported an average of 3.1 (SD = 2.028) passwords. More than half (59.7%, 188) reported that they do not vary the complexity of their password depending on the nature of the site they are using

The study also goes on to talk about their password creation details, complexity, etc...


How secure is Websocketd? Is it secure enough for extremely sensitive information like used in banks?

What kind of attack vectors and vulnerabilities does it have?

Is the technology used making the contraption safe enough?

In all cases the wss:// protocol would be used.

P.S I am referring to websocketd.com and its corresponding GitHub page and not to WebSocket in general, since Websocketd appears to be based on inetd.

Secure WebSockets (wss://) properly protect the data during transfer, same as HTTPS does. But outside of this the application logic might introduce enough problems to impact the security of the data, similar to just using HTTPS instead of HTTP does not magically make the application safe against things like XSS, CSRF, SQL injection... . On top of this WebSockets don't rely on the Same Origin Policy (SOP) and thus attacks like Cross-Site WebSocket Hijacking are possible unless the server side properly checks the Origin of the connection.

  Is it secure enough for extremely sensitive information like used in banks?

If properly used it is safe for sensitive data. I have no idea what you exactly mean with extremely sensitive but if these data are really extremely sensitive I would not rely on a single layer of protection in the first place.


Unable to get correct base for cracking Crypt3 SHA-512 on Linux with Python I am reading a book and it gives me a simple Python script to crack /etc/shadow passwords that were encrypted with the crypt() function. It then challenges you to amend the Python program to work with the newer Crypt3 SHA-512 algorithm used in modern Linux(es).

I am getting stuck on outputting the same hash that is stored in /etc/shadow. I have a user test1 with a password of password and /etc/shadow looks like this:

cat /etc/shadow | grep test1
test1:$6$sRgBNCzw$A3IHWJz./hdhPa1FHuN.Kn.P/2InPqGjZxxGnNUxY2I2b0t4xpogCKWkq9.Ra.XDaFSpNOb5UYhwjQMzBWrtp.:16792:0:99999:7:::

An the simplest form of my script looks like this:

import hashlib
dk = hashlib.pbkdf2_hmac('sha512',b'password',b'sRgBNCzw',5000)

Inspecting dk looks like this:

>>> dk
'.YQ\xf0\xf1\x1f\x08\x0e\x9c\xa9-E\x90\x89\xebZ\xb1\x04ao:\x00;\x9a\xcb?\xaa\x04H\x14\xb6&\x9c\x0e}#\xbd\xf5\xe6\xa5\xd6\xda|xu\x1e\xa1\xd1\x95D\x94\x15\x19 \xccEX\\\xf0g\x97|\\\xee'

Which I guess is Python's best effort at representing a binary blob as text. However, I need to compare this with the hashed value of the Crypt3 function which is:

A3IHWJz./hdhPa1FHuN.Kn.P/2InPqGjZxxGnNUxY2I2b0t4xpogCKWkq9.Ra.XDaFSpNOb5UYhwjQMzBWrtp.

Now just looking at the hashed value in the shadow file I can see it looks like base64 so I use this:

binascii.b2a_base64(binascii.hexlify(dk))

And get this:

'MmU1OTUxZjBmMTFmMDgwZTljYTkyZDQ1OTA4OWViNWFiMTA0NjE2ZjNhMDAzYjlhY2IzZmFhMDQ0ODE0YjYyNjljMGU3ZDIzYmRmNWU2YTVkNmRhN2M3ODc1MWVhMWQxOTU0NDk0MTUxOTIwY2M0NTU4NWNmMDY3OTc3YzVjZWU=\n'

Further reading has taught me that the Crypt3 function uses a slightly modified version of base64 that does away with padding and '='.

Can any one help with how I can get my hash to match the hash in /etc/shadow using Python?

Based on information in this question, I was able to successfully reproduce a hash.

After setting my password to password, I executed these commands

$ sudo grep neil /etc/shadow
neil:$6$GpNiWKnm$aToSshPrg45wXFuP/Hmkkpf8/GUYg0d/C4eU/BH7iG2QwM.C59NIVr/izGUGXzf7HjqQNmpFXhxtIxGtXNrmj0:16793:0:99999:7:::
$ python -c 'import crypt; print crypt.crypt("password", "$6$GpNiWKnm$")'
$6$GpNiWKnm$aToSshPrg45wXFuP/Hmkkpf8/GUYg0d/C4eU/BH7iG2QwM.C59NIVr/izGUGXzf7HjqQNmpFXhxtIxGtXNrmj0
$ python --version
Python 2.7.10

It should be noted that the hash algorithm that is in use can be determined by the value between the first pair of dollar signs. In this case the $6$ means it's sha-512 (reference).


Should I check if the token is valid each time a user navigates on my app? I have a Single Page Application (SPA) that communicates with an API. I've created a very simple authentication system: user logs in and gets a JSON Web Token (JWT) that's stored on user's local storage.

I also have an endpoint on the API that let's me check if the token is still valid or not.

Should I call this endpoint each time a user navigates to a different page on the SPA or should I only call it when the user wants to access areas of the site that will use the token for requests?

This depends.

If you need the token for authentication and unauthenticated users are not allowed to access anything, you should check its validity for every request.

If you only check the token when you need a part of the information from it - and are fine with anonymous access to all other sites, you don’t need to check it on every request.

Please note that it‘s easy to forget to check the token when you need no information from it yet want to restrict access for logged in users, thus checking the token all the time seems like a good idea, especially since you seem to imply that every request should have a token.


ssh -Q key not listing all key types? I am having some problems with understanding which types of host keys my SSH daemon actually provides or supports (stock debian buster, sshd 7.9.p1). From the manual (man sshd_config):

 HostKeyAlgorithms
         Specifies the host key algorithms that the server offers.  The default for this option is:

            ecdsa-sha2-nistp256-cert-v01@openssh.com,
            ecdsa-sha2-nistp384-cert-v01@openssh.com,
            ecdsa-sha2-nistp521-cert-v01@openssh.com,
            ssh-ed25519-cert-v01@openssh.com,
            rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,
            ssh-rsa-cert-v01@openssh.com,
            ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
            ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa

         The list of available key types may also be obtained using "ssh -Q key".

Please note the last line. When following the advice given there:
root@odysseus /var/log # ssh -Q key
ssh-ed25519
ssh-ed25519-cert-v01@openssh.com
ssh-rsa
ssh-dss
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
ssh-rsa-cert-v01@openssh.com
ssh-dss-cert-v01@openssh.com
ecdsa-sha2-nistp256-cert-v01@openssh.com
ecdsa-sha2-nistp384-cert-v01@openssh.com
ecdsa-sha2-nistp521-cert-v01@openssh.com

I've got two questions:

As an example, the man page states that rsa-sha2-256 is part of the default for HostKeyAlgorithms. But this string does not appear in the output of ssh -Q key.
How does this fit together? How can something be a default which even doesn't exist?
The above example implies that ssh-rsa might be insecure, because it doesn't have sha2 in its name, and thus might be sha1 or even md5 based.

What does the string -cert-v01@openssh.com in some of the algorithm type names mean? Are these the types for certificate-based authentication?

What you're asking for here with ssh -Q key is a listing of all the key types.  With the rsa-sha2-256 signature algorithm, as well as the obsolete ssh-rsa (RSA with SHA-1) algorithm, the key type is still ssh-rsa, since both types of signatures use the exact same key.  If you want to know what signature types are available, run ssh -Q sig (example from my Debian sid system):
$ ssh -Q sig
ssh-ed25519
sk-ssh-ed25519@openssh.com
ssh-rsa
rsa-sha2-256
rsa-sha2-512
ssh-dss
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
sk-ecdsa-sha2-nistp256@openssh.com
webauthn-sk-ecdsa-sha2-nistp256@openssh.com

On newer versions of OpenSSH, you also have ssh -Q HostKeyAlgorithms, which prints the values that are valid in that option:
$ ssh -Q HostKeyAlgorithms
ssh-ed25519
ssh-ed25519-cert-v01@openssh.com
sk-ssh-ed25519@openssh.com
sk-ssh-ed25519-cert-v01@openssh.com
ssh-rsa
rsa-sha2-256
rsa-sha2-512
ssh-dss
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
sk-ecdsa-sha2-nistp256@openssh.com
webauthn-sk-ecdsa-sha2-nistp256@openssh.com
ssh-rsa-cert-v01@openssh.com
rsa-sha2-256-cert-v01@openssh.com
rsa-sha2-512-cert-v01@openssh.com
ssh-dss-cert-v01@openssh.com
ecdsa-sha2-nistp256-cert-v01@openssh.com
ecdsa-sha2-nistp384-cert-v01@openssh.com
ecdsa-sha2-nistp521-cert-v01@openssh.com
sk-ecdsa-sha2-nistp256-cert-v01@openssh.com

Note that whether your fingerprint is SHA-2 or not has nothing to do with the signature algorithm.  If you generate an RSA key, it can be used for both SHA-1 and SHA-2 signature unless you specify otherwise.  You would typically want to remove ssh-rsa from the HostKeyAlgorithms option unless you have a compelling reason to use it, or you can just solve the problem entirely by using an Ed25519 key, which always uses a secure algorithm.
The -cert-v01@openssh.com type indicates an OpenSSH certificate.  This is useful if you have a controlled environment, like a company, and you want to create a certificate authority to sign OpenSSH keys and restrict access to only those keys.