In WPA2-Enterprise, where does AES come in? WPA2-Enterprise uses 802.1X to facilitate authentication, but when and how is CCMP/AES used to encrypt the data after the authentication is completed?

Let us say you want to use PEAP, and the TLS tunnel is established after the RADIUS server presents its certificate. Does this tunnel close after the 802.1X port is opened, and AES takes over? Also, if AES takes over, what is used as the key?

PEAP is an authentication protocol which reuses TLS to establish a secure sort-of tunnel between the client and the authentication server. Nominally, SSL/TLS uses a bidirectional full-duplex transport medium (such as a TCP connection) and provides a bidirectional full-duplex tunnel. However, the initial parts of SSL/TLS (the "handshake") can be expressed as messages where each involved party knows, at any time, who should speak next. Thus, this handshake can be mapped to a request-response transport medium, and that's what PEAP does.

There is a nice overview schema on the Wikipedia page. The supplicant (i.e. the client system, aka your laptop) talks to the authentication server through EAP frames which are relayed by the access point. These EAP frames contains, for PEAP, a streamlined TLS handshake, which is then used to convey the credentials (usually, user name and password) from the supplicant to the authentication server; moreover, the "master secret" which is obtained through the TLS handshake is used as one of the sources for the derivation of a new key which is given to the client and the access point. See the EAP-TLS draft (section 2.5) for details.

The whole thing is complex (in my opinion, quite more complex than what it would need to be) but the core idea is that the authentication protocol is encapsulated in EAP frames and results in an authenticated symmetric key (here, the authentication protocol reuses parts of TLS). Then the symmetric key is used for encryption between the supplicant and the access point, with AES (in CCM mode), completely outside of TLS; the TLS handshake performed within the authentication protocol has played its role, and that TLS tunnel is no longer used.


Is AES easier to crack when the input is small? Say you just want to encrypt a number. For example, say the number could be any  double. A double in C# and Java is 8 bytes.

If you were to encrypt a double using AES:

var cypherText = AES.Encrypt(123d); // 8 bytes

would that be trivial to crack? If not would it at least be significantly easier to crack than the cyphertext from a larger input:

var largeText = GetDeclarationOfIndependence(); // 6760 ascii characters, so 6760 bytes
var cypherText = AES.Encrypt(largeText);

No, Unless...

It shouldn't be possible to "brute-force" possibilities unless you provide an oracle for an attacker to utilize.

An oracle in this case allows the attacker to feed as much chosen plaintext as they'd like into your encryptor, and receive encrypted output to check against.

If this is the case, you need to safeguard your data, preferably by setting an Initialization Vector for a block cipher mode like CBC or CTR (use GCM if possible), and making it so that the IV is chosen by the oracle (and not by the attacker).

Though you should really be doing this anyway.

I don't think the approach of padding your blocks with random data would be very effective in an attack against an oracle.

It could possibly mitigate an attack in the extreme edge case of only having 1 block of encrypted data, but it wouldn't be nearly as effective as just properly setting an Initialization Vector.

tl;dr No, unless there's an oracle for an attacker to exploit. If there is, make sure you're setting the initialization vector (oracle-side).


How to encrypt and authenticate large amounts of data with NaCl In a current project the NaCl-library crypto_box function has been used to encode and crypto_box_open to authenticate and decode data.

However the library does not seem to support de- / encoding of large amounts of data, since the message and the buffer for the cipher text (plus nonce) as well have to be allocated in memory (The application has to run on smartphones and therefore must not consume too much memory).

Reading the documentation I came across the crypto_stream_xor function which may allow to encrypt custom-sized portions of data, for example delivered through a stream. However a MAC still needs to be generated to detect message tampering.

Is there any built in way to generate and verify the MAC on a large message m or has this to be dealt with on an upper level of communication by splitting large amounts of data in several authenticated, encrypted packages?

The NaCl API is designed to work on an entire message at a time for a reason: The largest message you are willing to handle is the largest amount of memory that an attacker can waste in a denial of service attack on the receiver of the message.  You probably want to limit this to something small like a single IP packet, or a single megabyte, or similar.

You should break your data up into smaller pieces, and authenticate them in order, e.g. with the piece sequence number or byte offset figured into the nonce or associated data.  The overhead of an authentication tag is a mere 16 bytes, which is trifling in comparison to a megabyte of data.

Although this means you can confidently act on each piece of data in your pile as soon as you have verified it, doing so also means that you have to be able to handle truncation of the data partway through.  (But it's better to merely have to deal with truncation than to be tempted to operate on unauthenticated data, which is pure evil—don't touch it!)

There are some existing generic systems for authenticated encryption of streams, like miscreant.


2 External IPs to prevent DDoS? In my home network, I currently have a Hitron cgnm-2250 acting as a modem/router combo with an IP Passthrough option enabled for a 2nd router connected to it (ddwrt nighthawk x6 r8000). I already have the 2 external IPs showing for each device, but my issue is getting DDoS'ed offline.

I have my computer that I stream off of connected directly to the Hitron, and my gaming consoles connected to my Nighthawk. People are obtaining the external IP address assigned to the Nighthawk router and are DDoSing that IP. The external IP assigned to the Hitron is safe from being DDoSed as the players only see the IP of the Nighthawk. I have the QoS setting on the nighthawk so it can use a max of 25% of my total bandwidth, this is theoretically to prevent all the bandwidth being used when I am being DDoSed.

So my question is why are these DDoS attacks bringing down the entire network? Shouldn't these attacks only affect/bring down my nighthawk because the Hitron shouldn't be handling any of that traffic? I theoretically should have even bandwidth leftover for the Hitron to run the stream and other applications. My end goal is to only have the consoles knocked offline and the computer stay connected.

Any solutions to this? I would prefer not to use a VPN to prevent these DDoS attacks as my speeds take a huge hit.

Your Hitron device is still acting as a gateway. This means that any traffic targeted to your second device must be handled by the Hitron. When the Hitron device is running out of resources, every host which is using the Hitron as a gateway is affected.

First of all, it's not very effective to work around this issue without a external gateway like VPN. However you could evaluate the possibility to get a secondary, physically separated connection. (In Germany for example there's the option to use the TV cable for internet besides the phone line) You could also ask your ISP for help.


difference between rc4-40 and rc4 in OpenSSL I was testing rc4-40 out with a 200-bit key (25 bytes) and, to my surprise, the results were the same as they were with rc4:

<?php
$key_size = 25;
$key = '';
for ($i = 0; $i < $key_size; $i++) {
    $key.= chr(mt_rand(0, 255));
}

$a = openssl_encrypt(str_repeat('z', 50), 'rc4-40', $key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING);
$b = openssl_encrypt(str_repeat('z', 50), 'rc4', $key, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING);

echo $a == $b ? 'good' : 'bad';

Source: https://3v4l.org/7n0VC

It was my understanding, based on posts like RC4 doesn't work correctly with openssl command?, that rc4-40 only supported 40-bit keys and rc4 only supported 128-bit keys. But here we have them both seemingly supporting a 200-bit key.

Even https://wiki.openssl.org/index.php/Manual:Enc(1) gives the idea that rc4-40 is fixed at 40-bits and rc4 is fixed at 128-bits (both of which would seem to be disproven by the above code):

 rc4                128 bit RC4
 rc4-64             64 bit RC4
 rc4-40             40 bit RC4

Even if rc4, in this example, simply truncated keys that were to long to 128-bits and rc4-40 truncated longer than supported keys to 40-bits, it still stands to reason that the results would be different, but they're not.

So why does all the literature online imply that they're fixed length when my own tests suggest that they're not?

From https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States:

  The export of cryptographic technology and devices from the United States was severely restricted by U.S. law until 1992, but was gradually eased until 2000; some restrictions still remain.
  […]
  In 1992, a deal between NSA and the SPA made 40-bit RC2 and RC4 encryption easily exportable using a Commodity Jurisdiction (which transferred control from the State Department to the Commerce Department).

So this is a remainder (and reminder) of those times when software was only allowed to be exported with very weak ciphers.


Encryption: Files that can't be encrypted/cryptolocker family doesn't encrypt? Are there any type of file whatsoever that can -not- be encrypted? Is there any data that can't be encrypted by the regular RSA encryption methods?

Also, does anyone know what files the cryptolocker family actually encrypts? Are there any file-types that are safe at the moment?

No, any data can be encrypted. There are some types of data it doesn't make much sense to encrypt (e.g. data which is already encrypted), but there is nothing that inherently prevents you from doing it. Remember that most encryption algorithms don't work on files internally - they work on streams of bits. Since all files are made of streams of bits, they don't care what the actual content is, and will happily output a different stream of bits which we call the ciphertext or encrypted file.

As a result of this, technically there are no restrictions on what any ransomware could encrypt. It would be entirely feasible to have a ransomware application which used the Truecrypt source and performed full disk encryption, leaving a minimal boot area prompting for a decryption key once you've paid the ransom.

Any files which aren't encrypted by cryptolocker or other similar malware are down to specific choices by the designers. They may have decided that encrypting .dll files was likely to break Windows too much for the user to be able to access the payment methods, or that no-one cared enough about their .bat files to make it worth encrypting them. This also suggests that relying on specific file types not being encrypted is a bad strategy, since it would be trivial for the designers to change these at any point.


Force a device to give up its IP address? Expanding to a previous question where I asked if it would be possible to redirect traffic on a port from another device to my local device, if a PC on my network (device A) has the IP address 192.168.1.2, would it be possible for another PC (device B) that has an IP address 192.168.1.3 to force-use the IP address 192.168.1.2 in a way that causes device A to lose network access through that IP? If yes, how would that be possible or how can I prevent this type of attack?

For testing, I tried to use the IP 192.168.1.2 on 2 devices on the same network with ARP checking disabled. Only device A was responding, but I'm not sure if there is a type of attack that can cause device A to stop responding and I wasn't able to find this information online, so any answer would be greatly appreciated!

This would be an "attack" that would prevent only devices that don't know the MAC address/IP correspondence to talk to Device A. Under normal circumstances they would have the MAC address of Device A in their ARP cache.

If however this cache expires or a new device is connected to the LAN (the same broadcast domain) then the ARP request "who has 192.168.1.2" would be answered by two different machines. Quoting from Networking Basics: How ARP Works:

  In the case where multiple machines have the same IP address, you may
  get multiple responses. The one that gets placed in the ARP table can
  vary depending on the networking implementation, how busy hosts are,
  and how quickly they respond, etc...

Your concern is unavailability of Device A but another thing that can happen is for an attacker to be a man-in-the-middle: Inform you Device A that he has the IP of the gateway and inform the gateway that he has the IP of Device A. He will thus make all traffic to and from Device A pass from the eavesdropping system in the middle.


BLE 4.2 LE Secure Connection I am looking at getting the most secure connection between two BLE devices without an I/O capabilities but I am slightly confused by what is going on.

So without I/O capabilities the highest security I can use is Security mode 1 and Security level 'Unauthenticated pairing with encryption'.

However I understand with BLE 4.2 there is the ECDH implementation (LE Secure) to protect against MITM attacks. However I can only see this option with Security mode 1 and 'Authenticated LE Secure Connections pairing with encryption... but this requires I/O capabilities.

However from what I can see implementing the ECDH is specifically for a situation where you have an insecure channel, i.e. no I/O capabilities. Does this mean that with Security mode 1 and security level 'Unauthenticated pairing with encryption' I am using the ECDH with MITM protection?

Any help would be greatly appreciated!

Unauthenticated pairing with encryption is vulnerable to man-in-the-middle attacks by virtue of being unauthenticated. The use of ECDH does not protect from active MITM attacks, only from passive monitoring. It is a misconception to believe that ECDH (or any other key exchange mechanism) on its own can protect against such attacks. Another answer explains how ECDH protects against only passive attacks, but is never able to protect from an active attack such as an MITM.

Unauthenticated pairing without encryption does not protect from any attack.
Unauthenticated pairing with encryption protects only from passive attacks.
Authenticated pairing with encryption protects from both passive and active attacks.


How to detect self destructing emails? How to prevent from self destruction? Recently I came across a gmail extension for Chrome browsers which claims to send self destructive emails. I tested by sending self destructive emails to my email account and it works fine

Now my questions are few:

Is there any way to determine if the email I receive is an self destructive email?
Is there any way to prevent it from self destruction?

It is not possible to create a digital communication that will self-destruct after a certain amount of time (or upon sender's command).  This because of the nature of the message, which once reaches the recipient' machine can be copied at will.  This applies to email as well as instant messages.

Therefore any service promising you messages that self-destruct after some time (e.g. Snapchat) simply do not work.

The golden rule to remember in digital communications is that once you send a message, you have no control over it.

> any way to prevent it from self destruction?

Simply copy the message text, with full headers, and paste it into another window. (Or forward the message to another email address you control. Or start a reply quoting the original message, and save the draft. I don't know how this Gmail extension works, but if it allows this, it's dumber than I thought.)


How can SharedArrayBuffer be used for timing attacks? Since this new class of attacks involves measuring precise time intervals, as a partial, short-term, mitigation we are disabling or reducing the precision of several time sources in Firefox. The precision of performance.now() has been reduced from 5μs to 20μs, and the SharedArrayBuffer feature has been disabled because it can be used to construct a high-resolution timer.
Mozilla Foundation Security Advisory 2018-01

How can SharedArrayBuffer be used to construct a high-resolution timer? Isn't it just a buffer with special rules that allow it to be directly passed to another context rather than cloning it?

SharedArrayBuffer allows two threads to share state, so one can operate as a "clock" (incrementing the timing signal) and the other can read the "clock".  Additionally, the availability of the Atomics object allows performing operations on the SharedArrayBuffer in a fashion that makes incrementing efficient and can be seen by the reading thread without the risk of a race condition.

This timer is, admittedly, only in units of "how fast the other thread increments" and not "seconds", but for timing attacks, the interesting data for an attacker is relative timing.  Knowing that a given cache line (in the case of Spectre) loads faster than others reveals that it has been precached by the CPU.  The same holds true for timing attacks on things like password comparisons (correct characters take some proportion longer than incorrect characters).

It would be possible to calibrate a fast timing loop against a known clock reference (i.e., from performance.now()) to get an average time per increment, but there would still be some small jitter.


Why does tls_version "TLS 1.2" from howsmyssl rate "Probably Okay" in Chrome on Windows 10 but "Bad" in IE11 on Windows 7? I'm implementing an API endpoint based on howsmyssl to check the TLS version of clients then notify those clients about whether or not they passed the test. However, several clients have reported failing the test on our site but passing Salesforce's test of the same thing.

Why does tls_version "TLS 1.2" from howsmyssl rate "Probably Okay" in Chrome on Windows 10 but "Bad" in IE11 on Windows 7? Is it just the fact that IE11 supports "insecure_cipher_suites"? Here are the JSON responses for reference:

Chrome on Windows 10

{
    "given_cipher_suites":
    [
        "TLS_GREASE_IS_THE_WORD_0A",
        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
        "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
        "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
        "TLS_RSA_WITH_AES_128_GCM_SHA256",
        "TLS_RSA_WITH_AES_256_GCM_SHA384",
        "TLS_RSA_WITH_AES_128_CBC_SHA",
        "TLS_RSA_WITH_AES_256_CBC_SHA",
        "TLS_RSA_WITH_3DES_EDE_CBC_SHA"
    ],
    "ephemeral_keys_supported": true,
    "session_ticket_supported": true,
    "tls_compression_supported": false,
    "unknown_cipher_suite_supported": false,
    "beast_vuln": false,
    "able_to_detect_n_minus_one_splitting": false,
    "insecure_cipher_suites": {},
    "tls_version": "TLS 1.2",
    "rating": "Probably Okay"
}

IE11 on Windows 7

{
    "given_cipher_suites":
    [
        "TLS_RSA_WITH_AES_128_CBC_SHA256",
        "TLS_RSA_WITH_AES_128_CBC_SHA",
        "TLS_RSA_WITH_AES_256_CBC_SHA256",
        "TLS_RSA_WITH_AES_256_CBC_SHA",
        "TLS_RSA_WITH_RC4_128_SHA",
        "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
        "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
        "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
        "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
        "TLS_RSA_WITH_RC4_128_MD5"
    ],
    "ephemeral_keys_supported": true,
    "session_ticket_supported": false,
    "tls_compression_supported": false,
    "unknown_cipher_suite_supported": false,
    "beast_vuln": false,
    "able_to_detect_n_minus_one_splitting": false,
    "insecure_cipher_suites": {
        "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA": ["uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order"],
        "TLS_RSA_WITH_3DES_EDE_CBC_SHA": ["uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order"],
        "TLS_RSA_WITH_RC4_128_MD5": ["uses RC4 which has insecure biases in its output"],
        "TLS_RSA_WITH_RC4_128_SHA": ["uses RC4 which has insecure biases in its output"]
    },
    "tls_version": "TLS 1.2",
    "rating": "Bad"
}

Well, from the error message you posted, your IE11 is willing to use some really out of date and broken crypto, but the Chrome does not. That tool even gives you a helpful description of why each one is considered insecure / vulnerable:

"insecure_cipher_suites": {
    "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA": ["uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order"],
    "TLS_RSA_WITH_3DES_EDE_CBC_SHA": ["uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order"],
    "TLS_RSA_WITH_RC4_128_MD5": ["uses RC4 which has insecure biases in its output"],
    "TLS_RSA_WITH_RC4_128_SHA": ["uses RC4 which has insecure biases in its output"]

Scanning that list of cipher suites with my human eyes, I would agree that the Chrome list is "probably ok" and the IE list is "bad", for exactly the same reasons as stated in the error message. Those are old and insecure, a browser should not be suggesting them to the server. If the server doesn't support any of the new good things, the browser should refuse to display the padlock.

Note that TLS 1.2 is just the version of the protocol (message types), and has almost nothing to do with the crypto. You want to be on TLS 1.2 because it gives you access to the good stuff that's not in 1.1, but 1.2 also supports old bad stuff for backwards compatibility reasons.


Is a Master's in infosec required to break into the security field? So I'm going to be graduating college in January 2013, with a double major in Compsci and Cell Biology (don't ask...). I'm really looking to break into the information security field as a consultant. (Ideally, risk management)

I would like to start working straight out of undergrad... I'll have been in school for 6 and a half years when I do graduate, and I'd like to take some time off and visit the real world before I decide to jump into a Master's degree program.
So I guess what I'm asking is, to pursue a job as a consultant, would I necessarily need to complete my master's?

In terms of certifications, I have my security+ right now, and I'm going to see about getting my CISSP as soon as I get my bachelors (I believe the pre-reqs for the CISSP are either 3 years of work experience or a college degree), and I'll probably look into getting my GISP next summer (unless I get an internship).

The reason I list my pedigree is because I've heard arguments back and forth that relevant certifications are never a bad idea. On the other hand, I've also heard that getting too many certifications in a field gets kind of redundant... like the CISSP will cover a very decent chunk of what's covered in the GISP, minus some management stuff.

So I guess this turned into kind of a long-winded, two part question with no real definite answer:

1) To an experienced security professional/hiring manager, will my resume get flushed down the proverbial toilet because of my lack of a Masters?

2) Are my efforts to grab several big-name certifications worth it?

Thanks in advance for your help.

Your lack of a master's degree won't make any difference, but your lack of any relevant work experience will kill you (unless you've got a few years working in IT security that you've not mentioned). Before you can work as a consultant in any field, you need to be able to demonstrate a track record of proven achievement, not just academic study.


Content Blockers decrypting SSL I have heard about some content blockers decrypting SSL/HTTPS connections at the gateway and selectively blocking based on the content.

What are the privacy concerns about this? Is there a way for websites to prevent this from happening to their users? (Does HSTS prevent it?)

What are the privacy concerns about this?

Content analysis by intercepting SSL as an active man in the middle can only be done if the client trusts the CA of the man in the middle because this CA issues a new certificate. Thus it will usually only work transparently in company networks where the systems are managed in a central way and such CA's can get installed. It will also work if the user overrides the warnings or if the software does not properly validate certificates.

If the interception is done by a trusted party (i.e. employer or similar) which has control to the system anyway then the additional privacy implications due to SSL interception are probably less a problem because this trusted party has access to the system already and thus could in theory also grab the plain data outside the encrypted connection.

Privacy implications are more severe if the user is not aware of the inspection and thus transfers sensitive data in the believe that they can not be intercepted. This is especially problematic if these are private data. But, use of company controlled systems for handling sensitive private data is a problem anyway and is not restricted to SSL interception.

Apart from these legal interception there are illegal ways by using trusted certificates known to the attacker. From my understanding of the question this is not what you ask about, but see the story about Superfish adware for an example.

  Is there a way for websites to prevent this from happening to their users?

It is hard for websites to detect SSL interception but it would be possible in many cases. Since the SSL interception essentially terminates the SSL connection from the client at the MITM proxy and creates another SSL connection from the proxy to the server the TLS handshake hitting the server will be from the MITM proxy and not the original client. By fingerprinting the handshakes and comparing to typical browsers and MITM solutions it is possible to determine if SSL interception is probably done. For more details see the chapter TLS Implementation Heuristics in The Security Impact of HTTPS Interception.

But, in reality the necessary information to fingerprint the TLS stack are not exposed to the application but are kept inside the TLS engine of the web server. Thus a web application itself can usually not determine if TLS inspection is done or not.

Another way to deter SSL interception from the server side is to require client certificates. Most SSL interception solutions cannot deal with these and even if they could they would need to re-issue the client certificate the same way as they do with the server certificate which can be detected by the server because the issuer CA is not trusted. Unfortunately, this would mean that you would first need to issue certificates to all your clients which they need to install. While useful if you want to use these certificates for authentication of the client anyway it would be a logistic and usability nightmare in most cases.

  Does HSTS prevent it?

HSTS just says that the site should be accessed by HTTPS only. Since the site still gets accessed by HTTPS even though the traffic gets intercepted this header will not help. More useful in theory might be certificate pinning, either by using the HPKP header or using built-in pinsets. But while key pinning would detect if the certificate got changed due to SSL interception it is explicitly disabled if the new certificate was issued by a CA which got explicitly added as trusted. This is done to support legal SSL interception like done in companies but also within many antivirus products.


Fraud Mitigation - Card Present Transactions When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent transactions. Examples being:

BIN validations
Device Profiling
Geo validations

My question however is about card present transactions that is available for all cards? (This excludes EMV for the most part) What are the techniques that are utilized to deal with this flavor of fraud prevention? Are there any resources one can use to learn more about this?

The industry's answer to this is Chip-and-PIN (as it's known in the UK), where the card holder must enter their personal identification number into the card terminal for every card-present transaction. It has reduced card-present fraud by around 80%. Unfortunately, it has not yet seen widespread deployment in the US, which is causing problems for US card holders trying to use their cards in Europe.


Can visiting Pirate Bay itself give you malware? So I have a MacBook running High Sierra latest version and I decided to go to the Pirate Bay search engine  for the first time just for seeing how it looks and just some research. So I searched for Adobe photoshop for Mac and it showed up I clicked to download and it redirected me to a scam website with loud beep noises saying that I have a virus, I know this kind of scam. So I ignored it. Then when I clicked download again it didn't download a torrent file but a dmg file called "Easy Setup.dmg" I didn't run it because I knew again it will just install malware on my Mac.

But now I feel paranoid, that I could have got malware by just visiting the pirate bay search engine because I think javascript allows that. Correct me if I am wrong.

PS. I have heard that MacOS is sandboxed and prevents malware from reaching the heart of the machine but does it protect against remote access and key loggers?

TL;DR YES,  visiting any site can in principle give you malware.

Even legitimate sites with a proven history of security might be at risk because, for example, they might be sporting ads, and those ads aren't in the site's control, but come from a third party that might have been compromised, or might have poor security and not be aware of the fact that what was supplied as an "advertising banner" by an apparently legitimate advertiser, and pulled to thousands of sites for their visitors to see, was actually malware.

  But now I feel paranoid, that I could have got malware by just visiting the pirate bay search engine because I think javascript allows that. Correct me if I am wrong.

It depends on the browser (you can browse the CVE repository for any specific browser; this is the map for Mozilla Firefox). Which is why you want to always have it updated and with the security patches installed. Windows is a bit more vulnerable due to the support for WSH, which supplies an additional attack vector. But there are lots of such vectors; for example, again with Firefox (but don't think the other browser are safer), in 2016 there was WebGL on Linux systems too:

Confidentiality Impact     Complete (There is total information disclosure,
                            resulting in all system files being revealed.)
Integrity Impact           Complete (There is a total compromise of system integrity.
                            There is a complete loss of system protection, resulting
                            in the entire system being compromised.)
Access Complexity          Medium (The access conditions are somewhat specialized.
                           Some preconditions must be satistified to exploit)

Usual tricks include:

downloading some script that will then try to infect other websites you might be visiting,
popping up some ads when you least expect them,
cheat other websites by making you unwittingly generate traffic,
directly exploiting your machine as part of a "botnet" for:

running DDoSes,
mining bitcoins,
sending spam,
bruteforcing other sites,
running distributed operations to circumvent some services' request limit from a single IP or subnet

Usually these tricks aren't persistent if the browser is properly hardened, and when you close the browser, they halt. Though they will try to persist themselves, so if your armor has a chink they can exploit...

And, of course, nothing can help you if you willingly download something and then consent to have it running.

Regarding "cracks", consider that when running one, you're basically trusting that someone you don't know went to all the trouble of researching, writing and distributing the crack, breaking the law and risking fines or even jail time, just to do you a favor - for free. And also that the cracked program will keep working correctly and without unwanted side effects for the reasonable future. From a purely rational and non-moral point of view, both of these assumptions looks quite unbalanced towards the ass part, and conducive to poor security.

  PS. I have heard that MacOS is sandboxed and prevents malware from reaching the heart of the machine but does it protect against remote access and key loggers?

The 'sandboxing' your refer to is probably privilege separation. This means that whatever you do as an ordinary user cannot propagate outside your user's account "sandbox". The problem is that you work inside that sandbox, so you're still vulnerable to malware even if the other users of the same machine aren't. For this reason some users have two accounts, one for browsing and one for work. Not a perfect protection, but better than none, at the expense of some nuisance when you switch from the one to the other.

Remote access usually requires higher privileges, so you're almost certainly protected from that.

For the rest, you need an updated antivirus; and just to be sure, an encrypted backup of your data, kept current and tested every now and then, somewhere different than where your PC is. Sometimes you defend against hackers only to be burgled out of your data.


What CryptoPP APIs Output Round By Round Results for AES Encryption/Decryption? I created a program using CryptoPP APIs to implement AES ECB mode with a 128 bit key for encryption/decryption of user input plaintext.  I know that ECB is the least secure AES mode but it is sufficient for my program which is only for basic demonstrative purposes.

I would like to capture the output of the round by results when my program applies the AES ECB encryption and decryption operations.  Does CryptoPP provide APIs to do this?

In other words, when my program performs encryption on the user input plaintext, I would like to output the ciphertext produced by each of the 10 rounds involved in the encryption operation.  Similarly, when my program performs decryption on the AES ECB generated ciphertext, I would like to output the recovered plaintext produced by each of the 10 rounds involved in the decryption operation.

My program generates a key (with AutoSeededRandomPool's GenerateBlock API), performs encryption (by passing an "ECB_Mode ::Encryption" instance into a StreamTransformationFilter) and performs decryption (by passing an "ECB_Mode ::Decryption" instance into a StreamTransformationFilter).  My program prompts the user for plaintext to operate on, outputs the ciphertext produced by applying CryptoPP's AES ECB encryption API on the plaintext, and then outputs the plaintext recovered by applying CryptoPP's AEC ECB decryption API.

I'm posting this question after unsuccessfully researching CryptoPP resources for ways to output round by round AES operation results.  Many thanks for any assistance provided.

In fact, "output of each round" is not well-defined. The structure of AES encryption is a sequence of operations that looks like this:

Cipher(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)])
begin
   byte  state[4,Nb]
   state = in
   AddRoundKey(state, w[0, Nb-1])
   // See Sec. 5.1.4
   for round = 1 step 1 to Nr–1
      SubBytes(state)
      // See Sec. 5.1.1
      ShiftRows(state)
      // See Sec. 5.1.2
      MixColumns(state)
      // See Sec. 5.1.3
      AddRoundKey(state, w[round*Nb, (round+1)*Nb-1])
   end for
   SubBytes(state)
   ShiftRows(state)
   AddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb-1])
   out = state
end

This pesudo-code is extracted straight from the AES specification (FIPS 197). AES (with a 128-bit key) can be defined as consisting in ten rounds, where each round consists in a few operations (SubBytes, ShiftRows, MixColumns, AddRoundKey). However, that description would have to be amended with an extra AddRoundKey, and without a MixColumns in the final round. The pseudo-code above is structured as nine rounds, where each round is the sequence SubBytes-ShiftRows-MixColumns-AddRoundKey; and there are a few operations before and after this sequence of nine rounds.

What constitutes a "round" is arbitrary here; it would have been equally valid to define a round as the sequence ShiftRows-MixColumns-AddRoundKey-SubBytes; the starting and ending operations would have been a bit different. Neither description is more standard or correct than any other.

A further complication is that the sequence of operations is amenable to algebraic transformations. For instance, ShiftRows and SubBytes commute; and AddRoundKey and MixColumns can be done in reverse order, provided that the subkeys are transformed accordingly; this is described in FIPS 197, section 5.3.5, for AES decryption ("Equivalent Inverse Cipher"). This augments the number of possible descriptions of AES rounds.

Moreover, "normal" AES implementations (based on tables) will merge some operations together, typically SubBytes, ShiftRows and MixColumns, by the magic of linear algebra. Since they don't really occur as separate phases, individual outputs don't exist.

Since round output is not well-defined, there is little point in implementations for providing an access to these values.

If you want, for pedagogical purposes, to print out intermediate values, then you'd better select an implementation that follows the letter of the specification (at the expense of performance), i.e. not Crypto++; in fact, you should write your own (if you print out intermediate values, then you are not doing anything securely, so writing your own code is justified).


Scan all possible files on server (Brute force Filenames) I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to.

So it would try something like: example.com/a, example.com/b, ... , example.com/css, ... .

It would the check if the answer from the server is a 403 or something like that and try the next one.

Check out DirBuster where you can feed wordlists and it'll try to brute force file and directory names.

Nikto also checks for commonly used folder and file names on a web server.

It is not possible to check every file and folder name, however running the above tools will give you a decent amount of enumeration.


Accessing iPhone data without passcode - how difficult? I use iOS7 with a 4-digit passcode that isn't on any top 10 lists. I have "Erase all data after 10 failed passcode attempts" turned on.

How hard would it be for someone who stole my phone to get access to my email?

Theoretically, an iPhone can be configured to encrypt all the "user data" with a key that is ultimately derived from your passcode. However, that does not really save you:

If the attacker limits itself to the unmodified iPhone and just enters some potential 4-digit passcodes on the screen, then the attacker has a probability 1/1000 of success (10 tries, 10000 possible codes). That the data is encrypted is irrelevant here.
If the attacker opens the iPhone case and dumps the Flash chip contents, then he can try all possible 4-digit passcodes; there are only 10000 such codes and each try will need much less than one second on a basic PC, so he will be done within less than 3 hours. Since, in that scenario, the attacker works on the data dump, not with the phone itself, there is no automatic erasure. The encryption layer does not save you; at best, it delays a bit the attacker, but not by much (3 hours instead of immediate access). Note also that whether the encryption layer was done properly is questionable.

With a 4-digit passcode, your safety relies on how hard it is to physically open the case and access the data directly from the Flash chip. It will deter most phone thieves, who, after all, wanted the phone, not your data. However, a determined attacker will be able to do the dump. If your attack model includes such a determined attacker, then:

you need to activate encryption;
your passcode must have a lot more entropy than a 4-digit passcode (12 digits would be a minimum, more are better);
you still have to pray that Apple did not goofed up with the encryption.


Is Using SSL secure enough to post request login credentials to my backend server? I hope everyone is doing okay.

I've built a React.js website which is hosted in a server with SSL, but I'm not sure whether it's secure or not. That's why I decided to ask you for some advice/tips or solutions that will make my website secure.

In this app, I require the user to log in. After the user logs in, my app proceeds to send the credentials (with a Post Request) to my backend server, which is an API hosted in another domain. Then my API uses the post request data for web scraping and eventually returns some data to my frontend.

In the whole process, the only important data are the login credentials. What I did so far to make my website more secure was:

Using SSL both on my backend and frontend
The app does not hold any data (it doesn't have a database, it doesn't use cookies, etc.)
I limited the number of requests that can be made to my backend server in a second/minute/hour/day.
I only use one post request to transfer data between frontend-backend. (frontend sends a post request, backend sends a post request to the website that needs to be scraped, and returns frontend's post request with scraped data)
I don't know the use of this but I read somewhere that using With Credentials in your post request makes it more secure? (I'm not sure about this one.)

(Also, it will be an open-source project, so people will be able to see )
I read that SSL will encrypt my post request, I also used Fiddler to see whether it's encrypted or not, it was.

Is it possible for individuals with malicious intentions to trace the data I send with the post requests?

Do you think it's secure enough?

Thanks

Sinse you don't see any cookies, means you store user credentials on the client. It means that either you ask user for credentials for every single request, which is a poor usability. Or you have fields for user and password, user enters these data once and they remain in the current page the whole time over multiple requests. If this is true, this is not a good approach. Such sensitive data should be kept as short time as possible, because otherwise there is a risk that somebody else will know them.

SSL (or very probably you use TLS) ensures that nobody else can decrypt the traffic.

On the server side there can be some risks. Normally certificates are installed on a separate server, before the server where the application is running. The way between server with certificate and your application remains unencrypted. If there are no other users in your environment, this is not a big problem. But if there are other users, then there is a risk that some users can read your unencrypted traffic on the server side.


Detecting disabled Chrome plugins using JavaScript My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me.

I have disabled the Flash plugin on Chrome, since all websites that I use support HTML5 video playback.

Every other website that requires Flash redirects me to the Flash download page. However, somehow, the HBO website actually redirected me to the chrome://plugins page, which meant that it could detect that I had manually disabled the Flash plugin. Unfortunately, I have no access to the credentials to dig into the JS now.

I found this post on SO. However none of the solutions there (including the accepted one) can distinguish between not installed and disabled.

Does anyone know how JS can detect whether a Chrome plugin is installed, disabled or active? Shouldn't this be completely sandboxed? HBO can already detect incognito browsing, I wonder what the cumulative security impact is of the browser leaking all this info.

EDIT:
Adding image:

After looking through the JS I cannot find any mention of this type of validation. Maybe it is something that Chrome does, and I'm needlessly worried?

I have banged my head in the wall for awhile with the same question and failed to find a reliable answer in SO or elsewhere. There are ways to tell if a third-party plugin (like an add blocker) is limiting your flash, but in the case of flash being disabled by the user (or default browser setting), I suppose it is too much of a security breach to give this info away.

I looked at the Adobe flash-testing page and saw how they seem to be doing it - hope it brings some clarity:
They check the client's browser and OS versions and make an assumption based on this data whether flash is disabled, or not installed at all. If you want - inspect their page and look at polarbear_browserdetect.js and swfobject_util.js.


How to find vulnerabilities in a program by looking at it's source code Hello I have recently started learning Reverse Engineering. I often hear that it's much easier to find vulnerabilities in a program by looking at it's source code, but i don't know how to find them or what type of loopholes i can find by looking at source code. So Can someone give some examples, study resources or Ebooks which can help me...

and welcome to Security.SE.  This question doesn't really fit the StackExchange format, and will likely be closed. Questions like this typically end up just being a list of books, which could potentially get out of date very rapidly.
To answer your question, I would recommend a couple of things:

Pick an area that you would like to study (i.e. web vulnerabilites
vs.  C source code).
Find applications which fit your choice which are open source and have had security vulnerabilities which have been discovered in the past.  There are also plenty of purpose made vulnerable applications such as Owasp's WebGoat you could look at.
Download an old version of the source code which still contains the vulnerability, and read through the code to see if you can
understand how the vulnerability presents itself.

As far as books go, there are plenty available, but as @multithr3at3d mentioned, it's kind of a broad topic.
You can also try running some static analysis tools against some open source projects, and review the results to find other potential vulnerabilities.


Client IPSEC VPN Key Exchange vs. Site to Site IPSEC VPN Key Exchange Given a site to site IPSEC VPN most firewalls allow for the selection of which DH group the site to site tunnel will use to perform the key exchange prior to encrypting the traffic.

I have noticed that with client IPSEC VPNs typically you only have the choice of entering a pre shared key.

Do client IPSEC VPNs not use DH Groups? Do they only use the pre shared key (and since the key is pre shared there is not a need to perform a key exchange)? Do you know of any vendors who make a product that allows DH groups to be used with client IPSEC VPNs so the key exchange is dynamic and not pre shared?

I don't have a use case that requires this, I just want to make sure I understand why the Cisco ASA allows you to select a DH group for site to site IPSEC VPNs but not for client IPSEC VPNs.

There is no need for a key exchange, that typically applies to SSL/TLS protocols (and such). VPN's often use preshared keys. Sometimes (OpenVPN) you can define a DH keyfile but only for the ephemeral key exchange that takes place after the connection is established, this enables forward secrecy.

Update

There are VPN's that do a key exchange, IIRC both Cisco and Dell support this in their Enterprise VPN products.


Calculating how secure my password is I generally use GnuPG for encrypting my files and as far as I know its strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my password is? How do I know whether my password is safe or not?

The strength of a password is, exactly, a measure of what it could have been. The technical term for cryptographers is "entropy". The rough idea is the following: there is a set of "possible passwords" -- the passwords that you could choose. The attacker will try the passwords from that set. The attacker will be defeated if the set is large enough, because the larger the set, the longer it will take the attacker to hit the right password (on average).

For instance, if your passwords are sequence of 9 decimal digits, then the set of possible passwords has size, exactly, one billion (109). If you choose your password at random in that set, then, on average, the attacker will have to try half of the set before trying yours, so 500 millions.

Thinking about a big bag of possible passwords from which you choose, at random and uniformly, works as long as you really pick the password at random and uniformly. That's easy to do with a computer, very hard with a brain: the jelly which you keep inside your skull is remarkably good at a lot of tasks (such as image recognition), but not at randomness.

The important point to understand is that password strength comes from the password generation process. A given password is not strong "by itself". That's where "password meters" totally fail. A "password meter" sees only the password you type, not how you chose it. If you prefer, a password meter site will tell you how much time it would take an attacker to guess the password, assuming the site is the attacker, and knows nothing else about you. That's not completely realistic: your enemy knows you, much better than a lambda site on the Web. He is after you, specifically, and he must be assumed to be smart.

So, to estimate your password strength:

If you generated the password in your head, then try again: it is weak. From now on, I assume that you produce the password with a random generator (a computer with /dev/urandom, some dice, coins flipped... the choice is large).
Compute the size of the set of possible passwords, depending on your generation algorithm. For instance, if you use a 20-sided die to generate symbols (letters from A to T), and you launch the die 8 times, then the set of possible passwords has size 208 = 25600000000.
Estimate how many passwords the attacker may possibly "try". This is where the encryption details matter. GnuPG follows the OpenPGP format in which passwords are converted to keys through a hashing process which is intrinsically slow, in a configurable way (see section 3.7.1.3 of RFC 4880). This is expensive both for you, and for the attacker. The attacker has several computers which are bigger than yours, so he will be able to try a lot of passwords, but not ludicrously many. As a rule of thumb, consider that the attacker can try no more than one million passwords per second.
From the two previous steps, compute how much time it will take for the attacker, on average, to crack your password. On average, he will have to explore half of the set of possible passwords. With the numbers above (8 symbols from a 20-symbol alphabet, one million password guesses per second), you find 12800 seconds, i.e. a bit more than 3.5 hours. That's not much for comfort... but each additional symbol multiplies the attacker effort by 20. So 10 symbols with your D20 bring the attack time to about two months, at which point the attacker ought to declare that it is "not worth the effort" (which is your goal).

Hence the rules for strong passwords:

Don't trust your brain. Generate the password with a computer or dice.
Accept the generation result. Don't generate passwords until you find one which seems "easy to remember".
Stick to symbols which are easy to type. In particular, a sequence of lowercase letters is easy on a smartphone. Mixing cases, digits and punctuation symbols makes the password usage frustrating.
Use sufficiently many symbols so that the set of possible passwords is large enough. This depends on how well (or how badly) the encryption system hashes the password into a key. Unless the encryption system is tremendously incompetent (in which case you should not use it at all), 12 or 13 letters will be enough (do the math !).

In the famous XKCD password comic, the author suggests taking a list of 2048 "common words", and then selecting four such words (at random, with dice): the four words, concatenated, will be the password. The set of possible passwords then has size 20484 = 17592186044416, which is quite good. The point of the author is that such passwords are easy to remember (whatever the four words you obtain, you will find a corresponding "story"). Personally, I prefer shorter passwords which are just random letters (my brain, being that of a mammal, is bad at randomness, but it is quite good at remembering strings of symbols).

The key to remembering a password is to type it daily.


How relevant is OWASP ASVS? How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did try to search for them, but only OWASP ASVS poped up...

My boss, a non-technical person, wants to be able to sell strong app security, and I am the most informed person in the team security wise. I want to be able to say to my boss: here, I verified the application security using this really relevant standard, so that he is not embarased when talking to experienced security experts.

Any OWASP project is as relevant as the community behind it, for example the PHP project is now abandoned but ASVS seems pretty active still.

Adhering to any OWASP best practice is always a good idea, it may not be the perfect fit for your organization and you are not obliged to follow everything they say, but it certainly helps to steer you in the right direction, and you have the back up of a solid not-for-profit organization.

As for the second part of your question please see this, but keep in mind that you can also approach it from the risk analysis point of view, for which you have options like STRIDE or Trike and even OWASP's own help.


Enpoint protection: How to search an organisation for hash value As part of incident response to malicious code outbreak and given the hash value of the malicious artifact, I would like to search across the entire organization for this specific hash value.
Do you know of best practices or solutions that implement such functionality?

You get one of the many endpoint agents out there or Powershell scripts that allow you to search for IoCs in the form of file hashes. You tell the agents (or central script) to look for the file hash.


Doesn't hashing passwords server side mean a compromised website could leave passwords vulnerable? So the traffic is encrypted to a website so the password is safe during transmission and also if the website is hacked then the database only contains hashes.

But couldn't the hacker create a server side script to store the usernames and passwords used to login to the website in a file since they are decrypted and are not already hashed? This wouldn't get every user however it would allow them to view users passwords who try to log onto the site while it is compromised.

Wouldn't it be better to hash passwords at the client side?

The weakness you allude to is real. An important point is that once the server is compromised, the attacker has little incentive to grab passwords that grant access to that server -- he is already in the place. However, human users have the habit of reusing passwords, and that is a big problem, because a reused password means that compromises on one server tend to "propagate", exactly in the way you explain: the attacker grabs password P for user U, and guesses (alas correctly, most of the time) that the same user U will have used the same password on some other servers.

Hashing client-side is a nice idea, but there are details:

Whatever the client sends to the server, be it the password itself or the hashed password, grants access. It is password-equivalent. If the server stores these hashes "as is" in its database, then it is in the same situation as a server storing plaintext passwords, and that's bad. Thus, the server MUST also do some hashing.
Client-side hashing occurs only if there is code on the client side that does the hashing. In a Web context, this means JavaScript. Unfortunately, JavaScript is poor at cryptographic implementations; in particular, it is quite slow, so the client-side hashing will not be able to use the many iterations that are usually needed for good password hashing (see this for details). Also, this would not work for clients without JavaScript.
Still in a Web context, the client-side hashing, if it occurs, is done by JavaScript code sent by the server. If the server has gone under hostile control, then it may send malicious JavaScript that pretends to do the hashing, but does not. The user will be none the wiser. Thus, the root problem is not solved.

Client-side hashing is usually envisioned under the name of "server relief", not to increase security against evil servers, but to allow the server to handle many concurrent users without spending all its CPU on a lot of hashing. JavaScript being what it is, this is not commonly done nowadays.


How to protect myself online from the government? I need something trusted and secure. I need to make “onion layers security” with the most secure and hard to hack/crack software.

How to protect yourself from the government on the internet?

I’m from Russia and I need to post a few documents and articles on the internet, but I need to be 100% sure they won’t find me.

Please use simple English, basic tech terms and be as detailed as possible, or direct me via links to articles with information. But real good tips will be appreciated.

I just bought a new hard drive and I am going to install a new OS and other programs on it:

Which OS? Windows 10, Linux, Qubes, Whonix etc, or use Whonix inside of Qubes? Which the most secure? If Linux, which version? How best to configure it?
Do I then need to install a virtual machine on it? If so, which one?
Which third party programs do I need on it? VPN?
What browser to use? If Tor - What’s the best configuration for Tor browser? As I know just using Tor browser is not enough they still can find you. And should I use Chinese servers?
Do I need an Antivirus? Antispyware? Which one?

I guess that should be enough?

If your adversary is a nation state actor, and you need to ask this question on StackExchange, then you're doing it wrong. You cannot be "100% safe" from a determined, powerful adversary. While it's fallacious to say "if they want you, they'll get you", it is true that you cannot be 100% safe from any powerful adversary. They will always have 0days that you are not aware of, and will be tapping infrastructure you are not aware of.

  1 Which OS? Windows 10, Linux, Qubes, Whonix etc, or use Whonix inside of Qubes? which the most secure? If Linux which version? How the best to configure it?

That depends on your threat model. Qubes is great for mitigating hardware-type attacks (such as a compromised NIC), but it uses the quite vulnerable Xen and has other nasty configuration issues, such as running with NOPASSWD sudo (which allows anyone to get root without a password). Whonix is good for a very specific threat model (IP disclosure), but when run in a VM rather than on physical hardware, you negate much of the benefit. The Russian government absolutely has VM escape 0days.

  2 Then need to install virtual machine on it? which one?

Different VMs have different strengths and weaknesses. They can all be compromised with enough resources. QEMU for example runs in userspace, which allows it to be sandboxed via a command line option. The virtualization is done in the kernel by KVM, which is pretty secure. However QEMU is also buggy (as are all VMs), so unless it is being sandboxed and is using a chroot, it can be an issue.

  3 Then which third party programs I need on it?

Not sure what you mean. It depends on your threat model. Use whatever well-regarded programs give you the features you require. Tails has many programs which are sandboxed for security, and which provide you with a decent amount of productivity software (audio editors, text editors, spreadsheet programs, collaboration programs, etc).

You do not want to use things like VPNs. Even if you trust the VPN provider, the technology was not designed for anonymity. In fact, the "private" in VPN is referring to IANA-reserved private addresses, not the right to privacy. They are designed to allow connecting two virtual network interfaces together, especially to get on a corporate network. They have been abused by companies that want your money by advertising the fact that their name has "private" in it, and that they do hide your IP against any naive adversary.

  4 What browser to use? If TOR - What’s the best Configuration for TOR browser? As I know just using TOR browser is not enough they still can find you. and Use China server?

It's Tor, not TOR. And the best configuration is simply setting the security slider to high. This will disable JavaScript and certain other risky features. In contrast with what the other answer says, Tor was neither created by the government nor given away by them. The concept of onion routing was created by the Navy. Tor itself was created by Roger Dingledine. The computer mouse was created by DARPA, but that does not mean that your little Lenovo mouse is from the government!

While Tor itself is quite effective (so don't change its configuration!), Tor Browser is based on Firefox, which is not a perfect browser. However, it is the only browser that provides fingerprinting defense. There are 0days that governments and government contractors have that can compromise the browser, and if the browser is compromised, it can bypass Tor by connecting directly to a government-controlled server. There is no way to avoid this with complete certainty.

  5 Need Antivirus? Antispyware? Which one?

This is actually harmful. AV is fine for low-level threats that are already known in the wild, but advanced malware can take advantage of an AV, compromising it to elevate privileges. AV software runs with high privileges, parsing any attacker-controlled data you throw at it. This is a recipe for disaster.

  I guess that’'s should be enough?

Nope. If you're not using a hardened kernel with heavy monitoring and extensive syscall filters, you aren't even close to good enough. Protecting against a nation state adversary who is determined to attack you and is willing to spend plenty of resources on you requires expertise, many years of expertise. It would take me months and hundreds of pages worth of answers to even provide you with the basics. This is why threat modeling is so important. It allows you to determine who your adversary is, what their capabilities are, what their resources are, and what assets they are after. This makes it easier to protect yourself.

  Thanks a lot for saving my ass.

Honestly, the Russian government will not be spending a lot of money to get you. You can raise the bar a good bit by using things like Whonix (on real hardware), Tails, or Qubes, but none of that is perfect.

You need to define a threat model. To expand a bit on your implied threat model regarding "posting some documents on the internet", that makes it a lot easier. For example, you won't have to worry too much about exploits, unless you tell everywhere where you are posting the documents to or stay a long time, giving the chance to attack you. When posting documents, the threat model involves avoiding retroactive tracking, with the assets not being your computer resources or anything like that, but simply your identity. Your adversary will only be able to target you after you post documents, not before, so you do not need to worry about them lying in wait with a 0day exploit to use against you. Using Tails is perfect for this, as it not only is amnesic and such resists forensic attacks, but it is designed to be fool-proof for anonymity, making it extremely difficult to shoot yourself in the foot. Keep those documents on an encrypted flash drive, use Tails to upload them (e.g. to Wikileaks), then get rid of the flash drive and move on with your life.


Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key? By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase.

During that phase, the admin is asked to e.g. perform the challenge of putting a file on the webserver and sending a signed nonce to the CA.
What if a man-in-the-middle generated his own (authorization) key pair (while the admin is performing the domain validation) and signed the nonce with the malicious key pair? The admin would have performed the challenge by posting a file on the server and the CA would have gotten a maliciously signed nonce (if the man-in-the-middle is able to discard the signed nonce from the admin). This would mean a compromised authorization key in control of the man-in-the-middle for a domain.

The solution (in my opinion) would be to simply post the signed nonce on the Website (on a path decided by the CA) instead of sending it to the CA, such that the "signature swap" cannot happen. This however is not depicted on the Let's Encrypted "How it works" explanation.

Am I understanding something wrong or how is such an attack prevented?

From https://letsencrypt.org/how-it-works/:

Let’s Encrypt identifies the server administrator by public key. The first time the agent software interacts with Let’s Encrypt, it generates a new key pair...

Although it doesn't say it explicitly, the server admin must send the public key to Let's Encrypt at this point (otherwise, it's impossible to see how the later digital signature verification would work).  So, this is the public key that Let's Encrypt would use to verify the digital signature on the nonce.  Therefore, in your scenario, if a rogue actor were to create his own keypair and use his private key to sign the nonce, the signature verification would fail because the public key that Let's Encrypt would use to verify the signature would not correspond with the private key used to create the signature.


Google crawling and SQL injection recently my logs shows attack signatures from

  /news/html/?0'union//select//1//from//(select//count(*),concat(floor(rand(0)*2),0x3a,(select//concat(user,0x3a,password)//from//pwn_base_admin//limit//0,1),0x3a)a//from//information_schema.tables//group//by//a)b//where'1'='1.html

A search on google for pwn_base_admin seems to point to some PHP vulnerability. And something caught my eye is, one of the search results show a link:

My question is does how does google crawl sites while inputting such an attack signature? Doesn't it reveal sites that are vulnerable such as the one shown?
thanks

Yes Google, as well as other search engines, do see quite a large number of vulnerabilities and misconfigurations on websites. These are indexed and frequently can be searched for either by attackers or security researchers.

There's even a term for it "Google-hacking:
https://en.wikipedia.org/wiki/Google_hacking

There are many websites such as the following one which also keep track of these interesting searches:
https://www.exploit-db.com/google-hacking-database/

If you know a bit about penetration testing this becomes even easier because you tend to keep track of older versions of applications or plug-ins with easy to exploit holes and you can then use the search engines to find these vulnerable systems on a very large network quickly. For example think of searching for an old version of php anywhere at site:company.com  This can quickly help someone find vulnerable systems across what could potentially be over 100,000 publicly available computers ending with company.com.

So yes this does technically allow the world to see the vulnerabilities and search for them a bit easier but there are so many attackers scanning the entire IPv4 address space looking for particularly vulnerable systems that even if this were removed from search engines it wouldn't really put a dent into the number of systems compromised.

Another search engine you may also want to look at is called Shodan
https://www.shodan.io/

Shodan lists all sorts of vulnerabilities and it's not restricted to http so it can find telnet, ssh, database vulnerabilities as well.

To their credit Google does filter searches for credit cards now. A long time ago it was possible to search for credit cards and you could find all sorts of misconfigured systems or credit card dumps just via simple searches.

Hopefully this helps.


Is it bad practice to let the user know its hashed password? I recently found out that a website I use every day let me know my hashed password.

The process was the following :

Go to "Delete account" and enter your password. Password is checked.
If password is correct, a form then appear where you have to set why you are deleting your account (at this moment, the account is not yet deleted). There is an hidden input called hashedPassword containing what I think is my hashed password.
When you valid the form, your account is deleted.

Since you first have to input your password to get the hashed password, I don't directly consider it a vulnerability. This process doesn't look dangerous to me, even if I was a little bit surprise to see my hashed password.

All I can see is that it might allows the user to discover the hashing algorithm, or even let you find the salt used.

Is this a bad practice ? Is it dangerous and how could it be used by an attacker usefully ?

It seems needless exposure to me. Hopefully it is not merely hashed, but with a sizeable random per-user salt and a KDF with a lot of iterations. Even so, the intent of the design is to keep it protected on the server, not to send it out to clients.

If as you say, the hidden field is sent out of the server only upon proper authentication, the risk is far lesser (so a hacker wouldn't easily be able to collect hashes by attempting to reset a whole bunch of users' passwords), but it still appears needless.

The reason we are still talking about risk is that end-user systems and networks are far easier to snoop on, than consciously secured servers. So if in this case an attacker has a privileged position on a network that uses SSL stripping at its perimeter, then (s)he wouldn't need to "hack the server" - thus bypassing server-side protections.

We could argue that "the user account is going to be deleted anyway", and to some extent it would be true (lower risk). Still, a cache of used passwords (if they can be derived from the hashes) is nice to have - since password reuse is rampant.


Is there a risk on user's private data when android App got permission to access hardware without accessing user's data? I found in a published paper talks in a part of it about an algorithm of managing permissions and the description contains this statement:

"If the request from app is accessing for hardware, we set the permission being authorized, because hardware cannot do any harm alone"

So, I want to understand what about the situation if the android app get access just to the hardware and has no access to user's data, Is it true that this app can not do any harm on user's privacy (such as record from Mic/Camera and send it to remote server)?

All "hardware access" from an app is actually access to an abstraction provided by device drivers and/or HAL. In principle, this seems a safe assertion to make - especially with the first use case below. Beyond that, it's paranoia. :)

User's existing data is not at risk if the hardware access doesn't indirectly provide access to the data. e.g., microphone / speaker access may be considered okay.

What if the hardware can indirectly access the data - e.g., if it can access the networking hardware (wifi for example), can we assume that it is actually accessing a driver which is a high-level abstraction of the device? If so, does the abstraction isolate the app? What if the access is to the baseband radio? Can it make a network request (e.g., international call) and infer user info (e.g., "does the user's plan permit international calls"; or combine two accesses - make a VOLTE request - and obtain prepaid balance info from the LTE stack?)

The other extreme of the paranoia is about - with access to the camera and microphone, can the app deduce user info by making additional requests to biometric identification databases (lame example: can facebook identify the user even if logged in with a different persona?)


Brute-Force GPU Password Crackers Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu,  oclHashcat, and others.  oclHashcat appears one of the more popular, but I am not sure which AMD/ATI GPUs it supports. (I have an ATI card.)

Which of the password cracker programs has the greatest ATI GPU support?

Which is the easiest to use as an API library?

Which is the most reliable?

It depends on which Hash your trying to crack. If its MD4/5 i'd go ighashgpu, for anything else, OCL-hashcat-plus

OCL-HashCat-Plus supports these hashes and ATI/Nvidia cards on linux and Windows and has an excellent reputation, active forums and i've personally used it to great success on both Nvidia and ATI platforms. It's also updated regularly.

I've also used ighashgpu for MD5 cracking. It claims to be the worlds fastest multihash MD5 cracker for MD5. From comparisons i've read, i believe it to be true. The downside is that IghashGPU only supports SHA1, MD5 and MD4 hashes. Additionally, i odn't think its been updated for 2-3 years.

Both are equally reliable as long as your hardware is stable in my experience.

Additionally, since both are command line based (ocl-hashcat plus has an optional GUI), its easy to incorporate them into a script.


Could I use a TimeStamp also as IV? For an academic application, I use AES-GCM to encrypt my frames between 2 parties.

To enhance security, and reduce the possibility of replay, I'd like to use a TimeStamp in my frame exchanges. But, as I use the GCM mode, I need to tranmsit the Initialisation Vector besides the  ciphertext (and the MAC).

My idea is : could it be possible to use the IV as TimeStamp as well ?

The IV would thus be used for decryption of the ciphetext, and then to check if the message is not too old.

Thus, a modification in the TimeStamp will make the ciphertext un-decryptable.

The next step wil be to produce a TimeStamp in a long form, as not to reduce security. Any ideas how to emit a TimeStamp like this ?

Each encryption mode has its requirements for the IV. For GCM, the requirements are simple (see NIST SP 800-38D for details):

Length should be between 1 and 261-1 bytes. It is recommended that the IV length is exactly 12 bytes (96 bits); if it is not, then GCM will need to pad and/or hash the IV first, which is not supported by all implementations, and increases the risk of spurious collision.
For any given key K, you shall never use twice the same IV.

In particular, in GCM (as opposed to, say, CBC), there is no need for the IV to be random and unpredictable; uniqueness only is required.

Therefore, a 96-bit value extracted from a monotonic clock (I suppose that is what you mean by "time stamp") is a nice IV, provided that you take care of the following:

If you encrypt several messages in quick succession, they may end up using the same time stamp, depending on the accuracy of the system clock and the speed of the CPU. You MUST include some test to avoid such an occurrence.
The system clock may vary, either automatically or through human action (the user notices that the clock is off and adjusts it). Having a really monotonic clock can be hard in all generality.


Disabling post-pageload http requests to account for XSS I have a website where JavaScript is used to process sensitive data (chat messages) on the client side. No communication is done with the server or any other service after the initial page load. It's possible that a conversation partner of the user could have malicious intentions, and try XSSing the conversation. To counter this, I want to be 100% sure that it's impossible for the application to send any messages after the initial page load, since it's acceptable if any XSS breaks the JavaScript application, but it's not acceptable for any messages to be sent.

Is there a way to be certain that my JavaScript application will not send messages anywhere after page load, when there is possibility of XSS attacks?

No. Your Javascript application can be modified by the end user on their own machine, and send anything anywhere.

You should look at ensuring that your server side component only accepts chat messages from authorised sources, and that it isn't possible to make the Javascript application an authorised client without information which isn't available to the end user (e.g. require a server generated token to send chat messages - look at CSRF protection methods for an example).

Anything running on a system you don't control can be modified given sufficient time and effort, so you need to keep your protection mechanisms on systems you control.


Does creation of dump data would be considered as vulnerablity? Problem behind the question :

We were a small firm developing a small web application

which was similar to fb,gmail,etc [in terms of functionality].

We have a signup form and I was assigned to test the application for vulnerabilities.

Now I did a CSRF over signup form and created a sample which throws a message as :

  {"query":{"count":1,"created":"2015-11-12T07:21:59Z","lang":"en-US","results":{"result":"0
  ywamob, 1 geo. 1 geo, 0 ywa."}}}

I checked the db and the query was executed through my csrf.  Now I asked the developer

to fix this but the developer denied and said it doesn't have any security implications.

My explanation :

I claimed that since I was able to execute the query successfully at your database

without any parameters, the attacker can dump your database through a simple csrf form.

My questions :

Does the dumping of data, executing query a csrf form won't be considered as vulnerability?

If yes any layman explanation to clarify that developer its vulnerablity?

Was my opinion on this one right?  If no kindly provide valuable suggestions towards it.

... the attacker can dump your database through a simple csrf form,

A CSRF request alone will only cause the execution of some server side code in the context of a logged in user. The attacker itself is not able to access the results of this request, i.e. is cannot read the response. To get access to the server response you need attacks like Cross-Site-Scripting.

What you often can do with CSRF is to create a new user and then the attacker could log in as this user and access the database directly.


What is "Token" on lab.pentestit.ru? I am new to the Information Security field. Recently I found a virtual lab called "Pentestit"(https://lab.pentestit.ru/).
But I have a problem. After connecting via VPN, I can access target host: 192.168.101.5. I can scan and etc. But I do not know what's meant with "Token".
On the left side of the site there are fields for VPN token, site token, ssh token and etc.
What are these tokens and how can I find these?

When you find the vulnerabilities and hack through the system, you will see various files that contain strings like: token_ssh:. This is what you will have to use there.

Tokens are for you to prove your progress to the lab owners and participate in the contest. It is already won by Beched though.


CSP reporting to another origin I was implementing a CSP policy and set up the reporting endpoint as another domain, a completely separate origin. Everything seemed to work fine, but talking to a few friends they seemed surprised that it worked as they thought that CSP reports could only go to the same domain or a subdomain. I looked around online and read through the spec but didn't find anything that substantiated their theory that it used to be that way.

I'm cautious going forward because I'd rather set up a reporting endpoint that I could get consistently rather than one that might fail on older browsers. Is there any truth to their suspicions that cross-origin reporting used to not be supported?

Thanks in advance :)

Having tested this at scale with a wide variety of browsers there does not seem to be any issue with the reporting endpoint being on a different domain.


Is Windows Firewall suitable for running in a production environment? Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough?

I'm running a VPS with Rackspace on their cloud offering. It's running Windows Server 2008. I don't believe there are any other firewalls between it and the outside world. I've got a few things on there ranging from my blog through to a couple of client websites. None of which are eCommerce but I'm sure the clients would like their data kept private.

I guess it is up to you and your experiences. We (the company I'm working for) are using Windows Firewall. As far as I know, a lot of small enterprises are running Windows Firewall. It is "only" a firewall, and is therefore not more secure than what you make it yourself. Consider it ACL (Access Control Lists) you specify what traffic you allow and what you do not.

I can recommend these two sites for you, if you consider using Windows Firewall.

This one is a "How to configure windows firewall in a small enterprise:
http://technet.microsoft.com/en-us/library/cc875816.aspx

And this one is a textfile provided by Microsoft with an Introduction to Advanced Configuration of Windows Firewall:
Introduction to Windows Firewall with Advanced Security


Is it possible to detect the real IP from a modifed header Is it possible to find the real IP from a header which seems to be changed in order to hide the sender's IP?

No, the IP header will have been modified to remove the sender's real IP.

If you believe the packet with the altered header originated within your network, you may be able to check network logs to find the origin of the packet.


What is the difference between encrypted data and data sent through an encrypted tunnel? I am looking at different VPN protocols.

L2TP does not provide encryption so require IPSec to encrypt the data
IPSec tunnel provide encryption to the tunnel

What is the difference in terms of the packet that get sent through the link? Can you describe the two types?

Those are only different in terms of administrative features; the ipsec layer, assuming it's set up correctly, providers equivalent protection in either case. When IPSec people say "tunnel mode", they don't quite mean what most network admins think of when they think of a GRE or L2TP tunnel, which is why the GRE/IPSec and L2TP/IPSec solutions are sometimes deployed.


Rounds of MD5 and SHA512 Hashing Algorithms What is the exact number of rounds employed by the MD5 and SHA512 hashing algorithms?

According to various sources, the SHA512 hashing algorithm employs a total of 80 rounds (http://en.wikipedia.org/wiki/SHA2).

On the other hand, I am confused when it comes to the MD5 hashing algorithm.  According to Wikipedia, MD5 employs 64 rounds (http://en.wikipedia.org/wiki/SHA2).  However, another website states that MD5 employs 4 rounds (http://md5live.com/2013/03/06/encryption-methods-sha1-vs-md5-vs-sha256/).  Who is the correct of the two please?

I can't seem to find a reliable source of information regarding the number of rounds.  Furthermore, what are these rounds exactly?  In simple terms, what does the hashing algorithm do during these rounds?  Thank you very much :))

There is no objective, systematic and consistent notion of what is a "round". Each algorithm specification defines things its own way.

MD5 is described as first padding and then splitting its input into 512-bit blocks. Then, as the RFC puts it, there are four rounds where each round happens to be a sequence of 16 very similar operations. So we could say that MD5 uses "four rounds" (per block). However, cryptographers have soon shunned this terminology, and when they talk about the potential weaknesses of MD5, they concentrate on the internal operations, which they call "rounds". In that view, MD5 has 64 rounds.

SHA-512 is specified similarly as padding and breaking input data into 1024-bit blocks, and each block is processed with a loop which repeats 80 times a sequence of 4 steps. So we could say that SHA-512 uses "320 steps" (per block). There again, cryptographers agree, more or less implicitly, on talking about "80 rounds". It can be noticed that each of these rounds roughly implies twice as many operations as an MD5 "round" (when MD5 is said to have 64 rounds) so it could be argued that SHA-512 actually has 160 rounds. Or not.

These terminology issues are not important as long as everybody agrees about what they are talking about. The important point is that there is no absolute notion of "round" which is more correct than any other, or which could allow comparing different algorithms based on "how many rounds they have".

As for knowing what happens within the rounds, the simplest way to know is to read the specification, and implement it in some language. This is not hard (begin with MD5) and it is a great pedagogical experiment.


Is password + second factor more secure than public key auth now? (SSH) I ask this question because, I think, we now can reasonably assume the following:

NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and boasted) about this capability in the wild.
NSA has a database of stolen keys: They can somehow get SSH keys. The slides imply they have a database of stolen keys (I think it says something like, 'check to see if key in DB').
It is easier to steal the private/public keys than it is to steal the TOTP from my air-gap'd phone/ipod touch.

If it is true that agencies can easily acquire keys, then would it not make more sense to use password + google TOTP second factor authentication for each SSH login?

It seems google's TOTP second factor authentication does not work out-of-the-box if publickeyauth is used. So, there is a temptation to disable public keys and use only password + second factor.

Taking the latest leaks into account, if I have to choose between public key auth and password + TOTP second auth, which is better in terms of security? (I explicitly cannot use both).

(I don't care about convenience, they are both the same for me).

Thank you.

If the second factor is something that you have, and that cannot be copied, then it can be very secure.

RSA tokens (as was shown by the Lokheed Martin breach) may be physically secure, but if the backend is hacked, then they can be completely compromised. Which is why the mass recall/replace of RSA tokens was carried out.

The answer will depend entirely on your risk/threat model. If you are an NSA target I would imagine it won't matter either way. (In reality it doesn't look like there is any proof they can break SSH - just that they are very good at getting around it)

How well does your infrastructure/processes protect an SSH key? How good are your users at protecting a 2nd factor? Is that 2nd factor an SMS? Or a physical device? Or a phone call?

You can see why this is not an easy question to give a definitive answer to.


What is the use of nonces in HTTPS APIs I have used APIs that require a nonce for every request. If HTTPS requests are not replayable, seen here https://stackoverflow.com/a/2770133/2800469, what is the reason to require nonces for HTTPS APIs?

Is it just to ensure that legitimate consumers don't issue requests more than once?

HTTPS traffic cannot be replayed but its contents might be.
It is possible that a browser will send a request multiple times because the user has hit back or because the connection timed out on the last attempt or similar. In that case you need another nonce to detect the duplicate API requests. So you can avoid e.g. sending two pairs of shoes.

Note the difference. The HTTPS packets are not replayed. The browser might use a new HTTPS connection or still use the same connection but it is simply sending new packets.


How is it possible for scammers on YouTube to use the same exact username as the author of the video? Recently, there has been an absolute massive flood of scammers on YouTube videos related to Bitcoin. Their "trick" is to use the exact same username and profile picture as the person who uploaded the video, for example "MMCrypto", then making spammy comments/replies in the comments section, pretending to be the author of the video.
Of course, the actual author would get a special styling and a little "verified" icon (if they are verified), but still, I'm talking about the username being identical.
At first, I assumed that it was a "Unicode trick" where they use similar-looking glyphs, but that is not the case.
Example: https://www.youtube.com/watch?v=ylkiET_iCPc (click one of the "View 2 replies" links to see a scammer comment)
If you search that webpage for "BitBoy Crypto" and select "highlight all", it marks both the scammers' posts and the video uploader username, indicating that they are identical. So they are not using "similar glyphs".
I guess they could be using some sort of "invisible character" trick, but you'd think that YouTube if anyone would be on top of that. It's the only thing I can think of, but it doesn't seem realistic.
How are they doing this?

The YouTube channel name is not a username, but a display name. They are not unique, so one does not have to perform any tricks to get a matching display name. For normal users without a brand account the display name is linked with the Google Account.
Those verification badges are not about protecting channel names, but an extra feature for channels with more than 100,000 subscribers.


Am I required to hash passwords Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen?

If not required in the US, but required in the EU, can one legally do business in the EU without hashing passwords?

I think it's required by different security/governance standard, like PCI, NIST, and SOX.

So you if you store your passwords in the clear you may not pass these certifications and as a results you may end up in court.


Why can't the FBI copy the contents of an iPhone they are trying to crack? Making the news rounds now is a story about the courts ordering Apple to disable the automatic deletion of data after 10 failed password guesses.

What I don't understand is, why doesn't the FBI just copy the data from the phone? That way they can have unlimited tried to crack the encryption, or could just "restore" the data to another phone.

I'm not an iPhone user, so I might be missing something obvious here, but I don't understand why the FBI is blocked by this.

When trying to access the content of a hard-drive, you have to use the interface provided by said hard-drive. It usually comes with a firmware.

Currently, it is stated that this firmware will not allow data to be read without providing the correct password and that in case of 10 failed attempts, the data would be deleted.

To circumvent the restriction, you would have to :

rewrite the firmware with a less restrictive one, but the current one will not allow being replaced unless the new one is correctly signed with Apple keys
dismount the whole disks/ssd cells/whatever and put a new component to read from the storage. This requires very good knowledge on how the data has been written in the first place and eventually information that are store by the firmware in it's own memory (such as cell cycling for example). This operation can sometime be really difficult to perform, costly and might result in the destruction of the media.

Clearly the best way for any agency wanting to perform such hack is to ask for a new firmware, as it is easily replaceable and with no risk. Furthermore, the upgrade gets done by Apple themselves and not the agency.

The question about whether such agency are able to perform the latter solution remains open.


What can I do with crossdomain.xml access to a website I've been learning more about subdomain takeovers and trying to find other risks of them.

I have a fairly simple question; what can you do with access to a website via a crossdomain.xml file?

(ex. you takeover a.example2.com and example.com/crossdomain.xml says <allow-access-from domain="*.example2.com"/>)

Let's call them vulnerable.com and malicious.com instead, with vulnerable.com hosting a crossdomain.xml file which allows access by malicious.com.

When a victim visits malicious.com (e.g. after clicking on a phishing email), a Flash page hosted on malicious.com could instruct the victim's Adobe Flash plugin to send any request to vulnerable.com reading the corresponding responses. Here you can find an example of how to exploit it.

If at the time of the attack the victim is logged into vulnerable.com, then malicious.com will be able to act on her behalf on vulnerable.com, for example to read or change registration details bypassing CSRF defences.

Even if the victim is not logged in some attacks are possible, for example posting anonymous comments, logging in the victim as another user to perform abusive activities, attempt a DDoS by sending requests from many clients etc.


"Real" Salt and "Fake" Salt During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" as something seen in the original Unix crypt implementation that changed how the algorithm ran, thus requiring different code to be used to crack each password and greatly troubling GPU attacks.

Is there any merit to the "real" and "fake" salt discussion?

The distinction is arbitrary. A salt-aware algorithm works by taking input data and scrambling it in various ways, and there is no method for inserting the salt which is more or less "fake" than any other.

Trying to devise a password processing algorithm which is efficient on a general purpose CPU but does not scale well on a GPU (or a custom FPGA or ASIC) is a real research topic. This is what scrypt is about, and arguably bcrypt already does a good job at it. The idea here is to use accesses in tables which are constantly modified; table access in RAM is something that general purpose CPU are good at, but which makes things difficult for GPU (they can do it, but not with as full parallelism as what is usually obtained with a GPU).


What permissions should I give to a MySQL 'user' that searches my database? My site has a search form, which queries a few tables for whatever my end users want to find.

What permissions should I give my MySQL user in order to search the database and update the 'times searched for' column if needed?

Feel free to ask for more information or let me know if this is a duplicate. I did spend a good five minutes searching for it.

Give read permissions to the tables and columns necessary to perform the search and nothing more.


does the SOC 2 audit specification require credentialing? If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does the spec require that it be some credentialed 3rd party who does the review and report?  Or, can we DIY this?  Is there any requirement in the spec as to WHO does the audit and report?

The answer is yes
The ruling is very specific on this.

A SOC audit can only be performed by an independent Certified Public Accountant (CPA) or accountancy organisation. SOC auditors are regulated by the AICPA; they must adhere to specific professional standards established by the AICPA. They are also required to follow specific guidance related to planning, executing and supervising audit procedures. AICPA members are also required to undergo a peer review to ensure their audits are conducted in accordance with generally accepted auditing standards.
CPA organisations may employ non-CPA professionals with relevant information technology and security skills to participate in preparing for a SOC audit, but the final report must be provided and issued by a CPA. A successful SOC audit carried out by a certified CPA permits the service organisation to use the AICPA logo on its website.

For more useful information, read the whole page https://www.itgovernance.co.uk/soc-reporting