WebRTC shouldn't leak from a full, transport layer VPN ... right? I have read and re-read the questions about webRTC leaks and have a good understanding as to how this works and why IP addresses are leaking from so-called "VPN tunnels".

However, in all of those cases, the "VPN tunnels" are actually just software or application layer plug-ins or apps that work on the same layer, or just below, the browser itself.  It's unfortunate, but I understand how and why IP addresses could leak, via webRTC, from that configuration.

However, I am using a transport layer VPN called "sshuttle" that is a protocol agnostic, full VPN. It creates a bridge0 interface with pfctl and sends all traffic through it.

In this configuration, my localhost has NO OTHER IPs than 10.0.0.10 and ALL traffic is configured to run over the transport layer VPN.

And yet ... both google and browserleaks know my real IP.  Even my local system does not know my real IP, but somehow they do.

Am I correct in concluding that my VPN software is faulty/buggy/leaky ?  That is the only conclusion I can come to, since a proper, non-leaky transport layer VPN should not be able to leak info about an IP it doesn't know about.

Or am I wrong and webRTC is capable of even more magic than I thought ?

Thank you.

WebRTC leak and IP leak or DNS leak are two different terms and one shouldn't relate them with each other.

Why DNS leak happens?
When you use VPN and if you find that your IP is leaking it means your DNS request are also being forwarded to your ISP other than to your VPN provider. Your DHCP server chooses its own DNS server for fast response. This causes the DNS leak. You can test if your IP is leaking while using VPN dns leak

In WebRTC leak servers and browsers come to know about your internal IP Address if you are befind NAT but not all web-servers can do that.

How it works
Today your browsers are implemented with WebRTC. WebRTC accepts STUN request which is generated by STUN server. This request discovers behind which type of NAT you are sitting at and your public IP Address. WebRTC accepts this request and sends a response to STUN server that returns your NAT type and both public & private IP. STUN server uses 2 IP Addresses.

I wrote that not all web servers can discover your internal IP. The reason is not all web servers use STUN server because STUN server is designed for troubleshooting problems related with VoIP and NAT and how NAT creates problem in SIP&SDP.

While using VPN you might be able to prevent yourself from DNS leak but you can't prevent webRTC leak. To know your internal IP visit here. If you analyse the traffic of this site in wireshark you will see that it is generating STUN request.

How to prevent DNS leak
dnsleaktest.com serves a utility which blocks outside dns. I'm also using this tool. You can also flush dns cache using ipconfig /flushdns in command prompt or set static DNS address to Google or openDNS.

But remember preventing DNS leak doesn't mean you are preventing yourself from webRTC leak. VPNs doesn't block STUN request because it is just an internet traffic coming from STUN server.

STUN requests are made outside of the normal XMLHttpRequest procedure, so they are not visible in the developer console or able to be blocked by plugins such as AdBlockPlus or Ghostery

How to prevent WebRTC leak
In google chrome there are 2 browser plugins WebRTC Leak Prevent and WebRTC Network Limiter. They successfully block STUN request and I'm using them both just in case if one fails to do that. It also means that by blocking STUN request my browser won't be able to make VoIP sessions when I'm sitting behind NAT.

Mozilla Firefox users can actually turn off the default WebRTC functionality directly in Firefox settings by typing ‘about:config’ into the search bar and browsing to the ‘media.peerconnection.enabled’ option and setting it to FALSE.

WebRTC leak has nothing to do with how secure your VPN is and how strong encryption your VPN uses. The vulnerability is in your browser which is WebRTC itself. Your VPN will simply accept any traffic you have requested.Strictly saying, VPN doesn't prevent webRTC leak
It all depends on your browser. If webRTC is enabled it'll simply accept STUN request and send a response to server.

You can learn more about webRTC leak here


Possibility of Correlating Certain User Groups in low-latency Networks Lets first assume some things:

There exists an Adversary
There exists a known Group of Users of a certain System.
The User can communicate to the System through a small set of (to user and adversary) well-known Servers.
The Adversary wants to know if a certain User communicated with the System
The Adversary has a lot of resources and can see all incoming communications to the Servers of the System. (Assume some kind of tap)
The User of the System wants to mitigate the risk of an adversary seeing their communication and use a low-latency anonymity Network like Tor.
The whole communication between User and Server uses approximately 3 packets and uses TLS/SSL.

The Question is now: How likely can the Adversary mount an attack, where he uses some kind of correlation or timing attack to determine if an user communicated with the System. Assume the Adversary furthermore can either tap all Users communications or has control of many of many of the Autonomous Systems where the users traffic comes from.

First you look at the ingress part of the data. Fundamentally you put whatever sticks into the stream. Like modifying cookies or layer 6/7 session header injection. Later, you look at the egress packets. It doesn't matter that the connections are over an opaque cloud.

In fact, i think one can correlate the outgoing sets of packets from the origin host to the destination but that would probably require a lot of resources.


Does it strengthen or weaken security if one can't change the password he or she used before? I found a www service that allows to change passwords but it is not allowed the password to old password I used before. Does this have any impact on security? I mean, will people generate passwords from a list where the next password can be easily guessed, like password1, password2, ... I think this might weaken security if a hacker gets previous passwords and tries to find some pattern from the passwords.

The impact is undefined.   Choosing passwords that have a discernible sequence is an issue for sure in systems that require periodic password changes and disallow password re-use, however I'm unaware of any evidence that it is also an issue is system that merely allow password changes and disallow password re-use.

As with any system, the benefits and drawbacks offer trade-offs.  There are certainly drawbacks, such as having to store old password hashes that could potentially be stolen and brute-forced along with current hashes.  There are also theoretically potential benefits in that if previously used passwords that have been comprised can't be re-used, they can't give a malicious user additional attack windows.

Ultimately, the impact of this single control is minimal. It's unlikely to either help or harm security in any significant and meaningful way. It's far more important that users generate strong, unique password, don't re-use them across systems, and change them when compromise is suspected.


Is hidden gmail forwarding plausible? I'm currently investigating a situation where apparently emails I have sent from my gmail account have been also forwarded to another gmail account, without my being aware of it.

Is this plausible or feasible - that an email can be auto-forwarded, but not appear in "Sent Mail" and for the auto-forward rule to be hidden somehow?

What measures could I take to:

Establish whether this may have occurred?
Prevent it from re-occurring?

Sent emails can be deleted from the "Sent Mail" easily as part of a script. So that part is feasible.

Forwarding rules are meant for users to change, so there is no function to 'hide' a rule.

More likely that someone is logging into your account. Change your password and use 2FA on your account.


Is privilege escalation possible when shell is under www user? So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?

Yes.  The top two methods of privilege escalation are:

Kernel flaws. If there is a vulnerability in the kernel, this could enable an unprivileged user to gain root-level access.  Such vulnerabilities have been seen many times in the past.
Setuid programs. If there is a vulnerability in any of the setuid programs installed on the system, then an unprivileged user might be able to use this to gain root (or escalated) access.  Such vulnerabilities have been common in the past.

(There are other methods of privilege escalation, such as exploiting a race condition in the way that a program running as root uses the filesystem, or vulnerabilities in a system service/daemon.  However, my impression is that those are a bit less common.)

My rough rule of thumb is: if an attacker has access to a non-root account on your machine, you should assume that if they are sufficiently dedicated and sophisticated, be prepared that they may be able to get root on your machine.  It's not a sure thing, to be sure -- but reliably stopping privilege escalation is difficult, when the attacker has access to a user account on your system.

If this sounds abstract, let me make it more concrete for you.  You know how, for most smartphones, you can go on the Internet and find a way to root or jailbreak your phone?  Well, guess what -- when you run some program to "root" your phone, under the covers it works by exploiting some privilege escalation vulnerability in your phone.  Tools for rooting your phone have one or more such privilege-escalation exploits baked into them, and there is a phone enthusiast community that avidly looks for and collects such vulnerabilities.  Empirically, most phones can be rooted -- in other words, most phones have at least one such vulnerability.  The prevalence of such vulnerabilities gives you some idea of the difficulty of reliably preventing privilege escalation.


Inner Workings of Public Key Encryption After watching this video explaining PKE with tennis balls (interesting), it left me with a few particular questions that I'm having trouble finding answers to:

I assume that they keys used to unlock the padlocks are the Sender's and Receiver's public keys; if that's the case then does each endpoint in PKE have their own public key?
If the public key is "public" anyone can known it, then how does it secure the sending of the private key (if anybody could open the padlock and access the private key)?
In a real networking scenario, what does the tennis ball represent? TCP packets?
Can the public keys (which open the padlocks) be discarded after both parties have the private key?
How does each party generate their public key? Who generates the private key? How are these keys generated?

Thanks in advance.

That video is misleading on several fronts.  What you are seeing there is actually a Diffie-Hellman key exchange in progress.  The so-called "private key" is not really a private key in the sense of PKI.  The tennis ball represents an encrypted message and when decrypted contains what they label as the "private key" but should have labeled as "secret key". The locks represent a message encrypted with a public key, and the rubber gloved hands have (unlabeled) keys which unlock those locks representing the true private key.

In public/private key systems like RSA, there are two keys: the public key and the private key.  Each key is represented by a number. However, due to various mathematical concepts surrounding prime numbers, their scarcity, and the extreme difficulty of determining how to factor large numbers composed of prime numbers, one person can hold the private key (and NEVER expose it publicly) while allowing the public key to be distributed as freely as they wish.

Fundamental to public/private key cryptography is the property of asymmetry. Only the private key can decrypt information encrypted by the public key.  Because the public key is known to everyone, this means anyone can ENCRYPT a message destined for the holder of the private key.  However, only the private key holder can decrypt it.

Furthermore, public/private key crypto also has the property that the holder of the PRIVATE key can sign a message.  You might see many questions asking whether one can "encrypt with the private key".  "Encrypt" is not the right word because the confidentiality of the message cannot be guaranteed.  Instead, the term "sign" is used and it has a very specific meaning: only the public key can verify the signature. This means that a holder of a private key cannot claim they did not author the message. This is known as non-repudiation and is important when ensuring that a message was not altered.

If you wanted to make a video that discussed the fundamentals of public/private key encryption using the same props as in the video, then you'd need to do the following:

Give out copies of the lock to anyone who asks
Tell them to put a message into the tennis ball and lock it and send it to you
You can then unlock the lock on the tennis ball

The analogy is weak, however, because locks can be picked, opened, and reverse-engineered. Private keys can be "picked", but it might take tens of thousands of years of computing time to do it which is out of reach of ... everyone?

EDIT: I should mention that Diffie-Hellman is very important as a mechanism to distribute what are called "symmetric" keys.  Because of their asymmetric properties, public keys can be distributed freely in the clear without any issues.  However, because a symmetric key is used for both the encryption and decryption, you can't simply shout them across the room.  Their distribution has to be very tightly controlled.  Diffie-Hellman uses public/private keys to protect the distribution of the secret symmetric key.

As a matter of practicality, asymmetric keys are slow and cumbersome to encrypt large amounts of data. Symmetric keys are much faster. So generally what happens is that the symmetric key is used to encrypt bulk data, and must then be transmitted to the receiver to allow them to decrypt it.  Public/private keys are used in Diffie-Hellman to exchange this symmetric key.  The symmetric key can be considered a session key and need only be transmitted once or as-needed depending on if any expiration policies are in place.


Does MS16-087 imply Windows 7 computer vulnerable from Internet? I just read the MS16-087 security bulletin and the articles by Vectra (who apparently discovered the vulnerability). As I understand it, MS Point and Print offered a delivery of print drivers from a printer or print server without UAC query to user.

I am concerned about a colleague using a Windows 7 Professional computer without the patch, but don't want to update that system unless absolutely required because it is running a critical business application that I don't want destabilized by Microsoft shenanigans (e.g., Win 10 forced updates).

It is a single workstation with directly attached printer (USB cable). They use Internet for business only, e.g., email, business related websites.

They are running Kaspersky AV and firewall.

If I warn them to be especially cautious about not visiting websites without business validation and even then to be cautious about printing from a web page, would they be unlikely to be hit?

It seems to me you would need to go to an Internet watering hole attack vector and agree to print or accept a printer driver to be hit with malware related to this vector. The internal network is only accessible to a DSL router with firewall.

IMHO, the risk can be maintained reasonably low, because the attack vector needs that the user connects to an infected printer server or installs an infected driver on his machine.

That means that provided that the user is an educated one of has no administrative priviledge, either he will not even try to install a new printer on its machine, or will not be able to.

It can only be seen as a workaround and documented because if the machine should be reused later it would be critical to pass the patch. But it can be helpful if for any reason it is not possible to path a specific machine.


What is the Akamai Name Server I see for some big companies? I have played with DNS a lot lately, and I have found that some big companies' web sites use the Akamai NS as the Name Server for their WWW servers, for example:

$>nslookup
> www.redhat.com
Server:     192.168.43.1
Address:    192.168.43.1#53

Non-authoritative answer:
www.redhat.com  canonical name = www.redhat.com.edgekey.net.
www.redhat.com.edgekey.net  canonical name = www.redhat.com.edgekey.net.globalredir.akadns.net.
www.redhat.com.edgekey.net.globalredir.akadns.net   canonical name = e86.b.**akamaiedge**.net.
Name:   e86.b.**akamaiedge**.net
Address: 2.23.96.112

> www.ynet.co.il
Server:     192.168.43.1
Address:    192.168.43.1#53

Non-authoritative answer:
www.ynet.co.il  canonical name = ynet.co.il.d4p.net.
ynet.co.il.d4p.net  canonical name = a39.g.**akamai**.net.
Name:   a39.g.**akamai**.net
Address: 81.218.31.170

I have looked up at the Akamai website, but couldn't find the exact problem this is supposed to solve for its users, but I could understand that it is related to security (maybe to prevent DDOS attacks).

Does anybody know what kinds of attacks it is supposed to solve? or maybe I am just wrong and there isn't any relation to security but to outsourcing the DNS management?

Akamai is one of the largest CDN companies in the world. CDN networks make web sites perform faster by bringing content closer to web sites visitors, through different technologies.
CDN can shield web sites from surges in traffic whether it was benign traffic (a site hosting a hot video), or malicious when the site is under DDoS attacks. This protection comes from the size/scalability of CDN vs a regular web site's (10000s of servers vs 10s).
For the content web sites want to be served via CDN they will create a CNAME that points to an A record that belongs to the CDN (as the output of nslookup above).


It is possible that brute force attempts are successful before the worst case, correct? When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?

What happens if the brute force method is successul in much less time than the 'worst case'?

The recent event with LastPass where they noticed a lot of traffic leaving their server had thinking about this. Could someone have downloaded my LastPass data, which has all my usernames and passwords, and attempt a brute force crack on it to decrypt it? I have used a very long password to encrypt my data which should be difficult to crack, but what about in 5-10 years when we have much faster computer hardware. Could this be cracked at that point?

For most cracking attacks, the average attack cost is about half the cost of the worst case. Simply put, if there are N possible passwords, you will hit the right one after about N/2. Note that this is an average: you can always "get lucky" or "get unlucky" on any single instance. This can be quantified: the probability of finding the right password after trying out M is M/N. Thus, there is a 1/10 chance of cracking the password in a 10th of the time of the worst case, 1/20 chance for the 20th of the worst case, and so on.


Managing and deploying web app passwords What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally to using dedicated hardware or a general cloud provider and not any specific provider like Heroku or EC2.

Is the best you can do without an HSM is to deploy the credentials in a plain text file to a read protected directory that can be accessed only by the web app user? Should you have one file with all passwords or a file per user or store in environment variables? How do you manage actually putting them on the servers? Can you use a configuration management tool (e.g. chef/puppet) to deploy them and keep them up-to-date? How should these credentials be stored? Should they be stored in encrypted format in the source control directory containing the configuration management configs? Any recommendations on tools to use that may be helpful? (e.g. keyczar, secret server, etc.) If the passwords are encrypted what's a good way to share the decryption key among the DevOps team? (LastPass, KeePass, etc.?)

I know that's a long list of questions, but these are all things that I haven't found good answers to. I'm interested in any info whether that's a case study of someone doing it well, trade-offs to be made between different alternatives, things that should be clearly avoided or aimed for. I really don't know what best practices exist and have helpful tools vs. what we just have to decide for our own situation and solve on our own.

Your question is very vague and covers a number of areas.  An example would be most helpful.

Based on the title of your question, it seems you're interested in how to securely handle credentials that are required by an application.  If this is a Microsoft environment one can encrypt sections of the web.config which is used to store sensitive information (SQL logon credentials, etc.).  This post offers a good explanation: why-to-use-rsa-for-dpapi-web-farm-encryption.  In short, if you have a single webserver DPAPI is the recommended solution whereas RSA keys are preferred for web farms.

However I believe you're also interested in a enterprise password management solution.  SANS instructor Jason Fossen posted a great entry on his Windows Security Blog.  He wrote a script that will assign a unique password to local accounts and leverages asymmetric encryption to save the password to a centralized location.  In the entry he also mentions a number of commercial products in the Password Vault or Enterprise Password Management space.

HSM is typically only used for critical accounts like domain/enterprise administrators or for certificates used by critical infrastructure.  For general or everyday use, these enterprise password management solutions are great.

Quite some time ago I looked into the Lieberman solution and found it to be very cool.  There's full auditing to log the user accessing credentials, what credentials were access, and of course when.  There's also flexibility to setup temporary accounts (only good for x time) which is useful for contractors, consultants, etc.


Should user be allowed to save password in browser? The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared environments such as Internet Coffee shops"

But disabling autocomplete attribute doesn't prevent browser from storing password when registering. How do I prevent users from storing password in their browser? (i.e. appearance of browser's popup "Do you want to save this password?" after registration or login)

Storage of password in user's browser may be dangerous because of trojans that can steal it. However auto-completing password may help from key loggers and men staying behind the shoulder. So should user be allowed to store password in it's browser?

You cannot prevent the user from writing down his password on a stick-up note, and "hide" it under the keyboard. You cannot prevent the user from giving his password to his wife, friends, and colleagues. You cannot prevent the user from choosing as password the ID tattooed in the ear of his dog (there was even a commercial from a big French bank which promoted exactly that). For that matter, you cannot prevent users from typing their password on an Internet Coffee shop machine, which is already a bad idea, due to the threat of key loggers.

So I tend to say that password security is the responsibility of the user, and if he is intent on doing something stupid, you cannot truly prevent it.

Note that "auto-complete" is something a bit different, because it is about a Web browser filling data automatically regardless of the target page; normally, the "saved password" feature is tied in the browser to a specific page (or site), so it does not exhibit the privacy issues that auto-completed non-password field elements have (and which your auditing company rightly points out). Password saving is supposed to be handled with sufficient care by the browser itself.

Nevertheless, there seems to be some ways to prevent password storage from the page itself, or at least people who share your concern, possibly for administrative reasons which may or may not be rationally substantiated; see, for instance, this question on StackOverflow.


Safety of routing a network to a firewall I am studying for my CompTIA Security+ qualification and have come across the following question.

Question :

You are implementing a testing environment for a development team. They use several virtual servers to test their applications. One of these applications requires that the servers communicate with each other. However, to keep this network safe and private, you do not want it to be routable to the firewall. What is the best method to accomplish this?

My thoughts:

My issue is with the penultimate sentence of the question.
Namely, what would be one's reason for not wanting this network to be routable to the firewall?

The only real reason to prevent a network from being routable through a firewall is to make sure it's isolated both from external and internal unauthorized access. It's impossible for someone to hack into a system if there is no physical path for electrons to travel from their position to the target system's position. By unplugging any cables linking the target system(s) to the rest of the world this ensures there is no physical path.

This does however drastically reduce the network's functionality and ease of use since you'd need to be in a specific physical location to interact with any of the target machines. The more secure something is the harder it is to use and the less functionality it has.

If the testing environment doesn't need internet access then the best/easiest thing to do would be to just not connect it to the firewall at all. Just create a testing subnet, put all the servers in it and plug them all into a switch. All the servers will be able to talk to each other and since there is no physical connection to the firewall it's impossible for anyone that doesn't have physical access to the switch or servers to access them.

If the testing environment does need internet access then I would still create a network zone for them (same as above) but in the firewall I would ensure there is a deny rule for any traffic destined for the testing environment. Since any firewall I've seen manufactured in the past 5 years has statefull inspection turned on by default and most of them don't even have an option to disable it, this will allow the servers to reach out to the internet and traffic coming back on that same port will be allowed.

Depending on what exactly they mean by "safe and private" the second scenario is the most likely to be implemented in real practice since almost everything needs to reach the internet for remote management and patches. The first scenario though is the "safest and private-est".


Nmap scan output for other nmap scan I was wondering if it was possible to output the result of a nmap scan (>, oN/-oX/-oS/-oG, or an other way) in a way that I would be able to import the results for another nmap scan.

For example, first scan is a ping scan, it outputs the results in a file. Later I decide to do a SYN scan for each of the hosts that was alive (in the first scan). Is there a way for this? Do I have to make a script that would do this task? Thanks

Nmap's -iL option will take as input a file with one target specification per line. If you are using -oA or -oG, you can quickly grab this from the grepable output of a prior scan result using awk:

nmap -sn 192.0.2.0/24 -oA previous
awk '/Status: Up/{print $2}' previous.gnmap > targets.txt
nmap -Pn -iL targets.txt

The same info can be pulled from other output formats, but use the tools that are appropriate and available to you. Also remember that a host's state can change over time, so using -Pn to skip host discovery in the second nmap command above would not be recommended if a day or more elapsed between scans.


This is just straight ASCII represented in hexidecimal.  I removed the newlines and the following python code will display it:

>>> from binascii import unhexlify
>>> ascii = "7b5c727466315c616e73695c616e7369637067313235325c64656666305c6465666c616e67313033337b5c666f6e7474626c7b5c66305c666e696c2054696d6573204e657720526f6d616e3b7d7b5c66315c666e696c5c66636861727365743020417269616c3b7d7b5c66325c666e696c5c6663686172736574302054696d6573204e657720526f6d616e3b7d7d0d0a7b5c636f6c6f7274626c203b5c726564305c677265656e305c626c7565303b7d0d0a5c766965776b696e64345c7563315c706172645c6366315c66305c667332305c7061720d0a5c6366305c6631204c6f74204e696e65202839292c206f66204245415220435245454b20504f4c4f2052414e43482c20616e206164646974696f6e20696e20456c6c697320436f756e74792c2054657861732c206163636f7264696e6720746f20746865206d6170206f7220706c61742074686572656f66207265636f7264656420696e20436162696e657420432c20536c696465204e6f2e20343535206f662074686520506c6174205265636f726473206f6620456c6c697320436f756e74792c2054657861732e5c6366315c66325c7061720d0a7d0d0a00"
>>> unhexlify(ascii)
'{\\rtf1\\ansi\\ansicpg1252\\deff0\\deflang1033{\\fonttbl{\\f0\\fnil Times New Roman;}{\\f1\\fnil\\fcharset0 Arial;}{\\f2\\fnil\\fcharset0 Times New Roman;}}\r\n{\\colortbl ;\\red0\\green0\\blue0;}\r\n\\viewkind4\\uc1\\pard\\cf1\\f0\\fs20\\par\r\n\\cf0\\f1 Lot Nine (9), of BEAR CREEK POLO RANCH, an addition in Ellis County, Texas, according to the map or plat thereof recorded in Cabinet C, Slide No. 455 of the Plat Records of Ellis County, Texas.\\cf1\\f2\\par\r\n}\r\n\x00'

Things to recognize are the 0x0a, 0x0d ASCII characters at the end that represent a line feed and carriage return respectively.  Also a lot of the text is between 0x41 to 0x5A (A-Z), and 0x61 to 0x7A (a-z).

To address your question about recognizing encryption.  Unless the communication protocol or file format provides you with the algorithm type there is generally no way to tell one encryption algorithm from another just based on encrypted data.  For files it can be provided in a file header value.  You'd still have to know what value in the header represent an encryption algorithm, and then further you'd have to determine which algorithm the value represented.  For secure communication protocols the algorithms are generally negotiated during the protocol's initialization.


Info about gpg setup on MacOS On Mac OS Mojave:

▶ gpg --list-keys
Warning: Failed to set locale category LC_NUMERIC to en_GR.
Warning: Failed to set locale category LC_TIME to en_GR.
Warning: Failed to set locale category LC_COLLATE to en_GR.
Warning: Failed to set locale category LC_MONETARY to en_GR.
Warning: Failed to set locale category LC_MESSAGES to en_GR.
/Users/pkaramol/.gnupg/pubring.kbx
----------------------------------------------
pub   rsa2048 2019-07-04 [SC] [expires: 2021-07-03]
      1DA2A2434A38D1192A3EA4523FEF5E3944A2F025
uid           [ultimate] pkaramol <pkaramol@gmail.com>
sub   rsa2048 2019-07-04 [E] [expires: 2021-07-03]

~/Desktop
▶ ls ~/.gnupg
openpgp-revocs.d  private-keys-v1.d pubring.kbx       pubring.kbx~      trustdb.gpg

From what I understand, the public key is : /Users/pkaramol/.gnupg/pubring.kbx

How can I find out what is the corresponding private key?

pubring.kbx is the public key database. Private keys are in private-keys-v1.d/. As the pubring.kbx contains all public keys, there is no such thing as a "corresponding" private key.

To interact with the keyring, you will have to use the gpg command. gpg -k will list the public keys, while gpg -K lists the private keys. When a public and private key have the same ID, they are corresponding key pair.

If you need the key(s) as a file, you can use gpg --export for public keys and gpg --export-secret-keys. You can also specify the key that you like to export, or use the -a option to get an ASCII (plaintext) output.


Nmap NTP scanning monlist I'm trying to find if an NTP server allows or disallows usage of the "monlist" command with Nmap, but I haven't found how to do that.

I found the following script : https://nmap.org/nsedoc/scripts/ntp-monlist.html

But I have no clue how to use / install it correctly.

UPDATE :

Result with the first command on a random NTP server :

  Starting Nmap 7.12 ( https://nmap.org ) at 2016-09-04 13:02 Paris, Madrid (heure d?été)

  Nmap scan report for 213.140.255.15

  Host is up (0.069s latency).

  PORT    STATE SERVICE

  123/udp open  ntp

  Nmap done: 1 IP address (1 host up) scanned in 7.50 seconds

With the second one :

  Starting Nmap 7.12 ( https://nmap.org ) at 2016-09-04 13:04 Paris, Madrid (heure d?été)

  Nmap scan report for 213.140.255.15

  Host is up (0.070s latency).

  PORT    STATE SERVICE

  123/udp open  ntp

  Nmap done: 1 IP address (1 host up) scanned in 7.32 seconds

But I'm not seeing any output on Monlist being enabled or not on the server.
Is it eventually because it's disabled ?

nmap --script +ntp-monlist -p 123 -sU <ip or hostname>

or perhaps

nmap --script ntp-monlist -p 123 -sUV <ip or hostname>


gpg importing public key I'm trying to follow this: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-gnupg-import.html to import a key.asc using gpg --import key.asc, so that I can try to verify it, but I get the error:

gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

How can I resolve this? (Easy way?)

Easy way? Get whoever provided you the key file to give you a valid one, because they one they gave you is damaged or was generated incorrectly.

Without seeing the key itself, nobody will be able to give you more information than that, short of a lot of guesses of ways that the key could be invalid or a lot of instruction on the format of OpenPGP keys sufficient for you to recognize the problem with the key yourself.


Encrypt and Authenticate localhost-traffic? I have some app-components on the same machine but in different languages which need to communicate. I am using socket communication over localhost to do so. The data transferred is confidential.

Should this communication be encrypted?

I mean an attacker would have to be able to run code on the machine in order to intercept this and in that case the user lost anyway, right?

You need encryption to deter passive attackers (evil people who spy on the line and try to work out the data contents), and integrity (and its sibling authentication) to block active attackers who alter the data while in transit. SSL provides both. However, this makes sense only in contexts where attackers can actually spy on or alter data in transit. For two process on the same machine, communicating through the "localhost" network, attackers who can do that have, usually, "already won".

Details may differ depending on the OS. However, your security will normally depend on the OS, not on encryption. Consider, for instance, a Unix system with multiple users. If your two processes talk to each other, then processes from other users cannot peek into the data exchanges (unless the attacker is root, and then he can do anything); however, they may try impersonation: at some point, one of your components must connect to the other, and the rendez-vous point for TCP sockets is a port number. An attacker who can run his own code (as an ordinary user) on the machine may maintain a fake server which will receive the connection request in lieu of the intended component. To protect against that, the client would have to make sure that it talks to the expected server (and vice versa): this can be done with SSL, but better solutions exist (in this case, using Unix-domain sockets with a path protected by system access rights and/or getpeereid()).

If, in your case, the local machine is assumed to be "clean" (no hostile code runs on the machine, under any identity), then connections to localhost are safe and there is no need for any extra protection. If potentially hostile but unprivileged code may run on the machine (that's the "shared multi-user machine" model, as was typical of Unix systems in the late 1980s), then you should use the OS features to make sure that connections are indeed conveyed to the right process (i.e. to a process running on the expected identity). SSL would be overkill.


What is more secure for voice and SMS OTP: A random number or generated similar to HOTP? Many providers are creating OTP authentication for their sign in.  However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard emitted by Google Authenticator.
I see these six digit OTPs when:

Authenticating using a phone call (Google & some banks ...)
SMS to my phone (Facebook & Google ...)
Verifying an account through verified email address
Verifying my home address (Google Business, IRS strong authentication)

... namely any OTP that doesn't use a smart OTP token or device (YubiKey, Google Authenticator,Gemalto, etc)
Question

With regard to protecting the IdP that issues the OTP, what are the benefits and drawbacks of using a random number vs a seed like HOTP?

Here are how a few scenarios could play out if the one time password is stored in a database.  One scenario is HOTP-style seed based, the other scenario is random number based:

If the (salted) password database is stolen/extracted, it's likely that the HOTP seed is stored in that same location.  Datacenter security in this scenario relies exclusively on protecting the database & HOTP seed.
The attacker would have the HOTP seed until that seed is reset, which is likely never.

Conversely, if the number is generated from random() and written to the database then there is no seed to compromise. The only way it could be exploited is if the attacker had real-time read access to the database.

From that quick outline it appears that seeded OTP (like HOTP) should not be used in these scenarios (voice, and SMS).
Is this a correct conclusion?

The tricky point is pre-usage synchronization. When you want to use a one-time password, the client must "somehow" learn the one-time password to use. HOTP is for situations where this out-of-band synchronization is through a counter which is maintained both client-side and server-side.

If you have another out-of-band mechanism which can be invoked on a per connection basis (e.g. a SMS), then you do not need the counter management that HOTP provides. HOTP is also a good PRNG, but it is simpler to generate random one-time-passwords from the OS facilities (/dev/urandom and its ilk). As you point out, HOTP is similar to a PRNG with a secret key, and key theft implies compromise. With a fresh random password for each connection, an attacker who can peek at the server database might learn the current OTP for a given users, but will know nothing about the next OTP, so the damage is contained in time.

Using HOTP (or its time-based variant TOTP) in the SMS-based scenario is not awfully weak -- this is a good model which supports user tokens. HOTP is sane usage of cryptography. But if you have an out-of-band channel available for quasi-immediate transmission of the OTP (such as a SMS), then you can use random generation which will be even better.


AES-256-GCM using GnuPG Is there a way to encrypt files with AES 256 in the authenticated GCM mode using GPG?

I don't see GCM in supported cipher modes. It seems that the GPG uses only one mode (its own modification of CFB), although libgcrypt supports GCM.

Edit:

GnuPG relies on Modification Detection Code (MDC) based on SHA-1 for authentication. It's unclear how the authentication performance of the MDC compares with the HMAC in GCM.

GnuPG is an ancient design that wasn't designed from the ground up to do authenticated encryption properly. This is, for example, one of the causes of the Efail vulnerabilities. GnuPG will output the whole plaintext for forged messages to stdout before checking its message digest code.

If you're looking for a commandline file encryption tool that follows modern best practices, age seems to be the up and comer right now. It uses ChaCha20-Poly1305, though, not AES-GCM as you're asking.

If you need public key signatures, signify is a much recommended newer tool.


How do I secure my REST API? In detail here's the problem:

I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a while, I feel like there are only two approaches that I can take.

During Registration, I use https and get the user's credentials; save it in my DB against the username(server side). During Login, again I use https, and ask the user's credentials; verify the hashed password on the DB and return him a session ID, which I'm planning to never expire unless he Logs Out. Further any other API calls (GET/POST) that the user makes, will be accompanied with this session ID so that I can verify the user.

But in the above approach I'm forced to use https for any API call, else I'm vulnerable to Man in The Middle Attack, i.e. if anyone sniffs over my session ID, he can reconstruct similar GET/POST requests which I wouldn't want. Am I right with the above assumption?

The second option is to follow the path of Amazon Web Services, where I use public/private key authentication. When a user registers I use a https API to save his/her credentials in the DB. From then on I use the user's hashed password as the private key. Any further API calls that the user makes will be having a hashed blob of the request URL using the user's private key. On the server side I reconstruct the hash using the saved private key. If the hash is a match I let the user do his task, else reject. In this option I need to use https only for the registration API. The REST can go on on http.

But here the disadvantage is, that I'm forced to host my Registration API in a separate Virtual Directory (I'm using IIS and I'm not sure if I can host both http and https APIs in the same Virtual Directory). Hence I'm forced to develop the Registration API in a separate project file. Again Am I right with the above assumption?

Edit: I'm using ASP.NET MVC4 to build the web API.

The reason I'm reluctant to use https for all of my REST API calls is that I feel it's not lightweight and creates more network payload, which may not be best suited for a mobile app. Further encryption/decryption and extra handshake required may further affect a mobile's battery Life? Or is it not significant?

Which of the above two approaches would you suggest?

PS: We went with Https everywhere, and it was the best decision. More of that on my blog.

I'd go with SSL/TLS everywhere (since you control both sides, forcing TLS 1.2 should be feasible). It's relatively simple to use, and you get a lot of security features for free. For example if you don't use SSL, you'll need to worry about replay attacks.

If you're worried about performance, make sure session resumption is supported by both the server and the client. This makes later handshakes much cheaper. Since the handshake is quite expensive in SSL compared to the encryption of the actual data, this reduces overall load considerably.

If you use HTTP 2, you can even send multiple requests over a single connection, that way you avoid the complete TCP and SSL handshake overhead on later requests.


What are the risks of allowing Web Password Managers on a Corporate Network I recently encountered a situation whereby a manager decided that LastPass should be blocked from the corporate network.

There was a concern that people might have corporate account details stored in Lastpass.

Dashlane, 1Password are not blocked as I can get to both websites - LastPass is inaccessible.

I am trying to understand the risks to the business and how they could best be mitigated to avoid such problems.

What governance or security risks and issues are being addressed by blocking web password managers from the corporate network?

You are right that a password manager that has storage online presents the risk that corporate credentials could end up in public if that online storage is breached, so it is normal, even expected, for these to be blocked.

Password managers with local storage, however, can be a benefit in large corporate networks that don't have Single Sign On (SSO) as they reduce the risk of users either writing things down (as they need to remember too many passwords) or forgetting logins and then loading down the help desk for password resets.

We have a number of posts on here around password management, and there is a strong move across industries to make it easier for humans to do the right thing. Password managers can help in this respect, but read the associated questions for a more holistic view of what can be done.


Subdomain-only SSL security/availability CAcert and StartSSL both only validate domains whose TLD is owned by the requester. I have a few subdomains that come from places like freeDNS that I would like to run an SSL-secured server on. Are there any CAs that offer this service for free, and, if so, what are the possible security flaws created there? It seems to me that the owner of the TLD can't do anything if the subdomain just redirects to the server where the cert is stored, so it shouldn't be such an issue.

That's a tough one. Real domain "ownership" happens at the registrar level. Subdomains can be doled out by the domain registrant, but that level of of ownership is difficult to verify, and the terms and duration of your control over a given subdomain are not necessarily clear to the CA. As such, CAs that do simple domain control validation would categorically deny any such requests; it wouldn't fit the security rules they've set up.

Instead, such request would have to go through the domain owner, like FreeDNS. They're the only party that could realistically determine whether or not such a cert should be granted and for how long, and therefore they're the ones who the CA would want to talk to.

A better solution is to register your own TLD. Dynamic DNS can still be done with your own domain name, plus it simplifies your interaction with CAs and other similar organizations.

Alternately, you can always use a self-signed certificate. Self-signed certs are just as secure as CA-signed certs as long as you can verify that the site is serving your certificate. In fact, if you're doing custom certificate validation in your browser, it's actually more secure than a CA-signed cert because you're not subject to attacks involving malicious but properly-signed certificates.


HTTPS - Having TLS configured on Load balancer Finally we're moving our company website from HTTP to HTTPS (because of Chrome that show a Not Secure warning for all pages served over HTTP).

In my experience I know it is better have TLS handshaking configured on load balancers, because this will remove the overhead from Web Servers.

But the person who manage the network discouraged me to configure HTTPS on load balancers because of security concerns. In a few word he explained me that have the https on our load balancers put our website in a risky position, for example we are more vulnerabile to DDOS attack.

Is this true?

What are the security drawbacks of having SSL configured directly on load balancer and what if I have SSL configured on a WebServer/Reverse Proxy?

I have had to architect around this problem.

TLS off-loading does put greater load on the load-balancers. Not only do they take the brunt of all the traffic, but then they have to decrypt the traffic, too. If you can do the TLS function across the distributed web server estate, you spread the load.

But this is NOT a security concern. This is a load balancer capacity concern. If your load balancers are at such a capacity that they can't handle TLS, then you are near enough to a DoS event that it might not matter. Time to consider hardware that is better designed or that can handle greater capacity.

What is a security concern is that if you keep the TLS processing on the web servers, then you cannot place other protective technology in front of your web servers and after the load balancers (like WAF or anything that needs to inspect the traffic). TLS on the load balancers means you can inspect the traffic in the clear.

As always, there is security/usability/budget balance that everyone needs to strike. If your network manager says that TLS will break the load balancers (oops), then you need to put it elsewhere.


Techniques to pinpoint XSS injection point I am trying to figure out a way to understand which line of a JavaScript script is responsible for an XSS injection. Let's assume that I have a website that prompts for my name, and on some page, I set my name as something like <script>alert("XSS")</script>.

Later, I browse the website and somehow I see my payload being executed. I look at the source of the page, and I see that my payload is not there, so it should have been triggered by some JavaScript code. What is the best way to find which line of code is actually responsible for the injection? I usually look for innerHTML(...) calls, trying to figure out the ID of the element where my payload is injected, but it doesn't always work. I also tried using <script>debugger;</script> as payload, but I just see my script being debugged, and not the one responsible for the injection.

The best thing would be if there was a way to stop the execution of the script responsible for the injection right after the alert() is triggered, but I didn't find any way. Any help?

Partial answer here: If the script is executed with the help of eval (which is what happends if you use html() in jQuery 2.x), you can change the payload to something throwing an error:

throw "XSS payload executed!";

Then fire up the console (F12 in most browsers). Browse the site until you trigger the payload. When the error is thrown you will have a nice little strack trace to inspect in the console.


Prevent program from switching to user without password I created a user with useradd without specifying a password. When I try to

sudo -u theuser echo hi

I am being prompted for my admin password (unless specified otherwise in the sudoers file, of course).

su -c "echo hi" -s /bin/sh theuser

asks for teuser's password which is strange, but does not work either. Which is good.

I am now executing a

./malicious_binary

Is it safe to assume that it also cannot switch to theuser (without my explicit confirmation), even though it does not have a password set? (Or should I set an arbitrary password just to be sure)?

...su -c ... theuser asks for teuser's password which is strange,...

There is nothing strange about this but this is exactly how su is supposed to work. It might be useful to make yourself more familiar with the concepts behind su and sudo and how they differ. In short: su allows user A to execute a command as user B provided that user A can also authenticate itself as user B. In this case A can execute anything as B because A can actually be B. sudo instead allows user A to run only the specific commands in the context/permissions of user B, which root as explicitly allowed A to run in this context. Thus the authentication asks for use A to make sure that this is the user which is allowed to execute this specific command as B.

  Is it safe to assume that it also cannot switch to theuser (without my explicit confirmation), even though it does not have a password set?

No, this is not safe to assume.
 su needs the password of B and if there is no password set you effectively cannot login as B (note that no password set is different from an empty password set). But, sudo only needs a successful authentication of A, which the user has. If the sudo permissions are set too broad then A might be able to break out of an allowed command to execute other code.
A classic example for this case is when A is allowed with sudo to edit a specific file with vi as user B. But, it is possible to execute arbitrary external commands from within vi. This means that once A is running vi within the context/permissions of B he can also execute any other commands from within the editor session and these will also run as B.

Apart from that there might be other attack vectors which allow privilege escalation for A. There were in the past enough bugs in the linux kernel or system setup which allowed such attacks. Thus, if you are not running a system which is still supported and keep it always up-to-date there is a fair chance that your system is affected by such security bugs.


Will this Setup Protect My Data Files from Malware (e.g. Ransomware)? I set up an external drive for data backup (an SD card inside my laptop card slot).  In addition, I connect with a cloud drive for offsite backup (an app that I run only when syncing files).

I always sign in and use my laptop as a 'standard' user.  My external drive is set for UAC 'read' privilege only.

I then set my data sync app to run as admin only - meaning I need to type in the admin password before data can be synced to my external drive and to the cloud.

Of course I will remain vigilant about keeping OS and apps updated and avoid clicking email links or downloading unsolicited payloads,etc. -- but in case I miss something and a ransomware comes through, will my Win 10 system stop that ransomware from encrypting my external drive?

TL;DR: I'd suggest you to alternate two SDs, to enable Windows Defender Ransomware Protection and to consider switching to incremental backups.
Your Weaknesses
Your setup is better than the default one, but it seems to have a couple of weaknesses:

You might inadvertently synchronize partially encrypted files, propagating the encryption to all media
Depending on how your synchronization app works, attackers who compromised your cloud drive might encrypt it and wait for the encryption to propagate locally
Local malware might escalate privileges to local administrator bypassing UAC, proceeding to both harvest cloud credentials and then to encrypt local disks

Proposed solution
The key to protecting from ransomware is making valuable backups inaccessible from the potentially infected host. That can be achieved by alternating backup media, or by having a different host access your host and pull the files. You can alternate a couple of SDs (I always keep one encrypted backup in my wallet), or simulate alternating media by having your administrative APP do incremental backups (though that remains exposed to privilege escalation).
Mind some advanced manual ransomware attacks of the past were known to start by encrypting backups, patiently waiting for months for all copies to be overwritten. Only then they proceeded to encrypt the actual data and ask for the ransom. One assumption of IT security is: "the attacker knows your system".
Modern anti-malware software also helps, as it usually includes shadow backup solutions and behavioral analysis detecting and stopping ransomware, but it is not a silver bullet, also because it is subject to the aforementioned privileged malware. In any case activate Windows Defender Ransomware Protection.
Balance the cost
As usual the key point is: how much security is enough? Just enough. If you don't have very valuable data, don't look for the full mitigation, as costs increase exponentially (also in terms of time) but security increases asymptotically.
Additional risks
By backing up unencrypted files to media or the cloud you expose yourself to data leakage. I strongly suggest encrypting backups.


How do you use a public key to encrypt a string I am oversimplifying but I understand that a public key is the product of two large prime numbers.  In essence as long as the private key is kept private, the owner knows something that the outside world does not.

My question is, how, in simple terms does one take a string or number (like a proposed symmetric key for a session) and encrypt it with the public key, in such a way that:

a) the rest of the world with the public key cannot decrypt it (since they also have the public key) and
b) the owner with the private key can?

Thanks.

There's a few different things here.

  a public key is the product of two large prime numbers

That is partially true for RSA, though RSA public keys also contain an additional integer (e, in the algorithm's description). Other public key algorithms, and even public key ciphers, do not work the same way (see ElGamal Encryption, for example.)

  as long as the private key is kept private, the owner knows something that the outside world does not

This is correct. Specifically, the critical element is that only the holder of the private key can perform operations (in practice, generally just "reversal") related to operations that can be performed with the public key, and the private key cannot be derived (in a remotely plausible amount of computation) from the public key.

  how, in simple terms does one take a string or number (like a proposed symmetric key for a session) and encrypt it with the public key

The Wikipedia link for RSA, given above, has a very nice step-by-step breakdown of the algorithm in use for both encryption and decryption, in math you can probably follow (the other algorithms arguably require more mathematical background).

  in such a way that the rest of the world with the public key cannot decrypt it (since they also have the public key)

Anybody can encrypt a given plaintext with a given public key, and produce a ciphertext that cannot be decrypted without the corresponding private key.

Two parties with the same plaintext and the same public key will, if they use the same padding (basically, a way to convert or short string or number into a number of the correct size for the cipher in question) and cipher, produce the same ciphertext; an adversary who knows that the plaintext was one of a limited number of values could potentially use this to identify which value it was, but for a key exchange (such as is used in OpenPGP, SSH, TLS, etc.) it'd be just as easy or easier to simply try each candidate symmetric key on the message (and its authentication code) until one of them matches. Symmetric encryption (and decryption) is way faster than public-key encryption. In practice, the attacker has no knowledge about the symmetric key beyond perhaps its length, and brute-forcing even a 128 bit key takes a quite impractically long time (terms like "lifetime of the sun" are sometimes used to describe such time spans).

  in such a way that the owner with the private key can?

Well, that's the whole point of public-key cryptosystems; two keys, and (at least) one of them can be used to do some operation but the complementary operation requires the other. For RSA in particular, the trick is to set up modular exponentiation (c = (m^e) mod(n)) such that it can be reversed only via modular exponentiation using a number d that is related to e and n (m = (c^d) mod(n)).

Specifically, d is the modular multiplicative inverse of e modulo Carmichael's totient function of n, and computing that requires knowing the prime factors of n, and since n is a really stupidly big number, factoring it is completely impractical (but simply finding any two stupidly big primes and multiplying them together is a lot easier, and then you already have the factors, so key generation is practical).

To use even smaller, more "toy-like" numbers than the example from Wikipedia:

  Choose p = 11 and q = 13 (these are distinct primes; they're also only four bits long so this is going to be a really weak key).
  n = 11 * 13 = 143 (eight bits long - that is, between 128 and and 255 inclusive - so yeah, really weak).
  Carmichael's totient of n is the least common multiple of p-1 and q-1; LCM(10, 12) = 60.
  Choose an e that is in the range 1 < e < 60 and is coprime (has no factors in common) with 60: e = 7 (2,3,4,5,6 are all factors of 60; 7 is prime so it's coprime with anything except its own multiples and 60 is not a multiple of 7).
  To compute d, we find the number such that 1 = (d * e) mod 60 (or in other words, d * e is one more than a multiple of 60); 301 is one more than a multiple of 60, and 43 * 7 = 301, so d = 43.
  So the public key is n = 143, e = 7
  The private key is n = 143, d = 43

  The ciphertext c is m^e mod(n). Anybody with the public key (which contains m and e) can compute this, for any given m. Let's say we want to encrypt the message "42" (we'll say m = 42). In our case, the math looks like this:

  42^7 = 230,539,333,248
  81 = 230539333248 mod(143), so c = 81.

  We (who have the public key but not the private key) send the number 81, along with the fact that it was encrypted with this particular public key. The recipient, holding the corresponding private key, decrypts the message using m = c^d mod(n):

  81^43 is a quite large number, approximately 1.161 * 10^82 (if you're following along at home, make sure you have a calculator that uses a good bignum library!)
  That giant number, modulo 143, is... 42!

So, we successfully decrypted the message, using our knowledge that d was 43. However, it'd be quite impractical to figure out what d is without knowing p and q. A TI-83 can probably tell you the prime factors of n = 143 in milliseconds, but a "real" RSA public key's modulus n is so large, it puts the value of 81^43 (which is 83 digits long in base 10, and takes 273 bits to represent!!) to shame. We're talking really big numbers here, like 7.5x that long. Good luck figuring out the prime factors of one of those!

If you want to know more about the general theory behind public-key cryptosystems, or want an explanation of how any particular one works, you might want to check out https://cryptography.stackexchange.com/.


How to analyse a zip file forensically? I have a zip file and want to know as much as possible about it. Some information is obvious like creation date etc. But what kind of information could be found by a forensic analysis?

You can use 'unzip' from fx. cygwin. unzip -l Archive.zip in a terminal/cmd.exe. While it will list dates of the files archive (CTIME and MTIME, perhaps) these are attributes that can be changed by anyone. The creation date of the zip-file is just the time at which it was downloaded/copied to your PC.


Found a security vulnerability on gov related site So I'm unsure how to go about dealing with what I found. It's a really simple security hole, but opens lots of personal data if exploited.

I was on a government utility  (being vague intentionally) website and I was having an issue recovering my password. I noticed that it was able to tell me my security question answer was invalid without requesting a new page and i thought it was odd so i opened my dev tools and found it was relying entirely on Javascript to determine if my answer was correct. To be sure, i had the function always return true and I was greeted with the password change screen, and it (laughably) didn't require the old password. I changed my password and I had access to my profile again, only needing a username to access my information.

I tried to email the webmaster about the issue. No response. I'm concerned because I hadn't done very much on the site and already I had my SSN, bank account routing/acc numbers, personal address, etc.

What should I do? I don't want to hear in a few months that some other amateur hacker got all of the information and sold/leaked it. Thanks!

Any issue with a federal government web application, I would contact the office of my congress-person.

They are becoming increasingly aware of and concerned with security and privacy of government computer systems.  You can say what you want about our deadlocked, ineffective congress, but they are still pretty good at making things happen at the various government agencies they fund.  Tell them what you wrote above, especially that you never got a response.

If you don't get traction from this, let them know that the congress-person is now in the chain of people who "knew but did nothing" when you finally contact the press.

I think calling them up and demanding money is a risky idea.


Certifications that involve practical knowledge After a lot of googling and searches on forums, it was apparent that certificates like CEH and CISSP incorporated a lot of theory in them and were useful as an added for job.

Are there any certificates that give real time practice with the system during training or the learning process includes practical working (certificates that will give working knowledge) ?

What about Red Hat certs. or CISCO certs. ?

I think one of the most hands on security certifications out there is Offensive Security Certified Professional/Expert. The exam involves executing a penetration test and delivering a report on which you will get quoted. Now this certificate is aimed at attack and penetration testers, if your job is to administer Cisco equipment you should look into CCNAS or CCNPS.

There is also SANS but to be honest they are a bit expensive. The trainings are good though.


Are my Snort rules correct? I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason.
Out of the three only one, the teardrop attack, is detected.

I have tested snort with "testing rules" (alert every tcp packet, search for a string in the payload, ...) and they seem to work flawlessly. I checked Snort output and there is no warnings nor errors for the files containing the rules for sasser/jolt.

I have not much experience writing Snort rules so I picked them from recognized security sites and github.

Sasser traffic is generated by the sasser worm, which I found online and compiled. Jolt and teardrop traffic is generated with the tool targa2.

I checked the traffic with tcpdump and it seems to be OK. Sasser generates traffic directed to the windows update port and both jolt and teardrop generate ICMP packets.

Having tested all the previous I guess the problem are my Snort rules. I've beem intesively Googling but I found nothing new so it would be nice if someone could check if these rules do what intended.

Here are my sasser rules:

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt" ; flow:to_server,established; flowbits:isset,netbios.lsass.bind.attempt; content:"|FF|SMB"; depth:4; offset:4; nocase:; content:"|05|"; distance:59; content:"|00|"; within:1; distance:1; content:"|09 00|"; within:2; distance:19; reference:cve,CAN-2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2514; rev:5;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 ( sid: 1000041; rev: 1; msg: "LSLass MS-0411 exploit"; flow: established,to_server; content:"|eb10 5a4a 33c9 66b9 7d01 8034 0a99 e2fa eb05 e8eb ffff|"; reference:url,www.secuser.com/alertes/2004/sasser.htm; classtype: shellcode-detect;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 9996 ( sid: 1000042; rev: 3; msg:"Sasser ftp script to transfer up.exe"; content:"|5F75702E657865|"; depth:250; flags:A+; reference:url,www.secuser.com/alertes/2004/sasser.htm; classtype: misc-activity;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 5554 ( sid: 1000043; rev: 1; msg:"Sasser binary transfer get up.exe"; content:"|5F75702E657865|"; depth:250; flags:A+; reference:url,www.secuser.com/alertes/2004/sasser.htm; classtype: misc-activity;)

Here my Jolt rule:

alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Jolt attack"; dsize:408; fragbits:M; reference:cve,1999-0345; classtype:attempted-dos; sid:268; rev:4;)

And finally the Teardrop rule, the only one that works:

alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Teardrop attack"; fragbits:M; id:242; reference:bugtraq,124; reference:cve,1999-0015; reference:nessus,10279; reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:attempted-dos; sid:270; rev:6;)

Thanks in advance.

I don't see anything obviously wrong with the rules.

Did you happen to capture your pcaps on either the attacking or target system?  If so, checksums may be incorrect.  As a quick test, run snort with the "-k none" flag to ignore checksums but the correct way to do it would be to use tcprewrite to fix tcp checksums (or some other utility to reach the same goal).

Thanks,

~Patrick


Is it possible to regenerate my private key (SSL)? I've managed to lose my private.key file for my SSL certificate. Is it at all possible to create a new one if I know the passkey and CSR info?

If so, how do I do it?

The "passkey" is just for encryption of the private key, but it is chosen independently of the private key. Correspondingly, no information about the private key can be obtained from the passkey (the passkey is useful information to unlock the private key file, but you do not have that file).

The certificate request contains only the public key; by construction, the private key cannot be (in practice) rebuilt from the public key (which is why the public key can be made, in fact, public).

So the answer is: no, your private key is lost. If the private key could be recomputed from what you have left, then it would be cause for concern. You will have to generate a new private key, and obtain a new certificate.


Information Security Policy and Information Security Plan I have a question about the guidance in NIST 800-53.

The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information security policies (common controls)? Could the information security plan be considered the information security policy?

Your Information Security Policy is different from your Information Security Plan:

Your Information Security Plan should include all required actions for organization-wide implementation of your Information Security Policy. Although the two are closely tied, they are also separate documents.

A solid Information Security Plan will typically include several phases, depending on your existing infrastructure, network / systems topology and configuration. You may need several distinct technical phases to implement the required security controls without major service disruption. This is entirely subjective, and is up to you, the Security Engineer, to envision.

Note that if compliance with NIST 800-53 is required for your organization, the key word is required: Your organization will be expected to show proof of Due Diligence and implementation of all required items, and as many "suggested" or "recommended" items as technically possible/feasible.

Good luck!


Can you sniff broadband connections? And how you secure that? I know that you can sniff data which is transferred over wifi. Can you do that with broadband (wired)?
And how can you secure the network, so nobody could sniff data both over wifi, and broadband?

It depends on the broadband technology being used.  Generally, for most residential fiber and cable systems, about 32 or so houses share the same passive distribution network.  As such, the information coming from the ISP goes to all 32 customers and the cable modem filters down the information for each customer.  Using a hacked cable modem, it is possible to monitor all the traffic coming from the ISP, but it may or may not be encrypted depending on how the ISP is configured.

Similarly, traffic going to the ISP is moving in the wrong direction and can't be easily detected by other customers.


I have just 4 hours a month to security check a cloud based application - How to use my time? I've been tasked with looking after an application deployed to azure. I have been allocated 4 hours a month.

I essentially have half a workday to secure this application / keep it secure. What is an efficient use of my time?

Should I concentrate on:

Making sure all the components are up to date?
Checking all the logs to make sure nothing is looking dodgy?
Attempting to "hack" the application myself?
Documenting the system in detail from a security perspective?
Researching current vulnerabilities in this/related tech?
Ensuring backups etc are working correctly?
Disaster recovery stuff?
Creating policy around "being hacked"?
Auditing the source code with some tool to search for bad patterns?

Or some combination/something else?

I'm looking for experience based answers, preferably from someone that does this kind of security maintenance. If there is any kind of existing best-practice/guideline that would also really help.

The technology stack is:

SQL Server Database (Azure SQL)
C# Web API
Angular Front End

There are several additional components, but I'm not really looking for tech specific answers, more a strategy on how to approach this.

As mentioned in the comments, I too agree 4 hours in a month is way too low. Understand, and more importantly, make your stakeholders understand that with 4h they shouldn't expect much. Considering they've given you 4h, it doesn't look like they're serious about securing this application either.

Based on the comments, answers and my own thoughts I'll try to put together something. Here's how I think your options should look like in order.

Ask for more time. Make them understand if they want to secure an application in just 4h, it's practically useless.
Hire an agency and spend your 4h defining their scope, prioritizing their actions and reviewing their results. (@Nelson)
If you can't do the above, I'd recommend securing the low hanging fruits so you're covering more ground in 4h. Here's what I think are important

Set your external facing services to update. (~1h to find and set the important applications for update). Close unnecessary ports/services that you don't find useful.
Set up MFA (~10mins) - since you don't have much time, set up things that are quick, protect you against common attacks and alert you.
Review your secrets - Ensure they're stored securely, run scanners on your code to find hard-coded secrets. (~1h)
Disaster Recovery - I'd recommend spending some amount of your precious 4h in setting up protections for when things go wrong, because they will. Start creating backups (2 if feasible) in different zones. I'm assuming the platform will help you with this but it will still take time. During this time, you can also draft out a rough disaster recovery plan. (~1.5h)
Finally, with whatever little time you have left, document. Document what you've done, what you haven't done and what should be the next steps for the next time someone gets 4h to further secure the application. (~leftover)

DoS protection is good and required but I just couldn't find a way to fit it in to the above plan and neither could I swap anything out for it. Maybe that should be documented in your next steps.

Overall, it's a farfetched request to secure something in 4h. But if I were tasked with it, I'd do it with the above steps. I'm not sure if any investigations into whether the system is already hacked is feasible in those 4h. When you are given 4h to secure, you can either chose to spend it in securing the application against potential threats or investigate for attackers in your system (needs a different plan). That initial choice is yours.


How to implement JWT auto-revocation? I'm working on an API using Node and Express, with a Mongo database. My users can authenticate using a route, and they get a JWT in exchange.

I want to implement a security mechanism to protect said tokens. Namely, I want the tokens to auto-revoke when a user changes their password, and provide a "Revoke all apps" button, that would invalide all created tokens.

To do so, I added a nonce in the JWT body, which is a random v4 UUID. When the user changes their password or click the button, a new UUID is generated, causing a de-facto revocation of all tokens - since the JWT's body won't match what's coming from the database.

Is this a good approach? I can't think of a way this would be broken, is there anything I overlooked?

Your approach is sound when it comes to security, as long as you (1) use a cryptographically secure PRNG, and (2) don't leak the UUID's somehow. However, it does mean that you have to hit the database to check the UUID at every request. That negates the performance boost you get from using a JWT instead of a traditional session ID.

A minor performance tweak you can do is to instead add revoked tokens to a revocation list that is automatically pruned to remove expired tokens. At every request, you check if the token is in that list. Since a list of all revoked tokens is likely to be shorter than a list of all your users, lookup would be somewhat faster.

And as always the devil is in the details. I am sure there are plenty of mistakes one could make while implementing any of these schemes in code, but that level of detail is beyond the scope of your question.


Is there any security concern to host Wordpress on the main web server? We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com.

Now there is a requirement that the blog appears as www.mainsite.com/blog. I can install PHP, MySQL and Wordpress on our main website IIS server; my question is if there are any security and performance concerns? Every now and then, a new vulnerability is found in Wordpress and PHP; Is it fine to bring such vulnerable technologies to our main web server? Can someone tell "if the admin account of the wordpress blog gets compromised, can this cause any issues for the main web application?"

and if it is a bad idea to bring a new stack of technology to our main IIS web server, how can we achieve www.mainsite.com/blog instead of current www.blog.mainsite.com?

Installing more software on any machine (almost) always increases the number of ways the machine can be attacked.  So it is generally good practice to segregate components when possible. Suppose there is an attacker can use a flaw in the wordpress blog to execute PHP code, now the server hosting your main site is owned.

Another issue that comes to mind with this new setup is that hosting the blog on the same domain as your main site can give the blog access to cookies set by your main site. So now these cookies might be vulnerable to XSS attacks on the wordpress site, when they would not have been if the main site was hosted on www.example.com and the blog on blog.example.com.

EDIT:

Since you asked: I believe the admin on a wordpress site can install plugins/upload php files, so if this account were compromised then the machine would be compromised as well.


Can the client communicate with the AP after a KRACK attack? When a client is forced to reinstall the key and to reset the nonce and the replay counter, what does it imply for the future communication between the client and the AP? There's an adversary in the MITM position who now can decrypt packets, but I'm wondering if the client can still communicate with the AP (and with the Internet) provided that adversary forwards packets in both directions.

As I understand it, the AP's replay counter won't be reset, and therefore it will refuse any packets with number lower than its replay counter. Also, the AP will assume that it is receiving data encrypted with keystream from nonce X, but because of the attack and the client's nonce reset, it will receive data encrypted with keystream from nonce 0.

The KRACK paper states:

  We first establish a man-in-the-middle (MitM) position between the supplicant and authenticator.

And:

  A second minor obstacle is that we must obtain a MitM position between
  the client and AP. This is not possible by setting up a rouge AP with
  a different MAC address, and then forwarding packets between the real
  AP and client. Recall from Section 2.3 that the session key is based
  on the MAC addresses of the client and AP, meaning both would derive a
  different key, causing the handshake and attack to fail. Instead, we
  employ a channel-based MitM attack, where the AP is cloned on a
  different channel with the same MAC address as the targeted AP. This
  assures the client and AP derive the same session key.

(Emphasis mine)

From what that section of the paper says, there is a MITM between the supplicant (client) and the authenticator (AP). Furthermore, there is a diagram on the paper (page 6) which shows the MITM connection involving the supplicant, adversary and authenticator:

The paper also mentions how the authenticator will accept any replay counter:

  However, a careful inspection of the 802.11 standard reveals that
  the authenticator may accept any replay counter that was used in
  the 4-way handshake, not only the latest one.


Why is validating the integrity of the plaintext necessary in addition to validating the integrity of the cipher text? Reading the iOS Security Guide's description of the iMessage encryption protocol I'm trying to figure out why they included a mechanism for verifying the integrity of the plaintext as well as verifying the integrity of the final cipher text (emphasis added).

  For each receiving device, the sending
  device generates a random 88-bit value and uses it as an HMAC-SHA256
  key to construct a 40-bit value derived from the sender and receiver
  public key and the plaintext. The concatenation of the 88-bit and 40-bit
  values makes a 128-bit key, which encrypts the message with it using
  AES in CTR mode. The 40-bit value is used by the receiver side to verify
  the integrity of the decrypted plaintext. This per-message AES key is
  encrypted using RSA-OAEP to the public key of the receiving device. The
  combination of the encrypted message text and the encrypted message
  key is then hashed with SHA-1, and the hash is signed with ECDSA using
  the sending device’s private signing key.

What does this additional signature component add to the authenticity of the message?

What does this additional signature component add to the authenticity of the message?

Actually I think you got it reverse here. The ECDSA signature was there first. It turned out it wasn't sufficient. This is (part of) the content of the paper "Dancing on the Lip of the Volcano" (PDF).

The idea is that an attacker like Apple can just strip the signature and replace it with a "trusted one" (as they provide the public key directory service) where they actually control the signing key. After the authentication was defeated this way the paper describes a way to send malicious ciphertexts to the recipient to slowly learn the message.

The "fix" you see here, is that they've now part of the AES-CTR key depends on the public keys of the sender and recipient. Of course these are different when the attacker strips the signature and generates a new one and then the recipient should notice the integrity check failing.

Also note that the actually sane way to fix this issue would have been to use sign-then-encrypt with authenticated encryption rather than signing AES-CTR ciphertext...

Though one has to admit, that this "fix" somewhat solves the problem assuming they really couldn't change any of the previous message format given that this simply a bit of (undetectable) structure into the previously fully-random AES key.


What are the new risks of using hyperconvergent systems? There is a trend called "hyperconvergence" where computation, storage and network are all in the same system. I think that this is a step back (everything again in the same machine, like old times) but it is supposed to be better for maintenance.

What are the new security risks or threats that we have to take into account when using this technology?

I disagree with @JulianKnight's comment there is a different set of risks introduced by the new converged infrastructure.  Last time we had converged infrastructure the network aspect of computing was in its early stages, and the main security issues were around privilege escalation.  We changed that in the '90s with the layered design: often with the frontend layer, application layer and database layer.

Now, the frontend layer is often the only one exposed to the external network.  Other layers are behind a NAT+firewall and, therefore, more-or-less protected.  Discounting firewall hole puncturing vulnerabilities, and ignoring passive fingerprinting for network mapping, we can say that the internal layers are bubbled inside a more-or-less safe haven.

This produces a lot of bad practice such as open, unauthenticated, database listeners.  For example, by assuming that the database servers are safe from the external world, system administrators drop the authentication between the application and database layers.  That gives a boost in performance but exposes the database to an attacker that can cross the firewall.

OK, but I haven't talked about converged infrastructure yet.  Our new trend (converged architecture/hyperconvergence) pushes all layers back into a single machine.  But we are not in the '80s or early '90s anymore, we are pushing all the infrastructure layers onto a machine that is heavily interconnected to the network and often visible from the internet.  I can see two huge implications:

1. The documentation for layered infrastructure is misleading

When configuring converged infrastructure and using documentation that was written with layered infrastructure in mind you may fall prey of false security.  There is a lot of documentation (blog posts, tutorials, even official manuals) that assumes that internal layers of infrastructure are protected by a firewall and make decisions based on that.

Leaving an unauthenticated database port open in the database layer behind a firewall is bad, but may be compensated by the performance increase.  Leaving the port open on a machine that is visible from the internet is outright terrible.

But is bad documentation a big risk?  For converged infrastructure it certainly is.  Most converged infrastructure is constructed in IaaS/PaaS/SaaS, which in turn are used by "quick-and-dirty" startups which often have inexperienced developers or developers that would blindly follow a guide to do things faster.

Solution?  Do not trust documentation, use your own common sense.  In other words, it requires developer conscientisation.

2. Privilege escalation is back to the front row

But not in the same form as before.  Before (during the golden time of priv escalation on first multiuser OSes) the privilege escalation needed to go through the quirks of the OS (e.g. overflowing a setuid program).  The difference is that now we are running machines that are heavily connected, including connections on the loopback interface.

Since we are running a converged infrastructure, where is the firewall running?  On the same machine.

This firewall will (very likely) be very permissive to any traffic on the loopback interface.  If you have a user with low privileges inside the machine he is still free to explore the loopback interface.  If you leave network based communications between what was previously the layers of the application to run on the loopback interface, any unprivileged user can play with it.  And look back at point 1 (misleading documentation) above to see why the communication between the pieces of infrastructure would be going through the loopback interface.

Solution?  Use shared memory to communicate between the infrastructure layers on the same machine (just like people did before the layered approach), shared memory has permissions set by the OS.


Question about ISO 27001:2013 scope definition My company would like to be ISO 27001 certified, so we have started a preliminary study and are now working on a draft ISMS scope in accordance with the standard (context of the company, interested parties, boundaries ...).

Several things remains unclear to me for which I would like to get some help for a better understanding of what has to be included or not into the scope and other potential consequences:

Locations: The unique company office location is in scope (small office), but should we also include the data center location where some assets are hosted? Note that this is not our own data center, but is outsourced (the company rents some racks to a local datacenter provider).
Out of scope: The company holds also shares in another company which is located within the same office/premises. We can consider "shared premises", because people from this other company can access the whole office (only access control is in place at the main entrance).
From a network point of view, the second company is isolated on a dedicated DMZ with no access to my company network (still have to be confirmed, they may use a shared printer at least).

My first assessment was to exclude the second company from the scope (including the dedicated DMZ), but after some more thinking it does not appear so easy to decide, since people can move everywhere within our office ...

Is this something that will be raised through the risk analysis and treatment plan (conclusion will likely be to isolate physically this second company or to move it elsewhere)?
What about the dedicated DMZ on a firewall in scope if it is out of scope (unsecure network)?

27001 (2005 or 2013) is less prescriptive than most people seem to think. It is completely up to you how you set the scope, just remember that it will appear on your certificate.

If the external stakeholders (customers, partners, shareholders) invested in your certification don't think it is sufficient then the certification itself might be useless for your purposes.

If the second company is out of scope, then the auditor won't consider it of itself during assessment. Its policies, procedures and controls won't be relevant.

However, that isn't to say that things excluded won't cause you some problems indirectly. You rightly mention other people having access to your workspace might be a problem.

Section 11 deals with this element: 11.1.1 (Physical Perimeter Security) and 11.1.3 (Securing offices,
rooms and facilities) are where you will need to demonstrate effective controls on your Statement of Applicability.

The standard does not prescribe what the controls are, merely that you should have them. An auditor's job is to prove that you have them and that they are not obviously ineffective - not that they are effective.

The problem certainly isn't insurmountable. A range of controls around auto-locking screens, 802.1x on network interfaces and employees reporting any information security incidents pertinent to the presence of the other company's employees is likely to be enough to satisfy an auditor in most cases.

Indeed, in some organisations working with privileged information with members of the public present is necessary (the booths on the floors of retail banks, for example) and that is not a barrier to obtaining 27001 certification.  Of course, lots will depend on your environment and your auditor.

UKAS auditors tend to be the most stringent but at the end of the day play by the same rules -- is there a control? Is there evidence it isn't working?

Finally, to your datacentre point: as an Information Processing facility it will impossible avoid repeated mention during audit. If the facility itself is 27001 certified (doesn't matter on the version) then all you need to do is produce their certificate and Statement of Applicability. If it is not, then it is likely the auditor will want to visit to test the security they provide on your behalf.


How can I detect backdoors? I have a machine running Mac OS X and I suspect there may be a backdoor installed.

I know that I could take it to a professional security firm for analysis, or nuke it from orbit, but I'm interested in dealing with it myself.

What forensic techniques might I use to determine if any backdoors exist in the system?

Additionally, what network configuration options might l want to put in place (firewall or IDS rules, for example) to help limit or detect the exploitation of backdoors in my system?

If some people have put some hidden backdoors in your system, and if they were competent at it, then you won't be able to find them. "Competence", here, means "having an Internet access and typing 'rootkit mac os x' in Google". See e.g. this. It is theoretically impossible to completely hide a backdoor, but only in the same sense that it is theoretically possible to write software without any bug. In other words, it is hard.

"Security labs", whoever they may be, can try to see in your machine if they find something fishy. Possibly, if you observe strange symptoms, they might be able to explain them without postulating a virus / backdoor / malware. If you do not want to show them your computer, then, no escape: you'll have to do the analysis yourself, which means acquiring a few years of technical skills.

Alternatively, reformat the hard disk, then reinstall from scratch. Very few malware can survive that.


Specify Amount of type of character Crunch I'm sure these questions pop up a lot, but I can't find one that does what I'm looking for.
So, I'm trying to use crunch to generate a wordlist with specific amounts of each type of character, i.e. 2 numbers, 1 symbol, 3 uppercase, 1 lowercase, etc.
There are is -d, which seems to do what I cant, but it's for consecutive duplicates, which is not what I want.
The characters can be anywhere in the string, but there must be at least the specified amount of each type.
Is this possible?

There's no way to do this with Crunch that I'm aware of.

The only way I know of to do this is the generate all masks that conform to the composition rules using the policygen tool from the PACK toolkit, as described in my answer here.

In your case, it would be something like:

$ policygen --minlength=8 --maxlength=12 \
  --mindigit=2 --minlower=1 --minupper=3 --minspecial=1 -o test1.masks

You'll have to adjust the minimum and maximum password length accordingly. The number of masks can go up rapidly with the maximum length, so adjust carefully.


How can I test my spamfilter under real world conditions? We are currently planning to migrate our outsourced mail solution to our own servers. The last thing we need to test is the spam filter. We are going to use a cloud based spam and anti virus filter provided by Microsoft.

We now have a test server with an assigned test domain. We now want to test the spam filter under real world conditions. We thought about adding some test addresses to "no spam" lists to verify if the cloud based service is doing what it should. Is this a good idea or are there better solutions beside using our real mail server for validation of that service?

A good way to test your spam-filter is by actually spamming it yourself. Try to spam it yourself by using the techniques spammers use, on smaller scale. If your protection works on small scale, you can also assume it works on bigger scale.

There are also various of tools which allow reliable testing:

SpamAssasin - GTUBE
EmailSecurityCheck
Litmus

Especially GTUBE (Generic Test for Unsolicited Bulk Email) is often used and works similar like EICAR for testing Anti-Virus setups.

However, lot of those filters also work with blacklisting. So the best testing-method is throwing your service online and see if you receive real-world spam.