How protect ourselves from USB Firmware viruses? Does Antivirus help? On Windows (pnd probably other operating systems, I don't know), when you plug in a USB appliance (a flash drive, mouse, etc) Windows automatically runs the "Device installation" and the firmware is installed. However, that firmware doesn't reside inside the user-accessible space (i.e. there is no G: drive)
however, somewhere the actual files are installed.

After reading a few articles on some reputable security websites, I am worried about the global and non-beatable problem we face. Almost all non-branded & cheap USB appliances are programmed with suspicious-looking firmware (possibly malware), which Windows will auto-run while plugged in (unless you have auto-installation disabled. Which I suspect only around 1% of users actually do have this disabled)

How do I protect myself from this?

Where does the driver come from

The driver is downloaded from Windows Update, they are generally signed and secure, with some exceptions, like the signed drivers used by Stuxnet.

Where does the firmware come from

The firmware is loaded onto the device in the factory, and in some most cases can be updated once the device is in use, although depending on the device this may be impossible, or just difficult to get the new firmware and software needed.

What can bad firmware do

Bad firmware can make the drive pretend to be anything, allowing for attacks where the device pretends to be a keyboard and mouse and takes over the machine, downloading and installing malware itself.

How to protect against bad firmware

You can avoid plugging clean devices into suspected infected/untrusted machines, although this will not help if you are unaware a trusted machine has been infected.

There are also some non-upgradeable USB devices, but these tend to be hard to find, and more expensive when available.


No attributes in Certificate Request We use a CA that expects a challengePassword, so I set up a openssl.cnf like this:

oid_section            = OIDs

[ req ]
distinguished_name     = req_distinguished_name
attributes             = req_attributes
req_extensions         = v3_req

[ OIDs ]
RequestProfile         = 1.3.6.1.4.1.311.20.2

[ req_distinguished_name ]
commonName             = Common Name
organizationalUnitName = Organizational Unit Name
organizationName       = Organization Name
localityName           = Locality Name
stateOrProvinceName    = State or Province Name
countryName            = Country

[ v3_req ]
basicConstraints       = CA:FALSE
keyUsage               = digitalSignature, keyEncipherment
subjectKeyIdentifier   = hash
subjectAltName         = @alt_names
RequestProfile         = ASN1:BMP:tlsserver

[ alt_names ]
IP                     = 192.168.0.1
DNS                    = test.unit.org.ch

[ req_attributes ]
challengePassword      = ChallengePassword

I created a certificate request with

openssl req \
   -new -keyout test.key -out test.csr \
   -subj /C=ch/ST=BE/L=Berne/O=org/OU=unit/CN=test.unit.org.ch \
   -newkey rsa:2048 -nodes -config openssl.cnf

As far as I can tell, the test.csr looks generally fine, except the Attributes list is empty. I was expecting to see the challenge password there:

[simon@centos Projects]$ openssl req -noout -text -in test.csr
Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=ch, ST=BE, L=Berne, O=org, OU=unit, CN=test.unit.org.ch
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ce:b2:52:74:40:5e:c4:73:13:2a:08:ec:94:ea:
                    [...]
                Exponent: 65537 (0x10001)
        Attributes:
        Requested Extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Key Usage:
                Digital Signature, Key Encipherment
            X509v3 Subject Key Identifier:
                37:1E:95:70:3B:27:BA:8F:09:77:E4:42:DD:FD:A8:DD:29:01:F0:51
            X509v3 Subject Alternative Name:
                IP Address:192.168.0.1, DNS:test.unit.org.ch
            1.3.6.1.4.1.311.20.2:
                ...t.l.s.s.e.r.v.e.r
    Signature Algorithm: sha256WithRSAEncryption
         0b:5e:96:a2:83:b0:d5:08:1f:d0:34:e3:d4:c4:37:53:f2:28:
         [...]

This is with OpenSSL version 1.0.2k (CentOS 7.5), but also happens on RHEL 7.3 with version 1.0.1e.

I am probably misunderstanding something very basic - could someone please give me a hint?

The man page doesn't tell you, but if you look at the code the logic for the distinguished_name (subject) section and the attributes section are actually commingled. When you use prompt=no in the config file it affects both of them, and when you use -subj on the command line it uses a different code path that skips, and thus effectively disables, attributes.

Barring a fairly major reorganization of the code, if you want attributes you can't use -subj. You can use the default where you are prompted for both DN and attributes values, or set prompt=no with both values in the config file. If you don't want to actually edit the config file (or versions of it), remember in some Unix shells (including CentOS) you can use process substitution like:

 openssl req -new -config <(cat fixedpart; printf '%s\n' '[req_DN]' 'commonName=test.invalid' '[req_attributes]' 'challengePassword=letmein') ...


How to securely share credentials between two local applications? My employer has a system that clinicians use to capture video data for patient bookings. This comprises two applications running on Windows:

A GUI application (Electron/Javascript)
A local service (C#).

Both applications need to access our API over the internet.
Users must log into our API with their own account and password but they do so from the GUI application that runs on a computer with shared login credentials (shared between all clinicians at a site).
The two apps currently communicate over RPC (I plan to switch this to a local REST service in future).

What is a secure way to authenticate with our API from the C# service, given I only want the user to log in once, using the GUI application?

Can those authentication credentials be securely stored for use later by the C# service on a shared-access computer?

Background:
The GUI application is used to login (authenticating with our internet API) and get the list of available patient bookings for the user (over same secure API). The user then selects one of the bookings and captures some video data for it. Once video capture has completed, the GUI app hands the data over to the C# service.
The C# service's job is to run continuously in the background and perform time-consuming processing work on captured video data. Once that processing has been completed, some results data needs to be uploaded to our internet API.
We don't want the user to have to wait until this post-processing has completed (it may take 10 minutes or so) so we want them to be free to close down the GUI application and still have uploads occur in the background while the computer is running.
I would like to be able to restart the computer and have the C# service (which runs at startup) pick up where it left off with processing and uploading data. For this, I'd need to securely store the credentials of the user who performed the capture so they can be read back.
I've considered passing the credentials in plaintext over RPC when a user logs in successfully so both app are aware of them. This answer indicates there is no need for interprocess encryption on the same machine, but I'm not sure if that is reasonable given the user account used to access the computer is shared. I'm also not sure if it's possible to securely encrypt the credentials for use later without re-authenticating to unlock them in some way. (Our API password is not tied in any way to the password used to log into Windows and we don't want to integrate those as we may move away from Windows in the future).
Any help appreciated, thanks

Use an authentication token:

User logs in via GUI

API returns an authentication token

User captures whatever he needs, and sends data and token to C# service

C# processes all data, sends data plus token to API

This way username and password are not saved locally. Make sure to have a sane expiration time for the token, and don't let it be reused.


Making My Own Custom Payload I have tried many different tools to avoid being detected by an AV while using meterpreter exploit. Here is a list of tools I have tried: Shellter, Posh C2, Hack the World, Veil, Fat Rat, and many more. But they keep getting detected. I have read on the web, that the best way to evade AVs is to program and build your own payload. I know the Python programming language. I just don't know where to start, because couldn't find any useful info on the web. Where should I start from and what should I learn?

A payload is simply the thing that you actually want to do on a machine. Typical payloads are:

Interactive Shells (Meterpreter, OS Shell, etc.)

Dumping Hashes
Adding Users
Download/Upload Files

Install Malware (Keyloggers, Ransomware, etc.)
Persist Access (SSH, RDP, etc.)

So if your question is "How do I write my own payload?", the actual task for you is to pick one thing you would like to do (e.g. download a file from the remote host) and then write a program that does that.
Will this actually bypass AV?
Maybe. Depends on the AV, and what the AV actually detects. What I can tell you is that AVs do more than just comparing hashes of already known files. They also do heuristics, in which the behavior of a process is analyzed and if it does "something suspicious" 1, the process is interrupted.
For example, what about a process that reads a local executable file, then connects to some remote host, downloads a new executable file, overwrites the first executable and then launches it. Could be suspicious, could also just be a regular update process.

1 It is completely up to the AV vendor to decide what that means.


Shop saves credit card data from guest orders A web shop allows customers to order as guest or to create an account.

I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security code).
Some weeks later, I ordered something else, again as a guest. To my surprise, after entering my email address and shipping address, I could select the credit card that I used in the previous order.

It showed the credit card issuer, the credit card customer’s name, 4 digits of the credit card number, and the expiration date.

I selected it, and it worked. I didn’t have to enter or confirm anything (not even the security code; but this doesn’t seem to be required anyway).

I tested whether it is related to a cookie (no, it also works from a different PC) and whether the data has to be entered exactly the same (no, it only checks for the email address).

I guess this is bad, right?

I intend to contact the shop owner, but I want to be prepared in case they don’t agree that this is a problem. Should I also contact the credit card company, or is such a process allowed according to their rules (saving and allowing to use a credit card without authentication; showing some parts of the credit card data without authentication)?

This isn't just bad, this is a disaster. Just knowing the email address of someone allows you to buy stuff using his credit card if he happened to be the unlucky customer of this horrible site.

They are either storing complete credit card data in reversible format, and given that this security disaster was overlooked I wouldn't be surprised if it was stored in plain text without even any attempt at encryption (not that this would change much if the entire server is compromised anyway).

Another less scary possibility would be that they are only storing a reference to the card, whereas the actual card is stored (more securely) on the payment provider's side. In this case, the "buy something on other's behalf with their email" still stands, but at least if they're compromised your card's data doesn't go out in the wild.

If you can see what their credit card processing company is, you should report it to them, they'll quickly cancel his account while they sort it out. And please do expose them on Plaintext Offenders, as this is even worse than plaintext passwords.


How does BINs vulnerabilities work? Many companies have some BINs where you can enter a fake credit card and you get a premium account (the Credit card is based on a BIN that just trick or bypass the plateform),

I want to know how this works ?

For example : bin spotify/netflix etc.. 5273XXXXXXXX

How people can discover these bins ? And how/why they work ?

Generally, the first two octets of the card number (although in a lot of cases, only the first six numbers are used) are reserved as an IIN (Issuer Identification Number). These are what you to refer to as BIN numbers, however the term "BIN" (Bank Identification Number) is generally not used anymore. These IINs are used to identify which card processing organisation the processing of the card should be directed towards.

Card Numbers have an algorithmic validation check built in to make sure they are valid before sending anything off to a server. This algorithmic validation check follows the modulus 10 algorithm (aka the Luhn Algorithm). This is how PayPal, WorldPay and all the other companies that process card details are able to instantly tell you that your card was entered incorrectly, without sending your details over the internet constantly.

The algorithm follows the following simple steps:

Double every second digit (so, if you have 1 2 3 4, you'd double 2 & 4)
If your double is ten or greater, then add the individual digits together (let's say you doubled 8, you'd get 16 - you would add 1 and 6 together to get 7)
Add all of these digits you've performed operations on together. So, in our first case, we'd add (2 x 2) and (4 x 2) together, producing ten. If the number ends with a zero (you calculate this by performing modulus 10 on the number, and comparing to zero) then the card number is valid.

Further to this, all major card providers have their own assigned IINs or ranges of IINs. This is why when you're typing, many websites will instantly identify Visa (beginning with 4) or Mastercard (beginning with 51 through 55).

The reason some websites will allow you to enter in fake credit cards is because it's difficult to establish if the card is active and genuine. The primary way to do this is charging a small amount to the card, which is often not worth the trouble. The websites won't be checking if that card is active, they'll be checking if it is a card meeting the technical standards. Hence, until they try and bill it, they will have no idea if the card is genuinely active.

Some companies need more verification than this, however. PayPal for example charges you with a unique code reference that you must tell them to ensure that, not only is the card active, but it's also a card you control. This is a measure to prevent card fraud.


What are the privacy and security implications of Windows Telemetry There have been quite a few news stories relating to the use of "Telemetry" in Windows 10 (and also now Windows 7/8) with suggestions that users would want to disable or remove these updates due to privacy concerns caused by sending this information to Microsoft.

What I'm interested in are the details of what data is sent to Microsoft by these patches and any concrete privacy security implications of this transmission as many of the comments on-line seem to lack this information.

What is Telemetry?
Windows OS monitors and debugs information about the user's running applications. This is called instrumentation. Gathering remote information that is collected by instrumentation is what is called Telemetry.
As the product is not opensource, one can legitimately think of the worse. But to keep the answer as objective as possible, I prefer to quote from Windows 10 feedback, diagnostics, and privacy: FAQ:

As you use Windows, we collect performance and usage information that
helps us identify and troubleshoot problems as well as improve our
products and services. We recommend that you select Full for this
setting.

Basic information is data that is vital to the operation of Windows. This data helps keep Windows and apps running properly by
letting Microsoft know the capabilities of your device, what is
installed, and whether Windows is operating correctly. This option
also turns on basic error reporting back to Microsoft. If you select
this option, we’ll be able to provide updates to Windows (through
Windows Update, including malicious software protection by the
Malicious Software Removal Tool), but some apps and features may not
work correctly or at all.

Enhanced data includes all Basic data plus data about how you use Windows, such as how frequently or how long you use certain features
or apps and which apps you use most often. This option also lets us
collect enhanced diagnostic information, such as the memory state of
your device when a system or app crash occurs, as well as measure
reliability of devices, the operating system, and apps. If you select
this option, we’ll be able to provide you with an enhanced and
personalized Windows experience.

Full data includes all Basic and Enhanced data, and also turns on advanced diagnostic features that collect additional data from your
device, such as system files or memory snapshots, which may
unintentionally include parts of a document you were working on when a
problem occurred. This information helps us further troubleshoot and
fix problems. If an error report contains personal data, we won’t use
that information to identify, contact, or target advertising to you.
This is the recommended option for the best Windows experience and the
most effective troubleshooting.

Note that only on Enterprise Edition one can turn that feature off totally. On Windows 10 Home and Professional, for instance, it can be set only it to Basic.
UPDATE 1:

Is this information specific to the telemetry service or just general
information that Windows collects? I've had problems in tying up
what's telemetry (which was back-ported to win8/7) and what's general
data passed back to MS.

Telemetry is a main part of   Diagnostics Tracking Service available in Windows 8.1, Windows Server 2012 R2, Windows 7 Service Pack 1 (SP1), and Windows Server 2008 R2 SP1,  Windows Server 2012 R2 Datacenter,
Windows Server 2012 R2 Essentials,
Windows Server 2012 R2 Foundation,
Windows Server 2012 R2 Standard  and Windows 10. The quoted paragraphs concern the Diagnostics Tracking Service mechanism in which other modules, apart from Telemetry, are included.
Diagnostics Tracking Service consists mainly in these files:

telemetry.asm-windowsdefault.json
diagtrack.dll
utc.app.json
utcresources.dll

As you can see Telemetry is a JSON file that is used to describe the data sent back and forth between Windows machine (client) and server.
If you are curious about the details, you can see its content when you downloand the appropriate patch you want. When you extract the content of MSU file (instructions here) and retrieve the CAB files, you will find a folder which name looks something like this: amd64_microsoft-windows-u..ed-telemetry-client followed by several numbers. Check the content of that folder and open the Telemetry file in JSON format to have a technical insight about its details, mainly description of the data echanged between your machine and Microsoft server(s).
Telemetry is also seen as a part of Microsoft Customer Experience Improvement Program as

it is impossible for us to contact most of our customers in person to
get their feedback. The Customer Experience Improvement Program (CEIP)
was created to give all Microsoft customers the ability to contribute
to the design and development of Microsoft products.

If you check Privacy Statement for the Microsoft® Customer Experience Improvement Program you can read:

When you participate, we collect basic information about how you use
your programs, your computer or device, and connected devices. We also
collect information about how each is set up and performing. These
reports are sent to Microsoft to help improve the features our
customers use most often and to create solutions to common problems.

Which statement is in contradiction with the first text we quoted as the user has no ability to turn off totally Telemetry.
As for the exact data being exchanged through Telemetry, apart from the quoted text and the efforts you may make to read that JSON file (and may be survey your machine's communication?), I can not say more. But it is really very interesting to know that precisely (if it is possible).
UPDATE 2:
Additional information I found ( I still refer to official documentation only to stay objective):
From Instrumentation and Telemetry Guidance, we can read that the information generally include:

Details of operational events that occur as part of the normal operation of the application, together with useful information about that event. For example, in an ecommerce site it would be useful to record the order number and value of each order that is placed. These are typically informational events that are used to collect data about the way the application is used.
Details of runtime events that occur, and useful information about that event such as the location or data store used and the response time for access to the data store. These are also informational events that can provide additional insight into the normal operation of the application. The event should not include any sensitive information such as credentials, or any other data that might enable an attacker obtaining the logs to compromise the system.
Specific data about errors that occur at runtime, such as the customer ID and other values associated with an order update operation that failed. Typically these are warning or error events and will contain one or more system-generated error messages.
Data from performance counters that measure specific values related to the operation of the application. These might be built-in system counters, such as those that measure processor load and network usage, or they might be custom performance counters that measure the number of orders placed or the average response time of a specific component.

(Further reading: Telemetry – Application Instrumentation, Windows Azure: Telemetry Basics and Troubleshooting)
From Share telemetry data with Mozilla to help improve Firefox, we can read that it collects for example:

memory consumption
responsiveness timing
feature usage
memory configuration
hardware configuration

Note that whatever a user does, it seems it is impossible to know what Windows collects and sends permanently. Windows does not stop sending undefined information on his/her behalf as this study shows: Even when told not to, Windows 10 just can’t stop talking to Microsoft. But still what the official documentation describes is not very good for the user such as when Windows takes system files or memory snapshots, which may unintentionally include parts of a document you were working on when a problem occurred.


Making sense of John The Ripper numbers I'm doing a test with John The Ripper, to see how long it takes to crack a zip password.

One test is one an old intel NUC, which has an i5 processor and 4 cores. These are the numbers I'm getting:

0g 3:23:53:55  3/3 0g/s 11260Kp/s 11260Kc/s 11260KC/s idanloob6y..idanlokntz
0g 3:23:54:55  3/3 0g/s 11260Kp/s 11260Kc/s 11260KC/s i twskl2b1..i twskbfrk
0g 3:23:57:16  3/3 0g/s 11260Kp/s 11260Kc/s 11260KC/s dutyen1d48..dutyenib04
0g 4:00:02:19  3/3 0g/s 11260Kp/s 11260Kc/s 11260KC/s 1724b3by#9..1724b33t02
0g 4:00:04:07  3/3 0g/s 11260Kp/s 11260Kc/s 11260KC/s 1blpyryiz7..1blpyrcm71

All 4 cores are at 99% according to htop.

Now I'm processing the same file on a c4.4xlarge on EC2, which should be suitable for heavy cpu usage. I start John The Ripper, and according to htop, all 16 cores are number-crunching as well.

A big surprise occurred when I look at the numbers:

Loaded 1 password hash (PKZIP [32/64])
Will run 16 OpenMP threads
Proceeding with incremental:ASCII
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 3:22:50:03  3/3 0g/s 11262Kp/s 11262Kc/s 11262KC/s aiyuckla161..aiyuckjk346
0g 3:22:50:14  3/3 0g/s 11262Kp/s 11262Kc/s 11262KC/s byaleetoren..byaleeb1059
0g 3:22:51:07  3/3 0g/s 11265Kp/s 11265Kc/s 11265KC/s lmclitola25..lmclitils94
0g 3:22:52:53  3/3 0g/s 11271Kp/s 11271Kc/s 11271KC/s tkinemonggy..tkinemcamm2

Those are not better than on my cheap Intel NUC.

Am I missing something here, or is the performance identical on both machines, despite the fact my EC2 instance has 16 cores compared to 4 cores on the NUC?

One more thing: I transfered the john.rec from the intel NUC to the EC2 instance, so it would continue where the NUC stop. Can that has something to do with it?

Your assumption is correct.

John The Ripper by default will save its state every 10 minutes. When you ran it on your NUC the numbers first displayed to you were saved in the .rec file from one of those auto saved states. When you uploaded it onto the instance the state saved in the .rec file still showed the same numbers as your NUC because it was not updated yet.

When you deleted the .rec file a new one was created with the new numbers. If you want to see the numbers in live while it is running you can type any key into the console.

You can read a little more about it here.


Using client certificate to authenticate an app I'm building a backend for the mobile app with a public-facing HTTP API endpoint. Despite being publicly visible, this endpoint is only meant to be used by my app, i.e. I don't want people to send random requests to it using wget or anything similar.

My idea was to configure a SSL/TLS on my server, thus making the API only available over HTTPS and enforce a client certificate check on the server. Every copy of the app will have the (same) client certificate bundled with it.

Note that I'm not doing this for the purpose of a user authentication, just for limiting access from sources other than my app.

Is is a valid solution? It appeals to me a lot because of how simple it is. Are there any obvious flaws with it? How likely is that the certificate will be unbundled from the app and used for malicious purposes?

I don't want people to send random requests to it using wget or anything similar. [...] Every copy of the app will have the (same) client certificate bundled with it.

Ok, that's a bad idea. It won't work. Roughly summed up: if a secret value is copied into more than two places, then it no longer is a secret. In that case, if some people have any interest in "sending random requests using wget", then they just have to extract the certificate and private key from any copy of your application, which is a trivial bout of reverse engineering.

Think about it: if hiding a secret value in a widely copied application worked, then there would be no possible DVD ripping. Music editors would not wail and grind their teeth at the thought of software-based piracy. There would be no cheating in online games.

The usual catch-phrase used to describe this situation is: client-enforced security does not work.

Mind the context, though. Extracting a private key from a compiled application that uses that key is not hard; however, that does not mean that people will do it. Apathy is one of the strongest forces in the computer universe. Such reverse engineering will happen only if somebody, somewhere, becomes motivated enough to invest a couple hours of his time (at most) on that task. This may happen only if there is anything to gain in, indeed, "sending random requests with wget" to your server.

Many weak systems, even applications which try to enforce client-side security, fail to be attacked simply because nobody bothers to do it.


Identify Unique Computer through Tracking How are websites able to uniquely track my computer?

I'm aware of: Cookies/Tracking, Super Cookies(HTML5 Cache), IP, Referrer, UA etc

I have been experimenting with Private Proxies and VPNs, but I heard (from an un-credible source) even with a VPN that some websites Trace your router's Mac Address and therefore identify your computer.

Now if I wipe my computer and install a new OS, browser etc and even get a new IP are websites still able to identify my machine? Like a unique Hardware ID or something?

I have also heard Javascript is able to get your MAC address. and therefore be able to figure out if you're running a Virtual Machine or an actual Physical machine.

And I figured that using Chrome will make it even easier for Google to identify that I'm using the same computer right?

Why am I asking all this:

I'm interested in how big sites like Google and Facebook do it and if they do it
I feel like Google is tracking people's every move - but I guess I'm just paranoid.

Will hiding behind proxies protect you?

Using a browser-based VPN plugin can betray you if you have Flash, Java, or even other plugins installed. Anything that can get read/write access to your file system will betray your presence.

There has also been a recently-discovered exploit that affected users of private internet access, a VPN provider.

It's also not that difficult to track you online, even if you're behind a bunch of proxies. Why?

Browser-fingerprinting

This essentially allows anyone with access to a browser-fingerprint database to track your surfing habits, if you have Javascript, Java, and/or Flash enabled, or aren't using a plugin to randomize your values on page load. Even with a plugin that randomizes these values, Flash and Java will betray you, and Javascript can do so as well, but not to the extent of what Java and Flash can do.

Surfing with Javascript Enabled

Javascript is notoriously exploited, and there are always new vulnerabilities popping up. Anything that can execute remote code on your system is dangerous. D

Surfing with Flash Enabled
Become a victim of Java exploits, or even legitimate Java programs.

There are multiple tricks to reveal your network interface / computer hardware information. Unique serial numbers on devices are a thing, and this is one of the ways Microsoft attempted to thwart piracy, only to affect legitimate users the most.

Signing into services/accounts that you normally use, while surfing anonymously.

For example, keeping iCloud, Steam, Skype, or something else running, or even having Windows check for updates! These leave a huge crumb-trail.

Using browser plugins with read/write access.
Analyzing connection logs for recent activity. Metadata owns you.

User A connected to Proxy A at X time.
Proxy A connected to Proxy B close to X time at Y time.
Proxy B connected to Proxy C close to Y time at Z time.

Your VPN disconnected you at an inopportune time, and you reestablished connection to normal services under your real IP.
You are the only person in your neighborhood connected to TOR at that time.
SSH Fingerprinting. It appears that if you're using a mac and your SSH connection reveals your serial number, you can be tracked this way. My theory on Device ID correlation can be better explained here, but I believe this is a perfect example of it in action.

Browser plugins in general will only re-route traffic to and from the browser's requests. That's it. If you're playing a browser-based game, then sure, I don't see why not.

Desktop games will not be redirected unless the browser plugin does some weird tomfoolery that manages to install an application on your desktop which does this.

Your concerns

  some websites Trace your router's Mac Address and therefore identify your computer.

You can spoof your MAC address quite easily. If websites are getting your mac address, it's because you have either Java or Flash enabled. Javascript cannot do this without using an exploit.

  Now if I wipe my computer and install a new OS, browser etc and even get a new IP are websites still able to identify my machine? Like a unique Hardware ID or something?

Yes, Flash can enumerate your device information, and easily help track you this way.

  I have also heard Javascript is able to get your MAC address. and therefore be able to figure out if you're running a Virtual Machine or an actual Physical machine.

Not unless there's a drive-by download exploit. Javascript can't get this information on it's own.

Finding out whether or not you're using a Virtual Machine is also something Javascript cannot do, unless you're using a non-standard resolution. Then it will likely detect it as a potential Virtual Machine. Let's say for example you resize your VM. It will most likely show up in your browser as a really funky resolution that isn't used normally - at all.

  And I figured that using Chrome will make it even easier for Google to identify that I'm using the same computer right?

Of course. Google Chrome Incognito used to phone home. I am unsure if it still does, but I don't trust Chrome.

So how can I avoid being tracked?

You can't 100% avoid it (exploits come and go) without going to absolutely extreme lengths, but you can make it a lot more difficult.

VPN that kills the Host OS connection if disconnected.
Virtual Machine (Guest OS that is not Windows) with a web browser (tor is good, but slow) which doesn't have Java or Flash installed, nor Javascript enabled.
No plugins, except essential privacy plugins.

You'd probably have to disable images for good measure. From time to time, image libraries are exploited.
For better results, use a VPN inside the VM, which is already VPN'd through your main system.

And this may not help much at all. Why? Because when you connect to Windows Update with a legitimate copy of windows, they know about your unique key / account, and Microsoft logs every single IP address for that particular key  / account. This means you'll be associated with the first VPN connection, even if you're hiding behind multiple proxies and VMs.

But how does that help track? Every little breadcrumb counts, and anything that associates you with anything online can easily help the right people find you.

But what about Linux? Most distros phone home as part of an update process. Qubes is one of the few operating systems that I know of which won't do this.

There are so many different and creative ways to be tracked. Bottom line is, if someone really, really wants to find out what you're doing, there are so many different tools to do so.

So is there no way to remain anonymous online?

Take off your tinfoil hat. Reliably blocking yourself from advertisers is one thing, and not too difficult. 100% Blocking yourself from everyone and everything is only possible if the computer is powered off and unplugged.

If you're online, then eventually an exploit will get you. And if you're going to such lengths to protect your privacy, you'll attract the attention of those infinitely your greater.


Are there file-encryption tools that only allow access to whitelisted processes? I am looking into VeraCrypt, a spiritual successor of TrueCrypt. This made a question pop up: As far as I understand, as long as the encrypted volume is mounted, every process can access the data. Wouldn't it be safer if only specific processes could access the files? Is there a tool that does process-based access control?

Process-based access control only works on data in transient memory (e.g.: RAM). Once data is stored on a semi-permanent media (e.g.: hard drive, flash drive, DVD, etc.), that media can easily be connected to a system that will not honor any access restrictions that are enforced in its native environment.

You could add process-based access control to the native environment, but that only protects against an attacker restricted to that environment who already has the ability to run code on your system. An attacker with such access pretty much has free reign on the system anyway, so it's nearly impossible to guard against such a threat. Any attempts to do so, particularly in the manner you suggest, would have to severely compromise on user experience and system usability.

At a bare minimum, I can think of three programs you'd have to whitelist for every file:

File Browser (e.g.: Explorer)
Document Viewer (e.g.: Acrobat, Word, Excel, etc.)
Antivirus (Take your pick)

Two of these are things that will very widely vary from system to system, file to file, and user to user, and all of them are subject to changes via software updates. And there's probably plenty of things I'm not thinking of. It would be nigh-impossible for the developer of the tool to properly build and maintain a comprehensive database of even just the most commonly-used programs to auto-whitelist them for the user.

Thus, the user would have to be prompted to add programs to the whitelist. These prompts would happen, at the very least, the first time each program needs to access the volume and again any time the program tries to access the volume after having had an update applied. Eventually, the prompting would reach Vista-era UAC noise levels and the user will end up either disabling the security or auto-approving - thereby rendering the feature useless.

All of this is rendered moot by any number of means (rootkits and keyloggers to start with) that are commonly used by attackers to compromise systems. The best way to keep processes from inappropriately accessing your encrypted data, is to not let such processes get installed and run in the first place.


Finding all AJAX entrypoints Is there any tool to (automatically) find all backend JavaScript entrypoints within a site?

I have to check a site for vulnerabilities in the backend code that validates AJAX parameters and I would like to first generate a list of all addresses that receive AJAX calls.

I am almost certain this can be done with a high probability, as the most common ways to have AJAX are fairly known: XmlHttpRequest, jQuery and other JS libraries; and these are all detectable. So if all other fails, I will probably write something like this myself.

But I would prefer to use an established tool if there is such, since it would probably be both less buggy, and easier.

So, does such a thing exist?

I recommend reading "Crawling Ajax-driven Web 2.0 Applications". The paper discusses different crawling techniques for Ajax-driven Web application. Through Crawling we try to collect all possible resources from the server for vulnerability assessment. But this is not possible with traditional protocol driven approach for Ajax driven web application. Since traditional approach crawler sends HTTP request and interpret responses but  for Ajax-driven web application we require event driven crawling. You can work with Ajax based crawler such as Crawljax


Can a virus spread between two Android devices logged into the same Google account? It seems like I have a virus on my android tablet. I have had my tablet for 2.5 years (virus problems for almost 5 months). I am thinking about buying a new phone (Android) in the near future (I currently have a Windows phone).

My question: With my new phone I want to sign in to the same gmail account but I am afraid that this virus can move trough my gmail from tablet to new phone and infect it. Is it possible?

As mentioned in other answers, you should assume that any passwords or data that you type into your tablet is visible to the attackers. So once you stop using the tablet for good (or do a factory reset on it), change all your passwords (if you change your passwords and keep using the tablet then they will simply see the new passwords).

You also need to consider how the virus got onto your tablet in the first place. While it's common on Windows for viruses to get in through email attachments or media files, this is far less common in Android. Chances are higher that you downloaded some game from the app store that has a virus in it.

One of the nice things about Android is that when you log into your Google account for the first time on a new device, it'll automatically download all your apps. In your case, it'll also bring the virus-game with it and PRESTO! Infected. It's been a while since I set up a new Android device, but I believe it asks permission to re-install all your apps, say no!

Another point is that with your tablet being 2.5 years old, it's probably on an older version of Android. The vulnerability that allowed the virus in in the first place might have been fixed in the more recent versions of Android, so there may be no issue.


Minimum number of ports needed for HTTP I am supporting a public campground that provides web site access to its customers via a Time Warner Cable connection with wireless AP points in the park.
The allowed port usage is blocking some obviously not needed ports like FTP, and other non-essential ports.

My question is, should I revert to only allowing the minimum number of port access to these customers to support HTTP only with perhaps DNS.  If that is a good strategy, then what would be the minimum ports allowed for Web page access.

Well,if you only want HTTP access, it would be enough to open port 80 tcp (HTTP) to the outside.

You can also open port 53 (udp & tcp) so they can use a public dns server, or provide a dns resolver yourself for your customers (not open to the internet). You might decide to ditch dns and expect them to input IP addresses directly, but that's unlikely to be enjoyed by your users.

However, that way you are not suporting HTTPS, which means they won't be able to access many websites, from their bank (I need to log in there in order to authorise this purchase on your shop…) to twitter (I just wanted me to tweet how fun your park was…) or Wikipedia. So also port 443 tcp would be a minimum.

However, there are websites for which you would need port 8000, port 8080, port 8888…

Plus, although you claim that you only want to provide website access, I'm pretty sure your customers expect to connect their smartphones and be able to use their apps, which -although predominantly they will be HTTP(S)-based- may use any port.

Would that help you with your DDOS attacks? That seems unlikely. You don't specify the details in which you were attacked, but even for the small cases in which it was launched from the inside, they could do it with only port 80 open. It is more important to properly limit the resources by your different clients to ensure a fair use of them. Up to blocking of abusive devices if needed.


How to prevent IoT devices from phoning home via the neighbor's wifi? I'm wondering what, if anything, can be done to thwart the sort of attack described below. First, you can assume the following:

(1) There are several devices in your home which you have deliberately connected to the Internet, for example your phone or your laptop. These devices are all running operating systems guarded by strong passwords. In other words, in the spectrum of information systems security, they constitute a low risk.

(2) All these devices connect to a router. The router is also secured by a strong password and is free of any known vulns.

Then, let's say you buy a new device. This device is not provided with your router password, any may not even advertise any networking capability, for example, a mouse.

However, security is only as strong as its weakest link.

With that in mind, you live in an urban area populated by wifi connections. Most of them were installed for people with no clue about security and by companies who want to exploit their ignorance. It's a good assumption, then, that a significant number of those SSIDs are associated with weak passwords, for example, the 7-digit phone number linked to the DSL line.

Imagine, now, that this new device you bought wants to upload your life somewhere, in whatever form of data might be useful to an attacker. All it has to do is crack one of those neighboring wifi connections, which is easily done because, hey, that TV is going to be sitting in your living room for years, with nothing better to do while in a low-power state than comb through a cracking dictionary and hack into any wifi it can see. It could round-robin through SSIDs, trying password after password. It might well succeed within a month, in a typical urban setting, based on what we know about the rapidity with which weak passwords can be cracked, even in the absenece of a GPU array with suspiciously high power consumption. (I'm thinking of a commodity microprocessor quietly churning away for months or years on end.)

This is an even more serious problem if one considers open wifi. While there might not be any in your vicinity, at some point, that new TV or whatever is going to be moved across town. Enroute, it could find an open wifi connection and talk to it just long enough to upload the highest-value cargo stored within its flash. A cheap supercapacitor could suffice for the energy to do so.

If you bought that TV with any credit card, or probably even with Bitcoin, your ID is all over it. Not that we need that, of course. There will be plenty of photos of your private documents from months of photography, audio recording, key logging, or whatever.

You get the idea.

As you have probably gathered, my question has nothing to do with how to secure one's router. Rather, I want to know how I can detect, let alone prevent, evil IoT devices, or even rogue pencil sharpeners, for that matter, from connecting to the least secure locally visible wifi, especially when they might connect only rarely.

I guess you need some sort of wifi sniffer that dumps the air to an SSD or USB stick 24/7, so you can periodically dump it for analysis. It would be nice to know an easy way to do that, ideally buy kit X from company Y. (Yeah the sniffer itself is untrusted, but at least you could isolate it in foam packing or something.)

It's worth noting that most IoT won't have much to phone home about. You mentioned a few devices: TV, pencil sharpener, and mouse. Unless these devices were specifically created with extra mics, cameras, etc as intentional spy devices, the information they would hold about you would be negligible. A mouse records movements on a table, and clicks. It has no context of where you are moving it, and what it is clicking on. A pencil sharpener would know nothing except that it was being used as a sharpener. The TV would possibly have more information, but still limited, unless it takes voice commands or something, and has a mic. If you have top secret things to be concerned about, then create a safe room for those things. Life is too short to be afraid of pencil sharpeners. If you have doubts about what's in a device, take it apart to look.


How to make sure that the public key has not been tampered with during transit? I understand how public key infrastructure works.

There is a private and public key, and someone may use the public key to encrypt data that can only be decrypted with the private key.

However there seems to be a flaw with this...

When you want someone, E.g Bob to send you a secret message, you send the key to him:
Public key ==> Bob

Bob then encrypts the data and sends it back to me.

Data ==> Public key ==> back to me

But what happens if at the first stage Public key ==> Bob an attacker modifies the public key to one he has the private key to, then decrypts the data Bob unknowingly sends?

How is this prevented?

Either

you give the public key to Bob when you physically meet him and mutually verify identities (as at a key-signing party), or
Bob verifies your public key through a trusted introducer (e.g. a Certification Authority)

This is the "Infrastructure" part of PKI.


Is public Wi-Fi a threat nowadays? In my opinion, arguments we have been using for years to say that public Wi-Fi access points are insecure are no longer valid, and so are the recommended remedies (e.g. use VPN).

Nowadays, most sites use HTTPS and set HSTS headers, so the odds that someone can eavesdrop someone else's connection is very low, to the point of expecting a zero-day vulnerability in TLS.

So, what other threats may someone face nowadays on a public network?

Public WiFi is still insecure, and it will always be if not used together with something like a VPN.

Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
Only around 5 percent of websites use HSTS. And it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are  a security pro chances are that you would fall for SSL strip anyway. I know I would.
Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
A computer or phone uses the internet for more than just browsing:

All it takes is one app that has bad (or no) crypto for its update function and you are owned.
All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
Dancrumb has more examples in his great answer.

Defense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.


Using Linux iptables to implement a stateless, packet filtering firewall When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard that a packet filtering firewall was the previous generation of firewalls. I never got to work with and understand how a strict packet filtering, stateless firewall works. Now, I want to understand it better. I had an intern ask me this and I want to show  him the difference between the 2 firewalls. I believe iptables can be used to set up a stateless packet filtering firewall. The thing is I am not sure how a stateless firewall would track incoming responses that originate from the behind the firewall. I tried my best to find some resources online on how to implement such a firewall. Any pointers to some article would be very helpful.

For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x subnet that are bound for port 80.

-A INPUT -p tcp -s 192.168.1.0/24 -m tcp --dport 80 -j ACCEPT

For output, the rules look similar. Therefore, outgoing(egress) packets are only accepted if there is a matching rule. The rule below allows only outgoing packets on port 80.

-A OUTPUT -o eth0 -p tcp --sport 80 -j ACCEPT

For a stateful firewall, you have the ability to monitor state. For example, the rule below only accepts packets to port 80 if it is initiating a new connection or is associated with an existing connection. The tracking is done by a kernel module "ip_conntrack". It keeps a table of all active connections.

-A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT


Cipher that does not give confirmation whether decryption is successful I was reading this question where the author wanted to know whether layered encryption would be better than a long password. The answers to this question all said the same thing: It would be easier for an attacker because he could guess the passphrases one by one.

However, this led me to think: Why exactly should a confirmation be given when the password is correct? And what ciphers are actually good for this kind of layered encyption?

Why exactly should a confirmation be given when the password is correct?

The attacker only gets such confirmation if the message is protected against modification using some kind of MAC or if the attacker can conclude from the decrypted data if he got the right key. The latter is unlikely if the decrypted data are not the final layer but only the result of another encryption. But it could be likely for the last step of the layered decryption.

  And what ciphers are actually good for this kind of layered encyption?

Encryption methods which don't have any detection of message modification by themselves are suitable for this. These are methods like AES-CBC or 3DES and others which don't have message authentication integrated.

But that does not mean that such layered encryption with multiple smaller keys would actually be better than a single encryption with a longer key (equivalent to the length of all the smaller key together). It only would not be that worse in terms of key security. But it would still be more complex to implement - which also means also more likely to implement it wrong. Or in other words: don't do it.


How to set up a multi-developer environment with emphasis on source code security? One of my clients runs a small software development company (15 employees) with PHP as their sole server side development language. They are having a networked environment with all the computers connected to a central server via LAN. The server also runs a FTP server.

Their hardware setup is as follows:

Individual developer Environment:
Windows 7 x64 Professional + XAMPP + Netbeans

Central Development Server Environment:
CentOS 7 + Apache + PHP + mySQL

Their current workflow is as follows:

When multiple developers are involved in a same project they create a new directory in the central server under a /projects folder using a FTP client (with a common FTP credential that everyone knows).
Then they use GoodSync(http://www.goodsync.com/) to sync their files from their local machine to server and vice versa.

Also they are planning to install and use Git in the main server.

Everything works fine but the organization wants to tighten the code security so as to disallow the access of all code of all the projects to all the developers.

So how can they create a simple easy to manage but a secure system for multiple developers?

Firstly, you need to weigh up the cost/benefit of what you're trying to achieve.

Generally preventing code theft by developers is a very steep uphill battle, but fortunately I don't think it's a very common problem. I can't think of many prominent examples of code theft except in some cases where very specific proprietary algorithms are involved, or perhaps an employee jumping ship to a client and taking their code with them.

In terms of physically restricting access to code, really the only viable way is to restrict access to repositories. Even then, that will only be significantly effective if your application architecture in such that entire components can be operated as separate services and high risk employees can work on low risk components which might interact with the high risk components as a "black box" without having to give them access to the code.

It sounds like a high risk employee jumping ship with the project they're working on is your biggest threat and fundamentally they need access to that code to do their job so there's not much you can do about that.

The threat of legal action or damage to their professional reputation usually provides enough incentive for developers to do the right thing. Perusing these controls is probably a more practical approach. Endeavouring to hire trustworthy employees should also be obvious.

With regard to your deployment process specifically, it's pretty bad from both a security and operational standpoint. It seems you're without any form of version control, and I'd be shocked if you weren't frequently overwriting each others changes accidentally and trying to figure out who changed what without any way to know for sure.

It's typically considered good practice for:

Your developers not to have direct access to your production servers except via an automated deployment process that takes code from version control where changes will be attributed to a specific developer
To have a discrete deployment (as oppose to incrementally changing files) sourced from an explicit version control version
For developers to have unique accounts, and typically their version control access dictates access to the production servers via their ability to commit code which will then be deployed automatically

There's plenty of resources on implementing version control and deployment management so I won't go into it too much further.


Can a process be DoSed by interfering with its compare-exchange loops? Consider a file accessed by multiple processes; the processes map the file to memory and then use lock-free operations to synchronize (for example, use atomic-add to allocate an offset in the file to write to).

The atomic operations might be lock-free, but not wait-free. On x86 for example, atomic-max would be implemented as a compare-exchange loop (fetch previous value, compute the new maximum, compare-exchange, repeat if the previous value changed). Now, a malicious process could hammer the memory location with writes to make the compare-exchange constantly fail, thus blocking the other processes forever.

Is this a real issue that I need to protect against? Or does the unpredictable timing of modern processors make such attacks impossible?

Most interesting question.

In theory, such an attack would be possible if we were to make CAS (compare-and-swap) intentionally always fail.

For that to happen (from a hardware perspective), the underlying hardware should allow all competing threads to fail, which it normally should not, because a CAS that could fail for all threads could lead to live-lock situations (and non-deterministic behavior).

Furthermore, techniques such as exponential back-off (like in the case of the Ethernet protocol) should be used before retrying CAS.

From a software perspective, if not sure of the hardware behind, one can make sure to use things such AtomicX.compareAndSet (JAVA SE 7,8) instead of AtomicX.weakCompareAndSet, which practically makes sure simultaneous fails of all threads is excluded.

As example, win32 implementation is safe:

   void LockFreeQueue::push(Node* newHead)
{
    for (;;)
    {
        // Copy shared var  to local.
        Node* oldHead = m_Head;

        // Do some work, not yet visible to other threads.
        newHead->next = oldHead;

        // Attempt to publish changes to the shared variable.
        // If the shared var hasn't changed, the CAS succeeds and we return.
        // Otherwise, repeat.
        if (_InterlockedCompareExchange(&m_Head, newHead, oldHead) == oldHead)
            return;
    }
}

The above is loop free because if the test fails for one thread, it means it must have succeeded for another.


Can public keys be a security risk when performing password-less SSH logins? Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins.

The servers being checked put the public key of the nagios server in a file /root/.ssh/authorized_keys

Now if I see a nagios server in an enterprise network, couldn't I just fetch the public key of this server and replace mine with it and log into the servers without password?

The values in .ssh/authorized_keys are public keys -- these are mathematical objects, each of them being linked with another mathematical object called the private key. When the nagios server connects to one of the monitored servers, it uses its private key: the nagios server demonstrates its knowledge of the private key through a mathematical operation (a digital signature), which the target server verifies using the corresponding public key.

The magic of the construction is that the public key can be made public: although the private and public key share a common structure, that structure is "hidden" and cannot be rebuilt from the public key alone (here, "cannot" means "you would need a computer bigger than the whole state of Wyoming, and programmed by Chuck Norris").

So, to log into the target servers, you do not need to grab the public key, but the private key -- and that one never leaves the entrails of the nagios server.

(On the other hand, if you can get a read access to the nagios server, e.g. you can have a look at a backup tape, then you may get the private key, and access all the servers. Attacker's Nirvāṇa. That can be a serious security issue: protect your backups !)


Is there a reasoning encrypting a GPL binary where I have to publish the sourcecode? We're a company selling embedded devices. Our devices use u-boot & Linux, both being GPL and therefore we have to release the sourcecode as used to build our binary.

We're in the process of implementing more security measures (both to increase reliability as well as protection against IP theft), so of cause encryption becomes a topic. Some people call for the encryption of u-boot and kernel (which is supported by the hardware for the bootloader as well as by u-boot for the kernel).

Is there a reasoning in protecting our GPL covered binaries by encryption? We already have secure boot in place (HW for Bootloader, U-Boot for Kernel, ...)

I think you are mixing up concepts. Encryption is to hide something and since you publish the source code anyway there is no reason to hide it. But you tagged "secure boot" and this is more what you probably want in terms of information security.

Secure boot does not care about hiding stuff but it is about making sure that only the intended code runs. It uses cryptography, only not encryption but signatures. Using these signatures it can make sure that only the intended software runs on the device. This way secure boot can be useful to protect the software on the device against manipulation. Note that such protection can be useful for security but also can be used to restrict what users can do with their own hardware in a negative way.

Another way were cryptography is needed is to secure updates. But here again it is not about hiding stuff (encryption) but instead to make sure that these are actual genuine updates from the vendor - using signatures. Here again this can be used for security to protect against malicious updates but also in a negative way to deter power users who like to tinker with the hardware they bought.


Should I be worried about this url request I received on my site? I was checking the weekend logs of my IIS server and noticed a strange request which was blocked:

http://www.mysite.com/Scripts,j.html()).html(a.spinner)}this.xhr=d.ajax(d.extend({},a.ajaxOptions,{url:h,success:function(k,n){e.element.find(e._sanitizeSelector(c.hash)).html(k);e._cleanup();a.cache&&d.data(c

I have checked my scripts folder and found nothing unusual. I also I searched part of the request on Google and found that it is some kind of 'javascript injection'.

Should I be worried?

When I googled the query, I received many similar requests reported as malicious on different websites (like this one). This certainly looks like an XSS attempt. However, I don't think there's anything to worry about this particular request. The code:

j.html()).html(a.spinner)}this.xhr=d.ajax(d.extend({},a.ajaxOptions,{url:h,success:function(k,n){e.element.find(e._sanitizeSelector(c.hash)).html(k);e._cleanup();a.cache&&d.data(c

is actually a part of jQuery UI 1.8.13 minified. This is basically a part of the code which is responsible for handling Tab Widgets. Here is the complete code:

        if ( o.spinner ) {
            var span = $( "span", a );
            span.data( "label.tabs", span.html() ).html( o.spinner );
        }

        this.xhr = $.ajax( $.extend( {}, o.ajaxOptions, {
            url: url,
            success: function( r, s ) {
                self.element.find( self._sanitizeSelector( a.hash ) ).html( r );

                // take care of tab labels
                self._cleanup();

                if ( o.cache ) {
                    $.data( a, "cache.tabs", true );
                }

                self._trigger( "load", null, self._ui( self.anchors[ index ], self.panels[ index ] ) );
                try {
                    o.ajaxOptions.success( r, s );
                }
                catch ( e ) {}
            },
            error: function( xhr, s, e ) {
                // take care of tab labels
                self._cleanup();

                self._trigger( "load", null, self._ui( self.anchors[ index ], self.panels[ index ] ) );
                try {
                    // Passing index avoid a race condition when this method is
                    // called after the user has selected another tab.
                    // Pass the anchor that initiated this request allows
                    // loadError to manipulate the tab content panel via $(a.hash)
                    o.ajaxOptions.error( xhr, s, index, a );
                }
                catch ( e ) {}
            }
        } ) );

There are also no existing vulnerabilities specific to this particular version of jQuery UI. I don't think it would have done anything malicious, at least on the server side.


Open source firewall with multi wan support I use smoothwall express and also used IPCop. But now I need to have multi WAN support as I want to use a DSL and Cable internet connection together to increase my speed, specifically upload speed.

Any good user friendly recommendations out there?

pfSense - http://www.pfsense.org - and Untangle - http://www.untangle.org both support multi-WAN configurations.  Smoothwall and m0n0wall may do so as well, but I don't have experience with them.


DNS hijacking and Subject Alternative Names My website is published on Google's Firebase Hosting. I own the domain. Google provision an SSL certificate (lately from Lets Encrypt, it used to be someone else). The certificate is shared between several domains using Subject Alternative Names. I don't own these other domains.

  Once domain ownership is verified we will provision an SSL certificate for your domain and deploy it across our global CDN. This process can take several hours.

  Domains will be listed as Subject Alternative Names in the FirebaseApp SSL certificate.

My question is: what would happen if a DNS hijack attack redirected requests to my domain to one of the other domains sharing the same certificate? A request to my domain would be received by one of the other serves sharing the certificate. How would the server respond? Would my browser accept the response? If not, how is this protected against?

In the simplest case your domain at Firebase Hosting is sharing the same IP address with the other hosts mentioned in the same certificate anyway, which means there is nothing to actually DNS spoof.

If the IP address is not the safe and the DNS response can be spoofed to point to a different IP address serving the same certificate then both the server name inside the TLS handshake and the Host header inside the HTTP request will still have your domain in it. How the web server reacts to having a domain inside these headers which is not configured at the web server depends on the server configuration which also means the behavior might change over time. Typical behaviors are either sane responses like an error at the TLS level (unknown server_name), error at the HTTP level or an insane response of returning data from another domain at the server. I would expect that the server is configured in the sane way but have no way to test it. But if you know that the same certificate is actually employed on different IP addresses you can try it yourself:

$ openssl s_client -connect IP:port -servername example.com
GET / HTTP/1.0
Host: example.com


Best practice regarding activation mail request to reduce information leaks We are setting up a service on our website allowing users to ask for a new activation link. To ask for a new activation link, the user has to submit his/her email address associated with his/her account.

We can have 2 outputs, depending on which we have to give a confirmation message.

User is registered but account is not active. Confirmation message will be

  The activation link has been sent.

User is registered and account is already active. Confirmation message will be

  The account is already active. If you have forgotten your password, please click here.

We are having doubts about the second confirmation message. It tells too much about the fact that the account already exists. Are there best practices or security tips regarding these kinds of messages?

Or do you have any suggestions?

Edit 2017.03.17

We have implemented a new solution.
No matter the output, we will display the following message:

  If you are registered, you will soon receive an email.

However, the email sent will depend on the output:

If the account is not active, we will be sending the activation link.
If the account is already active, we will be sending an email saying that the account is already active and explaining the "password forgotten" procedure.

This solution seems to be the most appropriate in our situation.
If you have any other suggestions, please submit.


Security of encrypted Apple .dmg file? are there any information (in deep / cracking) about how secure a .dmg file is when encrypting it with 128 or 256 bit of AES?

I didn't find any documentation about it but I might just be too silly to find it. I would like to know how secure it is and if there is a possibility of a backdoor withing the file.

About DMG and AES in general

https://apple.stackexchange.com/questions/110369/are-the-files-in-an-encrypted-dmg-actually-in-plain-text-on-the-hard-disk/110618
https://stackoverflow.com/questions/16537418/how-secure-is-aes-128

About DMG "cracking" (infact he just bruteforces it because he knows most of the password and just has to test about 22k password combinations):

https://www.whitehatsec.com/blog/cracking-aes-256-dmgs-and-epic-self-pwnage/

At least there are no known implementation failures of which I am aware (there was some kind of bug around 2006).

With DMG Encryption on Mac OSX AES 128/256 is used which is commonly considered to be a safe encryption method (of course depending on your password).

So if your password is good (long, lower/uppercase letters, special characters, etc.) then it is safe


Does MAC spoofing prevent identification? I regularly connect to public wireless APs scattered around the city, offered by my carrier. I remember reading an article that a determined owner can track you between APs and thus know your location and routine. Now I found out that one can randomize one's MAC address, so I was wondering if that can prevent my identification and consequent tracking. If not, what other information can a determined AP owner acquire from a client that could identify him? Assuming all communication between the client and the outside world is encrypted end-to-end.

For instance I imagine the owner (or anyone on the network) could use nmap to get some info on me such as the OS I'm running, but is there anything that could uniquely identify me? A fingerprint, or even something like a hostname, which would be the same across all APs and presumably different from everyone else?

When using a phone while logged in to your accounts, you're visible.

  I remember reading an article that a determined owner can track you between APs and thus know your location and routine. Now I found out that one can randomize one's MAC address, so I was wondering if that can prevent my identification and consequent tracking.

Spoofing your MAC address is trivial. Encryption here is irrelevant. It doesn't matter if they can't tell what you're communicating, so as long as they can identify you and know where you are.

Even changing your IP address and using random proxies can be used to identify you easily. How? It's very simple. You may be logged in to multiple Google / Apple services. When you log into those services, they store every single IP address that was used to connect to that account. Here's more information on how you can be tracked online:

Identify Unique Computer through Tracking.

It doesn't change the fact that your social media may be still active and gathering information about you. Your MAC address is less relevant than the device you hold, and it's accompanying identification plus accounts.

  Assuming all communication between the client and the outside world is encrypted end-to-end.

The encryption doesn't matter if you're sending encrypted data to advertisers which they can decrypt, such as your device ID, known accounts, etc. They don't really need to know what you're doing -  just that you're there. That's all they need to really dig into your life.

Throwaway Smartphone without your normal accounts = stealthy

With this method, the only way you can be identified and tracked is in person, through cameras, or if you decide to log into your own account(s).

In some rare cases, your smartphone could be hacked and the camera could be used to spy on you, especially if you get the attention of the wrong people. However, this is very unlikely unless you're a criminal of sorts.

Using a Laptop correctly = stealthy

With this method, it's the same as a throwaway smartphone, but you need a different Operating System than Windows. Without logging in to your normal accounts, you'll greatly reduce your footprint.

You don't want your operating system keys / device IDs to point back to you. Windows Update/etc will send information to Microsoft about you, including the IP address you were connected to at the time. If you're using the same windows key / hardware every time, then it'll be very easy to put the pieces of the puzzle together.

So who exactly is using this information, and how are they doing it?

It doesn't matter if you're using encryption: they can still tell you were there. Not using encryption is just icing on the cake. When you connect to WiFi hotspots, you agree to the terms of service. They will collect information about your device, and sell that information to third parties.

Third parties will take that information and use data analysis to correlate your usage patterns, how you travel, where you connect, etc. Remember that advertisement companies want data on you, as they're able to sell it to those who are interested in it.

With a big enough data set, it's easy to show correlations between where you are, where you've been, and which accounts or IP addresses accessed that information. Using your unique device IDs, it's rather easy to tie multiple pieces of information together.

Even if the company claims that they don't sell personal information about you, it quickly becomes personal information through data aggregation, analysis, and correlation.

Remember, if something is free, you are the product.

Too Long, Didn't Read

It won't really help you. At best, randomizing or changing your MAC address will give you a small layer of "protection," so as long as you don't use any of your normal accounts, and don't leak your device IDs.

However, there are too many other things working against you at this time. In every single case, you should note that most public places have cameras, so you will be identified.

Do you really need that much opsec? Who's after you? >:|


What is happening to my empty server? A couple of days ago I logged in to a linux VM and the VM said there were 12000 failed login attempts. After each login it kept informing me of failed login attempts so I started to monitor my firewall logs on the host machine (who now also covers the VMs) and I keep finding incoming requests for DNS, telnet, http and ssh.

An example of some requests now:

As you can see, seemingly random hosts keep connecting to my host and/or VMs using various ports.

I began using the server a week ago and all I did was bind my domain to it and some VMs on it. There are however no real services running on it (except some test environments like HTTPD).

I'd like to note the host machine has had ransomware (Dharma) for a brief moment (I completely reinstalled it after a day).

This has been going on for a couple of days and as soon as the server comes online it continues. I assume this is an attack? If so, is there something I can do about it or do I just wait it out?

There are now millions of machines connected to the internet that are infected and part of one or sometimes several botnets. One of the things some botnets do is to automatically and continuously trawl through discovered IP addresses looking for ports to try and connect to. When they find one, they will attempt to use common ids and passwords to break in and infect the found machine.

You will find that any new server or router connected to the Internet is discovered within around 30 seconds.

You should NEVER leave common ports open directly to the Internet unless you really need them.

Some ports should NEVER be left open full stop. Those include TELNET and FTP. These are unencrypted services and if you use them, you are open to having your logins stolen and any data you transfer recorded.

In general, the only ports you should leave open on their defaults are 80 and 443 for HTTP and HTTPS respectively. Of course, you might need others too but you always need to be aware that any port is a target.

In addition to the unsecured services, I strongly recommend moving the default ports for SSH and RDP as these attract a lot of attention and you really don't want your logs full of connection attempts since this may mask other issues. RDP in particular can be susceptible to attack and there have been some really high-profile attacks using it recently. RDP is the Microsoft remote desktop service.

UPDATE: Accessing SSH via Teamviewer is a little excessive really. Use it but just move it to a different port. You might also look at something like fail2ban which can add some smarts to the firewall by auto-banning IP addresses that persistently try to get in.

Teamviewer has had some serious security failings in the past, I'd recommend doing a search to make sure it is OK at the moment. You would generally only be using RDP on a Windows server & you need an appropriate license for that.


Threat modeling a network monitoring software Assume a network fault monitoring tools is deployed to monitor a subset of routers.

What an attacker can do by exploiting a network monitoring system like OpenNMS?

Can they learn about the topology of the network?
Can they find systems interest? (servers, switches, etc)
What else may be possible to discover?

I believe it depends on the configuration of the NMS system, and what traffic is flowing across. Am I correct?

I am interested in finding out what sensitive information a network/fault monitoring system is vulnerable to.

Many NMS systems work better when deployed using simple network management protocol (SNMP). SNMP allows for greater detail in data versus inference. E.g. without SNMP, the NMS tool relies on aggregating bandwidth and connections it sees, versus using SNMP where it can access the router and query an interface. So what is at risk here:

Routes: In segregated environments, there are VLANs, multiple routes sometimes to different providers, destinations, and so forth. As an attacker, I would always be interested in those routes, it helps me discover more of an attack surface.

Systems: Where I would have to manually discover what is on the network, the NMS makes is simple for me because it is a single source of discovery versus me having to fire off say NMAP to discover everything on my own. This keeps my network noise minimal.

Versions: Along with systems, and routes, the NMS makes my life simpler as an attacker since most NMS systems contain versions of software and systems. Rather than performing system fingerprints, I can just query the NMS system for specifics. E.g.: "Which of these 1000 systems are Windows 2003 systems, and what is their patch level? (To be used for isolating exploits).

Credential Reuse: Many organizations forget about credential re-use. The more accounts on the NMS the higher the likelihood someone is re-using their credentials. E.g. username (on NMS): jsmith password: Passw0rd1 in this situation a junior admin has an account on the NMS. His password was cracked, and now I as an attacker can use that password to pivot around the organization. Depending on how you have your NMS configured, it may be possible to access an NMS, and get all the data I need without accessing say an Active Directory server.

There are plenty of issues with NMS systems regarding what, and how an attacker can leverage that data. I love targeting NMS based systems, and often find that organizations who deploy them, do not address these issues. (Segregation, isolation, monitoring)


Is there a virus that attempted to foil generic decryption techniques, and how did it do so? Is there a virus that attempted to foil generic decryption techniques? How did it do so?
I need to know the virus name, because I tried searching and I am unable to locate any virus that did that, and the mechanism of the virus is not defined either.

Thanks for the link, it is an interesting question indeed. I'm not a virus expert, but I know from previous reading I know that from the document you mention, I have a problem with the sentence "Inside this virtual computer, program files execute as if running on a real computer" which merely sounds like marketing simplification to my hear.

Indeed, the issue with this system is that if the anti-virus would have to implement a full fledged virtual machine to run the virus in an undetectable sandboxed environment really implement a full computer environment, then it would be really too resources intensive. Therefore, the anti-virus designer have to find a compromise: which system call should be implemented, which should be just stub, what kind of values should be returned, etc.

Starting from that, the virus designer will rely on these assumption to try to detect:

When the virus code is run from within the anti-virus sandbox (trivial example: call some system function several times and compare the results which should be different on a real system, and are always the same due to anti-virus' sandbox stub), in this case it will not trigger the decryption algorithm and remain undetectable,
When the virus code is run on the real system, in this case the virus will trigger its load.

And the next logical steps are just an arms race. Anti-virus vendors try either to fool or recognize the virus' sandbox detection routines, and the virus designers try to find different alternative ways to detect the sandbox, and so on...

Edit: Interestingly enough, the document goes on and acknowledges the speed issue affecting the ideal "as if running on a real computer" model ("the key problem with generic decryption is speed", page 8). It then replaces this ideal model with an heuristic one, concluding with the "marketing version" of the arms race I mentioned: "heuristics demand continual research and updating".


Could clicking a Grabify link to my Facebook page get me hacked? My newest boyfriend sent me a Grabify link on Messenger. Without thinking (probably because of trusting him), I clicked the link (yeah, I'm an idiot, lol). The link has routed to my Facebook account.

I'v done some searches online but I find no answer. I just wanted to know if there's any possibility that he was able to get my Facebook/Messenger login information or if my account is hacked?

Disclaimer: I am the creator of Grabify

No you cannot have your Facebook account hacked by clicking on a Grabify link.

To view the information it logs, you can see that here: https://grabify.link/faq/features

To remove any of you logs from the website, you can do that here: https://grabify.link/removeme


Do I have to hash users' IP addresses when I log them? I have read a lot of users saying that you have to hash IP addresses - and a lot of others who say I don't have to because it is not private information.

I use IP addresses for identifying users, because they can download files but have limited traffic (per day).

Are there articles or blog posts where this is illustrated or opinions from people who know more about privacy things like this?

I obviously tried searching on Google - but there are almost no suitable results.

So IPs can in fact be considered to be PII (or personally identifiable information) in some cases, so you're right to want to consider whether you need to protect them. Generally this doesn't mean, however, going to any additional lengths beyond how you would protect other PII, say, email addresses for example.

In any case, traditional hashing is likely going to be an ineffective mechanism.  There are only 4 billion IP v4 addresses potentially in existence, and the reality is that you're probably dealing with a far smaller address space that that.  This means that it's relatively easy for an attacker with the hashes to compute the IP addresses that result in those hashes.  Salting is generally not useful in this case, because you presumably want to know when two requests are associated with the same IP address, and you will not be able to easily compare an existing hashes to the hash of the IP address associated with a new request if all of the hashes are uniquely salted.

You could, potentially use a keyed hash without a salt, using a function like HMAC.   This, presuming you can keep the key secure will lead to hashes that can be compared to each other, but also cannot be associated to the IP addresses that were used to create them by an attacker who has the hashes, but not the key.  If the key is obtained by the attacker however, this is no more secure than traditional hashing.

Generally speaking, I'd suggest that the risk here doesn't demand the complexity of a mitigation of this level.   I think the complexity you're adding (and need to maintain) probably outweighs the additional security you'd get.   However, if for your application does in fact require you to consider IP addresses to be sensitive enough to warrant extraordinary protection, consider using a keyed hash function.


How to choose a good (and easy to use) WiFi password? Over the last few months I have had to enter WiFi passwords into smart phones, TVs, printers, etc.  None of these have real keyboard and they make it hard to enter long passwords or passwords that constrain symbols etc.
Therefore all the normal rules about choosing good passwords seem to be out of date…

(It took ages on the phone for me to explain to someone how to enter their password into a “TV stick” due to these issues and not having the same “TV stick” to try it out on myself.)

Most good password advice (suggesting long passwords with characters randomly selected from a large character pool) will not ever go "out of date", except perhaps with regards to "minimum length" recommendations. (Used to be 8, then 12. Soon enough, if not already, 12 will be too short too. I recommend 15, preferably 20+.)

The problem you have is one that cannot be worked around without weakening the strength of your password, because strong passwords will never be very human-usable regardless of what interface you're using to enter them. The really strong passwords aren't even fun to enter on a full QWERTY desktop keyboard, let alone any of the more limited UIs available on "smart" devices of any sort. The best passwords aren't even human-memorable.

Unfortunately, that's just the nature of the beast. You can have a strong password, or you can have one that's easy to use and remember. Intersecting the two is nigh-impossible.

Some suggestions for your WiFi network:

Pick a PSK as long and random as your router will allow. You'll generally only have to enter it once per device, so you're getting solid protection for practically zero impact to your daily life.
Be very selective of who and what you allow onto your WiFi network. This saves you the headache of having to enter in the password (or talk someone through it) more often than you really need to, and reduces the attack surface of the network as well. Troy Hunt has a blog post on the subject that's worth a read.
Wire things up wherever possible. If something doesn't need to move around, it doesn't really need to be wireless. Again, this saves the headache of punching in the PSK when you really don't have to. It also helps network performance for the device you're hard-wiring (giving it higher speed & reliability), as well as the devices you're leaving on WiFi (freeing up airtime for them).


What does "signing" a file really mean? I'm a bit new to security and trying to get the concepts properly.

I'm wondering what exactly "signing" a file (a certificate, an apk file, or something else) means?

Do we sign the whole file so it becomes sort of encrypted?
Is there like a piece of plain text that we sign and pass it through, for example, a zip, and let the receiving side checks that piece based on a particular protocol before going any further?
Or something else?

As far as I can see, if we sign the whole file, then it can be more secure as the contents would be encrypted (or signed). But I've also seen/heard some examples in where you only sign a piece of text instead of the whole thing.

Any ideas would be greatly appreciated.

PS: I've already checked What does key signing mean?

Signing a file does not encrypt it. When Alice signs a file she usually signs the whole file. So she calculates a hash of the whole file and signs only the hash with her private key and attaches this piece of information to the file.
Bob uses her public key to verify it and gets her calculated hash. He then calculates the hash of the file himself (without the signature of course) and checks both hashes. If they match its the same exact version of the file Alice sent. If they don't match Mallory could have changed it.

The file itself never gets encrypted, and of course you can just remove the signature, but then it's not signed anymore (and therefore worthless).

For more technical and detailled information please refer to forests answer: https://security.stackexchange.com/a/198473/191453


What popular online services allow passwordless authentication using digital signatures? I am looking for web services that allow clients to authenticate using digital signatures.

Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes using an additional factor). I'm looking for something entirely different: services where the client is authenticated by digitally signing a challenge provided by the server, otherwise providing no password at all.

I'm especially interested in web services in the field of e-commerce, but I'll take any well known web service that can be used to construct a mashup demo -- so far I wasn't able to find any.

Are any of you familiar with any such services?

PKI isn't a very popular approach to 2 factor authentication outside the enterprise because of the overhead of protecting the private keys and managing certificates, but there are some commercial solutions available.

Take a look at Layer7.

Years ago I used to work for Baltimore Technologies (famous for the first digital signature of legislation (by Bill Clinton and Bertie Ahern)) and we looked at doing exactly what you are wanting. Two factor authentication using digital signatures. The problems really are:

Where are the keys going to be  generated and stored?
Who can access the keys? and
How to we interface between the client and the device which holds the keys?

These are not easy questions to answer, but technologies like TPM may eventually come in to answer some of them. However, keys will still not be mobile. So maybe eventually we can use mobile devices for key storage? But, what happens when the device is lost / stolen / broken? And, again, how to we link to device to the client browser for authentication purposes?

Perhaps the most interesting implementation of device authentication I have seen is that by Barclays Bank. PINSentry uses a handheld device and your bank ATM / debit card in order to provide authentication to the Barclays online services. Check it out. This isn't a PKI implementation. Its a one-time password application, but the application is executed on the smartcard.

The most popular method for two-factor authentication is one-time password. These come in a variety of forms and can be provided by dedicated devices or mobile devices. Look at Authy, VIP Access or Google Authenticator.


Alternative ways to manage lots of Passwords since Lastpass was hacked & now acquired There is a lot of debate on Reddit and other sites about whether the hack was or was not bad based on lack of salt to uncover the password hashes. Also, LogMeIn seems to have poor reputation & ratings as a reliable company.

I read a lot about KeePass in sync with DropBox/ G Drive/ OwnCloud etc.

There are old threads on SU about options of easy of use but not sure what 'Information Security' experts from here would say?

What would be good ways to manage App & Web Site passwords that are:

Convenient & Usable - Ease of Use
Better/ more securely stored
Can be used for Individuals

Bonus:

As well as groups/ teams for shared resources in an SMB

This really depends on your threat model.  Depending on what information you're protecting (and who you're protecting it against), Lastpass is just fine.  With a different model, you can use KeePass on a standalone, airgapped, encrypted Unix machine and pray to God your info is safe.

Lastpass is fine for your recipe web site account.  To some extent, they're excellent for even other personal consumer account protection.  Remember, Lastpass uses "zero-knowledge" encryption, so by design, the fact that they host your password data is no different from one of the alternatives you mentioned....

Which is KeePass + your cloud service account. I really have no idea what advantage you gain by doing this instead of just using Lastpass anyway.  Seriously, what's the difference?

KeePass stored on your local machine will be about as secure as your machine (or any local media the password database is stored) is.

The best way to approach the problem is to do your own personal risk management analysis. That just means... figure out what's most critical to protect.  Figure out whats less important, and finally what's least important. Consider what/who you're protecting that data against, and then plan your defense strategy accordingly.

It really should (and does) depend on all these factors combined. There is no one perfect answer.


Evil Twin attack: How to make client send WPA2-PSK password when asked for AP-password? How can an Evil Twin attack be set up, so that the client will be prompted for a password and send it in plain text?

Is the above even possible? I have already set up the fake AP, but it must be configured correctly.

Which tool will be best suited for the job, and could someone provide details on how to execute the attack / find knowledge, if possible?

This is impossible without knowing the password (WPA prevents this). However, you can set up an open fake accesspoint and use a captive portal to get the password in clear text. This would require you to social engineer the target into connecting to your accesspoint. You can for example keep sending deauth requests to the real AP and let the captive portal on your fake AP be a fake update page.


Configuration settings for sessions in php I recently found the following configuration settings:

use-strict-mode
hash-bits-per-character
hash-function

and I have some questions about them:

Use-strict-mode says the following:

  session.use_strict_mode specifies whether the module will use strict
  session id mode. If this mode is enabled, the module does not accept
  uninitialized session ID. If uninitialized session ID is sent from
  browser, new session ID is sent to browser. Applications are protected
  from session fixation via session adoption with strict mode. Defaults
  to 0 (disabled).

My rudimentary understanding is that it creates always a session ID for you, but I already saw another config option with does the same. So I assume that my understanding is wrong. So why do we need it? (The closest I saw is that it prevents OWASP A9, but it does not give me a lot of information)

session.hash_bits_per_character:

  allows you to define how many bits are stored in each character when
  converting the binary hash data to something readable. The possible
  values are '4' (0-9, a-f), '5' (0-9, a-v), and '6' (0-9, a-z, A-Z,
  "-", ",").

From my understanding this does not contribute anything to security, only tells what chars can be used for your session. The bigger the number - more characters and thus smaller string. So why not to put 6 (instead of default 4)?

Hash-function

This one is clear, but from the big list of possible functions, which is the one (I assume that default md5 is not good) is preferable?

P.S. before asking the question, I read this answer.

session.hash_bits_per_character

This indeed only affects how the raw session ID is encoded. You can generally set it to any value you want. However, a value of 6 will lead to “strangely looking” session cookies, because the comma has to be URL-encoded.

session.hash_function

If the PHP environment uses weak session IDs without additional entropy (see session.entropy_file and session.entropy_length), then it can become feasible to recover the seed of the PHP pseudo-random number generator through the IDs and use that to predict future values (chapter 4.2). A slow hash algorithm like Whirlpool or SHA-512 makes this harder, because finding the original input of the hash takes longer. But of course the real solution to this problem is to not use weak session IDs in the first place.

session.use_strict_mode

This is supposed to make session fixation attacks harder by not allowing an attacker to make up their own session IDs. See the corresponding RFC for a more detailed description of the ideas behind it.

However, an attacker doesn't have to come up with their own IDs to perform a session fixation attack. They can simply obtain a valid ID from the application and use that. So this feature is rather questionable.