Is there a way to isolate every device on my network? As it is every device on my network and every app on those devices could be hacking my other devices on my network. The app I just downloaded to my iPhone might be looking for known exploits in my printer. Some game I just downloaded to my PS4 might be trying to hack my ip camera. My smart TV's new update might be trying to hack an unpacked exploit on my Linux box.

Is there some way I can configure a router such that every device is isolated from every other (can't see the other devices on the network). Then I can poke a few minor holes (like if I want my PS4 to be able to see my media server).

That's what a firewall is for. In your case a packet filter based solution (linux with iptables or similar) is probably mostly enough but if you want to have a more granular access (i.e. only specific pages of the internal web server) you would need application level control which a packet filter does not offer. The usual home routers are mostly not suitable for this purpose because the firewall they often implement is only for separating the internal from the external network, but not for separation between internal devices.


In Nmap: can we specify the --version-intensity option with A option? After having read Nmap documentation (in french but the translation seems pretty accurate), a question arose:

Is it possible to use --version-intensity option (from the -sV option) when using the -A option ?

I'm asking because -A option integrates service/version detection (which correspond to the -sV option right ?) but in the documentation of -A option I can't see any reference to the --version-intensity option.

I hope I was clear in my explanation.

Thanks

Yes, you can. Under the hood, -A is simply an alias for a number of other flags, including -sV which enables version scanning. User-specified control arguments are given precedence over defaults (if any) set by such flags.

As an example, -T4 sets a timing template including --max-rtt-timeout 1250ms, --initial-rtt-timeout 500ms, and --max-retries 6. However, you can manually specify any of these in addition to the -T4 flag to override these defaults.


How can I sandbox a Wine application on Linux? I would like to run Microsoft Office programs such as Word but do not trust them, nor should anyone. Without running a virtual machine, is there a good way to sandbox a windows application to run on linux. I've tried using firejail (block all network access and temporary fake filesystem) with Wine but could not get Excel or Word to work.

You can run wine inside of docker containers to isolate it from your host system.
docker does not support GUI applications on its own, but it is possible.

Have a look at x11docker to run GUI applications in docker. There is also a description of short setups without x11docker.

There is also a ready-to-use wine image at docker hub: x11docker/lxde-wine

Example: wine on dockered LXDE desktop (needs a nested X server like e.g. Xephyr):

x11docker --desktop --home x11docker/lxde-wine

The image contains PlayOnLinux, too. Run Playonlinux with:

x11docker --home x11docker/lxde-wine playonlinux

(Option --home creates a persistant home folder for wine container to preserve installed wine installations.)

Disclaimer: I am the author of x11docker, sorry for advertising

Setup without x11docker to provide an independent answer. It lacks some x11docker security features, but basically it works and is much better than installing wine on host:

Dockerfile to build a wine+PlayOnLinux image:

FROM debian:stretch
ENV DEBIAN_FRONTEND noninteractive

# contrib for winetricks, stretch-backports for latest wine
RUN echo "deb http://deb.debian.org/debian stretch contrib" >> /etc/apt/sources.list && \
    echo "deb http://deb.debian.org/debian stretch-backports main" >> /etc/apt/sources.list

# Multiarch for wine32, wine, some often needed dependencies:
RUN dpkg --add-architecture i386 && apt-get update && \
    apt-get -t stretch-backports install -y wine

# helpful additions
RUN apt-get install -y fonts-wine winetricks ttf-mscorefonts-installer winbind

# wine gecko and mono
RUN mkdir -p /usr/share/wine/gecko && \
    cd /usr/share/wine/gecko && wget https://dl.winehq.org/wine/wine-gecko/2.47/wine_gecko-2.47-x86.msi && \
    wget https://dl.winehq.org/wine/wine-gecko/2.47/wine_gecko-2.47-x86_64.msi && \
    mkdir -p /usr/share/wine/mono && \
    cd /usr/share/wine/mono  && wget https://dl.winehq.org/wine/wine-mono/4.7.1/wine-mono-4.7.1.msi

# PlayOnLinux
RUN apt-get install -y playonlinux xterm gettext

CMD playonlinux

Command to run PlayOnLinux image:

# folder on host to store settings and installations
mkdir -p ~/winehome
# allow X access for user in container
xhost +SI:localuser:$(id -un)
docker run --rm \
    --env DISPLAY=$DISPLAY \
    --user=$(id -u):$(id -g) \
    --env USER=$(id -un) \
    --volume /tmp/.X11-unix:/tmp/.X11-unix \
    --volume ~/winehome:/home/$(id -un) \
    --env HOME=/home/$(id -un) \
    --ipc=host \
    playonlinuximage


Difference between legitimate file transfer vs data exfiltration of confidential files using FTP I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer confidential file from an organization.
or in other words how would I (as a soc analyst) identify that the ftp server is the server not being used by the company for their data storage but the employee is using that particular ftp server for data storage. And transferring data to that server will be considered as Data Exfiltration.
Please assume you have access to all the logs and you can use those logs for analysis.
I would appreciate if somebody could explain me which logs to consider and what fields are critical in those logs and how?

What you're looking for is the intent of the user at the time they're performing the operation, and that's very hard to determine from logs alone.  Some factors to consider:

What is the volume of data being transferred?
Does the remote endpoint belong to your company, or a partner company?
Has this user conducted transfers of this type in the past, or is the behavior unusual for the user?
Do the files being transferred make sense as a single logical data set?
Have other users connected to that host before?

This is why good analysts are so critical: they can combine the information in the logs with other information available to them.  Information outside the logs that might be useful in this case:

The user's role in the company, and how it relates both to the data being accessed as well as the transfer itself.
The time of day at the user's location.
Any open bugs/tickets/work orders requesting the data transfer.
The duration of employment of the user.

At the end of the day, you need a lot more information to determine the reason for a particular action.  Logs alone are not enough.


Would using an input field for billing data but not storing or posting any of that data be legal? We're building a web application embedded in a desktop application (via CefSharp) so that we can use client-side C# methods based on front-end JS on the website. For example, there is a billing data portal in which users can enter in their billing data (cardholder name, cvv, exp. date, street address, etc.) - now, the input fields for this are online, on the web app, but all of the data is stored locally on the end user's computer. When they click the submit button, the C# desktop app running locally on their computer recognizes it and encrypts then saves the billing data in JSON to a file in their local AppData folder.

This is a "sneaker bot", if you're familiar, that is essentially half-cloud based and half-local, but there does need billing data to be stored in this fashion so that it can be sent to other merchants upon client request, and so we can't use Stripe or Square, for processing transactions, because we aren't processing anything. Also, when this data is sent to other merchants, it is via local scripts, and that data is not transmitted online through our servers.

In short, would using input fields on a live web app to enter in credit card information and billing/shipping information okay if we do not do a post request, store it online, or save it, have billing-related, cookies, and that sort of thing? Would we still need to register as a PCI merchant and do the scans and all of that? Would this count as "handling" data?

Thanks. We know it's a bit of a weird situation. And yes, before you ask, sneaker botting is completely legal, at least in this fashion, although it usually involves somewhat obscure development strategies to weave around the potential necessity for storing card data and things of that nature.

There will be questions about handling of keys and potential client side attacks, etc. The only person who can give you a solid answer is a PCI-DSS QSA who understands enough implementation details to understand the data flows. I'm not a QSA but I've done enough PCI work to have an informed opinion.

My guess is that it does not count as 'handling cardholder data' from the perspective of your infrastructure, since in reality your servers don't see the data encrypted or otherwise (pls correct me if I understood incorrectly).

Also, in my personal view, it's unlikely this would be illegal, but it will have significant ramifications into PCI scoping, depending on how it ends up being implemented.


How can someone determine where a wireless router/SSID originated? Someone hacked my wifi. I beefed up security. They now have renamed their SSID with a derogatory SSID including my apartment number. I want to find where they are so I can confront them. Is that possible?

If you have an Android smartphone or tablet, you can use the WiFi Analyzer app. It has a screen dedicated to detecting the proximity of access points.

Walk around and see where the signal is the strongest.


SSH to IP instead of to fully qualified hostname: does this reduce MITM risk? I am applying configuration management to a VPS hosted by a VPS hosting company. Changing the hosting company is not an option, unfortunately.

This VPS has the following properties:

when newly-imaged or re-imaged, it generates a new, random, SSH public/private key-pair;
neither the VPS hosting company's web interface, nor the VPS hosting company's API, provide a way to replace that key-pair a known key-pair;
neither the VPS hosting company's web interface, nor the VPS hosting company's API, provide a way to obtain that key-pair's public key fingerprint;
the VPS host does not have signed (e.g. DNSSEC) DNS records;
the VPS hosting company's web interface and API do allow the VPS's IP address to be retrieved;
the VPS hosting company's web interface and API do use TLS, and have a valid certificate from a decent CA;
the VPS hosting company's web interface does allow an SSH client's public key to be uploaded, after which each time the VPS is re-imaged it will add that public key to a specified account's .ssh/authorized_keys file.

The first point above is normally a good thing, but coupled with the next two points, it means that it is impossible for the configuration management tool, when it attempts to log in to the VPS via SSH for the first time after the VPS has been re-imaged, to tell for sure whether the connection is being man-in-the-middled. In other words, the configuration management tool can, at best, use the trust-on-first-use ("TOFU") approach.

Normally, I would use a VPS's fully qualified hostname as the VPS's identifier in the configuration management tool, and I would avoid the need for TOFU by separately obtaining the VPS's SSH public key fingerprint out of band (e.g. via a secure API). With this particular VPS, though, the latter step is not possible.

As such, connecting via the fully qualified hostname seems to risk a MITM attack, e.g. via DNS spoofing, exploiting the fact that the configuration management tool would have to TOFU.

It seems to me that the most secure option here would be to fetch the VPS's IP address from the API over HTTPS, and have the configuration management tool SSH to that instead. At least this would avoid the DNS spoofing risk.

(Also, taking advantage of point 7 above will mean that even if a malicious server successfully masquerades as the VPS, at least the malicious server will not obtain the client's password or private key.)

Am I correct about this? Are there other risks, or better solutions, that I am overlooking?

Generally, using the VPS company's API is a good idea, given its proper reliability and also enough resources to implement and maintain that on your side. After all, the SSH key management functionality may be added to said API sooner or later (maybe even upon your feature request, who knows?).

However, DNS cache poisoning alone is, to put it mildly, a rare and complex attack. And in your particular case there's also a rather short attack window (between a VPS is created and assigned a FQDN, and the first attempt to log in), which requires either a perfect timing or an inside knowledge (or both) on an attacker's side. Moreover, virtual servers in most cases are assigned rather random and obscure FQDNs, and an attacker must guess that one, too.

Next, the VPS company's DNS servers most likely retrieve the FQDN of your VPS from a local configuration file or a database of some sort. Assuming that; if your ISP and all the transit ISPs between your resolver and the VPS company's network aren't doing any evil MitM attacks; if you're able to use the VPS company's DNS servers directly to resolve the FQDN of a newly created VPS; then the only place in the network where DNS cache poisoning could be theoretically applied is at your resolver. Therefore, given the nature of the DNS poisoning attack nowadays, it would be rather easy for you to detect and properly mitigate a DNS poisoning attempt.

Also, if your threat model includes attacks of that sort, be aware that Internet routing isn't any safer than DNS. Thus it might be a good idea to set up a dedicated VPS in the same location where all subsequent virtual servers would be allocated, so that the first use of a newly created VPS would be from a machine in the same network segment, eliminating a possibility of hijacking the allocated IP address.

ARP spoofing might also be harmful in roughly the same way, though it heavily depends on the respective virtual network architecture.

Despite all that, as I've pointed out, those attacks are rather hypothetical for an average Internet-facing service. Your mileage may vary; however, I'd better focus on proper monitoring and reporting to ensure that in case anything like that happens, you'll know about that as soon as it's possible.


DataURL Browser Cache Security Implications What are the security implications that come with loading an image in dataURL format <img src="dataURL" />?
After signing into my website the browser loads an image in dataURL format for first time and take a few seconds to load. Later when I come back to the site and attempt to load the same image the image is loaded much faster. I'm assuming this is due to my browser caching the data URL. If this is true, how safe is that image stored in cache?

This depends an what you mean by "secure".
If the provider of the website does not enforce an appropriate cache policy, your data is accessible even after logging out of that service.
Is that a problem? Well it depends. If it's confidential data, yes.
On the other hand, even if the data was not be cached, you could store the data to disk while being logged in and use it later.
Either way you should prevent a third party from accessing any of your data by using encrypted storage (e.g. full disk encryption).


Why digital signatures needs different algorithm Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance related and how?

When you use a mathematical primitive directly, it's often vulnerable to mathematical relationships. The raise-to-the-power-of-$d$-or-$e$-modulo-$n$ operation (sometimes called “textbook RSA” or “plain RSA”) has a simple mathematical structure so it's easy to find some of the transformations it allows. For example, suppose that you know that the signature of message $M_1$ is $S_1$ and the signature of $M_2$ is $S_2$. Then the signature of $M_1 \cdot M_2$ is $S_1 \cdot S_2$, because $S_1 S_2 = M_1^d M_2^d = (M_1 M_2)^d$ (all equalities are $\mod n$). You can forge a signature without knowing the private key. That's bad. And this is just one example.

Constructions such as PSS, and PKCS#1 v1.5 padding before it, avoid this kind of mathematical relationships. They encoded each message in such a way that there is no simple arithmetic transformation between valid encoded messages.  PKCS#1 v1.5 does it by padding the message. For example, it avoids the attack above because $\mathrm{pad}(M_1) \cdot \mathrm{pad}(M_2)$ is not a valid padded message, so $S_1 \cdot S_2$ is not the signature of anything. PSS does it in a more complex way by masking the message and then padding the result.

So between plain RSA and the signature schemes RSASSA-PKCS1-v1_5 and RSASSA-PSS, the difference is security. Plain RSA as a signature schemes has many security holes, whereas RSASSA-PKCS1-v1_5 and RSASSA-PSS are both considered secure today. There are reasons to prefer PSS: v1.5 padding has known problems for encryption and there is a risk that someone will find a way to adapt the attack to signatures. Also v1.5 signature is tricky to implement correctly and even after two decades, some implementations don't get it right; PSS has fewer subtleties.

Between RSA-PSS, DSA and ECDSA, there is no particular security reason to choose one over the other. It mostly comes down to performance and ease of implementation. DSA is slower; it emerged when there were concerns about patents that might apply to RSA, but those patents have expired and DSA is dying out. Most new protocols favor ECDSA (or the newer variant EdDSA). ECDSA keys and signatures are smaller than RSA, which matters on embedded devices and ultra-low-bandwidth communication protocols. ECDSA signature is also significantly faster than RSA signature, but verification is slightly faster with RSA.


Is browsing from a guest VM using an open Hotel WiFi secure? My hotel WiFi has no password. I am using Virtual Box on Linux host with Linux guest. I plan to delete guest Linux VM after browsing.

My main concern is to secure the host OS (Linux) from getting compromised.

Is it safe to use virtual box to browse if I am not worrying about someone seeing what websites I visit or passwords that I enter?

If as you say, you're not worried about someone seeing what websites you visit / passwords you entered, open (without passwords) Hotel WiFi is not a significant factor at all.

In that case, YES. For your main concern, your technique of using disposable VMs for browsing is fairly good security if you are like most people.

It is not enough only if you are targeted by highly resourceful people (like Govt agencies). In that case you should expect that they'll use exploits that escape the guest VM and reach the host VM.


Why was October 2016 Dyn attack limited to East Coast? Maps on the Internet showed that the focus of the Dyn DDoS attack was on the East Coast of the US.  But why?

My DNS provider is not on the East Coast and I am located in Colorado.  My DNS is 8.8.8.8 (Google Public DNS).  Yet when I tried to reach twitter.com, my computer could not resolve the name.

Suppose the DNS TTL expired and Google had to issue a recursive query that landed eventually at Dyn, which perhaps is the authoritative DNS for twitter.  (Is that true?)  And suppose Dyn could not answer.  That still would not explain why the attack would be geographically focused on the East Coast.

Can someone explain?

If we specifically talk about the case of twitter.com; As why site was not accessible from East coast and why it was accessible from rest of the world (roughly).

BGP routes announcement of same IP network from multiple locations and existence of infrastructure at various location is the answer of your query.

On doing the dig for twitter.com from multiple open-resolvers, i got multiple IP address for the said domain but they all belongs to same /24 IP network.

Kansals-MacBook:~ Kansal$ dig twitter.com A +short @4.2.2.4
104.244.42.193
104.244.42.65
Kansals-MacBook:~ Kansal$ dig twitter.com A +short @8.8.8.8
104.244.42.129
104.244.42.65
Kansals-MacBook:~ Kansal$ dig twitter.com A +short
104.244.42.65
104.244.42.193
Kansals-MacBook:~ Kansal$ dig twitter.com A +short @8.20.247.20
104.244.42.129
104.244.42.1
Kansals-MacBook:~ Kansal$

So, twitter site is hosted on 104.244.42.0/24 segment (getting an ip from this segment only from various locations; corner cases may exist).

On doing the WHOIS for this IP segment, i got to know that the following results -

Kansals-MacBook:~ Kansal$ whois 104.244.42.65
NetRange:       104.244.40.0 - 104.244.47.255
CIDR:           104.244.40.0/21
NetName:        TWITTER-NETWORK
NetHandle:      NET-104-244-40-0-1
Parent:         NET104 (NET-104-0-0-0-0)
NetType:        Direct Assignment
OriginAS:       AS13414
Organization:   Twitter Inc. (TWITT)
RegDate:        2014-12-08
Updated:        2014-12-08

This means that 104.244.40.0/21 IP segment belongs to twitter.

Twitter has announce this segment (/21 or /22 or /24) from its various Data Centres (or from co-locations facilities) across the world.
So, when i request for twitter.com, i go to Singapore (as i am getting best routes from Singapore for this particular segment) And when someone tries to access twitter.com from East coast, he may have the best path for the segment from the location which was under DDoS attack.

Because of this announcement possibility of the IP segment from multiple locations and existence of infrastructure across the globe, service was only affected for few (locations which was under attack).

Hope this answers your query.


Is it possible for me to somehow verify that the PGP message blob I just generated contains what I intended for it to contain? I have this text:

Would you mind stopping by the local store and buy some baking soda for tomorrow, Betty-Sue?

Betty-Sue has given me her public PGP key, which I have imported and now use to encrypt the text to a PGP message block.

Alright. Now I have a "PGP MESSAGE BLOCK" with incomprehensible random-looking characters, which allegedly is my text in encrypted form, for that specific key.

How do I know that the text, when decrypted by Betty-Sue, won't say:

haxXed by cooldude92!!! his ip address 123.123.123.123 hostname customers.myisp.com username John Doe his sekurity suxxx duuude lol

? That is, whatever malware installed on my computer has replaced the text I intended to encrypt with that message full of personal information and/or taunting message from the attacker.

I can't verify that my text is inside there because I don't have Betty-Sue's private key -- only her public key! The whole point is that only Betty-Sue (or whoever else has a copy of the private key) can read the message!

Is there some sort of way to verify cryptographically that my plaintext actually is what the encrypted blob will turn into once decrypted by the private key owner?

It always freaks me out when I have encrypted a message and send away that blob, which I cannot read myself but the person on the other end can... I can't know what actually was encrypted. I don't trust my OS, GPG, my hardware or the network...

If you can not trust the machine you have PGP/GnuPG on and you think you might have malware on your system that has access to your Keys and Passphrase (if you signed the message) it's game over. There is no way to recover from that.

What you can do, however, is use PGP/GnuPGs method of adding multiple recipients.

gpg --encrypt --recipient alice@example.com \
--recipient bob@example.com doc.txt

and use your own identity as one of the recipients. This is popular with many email clients with PGP/GnuPG support, because it allows you to view your sent mail.

Since the same message is now encrypted for both recipients, you can veriy what you send before you send it.


Best practices for integrating external javascript? I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com:

<script src='//externalsite.com/js/script.js'></script>

The thing is: if externalsite.com gets hacked, mywebsite.com is at risk. And this JavaScript does not require access to the mywebsite.com content (it is for example a chatbox).

What would be the right way to do it? Is iFrame the way to go?

To clarify, the JS is a virtual assistant that "chats" with the visitor. The externalsite is managing the JS code, and more importantly the dialogs. I'm woried about XSS in the dialogs.

A chain is only as strong as its weakest link.

So make sure you trust your Content Delivery Network (CDN).  I guarantee it is more difficult for a hacker to penetrate Google's servers than yours.  Cloudflare is another example of a security minded CDN.

Mixed content and Insufficient Transport Layer Security can compromise accounts.  Transmitting any page or script over plaintext can lead to a compromise.   A secure source tag would be src=https://,  nothing else should ever be permitted.


What does this "ICAgICAg…" mean in public key certificates and messages? I noticed that the string ICAgICAgICAgICAgICAg, in various repeating lengths, appears fairly often in public key certificates and ciphertexts.

What does this mean? Is it some kind of padding? Is it a quirk of the encryption?

ICAg represents three spaces when text is base64-encoded.

For example:

echo -n '      hello world' | openssl base64

produces:

ICAgICAgaGVsbG8gd29ybGQ=


Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA) I am making a CA that I hope to be able to sign RSA and Elliptic Curve-capable (EC) keys with.  I was wondering if the best approach was:

CA with RSA keys capable of signing RSA and EC CSRs
CA with EC keys capable of signing RSA and EC CSRs
2 CA key sets (one RSA, one EC) each signing CSRs of their respective type
2 separate CAs

I'm using openssl to do this.

Any ideas or recommendations are greatly appreciated, thanks!

In X.509, a CA can use any signature algorithm, regardless of the type of key in the signed certificates. Theoretically, if both the CA and the signed certificate use DSA keys or EC keys, and the two keys share the same group parameters (i.e. work over the same curve, for EC keys), then the designation of the curve might be omitted in the signed certificate. For EC keys, this may save perhaps a dozen bytes, and PKIX (the group responsible for the Internet X.509 Profile) explicitly forbids this "optimization". Hence I confidently state that there is no link between the types of keys in a CA certificate and the certificates that CA issues.

EC support in the existing deployed software based can be described as "flaky". Although X9.62 specifies how to encode parameters for EC keys in quite arbitrary curves, almost everybody implements only a limited set of "known curves", mostly from the 15 curves from FIPS 186-3. Actually, among these 15 curves, only two of them (P-256 and P-384) have non-anecdotic support in existing browsers. These two curves are the "bare minimum" of EC support as per NSA "suite B" (a recommendation from NSA for non-NSA people -- what constitutes "suite A" is not publicly known).

Also, X9.62 defines quite clearly how an ECDSA signature should be computed for every combination of hash function and curve (i.e. how hash values should be truncated or expanded to fit the curve group order). As could be expected, implementers got it wrong, and many believe that with P-256 (respectively P-384) only SHA-256 (respectively SHA-384) may be used. Therefore, if you use any other hash function, you will run in interoperability issues (I mean, more issues than what you will get for merely trying to use an algorithm which was not born in the Disco era).

The bright side is that P-256 with SHA-256 is, security-wise, "fine" (I love that word). The dark side is that even with that most supported combination, you will get into issues with old browsers (and there are places which are quite conservative with regards to updates -- at my workplace, the only allowed browser is IE 7 !). So you need a backup plan. Since the backup should be a whole-RSA PKI (RSA everywhere from the root down to the server and user certificates) for compatibility, and you want to ultimately switch to a whole-EC PKI, then you need two roots, one with RSA and one with EC. You can smooth out transitions to some extent with cross-certificates, but it is a whole can of worms.


Testing Malware in one Virtual Machine which is running side by side along with other Virtual Machines I want to harden the security of my host system and side by side running virtual machines while testing some files for malware in one of the virtual machines.
Here comes a list of questions that I hope you can answer.

- Network Adapters
One thing that I am worried about is the possible spreading of malware from one virtual machine to another. Most of the virtual machines i am executing side by side at the moment are using the same network adapter. Could I somehow minimize the risk by allocating a separate virtual network adapter to the virtual machine I am using for malware testing purposes?

- Separation of Networks
I have read about separating the networks in some other threads.
Could I achieve this by connecting an additional network card to my pc and connect the machine that i use for testing the malware to one of the cards?
Furthermore I have read that one way to achieve separation would be to disconnect the machine from the network.
For my work the internet connection inside all virtual machines and inside the host system is essential at all times so I will have to exclude this possible solution.

- USB Device Drivers
Studying another interesting thread covering the same subject I have come across the claim that a mouse driver could possibly allow a buffer overflow attack.
Here is the link to the addressed thread, the post was created by Tim Williams.

Could somebody please explain if the mousedriver would have to be installed inside the guest system or would it be enough to have it running on the host system to cause the vulnerability?

- Mouse integration
Furthermore I have assimilated the information that the mouse integration (the plugin or option that makes mouse movement from the guest to the host machine flawless) could be a possible vulnerability. Is it really better or even necessary to disable this option to harden the security?

- Separating CPU Cores.
Do I have to worry about the guest VM using the same CPU cores like the host system? Is there a way to allocate for example one CPU core to one VM?

Network questions:
All your network related questions are basically down to the malware been able to talk with other computers on the network to. So, if the other devices outside of your guest machine are vulnerable then you're exposing your whole network. You'll want to have different NATs so they can't talk to your host machine or any other device on your network.

Separating CPU Cores
Yes, you can allocate certain cores and set an execution cap (Though this would depend on what VM software you download.)

How secure is my VM
It is possible for malware which executed inside the guest machine to execute outside of the VM. I'll get you references when I'm at home. So, don't believe because you are running VM that your host machine is secure.


Is there a safe way use a private key from a shared server? I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH.

If I create a new public/private key pair on the remote system and use a strong passphrase for it, would the system admins, who have sudo access, be able to access and use the private key?

In general, I'm not assuming any malicious intent on behalf of the sysadmins, but I know there is always a chance that one of them is less-than-honest. I'd like to know what kind of risk I would be exposing myself to for both the malicious sysadmin and non-malicious cases.

I'm not worried about the admins seeing the contents of my GitHub repository. I'm concerned about them being about to use the private key to impersonate me and wipe our repo or clone other private repositories that aren't already copied onto the server. In other words, would using key authentication expose me to any more risk than I already am?

Considering your explanation:

  I'm not worried about them seeing the contents of my GitHub repository - I'm concerned about them being about to use the private key to impersonate me and wipe our repo or clone other private repositories that aren't already copied onto the server.

You may consider using GitHub feature called read-only deploy key.

In a non-hostile environment you can use SSH agent forwarding, which lets you use the key on your client machine without the need to save it on a springboard server, but this method is exploitable by administrators.

If the machine you use as a springboard is controlled by a malicious admin, there is no way you can fully protect your key or your GitHub account.

Please mind that whatever method of protecting the key you use, the git command (which you might legitimately execute and authorise) could be replaced with a one doing harm.


What is the most unique data identifier for a phone user that cannot be repeated? I'm currently developing an Android (and probably iOS in the future) application for my company.

I was wondering what is the most unique data identifier to authenticate the users. A data that cannot be repeated through users. For example:

Email? That user can log in with another phone using the email and password
Phone number? Could be the most unique one but it would required to verify the phone and I will have to setup a SMS validation service like WhatsApp
IMEI? It pretty much validates the unique phone but it can be spoofed or replaced.
Although I don't know if the application required permissions for this.
Maybe a mix of all this methods?

My main goal is to save this data as a database and make it the primary key of it and with this know exactly who's the user that it's really using the company web services.

It sounds like you've got two problems that you're kinda rolling into one:

Device enrollment -- you need some way to know which user to register this device to, that's where the email or the phone number comes in. A valid user can register any device they want, as long as you can track the device somehow.
Fingerprint the device -- on subsequent logins, know whether it's the same device or a different device.

If you find the right google terms, I'm sure this is a problem that's been solved many times before.

I would assume that most solutions involve planting some kind of unique secret on the device during the enrollment step that can be checked at subsequent logins, like an API key or a client certificate.


Is this INTERNET REGISTRAR email a phishing scam? I am the "acting" IT person (very loose term) for our small company. I received this email yesterday. I am going to ignore it, but I was just curious how this could negatively effect me/us if I replied to it. I did some searching and found a few similar email reports on this, but no good explanations.

There is nothing that will harm you in responding, but you have to realise that this is a scam and they are trying to get you to respond in order to suck you into their trap. When they respond to your reply, they will ask you to open an attachment, send business details including bank info, or other things that will harm you.

When dealing with scams, unless you know what you are doing, it is best not to respond at all else you step onto their slippery slope. Remember, they do this for a living; you're just curious.


How big a vulnerability is phone number theft and how to protect against this? This interesting article in the NYT discusses how attackers are stealing phone numbers of their intended victims by phoning up Verizon, AT&T, etc., giving them a sob story about an emergency and convincing the phone company to transfer the target phone number to the attacker's own device.  Once the transfer of the phone number is complete, they are then using the 'forgot password' functions of digital currency websites to gain control.

My questions are:

The attackers focused on specific people associated with digital currency.  What ways are they likely to have used to get the phone numbers of their targets in the first place?
Was the root problem that these digital currency accounts all had SMS password/account recovery options, such that once the attacker had control of the phone number a simple account reset via SMS allowed them complete control?
Assuming SMS account recovery/reset was the vulnerability here, how widespread is this practice amongst websites?  What else can an attacker do with a captured phone number?
Are there reasonable steps people can take to protect against this scenario?

There's a number of ways that someones number can be acquired by attackers. Perhaps the victim has it, and their email address exposed publically on Facebook, or Skype, or LinkedIn. Or perhaps that data has been leaked in a data breach and then sold and shared by Criminals.

In my opinion, the root problem is that the phone companies employee(s) broke procedure and transfered someones number to another sim without proper authentication. Those procedures are in place for a reason, but the attackers socially engineered the operators into breaking them.

I can't say exactly how widespread the practice of sms recovery is, I believe its fairly widespread, as its nice and easy for an average user. The article mentions Facebook, Twitter, and Google, and I know LastPass does it too. The first three are very big players on the internet, so that suggests it would be a widespread practice as others follow their example.

To avoid it, we can either hope that phone companies change how they work so this becomes impossible (or at least a lot less likely). You can also limit the exposure of your phone number, or have a specific phone number on a pay as you go sim in a 'dumb' phone (an old one like the classic Nokia 3310) that you only use for account recovery. Finally, while this won't be applicable for every website, you could also try enabling alternative methods of account recovery.


RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30) I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and metasploit scanner module to ensure that it is indeed vulnerable to ms17-010.

However, when I run the exploit module, I get this:

I've spent the past hour testing out every single payload available and even tried the other eternalblue modules (which all didn't work). Does anyone know what is denying me from gaining entry to my virtual machine here?
(PS I turned off the Windows Firewall and Windows Defender real-time protection on the win10 machine already)

That module doesn't support Windows 10 targets. You can see from the targets that it supports Windows 7 and Server 2008.
msf6 exploit(windows/smb/ms17_010_eternalblue) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Windows 7 and Server 2008 R2 (x64) All Service Packs

msf6 exploit(windows/smb/ms17_010_eternalblue) >

The ms17_010_eternalblue_win8 module (despite it's name) works on Windows 10. Says it was tested successfully on Windows 10 build 10240 and build 10586 so the build of your target is quite a bit newer but it may work.
FYI, it's a known issue that these modules are separate and targeting is difficult which is why there's an effort to combine them into one.


How is this registration setup vulnerable? I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are not secure, and thus I can't convince them to change their requirements.

Some background; when we implement user registration, there are two options to do so: fill in a mobile number (and trigger an SMS verification) or connect with Facebook. The backend is a RESTful API.

The first flaw is that when we connect with Facebook, they still want the user to create a username and password in the app. The only thing they want to use the Facebook login for is to auto-fill some of the data in the registration form, like the username. This means that the Facebook login is essentially useless since the backend never sees a successful Facebook login token. It still boils down to form-submitted data.

The second flaw is that when we register using our mobile number, they want the password to be filled in after the SMS verification step. So the flow is:

register with a mobile number,
get an SMS verification
supply the password. This means the person who registered their
mobile number is not guaranteed to be the one who is also
supplying the password.

Of course, user login is what you would expect - fill out the username/mobile number and password. Always, even when they registered via Facebook.

My question is, what are some attacks that a hacker could do to take advantage of a registration setup such as this? I intend to use this info to make a more concrete case of why the registration flow should change.

What are some attacks that a hacker could do to take advantage of a registration setup such as this?

Although this will most likely not help you in your case to change the registration flow, the first thing that comes to mind is to abuse the SMS function. Since only a username and a phone number are required this can be used to:

Get the company out of SMS credits (depending on the setup)
Get the company a bad reputation for sending random text messages (in case the company name is used in the SMS message).
In a replay attack this could lead to unnecessary costs.
The company registration flow can be used as a "prank platform".

A better solution would be to have a user enter a username, an email address and get the phone number programmatically (https://stackoverflow.com/questions/2480288/programmatically-obtain-the-phone-number-of-the-android-phone) from within the mobile application.

An email is sent to the given email address with a verification link. When the user clicks the verification link from the email, a password should be set. Make sure that once the password has been set, the registration link is invalidated.

Additionally, the registration link should have a specific life time, e.g. it should expire after X amount of time.


Does GnuPG use symmetric + public key encryption for large files? Recently, I have a need to encrypt few large files. I have the option to use the OpenSSL command line utility, however I prefer to  use GnuPG.

How does GnuPG works under the hood with the --encrypt option?
Does it generate symmetric key first, then it encrypt it with public key?
Or is it only asymmetric encryption, which is heavy on performance?
If it's generating symmetric a key first, which then gets encrypted using the public key later (asymmetric), what algorithm does it use to encrypt data symmetrically?

The encryption method I'm asking about (symmetric + asymmetric encryption) is sometimes refered as "hybrid encryption" or with use of "session key".

I haven't found such information anywhere and digging through code is a pain.

OpenPGP always applies hybrid encryption (no matter how small the file/message is), thus encrypts the message using symmetric encryption and a session key, which again is encrypted using one or more public keys and asymmetric cryptography (once for each recipient). In fact, also symmetric encryption might be used again for the session key, if you also add a passphrase (you can encrypt combining a passphrase and public keys at the same time, such that either a passphrase or the matching private key can decrypt the message).

The (very simplified) structure of an OpenPGP message is more or less

one or more Public-Key Encrypted Session Key Packets (Tag 1) and Symmetric-Key Encrypted Session Key Packets (Tag 3),
followed by a Symmetrically Encrypted Data Packet (Tag 9),
which then contains a Literal Data Packet (Tag 11), often wrapped in a Compressed Data Packet (Tag 8).

There is no difference between encrypting files and messages in OpenPGP, maybe apart from messages not having a filename attached. The packages and algorithms used are the exactly same ones.

Discussing algorithms used is a little bit more complicated and depends on the version of GnuPG, preferences set on the computer encrypting and preferences set by the recipient's key owner. The easy way to determine what's used is to run gpg --list-packets, which provides the full packet structure (reading RFC 4880 helps at understanding the output, and you will learn a lot about how OpenPGP works behind the scenes), often adding one or two -v options is sufficient and provides an easier to read and understand, textual output.


Facebook user data encryption In my country, Austria, a telecommunications data retention law will be executed starting at April 1. Internet carriers are required to store connection data (from which computer to which server), but no actual data payloads, for up to 6 months.

I would like to avoid the government knowing which of the many million Facebook profiles is mine (I'm using a pseudonym as name). AFAIK, SSL encrypts the GET-parameters as well, so my profile id should be safe from storing. Is there any other way the government could find out about my FB profile id, given only the connection data?

If yes, is the only way to keep my profile safe to always use a VPN?

If the ISP is only storing the header data, information letting them know that the connection occurred, when it occurred, how long it was, and how much data was transmitted they can't tie you to a Facebook account based on that information alone.

However, they could subpoena Facebook for any logs they have tied to your IP address and determine your account from there.

If you want to be as anonymous as possible I would recommend giving Tor a try.  It is a project that allows users to bounce their traffic through several nodes located around the world while no single node is capable of determining the source and destination of the traffic.  Specifically try the Tor browser bundle (Google is in friend for finding it).  It provides fairly strong anonymity, but make sure you use SSL still because the node that your traffic goes through to reach the rest of the internet will see it unencrypted if you don't and they have been known to log traffic in the past.

In short, with Tor you can hide (even from your ISP) the fact that your IP address connected to Facebook at some point in time.  Beyond that, theres not much you can do.


Using HTTPS with localhost in production environment Preface: We're running an API back end with JS-framework front end for our website. They will be running on the same box and we have no need for the API to be available via a publicly exposed hostname.

That being said, if we're using this in production, is it superfluous (security-wise) to use TLS for our localhost application? For the sake of being thorough, let's assume that the LAN is not secure. However, we do have a hardware and software firewall on our LAN.

Yes, because localhost traffic doesn't go over the network. There's a special loop back adapter in operating systems that handle requests to 127.0.0.1. Using TLS on localhost would simply add an extra layer of encryption on memory that doesn't ever leave the box.


Is it enough for the server to require TLS 1.1? If we want to ensure that connections use TLS version 1.1 or greater, is it sufficient to set one side of the connection to require TLS version 1.1 or greater or do both sides of the connection need to be set to require TLS version 1.1 or greater?

In other words, if Bob requires TLS 1.1 but Alice will accept TLS 1.0 (or SSL), assuming Eve can intercept the connection request from Alice to Bob, can Eve exploit the weaknesses of TLS 1.0 to obtain information from Alice that would allow her to create a TLS 1.1 connection to Bob?

The client sends to the server its support cipher suites, and the server chooses the highest one in which it supports.

  If we want to ensure that connections use TLS version 1.1 or greater,
  is it sufficient to set one side of the connection to require TLS
  version 1.1 or greater or do both sides of the connection need to be
  set to require TLS version 1.1 or greater?

Ensure the server does not support protocols less than TLS 1.1 and then any connections attempting less than TLS 1.1 will be rejected by the server. But note any clients that do not support TLS 1.1 or higher will be unable to connect at all.

  In other words, if Bob requires TLS 1.1 but Alice will accept TLS 1.0
  (or SSL), assuming Eve can intercept the connection request from Alice
  to Bob, can Eve exploit the weaknesses of TLS 1.0 to obtain
  information from Alice that would allow her to create a TLS 1.1
  connection to Bob?

There are attacks that are called 'downgrade' attacks and they in a nutshell alter the clients cipher suites to trick the server into thinking the client only supports older (weaker) cipher suites and protocols.

Make sure the server does not support weak cipher suites and protocols and therefore the client (or attacker) cannot downgrade a client to a weaker one as the server will reject it as a cipher suite in which it does not support.


Does a searchable public database exist of (hostname; ip) mappings? This question is not about the trivial usage of the forward/reverse DNS.

Getting the IP of a hostname is trivial (DNS), and using reverse DNS, also we can get (typically) a single hostname of an IP.

However, particularly for massive http virtualhosting, there is a (sometimes quite long) list of the hostnames, what resolves to a given IP. This list is not given back by the reverse DNS records (although it would be possible, it is not the practice).

If a possible attacker has access to this list, he can have much more broad attack options, simply because he knows all the virtualhosts on which the target can be accessed.

This database could be collected by large-scale data collection and processing, ideally by using public search engines, or by developing a specified crawler for this task.

Does it exist already?

Yes, there are several services out there that provide (limited) information about domains shared on one or more IP's:

https://www.yougetsignal.com/tools/web-sites-on-web-server/
https://viewdns.info/reversedns/

In case you want to collect data yourself, you could create an account on czds.icann.org and request access to specific zone files. Using those zone files you could create your own database and/or service.


DoS in local network computer I'm using Snort to study detection, and I wanted to simulate a DoS attack from the inside to another computer in my home network, but I have a question.

If I start to flood the target computer with network requests would that only affect the target computer or could I also block the entire network if I send too much packets?

A little background first. As you know, when communicating over a network, programs split raw data into "packets", which as well as this raw data also contain some extra information:

Where does this particular packet fit inside the entire block of data being transmitted?
Who does the packet come from?
To whom does it need to be delivered?

Routers are the physical devices that move packets around, using the above extra information. According to specifications, routing systems are expected to be responsible for two things:

Getting packets to the right place
Not sending packets where they aren't meant to go

That second point is the important one for your question. It means that with the exception of multicast packets, a router only forwards a packet on the route it needs to go through to get to the destination. Other routes shouldn't even know about the existence of the packet.

In theory, if you place a dedicated router between the attacker and the target, the only devices that will notice the load are

the target;
those directly connected to the router (because the router will start dropping packets);
those contacting the target (because they won't receive replies).

And that solves your problem. Now, I'm not saying that all routers will respect this, but it should be how it works.


Is using bcrypt on existing SHA1 hashes good enough when switching password implementation? I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we should switch to bcrypt, and he agreed.

My plan was to just run all the existing hashes through bcrypt and store those in the password field, and then use the following psudo-code to check the password: correctPassword = bcrypt_verify(password, storedHash) or bcrypt_verify(sha1(password), storedHash).

This way, new users, or users who change their passwords will get "real" bcrypt hashes, while existing users won't all have to change their passwords. Are there any disadvantages to doing this? While it would probably be ideal to ask all users to choose a new password, do we lose much in the way of security by doing this?

I was thinking that even if an attacker got access to both the database and the code, cracking won't be substantially faster even if the majority of the "input" to bcrypt was a 40 character hex string, since the slow part (bcrypt_verify()) still has to be invoked for each password attempt on each user.

Actually this is a good way to protect the otherwise unsecurely stored passwords. There is one weak point in this scheme though, which can be overcome easily in marking old hashes, so I would prefer this solution:

if (checkIfDoubleHash(storedHash))
  correctPassword = bcrypt_verify(sha1(password), storedHash)
else
  correctPassword = bcrypt_verify(password, storedHash)

Imagine an attacker getting hold of an old backup. He would see the SHA hashes, and could use them directly as passwords if you test with bcrypt_verify(...) or bcrypt_verify(sha1(...)).

Most bcrypt libraries add a mark of the used algorithm themselves, so it is not a problem if you add your own "double hash mark", but of course you can also use a separate database field for this:

$2y$10$nOUIs5kJ7naTuTFkBy1veuK0kSxUFXfuaOKdOKf9xYT0KKIGSJwFa
 |
 hash-algorithm = 2y = BCrypt


WPA/PSK Dictionaries So i have been reading some articles on WPA/PSK encryption,
And one said that the hash is calculated like this:

  Key = PBKDF2(passphrase, ssid, 4096, 256)

Where PBKDF2 is a standardized method to derive a key from a passphrase.(anyways)

As you see here the key depends on the SSID, so if you have the same password with different SSID the key wouldn't be the same.

So it is not possible to generate (and save) like a rainbow table to WPA/PSK hash like:
hash:plain-text
because the hash would need the SSID and the SSID is different from router to router?

Yes, that's the point. Technically, the parameter which is non-secret but alters the hashing process is called a salt. The salt is as powerful as it is unique; the more unique it is, the more it prevents attackers from doing parallel attacks (precomputed tables such as rainbow tables are a kind of parallel attack, if seen in the proper space-time referential). In WPA/WPA2, the SSID is used as salt on the basis that different WiFi routers will use different SSID.

This is not 100% effective: since each user can choose his SSID, without a global SSID allocation system, some SSID values are widely more popular than others (the default values chosen by manufacturers also lead to high SSID reuse). This site, for instance, reports that as many as 2.357% of all WiFi routers use "linksys" as SSID. This prompted some people to actually compute rainbow tables for these most common SSID and passwords (e.g. there).


File upload functionality - cer format verification While testing file upload functionality in web application, which allows only .cer files, I found out that it is possible to upload a .cer file where at the end of the file, after „-----END CERTIFICATE-----„ it is possible to append data.

Does this mean that the content of the file is not verified correctly, or it is a standard behavior? When I add additional data before „-----END CERTIFICATE-----“ there is an error and I cannot upload the file. Uploading other files like image files with changed extension to .cer is also not possible.

TLDR: 'PEM' format only uses the part between dashed BEGIN and END lines

The so-called PEM format used by lots of crypto software has evolved somewhat over time and isn't entirely standard. RFC7468 (in 2015) documents and describes some of the variations for some data types, including (X.509/PKIX) certificate. I often call this format PEM-style rather than PEM to emphasize the difference.

The core of the PEM-style format was and is that arbitrary (potentially binary) data is base64 encoded, broken into lines, and surrounded by -----BEGIN x---- and -----END x----- lines where x specifies the type of data. (OpenPGP 'armor' is the same except it also adds a base64 checksum.) In its original application to email, PEM needed to and did allow other data before, after and between PEM block(s). In the more recent adaptations of this format, some software does allow such external data and some does not or not always, but when external data is allowed it never affects the PEM object, which is always only the part between BEGIN and END lines; what the software does when external data is present but not allowed is not standard.

Changing anything in the data between the BEGIN and END lines, in a way that is it still valid base64, does change the represented data. An arbitrary change is likely to produce data that is not valid ASN.1 DER, and thus not any certificate at all. A carefully crafted change, including a malicious one, can produce data that is the valid encoding of some certificate, but generally not a valid certificate. Depending on exactly what validation is done this may or may not be detected.

Some (many?) applications that process certificates also accept the DER/binary representation from a file, but I'd expect a web or GUI application is less likely to because binary data generally can't be cut&pasted correctly. These files contain only smatterings of text and cannot be reliably identified, much less validated, by normal tools like cat or more or a text editor.


Ways to Redirect URLs I'm looking for some interesting ways to redirect URLs. For example, http://example.com:@example.org will redirect to example.org. Are there any other ways to redirect/spoof URLs in a browser like that?

Any help is appreciated.

Take a read of the RFC for URLs - it covers all the options including the one you mentioned.


I accidentally entered password for a website as a username for another website First and foremost, I am sorry for posting anonymously for security reasons. Exposing my identity might mean exposing my vulnerability, which comes from the problem decribed below.

I have accounts in websites A1,A2,A3,...etc with password X or derived from X in some pattern.

When registering at website B, I accidentally entered X in the username field. The registration flow was: I entered my email address, I clicked the link in the email they sent, and then they ask a username, which I mistook as a password field. They didn't ask any other information, so right after I entered X as username, I was registered.

The problem is:

X, my password for A1,A2,A3,...etc is stored in plaintext, and
in website B, username is public, which means everybody can see X.

One obvious solution is to change my passwords for A1,A2,A3,...etc. However, it can only be done to websites I remember. I might miss a lot of websites in which I have an account.

Website B doesn't seem to have a mechanism to change username or delete account. I have tried contacting them however there are issues with that:

The technical support claims not to understand my explanation of the problem
There might be some restrictions which prevents them from changing my username or deleting my account.

Is there any possible solution for this?

That sucks. I can't think of any other possible solutions beyond the ones you listed:

1) Keep at the technical support to delete the account (fully delete from all databases). This is probably your cleanest option.

2) Go around changing your password everywhere. I recognize this is a pain, and impractical / impossible for websites that you don't remember having an account on.

The main reason for posting an answer is to highlight your unfortunate situation as a warning to everybody else:

USE A PASSWORD MANAGER!!!!!!!!!!!!!!

This situation would have been completely avoided had you been using a password manager for all your accounts.

Had you pasted a newly-created random password into the account name field, then you go "oops", generate a new random password, and start the account registration over again (or live with a username like huWb9EIaemGZqVsp3aYV).

Even if - for some reason - you don't like random per-account passwords and you revealed a password used by multiple accounts, your password manager is a list of all your accounts, giving you a nice list of which are using that password and need to be cleaned up.

Finally, let's address:

  I have accounts in websites A1,A2,A3,...etc with password X or derived from X in some pattern.

Your situation is a great example of why "a password derived from X in some patterns" is essentially equivalent to "a password X".

I wish people would stop trying to be clever with patterns, and just used properly random passwords. (sure, password managers have usability issues, but they are far less risky than memory-based tricks)


Historical events in terms of risk assessment How can historical events be leveraged in terms of a risk assessment. I know you could for instance look at malware infections over the past x months to perform a better estimation of for your malware infection likelihood and impact (even though you can't actually completely rely on it as there are still uncertainties).

I was wondering if there are more categories or examples where historical events are used to perform a more effective risk assessment?

I'm not sure I fully understand your question or what you mean by categories.

Normally, you start your risk assessment with a basic analysis to identify the risks. You then need to determine the likelihood and consequences for those risks. Any available information can help, both historical and otherwise. The objective is to understand the risk so that you can estimate what both the likelihood and consequence may be.

Historical data which is often relevant includes previous events within the environment, events which have occurred in similar environments for others working in the same or similar field, historical data from insurers, any historical data relating to the identified risk etc.

Historical data is often seen as important for assessing liklihood, but it can also be important for assessing consequences. For example, historical data from insurers regarding factory fires may tell you that in 80% of cases, factory fires result in 60% of the building and plant infrastructure being destroyed - this can help assess the likely consequence should a fire occur in your factory, which in turn helps identify the potential loss, which in turn helps identify what level of controls are appropriate and associated investment etc.

Similarly, historical data on the number of small businesses which survive a major data breach can tell you what the consequences are likely to be or historical data on the frequency of such breaches in business with fewer than X employees could hlep assess the likelihood.

If the historical data can help assess likelihood or consequence, then it is of value. If it can't then perhaps it isn't. However, more often than not, the limitation is not with the data, but with the ability of the person doing the assessment to see how the data can be of value.


How to stop the "mitmf" tool on my home network? Okay, so I am basically an electronics student so  I have limited knowledge on the subject. So please help me out here.

The thing is that one day, as I was browsing, I opened up Google and instead of the Google logo, a "You have been hacked" image came up. I share a flat with 5 people and one of my flatmates came up and told me that he had performed an "Image replacement" attack or something. He didn't tell me how he did it. I did some research and stumbled upon the mitmf's GitHub page. I was quite impressed with the capabilities of the tool. However, the question here is, how do I protect my computer against the attack? My flatmate and I are on the same network (using our home router). We have a broadband connection. How do I protect myself from this tool?

Also, please inform me whether it is possible to install viruses on my machine via this tool? I also saw that this tool (mitmf) has screenshot and keylogger capabilities. In that case, will my anti virus detect these? And will the screenshot and keylogging work one the attacker's machine is turned off (Meaning can he still receive my screenshots and keystrokes even after he disconnects from the network)?

NB: I know that he won't use this tool to cause any harm to me, but one can never be too cautious. Please help me out here.

EDIT: I am looking to prevent all kinds of attacks that this tool can do, not just the keylogging and screenshot attacks in particular.

The type of attacks you can suffer from depends to what your flatmate has access.

Understanding the attack

There are a couple of ways that your flatmate could have pulled this attack and understanding them will help you to understand how to protect yourself.

Google usually use https for its pages. This usually means that your flatmate can't do MitM attack on your communication with google and if they do your browser will give you a big scary warning warn you that your communication was tampered.

The first way to counter the https protection is to remove the https by redirecting to http. We call this attack ssl stripping. By doing that, he can now modify anything on the page and your browser will not give you any warning, except that the address will be in http instead of https.

The second way to counter https is to counter https is to install a CA certificate on your computer. Your browser is able to warn you when someone
tamper with a secure connection because of the CA certificates. If your flatmate, is able to access your computer and install CA certificates, he
can tamper any and every of your connections and your browser won't give you any warning. The address will even be in https. You can sometimes
detect this type of attack by looking at the certificate that is encrypting the current connection. Right click on the padlock in the address bar
and look for the certificate information. If you are on google.com but the certificate is issued by "flatmate", then you have a problem.

Also, with physical access his possibility are limitless. For example, the easiest way for me to do this attack would be to install a custom made browser extension on your computer.

Restrict his physical access

You need to restrict the physical access of your flatmate to your computer. If you can lock your door, do it. Then you need to make sure
your computer is protected with a good password. It's the first step.

In the previous section, I talked how your flatmate could install CA certificate if he had access to your computer but this is just the tip of the
iceberg. If he has physical acccess, he can install any type of malicious software.

Your system might already be compromised

There are good chances that he installed something on your computer. In this case, you need to do a fresh install. Antivirus won't help you here.

The router / modem is compromised

You can probably assume that he has complete control over the router/modem. This means that anything that you access from the internet need to be
encrypted or he can tamper it. Using extension like httpseverywhere can help or you could also use a secure VPN.


Security tokens for external exposure: UUID or HMAC/JWT/hash? I'm build the backend for a web app. When a new user goes to the site and clicks the Sign Up button, they'll fill out a super simple form asking them for their username + password and they'll submit. This prompts the server to send a verification email to that email address. They'll then check their email, click a link (which verifies their email) and then be routed to the login page so they can sign in if they choose.

In order to verify their email, when the server generates the email it will need to create (and store) a verification token (likely a UUID) and attach it to this link in the email, so that the link looks something like:

  "https://api.myapp.example.com/v1/users/verify?vt=12345"

Where vt=12345 is the "verification token" (again likely a UUID). So the user clicks this link and my GET v1/users/verify endpoint looks at the token, somehow confirms its valid, and makes some DB updates to "activate" the user. They can now log in.

Similar scenarios for when a user wants to unsubscribe from receiving email, or when they can't remember their password and need to recover it so that they can log in.

Unsubscribe

User wants to stop receiving emails but still wants to use the app. They click an "Unsubscribe" link in a weekly newsletter we send them. This link needs to contain some kind of similar "unsubscribe token" that, like the verification token above, is generated + stored on the server, and is used to authenticate the user's request to unsubscribe from email.

Recover Password

Here the user has forgotten their password and needs to recover it. So at the login screen they click the "Forgot my password" link, and are presented with a form where they must fill out their email address. Server sends an email to that address. They check this email and it contains a link to a form where they can enter their new password. This link needs to contain a "reset password token" that -- like the verification token above -- is generated + stored on the server, and is used to authenticate the user's request to change their password.

So here we have three very similar problems to solve, all requiring the use of what I'm calling "one-time only (OTO) security tokens". These OTO tokens:

Must be generated server-side and persisted (maybe to a security_tokens table)
Must be something that can be attached to links that we'll expose from inside of emails
Must only be valid one time: once they click it, the token is "used" and cannot be reused

My question

The solution I came up was simple...almost too simple.

For the tokens I am just generating random UUIDs (36-char) and storing them to a security_tokens table that has the following fields:

[security_tokens]
---
id (PK)
user_id (FK to [users] table)
token (the token itself)
status (UNCLAIMED or CLAIMED)
generated_on (DATETIME when created)

When the server creates them they are "UNCLAIMED". When the user clicks a link inside the table they are "CLAIMED". A background worker job will run periodically to clean up any CLAIMED tokens or to delte any UNCLAIMED tokens that have "expired" (based on their generated_on fields). The app will also ignore any tokens that have been previously CLAIMED (and have just not yet been cleaned up).

I think this solution would work, but I'm not a super security guy and I'm worried that this approach:

Possibly leaves my app open to some type of attack/exploit; and
Possibly reinvents the wheel when some other solution might work just as well

Like for the 2nd one above I'm wondering if I should be using a hash/HMAC/JWT-related mechanism instead of a dead simple UUID. Maybe there's some smart crypto/security folks who found a way to make these tokens contain CLAIM status and expiration date themselves in a secure/immutable fashion, etc.

I see a few concerns with what you've described:

Depending on how you generate the UUIDs, they may not be all that unpredictable -- they're not cryptographically strong tokens.
You do not describe a "purpose" in your security_tokens table, which might (depending on your code) allow someone to use a token for a different purpose than was intended.
Your system requires a lot of database traffic -- this might or might not be a problem, depending on the amount of traffic you anticipate receiving.

An alternative solution would be to use (for example) JWT and include in the signed data:

The user ID for which it is valid.
The purpose for which it is valid.

JWT itself provides the functionality for managing expirations.  Note that this does generate tokens that can be 'double spent', but if they are for validating emails or unsubscribing, that is not a problem.  (Is validating the same email twice a concern?)

For these tokens, all you need is a secret stored on the application server, and it incurs no additional database writes to either generate or spend the tokens.  (Which, again, is an issue of scaling, so may or may not apply to your application.)


Sending Digital Certificates I used the makecert tool in order to create:

a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate

I then installed the self-signed certificate in the Trusted Certificate Authorities section in mmc.

The server certificate and the client certificate were installed in the Personal section in mmc.

I then deployed a web service in IIS as HTTP using the server certificate.

I then have another application which makes use of the web service.  It sends the client certificate with the web service request, as shown below:

public static void Main(string[] args)
        {
            X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
            store.Open(OpenFlags.ReadOnly);
            X509Certificate2Collection col = store.Certificates.Find(X509FindType.FindBySubjectName, "client.com", true);

            if (col.Count == 1)
            {
                ServicePointManager.Expect100Continue = true;
                ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls;

                ClientServices web_service = new ClientServices();
                web_service.ClientCertificates.Add(col[0]);

                try
                {
                    string check = web_service.CheckCertificate();

                    Console.WriteLine(check);
                }
                catch (WebException e)
                {
                    Console.WriteLine(e.Message.ToString());
                }
            }

            else
            {
                Console.WriteLine("The certificate was not found!");
            }
            Console.ReadKey();
        }

On the server-side, I am checking for the client certificate like this:

[WebMethod]
        public string CheckCertificate()
        {
            string message;

            try
            {
                X509Certificate2 cert = new X509Certificate2(Context.Request.ClientCertificate.Certificate);

                if (cert != null)
                {
                    message = cert.SerialNumber.ToString();
                }

                else
                {
                    message = "Error: No certificate was found!";
                }
            }
            catch (Exception e)
            {
                message = e.Message.ToString();
            }
            return message;
        }

Whenever I run the client app, I am getting the following error message:

The request was aborted. Could not create SSL/TLS secure channel.

How can I solve this problem please?  I have been stuck on this for two days so any help would be immensely appreciated.

I solved the problem.  I installed the WinHttpCertCfg tool and granted access to the private key.  The command that worked for me is:

WinHttpCertCfg.exe -g -c LOCAL_MACHINE\MY -s "" -a EVERYONE


I accidentally published my SSH key passphrase, what to do? So I mistook input fields and now my SSH key passphrase is visible to the world, and I can't even remove it.

Now as far as I understand, this is not an immediate security concern, since the passphrase only protects against the case of my private key itself getting disclosed. Since that hasn't happened (they key only exists on hardware I own), I at most have to change the passphrase in case it happens in the future, I don't have to change to a different SSH key everywhere I've used it.

Is that correct? Keeping in mind that all of this is for private projects and a hypothetical breach could at most be annoying and embarassing.

Technically, changing your passphrase is sufficient if you don't also believe that your (password-protected) private key has also been leaked.

Realistically, you might just want to replace your SSH key with a new one.  They're so cheap they might as well be free, and it removes you from worrying about whether anyone has, is, or will be able to get a copy of the private key with the compromised passphrase.  Remember, if somebody grabs a copy of your key that you backed up months before you leaked (and changed) your passphrase, the passphrase still gives them access to that key - which is the same as you're using today under a new passphrase.

So just change your key.  It's good practice and best practices.

Edit:

@David-Z has suggested that the time involved in replacing the key is a cost to be considered.  I maintain that, since we're talking about keys, that's also negligible, as you can automate the process.  The following script took me about 15 minutes to write and test:

#!/bin/bash

for i in $*
do
    cat newkey.pub | ssh -i oldkey username@$i "cat >> ~/.ssh/authorized_keys"
    ssh -i newkey username@$i "sed -n '/my_old_key/!p' < ~/.ssh/authorized_keys > ~/.ssh/authorized_keys_tmp && mv ~/.ssh/authorized_keys_tmp ~/.ssh/authorized_keys"
    if [ $? -eq 0 ]; then
       echo "Successful key replacement for $i"
    else
       echo "Key replacement failed for $i"
    fi
done

This script will:

Use the old key to append the new key to the remote authorized_keys
Use the new key to remove the old key from the remote authorized_keys

The beauty is that if anything went wrong pushing the new key out, the removal of the old key will fail since it uses the new key, so you're less likely to shoot yourself in the foot.

You'll need to cache your passphrases with ssh-agent so that it doesn't prompt you for these uses of ssh; then just run it with the servers you want to update on the command line:

$ ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-GWE6uxZxn9IS/agent.2016; export SSH_AUTH_SOCK;
SSH_AGENT_PID=2017; export SSH_AGENT_PID;
echo Agent pid 2017;
$ ssh-add oldkey
Enter passphrase for oldkey:
Identity added: oldkey (oldkey)
$ ssh-add newkey
Enter passphrase for newkey:
Identity added: newkey (newkey)
$ ./chssh.sh server1 server2 server3
Successful key replacement for server1
Successful key replacement for server2
Successful key replacement for server3
$


Programatically encrypt data on Windows using login I have a user giving me a password that I need to save for automation they want to have me run. I can't use their existing credentials as it's not something Windows talks to.

And I don't want to store their password in plain text. And any encryption I do in my app (it's a desktop app) can be undone by tracing through the program.

I believe (but can't find it) that there's a way to encrypt a string and Windows encrypts it using the logged in credentials. That way the password is only readable if the user is logged in.

Is this the best way to handle this situation?

And if so, can you please point me to a page that says how to do this?

thanks - dave

DPApi will apply using the current user context - so if code can execute in the same context an attacker could access the credentials. A simple powershell script run on the machine while in the same context can decrypt the contents with a single command.

Its hard to determine the best approach without knowing more about your environment.

Will the automation be running under a service account?
Can you use MSA?
Are certificates an option?
Can you store these credentials in a secure store?

Sorry a lot more questions than answers - I would use DPApi if writting a desktop application that needs to secure data on a multi user system.
Chrome for example uses this to secure cookies - I don't know if I would use it in an automated process if its running under your own user account.


Should I report this Google API key disclosure issue or not? I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to:

https://www.googleapis.com/customsearch/v1/siterestrict

I also found their Google API key value inside that javascript file. I was able to access their personal CSE Google API. Is this something I should report to the company? I'm not sure if this could count as a valid issue or not.

There is potentially really an issue here, but it is unlikely. Including their Google API key value inside JavaScript is how it is done. Yes you can bypass their search function and query the Google API directly, but to what end? The API will have its own validation that will limit what you can do. Are you able to gain more info than what was already available to you on the website? If so, then it is an "information Disclosure" vulnerability, if not then is it really a vulnerability?


Will changing the TLS Diffie-Hellman key exchange bit length from 1024 to 2048 cause client/browser compatibility issues? Recently discovered the need to upgrade our DH key exchange length (used for TLS) from 1024 bits to 2048 bits (due to Logjam exploit and other factors). The question is: How will making that change affect client compatibility? Is there an official list of OS's/browsers that can support 2048-bit crypto for key exchange when using TLS? I've only seen mutterings about older client versions of Java (

Modern browsers will be perfectly happy accepting 2048-bit DH moduli. You can verify that your site's TLS configuration is compatible with popular browsers by using SSLTest. Only (very) outdated versions of Java tend to have problems with DH moduli larger than 1024 bits.


How can I verify that the logged-in user is actually the person who owns the account? I am trying to design a little tournament for an existing online game. I have no access to their game accounts, I can only add them inside the game and chat. I will create a web service with profiles for the tournament. How can I prevent the players from cheating by sharing their account information and having a better player play for them?

Solutions (?)

Physical place: Make the tournament in a physical location where the players will be all together. This have obvious difficulties.
SMS or Email code: I can send a code to the user and he will have to give it to me through the chat. But in this case he can just send this code to the person who is using his account.
Sound authentication: I can speak with the player using skype or some other VoIP service and make sure it is him, but again, I can speak with the player and someone else could still be using his account.

Is there any real solution for this?

If you have no ability to see IP addresses and the computer name, then you either need an external service/program that can expose that information to you so you can verify it is the same machine, or your best bet is renting a conference room or similar and hosting it at a physical location. That route is better anyways because you can set up your own LAN and ensure that latency between players remains low and no one has a heavy advantage of latency and you know someone else is not sitting at their computer.


How dangerous is reflected request query strings? I have discovered a possible security flaw in a login for a site that many people rely on. I won't say the site but in the URL there is something similar to

/Success?message=Success+please+wait+a+bit+for+results

/Failure?message=Failure+Please+try+again

I know all about XSS, and you can't get JavaScript to be embedded even with trickery, but it still prints what you put in the message query.

I think this could possibly be used in social engineering attacks

How dangerous is this? (it CAN be hot-linked)

You can host all the phishing emails there. For example:

  We have detected suspicious behavior on your account. All furthur login requests will be denied. Please use the alternative login form at http://example.com/ to do a secure log in and unlock your account.


What are spambots doing with unintelligible login attempts? After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the info they tried, their IP address, whether they're blacklisted, etc. Of those that are from spam bots, the login info I see from these spammers are garbled username and password, like these:

[username] => BKujXjbL
[password] => 2454HIYQYH

[username] => Antiretewssar
[password] => 4xi82JfkbS

[username] => a
[password] => CKNSC58E3U

My question is, why would spam bots try username/password combo that no humans would create? I feel trying something like smith/123456 has a much better chance of a successful login on a given site. At first I thought these are some "secret code" that can bypass the login script, but I quickly realized that there's no such thing as a login bypassing code. Or are they doing something other than cracking password?

*Update (2/10/2014) *

I've been getting around 15 failed login attempts everyday from these bots. Some of these usernames are real usernames (eg. Danielbold), some contain brand names (eg. in my case, for an originally-Australia-based winter shoes), and the rest are likely non-human usernames (eg. bnCwVFmIWbweQJr). All passwords are still unintelligible, possibly hashed passwords truncated to 10 characters. It was interesting to see an attempt to use identical username/password combo (Astectton/kea85aXe8W) on 2 separate occasions, so these combos should be from a certain database and not randomly generated on the spot. It's interesting to see that these similar attempts come in from different places: US, Canada, Netherlands, China, etc., suggesting it's a very common bot code that many hackers(?) use.

It's also really interesting that no one else has encountered the same problem.

These logins might be the result of spambots outwitting each other. This scenario doesn't seem that implausible to me:

Webmaster sets up a web forum for testing purpose
Webmaster forgets that he even did and lets it keep running on some forgotten webspace
SpambotA finds the forum, and decides to have some fun with it. It creates tons of accounts with random names and passwords and posts spam search engine optimization.
A critical security flaw in the forum software is discovered which allows to read usernames and passwords from the database. Webmasters are urged to install the patch ASAP, but our webmaster doesn't care.
SpambotB comes around, hacks the forum using that vulnerability and gets the login data
Not noticing that these aren't legitimate logins, SpambotB tries the same username and password combos on another forum, because people tend to use the same usernames and passwords on different websites.


Harden root remote access I'm trying to find a good method for hardening a server while allowing automated remote management via ssh (ansible).

The popular choice is login with a normal user and then use sudo, but this has some problems:

Passwordless sudo: this is a no-no. It's just as if you allowed
direct login to root.
Sudo with password in a file somewhere. Don't like the idea, writing the password in a file opens a world of possible attacks.

Then I've seen some people suggest allow root login via ssh but only from localhost. At first sight this seems like a good idea but after a bit of thinking it's not a good one. Once an attacker gets into any account in the machine s/he can attack root's ssh as if doing it remotely. It's like putting a second lock on a security door. It will take longer for the attacker to break it but it won't be any harder.

It can even make it easier because the attack surface is greater. If using SSH Agent Forwarding to enter root via a normal user, an attacker could modify the user's login scripts to use the forwarded authentication to gain root and then restore the login scripts and clean up the logs so the user has no clue to what has happened.

What would you suggest?

I would use a Match block in the sshd_config file to only permit direct root login from the machine(s) used for remote management. If those machine are on the same local network, IP spoofing should not be possible (at least from a remote machine). Something like

Match Host my.admin.machine
    PermitRootLogin prohibit-password

That way, root login is normaly denied from any machine other than my.admin.machine, and simple password login is not allowed from there (only key).


Mitigating the loss of a mobile phone used for second-factor login Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile application as the second factor authentication for login. John loses his mobile phone and as such is unable to log into GMail as he does not know his password. John is also unable to login to LastPass as while he knows the master password, he does not have the second factor, nor is he able to disable the second factor as he does not have access to his email account. John is now locked out of his accounts.

Current solutions that John may have made use of to stop the loss of account access due to the lack of his second factor device include setting up mitigations such as:

Backup codes/Master code
SMS/Phone Call
Alternative Email

However, the viability of these solutions vary on many factors.

While the above scenario is specific, I ask generally what can be done to mitigate the effects of losing a mobile phone used as a second-factor device?

What I can say, generally, is that you should not have a single point of failure. Be it your mobile phone (can be lost, damaged, stolen), some other computer or device (can be damaged), a piece of paper (can be lost, damaged) or even your memory (can forget things, especially if not used too often).

Just like passwords usually have fallbacks for recovery (ex.: having a password reset link sent to an alternate e-mail address), your 2nd factor authentication should also do the same, and if there's nothing built-in you'll have to make your own. Easier said than done, true, since every additional "step" solves one problem but introduces a new one (ex.: if I forget my e-mail password, I can reset it using an alternate one, but now I also need a fallback for my alternate e-mail password).

Your problem, IMHO, is that you created a "closed loop" in your fallback strategy: to access your e-mail you need your password manager, and to recover access to your password manager you need your e-mail. When planning the recovery of LastPass, you can't count on things that are dependent on having access to LastPass...

I don't think there's a one-size-fits-all solution to mitigate this problem, and all your suggestions are valid ones depending on the circumstances. Personally, here's how I protect my GMail account (I don't use password managers yet, so the e-mail password is commited to my memory):

My personal (desktop) computer is marked as "trusted", so it doesn't require codes and only asks for my password once in a while (each 30 days, I think);
My Android device has Google Authenticator, but to open it (or to open the GMail app itself, for that matter - or the whole 2-factor thing would be pretty pointless...) I need to provide a PIN for an App Blocker (so even if someone gains access to my phone he can't read my e-mail).
There's an alternate phone number registered, so an SMS can be sent to it if I can't use mine.

That protects me from most "catastrophic" scenarios:

If I forget my password and my phone is lost at the same time, I can still access GMail from my desktop (recovering administrative access is a bit trickier).
If I forget my password and my desktop is broken at the same time, I can still access GMail from my phone (assuming I can still remember the PIN - something I use often).
If my desktop is broken and my phone lost at the same time, I can still use my password and the SMS to the alternate phone to access GMail from another machine.

While retaining the 2-factor property at all levels:

To access my desktop, I need physical access to it and my login credentials;
To access my phone, I need physical access to it and my PIN;
To access my e-mail from somewhere else, I need physical access to a phone (either primary or alternate) and my password.

(Note: strictly speaking, only physical access is required in the first two cases, if a skillful and silent/quick attacker is involved, but that's beyond the scope of this answer)


What stops Google from saving all the information on my computer through Google Chrome? I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the file path.

What processes and systems are in place so that Google is not able to copy data stored on my computer? What processes and systems are in place so that someone who writes a Chrome extension is not able to copy files stored on my computer?

What processes and systems are in place so that Google is not able to copy the data on my computer?

None. Google Chrome usually runs with the permissions of your user account. The application can then read and modify local files to the same extent your user account can. (These permissions apply to most of the programs you're using.) So you need to trust Google in that they don't ship a malicious update that spies on you, or keep sensitive files inaccessible to the account you're running the browser with. Alternatively, there are most likely sandbox implementations for your OS that let you run Chrome in an isolated environment with restricted access to the filesystem.

  What processes and systems are in place so that someone who writes a Chrome extension is not able to copy files on my computer?

Chrome extensions have limited privileges by default. An extension needs to explicitly request (declare) a permission to interact with documents on the file:// scheme.

Also note that your browser disallows ordinary websites to read or even redirect to file:// URIs. So while your local files are accessible to the Chrome process, they are not exposed to the web.


Simple way to protect ssh against man-in-the-middle attack? If a narrow, trusted channel is needed (for example, there is an usb key to take data between the machines), it is okay.

Although SSH will throw a big error if it tries to connect to a server pretending to be another one (RSA fingerprint wont match), it can't happen if the servers don't know eachother (also they don't know eachothers key as well). In this case - also before the first connection - a MitM attack is possible, AFAIK.

The best were a command sequence on both side, which generates the needed keys on both sides.

If the servers do not know each other then every connection is in theory unsecured. You can have a list of known servers, distribute it in your environment and prevent users from establishing connection with unknown servers.

To further protect yourself, you can add the server's fingerprint to DNS record require additional verification during connection. See this tutorial for an example.