How to secure my network, laptop, ipad and email accounts which are possibly hacked? Background

Last month I noticed lots of failed emails in my inbox and after few minutes I lost my access to my Yahoo Mail. My friends informed me that they have received spam emails from me.

So I called Yahoo customer care and they helped restore/reset my password and I then made a very strong password.

I was at peace until last night when I noticed that there was a new failed email and today another one! So I called again and they connected to my laptop and scanned my both Yahoo and Gmail accounts. They told me that someone had gained access to all my email accounts and network and the hacker knows my IP address and can also access your pictures and your laptop...

They then offered me a software solution for the price of $280 to secure my network for against future hackers, but I'm not sure if it really helps!

Question

What I would like to know is:

Is there anyway to know how much of my data was exposed? Or stolen?
Can I know if they really got my pictures? Or anything else?
Is there anyway to secure my network? Or do I have to close my email
accounts and change my laptop?

I really need an expert's help.
Thanks in advance....

Is there any way to know how much of my data was exposed? Or stolen? Can I know if they really got my pictures? Or anything else?

  This will depend on your operating system and what behaviour gets
  logged automatically. That you knew that you were hacked indicates the
  hacker wasn't covering their tracks very well.

  Still, most service accounts when someone logs in will provide carte
  blanche access to all assets. So if a specific account was breached -
  assume they took everything. Otherwise it will depend on how much security logging the computer or online web service did and whether
  anyone will want to check these often cryptic audit logs for free.

Is there anyway to secure my network?

  Yes. Many ways to secure a network. Too many list here. But you can start with this guide.

Or do I have to close my email accounts and change my laptop?

  No - you don't need to close your accounts or sell your laptop. But you do need to reconfigure your accounts and laptop.

  For your computer

  Install malware/virus scanner and check that no corrupt apps exist
  on your laptop. You need to do this first to ensure no corrupted
  backup tool re-injects viruses/trojans.
  Restore your computer from a full backup prior to the breach date
  (if known); or if no full backup available: Backup everything
  except applications or anything that executes code; then factory wipe/reinstall your laptop to the original clean operating system
  and then reinstall applications from clean read-only or internet
  sources. Then restore backed up data.
  Install a decent firewall and anti-virus solution.
  (Optional) Request your ISP to provide a different static or
  sticky-dynamic IP for your computer so that the prior attacker can't
  easy find you any more. This can be useful if they were targeting your
  computer specifically

  For online services (email, gaming, forums, digital storage, social
  networking, etc). Assumes that you do this from an uncorrupted computer:

  Get a good strong password manager.
  Log into each breached account (if you can; otherwise contact the
  provider)
  Change the password with one generated by the password manager.
  Longer is better, and never use the same password on two different
  sites.
  Change any secret security questions if you can. Opt for nonsense questions or answer if you can. e.g. Q: What is your mother's maiden
  name? A: E-S-V-F-H-N
  Check that your email address for the account hasn't been changed.
  As many services send password reset links to your account's email
  address.
  Check for any tweaked or altered security settings, such as
  authorised third-party apps, client certificates, public keys, email
  forwarding, account visibility/privacy settings.

This can be tedious, so it is up to you whether you wish to do this yourself or pay an expert to do it. If the time and materials (money) for doing this exceeds the cost of a new laptop and porting content across, then you could resort to truly clean slate of new equipment.


What are the security risks of using downloadable email vs. remote/online email? The organization at which I work wants us to download our e-mails rather than use a remote/online service like gmail.  I have argued that this is less secure because downloading the e-mails brings the text and any attachments behind our firewall.  I am fairly certain they are requiring this not for IT security reasons, but to try and save money (i.e., our current online e-mail allocation is only 1 GB, which is rather small when you routinely send 10+ MB papers to/from colleagues).

So is it more or less dangerous to use an e-mail client where one downloads the e-mails to their personal computer than an online e-mail client (e.g., gmail)?

Both approaches have their own risks: If you have your mail remote then you fully depend on the security provided by the external provider. If you host it locally it is more under your control. Which is more better depends an what you and what the provider are able and willing to do regarding security but the provider is definitely the more lucrative target for an attacker and thus needs to have better protection.

Apart from this general statement I could think of several particular problems:

With web mail the provider has to deal with the usual than you you are open to all the web based risks, like CSRF, XSS, session hijacking etc. That risk does not exist when stand alone mail clients are used.
If the mail is stored permanently at an external provider you risk that this provider gets hacked and all mails (with confidential company data) get exposed.
If your company has full control of incoming (IMAP, POP) and outgoing (SMTP) mails it makes filtering much easier. This includes filtering for malware, phishing and spam, restriction who can send, detection of data leakage etc. On the other hand a good external provider might offer better protection than a cheap in-house solution.


Unknown encryption string I'm trying to learn about encryption and decryption methods when I faced this string:

{MD5}JfnnlDI7RTiF9RgfG2JNCw==

MD5 is 16-byte string, so anyone know what type of encryption is this and why there is "{MD5}" ??

It was a fun exercise for me, so +1 for the question.

The {MD5} part indicates that the string after it is an MD5 hash. As you can see by the trailing ==, that means the string has been encoded with Base64. By Base64-decoding it, you get the following in binary

00100101 11111001 11100111 10010100 00110010 00111011 01000101 00111000 10000101 11110101 00011000 00011111 00011011 01100010 01001101 00001011

By converting that binary to HEX, you get:

25 f9 e7 94 32 3b 45 38 85 f5 18 1f 1b 62 4d 0b

Remove the spaces and you get

25f9e794323b453885f5181f1b624d0b

Finally run it through an MD5 rainbow table service (I used md5rainbow.com) and you get the original text:

123456789


Example of a double-free vulnerability in C I hope this is the correct forum to ask for the question that I have:
We are currently discussing double-free vulnerabilities in our software security class, which is why I know the code given below is suppossed to be an example of how a double-free can be exploited. Now, I am trying to understand this example and I hope that somebody here can help me with this.

The first thing done in this code is a definition of a struct auth. We use this struct by defining a pointer to such a struct:
struct auth *auth;

Ok. I think a vulnerability can only be where malloc or free have been used. But what could possibly be exploited in this specific code? I don't see it. I remember from class that the problem with applying free to the same pointer twice is, that now the chunk's forward- and backward pointer are pointing to this very same chunk that they themselves are stored in. That's about where my knowledge ends.

I would be so glad to find someone here, who might help!

struct auth {
  char name[32];
  int auth;
};

struct auth *auth;
char *service;

int main(int argc, char **argv)
{
  char line[128];

  while(1) {
      printf("[ auth = %p, service = %p ]\n", auth, service);

      if(fgets(line, sizeof(line), stdin) == NULL) break;

      if(strncmp(line, "auth ", 5) == 0) {
          auth = malloc(sizeof(struct auth));
          memset(auth, 0, sizeof(struct auth));
          if(strlen(line + 5) < 31) {
              strcpy(auth->name, line + 5);
          }
      }
      if(strncmp(line, "reset", 5) == 0) {
          free(auth);
      }
      if(strncmp(line, "service ", 7) == 0) {
          service = strdup(line + 8);
      }
      if(strncmp(line, "login", 5) == 0) {
          if(auth->auth) {
              printf("you have logged in already!\n");
          } else {
              printf("please enter your password\n");
          }
      }
  }
}

Small Edit: With the answers given to the post, I came up with a solution. Simply type the following lines:

auth me
reset
service AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
login

The input written after service is 36 characters. Now, what is happenning in this program? auth me allocates 36 Bytes of memory on the heap. reset frees this memory, however it is not set to NULL. Now service again allocates 36 Bytes of memory on the heap. It is very likely that the same memory that was allocated before by auth will be allocated. In this memory we can still find the name me. This is written in the last 4 Bytes of this memory area.

That code have some issues that you should correct.

If the user types "reset" the first time, you have a free of something that you didn't allocate, also the pointer should be initialize to null to help (auth = NULL)
If the user types "login" the first time, your code will generate a SIGSEV on auth->auth, you didn't allocated auth properly.
on the call malloc you should verify that the return value is not null.

There are more issues on the code, but are more related to bad programing practices than a security related from my point of view


Bank accepts different password to the one that I set I'm not particularly well versed in IT security so please bear with me.

I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of random characters. So for example, if my password is "password", it will accept things like "password1" or "password43435". I'm fairly sure this shouldn't happen with any sort of hashing + salt method, or even a string comparison. It's making me worried that it's just horribly insecure, so I'm wondering if there's any secure method for storing passwords that allows things like this to happen. And if not, can anyone explain how things like this happen?

Sure there is, but this doesn't mean it is a good practice.

Probably your bank is chopping your password to eight chars (this limit was highly used in old systems). Your bank simply takes the first eight chars of the string, hash it and compare against their own hash. This is secure, at least, as secure as the length limit of its password.

There are more possibilities like they try every hash in the string with the first 4,5,6,7...N (where N is the length of the string the user entered) chars until they find a match, but I believe that my first guess is the good one =)

So you will have a log-in as secure as your first eight chars (or the amount they are using). If they simply use the second method (which I extremely doubt) the log-in will be as secure as your password length.

I won't enjoy my bank doing so but... Consider that they hold the responsibility if they got hack since your money is guaranteed by them (but you will have headaches).


Nessus Vulnerability Scanner My question is: can we use Nessus to perform a scan on a remote server? Or is it used only to perform scans on the local network?

I am not sure what you mean "on a remote server" but very simply put: yes, you can - as long as you're authorized.

If your scenario is to scan server which lies outside of your local network (for example a different server belonging to your company, hosted somewhere else) Nessus is your choice.

If you mean you want to perform a scan from a remote server with Nessus, that's possible as well. Our company uses Nessus on a dedicated server for external scans.

But be warned - don't scan server which you're not authorized to.

I also believe trial version is only for non-commercial scans.

Happy scanning!


Windows passwords: Blank/non-blank, admin/non-admin What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account with a different password.

Using a non-privileged account with a blank password and having an admin account with a password.
Using an admin account with a password.
Using an admin account with a blank password.

For the scope of this question it is assumed that: The PC is a private single-user machine behind an usual consumer grade NAT, which is connected to the Internet. All the non-blank passwords are secure and get used for nothing else. No potential attacker has physical access to the machine.

Keeping the system fully patched is as important as setting a good password. The strongest  that you have suggested is Using a non-privileged account with a password and having an admin account with a different password. The attacker does not require a password to break in.

If an attacker gets into the system because of some service that is not patched, he can easily wreak havoc.It is possible to escalate privileges even from a non-privileged account. So set passwords of great strength especially for the administrator account because in case the attacker couldn't gain administrative privileges, his next step is to dump the SAM file and to bruteforce the admin password.

My point is,the attack can occur after you have logged-in and is using the system. Once in he may/may not need passwords for further privilege escalation.

So

Never use blank passwords
Use passwords of excellent strength
Always keep the system fully updated - This includes not just the OS updates, but updates of every software you use.


Is there any effective server-side prevention technique against PHP-aided CSRF? I'm gonna start by saying it: I'm merely a cybersecurity enthusiast, not an expert. Thus, I'm gonna state what I think I know so far, please feel free to correct me at any time.

Through my readings, I've come to learn about:

The existence of CSRF
The basics behind it, for both GET and POST requests
Token and Referer mitigation techniques
How the Token can be retrieved if the target website hosts an XSS vulnerability
The fact that the referer is passed in clear text through HTTP headers and could thus be spoofed
cURL used to load the page first, get the token, and use this one to send the POST data and get page post-auth contents

Hence, my question is the following: if someone uses a PHP script that loads the page hosting the POST form, gets the randomly generated token, and sends the POST data with a custom "Referer" header matching the destination website, is there anything I can do on my server to mitigate this?

I think you are misunderstanding how an CSRF-attack works, and why CSRF-tokens protects against them. So lets begin with how one works.

The attacker fools the victim to visit http://evil.com that contains a form that automatically does a POST to http://bank.com/transfer?to=evilHacker&amount=1000000. If the victim is already logged in to her bank, the cookie with the session ID will be sent like usual by the browser and there is no way for the bank server to know that the victim did not actually intend to transfer the money. Note that this relies on the browser sending the cookie with the session ID to bank.com.

So how can a CSRF-token help? If the bank.com always checks that a random token unique to that session is present in the request, evil.com can not forge the request since the evil hacker running that site does not know what the token is.

The referer check works in a similar way. The request made by the browser from the site evil.com would have evil.com and not bank.com as the referer. Browsers do not allow modification of the referer header, so the attacker can't forge that.

So what about your line of attack - having the attacker request the site with a PHP script on her server to get the CSRF-token? This will not work, because the attacker will not get the victims CSRF-token. The token is unique to the session, and hence the cookie with the session ID. But the attackers does not know what session ID the victim has, so she can not include it in the request.

Notice the difference to the first scenario, where the browser included the cookie. That can not happend on the server.


Is it possible to prove that a TLS server key has changed? I know of a site that is currently using SSLv2 and I'm refusing to connect to them until they

Disable SSLv2
Re-key their servers

I'm insisting on #2 because due to DROWN, servers running SSLv2 should consider their private keys compromised. A re-key is the only thing that will solve that issue.

Is there a way for me to prove that the site has re-keyed their server? I can check the certificate (which will need to change), but how do I know they didn't just re-use the same key and get a new certificate?

I know I can use openssl x509 -pubkey to get information about the public key (which is tied directly to the private key) from the certificate. If the public key changes, does that mean that private key has changed?

Or, a better question might be "if the public key changes, is it at all possible that the private key has not changed"? I would compare the public key's modulus and exponent, of course, not just the bytes of the DER-encoded files I was able to fetch or derive.

Will public-key comparison work, and is there a better way?

Short answer: If the public key has changed, so has their private key.

Long explination: Modern cipher suites used by SSL/TLS servers have exactly one key pairing. So as long as one of the keys has changed, then the other key has changed as well. So if they have also disabled SSLv2 then you should be good to go. More information can easily be found on the Crypto stack.


Signing/certifying keys as a YubiKey user After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys.

I was surprised to learn that one can only sign keys using their master key since it would mean that I would have to import said private key onto my computer every time I want to sign a key, which seems to be a large security risk in comparison to using a yubikey's subkey smartcard features.

What is the best way to securely sign keys when your master key is typically in (air-gapped) cold storage?

Is it possible to certify keys with a subkey?
I don't know how, but I believe I did this last month (I have the signed key on my desktop, generated last month but I haven't touched my master key in over a year), although the SE question linked above is making me question myself.

Just to review, here's an overview of my setup, which I assume is pretty standard:

master (private) key in cold storage (encrypted)
yubikey allows for easy gpg operations while not permitting direct access to the private (sub)keys

I plan to signs on a roughly monthly basis and while I prefer convenience, for me security is more important.

Here are some ideas I have:

dedicate a raspberry pi (or something similar) to key signing
tinker with low-level PGP settings to try to get a subkey with the certify ability
generate another pgp keyset specifically for certifying keys and sign that key with my existing master keys. I already have two master keys (each for a different yubikey) so a third might be a bit of a hassle
use the weaker (2048 bit) of my two master keys for certifying keys, keeping it encrypted but on my computer

I think it's first of all important to understand that in GnuPG "subkeys" are just sets of fully independent keys that have capabilities assigned to them: a signing key is artificially limited to be only be able to do signing operations. The certification key is just as much of a subkey as the signing key -- there's really nothing that makes it extra special. We only call it the "master" key by convention, and it is often confusing to people (e.g. in the physical world a "master" key is able to unlock all locks, so many users expect their GnuPG "master" key to be able to decrypt messages encrypted to the "E" subkey). The certification (C) key is just another key that can indicate relationship between your identities and other keys belonging to you. Understanding that lets you better understand why the answer to the following question is "you do it already, with your 'C' subkey":

  Is it possible to certify keys with a subkey?

So, can you put your "C" subkey onto the smartcard? Yes, I believe 2.1+ versions of GnuPG make it fairly easy to put your C key into the "S" slot of the smartcard. With some extra tweaking, you can even have your keys on multiple smartcards, though you may run into corner cases with weird behaviour.

Having a dedicated off-the-network system for certifying keys is common practice, though few people go through the trouble of setting it up. All the mechanisms you mention are fine for that purpose, and I'll let you pick the one that suits you best.


Should a SAML Assertion whose SessionNotOnOrAfter value is exactly the same value as its AuthnInstant be treated as having an invalid session? I am receiving SOAP requests with SAML AuthnStatements whose SessionNotOnOrAfter timestamp is EXACTLY the same value as its AuthnInstant:

<saml:AuthnStatement AuthnInstant="2020-04-22T21:11:41.453Z" SessionNotOnOrAfter="2020-04-22T21:11:41.453Z">

I am using ApacheWSS4J to validate the SOAP Signatures it also validates a variety of SAML 2.0 features including the AuthN statement. Messages which fit this pattern fail validation because as soon as I get the message it's AuthnStatement is instantly expired!

In order to either configure, or create my own validations I would like to learn about this condition through the lens of the SAML standard.

Does this condition represent an AuthN statement which is instantly invalid?

What does the SAML standard say, if anything, about a SessionNotOnOrAfter being exactly equal to AuthnInstant?

It's a misconfiguration on the partner's part.

And yes, it should absolutely fail validation. For two reasons:

SessionNotOnOrAfter being equal to AuthInstant means that it is expired the instant the token is minted.
When comparing SessionNotOnOrAfter to your system's time, since it's already expired, there's no way that has changed - the token is expired.


What happens when a SSL certificate issued by CA for Y years but the domain get expired before that and purchased by someone else? I'm trying to understand the security part in SSL.

Lets say I have a domain called xyz.com and I was able to successfully verify with CA. But the domain expires 1 year from now.

However I was able to get a SSL that has validly for 3 Years.

I dropped the domain xyz.com but after sometime that domain got backordered by someone else.

Now I can still use my unexpired xyz.com SSL and trick the user that they are in xyz.com even though I don't have access to that domain.

Is such things possible? If such things happen, CA will be in trouble right? How do the CA prevent such things?

Yes, the scenario you are describing is kind of a loophole in the CA system. It is the obligation of the client (the certificate owner) to inform the CA that the ownership of the domain has ended. The CA (usually) does not do any active checks after the issuance has happened.

There are steps taken, to mitigate this problem, tough:

The Baseline requirements of the CA/Browser Forum do not allow certificates valid for more then 825 days starting next year, so the time where you could do attacks with your certificate will be shorter
Certificate Transparency, which will be required from all certificates next year, too, will allow the new domain owner to easily check if your certificate is still valid.


Are the Trends of Type II Hypervisors and Newer Applications a Security Issue? It seems that every time I have a new 'binge' at using the likes of VirtualBox or VMWare (the Type II version), they've introduced even more high-level features, often ones that remove layers between guest OSes and the host system. They realised early on that emulating the x86 was too slow, so they pretty much gave the CPU directly to the guest VM. They then realised that giving direct access to DirectX and OpenGL would increase performance, so they granted direct access to that too. Then they added more desktop integration, more seamless copy-and-pasting, etc. It goes on.

So, whilst Type II hypervisors are granting lower and lower-level direct access as well as more high-level desktop integration, so often are the applications running within the guests: before, DirectX and OpenGL was the darling of game developers, but now even web browser developers can't keep their mitts off it. So even things like web browsers are using functionality that is being 'handwaved' through the sandboxing layer of the hypervisor.

Is this trend turning type II hypervisors more into 'enablers of co-inhabiting OSes', and if so, should we be concerned at the weakened sandbox this presents?

If you want to use virtual machine as a sandbox mechanism to contain potentially hostile software, then indeed all the kinds of shortcuts you talk about are a source of worry. However, note that these "enablers" all apply to desktop-related virtualization. Most users of virtualization on their desktop systems do not do that for security, but for functionality: typically, being able to run Windows applications on a Linux or MacOS X system.

Most "big" users of "sandboxing virtualization" (where the containment is intended as a security feature) are on the server side, where there is no question of OpenGL or desktop integration, since there is no desktop and no graphic card worth speaking of.

The people who have to worry are then security researchers who analyse malware on their desktop systems. If (when) I indulge in such activities, then I tend to use Xen rather than VirtualBox: though the latter is easier to configure and manage on a desktop, it also does a lot of things automatically, that I would prefer to keep contained. Xen with the "xl" toolstack is barebone, but at least I can know what happens (i.e. nothing happens until I activate it explicitly).


How do iOS 11 apps identify me despite app reinstalls? I've recently reinstalled Pinterest on my iPhone and noticed I was logged in right from the start without even asking me for my username/password, so it must've somehow kept some data on my phone despite the app uninstall/reinstall.

I checked the obvious stuff and it's iCloud Drive as the app doesn't even appear in the iCloud Drive settings so it can't be storing data there. It's not iCloud "look me up by email" either as the app is not listed there either (in fact nothing is listed), and it's not browser cache/cookies as those have been cleared many times after the app was first uninstalled. It's not the iTunes advertising ID either as "limit ad tracking" is enabled and the ID was reset anyway.

Where is this app persisting its data, and how do I prevent this behaviour?

Regards.

Since iOS 11 it seems like the "keychain" (per-app secure storage for API keys, etc) is no longer deleted once an app is removed, so apps can persist their credentials (and of course ad tracking nonsense) in there and get them back when they're reinstalled.

The only option at the moment is to completely reinstall the device if you want to clear this, as the keychain is per-app so you can't even use another app to clear it, and there is no built-in way to do this. I imagine it would be possible with a jailbreak but that brings its own risks.

I've raised a bug with Apple about this and I suggest you do the same to push them into reverting to the previous behaviour of clearing the keychain of deleted apps.


Microsoft DP API and its keys Google-fu is failing me, and I could not find documentation that answers the following question: if an application uses Windows machine key or user key to encrypt certain data, and the encrypted data is still available, but machine becomes inoperable (hard drive failure, erroneously formatted drive, etc.), how can keys be backed up and restored, to be used for disaster recovery?
I understand that it is possible to take an image of such machine and recreate it from image, but I am looking for a solution that is independent of image media. Does such solution exist? I.e. is it possible to take a backup of a Windows machine or user key and re-apply it on a different machine, if the original one is totally lost?
I would imagine that taking such a backup represents a security risk, but ATM I am only concerned about the very possibility of such approach.

This seem to talk about using an alternative location for keys on a file system: Key storage providers in ASP.NET Core It is strange that I could not initially find it, but the result appeared as soon as I dropped 'Microsoft' from the DPAPI search terms.
The linked article must be talking about user keys, unless I am missing something. This would make sense, because, like I presumed, backing up a machine key is a security risk. I am pretty sure I can go from there and base any further encryption on user keys.
I was also interested in the article DPAPI and Roaming Profiles that is linked from Key encryption at rest in Windows and Azure using ASP.NET Core but it throws 404.
A high-level solution seems to be to use a file-system backed user key store and to enable key encryption at rest, making sure that the key encryption key is also backed up somewhere.


File upload vulnerability: rename solution? I have a module in which the user can upload images.
I searched Google for different kinds of upload attacks

checking dimension of the image (still vulnerable)
checking of file extension mypicture.php%00.jpg (still vulnerable)
checking of mime type (still vulnerable)

The only solution that I have is to change the file name of uploaded file
e.g:
fileUploaded:mypicture.jpg
move_uploaded_file($_FILES["pictures"]["tmp_name"] , 'mycustomname'.'jpg');

My question is:
Is there still a way to upload shell file after I've taken these precautions?

You need to do a few more things:

Check the file size of the image and enforce a limit (prevent overflows from happening)
Along with renaming the file (and storing it with a different name and path than the uploader can recover, preferably on a separate domain), you should also rewrite the file in some minor way (add a bit of random noise) with a tool like ImageMagick.
Extract EXIF (and any other similar meta-data) from the file, or just consider converting every image to a bitmap.

Most important -- understand how the executable image exploits work:

http://www.stumbleupon.com/su/1q3iyy/video.google.com/videoplay?docid=4221457095668033104


Is it possible to run shell code from programming language A in a script that is programmed in language B? I am sorry about the confusing title, but what I'm asking is this: Could you run shell code from C (or any other programming language) in a buffer overflow script that is programmed in Java (or any other programming language)?

The quick answer to your confusing question is "yes".

Buffer overflow attacks take a few steps.  There's the delivery phase (delivering the vulnerability), exploit injection (gaining control of the Instruction Pointer), executing the exploit (getting the Instruction Pointer to run the attacker's code), and shell code (the payload the attacker wants to run.)

Delivering the exploit is utterly trivial.  Attackers write the delivery code in whatever language they are proficient in.  It doesn't matter what language the delivery code is written in, because the language simply has to be able to deliver specific byte values into the buffer at the point of the overflow.  Different languages have different ways of expressing byte values.  Many attacks these days are delivered in URLs, which are text strings that are perfectly capable of specifying exact byte values.  I've seen an attack delivered inside a barcode, which is clever, but still trivial.

The exploit injection step almost always utilizes the victim machine's binary machine language to exploit the vulnerability.  The attacker finds a way to get specific bytes loaded into the buffer at the right point, such that when the function containing the buffer returns, it loads the attacker's bytes into the Instruction Pointer instead of the bytes that are supposed to be there.

Once the attacker has control of the Instruction Pointer, the IP has to be set to point to the exploitation code, and execute it.  This can be easy, this can be difficult, or this can be virtually impossible.  It's all a part of analyzing the vulnerabilities to create a successful exploit.  The goal here is to get the victim machine to launch the shell code.

Once the exploit launches the attacker's shell code, the rest is history.  The shell code is specific to the machine it's being run on.  Most often, it's also in binary machine instructions that are hand written in assembler, because the original buffer being attacked usually has size constraints.  A buffer overflow vulnerability doesn't automatically mean an infinitely sized buffer is available for the attacker to deliver a large payload of shell code all at once.

Once the shell code is running, the attacker has pwned the machine, and can control it however he wants.  To start out he'll often have the shell code expose a native command shell present on the victim machine.  That could be bash, a Windows Command shell, PowerShell.  Other possibilities include downloading and running a malware agent; allowing for remotely managed operations.  Common names for these infected machines are "bots" or a "zombies".  These run in a custom command and control language designed for operating thousands of machines in a botnet.  Once the shell code is running, the attacker is free to download more code to carry out his malicious commands.

Notice that all the exploit languages are completely unrelated to the language the attack was originally delivered in.


Which part of the eapol packets contain WPA password Hash? I have captured wifi traffic from a WPA network using Wireshark. I filtered the results for "eapol" packets and noted in the info column there are message type 3 and type 1. I believe this is two parts of the WPA four-way handshake.

Within these packets I see things like 802.1X Authentication, where will I find the hash of the WPA password/key?

PS: I know there are many cipher method which use in WPA like TKIP or CCMP and I read about the WPA authentication, but I was unable to determine where within the message the password can be found.

The hash is not passed directly in the string of bits. It will not just be there to grab in one packet. In order to attack WPA/WPA2 you must capture the entire four-way handshake. The key itself is not really sent as part of the message, since both sides know the key, they just need to prove to each other they know it, not send a hash for verification. One you have all parts of the four-way handshake capture, you then just brute force passwords until you get one that fits.

References:

Benefits and Vulnerabilities of Wi-Fi Protected Access 2 (WPA2)
Details of Key Derivation for WPA

Edit: Please see details in this question and answer. The answer is about the same, but your question is slightly different so it may not be merged as a duplicate.


Why not use PKCE for backend apps, too? So for SPA/frontend apps, you should be using PKCE these days for OAuth flow. But the backend apps have this additional complexity of having to have a secret key and use that key to talk to the token endpoint. Why not just use PKCE on the backend, too?

(This is a best guess as I am not a OAuth expert nor user).
RFC7636 created PKCE to incapacitate attackers with access to both client source code and relevant client communications. This is for example the case of some mobile applications which cannot ship secrets directly to the client device and cannot prevent other applications on the same device from sniffing the OAuth callback.
On most servers there isn't this kind of risk, as one can directly deploy secrets in a secure manner. On those servers PKCE would create unnecessary complexity. Complexity would both create new security risks and would divert resources which would be better spent mitigating more applicable security risks.
See also this YouTube video explaining the difference between confidential and public clients.


Choosing the right tools I'm totally new in the field of penetration testing, like almost no experience, only read lots of books and papers. I encountered lots of interesting tools during studying, many are famous like Metasploit, Nmap, OpenVas... etc. and other tools that aren't known or less famous, along with lots of code on websites like Github.

My objective is: Building a tool that can automate pen testing using Python. It should be able to connect some tools together like some already done projects.

My problem is: I need to select a set of tools to be used, but since I have low experience in the field, I don't know how to evaluate these tools.

What I need: The last thing I need is a list of tools. I'm welling to know if there are some right steps or a framework to evaluate these tools. If not, then how can I say that this tool is better than that or this tool is more convenient... etc.
As a pen tester or a security expert: How do you evaluate and choose these tools during your work?

Just to let you know, I use Backtrack and aware of some valuable tools on it.

Please before thinking about closing my question or down voting it, try to help me. I'm kinda confused and really need help with this issue. If you found my way of thinking wrong too you're welcomed to correct it.

Edit: This tool is being built for a college project.

As a pentester automation makes up about 1% of what I do and is only useful because it can catch low hanging fruit.  Firing off Nessus or some webapp scanner takes less than an hour.  The remaining time is spent actually hacking the application.  I look the source code for security critical components,  and fuzz strange API's with burp.  Be observant,  attention to detail.  A finding start as simple as a strange error message,  a "Huh, that is funny"  moment.

The tools I commonly use are (no specific order):

The scientific method
grep
python
burp
a decompiler
a debugger
nmap

In any case I suggest getting some findings under your belt before your start writing hacking tools.  There are already some great tools out there.


PCI DSS: Is Mirror/ Identical Server in Pentest or Scanning Scope I am just wonder if I have a mirror/identical (high availability server) server in my CDE segment, is that mirror server need be in scanning scope?

If it is not in the scope, in the scanning report do I need to have a special note or remark on that particular server to show that it is a mirror server of XX server.

Yes, the mirror server must be scanned and listed separately in your asset inventory. Identical in technology is never truly identical. All you need is to miss one patch or miss one configuration item on one of the servers.


How to prevent private data being disclosed to unwanted audience over internet? Everyday, in order to subscribe to certain services on the Internet we are almost forced to disclose private data even though those services don't necessarily require it.
For example, I need to expose my credit card number in order to register for iTunes even if I just want to browse through free apps, etc. This seems risky to me and I feel I should only have to provide my banking information on demand.

In most cases, we may face targeted marketing through the private data we disclosed over the Internet.

Are there any guide books or guide lines to know how to prevent exposing our private data to service providers over the Internet when it is not necessary?

There are steps people can take to minimize the amount of personal data given to websites.

For example instead of giving your credit card data every time you buy something many sites permit you to use PayPal.

If you are required (or want to in order to gain access) to give a credit card number, you can simply use a Controlled payment number. That way the site never gets your real credit card number.

Here is how to create one.

The real point is that most people do not take the time and effort to fully protect themselves. They much prefer "fast and easy" to prudent and cautious. Protecting yourself takes time and effort as well as research and learning.


How do short lived certificates increase security? After reading a blog post about the new Roughtime protocol, I am not convinced of the original premise that shorter certificate lifetimes increase security. The claim is that a shorter time somehow reduces the exposure if a secret key is compromised. But how realistic is that scenario?

If the crypto protocol is weak and that’s how the key was compromised, changing the key for a new equally weak one is meaningless. Conversely, if the protocol is good, an attacker will only be able to compromise the secret key from breaching the system (or by exploiting weak people.)  And we know from long experience with breaches that the first thing any attacker does is to open a back door in order to retain access if their originally exploited vulnerability is closed. The amount of time between a breach and the back-dooring process is usually measured in seconds or minutes, which a rotation policy likely won’t help.

We’ve finally begun to accept with passwords that frequent rotation is pointless (and risky). The NIST recommendations are evidence of that shift. Believing in frequent rotations for certificates seems like a superstitious holdover from the 1980s ideas of security.

So I’m asking for evidence. Have there been any studies on the efficacy of short-lived certificates as a security measure? Is there any proof that frequent certificate rotations improve security instead of simply causing frustrating inconveniences (and significant downtime as certificates expire) for all concerned? Another way to ask the question is what are the actual benefits a short certificate rotation period provides?

One document I can't resist from showing you here is draft-nir-saag-star by Yoav Nir (the chair of ACME working group) and the subsequent discussion across the saag mailing list.

An important issue Yoav rises there is that neither OCSP responders nor CRL distribution points are widely recognized as reliable network parties. I mean, there's obviously no evidence they are constantly down either, but, given the soft-fail approach currently in use, there's no need for a current certificate authority infrastructure to be available and monitored 24/7, which makes the transition to hard-fail (with the likes of Must-Staple, etc.) much harder.

And, anyway, CRL and OCSP both constitute an additional single point of failure, while a today's Internet service tries its best to avoid those at all.

As a matter of fact, a short-lived certificate is only good if the rotation is automated; however, for a sufficiently scalable network service, deployed across tens to hundreds to thousands physical and/or virtual instances, this holds true.

Also a few quick remarks on the rest of the question,

  Conversely, if the protocol is good, an attacker will only be able to compromise the secret key from breaching the system

— But not necessarily the system where the certificate and the private key are deployed in order to handle the production traffic. Might as well be the central Ansible server, or its network storage, or a server used for certificate renewal, or anything else. Might also be just a small portion of the production servers, not even in use (e.g. when a network service is deployed over a few cloud providers and one of those has allowed for a breach). In some (more outdated?) threat models it might have also been a (stolen) personal laptop of an employee responsible for certificate renewal.

In all the above cases there won't be any immediate benefit to an attacker for installing a backdoor, while they can still easily go away with the private key and use it for MitM, etc.

  We’ve finally begun to accept with passwords that frequent rotation is pointless (and risky)

Well, not exactly. E.g. NIST SP 800-63B suggests that "verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)", where a memorized secret is "a type of authenticator comprised of a character string intended to be memorized or memorable by the subscriber, permitting the subscriber to demonstrate something they know as part of an authentication process".

However, this doesn't apply to a private key which is never ever expected to be memorized or memorable in any sane contemporary usage scenario. As a matter of fact, there are also drawbacks of a frequent certificate rotation (such as the need to properly automate things), but those are not even close to the disadvantages of a frequent memorable passwords' rotation.


Is there any security implication of using WebRTC over unencrypted channel for streaming? I've spend a few hours reading about WebRTC and everywhere it's recommended to use a secure connection for contacting with the signal server, so no MitM attacks could be possible.

However, my project is aimed at video streaming (public), so I really don't care (I think) if someone is eavesdropping the connection to the signal server because it's only information about an already public resource. So... why would I need to use WSS instead of WS? Is there any other attack I may face if I'm not using WSS?

During the session initiation, through the signaling channel, the peers (two or more) are sharing information about their environment in order to create the stream.

You expose not only yourself (aka your application), but also your users by not using a secure connection.


Is zeroing out values on the stack and arguments overkill? I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks.  Is it a sin (or overkill) to do the same with arguments and stack values?  Thanks in advance.

Edit:

Here's an example of what I mean:

void foo(int arg0, int *arg1) {
    int local;

    /* ... */

    arg0 = 0; /* passed by value, so zero the copied value */
    arg1 = 0; /* 0 instead of NULL (NULL might not be 0) */
    local = 0; /* MIGHT be on the stack, depending on optimizations */

    /* Edit: now those values should be safe for FUTURE use */
}

The C standard specifies the behavior of code in terms of an abstract machine.  This specification does not know about concepts such as "the stack".  It knows variables with "automatic storage duration", meaning variables which are "gone" when the scope they've been defined in is left.
From the perspective of the C standard the code local = 0; has only the effect that subsequent accesses to local will yield the value 0.
Now, even though it's not explicitly called like this in the standard, C has an "as-if rule".  This means that a compiler is free to implement the code however it likes as long as the "observable behavior" remains the same as that of the code when "run" by the abstract machine.
local = 0; has no observable behavior (assuming there's no code using local in an observable way after the assignment).  Therefore, the compiler is allowed to discard that assignment; regardless of optimization settings.
Thus, "zero-ing" like this is a sin because it is not guaranteed to actually do anything and adds clutter to the code, making it less readable.  Note that this also applies to dynamically allocated memory!
edit It's questionable if it's even possible to make sure the compiler doesn't optimize the zeroing away, see this blog post, linked post and comments
/edit
To really zero a variable You need to make this assignment "observable".  The C standard luckily includes means to do so: via an assignment to an object of volatile qualified type.
So with a function like ...
void zero_out(unsigned char volatile * memory, size_t size)
{
  while(size--)
  {
    *memory++ = 0;
  }
}

... You can be sure that after calling zero_out(&local, sizeof(local)) the memory region (if any) where local is/was kept is zero.  This disables any smart optimizations by the compiler, though, so for larger memory regions it might be slow!
Even better than my above function is to use a function provided by either the standard or the compiler to achieve the same (because it might be optimized):

C11 has memset_s which won't be optimized away.  Problematic because memset_s is only optional, and currently not available on e.g. GCC and Clang.
MSVC has SecureZeroMemory

There are also other (potentially better) ways to implement my zero_out from above:

A volatile function pointer:
 void * (*volatile memset_here_to_stay)(void *, int, size_t) = memset;
 void zero_out(void * p, size s)
 {
   memset_here_to_stay(p, 0, s);
 }

An "external" function, implemented in assembly (or generated by another translation unit).  Attention! Link time optimization might make this ineffective ...


Any reason to send a user a session salt? I'm a summer intern turned full time employee. To make a long story short, the lead developer of the project I interned on quit, and since I'm the only other person that knows the project I got hired full time to maintain it.

Anyway, while poking around the program, I found that - upon loading a specific admin tool - the server sends the client a JSON packet containing:

My question: What possible reason could there be to send the client a session salt?

My security background is watching a few Defcon talks to kill time, so I'm no professional, but from what I know salts and hashes are something you're supposed to guard with your life. I also know that anything sent over a network is fundamentally unsecured. Furthermore, the only place this salt is used clientside is a text-field on that admin tool that simply displays the salt.

So what reason is there for this to be sent to the user? Should I edit the server so it doesn't send the salt?

If implementing custom session handling, salt obviously shouldn't be passed to the client, it should be stored either in a configuration file or in a database. Only the session token should be transferred between the client and the server.

First of all I'd suggest to look for uses of SESSION_SALT. If it's not used, remove it as you are just leaking sensitive information here. If you find something, we can take a closer look of what it's meant to do. My first thought was that the programmer just used wrong terminology here and it's actually a session token.


Which brute attacks are more common? Ones that use dictionary words or random symbols? If we compare only these two passwords, which one is the safest?

Ss1*x_32 or Very-hard-password-it-is-so-hard-to-break-it-1

The question is not about how many bits every password contains but about statistics, which brute attacks are more common: dictionary or random symbols?

Statistics on the attack methods aren't reliable. For example, we could say that a password like this-password-is-really-awesome-dude-believe-me is better than 3h8wnho9 because we could suppose that the average attacker would focus on 8-char alphanumeric passwords rather than long sentences, but is this assumption even true? We don't have a way to compute precise statistics. Also, in the information security field, the average case is often not very interesting. You need to consider lots of different cases and assess their specific risks for you.

So how can you choose a secure password if you don't know the method hackers are going to use to crack it? Well, you don't need to know how a hacker is going to try to crack your password, if you make sure your password has enough entropy. For example, if your passphrase has been generated by diceware and has 128 bits of entropy, then it won't matter if the attacker has a good dictionary or a good supercomputer, because they won't be able to crack it by bruteforce. Problem solved!


What additional methods for user tracking are there? I was getting interested in data privacy and looked up how users are tracked on the internet to connect the different traces to a single user. I found this:

  In addition to regular cookies, pixel tags, ultrasound beacons and fingerprinting technologies, there exists other methods for tracking users, such as undeletable zombie cookies or super cookies, dynamic cookies, Silverlight Isolated Storage, IndexedDB, etc. (source)

I wonder what other methods the "etc." entails?

I suspect this list could be made much longer, but just from the top of my head:

E-tags and other cache mechanisms
HSTS (and perhaps HPKP?)
Local storage
Flash, may it rest in peace (perhaps included in "super cookies")

Basically, you can use anything that creates some sort of state in your browser, that affects the browsers behaviour towards servers. That includes a lot.


Strange block page on OpenDNS? This morning I went to the internet and accidentally clicked on a blocked website (OpenDNS blocked it).
Though there was something strange on the place of the icon there was a little router icon and there was written "Strona zablokowana przez administratora".
The rest of the page was the exact same.
I went to work and when I came back I was trying to found out how that was possible.
I did not remember what the site was so I used another (kickasstorrents.com was giving me the same thing).

I am using the OpenDNS parental control version (208.67.222.123) to block sites. So that the page is showing up is normal. I scanned my MAC and there was no virus (Norton + Avast).  I tried to go directly to block.opendns.com and the page was normal without the strange text and picture. When I clicked kickasstorrents.com the weird page did show up again. After that I did go directly to the block.opendns.com and the weird icon was still there. After clearing the cookies and history it was gone.

Every other page is showing up normal. When changing the DNS server to Google (8.8.8.8). The page is not showing up anymore (not even when clicked kickasstorrents.com).

What is happening here?

Nothing unusual. What happened here was that a non-blocked loaded the blocked page inside a frame. This can cause the blockpage to inherit the favicon and title from the non-blocked page. This is not a security risk because a fake page could aswell spoof the favicon and title anyways instead of inheriting it from a Another site.

Clearing the cache does in most time solve the problem.


A customers site had a big mysql injection attack on it, just want to learn from it I created an online store for a friend of mine.

I created a system that shoots me an email any time there is a database error, that way if it is a bug in my code I can identify it and fix it. The email includes details about the query that failed, the data that was passed, session data, etc.

Well at 3:05 this morning I got about 120 emails in five min. for a database error and looking at what was happening I can quickly tell it was a mysql injection attack. After looking at a bunch of the things the attacker tried I'm kind of wondering what some of the sql commands they were trying to pass would actually do.

After looking through the whole database as well as the files on the site, I'm nearly 99% positive nothing was harmed, deleted or changed. Which makes me glad to know that I'm knowledgeable enough in my php to know how to prevent these things.

My question is, of the mysql commands below, what was the attacker trying to do?

 or 1=convert(int,(select cast(Char(114)+Char(51)+Char(100)+Char(109)+Char(48)+Char(118)+Char(51)+Char(95)+Char(104)+Char(118)+Char(106)+Char(95)+Char(105)+Char(110)+Char(106)+Char(101)+Char(99)+Char(116)+Char(105)+Char(111)+Char(110) as nvarchar(4000))))--

; if (1=1) waitfor delay \'00:00:07\'--

union all select null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null--

999999.9 union all select 0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536--

leachiancs\' and \'x\'=\'x

Thanks for the info.

More Information

The query that was run for every attack was a simple

SELECT * FROM tableName WHERE $phpVar AND price!='sold' ORDER BY id DESC

The $phpVar is populated based on if a $_GET entry matches a term in an acceptedTerms array.

so the literal query that was running and returning an error was

SELECT * FROM tableName WHERE AND price!='sold' ORDER BY id DESC

That is what threw the follow

 Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND price!='sold' ORDER BY id DESC' at line 1

The mere fact your DB ran the quoted queries (throwing you the error reports) means you do have injection vulnerability in PHP code. Note, that some methods of inspecting DB tables structure involve running multiple queries with different parameters until DB throws an error and HTML page breaks. That means the failed queries are only tip of iceberg of all queries that were run.

There're 5 queries:

1) Invalidates all previous restrictive WHERE statements by effectively adding " or 1=1" statement.

2) Check for DOS attack against SQL server DB by adding another delay query.

3) Inspecting number of columns in DB table. Number of null-s on change between passed and failed queries is the one attacker looks for.

4) Same for user auth tables: ends query with likely non-existent ID then inspects number of columns. null-s are replaced by HEX values.

5) misguiding auth check by injecting crafted $user into query PHP string like

"SELECT ... WHERE ... AND name = '" + $user + "'"

(note the exact sequence of single and double quotes) It's likely the user 'leachiancs' was real aquired by previous investigations.

Queries (1)-(4) carry SQL comment in the end for invalidating the rest of originally intended query and defeating LIMIT or other validation WHERE constructs.

The main lesson here is using only parametrized queries and not trying to reproduce all that dirty work of proper DB+PHP escaping for all possible versions and quirks in syntax.


Best way to apply least privilege to one specific jar application on Linux Let's say I have some java application running on the host and do different things, and now I have built a jar that captures network traffic. While reading What's a least-privilege way to allow node.js to access network adapters on Linux?, it seems to me that the best way to apply the least privilege is to do use setcap:

setcap 'cap_net_raw,cap_net_admin=eip' /usr/local/bin/java

But here is the problem, if I setcap to Java, it then gives all java application to have ability to capture traffic. Is there a better way to do it?

Create a wrapper program that has those capabilities, that just starts java on the correct jar file.


What public GPG key do I have to publish? I just created a master key and two subkeys. The first subkey is used for encryption, the second one for signing.

Now I am wondering what public key do I have to publish on my website. Does is suffice to publish to public key of the master key or do I have to publish the public key of each subkey?

As I understand the scheme, you now have three pairs of keys: A Master public/private, and two Subkey public/private pairs. Please correct me if I misunderstood.

According to https://wiki.debian.org/Subkeys , it seems like you should publish both of your public subkeys in order for others to both

encrypt messages meant only for you, and
verify your signatures.

  Subkeys make this easier: you already have an automatically created encryption subkey and you create another subkey for signing, and you keep those on your main computer. You publish the subkeys on the normal keyservers, and everyone else will use them instead of the master keys for encrypting messages or verifying your message signatures. Likewise, you will use the subkeys for decrypting and signing messages. [emphasis mine]

Furthermore, do not publish either of your master keys: (again, https://wiki.debian.org/Subkeys)

  You will need to use the master keys only in exceptional circumstances, namely when you want to modify your own or someone else's key. More specifically, you need the master private key:

  when you sign someone else's key or revoke an existing signature,
  when you add a new UID or mark an existing UID as primary,
  when you create a new subkey,
  when you revoke an existing UID or subkey,
  when you change the preferences (e.g., with setpref) on a UID,
  when you change the expiration date on your master key or any of its subkey, or
  when you revoke or generate a revocation certificate for the complete key.

  (Because each of these operation is done by adding a new self- or revocation signatures from the private master key.)


Using Simple JWT for Public Facing API Auth I'm looking at security methods for APIs. Using JWT access tokens after client login with user/password will work well for internal web apps using our own APIs. However, I'm looking at how we should secure our external APIs that other systems/clients may use to consume data.

I typically see API services providing a client_id and client_secret. This, however, ends up being used in OAuth2 which I'd rather not have to implement as I'm not confident of a successful, secure implementation of such a big spec and nor do I want to be dependent on auth0.

I think that if used simple JWT for external APIs consumed by applications then I'd have to have a different identity type than user/password. Such as an ID and secure key. What would be best?

Yes, a simple token is enough to consumed securely a public API.

Structure of this token :

a unique part or must be unique itself (this will be the id)
a random part

Only the person which has the token can access the API. On each request to the API, you send the token with it. Your API validate the token and return the data if it's valid.

But, the tricky question is how do you get this token?

You will need an authentication page somewhere. After the user is authenticated you can let him create/download an API token. He can then gives this token to anyone or any applications he want and they will be able to access his data.

OAuth2 mostly automate the process of obtaining this token so the user doesn't have to do manual step like copy&paste to share the token.

Note

A game that I played in the past used this scheme for it's public API : Guild Wars 2. When accessing their account on the website, a user could create and copy their token, then give it to other applications that would analyze their account information.


Outsourced software development ISO27002 definition In ISO27002 section 14.2.7 it sets out the requirements for outsourced software development.

By Outsourced software development are they referring to bespoke software or does this also include off-the-shelf software?

The intention of section (14.2.7) in 2014, (12.5.5) in 2005, have always referred to bespoke software development.

When I participated in the Swedish translation of ISO27002:2005 the question was never raised as to whether it might also apply to COTS-software.

However. Even though the intention of the section is to ensure a somewhat qualitative software development practice there is nothing, obviously, preventing the use and adaptation of this to apply also to regular software.

Many of these practices could be generalised and used as a part of a quality measurement of the organisation from which you intend on purchasing the COTS-software.


Archival storage for ransomware defense Thinking about the threat posed by ransomware, the defense that makes
the most sense to me is to have a secure copy, and an automated way to
restore protected files.  Ordinary backups are not really secure, because
the ransomware could just as easily target your backups.  Even network
based backup isn't perfect, because the ransomed files are likely to be
automatically backed up and supersede the valuable files.  And anyway,
backup of "valuable" files in the same stream as all the other routine
stuff isn't perfect.

Is there any existing product that will (a) automatically make copies
of designated files folders (b) audit the live files against the archive,
looking for any kind of damage (not only ransomware).

A good option is to backup to a remote system which regularly creates unmodifiable snapshots of the filesystem, which cannot be changed/deleted with the same credentials used to access the files.

I use FreeNAS for storing my personal files, and every 15min a snapshot of the ZFS volume is created on the server.

The account used to access the files can also be used to browse and restore old versions, but to delete a snapshot different credentials are needed which are not stored on my PCs.

The important part is: using the credentials stored on the PC (which are used to access the current version of the files and change them) it is not possible to delete snapshots.

But remember: Even a RAID system with scheduled automated snapshots cannot replace backups!


AES-256-CBC encryption IV vs salt when encrypting files with a secret key I am writing a small class to add to my application that will handle things like config secrets.  (I don't want to get into this topic as a lot of research has gone into the approach we've decided to take for this.)

One of the requirements is to encrypt file secrets.  (Think a TLS certificate key or PGP secret key.) I am able to generate (and decrypt) a secret key that can be used to encrypt/decrypt the files outside of the application using the AWS KMS service.  (See this for information about what this actually returns: https://docs.aws.amazon.com/cli/latest/reference/kms/generate-data-key.html)

So, to my way of thinking that just means I need to store the encrypted version of the key along with the file so that I can decrypt the key, use it to decrypt the file when it is used.

My confusion comes from the use of the openssl encrypt/decrypt functions on the file data due to the IV.  I've read a lot about IV over the last couple of days and understand its general purpose, but am left with a number of questions attempting to reconcile this with what I see in the "real world".

When I use openssl from a command line to encrypt a file I've read to use this:

  openssl aes-256-cbc -salt -in secrets.txt -out secrets.txt.enc

Notice there is no IV passed in, though the -salt parameter may serve a similar purpose?

But when I decrypt the same file I use a command like this:

  openssl aes-256-cbc -d -in secrets.txt.enc -out secrets.txt.new

Notice no -salt parameter, no IV, or anything of that nature, so how is it able to decrypt the file without that information?

In the openssl encrypt/decrypt functions in PHP, and other discussions around IV, it sounds highly recommended to use an IV when encrypting data, which then suggests I need to store/use the IV when decrypting it as well, but this isn't being done from the command line, so how is that working?  Is the command line above less secure for that?  Do I not need to use an IV based on the fact that each file will have its own secure encryption key?

As stated in this thread

  The OpenSSL developers preferred to derive the IV from the password, just like the key (i.e. they produce from the password a long sequence, which they split in two, one half being the encryption key, the other half being the IV).

The IV does not need to be provided for decryption since OpenSSL derives it from the password. The thread also mentions some drawbacks of using OpenSSL's file encryption method which is worth considering, like not having a MAC to verify the integrity of the encrypted file.


How trustable are third party root certificates? I recently tried to use Fiddler2 from a third-party vendor Telerik. While decrypting the HTTPS traffic of my network, it asked me to install its own root certificate in my Windows operating system:

Take a look at the below screenshot:

Is it safe to trust these kind of root certificates? What are the preventive measures to be taken when installing such root certificates?

It's safe as long as you understand the implications.

Fiddler acts as a proxy / man in the middle to intercept and decrypt traffic between you and the target.

For SSL sites, it does this by dynamically generating an SSL certificate with the name of the target. The problem is that your browser will not trust certificates issued by Fiddler, hence the suggestion to install the Fiddler Root certificate.

The reason this could be bad is that if a malicious user generates an SSL certificate signed by the Fiddler root for a site like...let's say....www.bankofamerica.com - your browser will automatically trust the "fake" certificate.


Copy Metasploit from Linux to Mac OSX? I'm just wondering is there anyway to move Metasploit framework from Linux to Mac completely and It will be work ?
and if yes , how ?

You can export the workspace from the Metasploit installed on Linux, install Metasploit on Mac OS using Carlos Parez's script or using the method outlined here. Once the installation is complete, import the workspace and you will have all the data (hosts, vulnerability information, looted data, etc) in the new setup.

To export the workspace data, connect to the workspace using the msfconsole workspace <workspace-name> command and then run db_export:

msf > db_export -f xml -a /root/msf-data.xml


In apache, why www-data owner of a web application directory is safer than recursive 777? I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep owner www-data or apache (Depends on my web server user) for my web application directory. All directories should have 755 and all files should have 644.
Files with 644, Directory with 755 and owner of web application directory (recursive) is root or ubuntu, this looks good to me but my yii application is not able to create files in runtime and assets so I am not able to login as well as users are not able to upload files in upload directories.

If I give 777 recursive to uploads directory, it starts working fine but an intruder can upload a malicious file in it and all files are 777 so he can simply remove all of them.

If I give 777 to folder only, not the files then users are not able to modify uploaded file, that is one of functionality, so functionality does not work, for security purpose it is fine.

If I make owner to www-data of uploads directory recursive 755, it means user can upload files, modify files because www-data has read write permission for the directory and the content but intruder also have same permission for its malicious file. In this case, he can also remove all files.

Summary
If I keep 755 for all files and 644 for all files with owner www-data of web application directory recursively. All works well, I do not need to give 777 to uploads, runtime or assets, it can create files inside these directories when user uses web application but an intruder can also create php files in these directories with owner of www-data that means, he has also full modify permission to all files of all directories. I do not want to handle this in apache to make execution of php files forbidden inside uploads. For different web applications, this name is different and many applications use multiple directories for upload. I do not want to deny all for php files of uploads folders. There should be correct permissions which could handle this better.

Please suggest.

The risks from a folder with 777 privileges and from a folder with 755 privileges owned by www-data are slightly different. In the case of the 777 folder, if an attacker is able to get control of any user on the server, they will be able to modify and delete the uploaded files. In the case of the 755 privileges, if they are able to compromise the www-data user (or any user in that group), they can still modify and delete the uploaded files, but if they compromise any other user, they can only read the contents of the files, without being able to make modifications.

If all users on the system are in the www-data group, there is no difference, but that isn't usually the case. For example, if the server runs a database as well as the website, the DBMS will usually run as a user in a different group. In this case, a flaw in the DBMS allowing code execution would not allow an attacker to directly affect the uploaded files, unless they could escalate their privilege to a member of the www-data group or root user.

For finely grained permissions, look at options such as Access Control Lists (ACL), which can allow more specific rules than the basic owner-group-everyone approach, or SELinux, which can implement mandatory access control to files and folders, meaning, for example, you can say "only processes with a particular flag can write to this folder". In either case, these are very easy to shoot yourself in the foot with - test carefully before applying to a live server!


What does downloading an SSL Certificate allow my school to see? Recently, my school's administration announced some network changes. Should I want to use the school's WIFI, I'd have to download an SSL Certificate to my MacOS (High Sierra v.10.13.1) I'll admit that I have limited knowledge of what this all means. I'm afraid that this will enable them to access my private information and search history. Is that the case? Can they see what I am doing when I am not connected to their wifi through a SSL Certificate? Please excuse my ignorance :)

As alluded to by many of the comments on your question, the information you provided isn't enough to give a definitive answer, but here's my guess being that I am very familiar with typical campus infrastructure.

Your school likely has their own CA (certificate authority) that they use for various services on their network. Since they made the CA (and its not that widely used), your device doesn't recognize the CA and doesnt trust it. In order for your device to trust the school's CA, you need to install the certificate. Since you are required to install the CA certificate to use the wireless, my guess is your campus is using WPA2-Enterprise with RADIUS authentication using PEAP and MSCHAPv2 (pretty common). The P in PEAP stands for protected, in this case using a TLS (the new fancy term for SSL :P) to protect the communication being transferred. This does NOT give the university any direct access to your device whatsoever. This will merely allow you to connect to their network which may have monitoring ramifications (such as Deep Packet Inspection, location based on access point, Identifying your machine by the MAC address, etc) but this can occur on any netowrk regardless of the TLS certificate installation. The TLS certificate and CA install will not be adding any remote monitoring software or anything crazy like that.


How to properly handle unathorized errors in SPAs In order to prevent URL guessing for unauthorized users I will return a 404 error even if the URL exists.
It's better to always return a 404 error page even if the call is to an API?? or is better to return a JSON with a 404 in case of and API call??
What do you suggest??

Well it is rather more friendly to return JSON if you API specifies that it returns JSON. If it doesn't specify either way, it probably doesn't matter that much.

In honesty, I generally prefer to return something useful and meaningful. For people, I would redirect to the login page. For an API, I would return an unauthorised message. Returning a 404 when the result isn't missing isn't terribly helpful. Of course, this is more a usability question than a security one.

If you want your app to be usable, return the correct/useful data unless it would leak something critical. If you want your app to be ultra-secure but less usable, best to not even return a 404, return empty data instead.


Can a wifi usb adapter double as a keylogger? I've read that there are keylogger hardware and thought that usb wifi adapter are hardwares and wondered if they can be hacked to work as a keylogger. I'm just worried that my usb wifi adapter might be a keylogger.

It is possible?

I believe it's certainly possible.

In principle, the initial connection of the usb dongle loads key logger software onto your machine along with the code to capture and send keys to remote storage periodically, then switchs modes to become a WiFi.

There are a number of usb devices that support multiple modes and switching modes. I've not seen that particular combination, but it should be possible.


Can TPM "Storage Keys" be created outside the TPM? I am interested in 'adding' preexisting keys to a TPM's storage hierarchy.

An example of a desired key hierarchy can be shown as:

(SRK)----->(User Storage Key)-------> User Working Key 1
                             |
                             |------> User Working Key 2
                             |
                             |------> User Working Key 3

Where:

SRK is the storage root key created and managed by TPM administrator
User Storage Key is created as a (public, private) key pair outside TPM. For example by using the OpenSSL command line tools.
User Working Keys are also created outside TPM using OpenSSL.

How can I insert "User Storage Key" and "User Working Keys" in the above hierarchy?

The TPM allows me to create (public, private) key pairs internally inside TPM  (and to export public key along with a (wrapped form of) private key thereof). But it is not clear to me if TPM commands like TPM_CreateWrapKey and TPM_LoadKey2 allow this option.

This is warranted by situations where user's signing/encryption keys are already created elsewhere and we are interested in using the TPM as a secure repository of keys on the operating platform. (Binding/sealing to create opaque data inside TPM is not useful here, since bound/sealed data is incapable of extending the key hierarchy).

I wouldn't have thought this was a good idea.  The TPM can only provide "trust" for keys that were created within the TPM.  Otherwise, who knows what happened to the keys before they were added to the TPM?  If the private key ever exists outside the TPM, all bets are off.


How safe is the VirtualBox NAT network adapter option? I had an Ubuntu VM running and I was using Firefox in it to look at tutorials; then my antivirus detected an attempt to forcefully install a fake Java Upgrader.  From what I know about the VirtualBox NAT option for the network adapter... in fact, all the internet accessing options, is that they use the network capabilities of the host( where else could they get such functionality? ).

So, given the above, I'm inclined to believe that fake Java Upgrader was intended for my virtual machine; but since the VM uses host resources, the fake upgrader was picked up as host traffic( which makes sense, the antivirus watches that at least minimally ).  So the question is, how safe are the internet accessing network adapter options for the host?  Could that fake upgrader, coded to target the VM( because the VM was the one that tripped on the hostile page ), attack the host instead?

The very purpose of virtual machines is to isolate the guest OS from the host OS, therefor the situation you're suggestion should not happen under normal operation.

To think of it another way, if you download a virus, the traffic passes through your router. Does your router get infected? Of course not. The same principle goes for your host NATing traffic for your vm.

It is possible that a bug in the virtualization software or your host's network stack could allow a sophisticated attack to "break" out of the vm.


Protecting critical state infrastructure from the aftermath of a nuclear blast Countries rely on computer infrastructure for a huge percentage of communications and military management, as well as utilities like electricity. Unfortunately, nuclear attacks release massive electromagnetic pulses that damage these systems.

Normally this isn't much of an issue, since everything in the pulse radius is reduced to ash, but high-altitude nuclear explosions (HANE) can cause serious electronic damage without the hassle of mass death and destruction.

Ignoring the ridiculous improbability, I'd like to know how infrastructure critical to a nation during wartime might be secured against such damage. Since this is purely theoretical, I'd like to see sources for all information. I don't mind what countries you focus on, as a nuclear war is likely to affect all of them.

I know this is a pretty outlandish question, but it's been on my mind for a while and I'd love to see some well-sourced answers on the subject.

P.S. Yes, I did just find a legitimate use for the nuclear-bomb tag.

The Internet at large is designed to resist nuclear blasts. At least, it was a design goal of its immediate predecessor, ARPANET.

There is no secret: to survive loss of components, you must have redundancy. In the context of nuclear blasts, this means that there must exist several paths for data between any two machines, and the paths should be as geographically separate as possible. Mathematically, given an assumed blast radius r of 50 miles (for a nuclear-powered EMP, this is a rather low estimate), and two machines A and B and two paths between A and B, then the following should hold: for any two points M and N where M is on path 1 and N is on path 2, and the distance between M and N is less than r, then either M or N (or both) is no farther than r from either A or B. In plain words, the two paths never come closer than 50 miles from each other, except at both extremities (the two paths necessarily join at A and B).

The packet routing nature of ARPANET, then the Internet, allows for such redundancy. Extra points to radio links, in particular satellites: the link between a base station and a satellite cannot be permanently disrupted by a nuclear blast in between. The blast may induce a high ionization of the upper layers of atmosphere, so communications may be temporarily jammed, especially for longer wave lengths; satellites work in the GHz band and should have less trouble than, say, FM. Also, geostationary satellites tend to be relatively high on the horizon (at least from southern USA -- much less so from, say, Moscow) so getting a blast between a base station in Atlanta and a geostationary satellite which is roughly over the Americas entails detonating the thing over US territory, at which point Atlanta itself is in big trouble.

Transoceanic cables should also be fine: 3 miles of water are a Hell of a shield. And they offer lower latency than geostationary satellites (the ping time with a remote server through a geostationary satellite cannot be lower than half a second, because 4*36000 = 144000 km); latency is a problem for flying drones. Lower-altitude satellites are more difficult to use (from the point of view of a base station, they move a lot and often go beyond the horizon) and are in range of Anti-satellite missiles.

Optic fiber is more resilient to EMP than copper links, and the US military have studied that for more than 35 years. The weak part of an optic fiber link would be repeaters: the devices which pick up the signal and re-emit it stronger. You need some of these in any long-range cable. But at least this reduces the problem to building anti-radiation bunkers at regular intervals.

Actually, a bigger problem may be electricity. An EMP will imply high surges in the grid. For instance, the US grid has trouble resisting bad weather.

And, of course, redundancy of network links is not sufficient: you also need to duplicate the servers (data storage, computing elements). You already need to do that to survive floods and earthquakes and even simpler events like a server room burning down. EMP resistance is just more of the same, on a slightly larger scale.


What is Autocsr and is it secure? I read an interesting article about something called autocsr for SSL certs. After reading I still could not figure out how it works. Doesn't generation of CSR happen on my box? The CA won't have access to my box. Is it really safe as it proclaims? thanks

AutoCSR breaks with the principle that the private key should be generated on the machine where it will be used, and never leave that machine. It generates the public/private key pair on a machine of the CA, transfers the private key to you via the Internet in encrypted form together with the certificate, and erases it on the machine where it was created.

On one hand, this does indeed reduce security. Instead of controlling the private key yourself you have to trust the CA's procedures and security measures to ensure that the key generation is done securely, there are really no traces of your secret key left anywhere on their systems, and the key isn't disclosed to or manipulated by a malicious third party in transit.

On the other hand, it can increase security. Generating a public/private key pair securely requires some expertise. There have been incidents of weak keys, as well as services not offering encryption at all because the challenge of setting it up was too big for them, which could have been avoided by using a service like AutoCSR.

In sum, if do you have the experience and equipment available to do it properly, creating the key pair on the target machine will definitely be more secure. If not, it's a trade-off between your organization's capabilities and your trust in the CA to do it right.


In Return-Oriented Programming how can the machine execute unaligned instructions? I am reading "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)".

The author claims that x86 code is like English written without punctuation or spaces, so that the words all run together. This means that execution can start on a different location than intended by the programmer and that there exists a sufficient set of code sequences of this type within libc to allow arbitrary computation.

From the paper the following sentence has confused me:

  "On an architecture such as MIPS where all instructions are 32 bits long and 32-bit aligned there is no ambiguity about where to start or strop, and no unintended instructions of the sort that we describe."

On a 32-bit machine aren't x86 instructions also 32-bit aligned?

Does this mean that it is possible for non-binary alignment and execution? (e.g. I have bits "00001111|22223333" in memory on a 32-bit machine and I decide to execute the instruction "11112222"?

x86 is not RISC. The instructions are variable length. From 1 to 15 bytes. They are of course not aligned. Few things on x86 are aligned (atomics, some vector instructions, cache lines of course, etc.).

The text you're reading basically says that an instruction can't be a prefix to another instruction, but anything else goes.

So if we have 4 bytes in memory: AA BB CC DD

If the instruction pointer ("program counter") points to AA, it might execute the single 3 byte instruction AA BB CC, then start decoding from DD. But if the instruction pointer points to BB, maybe BB CC is a valid instruction too! Or maybe BB alone is a valid single byte instruction. Or maybe BB CC DD is a valid 3 byte instruction. Who knows? The possibilities are endless.

Since instructions can contain constants, if you can feed constants into a JIT (like firewall rules that get compiled into eBPF programs or lua code in a game or javascript code in a browser or whatever), you can make the JIT produce code with the bytes you want, and then you can jump into that code (basically, jump into the constant, make the CPU interpret it as instructions, profit). Some JITs take care to produce "safe" byte sequences instead of short/fast byte sequences for instructions bearing constants to ensure this doesn't happen. Same for ahead of time compilers.


How can I detect if hashes are salted? Is it possible to detect hash function of a hash if I don't have access to PHP code? I know that if a hash is some kind of MD5, but I don't know if there is salt etc.

Some tools make a educated guess regarding the encryption and salt type but there are numerous types of encryption schemes, some so closely related that the hashes nearly looks the same.

Take for example the following hash (altered to protect the google dork): 0000000B84FF762C88DG6E16F324269EFCA186FA

If I ask a classic such as John the Ripper to crack it without specifying what type, I get the following response:
Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-linkedin"
Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha"
Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-ng"

Thus, John will run and try to crack the password as "raw-sha1" but it could be wrong.

If I input the same hash into hashcat-plus, it complains about the hash length and ask that I specify a hash type. All well and good I suggest SHA1 but there are also numerous permutations available that could mean a endless amount of time wasted if you choose wrong. E.g. Hashcat gives the following options for SHA1

100 = SHA1
110 = sha1($pass.$salt)
120 = sha1($salt.$pass)
130 = sha1(unicode($pass).$salt)
140 = sha1($salt.unicode($pass))

Searched around and found some interesting tools to find the encryption type and they can be broken down into two categories namely with source / binary available and without any source binary.

Finding the encryption type through reverse engineering can be achieved via tools such as:

http://www.autistici.org/ratsoul/iss.html - A plugin for immunity debugger that identifies common encryption or encoding functions / structures etc.
http://aluigi.altervista.org/mytoolz.htm#signsrch - is the binary version of the immunity plugin version
http://www.hexblog.com/?p=27 - a plugin for OllyDbg to determine the type of encryption
https://www.hex-rays.com/products/ida/tech/flirt/index.shtml - a plugin for IDA Pro to determine standard called libraries, could be used to identify encryption libraries

Then there is the "educated" guess script:

http://code.google.com/p/hash-identifier/ is a script that compares various attributes such as length, contained char types etc to produce a possible hash type used. Seems to be included in Backtrack5 standard.

And the websites that allow for manual verification such as:

http://www.insidepro.com/hashes.php - Allows you to enter a password and compare the hash to your example hash
http://forum.insidepro.com/viewtopic.php?t=8225 - Lists various encrypted hashes to allow for a manual comparison

So basically it seems that without prior knowledge of the hash used, with no source / binary available to reverse engineer, you are basically left with serious guess work. And to add a little pressure, choose carefully since choosing the wrong hash can lead to a LOT of wasted time!


Why does the ProtonMail Android app require Identity permissions? The ProtonMail Android app is supposed to be a privacy-centered alternative for data-mined email services such as Gmail, Yahoo, and Outlook. If this is truly the case, why does the Android app require Identity permissions which allow the app to view existing accounts on the device?

You can find more details on the link below for the permissions ProtonMail Android app is using, along with information why each of them is needed.

https://protonmail.com/support/knowledge-base/android-permissions/

  Identity: Allows push notifications when you receive new messages
  through the ProtonMail app. Unfortunately this is the only solution to
  provide push notifications at this time. We will continue to look for
  alternate solutions.


Are there any security risks with allowing shared accounts to website What are the security risks of encouraging, supporting and allowing shared logins to our website (username / password)?

This feature would allow some number of users, normally working for the same organization, to all use a single login to the website and perform the same functions as that login with no further identifying info.

Several users and some of the business stakeholders are asking that we support and encourage shared logins to one of our new websites. I have no idea why they are asking for this yet. The website does not have anything to do with the health industry and no financial information will be tracked in it.

There are immediately some architecture and UX problems I have with this 'feature' but I am looking for any security risks/concerns to back up my other gripes.

Concerns regarding shared accounts:

The audit trail becomes an issue, since there is no valid audit trail possible. When the audit trail is not properly in place, accountability becomes an issue.
Loss of credentials to unauthorized users is significantly increased.
Once an account is compromised, the impact is high since many users share the same account.
Password policies no longer apply. Regularly changing passwords is not a viable option anymore. If the password would regularly be changed, how is the new password communicated to all your users?

Probably one could come up with a few more concerns here. The fact that you do not understand why they are asking you this question is interesting to me.

Apparently they have an issue and think they have the best solution for this problem already and ask you to implement it this way.

I personally would go back to them and try to determine the problem. Once the problem is determined, a proper and secure solution could be considered.


How to close or block remote access backdoors? I've been reading about famous hacking groups targeting law firms, corporations and individuals. They always use remote access backdoors to get into a victim's computer or phone and lock the system with ransomware or steal files and information. This made me wonder if there's a way, no matter how complicated, to close or block these backdoors?
Operating System(s): Any

Short answer: possible, but not doable.
Long answer: not possible.
It's relatively easy to create a backdoor. Anyone with a minimal programming knowledge can search around and create another backdoor. Most of them will be easily detected, but some can evade detection. Add that to the almost unlimited ways to communicate with the command and control servers, and you see how is impossible to detect and block every backdoor.
I once saw a report on the Turla family of malware that used comments on a Britney Spears post to send the C&C server address to the agents. As usually Instagram is not blocked, and Britney looks like a famous person, nobody would suspect it was used as a malware communications channel. And sending data back is easy too: they can use Domain Fronting, DNS-over-TLS, DNS-over-HTTPS requests, even plain DNS queries.
That's why is impossible to a common user to detect backdoors by himself: too many possible infection vectors (Word macros, browser exploits, infected PDF files, phishing), too many C&C communication paths, and too many exfiltration paths too.
Backdoors targeting normal users (any user, not a specific individual) can be detected and stopped by anti-malware, antivirus and firewalls. Most of them are not sophisticated enough to bypass basic defenses. Keeping your defenses up to date is enough to protect you from most of them.
But backdoors aimed at large corporations, governments, high profile law firms and specific individuals are a different kind. They use undocumented features, abuse normal OS components to disguise their actions, mix with expected traffic, and are tested against the target defenses. Their owners research the environment first, and create a specific backdoor to bypass the target defenses. They are not the normal, off-the-shelf malware, and employ a lot of effort to remain hidden for as long as possible.
So it's useless to try? No. Employing strong defenses makes you not be a sitting duck and the lowest hanging fruit, so the attackers will look elsewhere. But if the attackers have plenty of time, skills, and strong financial/political motivation (and external funding), they can break any defense.