How to go from wifi password to computer access In looking at What can hackers do with a wifi password?, it is said:

  Simply said, if someone has your Wifi password, they have full access to all connected computers and devices within your network.  This can be used to do anything from copy data, monitor your usage, send data (typically virus or other sniffer program), watch you on your own webcam, play music on your computer, and a variety of other things.

This sounds like it means, if the wifi password is obtained, you can somehow end up directly running a program on someones laptop. I don't quite see the connection there though. Wondering if one can outline the pieces to make the connection.

My attempt at explaining how it might work... I'd imagine that first you would sniff the network traffic given that you are connected to the network. Not sure exactly how this works but it is said it's straightforward to inspect packets from connected devices on a network if you're on it too. Not sure what sort of security exists here. But given they are sniffing the traffic, I would guess they could monitor any passwords you send over the network. From there I guess if you use the same password on your computer as on the internet then they could type in the password on your computer remotely somehow. I am all guessing here, I don't see how it's possible. You would somehow have to inject something directly into the computer, which just seems backwards.

You're mostly right - and indeed, as default commented, "they" are wrong.

What you might do if you had access to the wifi access point would be to lie to the connected devices and turn something they're doing into a point of entry.

For example you might wait until some specific Web request is made to some very common resources (for instance, the jQuery library scripts on a CDN). Then, provided there wasn't any extra security on the call or on the resource (smart sites employ both), you would "tell" the browser that the site hosting the resource is not the real site, but another that you control. The jQuery library there is a modification of the real one, that also performs several tests in search of vulnerabilities.

It could try and download a corrupt PDF file, or a malicious Windows Shell script, and so on.

If one of the exploits is viable, bam!, you own the target machine.

Otherwise, there are still things that can be done even with a limited access - a very common one is try and "enrich" the connected browsers with crypto-mining scripts, stealing some computing power and electricity to run the calculations required to "create" crypto-coins which are then sent to the attacker.

Also, several resources inside the network are often not protected at all (NAS backups, DLNA players, or even computer shares). The data on those is therefore free for the taking.


Trying to understand why signatures in root certs "are not used"? Taken from here:

  Don't worry if the root certificate uses SHA1; signatures on roots are
  not used (and Chrome won't warn about them.

Why are the signatures not used?
Are not root certificates vulnerable too?
Is there nothing that can be gained from breaking SHA1 to fake a root cert?

A root certificate is a self-signed certificate (by definition).

So how do you want to verify the signature of a root certificate? The root certificate is valid in itself, therefore you cannot verify it.

This is also the most problematic part of root certificates: they cannot be validated independently. If they are in the browser, then they are trusted.


Algorithm for HTTP flood attack detection I want to apply an algorithm on my Python script for HTTP flood attack detection. Main idea is to parse Apache logs to a MongoDB, but i want to extract only those lines that indicates an HTTP flood attack. Any idea please?

I would suggest using a tool that is geared towards log aggregation/parsing such as the ELK stack (Elastic search, Logstash and Kibana). After a couple of hours of research into the context and tools, you will be able to set up a logstash pipeline and a filter plugin that will suit your needs.

Parsing apache logs in particular is a very mature use case.

Regarding your specific question, some good generic starting points would be:

Detection of randomized subdomain requests ([gibberish].yourdomain.com), multiple and isolated requests targeted at a specific resource of your site (i.e an image, text file etc..)  coming from random IPs, abuse of forms present on your site (multiple requests to your target script) or abusive entries in fields that traditionally have processing attached to them (uploads of malformed/large files).

Considering the context of your question, I would suggest basing my PoC on a specific common design flaw or popular package vulnerability in order to illustrate the detection techniques that might be relevant.

Perform the following search on google and it will yield DoS vulns that you can replicate and have working exploits that you can build countermeasure against: "apache dos site:exploit-db.com".


How does an SSL server prove its identity? This document says that a challenge response authentication proves the servers identity. But is a man in the middle attack still possible if the client does not verify domain name ? Please help me understand this.

The SSL handshake implies the use of certificates; the server has a certificate which the client shall validate (with regards to its known trust anchors, aka "root CA"). The certificate contains a public key and the cryptographic algorithms used in SSL that the connection is secure in the following way:

The client knows that whatever data it sends and receive will be usable only by the server which owns the private key associated with the public key it received (within a certificate).
The certificate proves to the client that the said private key is owned (controlled) by some entity whose name is written in the certificate; for SSL, the name is a DNS name such as "www.example.com".

It is still up to the client to check that the name in the certificate is the name of the server that the client intended to contact in the first place.

Analogy: you meet someone who tells you that his name is Bob. You ask him to show you an ID card. Verifying that the ID card is a genuine ID card is not enough; you also have to check that the name on the ID card is indeed "Bob". Otherwise, Charlie could tell you "I am Bob" and show you his ID card with the name "Charlie".


What is the security risk with weak references? This interesting article talks about confidentiality concerns regarding weak references in languages with garbage collection.  But I didn't fully understand it.

  For code that can overtly sense what has been collected ... such observation opens an overt information leakage channel.

What kind of information could leak?

They seem to be saying that the "duration of an allocation" is one thing that might be detected.  How could that be used maliciously?

(By the way, I found the article in this question about potentially avoiding memory leaks by asserting garbage collection has occurred on specific objects.)

The linked article is speaking in very general terms because it is talking about a generic implementation of weak referencing in garbage collectors. They are stating the potential confidentiality issues because, at the abstract level they're working on, the specific types of side-channel attack which may be presented are entirely up to individual implementations.

For a start, it's important to understand what weak references do.

In a garbage collected system, the GC is tasked with clearing up objects which are no longer in use by the program. The detection of whether an object is in use is often implemented via reference counting, in which the program stores reference metadata alongside the object to aid the GC, incrementing and decrementing the reference counter as and when consuming objects and scopes enter and exceed their lifetimes. The traditional types of reference are usually called strong references.

A downside to strong referencing is that you can't observe an object without preventing the GC from disposing of it. For example, you may want to provide internal debug commands which display information about allocated objects within a collection, without creating a strong reference which causes the object to permanently sit on the heap until your program exits. This is where weak references are useful - they indicate to the GC that the program is still interested in the object, but that it is not strictly necessary for the object to remain. More importantly, they implement a procedure by which the application can check (or be notified) whether the GC has removed the object, and most likely some locking mechanisms which ensure that the GC cannot remove the object while executing code is directly operating upon the object.

The specific implementation of a weak reference falls down to the general memory architecture and type paradigms of the language, and the GC itself is often considered a black-box. Relying upon specific behaviour of the GC, outside of documented concrete behaviour, is poor practice for user code. However, as an attacker in a specific scenario, you have the benefit of being able to study the internals of the specific implementation in use and use them to your advantage.

As a theoretical example, let's say there's a GC whose disposal process for weakly referenced objects works as follows:

Is there memory pressure?
Have you disposed all objects with zero references, weak or otherwise?
Is there still memory pressure?
Prioritise objects which have not been accessed for a long time.
Prioritise objects which have fewer weak references.
Prioritise objects which are larger in size.

Now, if an attacker can detect that a specific object has been disposed (some GCs allow for user-defined finalisation code, which may leak the event externally in some way) then they would know that there was memory pressure, other objects may well have been cleared off the heap too, the object they know was disposed probably wasn't accessed for a while, it probably only had one or two weak references, and it may be larger than others on the heap.

This could be very useful information for a range of side-channel attacks, or even for coordinating other attack types such as timing attacks. It could also be useful when understood in the context of a specific application, e.g. if a weakly referenced object is only continually accessed while the user is present at the system, its disposal may well indicate that the user is not at their station.

The important thing to keep in mind, here, is that the vulnerabilities are theoretical, and the article is simply trying to get GC implementers to keep these issues in mind when designing weak referencing functionality.


What is considered an acceptable, secure method of remotely connecting to a Linux system? Given that VNC and X11 were not developed with security in mind, what do people typically see done to remotely connect to a Linux system where a GUI is required.  While SSH access alone might be preferred, often times there are requirements where a developer or administrator needs GUI access to a Linux system.

So far, I see the following solutions:

Require VNC to be used over a secure SSH tunnel. However, I would have to rely on the dev/admin to setup a tunnel every time
Use X11Forwarding. X11 was not designed for security, and additionally is much slower than VNC is.
Nomachine remote desktop. I have not played around with it yet, but they purport to be a secure remote desktop solution

While many people advocate setting X11Forwarding to 'no' in the sshd_config, it seems to me that this is the most secure native alternative. However, I am more than open to ideas from the security gurus out here!

NoMachine is more-or-less X11 over SSH with improvements in performance.  So the two benefits there are that SSH is managed for you and that you don't have the ghastly performance of X11 over a network.  (ISTR that SSH is not the default, but it's essentially a dropdown option, not a setup saga).

VNC also provides better performance than X11, and can be secured either over SSH or using one of the various hardened variants (like UltraVNC or RealVNC Enterprise or Personal).  However, the hodgepodge of variants and manual nature of SSH integration (e.g., TightVNC basically says "do it yourself") it's not the most coherent of solutions.

X11Forwarding ranges from bad to abysmal across the network.  It's essentially unusable across the WAN.  And that's not because of SSH, it's because of the way latency impacts the X11 protocol.  I wouldn't bother with it for that reason.

My personal advice is to look at NoMachine.  It's a much more coherent, solid product than *VNC, and having the SSH bit work is easy and integrated.


Convert customer tracking system from web access to REST Intro:In our company there is a service tracking website for our clients, where they can monitor the progress made in their cases with us. Our users are required to log in to that website (admin access) and update the milestones representing the percentage of the progress made. Whole tracking system is simple, built by a web company with PHP and some database system (not important to the issue)
What we need, though, is to automate this process. We have software (based on SQL server) that allows us to extract needed information, repack it into any format and transmit it to that tracking site without the need of any user action.

Problem: Users often forget to update tracking system. Or do it with delays. They are overworked, truth be told, so we (IT) want to make their life easier

Solution: Automate this process using data from our internal system and update tracking in real time.

Issues:

Me: SOAP?

Them: Out of the question. ISO 27001. Not secure.

Me: Encrypted? Static IP? VPN?

Them: Out of the question. ISO 27001. Not secure.

Other REST?

Out of the question. ISO 27001. Not secure.

Then what?

Some code just for you. Or mabye secured FTP.

Eeee?

What we really need to do to RDP in to see what you have so we can see what we need to extract and how to transmit it.

Oh. Get back to you then.

Sure

Context: Webdev/host company in question says that no unencrypted and not by authorized personnel is permitted, as they need to secure shared servers. So they will not expose them to direct outside access.

Now the question is: what is going on? I'm literally feeling dumb from all the emails and apparently communicating in a language one of us does not understand. Am I really toooo stoopyd to even ask proper question?

EDIT: I'm starting to think I'm talking to exceptionally bad account manager with humanist arts degree... "I want to send you some stuff using soap or basic rest or something". "No, we cant give you access to our secure servers but we may allow you to push something basic to our system".
Go figure...

Well, after several months of just repeating questions to get repeated answers we're moving to different provider. Suddenly REST, JSON and one IP only is secure enough for the other guy be simply ecstatic.

Thanks to all contributing in comments above - it's always good to know that there are people agreeing with you. And you still helped with asking same question in different, better way.


how to access freenet on a remote machine from android The goal is to use freenet on non-rooted android devices.

It is far out of my capabilities to actually port Freenet to android, but I am attempting to use and provide a functioning solution for android.

I was able to use "gnuroot debian" to install java and freenet on my device via command line.
w3m browser works for basic functions but it's not much good without images and video support.

Xterm seems to use too many resources and crashes / freezes the device.

The most promising solution seems to be to "Allow Freenet Remote HTTP Connections" as described here. https://old-wiki.freenetproject.org/InFrequentlyAskedQuestions

but I do not understand how to connect. what Ip would my android device have  and what ip would my virtual debian installation have. How would i make my regular android browser (firefox) access 127.0.0.1:8888 on the virtual machine? Is this method even possible?

How would you go about this?

Freenet works best on a machine that has good internet connectivity and can stay online as often and as long as possible. Mobile phones usually satisfy none of these conditions, and are often not particularly suitable to run Freenet on (although it is possible, as you have experienced).

I would recommend running Freenet on an always-online PC, and then use your Android device to browse Freenet using that installation. The safest way to go about this is by SSH port forwarding: SSH client apps like ConnectBot allow you to forward a local port to a remote destination.
An easier way is to configure Freenet to bind to the wildcard address 0.0.0.0 (relevant setting: fproxy.bindTo), and then limit access to only your phone or your local network by their IPs (relevant settings: fproxy.allowedHosts and fproxy.allowedHostsFullAccess).

If you insist on running Freenet on the same Android device as you'd like to browse Freenet with, your approach with GNURoot and Debian should work out of the box (that is, after installing a Java 7 or later, installing Freenet, and starting Freenet). Android apps and the GNURoot Debian share the same loopback interface: they can communicate over the 127.0.0.1 IP address as usual. As such, just start Freenet and point your browser to http://127.0.0.1:8888. If that doesn't work, consult wrapper.log and/or logs/freenet-latest.log in the Freenet installation directory for more information on what is happening.


How to import primary secret key from backup into GnuPG? I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1.

Even if I delete my entire ~/.gnupg and try the import again, I can't seem to get the primary key secret to import. I'm assuming no keys are being merged when starting from scratch, so I don't understand why this wouldn't work even on GnuPG 1.4.

My backup file does contain the private key:

➜  ~ gpg --list-packets master-secret-key.gpg
:secret key packet:
    version 4, algo 1, created 1459961571, expires 0
    skey[0]: [4096 bits]
    skey[1]: [17 bits]
    gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2
    protect IV:
    keyid: DBDE1E0253A3B420
...

Starting from scratch with an empty ~/.gnupg:

➜  ~ gpg --allow-secret-key-import --import master-secret-key.gpg public-key.asc
gpg: key 53A3B420: secret key imported
gpg: key 53A3B420: public key "Rodrigo López Dato <rodrigo@auth0.com>" imported
gpg: key 7C4C5564: public key "Rodrigo López Dato <rolodato@rolodato.com>" imported
gpg: Total number processed: 2
gpg:               imported: 2  (RSA: 2)
gpg:       secret keys read: 1
gpg:   secret keys imported: 1
➜  ~ gpg -K
/Users/rolodato/.gnupg/secring.gpg
----------------------------------
sec#  4096R/53A3B420 2016-04-06
uid                  Rodrigo López Dato <rolodato@rolodato.com>
uid                  Rodrigo López Dato <rodrigo@auth0.com>
ssb   2048R/00E7B480 2016-04-06
ssb   2048R/7D9F38D2 2016-04-06

sec# means the private master key wasn't imported, why is that?

FWIW, I need the master key to generate a revocation certificate and to eventually renew my subkeys once they expire. If there's a way to do this from the backup directly without needing to import it, that would work too.

The file you're trying to import does not contain the actual private key, as indicated by this line in the output of gpg --list-packets:

gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2

The special "dummy" S2K algorithm is applied when GnuPG actually exported a secret key stub to still enable using secret subkeys, but having an offline primary key (on another computer, a disconnected thumb drive, an OpenPGP smartcard, ...). This key stub is also what you observe in the --list-secret-keys/-K output:

sec#  4096R/53A3B420 2016-04-06


How does a JWT refresh token improve security? I've recently learned about JWT tokens, but I don't understand why I need them. Considering:

HTTPS is enabled, thus the access token can't be stolen along the way. it's encrypted.
If at anytime, the hacker finds a way to read incoming JSON responses from the server, then he can steal both tokens, since the access and refresh tokens are in the same response.

{status: "success", access: "abc", refresh: "def"}

if at anytime, the hacker finds a way to read user's requests to the server, then the same is true: access and refresh tokens are sent in the same way (request headers), so if you can steal access token, you can do the same with refresh.
if at anytime, the hacker finds a way to read the local storage of the user, then, same again, access and refresh tokens are saved in  the same place (client's device), so the hacker can steal both of  them.

So how does refresh tokens provide any extra security? Are they required?, and if no, how secure is  it to  use JWT Access tokens only, with long expiry dates (e.g. 3 months).

tl/dr: They key difference is that, unlike the JWT, the refresh token can be
revoked.  This allows it to have a longer liftetime and fill an important need in the JWT "ecosystem".  Also, I think it is a little unusual to have both access and refresh token on every request/response.  They should go to separate places.

The reason for short-lived JWTs
Imagine a JWT with a 3-month lifetime.  During normal usage there is no option to revoke a JWT.  Therefore, if the JWT is stolen, then the attacker will be able to act as the victim for 3 months (or however long is left on the token lifetime at the time of theft).  This is why the JWT lifetime is kept nice and short.
The problem with short-lived JWTs
However, because the JWT is intended to have a short lifetime, getting a new JWT becomes an issue.  If the JWT only has a lifetime of, say, a day (or even a few hours), then you need some way to automatically get a new one.  Otherwise you will drive your users away because they are going to be irritated when they have to log back in to your site a few times a day.
Refresh tokens: the solution to short-lived JWTs
That is where the refresh token comes in.  It can be used to generate a new JWT automatically.  Therefore the refresh token's job is to log the user back in automatically so they don't have to put their password back in everytime the JWT expires.  This makes life convenient for the user and gives a good balance between security and usability.
Securing long-lived refresh tokens
But why is it safe to have a refresh token that can last for months when the JWT can't?  The answer is simple: It must be possible to revoke the refresh token so that the server no longer accepts it and won't issue new JWTs to someone who has it.  This way if an attacker gets a copy of the refresh token it can be revoked, and the attacker will lose all access as soon as their short-lived JWT expires.  Therefore you would invalidate all refresh tokens for a user in response to security events: if the system suspects a stolen refresh token, if the user changes their password, if the user changes their email, etc...
In essence, revoking refresh tokens is how you force a user to logout, which is something that is not possible with "standard" JWTs.
Bringing it all together
Finally, for the sake of completeness, the refresh token is revokable and the access token isn't for (typically) performance reasons.  JWTs allow systems to validate user access without having to actually check a database or even have access to the user "table".  This can be important for performance or, if nothing else, ease of development.  A microservice that doesn't need database access is much easier to manage that one that does.  Therefore your microservices can work with stateless JWTs exclusively, and then you can have a separate Auth server that manages the status and revokation of refresh tokens and JWT generation.  In some cases this can be a convenient separation of concerns.
Finally, I think it is a little unusual to have both JWT and refresh tokens on every request and response.  There may very well be systems that do that, and they aren't necessarily wrong, but typically the JWT goes along with every request for authorization/authentication, and the refresh token is only ever sent to the Auth server to get a new JWT.  However some may send both always to alleviate some work for the client, as the backend services may use the refresh token as needed to get a new JWT and send that down to the client, so that the client doesn't have to manually refresh it.


End-2-End and server to server encryption over home network I am setting up a private home management system containing several daemons/servers and a few clients to connect from.

I am trying to achieve end-to-end encryption with the most monitoring and health check processes I can in order to create trust in this homemade system.

Tl;dr:

I want to ensure the authenticity of every ongoing connections to each independent modules. Avoiding MitM and losing track of transitting data. At any point, the data should keep its integrity and be protected from any alteration unless ordered by an authenticated session.

Storyboard

Architecturally speaking, here's what I have in mind:

A shell client, an admin GUI (web), and a mobile app can connect to my home network.

To connect, the first step would be an auth server that generates a session.
Then, the session would be spread among every module in the home network (talking about a few raspberries plugged here and there).

Once the session is created, the client (either shell, web, mobile) can interact with a Command & Control main hub, which then spreads the commands and fetches information to and from every other module (raspbpies)

The modules do not need to communicate with each other, but they all, independently should communicate with the Command & Control hub.

To communicate with C&C, each module should once be registered and given an API_KEY

Now here's how I would try and secure it:

Web/Shell/App Connection: 2 step-auth (Basic + HOTP)
Client -> Auth Server: HTTPS TLS
Auth-Server -> Command & Control hub: Session related JWT

C&C -> Modules

As those modules should not be reachable through the internet, I was thinking of generating a session-related RSA keypair between C&C and each module to authorize the connection.

Maybe, the keypair could be generated from the API_KEY provided by C&C.

The modules would send needed information to C&C, which will then be delivered to the logged-in client.

I would appreciate if you could point my mistakes or point me to other useful resources that I may have missed.

Additional note: Most (if not all) daemons will be nodejs processes

You could setup a Kerberos server on one of your Raspberry Pis. It would achieve secure authentication with all your clients. The best part about kerberos is that it is supported by a large number of clients and daemons. You will easily find APIs for integration in almost all popular languages and Operating Systems.

SSH and web servers are kerberised in a straightforward manner with a handful of commands. For APK modules (mobile apps) you can use the Java API (see here) or any other libraries which provide a wrapper interface to kerberos.

I'd written an article about setting up such a server here, you may find it useful since it was setup using a Raspberry Pi. Also refer to this excellent guide giving an overview of all possible ways to integrate kerberos within apps.

In addition to the kerberos server, the same raspberry pi could also serve as a RADIUS server, an NTP server and a common syslog server to gather all the logs of all the daemons across your network. But ensure that you harden it properly. If you need good redundancy, the entire setup can be mirrored very easily as all these protocols natively support mirroring.


Hashing a large file on an embedded system I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is that the file size might be too large to load it into a buffer and pass it to the hashing function.

When searching online, I came across this answer (https://crypto.stackexchange.com/a/19805) that talks about computing a hash tree instead of a hash for the whole file.
Is this a valid approach? Does anyone have any advice for doing this in a different way?

As long as you receive the file in order from beginning to end, you can calculate the hash incrementally. Any cryptography API that's suitable for embedded systems (and most of the ones that aren't) lets you calculate hash by passing successive chunks of the input. Each time you've received a chunk, feed the input to the hash calculation and append it to a file. When the transmission is over, finalize the hash calculation, and erase the file if the hash is incorrect.

Note that a hash can only verify the integrity of a file, not the authenticity. This means that the device needs to know the hash value in advance, so you need to transmit the hash through another channel. This is typically done by using a slow, but trusted channel to transmit the hash (e.g. end-to-end TLS to a trusted server), and a channel with more bandwidth but less security for the file itself (e.g. a broadcast mechanism).

A hash tree is only useful if you need to be able to verify parts of the file independently without having to retrieve the whole file. If you're getting the file sequentially and fully, it isn't useful.


How can I report an ecommerce site in violation of security practices? I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. The information displayed shows email address, full billing and shipping address, and products ordered with the amount.

The site has badges on the bottom claiming "Paypal Verified", "Authorize.net Verified", "Sitelock Secure", "Google Checkout" etc., yet I cannot find out how to report such an obvious data/security breach to any of these companies. How and who should I report this to, to get the website owner to take the matter seriously?

The following questions on this site may be of interest:
Best way to alert a website owner of a vulnerability?,
How to disclose a security vulnerability in an ethical fashion?,
Reporting vulnerable sites.

Here are some security contacts for some of the companies you named:

Paypal: sitesecurity@paypal.com  (really intended primarily for security issues in the Paypal site, though, not third-party sites)
American Express: Amex Enterprise Incident Response Program (EIRP): 888-732-3750 / EIRP@aexp.com.  (really intended primarily for merchants to report a security breach of their systems, though, not for fourth-party reports of vulnerabilities in third-party sites)
Google: security@google.com (really intended primarily to report security problems in Google products, though, not third-party sites)

Be prepared that most likely none of these parties will act on your complaint.  If I were you, I'd report it to the site, and if they brush you off, well, you've done your duty and there's not much more you can do -- apart from taking your business elsewhere.  Sucks, but that's how it works.


What's the best length for randomly generated passwords? (Security vs. compatibility) It's generally recommend to use a unique password for each online service, a random password generator to create them and a password manager to store them.

I've started to replace all my online passwords with this technique, but some sites have certain rules regarding the length of a password.

Unfortunately, sometimes, a website will not be programmed to communicate the number of maximum characters allowed and simply delete the overflow if copied into the password field. Because of this, I've already had some trouble getting control of an account back, since I did not know how many characters were saved as the password.

Is there any specific number of characters that will probably work on most sites/backend programs and that is still considered relatively safe for randomly generated passwords, so that I can just use one password generator length setting for as many sites as possible?

If your passwords are n characters randomly drawn, with equal probability, from a set of 95 characters (which is about all the ASCII printable characters minus space), then each character gives you about 6.6 bits of entropy, so the strength of a random password with n characters is 6.6 × n.  So:

A 10 character password gives you about 66-bit strength;
A 12 character password gives you about 79-bit strength;
A 14 character password gives you about 92-bit strength;
A 20 character password gives you about 132-bit strength.

In my judgment, you could sensibly choose any of these lengths depending on the application.  For example, if you use a 66-bit password for a low-value online service, your password will still be loads stronger than nearly everybody who uses that service.  But if we're talking about a password that's used to derive an encryption key on software that you run on your own hardware, you should certainly consider something stronger.

To add some additional thoughts, it pays to consider two kinds of attack:

An attack targeted at a website (or other password-protected service) that you've enrolled in;
An attack against you specifically.

In scenario #1, the password cracker is going to divide their computational power to cracking as many users' passwords as they can, in the hopes of finding the low-hanging fruit—users who have very weak passwords.  I believe a 64- to 80-bit password is plenty to defend your passwords against such attacks.

In scenario #2, the attacker is going to dedicate all their computational power to cracking your password specifically.  In that case, a powerful adversary might (or might not!) be able to crack a 66-bit password, and you could therefore justify going as far up as 19-20 characters (to match the 128-bit security strength of most ciphers).

And always keep in mind that if your password is strong enough, that just means the #2 attacker is going to probe a different weakness.  Don't bother making your password inconveniently strong if you've got big holes elsewhere.


Is there an issue if application responds with access control allow origin * but there is no allow credentials header? Since application is not responding with allow credentials header, an attacker can't craft cross domain request with cookies, but I was wondering if allow origin * alone (Without credentials being true) can be exploited?
I know allow origin can't be * if allow credentials header is true, what am asking is that is this alone a flaw, is this exploitable in any way?

No, if the server's API follows REST principles (which it should).
If in a fetch with GET you set credentials: "include" then the request will be performed and credentials will be included. But:

response's content won't be made available to the browser when either Access-Control-Allow-Origin: * or Access-Control-Allow-Credentials: false (or if either of them is missing). So the client won't be able to read the response even if the server responded with something user-specific.
since this is a GET request then the server shouldn't do anything state-changing (this is the "follow REST" part)

Using POST, PUT or DELETE in a cross-origin fetch with credentials: "include" will require a preflight request beforehand -- to ask the server if these methods are allowed to be performed with credentials. So if the server does allow credentialed state-changing requests then it must reply to the preflight with headers Access-Control-Allow-Origin: https://the-clients-origin.com and Access-Control-Allow-Credentials: true.
(There is a slight exception to the previous for POST requests with content-types either application/x-www-form-urlencoded, multipart/form-data or text/plain. These are there for cross-origin form-submit handlers (someone correct me on this).)
Read more on MDN: CORS: Simple requests or Fetch specification.


Are online hash calculators dangerous? I was about to use an online MD5 checksum calculator when I realized that my result could be added to a database. This is significant because the string I was going to type in was my bank password.  Could online hash calculators be dangerous?

Potentially yes, the hash could indeed be stored in a database for malicious use.

Never input your password into a third party website unless you trust the provider of the service AND the service is using some sort of authentiation/encryption scheme(SSL, HTTPS).

You could easily generate your own hashes on your own system, using MD5 libraries of various programming languages.


How does separating concerns into separate processes (without enforcement) help security? In this talk on privilege separation, Theo de Raadt explains that OpenBSD's ntpd has a master process which calls settimeofday(), a DNS process responsible for querying DNS servers, and an NTP protocol process which is responsible for speaking UDP to NTP servers. He has this to say about the DNS process:

  The other thing we've got is a separate DNS servicer process, cause we wanted to be able to do DNS, but we didn't want the master process to do it because DNS libraries sometimes have bugs, and we didn't want the internet speaker to do it because... it's... it just didn't make sense.

Let's assume that pledge doesn't exist (this design predates it, as I understand it). Obviously this design is pretty pointless on its own, as if the network-facing service is compromised the attacker has root on the system. Therefore, the master process will fork both subprocesses, which will immediately drop privileges to nobody or something. That way, if there's a security bug in either the DNS library or the NTP code, the attacker doesn't have write access to system file, home directories, etc.

That all makes sense to me. However, what I don't understand is why the separation between the DNS and UDP processes is useful. It doesn't matter which one is compromised; the attacker is running as the same user either way. You could put the DNS process in e.g. a nobody2 user, but even then, nobody2 will be just as unprivileged as nobody.

With pledge, the benefit is obvious since e.g. the DNS process can pledge that it will only make DNS queries, which will be pretty damn useless for an attacker. However we're assuming that pledge isn't a factor since this design was introduced before pledge.

Is there any security benefit to the three-process ntpd design that I'm missing? Or was it just a design decision unrelated to security (perhaps considering the possibility of a future pledge-like system)?

(Note that I know nothing about the design of OpenBSD ntpd, I'm just answering the generic question about separating processes.)

From your quote, I gather that the separation the UDP process from the DNS process was not motivated by security concerns, but by architectural concerns: “because... it's... it just didn't make sense”. The UDP process and the DNS process react to completely different events. If they were in the same process, they'd use separate threads (either explicitly, or implicitly with an event loop around a select call). Since the UDP process and the DNS process operate independently, putting them in the same process would complicate the design, hence by default they are in distinct processes.

If the NTP server had been designed as a single process then the design would have had to accommodate the different interaction patterns of the subsystems. Then threads would have made sense. But if there's process separation anyway, then grouping unrelated subsystems in the same process complicates the design.

Nonetheless, there can be security benefits from having separate processes. One benefit is that not all exploits allow the attacker to execute arbitrary code. Some exploits only allow localized data corruption, or the exposure of some secret data, or can cause a crash but always in a controlled way (e.g. only a null pointer dereference and not an arbitrary pointer dereference). Even if a vulnerability does allow arbitrary code execution, sometimes writing an exploit is complicated, and making exploits more complicated buys the defender time to fix the bug and deploy the updates.

Even if a vulnerability allows arbitrary code execution in a process, OS-level mechanisms might confine the process. Even before pledge, OpenBSD allowed an OS-wide restriction on ptrace, which should be enabled on a production server. A process running as nobody can't directly harm other processes if it can't ptrace them. The attacker would have to find some indirect means, and while opportunities for DoS abound, a breach of the DNS would not allow the attacker to generate fake NTP traffic, for instance (it wouldn't be able to bind the port).


Is fileless malware is a new type of attack or the media just bringing them now more to our attention to promote sales of related "new" solutions? I feel there are so many articles talking about fileless malware, so I was trying to understand is it a new type of attack or those articles are just kind of promoting new cyber solutions?

Fileless malware has been around for years. It is nothing new. Any malware that runs in memory is considered "fileless".

The common media also has the misconception of thinking that a malware running from the Registry is fileless. Since the Registry is written to the disk inside Registry hives, it isn't really fileless. Same thing for malware that uses WMI.

Real fileless malware is malware that simply lives in a process, in the memory of an hijacked process (since if it was launched from its own image, it wouldn't be fileless, as it would have a trace on the disk). You can think of it as a malware doing process injection, and then deleting itself from the disk, only staying alive within the process that hosts it. As an example, executing a malicious script via PowerShell can be considered fileless.

As for detection, security products have also been able to detect fileless malware for a while now. Powerliks, GootKit and Kovter are examples of fileless malware, according to media's description of the concept.


Preventing/Detecting forgery of logs generated in a potentially hostile environment I have an application that runs on some host machine and generates logs. Later in the day those logs are securely transmitted to my machine.

The problem is that while the logs are being generated I dont have any access to the host machine whereas some users have full access to it and may want to forge the logs to their benefit. Is there a way to detect (or better yet prevent) such forgeries.

The log generating application may be modified to encrypt or insert MACs in the logs but encrypting/signing keys have to be on the same machine. Given that the malicious users may also have access to source code of the application, how do I go about protecting those keys?  Or are there other better techniques to tackle this scenario.

TIA

If you run a service on a machine you don't trust, it will only generate results you cannot trust.

Even if you authenticate the logs somehow, they can change the log anyway, because they have access to the sourcecode. I assume you use some interpreted language (PHP, Python, Ruby) on the application.

One way to have secure logs is to send the entries offsite as soon as they are generated. Write the logs on a local file, but at the same time send them to your trusted server. A web service will be nice.

It won't prevent the malicious users to forge log entries and send it to you, but will make impossible to them to change the logs on your trusted server. If you send the logs using SSL, they cannot change the logs on-fly.

Later you can compare the consolidated received logs and the logs sent by the web service to see if they match.


Wireshark Trace containing SSL RSA with RC4 128 md5 I thought it'd be a neat idea to do a wireshark capture on my own login to a website and try to figure out where the packet containing the password is and decrypt it.

So I logged into a website which uses SSL RSA with RC4 128 md5 to encrypt the password. I'm not asking for someone to tell me exactly what to do, that would be great, but I'd like some tips on how to find it and how to decrypt it.

(I already know the plaintext password since it's my own, but of course, it's not in plaintext in the wireshark trace)

I have got the standard MD5 hash of my password and I tried to find it in the trace, but it doesn't show up. I don't know how the SSL RSA encrypts the password, so I'm not sure what I'm looking for exactly.

Thanks in advance.

Ooops !!! You cannot do that .

Why ?

You cannot Decrypt the wireshark dump without having the Private key corresponding to the server's ssl certificate.

If you do have the SSL certificate's corresponding private key , then with the latest wireshark .

Goto Edit-> Preferences -> Protocol -> SSL --> RSA KeysList -> Edit , provide the server IP , Protocol as HTTP and the SSL PFX and its password and click APPLY and OK .


How does end to end encrypted emails work? I was thinking about this concept and realized that when a user is decrypting an email on the frontend of the email service, won't the server theoretically be able to "see" the private key and the decrypted contents?

Like, once the email is fully decrypted and the user can see its contents, since the contents are just text which are in a UI which is hosted on a server, cant the server theoretically see the contents (or if the owner of the servers had intent to see the emails)?

Thank you

Whatever can decrypt can get hold of the plaintext. For encrypted email that includes "the server" or not, depending on the setup, which is not clear in the question.

With what we can imagine of the setup, for sure the plaintext is available not only to the user, but also on the screen, and in the computer connected to that. The plaintext is thus vulnerable to whoever can see the screen, tap its cable, penetrate the user's computer, or decide the programs it runs in the first place. That minimal chain of trust needs not extend to "the server" (as in say an IMAP server on which the emails are stored at rest), but it can extend to that, and sometime does. The question does not allow to tell, in particular because it does not specify what "the frontend of the email service" is.

The conceptually simplest and (thus) safest way to practice email decryption is that it is carried on the recipient's own trusted computer, which is the only machine using the user's private key. In this case "the server" can not see the decrypted email. In the basic form of that, encrypted email really is a an attachment, extracted and deciphered by a local program (e.g. GnuPG), and displayed. That can be integrated in the email client program (e.g. Thunderbird, or Outlook-the-user-side-program), perhaps thru a plugin. And that can be integrated in the email syntax so that the encrypted email does not appear as an attachment. Each step away from simplicity comes with potentially decreased security; that's one of the lessons of efail (archive; main site is currently down, because security is hard to conciliate with functionality).

Setups in which the server can intercept the decrypted email include anything where the user interface is a standard web browser. Adding a plugin handling the decryption locally with a local private key, perhaps a Smart Card or Trusted Platform Module can be a step in the right direction; but that might also be mere security theater if the software orchestrating the flow of information comes from the server: the server can still send a modified software that will give access to the email. In practice, whatever can decide how decryption is performed can get hold of the plaintext (with few exceptions not found in common practice: like there is a data diode in place to prevent the decrypted plaintext to flow back to the server).

When the user is using a web browser or a dedicated program of unknown origin and closed design or/and source, it is in practice next to impossible to tell if "the server" can get the decrypted email, thus the rational action is to consider that possible.


How can I change this new MAC address? I have successfully changed my MAC address using macchanger from XX:XX:XX:XX:XX:XX to YY:YY:YY:YY:YY:YY. I executed ip neigh on Kali Linux and  got this output: 192.168.0.1 dev eth0 lladdr ZZ:ZZ:ZZ:ZZ:ZZ:ZZ STALE. I am using a Modem Router. I want to know where this new MAC address is coming from and how I can change it.

That IP is another device on the network and, based on its IP, I suspect it's the gateway. You can't change that MAC from your Kali box, you'll need to do it from the device broadcasting that MAC.


How to find out what programming language a website is built in? I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in.

I know that URL extensions, HTTP headers, session cookies, HTML comments and style-sheets may reveal some information but it's still hard and not assured.

So I was wondering: is there a way to determine what technology and framework are behind a website ?

There's no way to be 100% sure if you don't have access to the server, so it's about guessing. Here are some clues:

File extensions: login.php is most likely a PHP script.
HTTP headers: they may leak some information about the language which is running on the server, and some additional details like the version: X-Powered-By: PHP/7.0.0 means that the page was rendered by PHP.
HTTP Parameter Pollution: if you managed to guess which server is running, you can refine the guess.
Language limits: maximum post data, maximum number variable in GET and POST data, etc. It may be useful if the webmaster kept the default values.
Specific input: for example, PHP had some easter eggs.
Errors: triggering errors may also leak the language. Warning: Division by zero in /var/www/html/index.php on line 3 is PHP, for example.
File uploads: libraries may add metadata if the file is being modified server-side. For example, most sites resize users' avatars, and checking for EXIF data will leak CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), default quality, which may help to guess which language is used.
Default filenames: Check if / and /index.php are the same page.
Exploits: reading a backup file, or executing arbitrary code on the server.
Open source: the website may have been open-sourced and is available somewhere on Internet.
About page: the webmaster may have thanked the language community in a "FAQ" or "About" page.
Jobs page: the development team may be recruiting, and they may have detailed the technologies they're using.
Social Engineering: ask the webmaster!
Public profiles: if you know who is working on the website (check LinkedIn and /humans.txt), you can check their public repos or their skills on online profiles (GitHub, LinkedIn, Twitter, ...).

You may also want to know if the website is built with a framework or a CMS, since this will give information about the language used:

URLs: directories and pages are specific to certain CMS. For example, if some resources are located in the /wp-content/ directory, it means that WordPress have been used.
Session cookies: name and format.
CSRF tokens: name and format.
Rendered HTML: for example: meta tags order, comments.

Note that all information coming from the server may be altered to trick you. You should always try to use multiple sources to validate your guess.


How to completely remove all traces of a file on Linux? (Overriding everything if needed) How can I delete a file and completely remove it from the system FOREVER. I does have in mind that it's needed to override it. But how can I do that?

Install scrub (secure erasing tool) and bleachbit (slack space scrubber)


Some folders in the PATH variable are writable by anyone. Dangerous or not? I noticed that some folders in the PATH environment variable (e.g. C:\Python) give write privileges to anyone on the machine, including users without Admin rights. I understand that people can probably modify the Python executables and things in that folder. However, how dangerous is it if I don't use Python? Also, since most programs on Windows are called either through GUI or with absolute paths, could this issue still affect other more sensitive folders in PATH such as System32?

How dangerous is it if I don't use Python?

Your usage of Python is irrelevant to the risk.

The PATH variable provides a means to invoke programs without having to type in their full path. While Unix people would consider putting a publicly writable directory (or .) in the PATH variable a cardinal sin. The risk is that an attacker can substitute the program a user intends to run with their own evil code and thereby trick the victim into running it.

On MS Windows the risk is lower but its more difficult to mitigate:

most people don't use command lines in MS Windows
usually programs are started from the explorer which uses a full path to the executable
MS Windows always searches the current directory first before checking in %PATH% for an executable (i.e. the risk is baked into MS Windows by design)


In Tor, why are the middle and exit relays changed periodically but not the guard relay? In Tor, middle and exit relays are changed periodically and are chosen from a available relays, what is the reason behind it?

Why the guard node isn't changed that much frequently? Isn't it a highly sensible relay in the circuit as if this is compromised, then the whole circuit can be compromised according to my understanding?

To answer your questions, please let me correct the first misunderstanding. If the guard relay is compromised, the whole circuit is NOT compromised. Guard relay can only identify the IP address of the client which established the circuit, but it cannot identify the server are you communicating with, nor the content.

This explains the guard design - here is the document about it - and answers your second question. To quote the main reason:

  If you choose new relays for each circuit, eventually an attacker who
  runs a few relays will be your first and last hop. With entry guards,
  the risk of end-to-end correlation for any given circuit is the same,
  but the cumulative risk for all your circuits over time is capped.

This means the following: let's assume an attacker controls one guard relay out of ten, and one exit node, and thus can do traffic correlation between them. If there are 10 users of the site, and they change the guard relay often, in a day they change all ten guard relays, and the malicious guard relay will know about all of them. But if the guard relay is not changing, the attacker will only know about one of them at the end of the day. This raises the cost of attack to an attacker significantly.

Now the first question. The main reason circuit changes (once in 10 minutes) is to prevent profiling. If the circuit is used long enough, a malicious exit node operator will be able to correlate your activities on different web sites and reasonably find out who you are, even though he wouldn't know your IP address. Changing the circuit prevents this.


How to intercept requests/responses from Smart Phone while surfing internet? I have used Burp Suite Penetration testing tool in my computer to intercept requests.Assume that I am using Smart Phone. So Is it possible to intercept my smart phone requests into my computer?

Yes, you can use a router along the way to redirect traffic from your smart phone to Burp suite on your computer.

For example, you can use IPTables REDIRECT target to send it to a local port if you're running an access point on your Burp system to set up a transparent proxy. You can configure a local access point, or connect a router via ethernet and let it provide wireless, getting the traffic naturally through.

Another option if you already have a router setup and don't want to have the router go through your laptop is to intercept requests and send them over an SSH tunnel.

Of course, you can also get traffic via any other man-in-the-middle technique, like ARP poisoning, it's up to you how you'd like to redirect traffic to the Burp workstation.


So is the phone without BLE vulnerable before BlueBorne or not? It is already known that BlueBorne poses no danger to Android-devices
  using Bluetooth Low Energy. For other cases, there were updates that
  were included in the September Android Security Bulletin.

My phone does not support BLE. - then it is vulnerable?

  Users of Android devices can check their gadgets for vulnerabilities through a  special application BlueBorne Vulnerability Scanner by Armis, already available in the Google Play catalog.

Checked through this scanner. I get that the phone is invulnerable. Confused...

Not sure why you are confused.

It only attacks via Bluetooth, not Bluetooth Low Energy, but that info doesn't matter to you as your phone does not have BLE.

What matters is if the Bluetooth firmware and config are vulnerable.

The scanner says you aren't vulnerable, so you are probably not vulnerable.


Rogue network printers as an attack vector in windows I recently installed a new printer in our network. Just because I was interested, I switched to wireshark when scanning for and adding the printer on windows. I noticed that it was discoverd through mdns and then instructed windows to download some drivers in form of dll files. Now I wonder: What if I would setup a rogue udp server that listens for mdns queries and then responds with a fake printer service that sends malicous dlls to windows hosts. Since they are automatically "installed" (and executed?), it would provide a very good way into a system. I also wonder how one could fix this (issue?) without breaking the comfort this feature gives users.
I tried to setup a socket that listens for mdns queries to respond to in python3, but cannot get it to work. And before wasting much more of my time. I figured I'll ask about this attack vector here.

Windows only automatically installs drivers that have been digitally signed. Unsigned drivers, drivers that have invalid signatures and drivers that have been signed by untrusted publishers are not installed automatically. Instead, if the user is an Administrator, they are given a warning message informing them that the driver is unsigned or has been altered (and then are given the option to quit installation or continue anyways). Standard users are not given any option and the driver is not installed.
So to successfully install a driver the way you suggest, you would either have to compromise the private key of a vendor that Windows trusts, or somehow manage to get your own certificate onto Windows list of trusted publishers.


Is Tomcat vulnerable to "Ghostcat" (CVE-2020-1938) via mod_proxy_ajp? Is it possible to exploit the "Ghostcat" vulnerability (CNVD-2020-10487/CVE-2020-1938) indirectly over mod_proxy_ajp?

I was able to successfully test the proof-of-concept exploit (https://www.exploit-db.com/exploits/48143) when targeting my Tomcat's AJP port.  However, my tomcat instance is not directly externally accessible, but rather sits behind an Apache reverse proxy via mod_proxy_ajp.  Am I safe from external Ghostcat attacks in this instance?

As a test for indirect exploitation, I sent an HTTP GET request targeting my Apache front-end which proxies to the Tomcat AJP port, and I set the following HTTP header:

req_attribute: javax.servlet.include.request_uri=/, javax.servlet.include.path_info=WEB-INF/web.xml, javax.servlet.include.servlet_path=/

I also tried variants of this header such as using semi-colons as a delimiter instead of commas, as well as having multiple req_attribute headers for each key,value pair on a separate line.

Fortunately, the body of the HTTP response did not dump my WEB-INF/web.xml file, therefore these indirect exploit attempts failed.  Upon further inspection with tcpdump, I see that these req_attribute headers do not get encoded to AJP's format of using a single byte (0x0a) to denote req_attribute.  So it seems that the HTTP ASCII request headers do not translate into AJP's binary request headers.  Therefore I believe that the vulnerability is non-exploitable through HTTP requests that get passed to mod_proxy_ajp, is that correct?  Or is there a clever way to craft an HTTP request that would make mod_proxy_ajp pass along the req_attribute headers in AJP's binary format in order to indirectly exploit this vulnerability?

It is unlikely that this vulnerability could be triggered via mod_proxy_ajp.  It can be generated by setting the relevant AJP attribute as an environment variable with AJP_ prefix on Apache.  As below.

SetEnvIf Request_URI .* AJP_javax.servlet.include.path_info=WEB-INF/web.xml


How secure is Microsoft's Windows 7 SChannel implementation of TLS 1.2 out of the box? Theoretical question: Is there any reason that a client could not securely use Microsoft's Windows 7 SChannel implementation of TLS 1.2 "out of the box", as in with no updates? Having looked at SChannel vulnerabilities on the NIST National Vulnerability Database, it seems there are at least 5 known ones:

CVE-2014-6321 a.k.a "Winshock"
CVE-2015-1716
CVE-2015-6112 "Triple Handshake Attack"
CVE-2015-1637 a.k.a "FREAK" attack
CVE-2010-3229 "TLSv1 DDOS Vulnerability"

However, it seems if you implement TLS v1.2 in the correct manner you can avoid these issues (although I could be and probably am completely wrong here). Again, this is just a theoretical question but stems from a conversation about utilising TLS 1.2 on a Windows 7 system with as little updates and dependencies as possible and no open source libraries.

... it seems if you implement TLS v1.2 in the correct manner you can avoid these issues ...

Some of the CVE you've listed is that TLS 1.2 wasn't implemented in the correct manner, contradicting your assumption. For example Winshock is an implementation problem which remote code execution on the TLS server side. Others are problems in the standard itself, i.e. the triple handshake attacks works even if the standard is correctly implemented.

Which means that an unpatched Windows 7 is vulnerable to these attacks, no matter if TLS 1.2 was correctly implemented on the system (which it wasn't) or not.


PSD2 compliant two factor authentication According to PSD2 the elements of the multi-factor authentication must be independent so the compromise of one element does not compromise the other.
Here is the article from the directive:

*Article 9
Independence of the elements,

Payment service providers shall ensure that the use of the elements of strong customer authentication referred to in Articles 6, 7 and 8
shall be subject to measures in terms of technology, algorithms and
parameters, which ensure that the breach of one of the elements does
not compromise the reliability of the other elements.
Where any of the elements of strong customer authentication or the authentication code is used through a multi-purpose device including
mobile phones and tablets, payment service providers shall adopt
security measures to mitigate the risk resulting from the
multi-purpose device being compromised.
For the purposes of paragraph 2, the mitigating measures shall include each of the following:
(a) the use of separated secure
execution environments through the software installed inside the
multi-purpose device;
(b) mechanisms to ensure that the software or
device has not been altered by the payer or by a third party or
mechanisms to mitigate the consequences of such alteration where this
has taken place.*

The question is what could be considered independent in this case?
Let's imagine the following scenario:
The customer uses his/her phone's browser to access the online banking website.  Password and another element (based on possession) is required for authentication.
In case the second factor is a one-time-password sent via SMS to the phone, a single malware is enough to compromise the phone, install a keylogger to steal the password, and steal the SMS as it arrives.
Based on this OTP via SMS is a no go.
Now let's suppose the SMS OTP is replaced by a push notification (the customer should install the Bank's mobile application previously). There are few possibilities for the exact implementation:

an OTP is sent via push

a approval window pops up and the user needs to tap on the approve button (just as Google does it)

a CAPTCHA pops up and the user needs to solve it

OTP generation with soft token

etc.

In case of any of the above mentioned solutions, if the attacker could exploit a vulnerability in the phone's OS and gain root permission, he is able to steal the customers password and validate the transaction with the second authentication factor at least theoretically (by installing some kind of remote access tool).
Hard tokens are a no go as well because of user experience reasons.
Could the separate sandbox which is used by both Android and iOS considered as a secure execution environment which would meet the following part of the directive?

The use of separated secure execution environments through the
software installed inside the multi-purpose device

What could be an effective solution which meets the regulation and is also convenient for the customer?

tl;dr; Nobody can say for sure and this is highly debatable

Little history: there was a change from "trusted execution environment" to "secure execution environment". It is documented here: https://www.eba.europa.eu/documents/10180/1761863/Final+draft+RTS+on+SCA+and+CSC+under+PSD2+(EBA-RTS-2017-02).pdf

Most of the industry (that I know of) agrees that this implies hardware based TEE is not a requirement.
There are some reasons provided in that document:

  Article 6(2) (now Article 9(2)) does not refer to segregation, only
  Article 2.2.b does. See comments [10] and [11] on that. The EBA has
  therefore not made any changes to the Article. However, in relation to
  comment i), the EBA agrees that PSPs can mitigate only the risks
  within their realm of competence. The EBA has made changes to Article
  6(3) (now Article 9(3)) to specify that the focus is on the software
  used by the PSP rather than the hardware itself.

EBA refused multiple requests to be more specific on how to achieve execution environments separation. From this we can understand that you should care only about proper software implementation, but what does that mean? Lets dig deeper.

There is this older document with some less vague language:
https://www.eba.europa.eu/documents/10180/1548183/Consultation+Paper+on+draft+RTS+on+SCA+and+CSC+%28EBA-CP-2016-11%29.pdf

  Furthermore, the authentication procedure should ensure the confidentiality, authenticity and integrity of the information
  displayed to the payer through all phases of the authentication
  procedure including generation, transmission and use of the
  authentication code. To that end, the channel, device or mobile
  application where the information about the amount and the payee of
  the transaction is displayed should be independent or segregated from
  the channel, device or mobile application used for initiating the
  payment. This can be done, for example, via an independent channel to
  prevent any manipulation of the transaction details through the
  initiation process of the payment transaction.

Considering all this, I'm of the opinion, that using platform sandbox is a completely compliant solution. It might be not safest one though.
It's all makes sense when talking about mobile platforms, web environment is even more confusing, because it doesn't have any sandbox.


CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow https://googleonlinesecurity.blogspot.co.uk/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html

If I have an OpenWRT with default install, do I need to update, if we only count the threat from WAN/Internet side?

If it really is "default", then no update is required: OpenWRT has always used uClibc for its libc by default, it will not be vulnerable if so.

However, OpenWRT also supports glibc (and musl, which will be the default in the next release), so it is possible to have a vulnerable OpenWRT. Given the size and complexity of glibc, it's most likely that memory/storage constrained devices will not run a glibc version.

If you have a shell on the system, this should be useful:
https://unix.stackexchange.com/questions/120380/what-c-library-version-does-my-system-use

If you built/configured it yourself, check CONFIG_LIBC in the .config in your build directory. Otherwise, check with the provider of the OpenWRT installation.

(It is also possible, though very unlikely, to have multiple libc instances. The OpenWRT build system does not support this though.)


Can I communicate with a wireless device, without logging in the same LAN? Suppose there are three devices:

WPA2 protected AP
linux laptop, accessing internet through tha AP
linux laptop, not connected to the AP

I own the third device and do not know the AP's password. I have sufficient signal strength.

Can I port-scan the authenticated laptop? Provided there is an open e.g. telnet port, can I attempt to log in? Lastly, can I spoof the AP i.e. perform a MITM attack? All those without knowing the password.

When somebody connects to a wireless access point, their communication happens only through that access point. If you want to communicate with a member of that network, you must get the access point to route/forward your signals to that device. To do that, you must be part of the network; in other words, to associate and get authenticated by the access point.

So, no, you cannot port-scan the devices inside that network unless you somehow create a network with them (some wireless ad-hoc network) or by exploiting the access point from the Internet (using its public IP address). For the same reason you also can't login to one of the devices using telnet or any other service.

As for spoofing the network, yes it's possible. You just need to use some social engineering, i.e. create another network with the same SSID and trick the others to connect to it. You might also do some trickery like pulling the AP's power plug so the other users will only have your network to connect to.


Capability-based security vs protection rings: in what sense are they diametrically opposite? From https://en.wikipedia.org/wiki/Capability-based_security

  Capability-based security is to be contrasted with an approach that uses hierarchical protection domains.

From https://en.wikipedia.org/wiki/Protection_ring

  hierarchical protection domains, often called protection rings, are mechanisms to protect data and functionality from faults
  (by improving fault tolerance) and malicious behaviour (by providing
  computer security). This approach is diametrically opposite to that
  of capability-based security.

Are capability-based security and hierarchical protection domains for different purposes? Or are they different methods for the same purpose?

In what sense are the two approaches are completely opposite to each other?

In capability-based security, programs follow the principle of least privilege as stated on Wikipedia. This means that each program has almost no permissions to begin with and permissions are then granted for only the parts that the program needs. This is generally done on a much higher level than hierarchical protection domains.

In hierarchical protection domains, there are essentially layers that each contain certain permissions. Programs in more privileged levels have more permissions. In this way, programs do not start off with no permissions and may be granted lots of permissions they don't actually need. This is often enforced by the CPU architecture instead of in pure software and is much less granular than capability-based security. This approach contradicts the principle of least privilege.

In the sense that both approaches are used for the provisioning of permissions to programs, they are different methods for the same purpose, but the tend to apply to different domains. The Android OS implements a kernel similar to Linux and uses hierarchical protection domains there, but then on top of that it adds the Android stack and then uses capability-based security for Apps.


Can I track delete action in event viewer? Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on samba that day due to size is full. Is it possible to track in the windows pc if that pc deleted that file? I wanted to make sure if it's possible to check in the event viewer to see if that specific pc is the culprit. thank you for those who will answer.

Unfortunately the only events logging delete actions don't fit your requirements.

Both are logged on the system the file is located i.e. server side, and this wasn't even a Windows Server.
They are not enabled by default as this level of auditing might cause excessive logging.

  4656(S, F): A handle to an object was requested.

  This event indicates that specific access was requested for an object.
  The object could be a file system, kernel, or registry object, or a
  file system object on removable storage or a device.

  If access was declined, a Failure event is generated.

  This event generates only if the object’s SACL has the required ACE to
  handle the use of specific access rights.

  This event shows that access was requested, and the results of the
  request, but it doesn’t show that the operation was performed. To see
  that the operation was performed, check “4663(S): An attempt was
  made to access an object.”

You need to revise your backup procedures and implement some incremental backup that will keep storing deleted files.


Android and AES side channel attacks I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for Android that include countermeasures against simple and differential power attacks?

What other techniques might I utilize within the app to protect from side channel attacks?

I have seen demonstrations showing what appears to be an iPhone having AES keys easily compromised through relatively simple side channel analysis. Is Android just as vulnerable?

I am not aware of any public crypto library with countermeasures against side-channel attacks based on power analysis against AES (or any other symmetric cipher). There are 2 good reasons not to even think to write them:

Loads of techniques are patented. You may receive a take-down notice very quickly.
With power analysis, you must have physical access to the device and in most cases you also need to be able to run arbitrary code on the device. For smartphone apps, it is much easier for the attacker to lift the key via traditional means (e.g. jailbraking).

Simply put, don't use important AES keys in an Android phone (or iPhone) if your attackers have physical access to it. Note that in the video the first attack was mounted on a weak implementation of ECC, not on AES.

You may prefer to address more likely side channel attacks where the attacker operates from remote, like timing attacks, cache attacks, or padding oracle attacks.

Effective countermeasures can be done at the protocol level, independently of the AES library. Otherwise, you could consider using the Android NDK and the NaCl library.


How to leverage a stored XSS to perform a file inclusion? I have identified a stored XSS and I'm wondering, how could I leverage that vulnerability to upload a shell.

XSS is an attack against the client, not the server.

The only way an attacker could turn this against the server is if the victim has special privileges (like an administrator account).


DoS Reflection attack using CharGen protocol I'm researching DoS Reflection attacks w/ amplification, and Wikipedia says that one of the "worst" amplification services is the Character Generator Protocol. Frankly, I have never heard of this protocol before, which leads me to my question: Is it in use today?

In my experience, it is not used today very frequently. SSDP and TCP amplification seem to be the "trending" attack vectors.

Every widely used UDP protocol that sends unauthenticated clients responses much larger than the request will be weaponized at some point.


How would an external attacker utilise universal plug and play to bypass a firewall? I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play.  I'm aware of security issues regarding UPNP in the past but I've also heard that there are some persistent vulnerabilities with UPNP that have not been patched, presumably because it would negatively effect the usability of UPNP.

In this scenario, I am examining how an Internet of Things embedded device might be insecure despite of being placed behind a home firewall.  Assuming the device had FTP enabled and no further controls on it, so that a simple FTP cracking attack would suffice, how would these UPNP firewall bypassing techniques be used to establish an unfiltered connection between the IoT device and said attacker?

UPNP opens ports on the router without user intervention. This means in your example the FTP server would (could) be exposed on the internet by the IoT itself.

This means if there was a vulnerability within the FTP server or poor programming/setup by the IoT company, then an attacker could attempt access just as if you had manually port forwarded the port to the device.

My advise in this example with UPNP is if you do not need it at all, turn it off at the router. If you need UPNP for a device then

make sure the device is patched with latest firmware
make sure the device doesn't have default username and password
make sure (if possible) any services that the device has running are disabled if not being used
ideally run the IOT devices on a different network to your main home internet (such as phones and laptops) - that way if the device is compromised the hop to other devices on your network is mitigated


Strange packets coming over wireless, looking for clues While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several odd characteristics:

The destination MAC is broadcast (FF:FF:FF:FF:FF:FF) while the BSSID and source MAC are zeroed out (00:00:00:00:00:00).
There is no ESSID
The signal strength is relatively steady and is on par with neighboring networks, which leads me to believe this is a device in a nearby building.
The speed at which these frames come in is odd. While most of the neighboring networks send out beacons at a steady rate of 10 packets per second, this one triples that rate, coming in at about 30 packets per second.

Has anyone come across this before? Do you think it is most likely faulty drivers or is this a known behavior of some device?

(If you would like to see an example of a packet, check out this one minute dump, filtered by BSSID.)

When a network device uses a value 00:00:00:00:00:00 as a MAC-address, it is being used as multicast address, however the request will be proceeded by all devices which would receive it (so the machines in the multicast group).

Your description doesn't provide sufficient detail to otherwise infer what might be happening, however we can guess reasonable restrictions.

It likely isn't an attack since:

an active dictionary building attack on WEP would be obvious through artificial traffic generation and wouldn't appear as multicast
An active attack to inject traffic from an unauthorized mobile station would use its own MAC or decoy another legitimate MAC rather than multicast
An active attack to decrypt traffic targeting your access point wouldn't use a broadcast, but target your access point, and you'd see increased outbound traffic from your access point (the goal being to see it try to initiate connections enough times to crack the WEP key)
A Passive attack would be silent, so go undetected.

Though there's too little to infer exactly what's happening, an educated guess might be access point misconfiguration.  Can you tell us if this behaviour is new, intermittent or what?  (And yes, packet capture some of this if you can and share it)


How to list all files with only arbitrary file path read, but no directory listing nor sudo? I have found a path traversal vulnerability that allows me to read any path on the server that does not require sudo.

To fully exploit this, I would like to know which files exist in each directory so I can read them.

In other words, I can do cat /any/path, but not ls /any/path nor sudo cat /any/path. So how can I find as many files as possible to cat them (without trying all possibilities...)

Reading special files like dev or proc, or files present on most Linux distributions is OK. For example, if I could read locates /var/lib/mlocate/mlocate.db database the problem would be solved: but I can't because I don't have sudo.

If there is no ideal answer that lists all files, I am also interested in answers that list large number of existing files.

In this particular instance, the traversal happens inside a remote VM, so privilege escalation in itself is not the main goal: what I'm interested in is confidential source code that may be found on the VM. But very common privilege escalation paths are also welcome as those would give us mlocate and solve the problem, besides being directly useful in other systems.

More precisely, the system in my case is a build on push Git service analogous to GitHub / GH pages (assuming each Jekyll build runs on VM, which I don't know). Mentioning this because it has already been fixed by vendors of course :) It is me who creates the Git repo: that is the attack vector, so reading the Git repository is not very interesting.

You can try other locate implementations that index world-accessible files in a world-readable index, typically located at /var/lib/locate/locatedb or /var/cache/locate/locatedb or some such.

I don't see a lot of need for file listing to escalate your access on a typical server. Usually you'd know what application you're attacking and retrieve its configuration files and its database and obtain credentials this way. You might try files such as .netrc, .ssh/id_rsa and .ssh/config to see if the account can be a gateway into other accounts. If you aren't sure what may be running on the box, try lots and lots of plausible file names.

The one thing that's a bit long to exhaust is the PID values, to explore what's running. It takes 32k requests to exhaust pid_t under Linux by default, and you can check the maximum value in /proc/sys/kernel/pid_max. The command line is in /proc/PID/cmdline; you don't get to see the list of open files (you need readlink for that) but you can see their content (cat /proc/PID/fd/0 …).

For the specific case of a build service, do check the configuration files of that service. That should help you locate the git repository. If you've been able to locate a git checkout, look in .git/index and .git/logs/HEADS and perhaps other files in .git/logs (experiment with that service to see which branches are used and what operations it uses). This should let you retrieve object IDs which you can then read from .git/objects.

Other than finding a locate database, I can't think of a way to elevate read-files access into list-files with a typical configuration.


What ways are there to verify a self-written protocol? Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO", I haven't, technically (I'm still half way), but apart from that I am making a TLS-like protocol, but way lighter.

I needed to secure communication between several embedded systems with very little RAM/ROM and processor power (well, it has 100 MHz, but a lot of it is in constant use and cannot be interrupted).

What I am going to do is use AES-128 with GCM (or CBC + HMAC) to secure the communication between the devices. Some devices can only use GCM, others use CBC + HMAC so (still working on it) I have to make a TLS-like structure to agree which one to use (device communicate through a server, not peer-to-peer, so having only 1 of the 2 isn't a problem; the server just needs both).

I've been doing a lot of research these past months (2 1/2), and I would like to say I have covered the basics. I'm now starting with implementing everything I have found (usage of keys, IVs, nonces, encrypt then MAC, etc.).

Now comes the question: when I'm finished I want to have the code I created checked. Obviously the deep level scrutiny TLS has gone through won't be achievable, but what ways are there? Are there sites where I can post my code for review? Are there companies which can 'certify' it? What would normally happen when a company created a secure communication and want to verify if it protects against the things they envisioned?

And yes, I know I'm not using a PKI. The hardware is in a secure environment, and no new devices can be added to the server (the server keeps a list of devices which can connect and monitors if one ever goes offline), so the company said PKI might be something they'd consider later on, but for a first version would not be necessary.

EDIT:
I want to clarify (I'm taking back a few words). I will be using TLS to create this protocol, and the amount of TLS usages is of yet still unclear. When possible, I will simply try to remove everything I don't need from TLS and create it that way, I might take pieces of it (encrypt-then-mac, adding IV to ciphertext, etc.) and use that.

But either way, it is not TLS and even only removing stuff from TLS source code might introduce weaknesses so an 'audit' is still necessary.

There are IT security companies which provide services like code auditing (most often along with other services like penetration testing, etc.). You contact them, describing your needs, then if this fall under their competences they will send you an estimate.


Public and private classes I have a a robot program in Android Studio written in Java with certain lines designated as a public or private class. I have to submit a form with a section for labeled "key algorithms", but it doesn't specify what exactly that means, and I am wondering if those qualify.

This is a segment of the code, to show you an example of what I mean:

private org.firstinspires.ftc.teamcode.HardwareIndibot robot = new HardwareIndibot();

Are these classes encryption keys or are they just algorithms?

Public and private classes are just concepts inside a programming language which help with design by distinguishing between internal implementations (i.e. private) which can change all the time and public API which should be mostly constant. They are not a security concept but a design concept. It is also possible to bypass these "restrictions" depending on the programming language, for example with reflection in Java.


Does the key size have an effect of the size of the public key and signature If I have a 2048-bit RSA and a 4096-bit RSA key
is my signature and public key smaller when I use a 2048-bit key vs a 4096-bit one ? (In bytes)

Yes, the public key size and signature size is smaller when you use a smaller RSA modulus. The RSA public key composed primarily of the product of two very large prime numbers. This product is said to be the modulus, and this is what makes RSA keys so large. RSA 2048 has a 2048-bit modulus. The signature size also depends on the modulus size. In fact, it will always be about as large, but no larger.

An RSA signature is created by raising an integer representation of the hash of the message to the power of a secret integer kept in the private key. The result is divided by the modulus, and the remainder is your signature. Because the result is so massive, the remainder is also going to be quite large. The bigger the modulus is, the bigger the remainder is, and thus the larger the signature is.

If you need a secure signature scheme which has small public keys and signatures, try Ed25519.


Secure internet privacy in home at router level We have a modem/router at home that provides internet services to each of the tenants in the home. These are all students and none of them are network experts. But there has been a dispute that they maybe peeping into websites others are watching. Their websites can be monitored by ISP which is fine with them. The problem is the router also records the websites visited. And these can be accessed by home members. Can some settings be tweaked at the router level so that the students have peace of mind? The issue is not so serious as if one of them knows other's banking passwords he/she will take out money because they are decent students. But privacy is lost. If there are some ways of tweaking the router so that the home members cannot know each others web activity, it will put everyone to rest. VPNs seem to slow down the speed too much.

VPNs are great at hiding what you do from people you know, but most people don't realize that doing so lets total strangers have access to some of your personal details which can be much worse.  For that reason, that is not a good solution anyways.

Most (if not all) routers do not log activity by default, but your tenants will necessarily believe that you didn't enable it without having access to its configuration which would be a security hazard for you.

The only good suggestion you can give them is to use secured connection (such as HTTPS).

Using a secured connection does prevent intermediaries from knowing what was exchanged and which page was viewed.  The only thing that may leak is the IP address which very rarely can be traced back to a specific page.


Connection to ports 2000 and 5060 successful despite filtering I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP:

nmap -Pn -v --reason XXX.net

Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-28 09:52 CEST
Initiating Parallel DNS resolution of 1 host. at 09:52
Completed Parallel DNS resolution of 1 host. at 09:52, 0.09s elapsed
Initiating Connect Scan at 09:52
Scanning XXX.net (XXX.XXX.XXX.XXX) [1000 ports]
Discovered open port 21/tcp on XXX.XXX.XXX.XXX
Discovered open port 22/tcp on XXX.XXX.XXX.XXX
Discovered open port 5060/tcp on XXX.XXX.XXX.XXX
Discovered open port 2000/tcp on XXX.XXX.XXX.XXX
Completed Connect Scan at 09:52, 5.17s elapsed (1000 total ports)
Nmap scan report for XXX.net (XXX.XXX.XXX.XXX)
Host is up, received user-set (0.035s latency).
Not shown: 995 filtered ports
Reason: 995 no-responses
PORT     STATE  SERVICE    REASON
21/tcp   open   ftp        syn-ack ttl 52
22/tcp   open   ssh        syn-ack ttl 54
113/tcp  closed ident      reset ttl 254
2000/tcp open   cisco-sccp syn-ack ttl 61
5060/tcp open   sip        syn-ack ttl 61

Read data files from: /usr/local/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 5.33 seconds

ftp and ssh are correct, as these two services are configured on the router. But cisco-sccp and sip being open is news to me.

Indeed, a telnet connection to both ports is successful:

telnet XXX.net 2000
Trying XXX.XXX.XXX.XXX...
Connected to XXX.net.
Escape character is '^]'.

telnet XXX.net 5060
Trying XXX.XXX.XXX.XXX...
Connected to XXX.net.
Escape character is '^]'.

But running netstat -talpn on the router while the telnet session is active shows no established connection for either port. And the log shows that iptables drops the packets:

Mar 27 20:52:16 router DROP INPUT  IN=ppp0 OUT= MAC=MM:MM:MM:M SRC=YYY.YYY.YYY.YYY DST=XXX.XXX.XXX.XXX LEN=60 TOS=00 PREC=0x00 TTL=51 ID=39215 DF PROTO=TCP SPT=52200 DPT=2000 SEQ=106277563 ACK=0 WINDOW=42340 SYN URGP=0 MARK=0

where YYY.YYY.YYY.YYY is the IP that telnet connects from.

Is my diagnosis correct?

If yes, how can telnet establish a connection, even though the packets are dropped at the router? Who is listening on ports 2000 and 5060?

There is something between the scanner and the target that is responding on behalf of the target, spoofing its source address so as to appear to be the target itself. When you ran the Nmap scan as root with --reason -v, it showed the IP Time-to-Live (TTL) values of the response packets for each port:

PORT     STATE  SERVICE    REASON
21/tcp   open   ftp        syn-ack ttl 52
22/tcp   open   ssh        syn-ack ttl 54
113/tcp  closed ident      reset ttl 254
2000/tcp open   cisco-sccp syn-ack ttl 61
5060/tcp open   sip        syn-ack ttl 61

The TTL field starts at some number (usually 128 or 64) and is decremented by each intervening IP router or hop. If any received TTL fields are unexpectedly high, it can mean that the packet originated closer to the scanner than expected, i.e. from one of the hops.

You said that 21 and 22 were expected to be open. They have differing TTL values, which could mean that one of them (FTP) is port-forwarded to a system inside your network, or it could mean that there is some asymmetric routing going on resulting in a different path each time. But the real question is over 2000 and 5060, which are 7 hops closer than the nearest expected distance. These are almost certainly being intercepted.

You should be able to determine which hop is intercepting the traffic by conducting a traceroute. Nmap can be used to do this, if you limit its traffic to the one port in question:

nmap --traceroute -Pn -p 2000 example.com

This will show a series of hops culminating in the one "from" your target. It's actually most likely to be the hop beyond the last hop in this list. Compare it to the traceroute for a port that is acting as expected. For example, if your scan looks like this:

# nmap --traceroute -Pn -p 2000 example.com
TRACEROUTE (using port 2000/tcp)
1   2.04 ms  gateway (192.168.1.1)
2   14.37 ms 10.100.96.1
3   15.60 ms example.com (192.0.2.5)

# nmap --traceroute -Pn -p 22 example.com
TRACEROUTE (using port 22/tcp)
1   2.04 ms  gateway (192.168.1.1)
2   14.37 ms 10.100.96.1
3   15.60 ms 182.23.16.88
4   10.11 ms 182.23.16.82
5   44.73 ms example.com (192.0.2.5)

The last common hop is 10.100.96.1. The next hop in the sequence is 182.23.16.88, which is most likely the one that is spoofing the response.

As to why these ports may be being spoofed, I note that SCCP (port 2000) and SIP (port 5060) are both VoIP services. Maybe your ISP doesn't want you running a VoIP server, client, or relay, and is using this method to prevent it?


Possible Scam - reply address appears to be yours Have received the following email which I believe to be a scam

Internet Crime Complaint Center (IC3)
In Partnership with:
Swiss National Fraud Relief Center (NFRC)
Case/Reference ID: IE3033900045
We regret to inform you that you have been a victim of identity theft. Your identity and consumer credit file have been compromised and used in an identity theft scheme recently uncovered in Ireland by federal authorities.
Your more personal details have been undisclosed in this email for your own security as your email might have been compromised as well. The offenders have since been prosecuted, tried and ordered to pay restitution to victims involved willingly through wire fraud and romance or other scams, or unwillingly through identity theft and hacking. This means victims that had direct contact with the offenders by telephone or email in response to some type of scam and those who are hacked and are unaware of the incident prior to this notification. You have received this notification because this applies to you directly regardless of if you have lived in Ireland or not, that's where the case was opened and that's where the hackers were charged.
For more detailed information about this case and the settlement pay outs that you are entitled to, immediately contact the Office of International Affairs at the Limerick City District Court by replying to this notification, or by visiting in person at 38 Roxboro Road, Limerick, Ireland between 9:00 a.m. and 4:00 p.m., Monday through Friday, excluding Court holidays.
If you are visiting in person, set up an appointment prior to your visit by telephone: +353 800 814 250 (toll-free) or by email. If you are unable to make a trip, you will be rendered proper assistance online and on the telephone.
Regards,
Ilia Price
Administrative Clerk

The send address was    Ilia Price
The reply address was international.affairs@limerick-city.org

Are you able to confirm that is is a scam

Kind Regards
Richard Stafford

Scam.

Like many such messages, it seems to be a very similar to several other variants of this type of message as seen by searching pieces of information in the email.
The messages I have found that match this almost to the word have at least three different "Administrative Clerks" signing off on them.
38 Roxboro Road, Limerick, Ireland (to the best that I can find out) is the back side of Limerick Prison. The nearest court does share a street with Limerick Prison, but it isn't Roxboro.
+353 800 814 250 doesn't appear to be a valid toll free number for Ireland where the closest match for toll free numbers is 1800, so I assume a North American author found an Irish reference and falsely assumed that the 1 could be dropped.

I could keep digging, but if I had received this I would be fully comfortable calling this a scam and moving on.


Is receiving an OTP via email any more secure than receiving it via SMS? I understand that getting OTPs via email and SMS are the weakest forms of 2FA, but given a situation where these two are the only options for 2FA, is email any better than SMS?

(Assuming the email - rather, webmail - account is itself reasonably well-protected with strong passwords and 2FA.)

Related:

How hard is it to intercept SMS (two-factor authentication)?
Database leak exposes millions of two-factor codes and reset links sent by SMS - Ars Technica

  The database provided a portal that showed two-factor codes and resent
  links being sent in near real-time, making it potentially possible for
  attackers who accessed the server to obtain data that would help them
  hijack other people’s accounts.

The worry is that 2FA protects you in cases where your passwords get leaked. The 2FA is a mitigating control to prevent people from abusing that password. However people often re-use their password across multiple websites, including their email and most people do not protect it with 2FA.

This means that if your password leaks, there is a higher likelihood that someone will be able to get your OTP from your email address than from a text message.

Hardware tokens and OTP generators are still much more prefered over SMS or email.