Why require root to be the first entry in /etc/passwd? Security policies sometimes demand that root be the first entry in the /etc/passwd file. Is there a valid reason for requiring this, or is it just conventional to do so since the root account is the first one created?

I understand that some places used to use multiple accounts with the same numeric UID, which is bad practice in any regard and much worse for root. In those situations, ls(1) uses the first name it finds that matches the numeric UID, so making sure root is first would mean that all UID 0 account ownerships show up as "root" in directory listings. However, it's even more common to prohibit the creation of multiple accounts with the same UID anyway, so that doesn't make a whole lot of sense as a reason to require this.

Update: A colleague informed me that older versions of some Unix operating systems used the first entry in /etc/passwd to authenticate access to single-user mode. Modern operating systems authenticate to the root account regardless of its position in /etc/passwd and /etc/shadow. I would be interested in finding out when this change was made for the major Unix platforms; I'm told it was pre-Y2K, so likely Linux has never had this issue.

It has to do with the potential for early entires masking later ones:

  Note that earlier entries in /etc/passwd take precedence over, or mask, later entries with the same user name or same user ID. Therefore, please note the order of the entries in the example for the daemon and sync user names (which have the same user ID). Make sure you do not alter this order in your own file.

http://uw714doc.sco.com/en/NET_nis/nisC.passwd.html

Therefore, if you can inject a user named "root" at the beginning of the /etc/passwd file, it could cause some havoc.


Why does WiFi deauthentication need multiple packets to work? I am trying to understand a common "problem" when injection deauthentication frames in 802.11 networks.

My goal is to cause a client to re-authenticate (like one would do, to capture a 4-way-handshake) I do not want to cause a DoS.
Theoretically I would only need to send one fake deauth packet to do this. But when I send out a single deauth packet, nothing happens. Even with 10 or 20 packets I rarely get a re-authentication from the victim.
Aireplay-ng uses 64 packets with default settings, this number seems to work good for me as-well.

My main question now is:
Why does an attacker need to send so many fake frames, when a real AP only needs one frame to get the job done?

My test-setup is as follows:

Acces Point:

inksys wrt1200ac (openWRT)
Channel 11, WPA2, "legacy" mode (no 802.11n)

Clients:

ESP32
Android Smartphone

Atacker:

Kali VM (running on a MacBook Pro(macOS catalina)
ALFA AWUS036NHA

No traffic or other devices on the test-network

The network is only used for my testing.
The general RF-space is probably as crowded as in a normal tech enthusiasts home: Bluetooth, ZigBee, 2.4 and 5 Ghz Home-WiFi + neighbors

It could be a layer 1 (physical layer) problem.

It could just be that the victim is receiving too many frames and drops yours, or perhaps the frame doesn't make it all the way to the target (obstacles, interference).

Or, maybe your system isn't staying on the same channel the whole time. If you are transmitting on different channels than the target device, it will not work at all, and if you are hopping channels, it will only work some of the time.


Does using token-based auth make CSRF checks on login unnecessary? Based on my understanding, avoiding the use of cookies as an authentication mechanism prevents CSRF vulnerabilities entirely (namely token based authentication in an SPA), when authenticated.

Does this also render CSRF checks on the login page / API endpoint itself unnecessary? As far as I can see, even though we could be tricked into sending requests to it unwittingly, there'd be no effect of this - because we're not using cookies to authenticate on subsequent requests.

However, I wanted to check with your collective wisdom - can we avoid them on the login page? And what about other non-authenticated pages like password resets?

If you treat a request specially because it comes from a particular IP address or includes particular cookies, then there is a potential for CSRF.  If no machine-specific information influences how the request is processed, then there is no potential for CSRF.  A password reset page could be subject to CSRF if it somehow defaults to the last username used from that machine (i.e. based on cookies, or worse, IP address) and allows the reset to be issued without specifying the username as part of the URL or in POST data.  (Still, the damage would be limited since we are just talking about a password reset request.)


Does WD My Passport WDBYFT0040BBK-WESN have encryption vulnerability? Recently I came across this whitepaper:
https://eprint.iacr.org/2015/1002.pdf

It states vulnerabilities in Western Digital hard drives but doesn't include exact model numbers.

I have WD My Passport WDBYFT0040BBK-WESN and I wonder if my hard drive is encrypted properly so that nobody can access the data without knowing the password?

That paper has 2 tables (table 2 and table 6) listing VID:PID (vendor id and product id) for devices known to use the chips they examined. You can find the VID and PID of a usb device on Linux using lsusb, other systems may have other methods to obtain VID and PID.

However, it's possible that your device uses one of the chips listed in table 1 without being listed in table 2 or 6, as the authors could have been unaware of it or it could have been released after the paper was written.

Even if your device doesn't use one of the chips examined in that paper, given the track record I wouldn't rely on it for anything sensitive. In general software solutions for disk encryption have an advantage here as they're generally more widely audited and they don't have to be tested for each and every hard drive model.


Security requirement for an R&D team I have an R&D team that has been recently set up. I have been asked to help out with the cyber-security requirements for the department. They require access to anything and everything available on the internet, and also will require access to mailing sites other than O365. Any leads on what can be the different aspects I should make sure is available in my infrastructure to make this secure.
For example
Endpoints: I should implement DLPs to avoid the team from sharing confidential documents
Anti-virus (But will it be sufficient for zero day attacks)

Network point of view: I must segregate the team from rest of the organisation so I can customise policies specifically for this team...

Am I heading in the correct direction? What else should I be taking care of?

In a critical environment where you are introducing new devices which will be conforming to new, looser rules, it might be worth having an entirely different network 'air-gapped' - i.e. these new devices being completely separated from your existing infrastructure.  Many of the measures you take, such as a firewall, anti-virus, and group policies, will be the same as for existing computers.  The Internet itself is not scary, and having access to it does not mean immediate infection, but it will increase your potential attack surface.  You said restrictions need to be looser, but that does not mean they have to be lifted completely:

Users probably don't need to install programs (if they do, you could do this manually as an admin, infrequently)
Users probably don't need external mail (you said they do, but I see no reason why they would need e.g. GMail?)
Users shouldn't have admin access to their computer
etc.

It may however be worth getting a professional in to evaluate your systems and use case, where you act as project lead.  The contract for that will likely be considerably cheaper than the potential cost of infiltration.


Does prepending "http://" to a user-provided string yield a safe-to-use URL? Is it safe (in terms of XSS vulnerability) to get a parameter X from the user, escape its double-quotations and insert it as href?

Pseudo-code:
Y = escape_double_quotes(X);
print 'link'

(The following answer is based on the assumption that escape_double_quotes() only escapes quotation marks.)

It depends on whether the user who is providing the parameter is different from the user who is seeing the link. If a user A is providing the parameter, but another user B may see the resulting link, then user A might maliciously insert a link to exploit user B. Consider the following example:

www.example.com/transfer_money.php?src=userB&dest=userA, which would result in:

print 'link'

Another example:

><a href=javascript:myfunc(), which results in:

print 'link'


sslstrip works with Internet Explorer only? Ive been playing around with sslstrip, arpspoof and ip_forward.

I read about the whole process at: http://www.thoughtcrime.org/software/sslstrip/index.html

My goal was to sniff HTTPS connections, passwords and such.

So i have a test setup with different IP´s and i can only see the passwords when i use Internet Explorer.  When i try with Chrome or another browser, it just wont work.  The connection persist to stay on an HTTPS if i check on my WM-Windows 7 Mashine.

Is there a solution to this?

SSLStrip will work on any browser.  This attack will fail to work under Firefox and Chrome for websites protected with HSTS.  For example Google.com and gmail.com should not be affected by SSLStrip because of HSTS.   Internet Explorer is not complaint with RFC-6797,  which describes the HSTS security measure and is therefore more susceptible to attacks like SSLStrip.


Do Client Nonces enhance the security of HTTP Digest Auth? As far as I understand the answer at
https://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being able to reuse the computations results

for multiple users and/or
for multiple servers

However, even in the simplest Digest Authentication variant (qop = none), the username and the realm (supposedly unique per server) and the nonce (more than just unique per server) are included in the data that gets (usually MD5) hashed.

Doesn't this already make reusing of precomputed hashes across users/servers impossible?

So a client nonce would only add to security, if http://tools.ietf.org/html/rfc2617#section-4.9 is correct:

  The ability to choose the nonce is known to make cryptanalysis much easier [8].

But that same section then goes on to say

  However, no way to analyze the MD5 one-way function used by Digest using chosen plaintext is currently known.

This is a statement from 1999. Since then, various collision attacks have been published for MD5, but none which would help in this case, if I'm not mistaken.

What am I missing?

Update I guess it makes sense to spell out what we are talking about exactly. In the most basic form of Digest Authentication the client calculates and sends to the server the result of the following:

MD5(MD5(username + ":" + REALM + ":" + password)
    + ":" + NONCE + ":" +
    MD5(http-method) + ":" + uri))

Except for the password, all values are also sent in plain text.

To make it more clear, variables whose values are set by the client are lowercase, whereas variables the client retrieves from the server are in uppercase. (This makes my 'realm and nonce' fallacy above, pointed out by David Wachtfogel immediately obvious, as a MITM can freely choose those uppercase values, assuming the realm is not checked by the client, which, judging from the "sophistication" I've seen in most admin's passwords, would be the norm, rather than the exception).

Btw, the value of the uri is supposed to be an absolute uri, like http://servername/path?query, and thus would globally unique, however, that depends on the client's implementation and whereas Opera implements it that way, the versions of Chrome, IE, Firefox I tested do not, and rather just use '/path?query' (afaict this is in violation of http://tools.ietf.org/html/rfc2617#section-3.2.2.5).

So whether a precomputed table would be reusable across servers depends on the client implementation, and if the MITM can choose, it will of course prefer the weaker browsers to Opera, if he has a precomputed table.

As described in Thomas Pornin's answer cited in this question, the goal of the client nonce is to prevent a chosen plaintext attack in which the attacker impersonates the server and chooses the challenge. In such a situation the attacker can also choose the realm (since this comes from the server) so the fact that realm is hashed as part of the response doesn't completely prevent this attack. Only if the user is vigilant and checks that the realm is as expected will this prevent the attack.

The username does help in that it requires the attacker to build a precomputed hash table, such as a rainbow table, per username. The problem is that usernames aren't globally unique - the same username will exist on many different servers. In fact some usernames are extremely common and are likely to appear on most servers - a classic example being "admin".

So an attacker can do the following:

One time: build a precomputed hash table for username = "admin", realm = X and challenge = Y (using any value for X and Y)
Interercept connections to any server the attacker wants to attack
If someone connects to the server with username "admin", send real =
X and challenge = Y
Lookup the response in the precomputed hash table to reveal the password

The client nonce prevents this kind of attack; since the attacker doesn't control and can't predict this nonce the attacker can't build the precomputed hash table.


Fake email messages via List-Unsubscribe header List-Unsubscribe email header makes it possible to recipient to automatically unsubscribe from the mailing list:

List-Unsubscribe: <mailto:list@host.com?subject=unsubscribe&body=qwe>

Free email service we build adds the "Unsubscribe" button in the UI, which will trigger sending a email to list@host.com with specified body and subject. And it will be sent from the email of the recipient (out user). And signed with DKIM.

An attacker can send a email to our user, which, in case of pressing 'unsubscribe'  button, will send a fake mail with given body, and from our user, signed by our DKIM.

How is it possible to protect from this?

We can forbid processing our emails in List-Unsubscribe header (Protecting our users from receiving such fake emails).

But what to do in case when 3rd party mail provider sends us such header?
How can we protect our users from sending fake emails? (Sent from our network, and protected by DKIM and SPF)

Or is it a problem and responsibility of 3rd party email services, not to sent emails with malicious List-Unsubscribe header?

Most implementers of unsubscribe buttons do not honour the "subject" and "body" parameters, for exactly the reason you give. Those that do, only do it in response to validated emails, and where the domain of the unsubscribe email address matches the domain of the validated sender email address.

Essentially, you need to implement a policy for when the List-Unsubscribe header should be trusted.

Only if:

You have validated the sender domain via SPF or DomainKeys, or matching round-trip DNS or another method.

AND

The List-Unsubscribe domain matches the sender domain.

Even then you should only trust the Subject and body if you have whitelisted the sender domain.

Better - if the list is listname@example.com:

List-Unsubscribe: <mailto:listname-unsubscribe@example.com>

Best - each recipient should have a unique subscription ID:

List-Unsubscribe: <mailto:listname-unsubscribe-927349872392343@example.com>

Or some VERP thing:

https://en.wikipedia.org/wiki/Variable_envelope_return_path


How can I make locally stored data unreadable unless connected (logged in) to server? I have a chat application built in Java. The chat app stores a log of the user Jimmy's chats locally on his machine.

I want this chat log to be encrypted so if someone uses the computer (authorized or unauthorized) he cannot simply read all of Jimmy's chats. I would like Jimmy's chats to only be readable when Jimmy is logged in. As soon as he logs out, the chats should be encrypted and unreadable.

Any ideas on how this sort of scheme could be implemented?

Ok, I'm no expert in this. Maybe others can add in.
But from your description, this is what I can come up with.

client logs in.
server issues a key, K.
client keeps K in memory to encrypt log on disk as well as decrypt any log read back in memory for viewing.
upon client attempt to log out, or disconnection, key K is wipe from memory.

That way, the client would have no key to decrypt anything in the absence of active session, such as accidental disconnection in addition to logout.
Here, I'm assuming the key K is being sent securely across using something like TLS.

However, encryption scheme is always hard to get right. Let see what others say.


How come I can see a full HTTPS requests via Fiddler? I am testing a C# web API hosted on a remote server, and I am monitoring HTTPS traffic using Fiddler.

What confuses me is that via Fiddler I can see all of the POST payload, headers and host URL addresses for both the request and the response. Shouldn't the SSL certificate actually encrypt this data, or at least some of it? I tried to find an example of encrypted HTTPS requests but I am not able to find it.

Why am I able to see an entire HTTPS request in Fiddler?

Take a look at these instructions for how to make Fiddler decrypt TLS traffic. It tells you to install Fiddlers root certificate into the OS trust store.

This implies that they are doing classic TLS interception - there is one TLS connection between the browser and Fiddler, and another between Fiddler and the server. The first one uses a certificate generated on the fly by Fiddler and signed with their root certificate. The second one uses whatever certificate the server provided. As seen below:

   Browser <--- TLS Connection #1 ---> Fiddler <--- TLS Connection #2 ---> example.com
                      |                                      |
               Certificate signed                  Genuine certificate
                   by Fiddler                         for exmple.com

This works because the OS has been told to trust Fiddlers root certificate, so they can simply spin up a certificate for any domain they want on the fly and the browser will accept it.


Possible to find out the last person to open a file on Windows without specialist tools? So I suppose this is specific to the OS you are using or the filetype or software used to open it, but my question stands open for all really but I am particularly interested in more common files such as docx and xls.

Note that the person to open the file may have not edited or saved the file, simply open and closed it.

Well, AFAIK there are two options that do not require activation, nor specialized tools:

Open C:\Users\user name\AppData\Roaming\Microsoft\Windows\Recent Items, and see if the file is listed there.
Open regedit.exe, and navigate to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs section. You will see values, structured by extension, that have recently been opened by the 'current user' (last 10 files of that extension).

Note that option 1 will only list files that have been modified, whereas option 2 will also list files that have been opened and closed, without editing or saving the file.


Is each office having their own router coming off the main router as secure as each office having their own internet line Company A owns a building and leases out 2 offices to other companies.

Telecom 1 provides internet to Router 1 with ip address x.x.x.121

Company A connects their router, Router A, to it and gives it IP address x.x.x.122
Company B connects their router, Router B, to it and gives it IP address x.x.x.123
Company C connects their router, Router C, to it and gives it IP address x.x.x.124

Is that effectively the same as each company having a seperate line?

Assume that A has control of the main router and each has access to their own router but no one else's.

EDIT:
In my case the main router is a Cisco 2811
Company A is using a Ubiquiti EdgeMax
Company B unsure
Company C a BT home hub

Since they use different routers (telecom + companies), it would be more secure to have them behind another router. An attacker would need to attack the telecom router and then the company routers, instead of just the company routers.

Additionally, if the telecom router has client isolation capabilities enabled, then the companies would have to attack the telecom router before attacking the other company routers.

One possible drawback with having them behind the telecom router is if they're able to attack each other, then they may have more bandwidth available with which to launch attacks.


Is using an SSL Session ID along with a cookie based session verification more secure or not really? I am using Django which is a web framework for Python. I love it but the session handling is cookie-based. Now over SSL I'm sure it's reasonably "secure" but I don't think there is any kind of fail safe for if that cookie gets compromised. I should also mention I am using Apache2 with Mod_WSGI. For each Apache2 session there is an SSL_SESSION_ID environment variable that I can obtain from the root python module. Specifically, my question is will requiring that SSL_SESSION_ID from Apache2 to match the Session_Key cookie in the database (and the clients browser) actually help prevent things like a MITM attack or session hijacking or it is a waste of effort? On the one hand I am thinking it could because the client has no idea (I THINK) about the SSL_SESSION_ID so they couldn't fake it. On the other hand I am thinking that if an attacker could compromise the encryption or the browser enough to get the cookie than they could probably just get the password anyway and start a new session.

The SSL session ID is transient; it designates the "SSL session parameters" that the client remembers about a previous SSL handshake, in particular the negotiated symmetric secret value obtained from the asymmetric cryptography of that handshake. It is kept in RAM only; if the user reboots, or even simply closes all his browser windows, then he forgets the session ID. If you use the SSL session ID as part of the authentication mechanism, then users who close and reopen their browser will have to authenticate with their password again.

If that's what you want, then, by all means, use the SSL session ID. I know of banks who do that for their Web-based bank account management.

Note that if the server reboots, the SSL session ID will also become obsolete: even if it is stored in the database, the rebooted server has forgotten the actual session key (the server, too, stores it in RAM only), and thus will negotiate a new session with a full handshake upon next connection from the client. Also, server memory of past sessions is configurable but often limited in time (with Apache, see the documentation, directives SSLSessionCache and SSLSessionCacheTimeout). Take also care that client's memory is based on the process: on a PC, closing all windows tends to terminate the browser process; on smartphones and tablets, who like to keep things running for inordinate amounts of time, really killing the process is a more convoluted process (usually, the browser "closes" only when the user runs out of battery).

On the other hand, for less critical sites (in the user's point of view), users tend to prefer it when they authenticate once, and they are "remembered" even across reboots or even browser close. For such a feature to work, there is no avoiding it: there must be some user-specific secret stored on the client side. Cookies are not worse than any other mechanism for that, and they are about the only one which is readily available and compatible with all browsers.

Summary: use the SSL session ID if you want very transient sessions, which disappear automatically when the browser is closed (the browser process, not just the relevant window). Use cookies for longer-lived authentication. They are not interchangeable; they don't operate on the same time scale.


How can LastPass enforce 2-factor authentication I've recently started using LastPass and one of the things you can set as a policy for you password vault is

  Prevent offline access when using Google Authenticator. The local
  cache can be accessed without a second factor when using Google
  Authenticator [unless this policy is enabled]

How can they enforce that? If they somehow encrypt my password db with a key returned by the google authentication procedure then how can they allow offline access in the first place? And if they don't encrypt it with something from google then how can they prevent offline access?

How can they enforce that?

The browser plugin will not store the data permanently on your local machine if Permit Offline Access is set to Disallow. It is only available while your internet connection is active and your session with LastPass is current.

  If they somehow encrypt my password db with a key returned by the google authentication procedure then how can they allow offline access in the first place? And if they don't encrypt it with something from google then how can they prevent offline access?

They don't encrypt the password DB with the 2 factor authentication key - only with your master password (or rather a key derived from it). The 2FA key only determines whether their server allows you access to the password DB and is not used in decryption.

There's a little bit of further information here.


With javascript in the browser, how can I sign some data without directly manipulating a private key? With JavaScript in the browser, I need to digitally sign some data. I'm looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to install a certificate on a mobile device, outside of my web app, then, in the web app, to sign some stuff with the installed certificate without directly manipulating or seeing the private key. However I can't see if or how the Crypto API interfaces with installed certificates.

Am I missing something obvious? If this is not possible, are there browser plugins that can help me? I see in 2009 someone did this with an MS ActiveX object, but there must be a better way six years later?

It's not possible, not without significant effort by browser authors (or browser plugin authors) to make it possible. Remember, the point of signing something is to verify that its authenticity - that is, that the signer meant to sign that thing, with that key, and they are the only one with the key - so having a way for web page content (which is inherently untrustworthy code, from a browser's point of view) to access a user's signing keys would be a major security risk! Even just enumerating installed keys would allow for user fingerprinting and tracking.

Now, a browser (or plugin) could attempt to do this securely, by offering a JS API that basically prompts the user "A script on site  is attempting to access your certificate store. [Allow] [Deny (default)]" and then a similar prompt (if the first is approved) for access to your private key (and password for it if needed). I would be very cautious about such a feature, though.


Content on a usb flash drive available for a limited time I need to distribute some content on a USB flash drive. This content should be available for a limited time only.

I am looking for some approach to achieve above.

So far I do not have information about what kind of content will be on there or what OS the consumers will use. I am looking for ideas, general information, some known approaches for similar tasks.

DRM-based solution may be the only solution to such need.

With such solution, when the client opens the document / software / whatever is stored on the USB key, the application must contact your server requesting for a key to decipher the document.

All you have to do then is to decide at which moment you stop distributing the key for this document.

Properly implemented, DRM also limits copy possibilities since even if someone copies the content of the USB flash drive, it will remain ciphered and the key from your server will still be needed in order to open it.

The main drawback for such feature is that it requires a compatible software (for instance Adobe Acrobat for .pdf files) and that a network connectivity is required.


How to monitor traffic/capture packets on your network? Say you're having a basic LAN-infrastructure (a Router, a Firewall, a switch connected with multiple access points, a server and multiple clients).
I want to be able to detect malicious traffic flowing through the network by studying the packets content.

I can for example set the clients network adapters in promiscous mode (e.g. running Wireshark).
But this puts extra load on the clients and doesn't show you the whole picture.

How would I be able to get a general overview of the traffic flowing through my devices?
Is there a system available that for example can collect all the different important logs my devices are generating without being overwhelmed by
duplicate or irrelevant information?

Snort is an open source packet inspection tool that is designed to do exactly what you are looking for.  It requires a box with plenty of processing capacity; and it is generally hooked up to a span port on your switch in order to see all the traffic flowing on your network.


Does SOC-2 compliance require password rotation For convenience and security I find password rotation requirements harmful.
Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020?
I would think(hope) meeting NIST password guidelines and TOTP MFA should be more than enough.

SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor.

And if your company cannot satisfy your assessor, then there is a mechanism called "management response" where the company gets to explain away the findings from the assessor.

And if your assessor is 4 years behind in their understanding of best practices in this area, then perhaps you need to find a new assessor ...


Penetration Testing of IaaS/PaaS environment - CVSS Score How can I measure the effectiveness of a Penetration Testing carried out in a Cloud Environment (IaaS/PaaS) by a third Party Vendor ? Should I ask for a CVSS score or something else ?

Any advise will be highly appreciated.

TL;DR - You should receive a report from the penetration-tester which will evaluate the security of the systems you're running, usually they will use a CVSS score to judge how vulnerable something is.

If you've had a professional pen-test they ideally will produce a report on the issues they found, how they exploited the issues and of course how critical those issues are. This is typically done with a CVSS score as it's a good way of measuring how bad the vulnerabilities are.

  The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to the threat. - Wikipedia

So in short, yes ideally they should be giving you CVSS scores, you should also receive their report which will detail their findings from that you will be able to work out how to fix it. Obviously some common-sense is required, the pen-tester can only evaluate what they know; like every human they can be wrong, so when reading through their report just make sure it all makes sense & you can evaluate the security yourself (to some extent) obviously the pen-tester is more qualified than yourself in identifying vulnerabilities so don't second guess everything they've told you, just make sure it makes sense.

Like everything, a lot of this depends on your threat-model if you're a small company and assume that you won't be getting hit by nation-states and he points out a flaw in a crypto suite you're running which only a nation-state could attack (and you know it will cost too much to fix) then maybe it's best you carry out an internal risk assessment on that. Just because they've produced a report doesn't mean you cannot produce your own and identify risks yourself - in-fact I'd encourage it. It makes no sense for a company to patch everything (if they cannot afford it) just be aware of the pen-testers level of expertise.

In essence, it all comes down to Risk Analysis


What is the purpose of a man in the middle certificate? So I'm at work today and I'm having all kinds of issues getting into secure sites that I need to do my job. So I go to portal.azure.com and I find out that the certificate for the site isn't issued by Microsoft (as it is outside work) but rather by my internal CA and issued to portal.azure.com.

This is true of a lot of sites on the internet -- the certificate isn't issued by the site, but rather by our organization as what I'd think is a man in the middle cert. I'm not sure why this is being done, but it is also causing a huge amount of problems with legitimate sites because they won't load certain information while I'm using them at work. At home, they all load fine.

Appreciate if any of you can shed some light on why this might be happening, and what the purposes are. Does it cause any insecurity by doing this? Appreciate any comments or feedback you can provide.

In the case of a corporate network this is called an SSL Proxy. These SSL proxies intercept certificates and should be transparent to end users. It sounds like yours might have some configuration issues. Bluecoat probably has one of the most popular SSL proxies but it can be done with Microsoft ForeFront Threat Management Gateway.

The most common stated reason why SSL Proxies are used is to have the ability to inspect corporate traffic for audit, compliance, and/or data loss prevention purposes. There is plenty of debate on the legality of doing this but in the U.S. - as far as I know - it is legal as long as it is disclosed. (i.e. Banner pop-up stating that the company has the right to monitor, etc.)


TPM - number of AIKs and signing key I try to learn a bit about the TPM and have a few questions I could not solve by myself.

There are some privacy concerns about using the EK for identifying a TPM. I do not get these privacy concerns. Can anyone provide me a small example how one could identify the certain TPM when using an EK for attestation purposes?
Same story with the AIK. One should use an AIK which is derived from the EK. But there are seemingly also privacy concerns. That should be the reason why there is more than one AIK in a TPM. I don't get this either. A small explanation would be nice.
My last question: Why do we need an extra signing key? We could use the/an AIK instead?

The EK is unique for each TPM. If we would all be using the EK for TPM operations (remote attestation via TPM_Quote()), anyone could correlate our actions. In other words, anonymity wouldn't be impossible for any TPM operations - a single identity.
Same here. If you're always using the same AIK, you're providing a single identity and thus loosing the possibility to do anonymous operations. This is why it is recommended to use multiple AIK for different purpose. Here, the EK is only used to - behind the scene - to attest the adherence of the TPM to the TGC specifications.
In crypto, it is recommended to use different keys for different purposes. This is normally done using key hierarchy. The top level can be used as the root of trust for a specific task. This way, you have have multiple key signed by the top level and used for different purposes (encryption, signature) but you only have to distribute the top-level public key. In other words, because it's a good practice.


AWS Flowlog for Private Subnet Showing Routable IP's When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected.  How is that possible?  I expect IP addresses from the private subnet could be rejected but not routable IP's

This is an example of the flowlog:

  12:24:40
  2 redacted eni-obfuscated 149.28.xx.xx 10.55.27.62 53501 22 6 1 40 1539951880 1539951940 REJECT OK

  13:22:41
  2 redacted eni-obfuscated 60.51.xx.xx 10.55.27.62 60375 8081 6 1 40 1539955361 1539955421 REJECT OK

  13:39:41
  2 redacted eni-obfuscated 221.229.xx.xx 10.55.27.62 9090 22 6 1 40 1539956381 1539956441 REJECT OK

The VPC layout contains a public and private subnet.  The private subnet routes outbound to the Internet through an AWS NAT Gateway.  The public subnet contains a bastion host that is used to connect to the private host.

The bastion server has a security group that only allows in port 22 from specific IP addresses (a.b.c.d/32).
The host on the private subnet has a security group that allows only ssh in from the bastion host, and all traffic from the private subnet.

So where is this coming from?  On the bright side no IP addresses I don't expect are being accepted.

TL;DR - There was a Network Load Balancer (NLB) in the private subnet in front of the host in the private network.  That NLB had a public IP.

When there is a Public IP associated to the network interface, traffic from the client public IP (source) will reach the ENI provided the security group and ACL allows the traffic to come in, regardless of whether there is IGW as default route or not.

Because an AWS NLB does not use security groups and no NACL was in place, routable traffic was able to reach the private subnet.  The security group on the host rejected the traffic and that's what was showing up in the Flow Logs.
Response traffic would not make it out of the private subnet because the route tables are followed.  Route tables aren't used to control inbound traffic but do control responses.
Can you clarify why an NLB in a private subnet even with a publicly routable IP address can receive traffic when it's subnet does not route through the Internet Gateway?
From a port scanners perspective they would have received no response from the NLB.

SYN from the client will reach the NLB, but no SYN-ACK would be sent to the client as now route table would be evaluated for response traffic and as there is no route to IGW the response traffic would be dropped.
To summarize, NLB or your backend target are not responding to internet traffic. Traffic would be accepted by Public IP on private subnet regardless of the route table default route.

Reference: AWS Support


Centralized authorization with distributed service providers I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization).

The part about authentication is mostly solved (probably going to use SAML). The more difficult part is implementing a centralized authorization, if even possible.

The only possibility I see to make this work would be that the resource providers ask the authorization server about the permissions of a specific user. The resource provider would then have to map those permissions into local rules for the user. The problem with this is that it is still up to the resource provider to respect and implement the policy provided by the authorization server.

Is there a solution to have the central server enforce user permissions/policies?

Yes, there is a solution out there and it is even a standard. It is called XACML, the eXtensible Access Control Markup Language. Much like SAML, it is defined by OASIS. Where SAML focuses on authentication, federation, and coarse-grained authorization, XACML focuses on fine-grained authorization based on attributes and policies.

For instance, you can define policies such as:

A user with role == manager can do the action == view on a resource of type == medical record.

XACML defines the policy language, the request / response scheme, and the architecture. The following diagram shows the architecture. It has a notion of a Policy Decision Point (PDP) which is the authorization server which can be queried from multiple locations in your architecture e.g. a service layer, an API, or even a data tier.

Most XACML implementations give you a binary Permit / Deny API - also part of the XACML standard. The implementation I work on, Axiomatics, also gives you an open-ended API e.g. "What can Alice do?" which returns a list of permissions back rather than just a Permit / Deny answer.


Where can we learn more about recursive encryption schemes? I've been wondering about recursed encryption.  The idea I'm trying to convey here is an encryption scheme where a message is encypted, then somehow encrypted again, and again, etc.

The encryption method may allow other means of security, like take a message, encypt it, shuffle it, zip it, and repeat this process.

I'm guessing that this has been explored somewhere before, but I'm not sure where or how to start researching something like this.

I guess I'm wondering if this particular topic has a name to it.  I'd also like to know:

Where can we find more information about this topic?

I hope this isn't too vague a notion.  I'm just trying to learn more about this and relate it to some ideas I have.

To me the idea doesn't sound like a good one. The security added by repeating the process (encrypt, shuffle, zip) over and over is marginal at best. You'd be better off increasing your key size (say from 128-bit to 256-bit).

Where can you learn more about such a construction? I've seen similar ideas proposed by companies trying to make "unbreakable" crypto, etc. Google "schneier doghouse" (without quotes) and you are bound to find a number of them in Bruce's doghouse.


Can you be DDoS'ed even if you are behind a home router with no open ports? I was wondering if someone can become a victim of a DDoS attack as home user when only his IP is known by the attackers but he is behind a router with no open ports or other known vulnerabilities?

I'm mainly interested because this becomes more and more a topic in professional gaming (which I like to watch). But my feeling is that the players often claim to be DDOS'ed without having a clue if this could be possible and the real reason most likely is that their connection is just bad/there are technical problems. On the other hand, there is a lot of money involved in those matches so ordering a botnet in a price range from $1000 - $10000 for the time of the match could indeed be attractive for some people...

So, is this possible or not? And if it is possible how can it work and are there effective counter measures (other than changing the private IP and not logging in to services afterwards over which the attackers could have get knowledge of the IP)?

Thanks for answers!

Yes you can.

If you relating DDOS attacks to ports and services, like you are here, you are talking about layer 4 to 7 in the OSI model stack. Everything from the Transport layer to the Application layer. Keep in mind there is still 3 layers below this!

Common attacks on these layers could be:

Amplification attacks. E.g. smurf attack. This usually requires vulnerable systems on the internet to be exploited.
Resource exhaustion. E.g. filling up your bandwidth with connection attempts. This could be done using a botnet. A common attack vector being SYN floods.

Unfortunately DDOS will always be prevalent in current days network and systems. Resource exhaustion will always be a concern, and today the ones with the biggest pipes and most systems wins.

DDOS'ing online gamers absolutely is possible and most likely trivial to accomplish just by flooding the victims pipe with bogus requests, hindering or fully disabling legit traffic. The reason I say it is trivial is because today you can rent a botnet fairly easy and cheap.

Considering some online gaming matches doesn't last more than 1 hour, and that you can hire a botnet for as low as $9 an hour, you can imagine the destruction you can do if you have the victims IP address (source).


How to find out if somebody is spying on my private browsing data in the same WiFi network? I live in a hostel and eight people including me, are using the same WiFi network. One of my friends is a "computer wizard".

I would like to know if he is secretly checking my browsing history and if he is able to see the websites that I visited in the incognito mode.

Incognito mode does not provide any protection from Wi-Fi snooping; it merely stops your browser from saving your browsing history locally. If you're using unsecured Wi-Fi (or secured Wi-Fi where the attacker knows the password), there is no way to detect if your friend has been recording your web traffic. Any http sites you visited have potential to have been snooped. If your friend was snooping, he or she may be able to determine which https sites you've visited, but wouldn't be able to determine what you did on them beyond how long you spent on the site and how much data you exchanged.

If you're concerned, you need to talk to your friend. You should also look into enabling WPA2 on the shared router (even if everyone knows the password, it makes it harder for the attacker) and using something like HTTPS everywhere to avoid using http versions of sites when you can. If you're even more concerned about your privacy, @dwarf015 had a good idea: buy vpn service and connect to that.


Can an OS .iso downloaded from Microsoft.com be compromised after the download? I've have looked at and considered Question about potential ISO infection and ISO verification and
How do I check the hash of an ISO?

I've been concerned about security and I have been reading a lot about stuxnet and hearing a lot lately about the leaked NSA exploits and the more recent leaked exploits NYtimes

This made me consider the importance of a clean installation of Windows and how the Windows install itself could be used as an exploit.

Can an iso downloaded from Microsoft.com with seemingly correct hash truly be 100% safe to use on a Windows machine?

- Is there room for an exploit after a clean download?

After the iso is downloaded could there be an exploit to
Spoof the SHA1 using something similar to link
Trick common software like hash calculator that checks SHA1 into saying that it is correct even if it is not.
Compromise USB/DVD imaging software like unetbootin / win32 disk imager / rufus etc. during the "burning" of the iso.

The .iso would be downloaded from:

  https://www.microsoft.com/en-us/software-download/windows7

Windows Resource Protection

  Windows Resource Protection aims to protect core registry keys and
  values and prevent potentially damaging system configuration changes,
  besides operating system files. wikipedia

An answer mentioned that Windows Resource Protection is enough to prevent someone from modifying an iso of Windows. I do not think that is true because there are plenty of programs to modify Windows iso. I fail to see how that will prevent a virus if you can add custom programs to the iso that can run at boot.

If you can prove that Windows Resource Protection is enough (which I don't think you can after looking at the links below) please explain why in your answer.

Here is an an example of programs that can modify a windows iso. Just so people do know that it is possible and how easy it is. nLite and RT7lite

Can an iso be compromised?  Sure, it can.  What would happen?

Microsoft, to their credit, has gotten a lot better about the security of their operating system.  For at least 10 years now, if a critical file in the OS is replaced with an unrecognized version, the device upon boot would ask for you to insert the original CD.  Windows then would replace the compromised file with the correct one.  So if your ISO gets compromised, unless completely replaced with something that looks like Windows and acts like Windows, you'll run into their OS verification.

WRT stuxnet: I've seen 2 posts about that recently.  That case was a particularly unique one. Although no one's taking credit for it (and many suspect that it was the US and/or Israel, no one knows), it was targeted against a very specific thing - the Iranian nuclear program.  I wouldn't worry as much about that as I would about users doing things they shouldn't do.  Your risks from users and generic malware are MUCH higher than from something like Stuxnet.


Security of WWAN cards in laptops I'm thinking about buying a WWAN card for my laptop (like this one here), as it is more convenient to use than USB tethering. However, I'm concerned about the security risk that comes with such a card as it is connected via PCIe.

What if there is a security vulnerability on the modem firmware running on the card? What is the maximum damage an attacker could possibly do? Can the card access memory of the host system?

Edit: I'm using Linux, and the data sheet says the card will use USB 3.0 on all systems but Windows 10. However, it is still plugged in that PCIe/M.2 slot.

There are almost certainly vulnerabilities in the modem firmware, because firmware is no more secure than other lightly-tested software.)

Odds are very good that the card could engage in DMA attacks if it were exploited, and the odds of a random card like this being exploited and the malware being linux-aware both seem relatively small, unless you come to the attention of nation-state sorts of attackers.

This paper says

  PCI Express peripherals are able, through DMA requests, to access other peripheral memory and the main RAM, even in the kernel memory regions, without any control of the processor. This raises a major security concerns if the peripheral is controlled by an attacker. To mitigate this threat, Intel has integrated the IOMMU hardware component, to filter PCI Express messages.

and goes onto explain that there's contention over performance.  It's likely that the configuration of the IOMMU is not robustly tested.


Should I delete my Yahoo! account? NBC News is running this story:  "Experts: Don't Delete Your Yahoo! Account".  According to the story, if your account's email is linked to your online banking account, deleting your account will allow a hacker to recreate it; so instead, you should change the password and security questions.

They didn't say what experts they consulted or quote any famous security gurus.  Has this vulnerability ever been exploited in the wild?  Is this sound advice?

Don't delete your entire account to avoid someone else registering it. Instead, delete saved emails and private information, and leave it with a strong password.

Especially if you used that email address to authenticate with other services (Facebook, online banking, GMail backup address, etc.) or gave it to a lot of people, you should keep it in your possession. Otherwise, an attacker could reclaim the address and simply ask these services for password reset links. Or one of your old contacts might write someday, assuming it's still you who owns the address. You should only delete the account if you can be sure that no entity trusts it anymore, neither your contacts nor any services.

Hence, it would have been sensible of Yahoo to block deleted addresses forever, but in their FAQ they say it's actually possible to register a previously used ID:

  Register a previously used ID

  A deleted Yahoo account ID may become available for future use, and you’re welcome to try to register it. However, Yahoo can't specify how long until a deleted ID may become available, and we can't guarantee that it will become available.

So, it's good advice to not delete your Yahoo ID to prevent new ownership and instead delete personal information from it to avoid damage in case of a new breach.


Is WebRTC safe for connecting random clients to each other? I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to create a WebSocket connection to my server to be able to establish a connection between two random hosts. However the downside of that is that I am forced to exchange their details. Is the most potentially harmful data that is being shared an IP address? and if so what could the IP be used for? or are there bigger things I need to worry about?

In terms of IP address leakage you might want to see How bad is the leaking of Internal IP addresses through external DNS.

Nowadays, WebRTC works only on HTTPS and you should also use WebSockets on wss instead of ws. And I guess this way you should be fine.


Mysterious Incoming/Outgoing Packets on my Wireless Connection Right now I am connecting to my work server as usual and during my connection through the VPN I always monitor the network ping through terminal and its always between 70-90. It usually never goes up beyond that, but lately I have noticed that it will sometimes go up to 1000-3000 then timeout and disconnect me for few minutes until I attempt to reconnect. Everyone in my home who uses the connection has not been engaging in unusual download or upload activity (eg. bittorrent etc).

When I disconnected the server that manages my local network at home, the problem seems to be solved for a while then it comes back, as I check my router to I find unfamiliar Mac address on my network. I am setting up a MAC address white-list to block non home wireless connections. I think this should be sufficient to solve this problem, but how might I monitor incoming/outgoing packets on my network if the white-list is ineffective.

(I'm using a Linksys E1000 router with Cisco Firmware Version: 2.1.01)

This May not be the answer but it won't let me comment.

Sounds like you are concerning about if unauthorized person had access to your network, and according to that you, you trying to Filter MAC Addresses If I am correct, To maybe secure your network? this won't solve your issue as Filtering is not a security feature!

MAC (Media Access Control) or sometimes called physical addresses or hardware addresses. Any device has MAC Address and it can communicate with any router as long as it knows the appropriate pass-phrase. with White-list When a device connects to a router, it always receives a specific IP address if it has a matching MAC address. Else it refuse the connection.

However, MAC address filtering, is more of a network administration feature. It won’t protect you against attackers trying to get onto your network. Therefore, it will allow you to choose which devices are allowed online. Even if necessary to be online * MAC Addresses can be easily spoofed in so many operating system's specially with such nice tool as Kali Linux.

There is tons of packet-sniffer's out there and one of the best is WireShark Where as you said to monitor your network, but the issue still remain if you are not there to monitor it. There is one way around that where you can find a way to set-up network alert to scan and log sniffed packets in certain time of the day or when this alert is triggered somehow according to your preferences.


Is the X-XSS-Protection HTTP header related to the anti-XSS filter in browser? The X-XSS-Protection HTTP header is used to prevent XSS.

Is that header directly related to the anti-XSS filter in browser?

During a mission, I found that Chrome & IE blocked a XSS attack but no X-XSS-Protection HTTP header or CSP were present.

Is this normal behaviour?

Is that header directly related to the anti-XSS filter in browser?

Yes.

The idea is that a value of 0 disables the filter, and 1 enables the filter. An additional mode directive may - and should - be used to completely block rendering of a page if an attack is detected.

In practice, not all browsers implement the header that way. Chrome for example does not allow enabling of the filter.

  Is [blocking without the header] a normal behaviour?

Yes, current versions of Chrome and IE enable the filter by default.


Can RSA keys be swapped? On a theoretical level, is there anything inherently different about public vs private keys?

During RSA key generation there are two keys generated, key A and key B. Key A is private and Key B is public. Could key B be private and key A be public?

Is the choice of which key to be private arbitrary?
Would either key work equally well as the private with the other being public?
Is there some mathematical property that necessitates key A is private?

I know that the on disk format is different and I can't just rename the files. But I'm talking about the raw binary key without any encoding, formatting or metadata.

In RSA there are three important components:

A public exponent
A private exponent
A common modulus (used both with the private and public keys)

So, then, the public key consists of the public exponent and the modulus, while the private key consists of the private exponent and modulus.

But the way things are typically implemented, the public exponent is almost always 0x10001 -- the same value for every key. So only the modulus is unique.

You can see, then, how swapping the private and public key would be problematic here. If everybody's secret was 0x10001, that wouldn't be very secret. So instead we keep the less-easily-predicted exponent secret, and call that one the private key.


Computer sending unstopped ICMP echo request to an IP I noticed while hanging in Microsoft Network Monitor that my computer is sending ICMP echo request to an arbitrary IP address 202.39.253.11.
I looked for the owner of this IP and I found it is owned by some Chinese or Taiwanese communication business called HINET. They seem to have a website at this address, although answers seem to come 202.39.253.12.

I was wondering, am I at risk of opening myself to ICMP tunneling from a remote attacker?

I looked at the packets and they all look the same:

08 00 6E 89 00 01 00 14 49 43 4D 50 20 65 63 68 6F     ..n....ICMP echo

08 00 6E 88 00 01 00 15 49 43 4D 50 20 65 63 68 6F     ..n....ICMP echo

The answers are all the same, except for 9 bytes of 00 data at the end of the answer payload. I know by seeing this that no data is exchanged at the moment, but is it possible that a "spy" software is installed on my computer and could start sending data at some point?

EDIT: They seem to own 202.39.128.0/17

EDIT 2 : Since I am still unable to find out which process is generating all these ICMP requests, I will setup a proxy server using Winpcap to simulate server's answer and figure out which process is reacting to random "commands" from the server. By setting custom routes I should be able to transfer echo request to my server. Any idea on how to detect a weird behavior from a process receiving commands hidden in a ICMP tunnel? I figured I could try using Sysinternals Process Monitor and look of failed registry access or some other types of errors.

EDIT 3 : I finally got it! For some reason I had this idea of using a "brute force" solution to find the process causing the issue. By looking at every single byte sequence on my hard drive, I might find the raw data inside a program's executable file. So I ran the first program I found, "SearchMyFiles" (http://www.nirsoft.net/utils/search_my_files.html) and started a query for ICMP echo. Guess what I found, appart from a whole lot of Google Chrome's history... A dll containing ICMP echo as well as www.hinet.net.
Here's a preview of the data I found:

49 43 4D 50 20 65 63 68 6F at offset 0001E4BC which correspond to ICMP echo

and

77 77 77 2E 68 69 6E 65 74 2E 6E 65 74 at offset 0001E233 (www.hinet.net)

The dll is called gep.dll and is located here C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp
So it seems to be ASUS that sends all these ICMP requests. I do have an ASUS motherboard and I did install the AI Suite from their website.

I still don't know if this connection is legitimate or safe, and I can't find information in the internet regarding this weird communication between an asus process an a server in Taiwan

I had the same problem, constant pings to 202.39.253.11.

I have removed ASUS Ai SUITE II and ran the uninstall cleaner and the pings have stopped

The cleaner was at

http://rog.asus.com/forum/showthread.php?28319-AI-Suite-II-uninstall-cleaner


Nmap and it default scripts when I already know some of the information I am a network guy and not a “hacker” or whatever the official term is these days.

I’ve been learning how to use nmap as I think it’s a great tool for just keeping the network secure.

The thing is Id like to run the “default or (discovery and safe)” against a set of IP addresses.

In this case though I already know what the IP addresses are and exactly what ports they run.

There are also a lot of hosts (over 800).

If I wanted to run the “default or (discovery and safe)” script on this list of 800 IPs which of the following is correct.

Running nmap specifically at one IP with -p 80,443 --script “default or (discovery and safe)”. Does this just blindly run every script “default or (discovery and safe)”. Or does it only run the scripts that relate to port 80 and 443 only. Ignoring whois scripts etc as I know how to exclude those. Or do I have to only include the ones I’m interested in “http-*” etc.
I suppose the question is as to above if the script is for SMB then will it not bother with the script as it can see its for different ports.
My end goal is to scan a list of IPs that I know are alive and I know the ports for with “default or (discovery and safe)” without running pointless scripts I don’t need to. Doing a script for each IP and list of ports in turn is fine if that’s what I need to do.

In this particular task Im mainly trying to see what a "script kiddie" would see generally from options in zenmap without me having to do long IP and TCP / UDP port scans (as I already know them) as well as the scripts. I just want to run the scripts as above and feed in the IPs and ports.

I find nmaps docs quite poor on explaining this as generally most people are doing the scan for IPs and ports at the same time as the scripts.
Hopefully that all makes sense.

In the nmap docs it says:

  Script scanning is normally done in combination with a port scan,
  because scripts may be run or not run depending on the port states
  found by the scan.

So if a host doesn't have http-port open then http scripts won't run for this particular host.
Also, in case the host has another port open (let's say 445) and you don't specify it, then using the -sC option (for default scripts) smb-related scripts won't be executed for this particular host. The above are only valid when script scanning is done in combination with a port scan of course.


PHP Vulnerability May Halt Millions of Servers - max_input_vars! Recent version of PHP 5.3.9 has been released a couple days ago, and Hash Collisions have been fixed, most of the servers actually didn't upgrade their server until now, including my website's server.
In this article I came across a part that has been told sites that are in a shared hosting can't upgrade their PHP by their own I know about that, but I'm wondering isn't that possible to use ini_set to set max_input_vars to secure your site (not server)?
I know that if someone attacks to the server the whole site will be down, but by setting the max_input_vars at least my site will be safe if somebody attack my site. Is this correct?

Interesting article (CVE-2011-4885 for those who like references), thanks for the heads up - I'll be reading up on this but a few points stand out already.

just to clarify - the problem is within the logic tier - not the webserver itself.
your question of whether it is possible to use ini_set is predicated on the underlying PHP engine having been upgraded - when you've already argued that this is unlikely to happen for a lot of hosting providers. OTOH any hosting provider who does upgrade their PHP is likely to deploy the related ini changes or provide a mechanism for doing so.
while most hosting companies will actively avoid imposing a major upgrade on their users, they should be deploying vendor patches to existing deployments - and this patch has already been backported to all production versions of 5.3 and 5.2, I believe that Redhat have now released patches for current RHEL
there are at least 4 different places ini settings can be changed in PHP - in the php.ini file, in the webserver config (when PHP is implemented as a module), in .htaccess files (again if module) and in the PHP code itself - but not all setings can be changed in all places - so far the new config var is not in the manual to say where it can be changed.
in order to exploit this vulnerability, it would be necessary to send a significant amount of variables in the request - Apache (and probably most other webservers) allows some control over the total size of the request, request body, and POST data - also execution time - effective and selective use of these config options in both the httpd config and for specific directory trees using .htaccess could be used to mitigate any potential attack - bearing in mind any need to support (e.g.) file uploads.
the nature of a DOS based on this vulnerability is, in effect, very similar to the problem with range requests on Apache (CVE-2011-3192) - although a serious vulnerability, I've not seen much evidence of that defect being widely exploited.

  I know that if someone attacks to the server the whole site will be down, but by setting the max_input_vars at least my site will be safe if somebody attack my site

I don't understand - certainly an attack based on this vulnerability will not result in leakage nor modification of data / code (AFAICS).


Storing credit card data on behalf of customers: and transfer the data later I'm developing a web application for hotels that send offers to the guest's hotels.
I want to store the guest's credit card data in a secure way, through a third party service as I don't want to implement a PCI compliant solution myself.

I don't want (and I cannot) process the payments, as each hotel has its own payment gateway and it will process the payments later on.
However we should  give to each hotel the capability of accessing credit card data upon offer acceptance by guests.
Hotels must perform antifraud check (like 1$ transaction) or introduce the cc data in their payment software system.

I would like to understand how this workflow could be achieved: most of the online services offer "tokenization" as a storage solution.

Which seems good, but I don't know how the send the card information to the hotels.
It seems to me that tokenization is used to perform later the transaction, which I cannot do on behalf of the hotels. Moreover, once tokenized, it seems to me that data cannot be recovered.
Each hotel must be able to actually see and use the cc data of its guests.

Any help and/or reference to a suitable provider is welcome.

If you touch the cardholder data at all, even if only to receive them and immediately transmit them elsewhere, you have PCI to worry about. (Maybe not directly - if you are not taking payments yourself, you don't have that as a contractual responsibility... but the merchants who do must ensure you, as a third-party service provider, are compliant.)

A tokenisation service only allows you to reduce the number of systems that are in scope, by taking storage out of the equation; it doesn't allow you to escape PCI entirely. You would have to create your own workflow for distributing tokens to third parties and authorising them (strongly!) to view the detokenised numbers; and this would certainly be subject to all the rigours of PCI.

Merchants avoid being dragged into PCI scope by letting a payment processor deal with the whole flow of cardholder data - redirecting the user into their processor's web site when it's time to enter card number, and redirecting back out at the end. I am not aware of any service similar to a payment processor that will take those details for you and, instead of doing an transaction, hand them over to a separate merchant party.

Your model is inherently pretty risky. Your merchants will be doing Card Not Present initial transactions without either the security code (CVV2 et al) or 3-D Secure (VbV et al) in this workflow. This puts a lot of liability on the merchant's shoulders, and puts you at risk of legal fun if there is anything at all wrong with your systems.


Is a return to libc attack possible without the system function? Every return to libc buffer overflow attack I've seen uses the system function to execute commands. I have an executable with DEP enabled (I can't execute on the stack) and the system function isn't linked in (at least, I don't think it is. Running the executable with gdb and typing p system results in a No symbol "system" in current context. message.

Is it possible to still execute a buffer overflow attack to execute arbitrary commands with this type of executable? Are there any tutorials or research papers on this topic?

UPDATE: I was able to exploit the binary by using this tool: https://github.com/JonathanSalwan/ROPgadget

This the main known limitation of the 'ret-into-libc' attack, you can only use the functions that are used by the attacked program. Moreover, in 'ret-into-got' attacks you are limited only to functions that have been already used before you perform the attack (the function location must have been resolved in the GOT).

But, you may use similar functions if they are present. Functions such as execve or any function of the same family may be used (yet, the arguments are a bit more complex to be set).

Just to conclude, this is also because of this limitation that the 'return-oriented-programming' was a big breakthrough since it has been shown to be Turing complete (i.e. able to emulate any kind of function if you have enough gadgets in the .text section). See the famous paper "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)" by Hovav Shacham.


32-bit Radio Voice Encryption, is it really that secure? If so, how? I'm a student studying Electrical and Computer Engineering and a ham radio operator (i.e. my knowledge of encryption is basic). More and more, police and local government radio has become encrypted, this obviously prevents the average police scanner user from tapping in, but what about a better resourced organization?

A lot of systems use either 56-bit DES or a proprietary 32-bit motorola system to encrypt the audio stream which is then transmitted over a digital protocol. From what I can dig up, the systems use a fixed key, but can be over-the-air rekeyed daily, (based on my experience I doubt most organizations use the feature).

As someone familiar with modern encryption the 32 and 56 bit keys seems far short of the 128-512 bit systems available today. IIRC, DES was broken in the late 90s by the EFF.

So perhaps there's some "size doesn't matter (as much)" reason. Otherwise, is it that these systems are vulnerable but not worth anyone's time (Many police agencies still transmit analog voice and don't have a scanner related crime problem).

Here are some more specific references:
http://www.batlabs.com/encrypt.html
http://wiki.radioreference.com/index.php/Motorola_Encryption_Topics
http://www.freepatentsonline.com/3639690.pdf
http://www.freepatentsonline.com/4167700.pdf

I agree with your analysis of the reasons why police departments and other agencies would use "weak" encryption products with their radios: simply because as of the current day encryption crackers are rarely used by common criminals that listen to radio transmissions of such agencies (they perhaps use analog/digital radio scanners, but such scanners can usually be defeated by using encryption of any kind, even if weak and/or proprietary).

It is true, however, that 32 or 56-bit encryption of any kind is pretty weak and can be bruteforced with proper knowledge of the radios and communications protocols used in them. This is why most agencies that process anything related to "national security" or "classified information" (think DHS or FBI) do not use such forms of encryption, but instead use actual strong encryption such as AES-256-GCM (see 1 and 2). That, or they use their own proprietary encryption algorithms (eg. Type 1*) and modules.

*Motorola (which is a common vendor) has boards/modules that support Type 1 encryption (see the FASCINATOR module in 3 and usage of Type 1 in the section "2.2 Security Features" of 2).

References:

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1752.pdf
http://www.crypto.com/papers/p25sec.pdf
https://en.wikipedia.org/wiki/FASCINATOR


How can I ensure my API is only called by my client? I have an API Key to a paid service. This API is invoked from an unauthenticated page on my site. I am proxying the request to the paid service through my backend server. I have also added CORS on the API to make sure it is called from my site.
THe above protections work when a user is accessing it through the browser. However, the API can be accessed from postman and this could result in me having a huge bill for the paid service. What is the best way for me to ensure that the API is only called from my JS client?

You can't. Even for things that aren't a website, like an embedded device, somebody could always open up the hardware and inspect the firmware or, in an extreme case, de-cap the chips and examine them with an electron microscope. For websites, it's utterly trivial. Anything and everything your client can do, so can any other client. That's inherent in the decentralized nature of the Internet and also in the way web pages work.
There are things you can do to limit abuse, like having your server make the request (rather than the user's browser) and limiting the rate at which it will do so on your users' behalves. Authentication might potentially let you limit requests per user and/or pass along the bill. Actually controlling the client used to talk to your server (or the third-party one) is impossible, though. At best, you can obfuscate your code and try to hide the access key, but in the end, you can't hide it perfectly.


Acquire new permission after installing an Android application I would like to know if there is an attack that allows an installed Android application to acquire further permission that is not assigned initially during installation.

I did some research and found that there is a method called "Permission Re-Delegation" which allows for other additional permission by targeting the authorized applications via IPC mechanism. Are there any other methods or names of malware that already take advantage of this vulnerability?

What you are asking about is known in the hacking world as "Privilege Escalation". It's a fairly broad term that encompasses a lot of techniques over a lot of operating systems and platforms, but is generally taken to mean exploiting a bug or flaw within a system to gain additional levels of access -generally administrative in nature.

To my knowledge there is no method available to do this on the current version of the Android OS and I suspect it would be regarded as a 0-day if it were possible. It's also important to consider that these types of exploits may be Phone specific, as each manufacturer applies their own "skin" to the stock Android OS. If you are looking for bugs in older versions of Android, you may want to check something like exploit-db.com. Here's one from back in March for Android One.


Has there ever been a case of a CDN spying on proxied HTTPS traffic? My question is about CDNs. As I understand it, data flow looks something like this:

browser ==(https)==> CDN ==(https)==> originServer

In theory, this configuration should provide quicker retrieval time for the static .html, .js, .css, and .png files that comprise my app. All of these items are static and non-confidential, by the way. From the user's perspective, they live at https://www.myDomain.com.

But there's also dynamic data that's exchanged via https://ajax-www.myDomain.com. That content actually is confidential and I'd like to protect it from snooping eyes. It occurs to me that any employee working at the CDN could read the confidential 'ajax-www' content if he so desired, seeing as how the whole point of the CDN (as I understand it) is to act as a HTTPS termination point, cache data when possible, and pass it on.

Of course, I could circumvent the CDN entirely for 'ajax-www' calls. After all, the data in question is dynamic and can't be cached anyway. But then I'd be revealing the location of the origin server to the outside world and more importantly, I'd be losing the DDOS protection that the CDN provides.

The discussion here recommends that CDNs should be avoided for session-specific data but is there a viable alternative?

Is this even something worth worrying about? Has there ever been a (known) case of a CDN snooping on client traffic, either of their own volition or as a result of government pressure? Casual searching doesn't turn up anything. CDNs seem to be considered beyond reproach. But I just figured I'd ask -- the specific CDN that's under consideration is based out of Dubai so it's not like we'd have any recourse if snooping were to occur.

Sorry for the basic nature of this question. I'm kind of new to this stuff. Looking forward to hearing your thoughts.

If you don't trust the CDN, don't use it.
You have absolutely no way to know it the CDN reads your data or not. The CDN probably reads the data, to mitigates attacks.
If the data require a high level of protection, use a CDN under your jurisdiction.
If the data require a medium level of protection, you could bypass the CDN, and if you are under DDOS attack, switch to the CDN (switch your back-end to another IP too)
For static data, you can use a less trusted CDN if you :

use SRI to ensure the integrity of your resources
mask your referrer to preserve the privacy of your visitor (ex: <meta name="referrer" content="origin"> )


Why is ms08-067 stopping at "Attempting to trigger the vulnerability"? Using Metasploit I am trying to attack an unpatched Windows XP SP3 Virtual machine with the ms08-067 exploit but it just gets stuck at Attempting to trigger the vulnerability. I assume this means the exploit failed for some reason but I would like to make it work. Do I need to enable any GPO or some other change on the target for the exploit to work?

I have checked the following:

The targets firewall is turned off and has no defences.

I have checked in add remove programs with the show updates box ticked and there is no patches.

The target IP address is correct.

Port 445 is open.

I got this working by changing my target machine to Windows XP SP2.


Opinions on my "Encryption at rest" implementation idea Ok so basic overview of the environment I'm envisioning: Webapp w/ db backend storing sensitive data, possibly phi; standard user:pass auth due to unteachable users.

My idea was to encrypt row data in sensitive tables stored in a db using a key that was derived from the user's password (ie the hashed pw using a different algorithm from how the pw is stored in db: eg. store for auth: blowfish(pw), encrypt w/ key=md5(pw) ). That way I could store the encryption key in session (in order to allow authenticated user access to their records w/o reentering pw) without increasing the risk of pw leaking and could destroy w/ session and regenerate on login.

Benefits:

It seems to me that an attacker couldn't use the data if they stole it while "at rest", ie the application was shut off or in a backup.

Drawbacks I can already see:

If you forget your password, you lose all your data.
It becomes impossible to edit db contents manually, everything must be
authenticated with the pw used to generate encryption key.
Doesn't protect data while a session exists.

What I'd really like to know:

Am I missing some fatal flaw in my scheme?
Is there a better way to store the encryption key while the session is active?

Clarification:

Ok I think I may have been unclear in my original wording of the question. I meant that I'd store a cryptographically secure hash of the password (likely using blowfish) for the authentication, which means a collision or bruteforce of the password won't be easy (unless someone breaks blowfish, which is always a risk). Simultaneously to authentication (when someone enters their password anyway) I'd hash the password using some other algorithm (probably something like md5 since I don't think it needs to be cryptographically secure at this point) which then would be stored in the session and used to encrypt/decrypt the rows belonging to the user who is authenticated for the duration of the session.

My thoughts wrt to increased attack surface are thus:

If an attacker compromises the hash of the password used for auth they can simply log into the application normally and extract the data that way.
If an attacker compromises the encryption of the db data then they have everything at that point and there's no point in getting the password. However if they were able to extract the encryption key and for some reason wanted to log into the application they wouldn't benefit from collision attacks on md5 because that's not the hash used to store/authenticate the password. And a collision against one hash is basically guaranteed not to be a collision against another different hashing algorithm.

Possible remediation of below vuln:

generate a good pseudo random cryptographic key before any data is stored
encrypt cryptographic key w/ password (I don't need to transform the password for this version I don't think)
on login decrypt key and store key in session
use the key to perform encryption/decryption on rest of the data

why I think this might work is you can't differentiate plaintext from incorrectly decrypted gibberish so the ability to check if your guess was correct is lost, even if you have a list of likely possibilities you can't tell if one worked. Also you get no help brute forcing the encryption key because that's now a proper random value.

The only real security issue I see with your approach is that you only seem to talk about encrypting the data -- you do no check that the encrypted data has not been tampered with.  It would possible to modify encrypted data (where you just took a message, applied AES-CBC or AES-CTR mode to the data), where you can guess the form of the plaintext and alter the value (by XORing as appropriate to the block cipher mode to change the corresponding XOR of the plaintext data).  The way to protect against this is to use authenticated encryption modes that combine encryption with a message authentication code (roughly a hash that you can only construct if you know the secret key).

I do see many usability issues from your approach.  First, you lose most of the benefit of using a big database to store information about lots of users.  You can't add or update or modify encrypted information for a user if that user is not logged in (e.g., as is couldn't use this for a messaging system, or for a system that automatically imports information from an external source).  You can't build any indexes, or fast searches, or agreggations, or joins inside your RDBMS that act on data in an encrypted row.  Your database query planner can't plan for the distribution of your encrypted data to execute the right plan.  Data can't be shared amongst users who should be able to access the same information without keeping redundant copies, which goes against the basic rules of database design and will leave you with inconsistent data (as you can only update the information for the current user).

As you mentioned, there's no way to deal with a user forgetting their password without wiping out all their data.  You would need to modify this so this feature is present, as real users will need their passwords reset.  (You can do some sort of system where you store every users key in an encrypted fashion with a strong passphrase protected key).

Finally, this doesn't buy you much extra security.  Any one who gets administrator access on those systems could get access to the protected data if they were a little patient and just waited for the user to login.  They merely log the incoming network requests and capture the user's passwords (at which point they can decrypt the data, either through the system, or from a database dump).  It does not seem significantly safer than having a well developed application sitting on an encrypted hard drive (with encrypted backups), where strict user controls and logging are done at all steps.


How do 2FA (and other account verification) systems identify true mobile numbers vs VoIP numbers? I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages.

My goal was to have a dedicated DID/number which I don't publish publicly that receives SMS messages, such that socially engineering access to my primary mobile phone number won't grant an attacker access to my 2FA SMS.

(And yes, I would rather use TOTP. Sadly, some vendors only offer SMS, and won't SMS to a VoIP number)

How do online services determine if a number is VoIP or a true mobile provider? If I port a Canadian VoIP number to a mobile carrier will I be able to receive such messages or will I permanently limit my options by continuing to use this number?

In a manner similar to how some online services detect VPNs based on known VPN IP address databases, VoIP numbers come in batches that have known prefixes within each area code. Certain providers choose not to allow VoIP numbers for verification because they can be obtained and accessed from anywhere in the world, and are harder to tie to real people, locations or accounts, and are easier to change or dispose of. Some service providers also do not want to be liable for fraud committed by intercepting SMS messages while they are in the IP domain. Intercepting a text message on a cellular network is much more difficult than on a hijacked VoIP account. An attacker does not have to physically obtain the device (like stealing a mobile phone) on a VoIP account, just obtain login credentials.


I don't quite understand the principle of "use after free" and CVE-2010-1119 I am a rookie hacker studying android vulnerabilities. My partner and I are studying "CVE-2010-1119".
Unfortunately there does not appear to be enough information online. Could anyone please help me describe the principle of the vulnerability, ideally in a similar way to how this has been explained?

This is a very complex question, and I'm not sure where you stand technically.  I'll lay out some background to help you get to the point.

Basic refresher

A computer has a couple of important parts: a Central Processing Unit (CPU) and Random Access Memory (RAM).  Essentially, a CPU reads a few bytes of memory from RAM, performs the instruction they contain, modifies some data, reads a few more bytes, performs the next instruction, and so on.  Most all modern computers work on this basic principle.

RAM is simply a chip with a lot of bytes of storage.  The RAM chips in a typical PC might have 2 billion bytes (2GB).  And each byte of that RAM has an "address", which is just a number that lets the CPU access that specific byte.  The computer can store either data or program instructions in a byte, then come back later and read them.  A computer can also store a value in one set of bytes that contains the address of a different set of bytes - this is called a pointer.

Of course, your desktop computer is a lot more complex than just one program.  It loads many programs into different sections of RAM, and the CPU rapidly switches between all of them to do your tasks.  One main program the computer runs is called the Operating System (OS) - Windows, iOS, Android, Linux.  One job of the OS is to allow these programs to share the CPU without letting them crash into each other.  The computer has only a limited amount of RAM that has to be shared by all the running programs.  So instead of using any piece of RAM, each program must ask for RAM from the OS.  The OS assigns an area of RAM for the program, and the program can do what it needs with it.  But if it tries to access RAM that is not assigned to it, or tries to violate the privileges assigned to it, the OS will terminate the program.

But the OS handing out memory is kind of slow.  Inside a program, a memory manager is responsible for the same task.  When a program needs memory for a small task, like creating a window, the program's memory manager keeps track of RAM addresses that are assigned, and which are free.  It keeps them in a table of pointers.

Object Oriented programming

Objects are a way for a programmer to logically group data and instructions for working with that data.  Objects can represent anything the programmer needs, such as a Window or a Button or a Customer or a Link.  A Window object might store an X and Y coordinate on the screen, maybe have some scroll bars, plus a "Draw()" method for painting the contents when the window becomes visible.  A Button object might have an X and Y and height and width dimensions, text for a label, and a Draw() method for painting itself on a screen.

Within an object oriented program, a program will create and destroy thousands or even  millions of objects continually while it runs.  Creating an object uses a command called "new", which is simply asking for an area of RAM to be assigned to that object.  The memory manager returns a pointer to the address of the RAM allocated to the object, and the program keeps this pointer associated with the object.  When the program is done with the object, it calls "delete" to get rid of it.  The memory manager then marks that RAM as freed-up, and will be able to assign that RAM to some other object request.

Some languages like Java and .Net run in a special runtime environment that automates the task of freeing memory after the objects are deleted.  This automated task is called garbage collection.  In other languages, like C and C++, the programmer is responsible for some memory management.  And sometimes, the programmers make subtle mistakes.

The setup

When a program creates an object with new, the object name is associated with a pointer to the address in RAM assigned to contain the object's methods and data.  The program can make a copy of that address, too, so that other objects can refer to that object.  An example might be a Window object containing pointers to Button and Hyperlink objects.  Perhaps the Button has a Hyperlink associated with it.  So the Window may have a pointer to the Button, and the Button has a pointer to the Hyperlink. Meanwhile, the memory manager's table looks like this:

RAM Addresses:
1000-2000 assigned to MyWindow
2000-3000 assigned to MyButton
5000-8000 assigned to MyHyperlink

The code might look like this:

MyWindow::Draw()
{
    ...draws frame and scrollbars here...;
    MyButton->Draw();  // Calls address 2000 to tell the button to draw itself.
}

MyButton::Draw()
{
    ...draws button and colors it in here...;
    MyHyperlink->Draw(); // Calls address 5000 to tell the hyperlink to draw itself.
}

The bug

What if the Window object deletes the Hyperlink object, but doesn't tell the Button object?  The Button still has a pointer to the Hyperlink's old memory address, but the memory manager has been told to delete the Hyperlink, and to free that memory up so it is available to some other object.

MyWindow::DeleteLinks()
{
    delete MyHyperlink;  // Frees the RAM from address 5000-8000.
    Draw();              // Calls MyWindow::Draw to repaint the screen.  Inside
                         // Draw, it uses MyButton's address of 2000 to tell
                         // the button to draw itself.  And inside
                         // MyButton::Draw(), it will still call MyHyperlink->Draw()
                         // at address 5000, even though we just freed it!
}

Surprisingly, this usually works long enough to pass a test!  When the memory manager is told to delete the MyHyperlink, it simply marks the space available, like this:

RAM Addresses:
1000-2000 assigned to MyWindow
2000-3000 assigned to MyButton
5000-8000 is free

But the bytes still hold their old values from when it was a Hyperlink.  When MyButton->Draw() is called, the old MyHyperlink-Draw() function is still in RAM at address 5000.  So the testers don't see any bugs, and the product goes to market.  There is now a "use-after-free" vulnerability in this program.

The crash

Let's say there's a web page that makes the program create a button with a hyperlink, then destroys just the link, then creates a new Image object.  The memory manager allocates the new Image in memory marked as free, which now includes the address space where the Hyperlink used to be.  The Button's pointer to the Hyperlink is still pointing at 5000, which it thinks is still a valid Hyperlink.  But when the Button uses the pointer to call the Hyperlink, it's instead incorrectly calling bytes stored in the RAM that used to be a hyperlink, but are now in the middle of image data.

RAM Addresses:
1000-2000 assigned to MyWindow
2000-3000 assigned to MyButton
3000-10000 assigned to MyImage, but MyButton still thinks that 5000 is MyHyperlink.

The program crashes, because address 5000 points squarely into the middle of a picture of puppies.

The exploit

A hacker notices this crash, and decides to exploit it.  He places instructions in a specially built picture file so that when the picture is loaded, and MyButton->Draw() is called, it will execute the instructions contained at byte 2000 of his image.  His image contains specially crafted code at 2000 (usually something like a NOP slide) that will divert the instruction pointer to his malware stored elsewhere in the picture that was downloaded.  Once that code executes, he owns that computer.

The first thing a hacker generally tries to do once his code is executing is to exploit a second vulnerability in the operating system to try elevate its privileges.  That way it can then download more sophisticated malware files, and write changes to files on the disk so that the next time the computer boots, it runs again.  It could hide itself using a rootkit.   It could run a bot client, or a keylogger.  It could send spam.  It could launch DDoS attacks.  It could install Cryptolocker and blackmail the owner.


What are some instant red flags when scanning an network with nmap When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other open ports should I be on the lookout for?

To echo gameOver's comment and elaborate further, simply detecting that a port is open is interesting but I wouldn't see it as an immediate 'red flag'. Perhaps a better approach might be to run Nmap with the -sV or -sC flags which will either run a service/version scan or launch the default NSE (Nmap Scripting Engine) scripts against the target port that you've deemed interesting, provided you have the proper authorization to do so.

So, for example let's say you discovered  that port 21 is open, which is interesting, but it only becomes a potential attack vector when you can enumerate the service running behind it. Once you discover the specific service you can begin searching CVEs and gain a better understanding if there is a vulnerability tied to it. By running a script-scan, the NSE will test your specific port in question and will output its findings, this might include (for port 21) an anonymous FTP login misconfiguration that allows for read/write access.

Now, after further enumeration of the service running behind port 21, you have a potential attack vector.

As a final note, there are some known ports where specific types of malware have a history of using, but these can also be false positives as I could simply run my SSH client out of TCP port 31337. You might see this port as open and immediately think Back Orifice! Instead I'm just running SSH using an unusual port to do so.

Sources:

https://nmap.org/nsedoc/scripts/


What is the most secure way to digitally communicate between the U.S. and China? What is the most secure way for two people to communicate digitally when one person is in the U.S. and the other is in China (likely being monitored)?

Updated:  Here's some additional info:

The data are traveling both ways.
The amounts of data are small: less than 10MB usually.
GPG may satisfy the requirements. I posted the question here because my understanding of infosec is not sophisticated enough for me to make that judgement myself.

Revised scenario:

Two parties wish to share information digitally, back-and-forth. One party is in the U.S., the other in China. The two parties do not want any other parties to be able to decipher the information at any point in the stream. The data transfers have a maximum size of 10MB. The budget is small – $10/month.

If PGP or GPG will meet these needs – that's perfect. I'm asking in case there is a vulnerability in this scenario that I'm not aware of or considering appropriately.

With the Great Firewall of China, the country has a tight grip on its communication infrastructure, especially on the IP and TCP layer, however there are still some options left. It all depends on the volume or reliability though.
Be careful! By using VPN or TOR you will become subject of investigation, especially if you are building connections to the USA
VPN:

China Unicom, one of the biggest telecoms providers in the country, is now blocking connections where a VPN is detected, according to one company with a number of users in China.
In early 2015, China cracked down on VPNs, software that allows internet users to access Twitter, Facebook, Gmail and others websites blocked in the country, according to state media and service providers. Many users reported VPN service disruptions. However, some VPN providers still work in China.

TOR:

Tor is most of the country, however that many IP addresses inside the China Education and Research Network (CERNET) are able to connect to at least to the Tor relay. Apart from the CERNET netblock, the filtering seems to be quite effective despite occasional country-wide downtimes.

SSH tunneling

By establishing an SSH tunnel, a user can forward all their traffic over an encrypted channel, so both outgoing requests for blocked sites and the response from those sites are hidden from the censors, for whom it appears as unreadable SSH traffic.