How does lack of SMTP authentication impact users? My school supplies an email address for its students. To connect to their email server, no authentication is needed for the outgoing mail server. So no user name, or password is needed and no SSL/TLS is used (and it's port 25). However incoming email uses SSL and requires authentication.

I am not very knowledgeable about email security. What practice risks does this present to a user? I am guessing it makes it easy for anyone to forge an email address. But does it make it easy for a message to be intercepted and red by a third party? I know it can be used for spam relay, though I'm more concerned about how a legitimate user can be compromised.

If relevant I wouldn't be connecting to the email from the campus internet.

That is the way the SMTP protocol goes... The authentication required by some SMTP servers is only used to prevent unauthorized people to use those server resources to send mail. In any case neither the From: header, nor the Reply to: one use the authenticated used name, but are prepared by the client application. Only webmail servers use the name used for authentication to fill the From: header.

Said differently, once you have a validated account on a server accepting the SMTP protocol, you can configure your mailer (Thunderbird, WindowsMail, etc.) to use almost any forged From: address. Some carefully configured servers will require that you use a domain they own, but the part of the address before the @ is never controlled (*).

So you should never trust the From addressed unless the mail is digitally signed. And the configuration of your school is acceptable on a security point of view. Anyway, if someone uses the mail server to send a forged offensive mail, the server normally keeps in its log the IP address used to send the mail. On a LAN, it is normally enough to find who is responsible for it with the help on login logs...

In the opposite, reading mail always require authentication, because a mail belongs to its recipient.

(*) some corporate servers do use corporate directories to control that the From address is valid for the authenticated user, but that is an advanced security practice.


What is the output length of CBC with zero input? Given this formula for CBC encryption from 6.2 The Cipher Block Chaining Mode

what is the output length of CBC if plaintext P is of length 0?

Block ciphers like CBC require an input as multiple of the block size. In this case P would need to be padded to be one block long.

Another thing to notice is that the first block of P is being XORed with the IV which is also one block long - this will also ensure that you start with an input data of size which is at least one block long.

Being a block cipher your output will be the same size as input (excluding any communications for IV between sender and receiver).


How useful are file shredders for nand flash memory (ios memory) Flash memory uses wear levelling (changing the physical location of data stored) to maximize memory life. Most flash memory has some "spare" space that is unreported that allows it to replace bad parts as they wear out. This means that there may well be small amounts of (worn/bad) memory that still holds some of your data.

iPhone uses nand flash memory (which uses wear levelling), so how can file shredders overwrite data in worn out areas.

Can fileshredders be used on iphones? How useful are they?

They aren't, in general. The point about spare space which is unreported is that it's for internal use only - any software accessing the memory through normal methods doesn't know whether the data goes on what was previously spare space, space which has never been used before, or if it's overwriting some data which is marked as deleted.

If the memory unit (drive/chips/whatever) has some specific "wipe" method, it might be that this specifically overwrites spare space, but the only way to check would be to access the data in a non-standard way, since the normal methods would just show the data on the currently readable parts. You'd also have to trust that the method which was provided by the manufacturer actually did what it said it did.

However, if you've used full disk encryption (or equivalent - full device encryption, perhaps, with a phone), it all becomes academic. If the keys are destroyed, any data is practically unreadable, whether you can pull it off spare space or not. That's why the general advice for SSD/flash memory use is to encrypt before writing anything important to disk - it means that even if there is some data you can no longer overwrite reliably, it still can't be used.


How do I recover from an email breach? A few days ago, I noticed something a little bit off from my Gmail account, my primary account, which all my addresses forward to, was showing less incoming email. Usually I have roughly 6-10 emails waiting for me in the morning: recently it's been more like 1 email.

Last night I got up in the middle of the night local time (US Central), and saw five unread emails. I answered one and went back to bed with the others untouched. In the morning, I got up and to my surprise found one unread email. I changed my password to something generated from cjshayward.com/passwords. I also set up a separate email account on Hotmail.

Conversation with the editorial team revealed that there were apparently several emails my editor had sent me and was presumably wondering why I hadn't responded. I addressed the points the team had raised in their email and asked for correspondence to be sent to the new address.

What, if anything more, should I do from here? I don't trust my email filters 100%, but if I introduced a bug filtering, they don't account as far as I can tell for my leaving four unread messages, after all my filters had already been applied, and then coming back and finding only one unread email left. How should I contact Gmail for any help?

Thanks...

At the bottom of the page in Gmail, you should see something like this:

If you click the 'Details' link, you will get a pop-up window showing all the recent IP addresses used to access your account, along with some other information.

You can probably use this to determine if someone else has been logging into your account.

You can also set up 2-factor authentication for Gmail to make it harder for someone to break into your account.

I wouldn't suspect a mistake in your filters, since you saw the messages in the first place.  A filter would act on the emails coming in as they come in, so you either wouldn't see the messages at all, or you would see them, and they would stay put until you (or someone) deleted them.

As an aside, I would suggest never having a filter delete a message outright, and only have them move messages to the trash.  This way, you can still save mistakenly filtered messages if you notice them in time.

It is possible that the spam filters retroactively marked some messages as spam, so you can look in the spam folder to see if they are there.  I don't think this is a very likely scenario, though.


Security of cloud-based password manager (Dashlane, LastPass) vs. federated login (OpenID, Google, Yahoo, Microsoft, Facebook) Many websites offer the option to log in with your existing Google or Facebook account (among others).  For a long time I've resisted doing this because I use a password manager and I figured it was more secure to create a separate account for each website with a strong, pseudorandom password.  The browser integration for some cloud-based password managers is great, and I started to wonder why nobody had created a server-side version.  Then it dawned on me that federated login basically is the server-side equivalent of a password manager (assuming you don't reuse passwords for the password manager).

Purely from a security standpoint, is there any good reason why I should prefer creating unique login credentials and storing them in a password manager vs. using federated login, or vice-versa? (assume I want to use a cloud-based password manager)

At least one way to look at this is to consider the strength and quality of the authentication offered at the target site against the Identity Provider (IDP) you intend to federate with.

For example, consider if you have a choice between opening a new account with a plain old password (which you will store in your Password Manager app) vs. redirecting to an IDP that performs Risk-Based Authentication (RBA) in addition to your password for the IDP. The system with RBA potentially will consider a variety of factors to score the authentication session, such as the IP address of the client, the characteristics of the browser, the "normal" pattern of the behavior for that user, etc. If the risk score turns out to be high, you may get prompted for answering some questions or another step up method already configured at that IDP.

In this case, which option do you prefer? Just the plain-old password, or an IDP with Password+RBA? Services such as Facebook are gradually deploying risk-based capabilities on top of the authentication service (which is why you may get prompted with a picture of a friend to name, etc). You can read more about RBA in this report:

http://www.landsbankinn.is/library/Documents/Frettir/The_Forrester_Wave_Risk-B1.pdf

a more generic definition is available from here:

http://whatis.techtarget.com/definition/risk-based-authentication-RBA

Regards.


Validating JWT in server-to-auth-server scenario The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario?

I am looking at the example custom login from Auth0 here:
https://github.com/auth0-samples/auth0-aspnet-owin-mvc-samples/blob/master/Samples/custom-login/MvcApplication/MvcApplication/Controllers/AccountController.cs

I see the token is received and the claim information parsed into cookie but it is never validated, is this correct?

I have found the library that is used in this sample code here:
https://github.com/auth0/auth0.net/blob/master/src/Auth0.AuthenticationApi/AuthenticationApiClient.cs

The sample is using the Resource Owner Password Credenatials flow (which is rather not recommended) but that is not the topic of the question. You can see in the related library that at the response the Identity Token is validated with an AssertIdTokenValid() function which is using IdTokenValidator:

private Task AssertIdTokenValid(string idToken, string audience, JwtSignatureAlgorithm algorithm, string clientSecret)
    {
        var requirements = new IdTokenRequirements(algorithm, BaseUri.AbsoluteUri, audience, idTokenValidationLeeway);
        return idTokenValidator.Assert(requirements, idToken, clientSecret);
    }

So by default the library is validating the Identity token.

The Access Token does not have to be validated in client application (Relying Party). It is only used by this client to authorize against API that the access token will be sent to - like it is when the UserInfo is requested to get the user claims. It is APIs responsibility to validate that access token.

DISCLAIMER: It is recommended to use Authorization Code flow with PKCE in such scenarios.


Do anti CSRF tokens need to be hidden? If the tokens are not hidden, I think the attacker can load the exploited site in an iframe, but he won't be able to access the token because of same-origin-policy (SOP).

Is this correct, or are there other ways of accessing CSRF tokens?

You cannot hide or encrypt your CSRF token, as it is usually passed to the web application in HTTP GET or HTTP POST request and it should be present on HTML page (or generated by JavaScript, which is basically the same).

CSRF-token is only one way to protect your web application against auto submissions (aka CSRF attack). Its usage is recommended when dealing with not very sensitive data. If you want to protect your web application against CSRF with CSRF token, I recommend you generate a new token at least every 15-20 minutes, so it cannot be easily brute-forced.

In many real-world implementations CSRF token is bound to session identifier. The same advice is valid for session identifier as well.

As for SOP, it should not allow by default to access elements within iframes. However, there have been vulnerabilities in many browsers in the past, which allowed this behavior.

The bottom line – you do not have to hide CSRF token. Instead, generate a new one once in a while. For very sensitive actions use additional means of user verification, e.g. request for user's password or use OTP.


What's the common pragmatic strategy for managing key pairs? I have a small number of different workstations (plus client devices like iPhone) that I use for to connecting to numerous servers using SSH.

Originally when I learned about PKI, I created a single key pair on my workstation, which I promptly started using from everywhere (meaning I copied it to my laptop, etc), and used it for connecting to all of my server accounts.

Since then, I've developed the opinion that this is akin to using a single password everywhere, and I might need to revoke access selectively, e.g. if one of my workstations is compromised.

Basically I'm trying to develop a personal strategy for dealing with key pairs:

What is the right way to think about key pairs securely for general use, while remaining pragmatic for usability? (i.e. I don't think single-use key pairs for every connection point necessarily makes sense either.)

Is it wrong for a key pair to represent a personal identity globally from all access points ("me-everywhere-id_rsa") as I did in the past, or is my current thinking that a unique client-user combination should always be represented by its own key ("me-on-my-personal-laptop-id_rsa") more appropriate?

Do you reuse the same key for connecting to all servers, or under what conditions do you consider minting a separate key?

You already saw the main point: if one of your machines is compromised, the private key contained on this machine must be "revoked": you must configure all servers on which you connect to reject further authentication attempts using that key (i.e. you remove the corresponding public key from the .ssh/authorized_keys of the servers). There is a mitigation technique, which consists in securing the private key with a password (or passphrase). This comes with a price, namely that you have to type the password (ssh-agent can be quite handy for that); on the other hand, this may temporarily deter the attacker from obtaining the private key (this depends on the kind of compromise, but if it is a theft of a complete machine -- a plausible scenario with mobile devices -- then the password will prevent immediate access to the private key and give you some time to reconfigure the servers).

One may note that "PKI" means "Public Key Infrastructure" and SSH is rudimentary in that respect. In a full-blow PKI, certificates would be used, with delegation, and centralization of revocation. With certificates:

you would create one CA key pair, stored safely somewhere;
for each client machine, you would obtain a fresh key pair, the public key being signed by the CA;
the servers would be configured to automatically accept any public key signed by the CA (they would know the CA public key, but not the individual client machine keys);
the CA would maintain and regularly publish revocation information, i.e. the list of public keys which must no longer be accepted even though these keys are signed by the CA (revocation information must be pushed to the servers, or pulled on demand).

The great thing about certificates is that you centralize decisions, which, in practical terms, means that if you connect to 20 servers from your client machines, and then add a new client machine, you do not have to manually push the new public key to all the 20 servers.

OpenSSH, since version 5.4 (released March 8, 2010), has some support for certificates; see the eponymous section in the man page for ssh-keygen. The OpenSSH certificates have a much simpler format than "usual" X.509 certificates (as used with SSL). The simplification also has a price: there is no centralized revocation support. Instead, if a private key is compromised, you still have to blacklist the corresponding public key on all the servers, and the blacklist is, in OpenSSH, a whitelist (option AuthorizedPrincipalsFile in sshd_config) which is, normally, under the control of root. So revocation does not work well and you still have to manually configure things on each server whenever you create or loose a key, the exact inconvenient that PKI was supposed to abolish.

You could still make time-limited keys, because OpenSSH certificates can embed time-limited keys. In that case, you would give to each client machine a key which is good for, say, one week. With keys which die after a week, and a CA public key known by the servers, you have the main CA goodness (no need to push anything on all the servers when a new machine is added to the client pool), and if a private key is compromised, the damage is "limited", assuming you had a key password which, presumably, would resist one week of cracking (but this will not work if the compromise is an hostile takeover with a key logger). Time-limited keys can grow tedious over time, and they assume that all servers have a correctly set clock, which is not always a given (it would be unfortunate to be locked out of a server because the server clock is wildly off, and resetting the clock requires SSH access to the server...).

An additional issue with SSH is that it is easy to add public keys on each server. This means that if an attacker compromises a private key and gains access to a server once, he can add his own public key to the .ssh/authorized_keys on that server, and no amount of revocation will fix that. Revocation is, by nature, an asynchronous process. Hence, it does not implement a sufficiently strict damage control.

Given the shortcomings of SSH support for certificates, there is no reasonable scheme which avoids having to do some configuration on all the servers in some situations. So you have basically the following choices, when you add a new client machine:

You copy the private key from another client machine (that's what you are doing right now). This requires no extra configuration on the servers.
You create a new key pair for that machine. You have to push the public key to all the servers.

In the advent of a key compromise, you must connect to all the servers to remove the corresponding public key from all the .ssh/authorized_keys. This is unavoidable (to avoid it, you would have to use certificates, and SSH is not good at certificates, see above). Then, if you used choice 1, then you must also create a new key pair and push it to all the client machines which were using a copy of the compromised private key.

Hence, choice 1 entails less configuration work than choice 2 in the normal case, but things are reversed if a key compromise occurred. Since compromises are normally rare events, this would favour choice 1 (which is what you already do). So I suggest that you protect your private key with a strong password, and copy it to all your client systems.

Note: in all of the above, I assumed that you wanted to connect to a list of servers with SSH, and you wanted to access any of the servers from any of your client machines. You might want to restrict access, such as accessing a given server only from one or two specific client machines. This can be done with multiple client keys, but configuration complexity increases quadratically.


Why does Tor browser use POST method for DuckDuckGo? I noticed that the default behavior of Tor browser is to use POST method for all DuckDuckGo searches even when that's not the default DuckDuckGo setting. At first I thought it'd be to protect the search query from the exit node believing that TLS doesn't encrypt the HTTP header but, I was wrong. I found that HTTP Headers are encrypted if the site uses TLS certificates which DDG does and it's equally difficult for exit node to figure the query string no matter which method is used.
So what's the concern that Tor is trying to address by switching to POST?
If it helps, I've captured images of both, GET and POST request headers on DDG.
GET

POST

With POST the actual search is not part of the URL. It will thus not be visible in the Referer header to a potential remote side and it will also not be part of the local history. See also this comment in the Tor issuer tracker about the setup of DuckDuckGo in the Tor browser:

You should probably do a POST request here as the value of the searchTerms parameter will be leaked as part of the Referer header.


Relationship between DoT / DoH and HTTPS I'm trying to understand the different roles that DoT / DoH and HTTPS are playing when it comes to protecting sensitive data in the internet. I spend the day reading a lot of stuff about DoT, HTTPS, TCP and IP.
But there is one thing that doesn't become clear to me: say I want to surf to https://www.myForbiddenSite.org and download an image from there. At first, my device has to retrieve the IP address for myForbiddenSite.org (e. g. 1.2.3.4). When using DoT / DoH, any third party (e. g. my ISP) does not know that I want to access myForbiddenSite.org.
Now my browser will do the TCP handshake and TLS handshake with 1.2.3.4 and I can start communicating with the website via HTTPS. The image I want to download will be encrypted.
But isn't my public IP address part of all IP packages that are send across the wire? So basically every node between my router and myForbiddenSite.org sees my public IP address and 1.2.3.4? If this is the case, are there any projects that address that issue? And if not, why? Is it related to the fact the resolving the IP address for a DNS name is easy, but not vice versa?

If you want to hide your browsing activity from your ISP (and every other router that your traffic passes through), then you might want to consider using a VPN.  This will prevent your ISP from knowing which sites your are connecting to, as the ISP only sees that you are connecting to the VPN.  However the VPN will know which sites your are connecting to.  Some VPN's claim that they do not log this information, but this is difficult to verify.
As another option, you might want to consider using TOR.  With TOR, your traffic is routed through several nodes, so that no single node is privy to both your source address and your destination address.  See https://2019.www.torproject.org/about/overview.html.en for more info on how TOR works.


Why do some people really hate security via client-side? For instance, lets look at a common login system for a website

HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
Session is initialized, and a key may be issued to log in again without passwords ("remember me")

This is generally the status quo right now, where passwords are all computed on the server. But, if we do the following client-side it's considered a bad practice:

HTTPS connection is made
JavaScript calculates the hash (may request specific user salt)
Script sends AJAX with the user/hash values
Server-side code looks if the password's hash and user name match.
Session is initialized, and a key may be issued to log in again without passwords ("remember me")

Can someone explain why this other method is considered bad practice to do it CS instead of SS? Both transmit over SSL, both create the secure hash, and both authenticate should be be considered reliable with well-written code. Both are susceptible to XSS and other bad design.

What you've described isn't improving the security of the system.  Its not a matter of opinion or emotion, security just doesn't work that way.   In your example the hash(salt+password) is now your password.  If it wasn't over https,  then an attacker could just replay that value.     Also you didn't really address owasp a9 aka "firesheep" style attacks.


How to Prevent Access to Local Machine's Data Please excuse the terminology as I'm no expert in information security.
My question is pretty straightforward:

How can I guarantee* that I am the only one  with access to my local machine's data (screen, microphone, camera, files)?
* With the assumption that no one will physically come into my apartment and mess with the hardware.

I own a Macbook Pro running macOS. I have heard of cases where a laptop's
data (camera/microphone etc..) has been accessed remotely without consent. I wonder whether it is possible to absolutely prevent such attacks.
Up to recently I thought that the hard drive's content was safe, but I don't think so anymore.
The simplest procedure I came up with is turning off the WiFi, reading/writing data to an external drive (like a thumb drive), unplugging the drive (and turning the WiFi back on).
Does the method above guarantee that no one beside me can access the external drive's data? Are there any easier methods?
Thanks.

There is no way to have both internet connectivity and foolproof security. Security is implemented through multiple layers of defenses. Each layer is designed to mitigate exposure and risk of information leaks. The more layers of security that are implemented, the less usable the system becomes. The remaining risk, which is always present, is called residual risk. A determination is then made if this residual risk is acceptable, at which time it becomes accepted risk. This is a very basic description of information security.

The only way to be sure information will not leak is to never put the information on the device in the first place and therefore the system is completely unusable.

You are not clear on your use case, and if network connectivity of any kind is actually necessary. But, the most secure configuration that doesn't make the system completely unusable and is still reasonable for most home users is:

Air gap the machine. Absolutely no network connectivity. All data exchanged with the system is done by physically walking up to the device and copying it from one device to another.
Strong, full disk encryption. Make sure all data stored on physical media is securely encrypted with a modern encryption algorithm that uses a long, hard to guess, key.
Keep the machine powered off and/or in a locked and encrypted state when not in use.

Note, there are still plenty of ways this system can be compromised. Just read about the Stuxnet malware which was able to penetrate several security layers of a highly secure Iranian nuclear facility. The question is if you want to protect your information from script kiddies and every day hackers, or if you want to protect your information from the CIA or Israeli Mossad.


Are there regulations that govern how social security numbers are stored and viewed? I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few million SSNs attached to names, addresses, work history, pay history...etc

As I'm working through their codebase, I keep wondering if there are any regulations that they need to be compliant of. Right now SSNs are encrypted in the DB, but anyone can log into their public-facing web app as an admin with an insecure password (Something as simple as admin@company.com, pw: admin) and view them in plain text, and existing employees can search for SSNs and view information on the numbers holders.

Is there any sort of compliance (similar to PCI for payment info) that needs to be followed/adhered to for SSNs and personal information?

This is one of those times that there may not be a clear and specific answer, but I assure you, there is an answer.
Part of that answer is found in one of the comments here made by Artog. There IS a NIST publication on the subject. The bigger concern is this...
In every Security class we discuss the prudent person rule. The question is “what would a prudent person do with this situation?”
If this company is using insecure methods to protect data that can potentially harm people (SSN, name, address, phone number, employer, etc) they CAN open themselves to huge liability. They could be responsible for any financial problems they cause.
There are several problems with what you have posted:

Is someone already exploiting their database?
It is likely the problem will only be discovered after damage is done.
Then, the question is, do they notify anyone in the database of the breach?

The reality is, that unless whatever this database is falls under some form of regulation/control, it is unlikely that a change will happen. Because change costs money, and the business is likely already making money off the database with the vulnerabilities you described in place.


Is storing a client's folder structure a security risk? At work, we generate sensitive report files for our clients. Currently, these files are stored in cloud storage. Some partners want the files on their local machine, instead, so we will need the directory in which they want to save the files. Would it be a security risk to save their directory structure in our database?

This doesn't jump out at me as a security risk.  Sensitive data is stored in databases all the time.  If your database is somehow compromised, I suspect that client directory structures getting out would be pretty low on your list of concerns.


Distributing API Keys to Mobile Apps I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs.  Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs when the app loads.  It's occurred to us that it is quite easy to extra the API keys from the executable on a rooted device.  Furthermore, if one of our API keys gets compromised and we are forced to change it, we're handcuffing ourselves by hardcoding these values in the executable.

What is the most secure way to store these API keys, and furthermore what is the most secure way to distribute them over the air (ie using a remote configuration pattern)?

You want to store them using apples keychain bindings and distribute them over SSL.
Here is a good wrapper for the keychain bindings

  https://github.com/carlbrown/PDKeychainBindingsController

Edit - Initially, I thought you were worried about someone stealing your user's key.  I see you are worried about your own dev api keys.  Just keep the keys on your own server and pipe the api content through your own backend setup.  That way the API keys are always safe.


Web Services and WSDL Documentation Protocol Let us assume that I have a web service in an ASP.NET project.

If I turn off the WSDL documentation protocol, will other users be able to:

add a service reference to the web service?
discover the methods and parameters of the web service?

This is the code that I am using to turn off the web service protocol:

<webServices>
    <protocols>
        <remove name="Documentation"/>
    </protocols>
</webServices>

It is possible to keep the WSDL private,  or keep it cached on the client.  However,  this is just (in)security though obscurity.  WSDLs are useful for generating test cases against your web service,  and you should test your own service before any major release.


Can I use tor browser to make myself anonomous? OK, I came across tor browser couple of years ago. Then I have been using tor browser some some reason or another. Normally I use Firefox or Google chrome but if I want to hide my IP then I use tor.

Recently I came across deep web. I had previously knowledge about deep web but now I thought of doing some research on it. You can access many deep websites through tor. Which is in many cases useful.

So, many people with tor browser knowledge, they know that the Internet traffic is routed through tor’s network and goes through several randomly selected relays before exiting the Tor network. The last Tor node, where the traffic leaves the Tor network and enters the open Internet, can be monitored.

Now my question comes here. When the exit nodes can be monitored, Can it also be monitored from whom the request came from? Yes, I have read in the internet it cannot be monitored but also I have read somewhere that the actual IP address and the request was monitored. I really want to know if it is really really safe to use tor browser in-terms of anonymity. If I want to use deep web, will tor browser will really really help me. Can I be really safe without any authority or government agency like NSA spying on me?

Tor users can be traced through traffic analysis by people who can inspect traffic for both exit nodes and entry nodes: namely, they can correlate entry of a data packet at some entry node with subsequent exit of a packet of the same size (actually a bit smaller, because of encryption overhead) soon afterwards from an exit node. The spies, here, need to control either node; they just need to make passive observation of the traffic which enters and exits the node.

It is interesting to note that adding intermediate nodes does not help much against traffic analysis. The real source of the problem is that the user (that's you) is not patient: when he clicks on a link, he does not want to wait for five seconds before the page begins to show up, then another five seconds before the pictures and CSS are obtained and the page begins to visually make sense. If the user was patient, then the Tor nodes could add random delays on the packet propagation, to make traffic analysis substantially harder. But that's Web browsing, not emailing; latency is not tolerated.

Arguably, by simply asking a question on security.SE about how you could use Tor to become really anonymous, you have already awaken your arch-enemy (the NSA), who has added you on the list of "people to monitor". It might be a bit too late to "go anonymous".

(If I were a spy agency manager, I would instruct my troops to survey Web sites which discuss anonymizing tools like Tor, because my targets of interest would be interested in such tools. Assuming that a government agency like the NSA can collectively be as smart as me -- which might be a preposterous claim, because collective intelligence is known to drop quite fast when too many people are aggregated in the endeavour -- then I may surmise that the NSA already monitors this very site that we are presently using. Hi!)


Freshness Protection in BL and BLE I recently found this document: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-121r2.pdf , Guide to Bluetooth Security from NIST.
Unfortunately, there is nothing described w.r.t.actual protection of the communication other than AES-CCM is used. I am asking myself wether the BLE (v.4.2) communication is actually secured against replay-attacks.

BLE v4.2 Should be secure against replay attacks, but not secure against MitM attacks.
According to this post, it uses a counter along with signatures to stop replay attacks.
However, BLE v4.2 still (to my understanding) is vulnerable to MitM attacks, this post mentions that the attacks from WOOT 2013 still apply to Bluetooth 4.2.
This article talks about the security enhancements of BLE v4.2 over 4.1 and two possible attacks on Bluetooth 4.2.
There are also new attacks against Bluetooth user devices which have been discovered in the past month which I recommend taking a look at (both are :

BLURtooth: allows an attacker to perform device impersonation, traffic manipulation, and malicious session establishment.
BLESA: which enable an attacker to impersonate a BLE device and to provide spoofed data to another previously paired device


Checksum vs. Hash: Differences and Similarities? What are similarities and differences between a "checksum" algorithm and a "hash" function?

Can they be used instead of each other? Or their usage are different?

For example, for verifying the integrity of a text, which one is better to be used?

And if they are different, what are specific algorithms for each one? Meaning that which algorithm is appropriate for  "checksum" and which one for "hash" function?

A checksum (such as CRC32) is to prevent accidental changes. If one byte changes, the checksum changes. The checksum is not safe to protect against malicious changes: it is pretty easy to create a file with a particular checksum.

A hash function maps some data to other data. It is often used to speed up comparisons or create a hash table. Not all hash functions are secure and the hash does not necessarily changes when the data changes.

A cryptographic hash function (such as SHA1) is a checksum that is secure against malicious changes. It is pretty hard to create a file with a specific cryptographic hash.

To make things more complicated, cryptographic hash functions are sometimes simply referred to as hash functions.


Measures to secure websockets for non-browser clients I've been looking into the security risks that needed to be addressed when setting up an application using websockets, but the major issues I've looked at (CSRF, XSS, cross-site websocket hijacking) all seem to hinge on the websocket client being set up in a browser. Csrf and web-socket hijacking both seem to hinge on other websites being able to access cookie information from the targeted website, but this shouldn't be an issue when the websocket client is a separate, non-browser application. As for XSS vulnerabilities, I don't know how a non-browser client introduces any new issues.

Can any of these issues be ignored when building a websocket application that works outside browsers? Are there any new risks that arise when only using websockets to communicate with non-browser clients?

Can any of these issues be ignored when building a websocket
  application that works outside browsers?

Your usage of websocket communication in a non "sandboxed browser" setting means that you don't need to worry about the shortcomings of browsers, but you are now in more control of where the data coming up/down the websocket connection is going, and also what the user is able to do with that data. This makes you vulnerable to the same variety of exploits that any TCP or HTTP connection are susceptible to. In summary, the application you are using the websocket protocol under doesn't effect the security of the protocol itself.


What is the relationship between Suite B and FIPS 140-2? What is the relationship between the Suite B algorithms and FIPS 140-2 certification? Does OpenSSL meet both criteria?

From what I've read, it seems that OpenSSL's crypto library implements many algorithms, and the FIPS 140-2 Object Module covers a subset of those algorithms. Further, it seems that Suite B is an even smaller subset of the FIPS 140-2 certified algorithm list.

Is this correct? Am I on the right path? Any clarity would be appreciated. Thanks.

"NSA Suite B" is a definition of algorithms that shall be implemented to be able to... claim "Suite B" support. It is more guidelines than anything else, aimed at improving interoperability. Having support for Suite B algorithms can be a requirement to sell products to the US Federal Government; however, in general, there is no rule which makes implementation of these algorithms mandatory, and no certification system which formally guarantees that you implemented these algorithms correctly.

FIPS 140-2 is a formal definition of security requirements for cryptographic modules; it defines "levels". In order to claim a level, you not only have to do everything as specified in FIPS 140-2 for that level, but also to do a thorough audit which verifies your claims. Implemented algorithms are only a small part of FIPS 140-2; it also encompasses things like physical shielding and background checks on developers. For the algorithms, there is a list of approved algorithms; algorithms outside that list are simply ignored by FIPS 140-2 (your module can implement them, but they are out of scope).

Since the US government has not (yet) fallen to the Absurdity Circle of Hell, the "suite B" algorithms are a subset of the algorithms covered by FIPS 140-2.

As for OpenSSL:

It implements many cryptographic algorithms, including the "Suite B" algorithms but also many others.
OpenSSL is not, by itself, certified to comply with any level of FIPS 140-2, but it includes a "module" which has obtained some official stamp at some point, subject to some conditions, which are explained here and there.

Bottom-line: anybody can claim "Suite B" support; that's just a claim. A FIPS 140-2 certification for some level is considerably more formal, expensive, and restrictive. Compliance to FIPS 140-2 levels often creep up in big organizations as requirements; e.g. if you want to build and operate a PKI which complies to WebTrust (and is declared as such by an independent audit firm), then keeping CA keys in Hardware Security Modules which have been certified FIPS 140-2 level 3 will help a lot.


Are anti-virus companies companies regularly committing software piracy? As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:

This got me to thinking, what differentiates that from software piracy?

If I download the torrent for Adobe Photoshop CS then I am pirating that software - deemed by many countries to be illegal.  If anti-virus software uploads that same copy of Adobe Photoshop CS to their servers for analysis then how is that any different?

It's possible that this is a moot point - software vendors understand and allow this particular type of 'piracy' or in certain countries this comes under "fair use".

But what about malware authors?

A piece of malware is just a piece of software and the author of that software is afforded the same rights as any software author. Could a malware author take the anti-virus company to court for 'pirating' their software? This doesn't just apply to software like the BlackHole Kit but what about state sponsored malware like Stuxnet?

So this is my question. Are anti-virus companies afforded special protection from copyright laws and if not could these be used against them, especially by corporate or state malware authors?

First, I would seriously question whether a malware author would ever bring suit against an antivirus vendor, since it would require admission of a serious crime. But let's suppose that the malware author has already been charged for creation and use of the malware and therefore has nothing to lose by fully admitting authorship.

Copying software for malware analysis seems like a textbook case of fair use (under U.S. law, anyway). Of course, U.S. fair use is a defense that is usable only once you already engaged in a lawsuit (and its parameters are notoriously vague), but let's indulge in a little armchair speculation about how such a lawsuit might resolve. To take the fair use criteria one by one:

Purpose and character of use: The use of the copy is legally transformative, which means that it creates something new, instead of merely attempting to recreate the original. Here, the analysts are producing a malware assessment based on the original software. They're not creating a copy just to have an extra copy; they use the copy to produce something novel. This factor heavily favors the analysts.
Nature of the copied work: The piece of malware is a published, creative work that rightfully enjoys copyright protection. This factor favors the malware authors.
Amount and substantiality: The analysts use the whole software in their analyses. This factor favors the malware authors.
Effect upon work's value: Virtually none, which favors the analysts. In fact, the work has little legitimate market, since its primary use is illegal. (While it may be the case that AV vendors reduce the value of malware by building defenses against it, this is not the same as harm caused by creating a substitute work. Wikipedia sumarizes it aptly: "Courts recognize that certain kinds of market harm do not oppose fair use, such as when a parody or negative review impairs the market of the original work.")

While factors #2 and #3 are in favor of the malware authors, the transformative use of the malware lends tremendous legal weight to the fair use argument in favor of the analysts. Only a judge can make a final ruling on fair use, but I suspect that a reasonable judge would rule in favor of copying malware for analytic purposes.

N.B.: This answer considers the legality of copying from a limited, copyright-only perspective. There are other statutes beyond copyright (e.g., ACTA, DMCA) that may be violated when copying malware or legitimate software without permission from the copyright holder. Even if a use is protected by fair use, the fair use defense protects against copyright infringement only, not other violations that may also occur during (or be necessary for) the act of a fair use.

(For example, you may want to include a few seconds of a movie in a video report for your cinematography class, but your copy of the movie only plays in a proprietary player that does not allow exporting snippets of the film. If you download a tool for circumventing the "no exporting of snippets" restriction of your player, then you have violated the DMCA, even though your ultimate goal was probably fair use.)

In short: the analysts' copyright infringement is probably legally defensible under fair use, but analysts may still be in violation of other statutes that are separate from traditional copyright.


PXE TFTP Vulnerabilities I am planning to implement diskless clients for booting Windows 7 clients. I am trying to determine whether to use PXE with TFTP or iPXE with HTTPS or iSCSI.

Are there any vulnerabilities with using PXE and TFTP that may justify using iPXE instead? Does TFTP provide any sort of security?

TFTP is a very weak protocol, from a security point of view: it has no provision for security or authentication, uses UDP for transport which makes it extremely easy to spoof, intercept, DOS or manipulate by anyone on the same network.

iPXE, on the other hand, does implement authentication, data integrity and security: you just have to set it up.


Rogue EAP (PEAP) access point to obtain hashes I set up a rogue EAP access point using hostapd-mana. This lets me capture hashes of credentials which can later be cracked by asleap. However, my Android phone doesn't automatically connect to my (rogue) AP even though the SSID is the same and the rogue AP's signal strength is better than the legitimate access point. Why?

There are few factors you need to have in mind when you want a "supplicant" to connect to an AP automatically. (This is called WiFi roaming)

If you want to set a Rogue AP or an Evil Twin (which aren't the same) to steal credentials and/or capture packets, here's the checklist:

Signal Strength (Make sure your rogue AP signal is higher than the legitimate AP)
ESSID (What probe requests look for)
Encryption algorithm (Open, WEP, WPA, etc.)
Cipher (CCMP, TKIP, WEP40, etc.)

Check all these and your device/supplicant should be able to connect automatically.


Why would Chrome return non-deterministic bytes for a versioned release? From the:
Abusing SHA-1 collisions for Chromium updates

https://news.ycombinator.com/item?id=20114809

https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/browsers/chromium/update.nix#L96

Why would Chrome return non-deterministic bytes for a versioned release?

(too long code to paste it here! but fixme.)

Chrome is not returning non-deterministic bytes for a versioned release.

aszlig wanted to update a nix manifest to check from the network if there were updates. However,  there's no such function in Nix. Why not? Because you're not really supposed to do stuff like that in the Nix paradigm which is all about determinism.

Nix only allows you to download if you already know the contents of the file in advance (in the form of its hash).

He made such a package that tries to download the Chrome update and results in the boolean information about whether the update was available. But the result needs to have the same hash in both cases. That's where a hash collision comes in handy.

This build script uses a couple of well-known PDF files that both have the same SHA1 hash. If the update exists, it gives PDF 1, otherwise it gives PDF 2.

The update script then depends on that hack package. It "installs" that package, and then checks whether it actually contains PDF 1 or PDF 2, and now it knows whether the Chrome update was available or not.

(based on mbrock and grhmc answers)


Phishing message in Outlook signature? One of my organization's users just showed us an interesting problem: every message they tried to send (in OWA 365) contained the following scary text:

  Your mailbox has exceeded one or more size limits set by your
  administrator. Your mailbox size is 1098957 KB. Mailbox size limits:
  You will receive a warning when your mailbox reaches 900000 KB.You may
  not be able to send or receive new mail until you reduce your mailbox
  size. To make more space available, Login Here to reduce your mailbox
  size. See client Help for more information.

  Help Desk.

We discovered that this common phishing message had been saved as the default signature (formatted text). It may have happened when checking mail on 3rd party computers while out of office. Their workstation shows no sign of infection.

Has anyone heard of Outlook signatures being used as an attack vector? My Google searches are coming up empty. It's possible that this was just a bizarre copy & paste mistake by the user rather than an intentional attack.

Infection is not the likely intrusion vector: it was likely that the account was compromised.

The user's passwords should be changed right away and the account inspected to see if other accounts have been linked, etc.


Is it safe to enable auto-login in Windows with whole-drive Bitlocker turned on? I am the sole user of a computer in an office. I set-up Bitlocker to encrypt the entire drive that Windows 10 lives on, so that I'm required to enter a Bitlocker password as soon as the computer boots and before Windows is loaded. I would like this to be the only password that I type, and for Windows to load and then automatically login to my user account (which is an administrator account).

There is an option in Windows User Accounts: Users must enter a user name and password to use this computer. I would like to de-select this option, since I need to be physically present to type my Bitlocker password in before Windows loads.

Are there any security implications of doing this? Every time I leave the computer unattended I lock it using Windows Key+L.

Is it the safest setup? No.

Is it safe enough for you? Might be, and by the sound of it, probably.

Infosec is not a set of rules to be followed stringently, it's a matter of deciding what the risks are in your specific case, and taking the measures you feel are appropriate to reduce that risk to acceptable levels.
This is assuming you don't have legal or contractual obligations, in that case you will have a list of things you MUST do of course, that's the nature of obligations.

Questions to ask: why did you encrypt in the first place? Will those reasons still apply if you don't require a password to login to windows? Do you always shut down the machine or leave it on stand by?


How do you handle untrusted software installation / runtime? If you need to install software from a third party and frequently run it on your PC, but you do not trust the software, although antivirus doesn't rise any flags:

Is it possible to install software on Windows 10 Pro in an 'isolated' environment, so it's somewhat separated (or jailed) from the rest of the machine.
Can you restrict access for the software, so it only has access to its own installation folder and specific processes?
Can you take any measures to prevent privilege escalation and also firewall it, so there is no network traffic possible?

I know of sandboxing tools like 'sandboxie'. But I was wondering if you could do it (better) with native Windows 10 Pro settings, group policy ...?

Wrapping the application as a UWP provides some measure of sandboxing but it isn't designed for security so I don't recommend it here.

Personally, I would run such code either in a full VM (e.g. Hyper-V) or using Docker for Windows which would allow some measure of isolation.


TLS DSA signature inputs Each TLS1.0 implementation must support the use of the TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA cipher suite. This cipher suite dictates that the server must send a ServerKeyExchange message with the following structures:

struct {
    opaque dh_p<1..2^16-1>;
    opaque dh_g<1..2^16-1>;
    opaque dh_Ys<1..2^16-1>;
} ServerDHParams;

select (SignatureAlgorithm)
{   ....... omitted ........
    case dsa:
        digitally-signed struct {
            opaque sha_hash[20];
        };
} Signature;

The sha_hash value is calculated by SHA(ClientHello.random + ServerHello.random + ServerParams) then the calculated hash is given to the DSA algorithm to produce the signature (which is in turn encoded in DER). My question is how are the inputs to the DSA derived in this case?
According to wikipedia DSA requires the following parameters:

N : q length
L : p length
q : N-bit prime
p : L-bit prime modulus such that p-1 is a multiple of q
g : a number whose multiplicative order modulo p is q
x : secret key, where 0 < x < q
y : public key y=g^x mod p

Is the public key (or any other value) the same value that is contained in the X.509 certificate sent by the server? Or all the values are specifically generated for the DSA signature?

Also: I've read somewhere that N and L must be 1024/160. Is this a requirement of the TLS protocol or other values are valid in the context of TLS?

I will mark this question answered. If anyone is searching the answer for this question:

The p, q, g params are contained in the DSA certificate (in the DSS-Params field) along with the public dsa key (in the SubjectPublicKeyInfo field) - technically this is the server public key. These parameters, along with the secret key (private), are contained in the file produced by openssl dsaparam -genkey 1024 -out dsakey.pem.


Firefox accuses of malware, but virustotal have 0 matches I sometimes download PDFs on libgen and sometimes Firefox will acuse them of being malware with the advice "this file contains virus or malware" but gives no details. I've run several of these files through virustotal and none give any problems in any of the scanners.

Some of them are djvu which I presumed was only a format to hold static images with no interaction, so it'd be much harder to host a malware. So is there a way to know what is firefox finding in those files?

Is firefox somehow better than all the antivirus tested on virustotal?

If someone wants to test some file please let me know so I can send the link

Firefox is not an anti-malware scanner, it uses a blacklist which it updates from various feeds e.g. Google safe browsing, phishtank, etc.

Since Firefox is pretty new in such a field, they tend to be "excessively paranoid", e.g. based on many bad URL and derive the blocking result, as mentioned by @Steffen Ullrich.  As a Firefox user, you can help by clicking the button on the warning screen. When there are enough clicks, hopefully, Firefox will notice it and unblock it.

Unlike malicious file detection, URL blacklisting is never easy to do it "correctly", due to the dynamic nature.


PKI: why is leaked CA certificate a threat? According to the SSL/TLS threat model from ssllabs:

https://www.ssllabs.com/downloads/SSL_Threat_Model.png

Why is "Leaked CA Certificates" a threat? (In the "Trust (PKI)" branch)
Isn't the purpose of a certificate to be publically available?

I understand, why "Rogue CA Certificates" is a threat, but why is "Leaked CA Certificates" a threat?

As marstato seems to have already said, by 'Leaked CA certificate', they seem to be implying the private key for the signing certificate as well. Which would enable anyone to sign their own certificates and hence the issue.


Why is a valid SSL certificate required for SSL-Strip? From what understand, SSL-Strip sits between the target user and the server, establishing a HTTPS connection between itself and the server, and an unsecured, plain old HTTP channel between itself and the target user.

What confuses me is, in a video demo of the tool, one of the prerequisites was an SSL certificate.

Why is the certificate required? Can't the "computer proxy acting as a fake user" send the plaintext back to the user without one? In fact, it seems the only reason a signed SSL certificate would be required would be if the middle-man sent back HTTPS encrypted data back to the user.

SSLStrip can work of one of two ways:

  It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links.

The video is talking about the latter.  So you can still use HTTPS, but try to fool the victim into going to https://www.gmail.attacker.com.  Where the attacker owns a valid SSL cert for *.attacker.com.  A valid SSL cert isn't required if you're simply replacing https links with http links.  i.e. https://www.gmail.com with http://www.gmail.com

http://www.thoughtcrime.org/software/sslstrip/


How do I prevent my Rails application from attack? My website is being nuked by new signups and new posts some of which don't even have user.id associated with.

How do I solve this? What code should I add to the user#new page and/or post#new page.

If it would help, please check my repo: https://github.com/nixor/cpblog

I have not looked into your code, but the things I would do are:

checking the eligibility of the user to do anything on your website before making that user makes an action. (If somebody posting something without even registering in the site - it is no good).
to prevent from the new signup the common practice is to confirm yourself using a mail account or an account from high profile resources google acount, fb account.


Can AWS KMS be used for both KEK and DEK for PCI DSS? Right now we're using our own built-in solution based on SSS, and we want to switch to KMS.

How far can we go? Can we use AWS' KMS for both the KEK and the DEK?

There's nothing within the PCI DSS which would prevent you from using AWS KMS for both the KEK and the DEK.

You should ensure you're generating strong keys, the KEK is equivalent strength to the DEK (e.g. both AES 256-bit), the DEK is encrypted by the KEK and you have separate key custodians for key components.


Are stack buffer overflows even possible in this instance? Let's say there is a C program that simply takes a string argv[1] and uses sprintf to copy it in a finite buffer.  Classic stack buffer overflow.  Let's even say the program is more complicated, allowing for techniques like ROP.

But then it's compiled with a stack canary/security cookie, and run on an OS using ASLR and DEP.

Does not the chance to then execute arbitrary shellcode approach 0?

It depends.

DEP blocks you from just doing a jump to esp and executing code there. ASLR is your major important thing to bypass here.

There are a number of ways that you might be able to do this:

Modules loaded into the process which don't have ASLR enabled. There are a bunch of ways this might happen:

DLLs that are a part of your application which were compiled without the ASLR flag.
Injected as part of the AppInit DLLs.
Injected by 3rd party applications, e.g. anti-virus or something like xfire / Fraps.
Shell handlers loaded alongside shdoclc.dll when you use the standard file dialogs.

Fixed-address allocations (e.g. VirtualAlloc with the lpAddress parameter set)
Secondary vulnerabilities that allow for memory disclosure or pointer disclosure may be useful in building up an idea of where things are in memory.
Corrupting the stack in some way that triggers a secondary issue, e.g. heap corruption. This could then open up other exploitation avenues, using tricks such as heap spraying, heap feng-shui, JIT spraying, etc.


Steganography using all TCP/UDP ports? I just had an idea, and usually when I come up with one, it turns out it was already invented, so...

Is there some standard that would consist of multiple parties sniffing on all of their TCP/UDP connections that would send messages via port numbers instead of (or additionally) data sent through the ports? A sophisticated port knocking system? Would such a system make it harder to detect an attempt to hide the actual connection?

Sniffing ports is slow: you have to send a bunch of packets and use a timeout to know which ports are open and which are not. Also, it is very uncommon for the list of open ports on a server to change every 2 minutes. Steganography cannot exist if it implies unusual setups; it strives on inconspicuousness.

What you could do is to hide data in source ports. Whenever you send an UDP packet to a target server, the packet is tagged with the target port (which is often well known, e.g. 53 for a DNS request) and a source port. The source port is momentarily open on the client and meant to receive the answer, should an answer be sent (there again, this is a normal situation with DNS). Under normal conditions, the source port is chosen at random by the client; applications don't need to bother with it, it is allocated by the kernel). But the application could choose the source port (it is a matter of a bind() system call before sending the packet) and thus convey information in a covert manner to the server.

That way, you can send covert information to the server under the guise of innocent-looking DNS requests. To mimic normal random port allocation as performed by operating systems, you would have to restrain yourself to roughly the same range, so you would be able to send, say, about 12 bits of information per requests. To make the covert transfer undetectable, you would have to encrypt the data (the source ports must "look random" and nothing looks more random than encrypted data).

It is a generic property: whenever a data protocol includes elements which are supposed to be chosen randomly by the server, then it can be subverted into a covert data channel. This is usually considered to be a security issue, because it allows the sender to leak critical data to third parties without the receiver noticing it. An example is the padding of record data in SSL 3.0 (section 5.2.3.2), when a block cipher is used: the value of the padding bytes can be chosen arbitrarily by the sender. This was fixed in TLS 1.0, where the value of the padding bytes is enforced:

  Each uint8 in the padding data
         vector must be filled with the padding length value.

I don't know of any standard for doing steganography through port numbers. When you come down to it, it looks pretty useless. Also, by nature, "steganography" does not mix well with "standards".


Docker container exposed port vulnerabilities on Debian server? I'm configuring a Debian (Stretch) webserver to run docker containers for socks requests. So, the application would be able to authenticate (on port 1080) with the Dante server running inside the container and communicate with the web. I'm concerned about potential exploits, although I updated the iptables and set the conf to accept traffic only from the bridge driver's CIDR 172.27.0.0/16. The only information exposed I could find was using nmap:
sudo nmap -PN -p 1080 -sV 172.27.0.2

This prints out:
Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-06 12:22 EET
Nmap scan report for 172.27.0.2
Host is up.

PORT     STATE    SERVICE VERSION
1080/tcp filtered socks

Only the service name socks is fetched (no version), compared to other services which print the version e.g.:
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))

My questions are:
Authentication credentials are set as ENV variables, is the port secure to be exposed?
Can someone publicly access the container's ENV variables with some sort of scan tool?
Is gaining information that the port is additionally running docker or alike possible?
Are there tools apart from nmap that scan ports and return leaked info or vulnerabilities?
Any feedback is highly appreciated! I want to be sure not to make any mistakes and configure docker properly to accept only local requests from server-side scripts with no public access nor information leaks.

Authentication credentials are set as ENV variables, is the port
secure to be exposed?

First off, that port isn't exposed at all, based on the "filtered" response. This is saying that nmap didn't receive any traffic back from this port. But no, information about processes on your system generally can't be retrieved by talking to arbitrary ports. However, if the Dante server itself has vulnerabilities, an attacker who can connect to the service could potentially exploit them and gain other information this way.

Can someone publicly access the container's ENV variables with some
sort of scan tool?

Same as above, there is no link between that information and the port is inaccessible anyway.

Is gaining information that the port is additionally running docker or
alike possible?

There is zero information returned about that port at all, so no, not remotely with your current setup. Docker isn't even involved; the packets aren't getting past your kernel.

Are there tools apart from nmap that scan ports and return leaked info
or vulnerabilities?

Yes, many both free and paid. You can find network and vulnerability scanners by searching online.


Details of TLS certificate verification I do understand the cryptography basics, but I am uncertain about the following three steps:

Step 1: How to compute a TLS certificate

Correct me if I am wrong:
The certificate authority computes a hash value over the relevant certificate information (including the public key of the certificate aplicant), then it signs this hash value using the private key of the authority.
The output of this process is a single certificate file that can be deployed on servers which have access to the corresponding private key.

Step 2: How to verify that the server owns the private key corresponding to the TLS certificate?

The client gets the certificate from the server during the TLS handshake. But the certificate alone is not sufficient to verify data authenticity. (since anybody could send a copy of a certificate without owning the private key) Therefore I think that there must be some additional random information transmitted, which needs to be signed using the corresponding private key (perhaps also by computing a hash)?

Does the client decrypt this random information with the certificate's public key? How is this check performed?

Step 3: How to verify that the certificate is signed by a trusted authority?

I think this works mainly with preinstalled browser tables that contain the public keys of the trusted authority's (among other information).

Are the certificate authority's public keys used to decrypt a hash value and check if it matches with a self-computed hash value over the whole certificate?

An answer to question 1:

Yes, except the CA's root is offline in an HSM in a vault, not available to be stolen electronically. The root was used to sign a handful of intermediate certificates (backups and OCSP responder certificates and other stuff) that reside in HSMs that are directly connected to computers that can be reached electronically.

To issue a certificate, the CA "backend":

receives CSR
uses some method of validation (ACME protocol, human clicking "ok" on admin website, etc.)
logs all the decisions and info used to make the decision for checking by later audit
generates the certificate data (X.509 v3) encoded in X.690 DER, using a template and new serial number / source of randomness.
maybe gets Certificate Transparency SCTs.
asks the HSM to sign the blob (or hash of the blob).
appends signature to certificate and sends it to the customer facing storage.

An answer to question 2:

In RSA key exchange, the client generates a random sequence of bytes and performs RSA encryption using the public key from the server's certificate. Then the client sends the resulting ciphertext to the server and expects the server to decrypt it (using the private key corresponding to the public key from the certificate) and use the random value in a KDF, together with other values, to generate symmetric keys and send a Finished message encrypted with the resulting symmetric keys. The client verifies the Finished message. The server can only succeed in generating the expected symmetric keys by decryption RSA encrypted message. https://tools.ietf.org/html/rfc5246#appendix-F.1.1.2

In DHE/ECDHE key exchange with PFS, the server signs its ephemeral key using the private key corresponding to the public key in the certificate and sends this in ServerKeyExchange. The client verifies the signature using the public key from the certificate. https://tools.ietf.org/html/rfc5246#appendix-F.1.1.3

An answer to question 3:
The browser contains a list of trusted roots (Mozilla Firefox does this) or uses a list of trusted roots provided by the operating system (Google Chrome uses the OS roots store). The root store contains self-signed certificates and some metadata about them that might constrain what they can be used for. Browsers also contain code that adds additional checks, like Chrome requiring Certificate Transparency from Symantec-owned CAs and the cutoff dates that allow using SHA1 certificates.

The way a leaf server/domain certificate is verified using the root store is by building a chain of intermediate certificates, one signing the other, from a trusted root to the leaf. The root signs an intermediate and the intermediate signs the leaf. There can be more than one intermediate in a chain. The intermediates are sent by the server together with the leaf.
https://en.wikipedia.org/wiki/Certification_path_validation_algorithm

Different computers have different root stores and by using cross signing, many different paths can be built. Currently the browsers try to build sha256-only paths if possible, sometimes fail and produce an error saying only a sha1 path was built thus the connection might be insecure.

Do not confuse digital signatures with encryption: https://security.stackexchange.com/a/87373/70830


What vulnerabilities in the OWASP Top 10 are relevant to WordPress? I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed?

I know injections and XSS are relevant for sure, but what about the others?

https://www.owasp.org/index.php/Top_10_2010-Main

Well. Most of them can, depending on what you do and how your server is configured, apply to WordPress (or any other CMS software really).

  A1-Injection

Of course injection (not necessarily just SQLi) is always a possibility.

  A2-Cross Site Scripting (XSS)

If there's user supplied data and its echoed back, its probably been vulnerable at some point

  A3-Broken Authentication and Session Management

There's an admin console to log into, maybe its got poor session management?

  A4-Insecure Direct Object References

Can you access any files (like a database file for example) directly?

  A5-Cross Site Request Forgery (CSRF)

Can you trick users into accidentally doing things they didn't intend on your site?

  A6-Security Misconfiguration

What options are available in WP? If you don't set them correctly will it reduce your overall security?

  A7-Insecure Cryptographic Storage

Is WP storing credentials securely? Hashing passwords using something that isn't unsalted MD5?

  A8-Failure to Restrict URL Access

Should the public be able to access the admin console URL? Can they access admin pages directly without logging in first?

  A9-Insufficient Transport Layer Protection

Do you have SSL/TLS enabled? This isn't so much a WP thing so much as a general security best practice.

  A10-Unvalidated Redirects and Forwards

Can attackers trick WP users into being redirected to malicious sites?

The following types of vulnerabilities have been, at some point, confirmed to have existed in WordPress software:
Denial of Service, XSS, Information Leakage, Privilege Escalation, Code Execution, SQLi, Unauthenticated Bypassing to access files, XSRF and Directory Traversal.
Source: CVEDetails

Hope that helps!


How to detect the OS running on IoT device? Is there a tool (or Linux command) that can detect the OS running on IoT devices, such as smartwatches or wearable tracker devices?

Or a tool that can list as much information as possible about the device.

There is an -O option on nmap that will try to detect what OS the device is running, it is by no means perfect.  It analyzes the TCP/IP stack's behavior. https://nmap.org/

If the device has port 22 (ssh) or 23 (telnet) open you could try to log/break in using some default username and password. (IoT devices aren't meant to be secure, they're meant to be stupid, so the chance of successfully logging in is too high.)  And then run the uname command as suggested in the comment.

There are many many search engines that could have indexed a page that happens to mention which operating system the specific device is running.

If there is any open port at all, you can dig in and start looking for clues. Ex: a webserver might send the Server header which might happen to name the OS.  (Be aware that it could also be lying.)

If all above fails, it is quite likely to be running something with Linux as a kernel or a proprietary BSD clone.


List of NSA spyware - remote bios exploits Found this rather detailed list of the NSA's latest spyware gadgets, with several different remote bios exploits that once installed are virtually undetectable and can survive reinstall of the OS:

http://leaksource.wordpress.com/2013/12/30/nsas-ant-division-catalog-of-exploits-for-nearly-every-major-software-hardware-firmware/

How does the OS defend against such bios intrusion? Can the NIC be part of such an attack, or do they need to exploit an application running at the OS level?.

I have been using Fortress Linux for awhile now (no affiliation), which is an OS and VPN that was developed to withstand all intrusion and surveillance from any source, even from a default install. For reference: https://www.fortresslinux.org

Assuming there are no vulnerable applications running, is there any other way into the bios over the internet?

It is possible to at least initiate, if not install BIOS updates from a Windows application.  Example being the Dell BIOS update utilities, which are provided in a .exe.  Heuristics say that if you can install an update from a .exe, there shouldn't be much, if anything, stopping you from installing malicious BIOS.  More so, if you can run an application, maybe you can cause the software to run by exploiting a software bug, such as a buffer overflow, to initiate the installation of your payload, which in this case would be the malicious BIOS installer.

Oh, so I guess to answer your question, if the attacker exploits a vulnerability (documented, or undocumented) then there is no defence.


Carrying out a professional IT audit procedure I'm a new masters graduate and I need to find out how to carry out an IT audit professionally. What software tools are required and what are the specific topics I need to cover? Please point me in the right direction. Specific links to journals and/or templates that are used would be very helpful.

  This question was IT Security Question of the Week.
  Read the Sep 23, 2011 blog entry for more details or submit your own Question of the Week.

This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents.

From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of specific technologies, and contributed to maybe 50 of those. The time investment is pretty high.

In saying that, I would definitely suggest you join ISACA (the Information Systems Audit and Control Association), which is the definitive body for this industry. A vast amount of information is available through ISACA, including CobIT and audit guidance.

(disclosure - one of my roles is President of the Scottish ISACA chapter)


Got a warning message - remote authentication changed. Should I be worried? Last night I started getting the following warning on all of my servers when accessing github.com.

  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @
  WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

  IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

  Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also
  possible that a host key has just been changed. The fingerprint for
  the RSA key sent by the remote host is
  ..... Please contact
  your system administrator. Add correct host key in
  /home/user/.ssh/known_hosts to get rid of this message.

There is an easy fix of course, https://stackoverflow.com/questions/20840012/ssh-remote-host-identification-has-changed, but I don't know why I get this message all of sudden.

I did not change .ssh/known_hosts.

Should I be worried? What steps should I take?

Thanks in advance,

See https://help.github.com/en/github/authenticating-to-github/testing-your-ssh-connection for the expected host fingerprint.

I used ssh -v -T git@github.com to see the host key my ssh client verified, and it was nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 which is listed on their page, so the connection is not MiTM'd.

I don't know why it happened. I guess a change in your ssh client (or their ssh server) switched from using one host key to another, for example because the host key algorithm was deprecated.


How does this backdoor work? I just found that one of my wordpress websites included backdoor (my guess).

As I see now, the same file on server is different than original on my laptop drive. So I think my website is already infected. Can you help me clean that up?

Sorry I can't put the code here as I am new and code is big and don't know how to import. You can see it here: Backdoor

Any Help Appreciated!!!

This is knows as Wp-vcd Malware. For full analysis you can check here.

For hardening Wordpress check here, and if you ask yourself, what should you do when your website is hacked - click here.

For removing that particular malware follow this.

More from IBM X-Force Exchange:

  Malicious code injection inside a wordpress theme's functions.php and
  wp-includes editing posts content.

  Injected files:

wp-vcd.php
class.wp.php

  Edited files:

functions.php
post.php

  Analysis

  https://medium.com/@cirku17/wp-vcd-malware-analysis-7c5dbaad89c3

  Repository

  https://github.com/CirKu17/wp-vcd-malware-sample

Keep in mind that this may be updated version of malware, so I didn't go through all the source - my suggestion for you is to backup your website and database from clean backups.


Why are cryptographically secure random number generators required for shared keys? As I understand, key exchange for secure communications like TLS has a client take a server's public key, generate a random AES key and send that as a shared key for further communication. The key is generated using a cryptographically secure random number generator where the seed is obtained via system entropy.

I assume a random generator is used to create the key rather than purely from system entropy because it's faster/easier, but why does the generator have to be cryptographically secure? The benefits of being so are that given any state of the generator, it's infeasible to predict the next bit, or any of the previously generated ones. However, if an attacker can see the output of the number generator, don't they already have the AES key anyway? In what scenario would they only ever have part of the key, which they could then exploit the number generator to recover the rest?

I assume I'm misunderstanding it's purpose.

As AndrolGenhald wrote in comment, modern protocols use Diffie Hellman (usually an Elliptic Curve Diffie Hellman) and don't use asymmetric encryption for key exchange.
The protocol often requires both sides to generate and send in the clear some random bytes. These can be "server random" and "client random" in the TLS handshake (and equivalent in SSH and IKEv2 for IPSec) but also nonces or IVs (CBC is not allowed in TLS 1.3 but bear with me). Basically, it is assumed that either side has used the same CSPRNG to generate data that was sent in the clear, before or after generating secret key material. If seeing the data that was sent in the clear allows a passive attacker to completely determine the inner state of the CSPRNG and then to "step" the CSPRNG forwards or backwards, the attacker gets the keys.

An illustrative example is the Juniper NSA backdoor. They had to exfiltrate some consecutive number of bytes from the CSPRNG to enable the passive attacker to compute the CSPRNG state to compute the secret keys. This necessitated multiple changes to the software in addition to the use of the backdoored PRNG. A non-cryptographic PRNG (like a Mersenne Twister) instead of a backdoored PRNG would be exploited in similar ways. Changes to how some of its output is sent in the clear will make exploitation easier or harder.


Does it make sense to consider a triggerable server software crash a DOS attack? I've found a little vulnerability in a web application running on Node.js server.

It works by sending some crafted payload to the application server, which makes the application server code to throw an error and due to lack of error handling - It crashes (until someone runs it again).

I'm not sure what is the appropriate name for this kind of attack.
I assume it's a DOS (Denial Of Service) attack because it makes the server Deny Serving its clients.
On the other hand, Until now, I've only heard of DOS attacks which works by flooding the server in some way (which isn't the case here).

So, is it correct to consider it as a DOS attack?
If the answer is no, so how should it be called?

Yes.  Any attack which has as a goal to deny the normal usage of a service by legitimate users is by definition a DoS (Denial of Service).


Chaining multiple PGP keys I would like to know the practical limitations to contact chaining multiple peoples pgp key's in order to protect a file.

In normal public key cryptography, four keys are required, public and private from both parties. But, if the integrity of one of participants is compromised say, through torture or some other form of coercion the information may as well be in plaintext.

However, what if that burden was lightened by having cryptography that required multiple keys from different individuals in order to encrypt and could be decrypted, using the public keys from those individuals. That way, it might be akin to having 2 or more deadbolts on a door that a thief would have to mitigate. I'm not talking here about encrypting a file that has already been encrypted, but using a combination of keys in order to encrypt a file that could then be decrypted only by having the public keys of everyone who did the initial encryption.

I'm sure there are a few needless redundancies or other things I'm not taking into account in this plan. What are they?

Out of the box with GnuPG/PGP, there is no way to encrypt a file with the method you suggest.  There is a "group" encryption or ability to encrypt to multiple recipients, but that allows each recipient to individually decrypt the message rather than rely on anyone else's key.

What you can do, and is commonly done, is to split the PGP private key and require multiple individuals to come together and make the key whole in order to decrypt the message.  Also, instead of individuals, you can have the other part of the key be on a hardware security module, smart card, or other such device.

You might want to take a look at SplitGpg which seems to do what you are asking.


How do I safely inspect a suspicious email attachment? I received a pretty blatantly spammy email to my Gmail account. Attached to the email is a supposed HTML file. My first hunch was that it was probably one of the following:

A nasty executable file masquerading as a simple HTML file, or
An actual HTML file meant to be opened in a browser in a phishing attack

My guess is that it really is an HTML file, since Gmail claims the attachment is only 1K in size.

I know I should probably just mark this as spam and get on with my life, but my curiosity is getting the best of me... I really want to know what's in that attachment. Is there a safe way to go about downloading it to a sandboxed location and inspecting the contents? I'm at the beginning of a career shift into the security field, and I would love to pick apart this real world example of something potentially nasty and see how it ticks.

I'm thinking a LiveCD or a VM would be a safe environment... I would prefer to do it in a clean, un-networked environment, but in any case, I'll still be logging into my Gmail account to download the thing.

Any suggestions?

It could also be:

3. HTML page with JavaScript code attempting exploit a vulnerability in your browser.

4. HTML page with an embedded Java applet attempting to exploit a vulnerability in the JVM

5. HTML page with an embedded Flash file attempting to exploit a vulnerability in Flash Player

6. The email itself, before you open the attachment could try to exploit a vulnerability in your email client

There might be other possibilities.

For this purpose, I have the following setup:

Virtual Machine using VirtualBox. No network access.
I have a snapshot saved for the VM after a fresh OS install.
I also take two snapshots with What Changed? and TrackWinstall.
I copy files only in the direction Host -> VM, using a free ISO creator.
I create the .iso file and mount it. Then I can have all the fun I want on the VM itself.
I usually run the malware and study memory usage, CPU load, listening ports, networking attempts.
I check the changes to the OS using What Changed? and TrackWinstall.
Finally I restore to the fresh snapshot.

The reason I have the whole setup is because I like to run the malware and see what it's trying to do.

Update:

I was talking to a colleague who performs malware analysis as a hobby and he told me about his setup, it might be different that what you might want for an occasional .html attachment check.

Old PC with a fresh OS install.
After installing the needed tools he takes a full-disk image using Clonezilla Live.
What Changed for snapshots comparisons.
The PC is connected to the Internet through a separate network.
Whenever he finishes working on a sample, he reboots with Clonezilla and restores the full-disk image.


Modifying the Ethernet/Wifi driver to get faster Network access? I've already asked this question on networkengineering.stackexchange.com, but unfortunately it was marked as Offtopic there.

As far as im concerned the CSMA/CD and the CSMA/CA standard rely on the compliance of the protocol standard of the hosts connected to the communication channel. For example: If a collision is detected in Ethernet, all involved hosts wait for a random time and try after that to send their data again - at least if the channel is not already used (carrier sensing). Another example: In the WLAN-Standard of DCF the hosts who want to send something compete with each other for channel access by waiting a random amount of time.
This seems to me on the first look like a good idea, because if every host really does what the standard dictates, its quite fair for everyone who is involved. But lets just say there is an attacker connected to the channel who doesn't care about the protocol standards in the data link layer. If he is involved in a collision in Ethernet, then he simply cheats by waiting the lowest amount of time. If he needs to compete with other hosts in Wifi for channel access, he does the same, so that he is always the first one who can send. If everybody did this, the network would be congested.

€dit - to be hopefully more clear: I just think about if one could achieve a higher data rate in a network (for example in the Wifi of an hotel/cafe) by ignoring back off times (https://en.wikipedia.org/wiki/Exponential_backoff) in the data link layer.

I think for doing this, one just has to modify the network driver. But is it really that easy or have i forgotten to consider something important? And if it's really that easy, why is it not done in practice? (At least I've never heard of it)
Greetings

To be clear, you are asking about a behavior referred to as a truncated exponential backoff:

https://en.wikipedia.org/wiki/Exponential_backoff
https://cloud.google.com/storage/docs/exponential-backoff

This general algorithm is not just used in networking: I've used it to backoff on HTTP requests to busy services.  I think there are a couple small misunderstandings on your part, one of which is simply:

What exactly do you expect to gain by rewriting a networking driver to not perform the standard backoff?

For TCP/IP protocols the backoff time is measured in tens and hundreds of microseconds.  Moreover, because it is only used in the event of collisions (aka high network traffic) it is probably not a constant source of network latency on, say, a home network (where your network driver is actually relevant).  If all you want to do is make your home network as fast as possible, then your best bet is to simply buy a high-end router and don't overtax it with too many devices.

From the standpoint of a malicious actor, I'm sure the same cost/benefit analysis prevails.  Sure, you possibly could rewrite your network driver to ignore the exponential backoff and try to be first in getting your packets through in the event of a collision but I strongly suspect that both the gains by doing so and the frequency in which those gains will be applicable are so small that no one would bother rewriting a driver for it.

The other problem I suspect you will encounter is that even doing this might not substantially help your cause.  In the event of a collision you and the colliding party probably aren't the only ones who can collide.  If you don't wait and send a new packet very quickly, that won't help you if you just collide with another host.  Sure, if you never wait you will probably get your requests in faster on average, but it isn't obvious to me that this will actually be a big help for you.  The whole point of this algorithm isn't to "make people wait their turn" but rather to moderate overall usage so that an oversubscribed network can get things done.  You are basically proposing to ignore the rules and just spam away on a busy network.  Yeah, that might get you through faster, but it might also just increase congestion to the point where no one can get anything through.


Requiring a pin instead of password for websites? Curious if this could be a good alternative to passwords. On a website, user can choose to use a pin instead of password. If she does elect to do this (given option) from then on, her account asks for pin only, and via Javascript pop-up.

For users that don't like enabling Javascript, could be good to have a password as normal.

Pop-up may also be good since it is more difficult to keylog, if we present user with on-screen numbers (like in lastpass, or iPhone.) Can even do dragging like in Android.

Do you think this is a good idea, to offer both? Is there anything you would improve or change about the idea?

I don't think this is a great idea, especially as an alternative to a password (rather than in addition to a password):

A 4 digit pin by itself could be brute forced in ~100 days even if you had a 15 minute lockout for incorrect password attempts.
Entering 4 digits via your mouse on a screen is probably slower for most people than entering their password via their keyboard (which they're used to typing)
People are very likely to use some permutation of their year of birth or postcode as their pin

To make this secure a user would still have to log in normally from each machine, which sets a long expiry cookie then each time the user returns to the site they must enter a pin which sets a shorter cookie. This is really only protecting them from someone else using their computer while the user is still logged in via a long term cookie.

Depending on your goals I suggest the following:

If your goal is stronger authentication then I suggest using multi-factor authentication
If your goal is to make it easier for users to log in but you don't want to use a longer cookie then remember their username and not password (users can type their password pretty quickly)
If your goal is to prevent other people snooping on a users computer than this is better addressed on the user end by logging out when they leave their machine.


How To Validate Secure Traffic from Chrome with Element To Matrix.org on Linux Are you familiar with the Element chat system of https://app.element.io ? Are you familiar with its connections to Matrix.org (for a free account)? Is there a way that I can sniff this traffic on the OS when I hit the enter key on a message so that I can confirm that Google Chrome on Linux only sends this encrypted message to Matrix.org and no other locations? A colleague believed that Google Chrome would send this same encrypted message block of data back to Google or some dubious location.
Note, I'm using Lubuntu Linux 19.10 and the Google Chrome (not Chromium) is the latest version.

You use a packet sniffer (wireshark, tcpdump) to capture traffic, and the OS tools (netstat) to determine the network port used by the Chrome process (each Chrome tab is its own process). Then you simply pair the traffic from this process to its destinations.
But the premise is ridiculous. If Chrome wanted to secretly copy the data to its own servers so that it could try to break the encryption to read what you are sending (already ridiculous), then it would do it over its own process, and compress and batch the sending, so you would not be able to distinguish this traffic from other types of traffic. So, if this was happening, it would be very, very difficult to confirm that they were not doing that.
But it's always very difficult to prove a negative.


Is Oracle gathering information from my machine when I download Virtualbox or Netbeans? When we try to download Netbeans or Virtualbox from the Oracle/Sun site, our firewall warns us that some suite called EdgeSuite tries to obtain information from our machines. I don't know what information it is gathering, but I can't download any of them because our firewall categorizes its actions as a violation of privacy.

Is the firewall correct?  Does Oracle gather information from your machine when you download Netbeans or Virtualbox?
If yes, what information is gathered?

EdgeSuite (sub-domains of edgesuite.net) is a service of Akamai : http://www.akamai.com.
Many important companies use Akamai & EdgeSuite network capabilities to host files : Sun/Oracle, Apple, Adobe, etc.
Take it as a mirror site with high network capabilities ;)

Does it try to get information about your computer?

If you download products via your browser via HTTP or FTP: the server won't be able to get a lot of informations, only what your browser exhibits (browser's codename, OS name, ...).


Can my PC get infected by a shared USB drive? I gave one of my flash drives to a co-worker to share some files. He transferred the files to his computer and gave me back the drive a minute later.

Is it possible for my computer to have been infected with a virus or any kind of malware/spyware after I used that flash drive again?

Avast and Malwarebytes show that my system is clean but is there a way to make sure my PC is 100% clean?

Thanks!

Simply inserting a genuine flashdrive (as opposed to an attack device that mimics the appearance of a flashdrive) shouldn't ever be a risk. Similarly, browsing the files on a flashdrive, copying them to your local machine (as long as you don't put them somewhere where other programs will expect to find a trusted file), or writing to the flashdrive should always be safe. However, files on the flashdrive should be considered untrusted if somebody else has accessed the device; for example, if there was an executable on the drive its contents could have been replaced with a malicious file but the name, size, timestamp, and other metadata have remained the same. If that happened, running that executable would of course compromise your system. Opening non-executable files from an untrusted flashdrive could also be a risk, depending on how secure the program that opens them is and how much it trusts the files.

Now, with that said, there has been malware that spread by flashdrive before, but only on old or unpatched operating systems. Earlier versions of Windows could be configured to automatically run a program on a flashdrive or CD-ROM, but that no longer happens by default. Security vulnerabilities in how Windows Explorer generated icons when browsing a directory were used to infect computers from flashdrives in at least one notable case (Stuxnet), but that bug was patched long ago. It is not impossible that some other vulnerability may have been discovered, but so long as your machine is running an up-to-date OS and file browser, and you don't open any untrusted files, you should be fine.


Backup TrueCrypt hidden volume I have a usb stick witch is encrypted using truecrypt. How can I back it up?

The only method that comes into my mind is making a image of the usb drive and then restore it. But 16 GB I think it will take some long time. Also I want the backup to be encrypted.

Thanks

Make a binary copy of your usb stick. In linux you can do this with the dd command. This indeed may take a long time, but in your case there is no good alternative unless you make a separate truecrypt volume somewhere and manually copy files from time to time to there.