Strong authentication over insecure links Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the client and the server is being intercepted and viewed.

Are there any strong authentication schemes that can validate both the client (to the server) and the server (to the client).  Ordinarily this can easily be accomplished by an SSL Certificate authentication scheme.  Since these are being actively MITM'd this solution isn't adequate.

Any thoughts on a strong authentication scheme that allows both sides to authenticate each other while preventing replay attacks?

(I'm thinking more along the lines of a web-application versus a desktop application)

If your encapsulating layer is insecure, then you can adapt by creating a secure layer within that if you have a known public key ID for the remote host.

Since IP is insecure, we run SSL within it. Since your SSL sessions are forcibly terminated to an unwanted hosted making them insecure, run another secure layer in them such as SSL. SSL over SSL, SSH over SSL, or any other combination of tunneling should provide a trustable connection as long as you verify the host key.


What tools are there to inspect Flash SWF files? I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?

From the Area51 proposal.

From what I have been using:
here http://www.swftools.org/ is a set of tools for work with SWF files, can be used for data structure analysis. Another one is a tool from HP specifically for scanning vulnerabilities in Flash: http://www.hp.com/go/swfscan (requires registration).

Tools that I have not used:
Flare: http://www.nowrap.de/flare.html - there are also links to other tools, and Swfmill http://swfmill.org/ - tool to convert SWF to XML.


How practical is it to bruteforce a 10-digit number via URL Example URL www.[somewebsite].com/[10_digit_number]

Getting the correct number loads a page.

I know there would be 10 billion possible digits to choose from, but how long would it take? What are the resources one would need?

About a day

If we're lucky: there's no throttling, we can perform each test with a HEAD request, can perform many tests on a single HTTP connection with Keepalive, and can have many concurrent connections.

In that case we're mostly limited by bandwidth. Say we craft a tight request that is 100 bytes, that means we need to send a total of 100 * 1010 bytes. And lets suppose we have a decent 100 Mbps connection, which will do about 10 megabytes per second. That would take 100,000 seconds - just over a day.

This is best case, in practice there are likely to be issues that prevent it working so fast. We could have multiple systems working simultaneously to make it faster - but at some point we'll overload the server.


How can one gain additional privileges from being able to read kernel memory? Given the ability to read (but not write) arbitrary kernel memory as an unprivileged user, what approaches might one take to gain additional privileges on the system? Ignoring the 'trivial' method of scanning through the page cache, finding /etc/shadow or equivalent, and cracking the passwords. For concreteness, say it's a Linux kernel running on x86-64, but I would be interested in methods that would work on other kernels/hardware as well. References to papers describing techniques or existing exploit code would be much appreciated.

You can do keylogging and learn people's passwords, SSH passphrases, etc.
You may be able to access filesystem buffers or process memory and learn SSH private keys, SSL private keys, etc.
You can access the internal pool for /dev/random and /dev/urandom, which may allow you to break crypto used by programs on the system.
You can access any crypto keys stored and used internally by the kernel.
You can defeat ASLR, which might make exploiting other vulnerabilities easier.

There may well be many more.


Is it permissible to use GPG without an encryption key? Will I be disapproved of or get frowned upon a lot if I choose to deploy and use GnuPG without an encryption key? E.g. I generate keys manually and skip the encryption key entirely.

The reason is that I do not plan to receive encrypted communications with GPG mainly because of the lack of PFS, which feature almost everything else offers nowadays. Even the very this website comes with PFS. Not even mentioning the anecdotal inconvenience receiving encrypted emails out of blue. What was very good in 1991, isn't so good in 2019. (No offence though! It's just OpenPGP wasn't designed with PFS in mind.)

Well, considering the above I could have just moved on if not GnuPG misbehaving funnily if there's no encryption key, which makes me think
if there could be an actual important technical reason I really should be getting myself an encryption key. Is there?

For example, given a known encryption-incapable public key, GPG reports an error and waits for more input indefinitely:

$ gpg --version
gpg (GnuPG) 2.2.12
libgcrypt 1.8.4
$ gpg --recv-key 4AEE18F83AFDEB23
$ gpg -k 4AEE18F83AFDEB23
pub   rsa2048 2017-08-16 [SC]
      5DE3E0509C47EA3CF04A42D34AEE18F83AFDEB23
uid           [ unknown] GitHub (web-flow commit signing) <noreply@github.com>
$ touch example.txt
$ gpg -ear noreply@github.com example.txt
gpg: error retrieving 'noreply@github.com' via Local: Unusable public key

Else should I be using other means to announce that I don't want things encrypted in my name?

It is entirely acceptable to forgo creating an encryption subkey, if you do not wish to use GnuPG for encryption. There is no technical reason why this would be impossible, problematic or otherwise out of the ordinary. The OpenPGP standard is designed for encryption and/or signing, and quite a few people use it only for the latter. This is especially common when someone is posting to a mailing list or a public forum, as there is no one intended recipient, but cryptographic authenticity is still important.

The OpenPGP standard lacks forward secrecy because it is fundamentally impossible to do correctly using a protocol for asynchronous, indefinitely-delayed communication. There are tricks to get the same benefits as forward secrecy to a limited extent, such as by using short-lived subkeys and destroying them after use. There is also a draft extension for providing forward secrecy in OpenPGP.

The primary reason that forward secrecy is difficult to achieve is because it requires using ephemeral keys that are only kept as long as they are needed. In the case of a asynchronous email exchange, someone would need to give you their public key and you would need to encrypt with it and send them the reply. They would then destroy the corresponding private key immediately after using it to decrypt your message. The problem with this is the fact that they don't know when you're going to send a reply. They can't just keep the private key in memory only, or shutting down the computer would render any message you encrypt useless. They can't store it on disk, or issues like wear leveling and sector remapping may cause traces of it to remain, even after "secure deletion".


Purpose of nonce validation in OpenID Connect implicit flow The OpenID Connect specification requires implicit flow clients to generate and validate a nonce:

  String value used to associate a Client session with an ID Token, and to mitigate replay attacks.

What replay attacks are those?

Put differently, what is the security impact of not validating the nonce when using the implicit flow?

My current understanding is as follows:

The client (a web application running in the user's browser) generates a nonce, puts it into the browser's session storage, and redirects to the authentication server, passing the nonce as parameter. After authentication, the authentication server redirects back to the client, passing a signed id token containing the nonce, which the client must validate against the nonce from the session storage.

If the nonce is not validated, an attacker could substitute another id token, by tricking the user into visiting his site, and sending a redirect with a valid id token obtained from a different request.

In addition to the id token, the authentication server also replies with an access token. If the nonce is not validated, an attacker could substitute a different access token, by tricking the user onto his site, and redirecting with that token. This might be used for a client side denial of service attack (in particular if browser tabs share the token storage, i.e. use local rather than session storage).

In summary, nonce validation is necessary to trust the id token. If the id token need not be trusted, nonce validation may be skipped.


In the SilkRoad takedown, what does it mean "An IP address was leaking" in Tor? According to the official complaint, on Page 28 they mention:

  on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from the site, and listed IP address of the VPN Server.

What does it mean that an IP Address "was leaking" and when would this occur?

It is an information leak on the Silk Road server. It appears somebody located a debug or info screen on the Silk Road server that dumped configuration and environment variables. Some possibilities:

The output of Apache's mod_status (example)
Output of phpinfo() (example)
A custom debug page that is part of the Silk Road application

It could have been found by checking known locations of status and debug pages or checking common locations (eg. /phpinfo.php).
It looks like the debug output contained the servers public IP address and the IP address of another server that was being used by the admin as a VPN proxy to administer the Silk Road site (the IP was stored because it was being used to whitelist).
In March of 2013, less than a few months prior to when the FBI took a snapshot of the Silk Road server, a blogger posted a warning to Silk Road users that the server contained a misconfiguration that revealed the servers IP address and other information:

WARNIG TO SILK ROAD USERS: SR is leaking their public IP address

It is possible that this is the same person who messaged and warned Dread Pirate Roberts about the info leak.
From a related thread on reddit that user says:

Last night, while SR was down for maintenance, a brief few moments allowed a certain set of circumstances that caused me to be able to view the public IP of the httpd server of Silk Road. This isn't an obvious flaw, but it is extremely simple if you know where to look - the server basically will publish a page containing all of the configuration data of the httpd server including the public IP address.

While we can't know yet if this is the same user or the same bug it is indicative of potential problems with information leaks on the Silk Road server. The FBI could have later discovered the same information and used it to trace back to the VPN server.
What we do know is that the Silk Road server had a public IP address, which was used by Dread Pirate Roberts to administer the server. Accessing this public interface using a VPN server (which in turn revealed his real IP address) was a good part of the case against the accused.
Most important, this leak had nothing to do with Tor or a flaw in Tor, it was all down to how the site was hosted and how it was accessed for administration.
Edit: I have since been able to confirm this theory
I found the following thread on /r/SilkRoad, it was posted 5 months ago:

Should we be worried? Showing on login page
I have removed the IPs
Array ( [USER] => X [HOME] => X [FCGI_ROLE] => RESPONDER [QUERY_STRING] => [REQUEST_METHOD] => GET [CONTENT_TYPE] => [CONTENT_LENGTH] => [SCRIPT_FILENAME] => X [SCRIPT_NAME] => /index.php [REQUEST_URI] => / [DOCUMENT_URI] => /index.php [DOCUMENT_ROOT] => X[SERVER_PROTOCOL] => HTTP/1.0 [GATEWAY_INTERFACE] => CGI/1.1 [SERVER_SOFTWARE] => X[REMOTE_ADDR] => xx.xx.xx.xx.xx [REMOTE_PORT] => X [SERVER_ADDR] => xx.xx.xx.xx.xx [SERVER_PORT] => 443 [SERVER_NAME] => _ [HTTPS] => on [REDIRECT_STATUS] => 200 [HTTP_HOST] => xx.xx.xx.xx.xx [HTTP_CONNECTION] => close [HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20100101 Firefox/17.0 [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 [HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5 [HTTP_ACCEPT_ENCODING] => gzip, deflate [HTTP_COOKIE] => session=X [PHP_SELF] => /index.php [REQUEST_TIME] => 1367610063 )

The above environment variables were being dumped in the source of the login page on Silk Road. They contained the real IP address of the server.
Edit: September 2014 - Confirmed by the FBI
In a filing during Ross Ulbricht's trial and in response to a defense motion the FBI revealed how they located the Silk Road server:

they found a misconfiguration in an element of the Silk Road login page, which revealed its Internet Protocol (IP) address and thus its physical location.
As they typed “miscellaneous” strings of characters into the login page’s entry fields, Tarbell writes that they noticed an IP address associated with some data returned by the site didn’t match any known Tor “nodes,” the computers that bounce information through Tor’s anonymity network to obscure its true source. And when they entered that IP address directly into a browser, the Silk Road’s CAPTCHA prompt appeared


Hacker101 Spoilter #2 EASY Micro-CMS v1 I am just getting into CTF and Hacking in general. I am very confused as to why this worked when I added an apostrophe to the end it reveals the flag. I have Burp Community Edition suite going and I have HTTP live headers.

I am just not trying understanding how adding http://example.com/page/edit/2' gives the flag while http://example.com/page/edit/2 is a normal page. I'd appreciate any information

As Seen Here

Using Burp, the only difference I see in the requests is

With the ' it shows

GET /page/edit/2 HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

And without, it shows

GET /page/edit/2' HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

So it appears the only difference is the Cache-Control HTTP Header, is that right?

Cache-Control: max-age=0

And from HTTP Live Headers

http://example.com/page/edit/2'
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Connection: keep-alive
GET: HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Mon, 09 Sep 2019 16:18:40 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Content-Length: 76

It looks like a possible SQL Injection. ' is used to limit strings in SQL, hence with your ' you delimit it.

It seems like the FLAG string was not properly escaped, so the flag gets returned when you add the character delimiter.

It's a common technique for people testing SQLi vulnerabilities. Web CTF has a lot of guessing in it, so be prepared to keep guessing.


renegotiated master key in openssl s_client OpenSSL c_client (CLI) prints the Master-Key during initial handshake. This can be clubbed with client random to decrypt packet capture in Wireshark. However, the random and master key changes after renegotiation and packet decryption stops working after this.

Is there a way to print the Master-Key after secure re-negotiation as well (from command line client)

Looks like this is not supported in s_client. However, the renegotiated keys can be printed by hijacking the SSL_read function in ssl/ssl_lib.c file of openssl library.

I added the following code to SSL_read().

int i;
printf("key is: ");
for(i=0;i<48;i++){
  printf("%.2X",s->session->master_key[i]);
}
printf("\n");

Then I ran apps/openssl s_client with LD_LIBRARY_PATH=. to print the keys used for each read operation.

Note: re-negotiated key based decryption is not supported in older versions of Wireshark. I used Wireshark-win64-2.3.0-3548-gc30bb2c


Monitoring nearby WiFi clients I know that a WiFi adapter can scan for active BSSIDs, and that in monitor mode it can scan all unencrypted traffic.

What is the best way to list nearby WiFi clients from Python?  I understand that all I might get is a MAC address and the AP it's communicating with, but this is all the data that I need.

Check sources for the WPS handshake attacks from the WIFITE package.

I remember it listing clients of all scanned APs, with MACs.

(Needs clients info to force deauth and capture handshake)

https://github.com/derv82/wifite/blob/master/wifite.py

class Client:
    """
        Holds data for a Client (device connected to Access Point/Router)
    """

    def __init__(self, bssid, station, power):
        self.bssid = bssid
        self.station = station
        self.power = power

Also

https://gist.github.com/garyconstable/1dca3c32dfd05f0bd15f

#sniff for client mac's
    de.sniffClients()

I don't know python very well, but it's in there.

Comment: remove inaccurate pieces of code via edit


How to provide two factor authentication code text messages, so that they are not shown on the lock screen? It's a commonly discussed problem that when a service sends an authentication to the user's phone, the code is often displayed in the preview on the lock screen, which means it's visible to anyone who can access the phone or even seen it.

I know you can change this setting so that the preview of an incoming text message is not displayed on the lock screen, but most people don't do this (and saying that users "should" do it isn't going to fix anything).  (And for incoming messages generally, it's often convenient to see them before you unlock the phone.)

It seems that for the service itself, the safest option would be to pad the beginning part of the message containing the code, so that even if someone can see the initial portion of the message displayed on the lock screen, they won't see the code.  (If the user is receiving an authentication code, I don't think it's asking too much of them to actually unlock their phone instead of just glancing over at it.)

And yet I've never seen this anywhere on a list of recommended best practices, and I've certainly never seen any service actually doing it in the text messages that they send out containing authentication codes.  Any reason why it wouldn't be a good idea?

Long-term, should there also be a protocol to mark a text message as "private" so that the preview should not be shown on a locked device?  (It could be as simple as putting "PRIV:" at the beginning of the message.)

Two-factor authentication means that you prove two things. In most cases, the two things are "something you know" and "something you have". In your case, the "something you know" is the user's password, which they must get correct before the authentication code text will even be sent. The "something you have" is then the phone, which will display the authentication code. If you were to force the phone to be unlocked before displaying the authentication code, you've added an additional "something" they must know (the phone's PIN), but this isn't an additional factor, since they already must know the account's password. Further, if an attacker has the phone, they can just take the SIM out and put it in their own phone, receiving the text and bypassing the phone's PIN that way. As such, implementing your suggestion would annoy and inconvenience users for only a negligible gain in security.


how secure is rsa encryption for a web login without https? I have a server running rstudio. This is basically a web application, and it is currently only accessible over the local network.

The web app takes your Linux username/password in order to log you in, and according to the docs "User credentials are encrypted using RSA as they travel over the network." (https://www.rstudio.com/ide/docs/server/getting_started)

Lets say I wanted to open the port to external requests, so that I could use this web app anywhere. What would be the security risk assuming I didn't use https?

It will be somewhat secure, but not nearly as secure as https, aside from the credentials all other data is unencrypted. If you plan on using it on public (open) networks, I would recommend setting up a proxy as described here. Even with a self signed certificate it will be a lot more secure.


How to protect UEM (Unified Endpoint Management) agent on your endpoint A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "Healthy" status back to the server.

If a device is compromised, OS level privilege was obtained by the attacker. How can we prevent the attacker from killing the UEM agent and sending fake "healthy" traffic back to the server?

My ideas:

Traffic can be encrypted with server's public key, but this doesn't matter since attacker can obtain the public key in your machine with OS access.
Use Yubico key (U2f) to authenticate the agent before starting a session with the server. This helps a bit because this prevented session duplication attack, attacker could only do session riding. (private key is not stored on the system) But what if the attacker patch the agent instead of killing it?
Don't trust your UEM status?

I have read a few things about that in the past few days.. came up with some ideas.

Ensure you have authentication used on the application. This can prevent someone from killing your agent AND create a fake agent to talk to the server. They will need to authenticate with their fake agent first, if they dun have the credentials, they will not be able to do so. You can also implement 2FA / U2F to increase the strength. This eliminated the possibility of your process being killed and create their own session.
Use TLS for connection, this might sounds lame, but it is an effective solution to prevent MITM attack, so in this case, we can prevent the attacker from changing the traffic.
Get your application signed by Microsoft / apple /google, and leverage their protection mechanism in the operating system to protect your app from being patched in runtime. Please look at system integrity protection in MacOS. This prevents your process from being touched even they gained root access on the device/platform.

By combining all three things, I think the attacker will not be able to modify the app/traffic. Let me know if you have any ideas!


What's a secure firewall rules using UFW? On my Ubuntu server I have these services running:

netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:9000          0.0.0.0:*               LISTEN      1340/php-fpm.conf)
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      685/mysqld
tcp        0      0 0.0.0.0:6698            0.0.0.0:*               LISTEN      557/sshd
tcp        0      0 0.0.0.0:9939            0.0.0.0:*               LISTEN      1457/pure-ftpd (SER
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1479/varnishd
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      1325/nginx.conf
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      1435/master
tcp        0      0 127.0.0.1:6082          0.0.0.0:*               LISTEN      1478/varnishd
tcp6       0      0 :::6698                 :::*                    LISTEN      557/sshd
tcp6       0      0 :::9939                 :::*                    LISTEN      1457/pure-ftpd (SER
tcp6       0      0 :::80                   :::*                    LISTEN      1479/varnishd
tcp6       0      0 :::8080                 :::*                    LISTEN      1325/nginx.conf
tcp6       0      0 :::25                   :::*                    LISTEN      1435/master

Since I am not familiar/good with iptable rules I am using ufw to make it simple for me. This is what my ufw status looks like:

ufw status
Status: active

To                         Action      From
--                         ------      ----
6698                       ALLOW       Anywhere
9939                       ALLOW       Anywhere
80                         ALLOW       Anywhere
8080                       ALLOW       Anywhere
25                         ALLOW       Anywhere
6698                       ALLOW       Anywhere (v6)
9939                       ALLOW       Anywhere (v6)
80                         ALLOW       Anywhere (v6)
8080                       ALLOW       Anywhere (v6)
25                         ALLOW       Anywhere (v6)

Would you consider it a reasonably secure firewall rules? Any suggestion?

The general rule with firewall configurations is that you should allow as little access through the firewall as possible.

In the ruleset you've listed you're allowing access to 5 services from anywhere, so if you're on the Internet and there's no NAT device or other firewall between you an the general 'net then anyone can access and attack those services.

It may be of course that, that's intentional (i.e. you're offering public services which should be accessible from anywhere on those ports) however if this isn't the case I'd recommend restricting those to the minimum possible.

As an example if you're not intending to offer any public services (which most client systems won't be) shouldn't be allowing any inbound traffic (apart from responses to connections you start).

Also if these services do need to be accessible but only by certain people, consider restricting the source addresses that can connect to them.


At what point does adding more iterations to PBKDF2 provide no extra security? If my true passphrase is used only to generate a hash which is used as the cipher's actual key, doesn't that mean it's possible to try and brute force the cipher itself? I know it would take an impossibly long time either way, but at what point would it be faster simply to brute force the key itself, rather than going through each hash iteration?  For my most secure drive, I use 20 second iterations (which results in about 2 million SHA512 iterations) instead of the default of 1.  If someone wanted to crack it and had all the time in the universe (and several times over), would they do it faster if they went for the resultant hash or every possible ASCII for the original passphrase?

EDIT: I want to point out that I'm just curious about the math, not about the practicality.  I already use a long passphrase, and I know that it would take impossibly long to brute force, I know about rubber hose cryptanalysis, etc.  All I'm asking is, if an adversary theoretically would be capable of brute forcing the AES key directly, after how many hash iterations would it be harder to brute force the ASCII key than the AES key directly...

There's no exact answer, and here's why:

Brute Force

We start with a 128-bit symmetric key. Assuming the algorithm (e.g. AES) isn't yet broken, we have to look at power consumption. Assuming 100% efficient computation devices whose technology far exceeds any computer, ASIC, graphics card, or other key-cracking device you can dream up, there's a minimum energy requirement for just flipping the bits to count that high. Wikipedia has done the math for us, and it comes out to, for a 128-bit key, the minimum energy requirement demanded by physics is approximately 1018 joules, or 30 Gigawatts for one year. Obviously with "real" hardware, the requirement would be several hundred thousand times that; more than the energy production of the entire world. So that's well outside the capability of any existing terrestrial body.

But if we move to a 256-bit key, the math gets more serious. Schneier did the math on this one in Applied Cryptography, and it's been discussed here before. To avoid boring you with repeated details, I'll simply cut to the conclusion: our sun does not produce enough power to accomplish this task.

Theoretically reversible computing (which may be possible with quantum computers) could cut the effective bit length by half, making such a project merely beyond the reach of any existing power, rather than beyond the reach of physics entirely. But that's all academic.

The take-away is this: brute-forcing a reasonably-sized symmetric key cannot be done. Not by you, not by anyone.

Equivalent Rounds

So, how many rounds of PBKDF2? If the attacker has to choose between waiting 10 years for the key derivation complete versus building a Dyson sphere around the sun, the PBKDF2 route is still faster. By any practical metric, adding more time to your key derivation means adding more time to the attack, and at no point  does trying to brute-force the key ever become an option (unless the PBKDF2 route also requires an extraterrestrial construction project).

So, where's the equivalence point? When does brute-forcing PBKDF2 require the whole Dyson Sphere setup? The answer is: it depends. See, the whole point to using the hash process in your attack instead of guessing the key itself is so that you try fewer password. If you know the password is either "monkey" or "123456", then you'd rather guess only twice, instead of trying to by luck hit the correct hash in a sequential scan.

So the answer depends on the size of the dictionary your attacker will use in his attack. If he knows the password exact, then he only guesses once. And therefore, the brute-force attack will take exactly as long as the correct login. However long you make that out to be. If he expects to get it in two guesses, then the his brute force will take exactly twice as long as your correct login. If he has a dictionary of 100 words to try, then exactly 100 times as long as your correct login, and if your password isn't on his dictionary, then he cannot ever succeed, ever.

Some Practical Math

So to guarantee that his brute-force attack will be impossible, you also have to guarantee that your successful login will be impossible, because you have to account for the possibility that your password is the only candidate on his list.

If on the other hand, you want to go for a reasonable average, just do some simple division. Lets say you want the brute-force attack to take 1 trillion years. And let's say our password is 14 characters alphanumeric (so 1 out of 1025). Assuming his dictionary is all alphanumeric passwords, that's 1025 password guesses in 1012 years (short-scale trillion), or 1013 guesses per year, or about 316900 guesses per second. That's for a fully-exhaustive pass through the list. Some password will be guessed first and some will be guessed last, we probably care about the average, not the max, so lets drop our guess rate in half. About 150000 guesses per second gets us half way through the list in the same amount of time.

So as long as we tune PBKDF2 such that it takes more than 1/150,000th of a second to guess each password, and we can guarantee that the smallest dictionary our password will appear in is the list of all 14-letter possibilities, then 1 trillion years it is.

Longer Passwords

Of course, 14 character random passwords are hard to come by. With 13 characters that shrinks our password list from from 1025 entries down to 1023, requiring about a 100x slowdown in cracking speed (1500 passwords per second) to keep our 1 trillion year average (technically that 100x is actually a 62x, because that's how many alphanumeric characters there are, but I'm rounding to powers of 10). Dropping another character off your length changes your numbers by another 62x each time.

The moral of the story is that what you're hashing matters so much more than how you're hashing. For example, a 22-character alphanumeric password is a 131-bit key, which even without using PBKDF2 at all is well beyond reason for trying to crack.

Caveat

Bear in mind that if the underlying crypto is ever broken, such that it can be attacked without guessing the key, then that will probably become the attack method of choice. But we know of no such attack in AES, nor do we expect one to ever exist.


Is there an alternative to google blocked searches? I'm trying to do some research on google. I'm using specific keywords like inurl, site, etc....  But google seems to think I'm trying to do harm (actually I'm doing recon on a website for a friend)... So it displays this message

  Our systems have detected unusual traffic from your computer network. This page checks to see if it's really you sending the requests, and not a robot

What can I do against it ? Is there an alternative to google to recon using a web crawler without being blocked ?

If continuing with regular search queries, you need to change your IP address, as simple as this. Users using proxies in the cloud often experience such issue, just because even though they have their unique IP addresses, somebody on the same subnet is doing a large volume of Google queries. I'm not sure if this was the case for you, but if you used a cloud provider to proxy your queries, this happens very often.

The wording of your question implies that you automate your queries with a program. Or you are the one that makes too many requests. In this case you'd be better to request a token from Google and use their APIs instead, where you can't get blocked. This is the API page. You can make up to 10K queries per day.


Login Name and Password in URL I've recently encountered a webapp, which has it's url in the following format:

http://www.[WEBAPP].com/INetService/Show.aspx?Username=[EMAIL]&EncryptedPassword=[Some String of 32 characters length]

Now this seems like a pretty bad way of delivering the login credentials to
the server especially since not only is it using http, so an attacker could easily read the traffic, but also you can copy paste this link after any duration of time into another browser on another computer and it will work.

This effectively means that if the users browser history is somehow compromised (for example by carelessly using a public computer), the users account can be compromised aswell, and logging out is essentially doing nothing.

How should I proceed, should I notify the developer of the application?

Yes you should notify the developer. This could be regarded as quite a serious vulnerability. It's their choice whether or not they choose to listen to your advice, but at least you can rest easy knowing that you did what you could to help them improve their security for their web application.

At the end of the day they are the ones that are ultimately responsible for the security of their users, and they would be extremely foolish to ignore this obvious loophole in security.

If you choose to write an email/message to the developers, try to outline the possible consequences of inaction. This could help kickstart them into actually fixing the bug.

EDIT: I would propose they make the following changes...

Use the 'post' method when submitting web forms so that information is not displayed in the URL of the webpage like it is at the moment.
Suggest implementing SSL to add a basic level of encryption to the communication between the client and the server
Suggest using cookies to store session information and NEVER to use the information provided in a URL as a valid form of authentication. In theory when designing apps like this it would be wise to make the assumption that you CANNOT trust the end user and therefore the server side scripts/software must perform all of the necessary validation.


Securely storing (email) lookup database Looking for suggestions on implementing a server-side lookup table, where the key is an email address.

Goal: Keep these email address private, even if data on the server is stolen.

Assumptions: The server does not need (and ideally should not know) the email address. Clients cannot directly talk to each other, but it's going to be a web/native app so they can can perform some calculations before making queries.

Is this achievable?
Note: Just storing a hash of the email on the server would leave the keys vulnerable to a dictionary attack. The server also can't simply add a salt for each hash, because it would not know which salt to use when presented with a specific email address. I could encrypt the hashed emails with a global key stored separately, but I'm hoping there are better solutions than this.

There are two different cryptographic approaches to this problem,  a hash function and asymmetric cryptography.

The client could hash the email address using a cryptographic hash function such as SHA-256 and send it to the server for lookup.  There is still the problem of brute force.  email addresses have their pros and cons.  The domain name is kind of like a salt in that no two users will have the same resulting hash.  The con is that its not a very strong salt,  gmail is pretty popular. To make matters worse large list of email addresses would be a useful dictionary attack.  The email address as a key may not be the best choice,  but its not bad.

An alternate design is to use asymmetric cryptography.   Generate a public private key-pair, then throw away the private key.  Give the same public key to every client which is used to encrypt the email address and this cipher text is transmitted to the server as the lookup key.  Note there is still the same problem as brute force,  but asymmetric cryptography is a lot heavier than sha-256.  If this a concern you could explore key stretching.


What is the state of the art on reading keystrokes based on vision? In Citizen Four, we saw Snowden use the following head blanket:

This doesn't look like a reasonable solution for casual situations, but it makes me wonder - what is the state of the art on reading keystrokes based on vision? Is there any research on an automated system that would read the keystrokes and in case of an imperfect read maybe match them against dictionary words? How reliable could such system be and what technical limitations would it have?

Any camera that is able to capture images at a good frame rate would make his password visible when the video is reproduced in slow motion.

As you say about passwords being matched in a wordlist, it would not be so effective, since passwords can be (and should be !) random strings mixed with numbers and other special chars.

But, even if some of them are not completely visible, you can use for example, in the case of a hash recovery, an attack called mask attack

Hashcat and john the ripper for example have this kind of attack implemented. It works as you giving a mask, for example:

potato?d?d?d?d

It means, try potato + ALL combinations of numbers (?d), from 0 to 9. Since there are 4 occurrences of ?d, it will try all from potato0000, to potato9999.


Getting Certificate KeyContainerName to initialize CspParameters How can I get the name of a Key Container that's in a smart card required for initialization of CspParameters?

CspParameters^ cspa = gcnew CspParameters(ProviderType, ProviderName, keyContainerName, cryptoSecurityKey, securityString);

RSACryptoServiceProvider^ csp = gcnew RSACryptoServiceProvider(cspa);

Since certificates from smart cards are automatically installed in a personal certificate store, I have tried looking for keyContainerName in X509Certificate2 and I couldn't find it there.

I have managed to find a container name of one of the keys outside of C++ using certutils.exe, and that way, I just entered that name and I managed to generate a digital signature using the aforementioned RSACryptoServiceProvider. It works beautifully. What can do I do with other certificates that the software might be used with? I can't ask the users to enter container name manually.

But, from what I understand, if I don't provide the container name (leave it empty), it doesn't work. So I need a way to find/get a key container name for any certificate in any smart card within the program code.

Unfortunately, most examples I've seen on the internet provide a constant predefined container name (like "example" or "test" - like here https://secpal.codeplex.com/discussions/13106 ), which is useless in real life.

Is this what you're looking for? (sorry for messy code, I'm a Java guy thrown into VC++ code)

    HCRYPTPROV hProv = NULL;
    DWORD status;

    if (FALSE == CryptAcquireContext(
        &hProv,
        NULL,
        MS_SCARD_PROV,
        PROV_RSA_FULL,
        CRYPT_MACHINE_KEYSET | CRYPT_SILENT)
    ){
        status = GetLastError();
    } else {
        PBYTE pbData = (PBYTE)Alloc(256);  // formally, you should check the max size
        DWORD tmp = 256;
        PDWORD pdwDataLen = &tmp;
        status = 0;
        bool is_first = TRUE;
        // PP_ENUMCONTAINERS does an enumeration over all containers available to the MS_SCARD_PROV crypto provider
        // (which should be just all containers on the smartcard in case of single smartcard and single reader)
        while (status == 0) {
            if (FALSE == CryptGetProvParam(hProv, PP_ENUMCONTAINERS, pbData, pdwDataLen, (is_first ? CRYPT_FIRST : CRYPT_NEXT)))
            {
                status = GetLastError();
                //__leave;
            }

            OutputDebugStringA((LPSTR)pbData); // or std::cout in a console application
            OutputDebugStringA("\n");
            is_first = FALSE;
        }
    }


Someone is using similar domain and spamming clients This is the problem my friend is facing in his office.
Someone is using an almost similar domain as my friend's company (via email). This person is posing as their company and asking them to send money with an invoice of the same format as his company uses but the only thing is different is the account details where amount should be debited while claiming that their product they ordered is out for delivery.

It seems imposter has details of clients emails, the format of the invoice the company uses and it's likely they somehow know the conversation going on between their sales office and clients.

How can I help him? Is there something that I can do or advise?

Use a tool like http://www.tcpiputils.com/ to find out who owns the fake domain and who hosts the fake domain and locate the "abuse" email. Send them samples of the fake emails. This should help to take the fake domain down.

Meanwhile, send warnings to all the clients that there is active criminal activity going on.

As for whether or not someone knows the communications between the company and the clients, there is not enough detail to provide any answer about what to do about that.


Looking for some sort of system wide auditing tool The title summarises it all but here's an example:

  You're sharing some hardware equipment with your dev colleagues, some
  days everything works well with it, the next day, nothing works
  anymore, can't even get yum to play nice, etc. And it's not clear as to what changed since last time.

What I'm looking for is a software, or Linux framework that does system-wide auditing in order to:

who was logged in and when
which files have been modified during that session
what exactly as changed within those files, like diff does

So far, I've seen packages like audit and acct address the first 2 points but don't seem to provide any detailed info about what has changed, the third point.

As you don't want to necessarily monitor the whole filesystem, restricting to the configuration dir /etc would be a great start ; keeping track of changes a bit like diff does. This way it would be easy to find out what config change causes system wide issues. Any ideas?

I recommend OSSEC, and or (mentioned by Schroeder) Tripwire. However, I also recommend principle of least privileges. If you have your developers all using escalated privileges to do their work, I emphasize placing them in groups, and using sudo. For added measures, I'd add timestamps to bash history files where applicable. This will enable you to track what commands occurred at what time (if users don't erase their history but that too can be addressed)


Are wireless card skimmers just fearmongering? I'm not sure about other countries but Australian Banks have been releasing cards with RFID Chips in them (for what reason is beyond me since around the same time there's been payway apps which swap the bank card for a phone). Also about the same time I have been seeing ads for Scan Blocker. The page explains how it works.

  Scan Blocker's antenna detects a nearby sniffer
  Scan Blocker draws energy from the sniffer to power up
  Scan Blocker instantly creates an E-Field, a surround electronic field making all cards invisible to the sniffer
  Scan Blocker repels and scrambles the sniffers' signals
  Once a sniffer is out of range Scan Blocker de-powers

Before these chips were put in to my understanding someone needed the bank card itself to skim it and steal information from it a person would either need to steal the card itself or hook up a card skimmer to an ATM or Eftpos Machine. The ads for Scan Blocker and the like imply now someone can just walk past you with this "sniffer" to get all your card details.

But I find it hard to believe that multiple banks would force1 a technology that would require third-party devices to make them secure. So I am wondering if there is any truth to what these Scan Blockers say? Have banks cards just been made more vulnerable thanks to these RFID chips?

1: I say forced because when I went to change banks once I asked for a card without a chip but I was told it wasn't an option

ScanBlocker seems like overkill, and depending on how the transmitter works it may even be illegal in some places.  RF blocking wallets are much cheaper, much smaller, and have fewer parts to go wrong.  My paper passport has an RF blocking cover; it needs to be opened a bit in order to be read.  My plastic passport card came in an RF-blocking Tyvek sleeve.  I've tested both and they have proven highly effective at preventing NFC reads.

The ads are correct in that NFC skimmers do exist.  Whether or not the card data that is visible to a skimmer is useful depends on the thief and the card.  The cards transmit the account number in the clear, but a successful authentication also needs another value, called the CVV, CVV2, CVC, or others.  If the card issuing bank used Static Data Authentication (SDA) to generate the CVV, the thief has everything he needs to create a working clone (most banks are smarter than that, however.)  If the card uses Dynamic Data Authentication (DDA), the thief will get a cryptographically generated one-time-use CVV number, and even that won't work after your card generates another number.  (The CVV2 is the short code printed on the face or back of the card, and the thief cannot read that electronically.)

Note that he still has the account number, but without a valid CVV it will severely limit the transactions where he can use the stolen number to primarily offline situations.

The larger question is if any of these measures are necessary.  Yes, there are NFC skimming thieves on the planet, but not as many as a scary advertisement would have you believe.  So the answer is "it depends."  Do you live in a populous area?  Do you frequently take mass transit, or sit in crowded public spaces?  Do you spend a lot of time in shopping malls, or busy airports?  The more people you expose yourself to, the higher the chances are that you could get skimmed. If you believe you are at risk, use an RF blocking wallet.


Are there valid reasons for spoofing an address? This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.

Are there valid reasons to spoof an address?

I found an article here which describes some legit examples for spoofing IP:

In mobile IP environments, where a roaming host must use a "home" IP address in a foreign network (ref. C. Perkins, "IP Mobility Support for IPv4)
virtual private networks that set the host IP to an address local to the organization's network


Where does last 4 bytes of hmac go in wpa2 mic? The wpa2 mic is a 16 bytes array which is built by Hmac(sha1)
,But the Hmac(sha1) returns 20 bytes array.
So where does that 4 bytes go?

It's supposed to be "negotiated" but the size of MIC is fixed to 16 octets, so independently from the algorithm used eventually it'll be truncated.

  11.6.3 EAPOL-Key frame construction and processing

  [...] EAPOL-Key frames are constructed and processed according to the AKM
  negotiated at association time. The negotiated AKM determines what
  algorithm is used to construct and verify a MIC, the size of the
  MIC, and the algorithm used to wrap and unwrap the Key Data field.

Table 11-9 - Integrity and key-wrap algorithms

So, they're discarded:

  11.6.2 EAPOL-Key frames

  HMAC-SHA1-128 is the EAPOL-Key MIC. HMAC is defined in IETF RFC 2104;
  and SHA1, by FIPS PUB 180-3-2008. The output of the HMAC-SHA1 shall
  be truncated to its 128 MSBs (octets 0–15 of the digest output by
  HMAC-SHA1), i.e.,
  the last four octets generated shall be discarded.

Taken from:

Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY)  Specifications. (IEEE Std 802.11 - 2012)


How does a phone call / SMS message verify my identity More and more I've been seeing online services that want to verify my identity using an automated phone call or text message.  The trouble is - they ask me to provide the phone number!  It seems the only thing they've verified is that I own a phone.  I suspect a skilled attacked could even use a "burner" phone or virtual number of some kind to make the verification anonymous.

I've also considered this might be a new type of CAPTCHA, but considering how easily a computer could parse the data, that seems unlikely.

Does the verification process actually add any value from a security standpoint?

EDIT: This is not just during sign up, it's used to verify existing accounts as well.  See sample screenshot from G Suite (Google Apps for Bussiness).  I signed into an account that does not have 2FA enabled from a computer I do not normally use to sign into the account.  After entering my cell number, I got a verification text and was able to get in the account.

Does the verification process actually add any value from a security standpoint?

It is an anti-spam system. Here's how it works.

Each phone number can be used to re-activate accounts a small number of times before it won't be accepted anymore, and each Gmail account can send to a limited number of recipients every day.

Because most people don't buy things from spammers, they need to work with lots of accounts in order to send enough email to make money. If we think an account might be being used by a spammer, we lock it until the owner provides a phone number. So, spammers need to have access to a large number of phone numbers to unlock all their accounts. This is very expensive for them but pretty easy for most regular people. In most cases it is expensive enough for the spammer that it becomes unprofitable for them to spam, so they give up.

source:-https://productforums.google.com/forum/#!topic/gmail/r_EfrI4BQU8


How to handle emails as usernames under GDPR? Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to do user/pass checks.

However, in the context of GDPR, and since emails are considered personal information, this data should be protected while on the database or other storage medium.

It would be wonderful to have your opinion on the following approach to handle it with pseudonymization:

Store a pseudonym (hash) of the email instead of plaintext email;
Every time a login is attempted, search for the hash of the email and do the credential checks;
When there is the need to really get email to display in the frontend or other usage, keep a "pseudonym table" with a key/value structure, where the key is the hash and the value is the encrypted value of the email. This plain-text column could be ciphered with any available column-encryption strategies available on most relational DBs;
The password to decrypt the column would be used in memory to decrypt the column values but the data would be stored in an encrypted form;
Do this for all personal data that the webapp needs to store;

What do you guys think of this approach?

Do you think this will have a big performance penalty, even with an indexed key column?

Is there any other simple approach to still offer the possibility to handle email as usernames but still comply with GDPR?

IANAL, but GDPR does not make encryption mandatory for personal data. Read this article to understand the complexity around encryption and GDPR better.

  In the GDPR encryption is explicitly mentioned as one of the security
  and personal data protection measures in a few Articles. Although
  under the GDPR encryption is not mandatory, it is certainly important
  to see where and why encryption is advised.

  ...

  GDPR encryption: the what you should know part
  Before doing so let’s be clear: GDPR compliance, as we wrote before is a business strategy challenge and encrypting personal data STRICTLY SPEAKING is not mandatory.

  Read more at https://www.i-scoop.eu/gdpr-encryption/

Preferably you do a Privacy Impact Assessment. Afterwards make a decision how you will handle the personal data. If you conclude that encryption of email usernames is a good decision, do it. For example if your web-application is called peoplewhoarechristians.com the usernames would be classified as sensitive data because it creates a relation between the user and their religion. But how sensitive the personal data is will depend by case basis and so will the actions to mitigate the risks. Also the law talks about a "implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk", what appropriate is will differ per case.

Your approach feels good for sensitive personal data. I think it will be overkill for low risk personal data. Still I would document your decision. Email addresses are currently not sensitive data by default. Read this article about the difference between sensitive and non-sensitive.

We could argue that giving an email address as username means that the user gives consent for processing and aware that it could leak in combination with your app-name. But better safe than sorry and therefore I would ask clear consent for the usage. In this example the purpose of personal data collection and processing is authentication and probably access control, but don't forget analytics and things like error logging. If you plan to also use the email for marketing purposes be sure to gather extra consent.


Code execution through JSP RFI? I'm working on improving my understanding of RFI (Remote File Inclusion), especially in JSP apps.

I've created a vulnerable application that imports a JSP page from another server to replicate the behaviour of a real RFI.

This the import code :

  <c:import url ="http://localhost:8082/rfi.jsp"/>

The rfi.jsp code is only displayed and not executed.
Is it possible to achieve code execution using JSP RFI?

Thanks.

I found this old question, anyway I'll try to answer it.

The answer is yes, but not with the code you put. The RFI (remote file inclusion) is exclusive of PHP, JSP and the uncommon HTML SSI (server side inclusion) as you can see here on its definition: RFI definition.

This code extracted from the link I posted is vulnerable to a JSP RFI.

<%
   String p = request.getParameter("p");
   @include file="<%="includes/" + p +".jsp"%>"
%>

/vulnerable.jsp?p=../../../../var/log/access.log%00 - Unlike PHP, JSP is still affected by Null byte injection, and this param will execute JSP commands found in the web server's access log.


syn flood size per second Given the size of a TCP packet is 60 bytes, there is a SYN Flood attack on a computer made by a 100 Mb bandwidth, the question is how many syn packets are sent in a second? Is there any formula for calculating?

Attack using 100 Mbps link means you have to create roughly 210k packets to fully utilize your 100 Mbps connection.

100 Mbps = 12500000 Bytes

12500000 / 60 Bytes = 208333.3333333333 Packets

Depending on your machine you will require multiple processes to generate this amount of packets, single process won't generate these many packets in one second.


Jump Servers for security In my network, I have the clients directly connected to the server; but in the new PCI policies, they required to use jump servers.

What is the advantage of using jump servers for security reasons?
How can I use two-factor authentication with jump servers?
Why do jump server need virtual machines?

What is the advantage of using jump servers for security reasons?

Jump servers, or more accurately, bastion hosts, provide a segregation layer between the target network and the user. Consider a network with database servers, application servers, an HSM or NAE for PCI, and monitoring systems. Without a bastion host, this needs to be exposed for maintenance and monitoring of these systems. The bastion host provides an auditable layer for users to access these systems. It also provides a separation of duties. Devops will need to access the servers, but Marketing typically won't need access.

Look at this basic network diagram without a bastion host:

Any user on the network can access, and potentially attack, any server in that network. But by employing a bastion host, controls can be put in to place:

  How can I use two-factor authentication with jump servers?

Check out libpam and configuration with TOTP.

  Why do jump server need virtual machines?

They don't.


nmap output to file different than interactive output? I am running a simple SYN scan of all ports on all hosts that I found on a previous ping scan saved to a file: targets like this:

nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets

As the scan runs it shows results like:

Discovered open port 23/tcp on xxx.xxx.xx.xx

But when the scan is done and I check the output file: puzzling.txt, I find this:

# Nmap 6.49BETA5 scan initiated Sun Oct 11 13:46:11 2015 as: nmap -sS -p- -v -T5 -oN puzzling.txt -iL targets
Nmap scan report for something.net (xx.xxx.xx.x)
Host is up (0.16s latency).
Skipping host something.net (xx.xxx.xx.x) due to host timeout
Nmap scan report for something.net (xx.xxx.xx.x)
Host is up (0.17s latency).

no mention of the open ports found, and seen in the interactive output! What am I missing here?

You used the -T5 option, which according to the documentation does the following (emphasis mine):

  T5 does the equivalent of --max-rtt-timeout 300ms --min-rtt-timeout 50ms --initial-rtt-timeout 250ms --max-retries 2--host-timeout 15m as well as setting the maximum TCP scan delay to 5 ms.

The important point is that host timeout. That says, "If you spend more than 15 minutes on a host, stop and give up on that host without showing output." Several users have requested that Nmap show partial results in this case, but nobody has contributed code to do so.

You have a couple of options if you want to get output from these hosts:

Use a less-aggressive timing option. You could use -T4 which has no host timeout, or use -T5 and override the host timeout: --host-timeout 24h for example. There is not currently a way to turn off the host timeout entirely once a timing template sets it.
Scan less stuff. You are using -p - which scans 65535 ports. For a host on a LAN, that's not too much. But your output says the latency is 0.17s, which is slower than I get from the middle of the USA to London. It is reasonable to expect that hosts at that distance may drop a packet or several, leading to slower scan times.


What makes Random Number Generators so fragile? It seems to me that a hardware component which generates random numbers is extremely simple - just measure tiny vibrations in the hardware with a sensor, right? Maybe I'm wrong but it seems like if you measured vibrations with very high precision, you could easily generate unguessable random numbers.

However, I'm a cryptography noob, and know little. So I'm reading and an article says:

  and you just don’t need to be that sophisticated to weaken a random number generator. These generators are already surprisingly fragile, and it’s awfully difficult to detect when one is broken. Debian’s maintainers made this point beautifully back in 2008 when an errant code cleanup reduced the effective entropy of OpenSSL to just 16 bits. In fact, RNGs are so vulnerable that the challenge here is not weakening the RNG — any idiot with a keyboard can do that — it’s doing so without making the implementation trivially vulnerable to everyone else.

I'm surely missing some critical detail about how random number generation is "fragile". Can someone explain?

Hardware vs software RNGs
The first thing you mention is a hardware noise source. High-precision measurement of some metastable phenomenon is enough to generate unpredictable data. This can be done with a reverse-biased zener diode, with ring oscillators, with an ADC, or even with a Geiger counter. It can even be done my measuring nanosecond-level delays in the timing between keystrokes. These noise sources can fail if the hardware itself begins to fail. For example, a transistor can break down if it is not specifically designed to operate in reverse at high voltages. While these techniques have varying levels of fragility, it is not what is being discussed in the text you quoted.
The second type of RNG you mention is a software RNG called a pseudorandom number generator (PRNG*). This is an algorithm which takes a seed, which is like an encryption key, and expands it into an endless stream of data. It attempts to ensure that the data cannot be predicted, or told apart from pure randomness, without knowledge of the secret random seed that the algorithm started with. In this case, the PRNG is implemented in pure software, so breaking it only takes introducing a bug into the code, which is what the text you quoted is talking about. It is merely code that is fragile, risking complete failure if changes to the code are made that deviate from the algorithm's intended behavior.
A PRNG can be thought of as a re-purposed encryption algorithm. In fact, you can create a cryptographically secure PRNG by using a cipher like AES to encrypt a counter. As long as the encryption key (seed) is secret, the output cannot be predicted and the seed cannot be discovered. When you think about it this way, it becomes easier to understand how a small, inconsequential change in the code can completely break the security of the algorithm.
Collecting randomness
So how do modern devices actually collect randomness? Let's take a server running quietly in a datacenter somewhere. In order to support things like TLS, it needs a large amount of completely unpredictable data that cannot be distinguished from a truly random stream. Without a dedicated hardware noise source, the randomness must come from within. Computers strive to be fully deterministic, but they have plenty of input from non-deterministic devices. Enter... interrupts!
In modern hardware, an interrupt is a signal emitted by hardware to alert the CPU to a status change. It allows the CPU to avoid rapidly polling every hardware device for updates and instead trust that the device will asynchronously alert it when the time comes. When an interrupt occurs, an interrupt handler is called to process the signal. It turns out this handler is the perfect place to get randomness! When you measure the nanosecond-level timing of interrupts, you can quickly get a fair bit of randomness. This is because interrupts are triggered for all sorts of things, from packets arriving on the NIC to data being read from a hard drive. Some of these interrupt sources are highly non-deterministic, like a hard drive which relies on the physical motion of an actuator.
Once sufficient random bits have been collected by the operating system, a small seed of at least 128 bits can be fed into a cryptographically secure PRNG to generate an unlimited stream of pseudorandom data. Unless someone could predict exactly when every past interrupt occurred, to nanosecond precision, they will not be able to derive the seed and will not be able to predict future PRNG output. This makes the output completely suitable for TLS keys.
* A security-oriented PRNG is called a cryptographically-secure PRNG, or CSPRNG. Using a regular PRNG when an application calls for a CSPRNG can result in security vulnerabilities.


What packets I'm reciving when running nmap over proxychains? I am learning to use nmap. I am observing that most of the times when running a command like proxychains nmap -sT -PN -n -sV -p 80 XX.XX.XX.XX, I am getting the following output:

Starting Nmap 7.01 ( https://nmap.org ) at 2016-11-25 18:11 UTC
|S-chain|-<>-127.0.0.1:9050-<>-162.213.76.45:8080-<>-203.130.228.60:8080-<--timeout
Nmap scan report for XX.XX.XX.XX
Host is up (16s latency).
PORT   STATE  SERVICE VERSION
80/tcp closed http

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

What I can understand is that the server failed to connect to the third proxy.

What I do not understand is: Does that mean that nmap packets are going from the second proxy to the target directly or the proxychaining is failing entirely and nmap packets are sent directly from my pc and revealing my identity?

Note: I'm running the tor browser, and therefore routing my proxychains through the tor network.

It appears that your scan worked correctly through the TOR network. Based on the switches you used, nmap only sent a SYN to port 80 and your target responded with a RST.  The timeout from proxychains just means a SYN/ACK wasn't received from the target.


Securing a Windows PC Currently I have an "Antivirus" and Anti Malware software installed.
In addition I closed all remote assistance and unused port rules on my firewall.

I'd really like to get a complete as possible solution/guide.

I wanted to know if there is  a guide on further securing my machine.
Do you have any suggestions? (IDS? Firewall rules etc...)

Note: I am using Windows 7

Sorry but this view that Linux is by default more secure than Windows is wrong. Does GnuTLS mean anything to anyone? How about all of the issues in OpenSSL recently? Vulnerabilities affect Linux just as much as Windows. More so in some cases.

In general, as long as you are keeping your OS and applications patched, you are doing the first few things right. Anti-virus and anti-malware help too, as would a software firewall on the machine.

If you want to go into ultra paranoid mode, then have a look at something like Sophos UTM, or purchase a hardware firewall. Ensure that any ports you don't use are blocked both inbound and outbound.

Use something like Norton DNS so that you don't go to known phishing and Malware sites. Install NoScript in your browser and whitelist only sites you trust.

Ensure you have a sound backup strategy with redundant backups and off-site backups.

Just a few things off the top of my head, but this idea that Linux is inherently more secure than Windows is a myth


Can a Wordpress be hacked by accessing a PHP script on the same server? Our Wordpress website was hacked. I couldn't find anything intelligible from my limited experience from the limited logs my hosting gives. However, browsing in the FTP files I found a post.php file in the root and two more themes. Nothing strange in the DB, nor a new user. In the index I found the string "Silence is golden".

I spent my day reading about it and it seems one of the most classic WP attacks.

The server hosts a directory of the root where there is a form powered by AppGini, which relies on another DB and is loaded in an iframe in the Wordpress pages. This form is not password protected, however AppGini ships by default protection of MySQL injection.

In your opinion, could this form be the door to enter the WP installation? Is this technically possible? Or is it a 100% Wordpress attack, regardless of what is beside it?

the entry points for attacker can include: outdated - PHP, themes, plugins, weak passwords, misconfigured php.ini file that can lead to issues.
Please check if any of these have been overlooked.


Multiple user encryption-key store Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the  datastore upon application startup (and then the application will have access to the datastore until it terminates). I don't want any single admin to have the ability to unlock the datastore  himself, but I also don't want all of the admins to be required to do it (since they may not always be available) -- I'd like a certain subset of admins to be able to unlock the datastore by entering their credentials.

For example, if I have 5 administrators for the application, I might want any two or three of them to be able to enter their passphrase to unlock access to the datastore.

Is there some off-the-shelf software implementation for a system like this?

This seems similar to a bifurcated key, but instead of requiring both people to supply their half of the key, I'd like any specified subset of users to be able to unlock the key.

This sounds like a good task for Shamir's Secret Sharing, as Stephen pointed out in comments. One example of off-the-shelf software that can do this is Crypto++ (relevant docs: http://www.cryptopp.com/docs/ref/class_secret_sharing.html).


Should I be concerned about a very slow dictionary attack? I have installed fail2ban on my mail server, and the logs show 4-5 IPs regularly hitting my server at large intervals (so not often enough to trigger the fail2ban rules):

2017-10-04 06:29:04,705 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 92.xxx.xxx.11
2017-10-04 07:14:35,674 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 37.xxx.xxx.118
2017-10-04 08:01:29,732 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 37.xxx.xxx.118
2017-10-04 08:08:45,221 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 92.xxx.xxx.11
2017-10-04 08:48:00,802 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 37.xxx.xxx.118
2017-10-04 09:36:07,958 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 37.xxx.xxx.118
2017-10-04 09:48:59,830 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 92.xxx.xxx.11
2017-10-04 10:23:22,123 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 37.xxx.xxx.118
2017-10-04 11:12:03,283 fail2ban.filter         [1091]: INFO    [postfix-sasl] Found 37.xxx.xxx.118

The IPs are all VPS'es, belonging to Digital Ocean, OVH and the like. A back-of-the-envelope calculation shows that, if the attacker checks one password every 40 minutes, they'll exhaust a 10 000-word dictionary in a little less than a year. (Not that my passwords are dictionary words, mind you). I guess it can pay off if the attacker is hitting thousands of servers simultaneously.

Should I be concerned about this type of attacks?

Just block them by changing time interval in your jail rule.

bantime  = 10800 ;3 hours
findtime  = 86400 ;1 day
maxretry = 5

If an attacker fails 5 times in a day, he will be blocked for 3 hours or you can increase that number according to your wish.

Prevent as much as possible, before it will be to late.


Does TCP/IP expose critical infrastructure to added risk? Background:

I just attended a talk on the security of critical infrastructure. The speaker spoke a bit on how adding the TCP/IP protocol to functions usually taken care of by dedicated protocols open up some security holes.

The example he gave was the SS7 protocol for the telephone infrastructure. He gave figures (can't remember the exact numbers) on how adding TCP/IP functionality onto the protocol, SS7OIP, increased the number of threats against the telephone infrastructure. One of the reasons he stated was that it opened up the telephone network to the wider internet, and no longer required insider access to the SS7 network to perform attacks.

Question:

In the case of critical infrastructure - telephone, electricity, water to name a few, what does adding a TCP/IP layer accomplish?

Is the threat real? Does adding a TCP/IP layer expose such systems to significantly more risk?

If there is a real threat, is the added functionality (if any) worth the added risk?

TCP/IP is a best-effort protocol. It is very efficient at maintaining connectivity in adverse conditions (including use of nuclear weapons). It offers no guarantee of communication, but, when you come down to it, no system can (all communication systems involve using some kind of hardware, which may fail).

The problem with TCP/IP is not with TCP/IP itself, it is with the others ("Hell is other people"). One very interesting aspect of TCP/IP is that it is what the Internet runs on, so, if you do TCP/IP, you can easily use the Internet infrastructure, rather than having to build your own. A transoceanic cable is a bit expensive... so switching to TCP/IP is a cost-killer. Unfortunately, you are not alone on the Internet. If you use the Internet infrastructure for your communications, then, necessarily, you expose your communications to whoever roams on the Internet. As some security specialists like to say, you have "enlarged your attack surface". Cryptography (i.e. SSL) can help to keep your data confidential, but TCP/IP is such that denial-of-service are possible (if only by clogging the tubes).

So it is not really a question of TCP/IP or not. It is a matter of sharing the infrastructures, vs using dedicated links. For instance, the Internet2 is a TCP/IP-powered network which is separate from the mainstream Internet. Sharing infrastructure makes your more vulnerable -- but dedicated links cost a lot. Choose your poison: risking to see your communications disrupted, or not being able to communicate because you wanted dedicated links but could not afford them.

(In the Inca Empire at the beginning of the 16th century, there was a network of roads with dedicated lanes for messengers from the central power. Building dedicated lanes and guarding them -- trespassers could be beheaded -- was very expensive, but the Inca still found it worth the effort. Your question about TCP/IP is really the same situation, only with 400 years of additional technology.)


Can DNS servers log users requests for commercial use (e.g. track direct access to websites)? How does it work?

For example, could OpenDNS be tracking everything (source ip + requested url) and then selling it to who have the necessary information to correlate the ip addresses with people profiles (i.e. BigData Companies, DataBrokers, Social Networks, etc).

I'm pretty sure that ISPs could be doing that. They did with my contact information (sell without permission).

Or has OpenDNS received more than 50 millions in funding only to offer this service:

  In October 2009, OpenDNS began offering an Enterprise service, which
  includes malware protection, delegated administration and block page
  bypass, in addition reliable DNS and Web content filtering. - See more
  at:
  http://www.crunchbase.com/organization/opendns#sthash.nIyr147U.dpuf

Your browser handles what is sent to the DNS service. It should only send the domain name, not the path or parameters.

The DNS service depends on what you have set in your network settings. It might be OpenDNS or Google, but it might be handled by the DHCP server of your network. In that case the DNS server is probably the router. If the router does not know the ip address of that domain name, it has its own DNS server, probably from the ISP. If that DNS server has no knowledge of that domain, it goes up in the chain until it ends up by requesting the root DNS servers for the ip address of the domain.

Your browser keeps a cache of visited websites. It does not sent out a DNS request everytime you visit a website. The same goes for each DNS server - they all have their cache. Domain names have a TTL setting, which sets how long the domain name should be kept in cache before checking. This is normally 24 hours. So once every 24 hours, the domain name is checked for the proper ip address.

All in all, it looks like they won't be able to see what you do on the web, except that you have visited a particular website that day.


Virtual Box security I am using virtual box to run a secure machine. I am not fully confident in the hosts security. My assumptions are that of course the host can read the VM when the VM is running and that if the machine is not running and some one got into my computer ripping the VB image would not be useful if it was encrypted.

Is there a way to make the VM more secure while it is running?

Are there settings on the virtual machine that will make it more secure against the host machine?

Can I assume that the VM is secured so long as it is not running and using an encrypted home drive? ( Default Encrypted home Ubuntu 12.04 LTS settings )

Have you read the manual of virtual box? It provides a lot of guidance for securing VM.

http://www.virtualbox.org/manual/ch13.html

In addition, your questions are little bit vague. Could you explain more details on what you want to achieve?


Can using web-based protocol handlers for protocols such as mailto: links be dangerous in any way? My question is specifically about an option in Google Chrome under Settings > Site Settings > Handlers. I've read in the past that with desktop-based protocol handlers--such as Office Outlook or Thunderbird with mailto: links--an attacker could use a script to compromise Outlook, but can the same thing be said about web-based protocol handlers, such as Gmail? What about webcal: links and other protocols?

I'm trying to figure out if I should completely disable the option in Chrome for sites to ask me if they want to become protocol handlers, or if I should leave the setting alone.

Maybe. It's not any more dangerous than any Cross Site Scripting vulnerability that could already exist in the web-based software that the browser launches.
One distinction should be understood between command injection and argument injection.

Command Injection
In the desktop protocol handler context, command injection happens when the protocol handler is launched in a way that allows additional (and unexpected) applications to be launched in some piggybacked fashion.
Pseudo example:
path/to/executable --argument1"; also-run-this-unexpected-application"
It is the duty of the browser (and perhaps to some degree the OS) to safeguard against this type of attack. The registered protocol handler at path/to/executable isn't even able to prevent this from happening. A smart browser would typically use some underlying OS call that is bound to a single executable so that no type of malfeasance can ever call more than one underlying application. This means that anything in the command that comes after the protocol handler is always passed as argument(s). For this reason, most modern browsers are immune to this type of vulnerability in the context of desktop protocol handlers. Historically though, there have been browsers that were easily exploitable and would run a series of commands piggybacked onto a protocol handler.
This is just speculation, but I find it highly unlikely that any type of command injection is possible via web protocol handlers. This is especially so because the browser isn't even launching a third-party process - it only ever launches it's own process (a new tab).

Argument Injection
Argument injection happens when unexpected arguments are passed to the protocol handler. In the context of desktop protocol handlers, this can still be dangerous, as it could cause the protocol handler to behave in ways that are unintended by the application developers. For instance, one protocol handler application that was created using the QTWebEngine was exploitable because one of its command line arguments allowed you to specify the path to load its DLLs from, and that path could include a remote location (https://zero.lol/2019-05-22-fun-with-uri-handlers/).
Concerning web-based protocol handlers - this type of argument injection is not going to lead to any unexpected software being run on your machine. At worst, it could allow Cross Site Scripting, but that could already be present in those applications via plain old URLs.

In summary: Protocol handlers that lead to launching a web-based application are highly unlikely to be exploitable in such a way as to compromise the machine that they are used on. They could still be used to make the underlying web application (e.g. Gmail) behave in a way that is against your expectations (e.g. Sending SPAM to everyone in your contacts list), but only if the web application is written to allow these types of destructive behaviors to be done via URL arguments - and this is also highly unlikely.
Ultimately, this is up to each web-based application to safeguard against. If your bank's website registers a protocol handler that allows funds to be transferred via a single URL, expect it to be exploited. In a real-world scenario though, I would only be as concerned with allowing these types of protocol handlers to operate as I would allowing a given service provider access to my data that their service operates on (Do you trust that Gmail is safe to access all of your mail and to operate with the ability to control correspondence to and from your identity/email address? Do you trust your calendar app to host all of your scheduling information?)


How are files in file container (posibly in archive file) encrypted? I see advantage of using container in it that offer work with more files rather than with one but is there some advantage in encryption technique?I would like to know if it encrypt each single file in a container (or an archive) or is there some another technique used to encrypt it?I want create my own file container as a school project and add some features like encryption etc. therefore i would like to gain more complex overview firstly.

Both ways are possible:  encrypting the whole archive or encrypting each file in the archive. Encrypting each file separately is more flexible because this way each file could be encrypted with a different key if needed and each file could be extracted separately, i.e. no need to decrypt the whole archive to get a single file. It comes with a bit more overhead though.
From the security perspective both ways can provide sufficient protection of the content if properly implemented.


Why is openssl key length different from specified bytes I realize this is rudimentary question, but I can't seem to even google diagnose it. Why is openssl key length different from specified bytes? For example when I use the command:

openssl genrsa -out testKey 512

I produce a key within my testKey file with the message, "Generating RSA private key, 512 bit long modulus". However when I check the length of just the key portion within the file, it is only 424 characters long.

Why is that, and why is it not actually 512 characters long?

Is there a way to generate a RSA key via openssl with a specific length in mind, such as 512 characters? I realize that my misunderstanding may stem from my lack of knowledge of what the above command is actually doing, but I just need a push in the right direction.

You are generating an RSA private key with a 512 modulus. However, RSA needs quite some more elements to work (the wikipedia article is quite good here). Since this is not a question regarding RSA, I will not go into details and instead give you the command you are looking for.

In order to process the RSA private key and see what all is contained in this data, run the following command:

openssl rsa -noout -text -in testKey

The first block is your 512 bit private modulus.


Is it possible to sync up LMKs in two Thales PayShield 9000 instances> Basically, when we execute a generate key command such as A0 then we receive a key-under-lmk for future use. What if we have multiple HSMs in a high availability configuration? How would we make sure that all keys-under-LMK mean the same thing to all HSM instances?

The documentation I have doesn't cover this and I didn't find anything online about that particular model.

Yes, Will need to load same LMK in both HSMs in same LMK ID (Default is 00). Normally Thales payShield HSMs doesn't stores keys, if it has same LMK, it will create temporary keys when required and verified.


Is it possible to remote forward tcp through a free proxy I’m aware you can forward connection from a proxy server like this:

ssh -R 8080:localhost:80 public.example.com

But I’m curious if it’s possible to forward from a free proxy such as:

https://free-proxy-list.net

Seems unlikely to use the ssh option because I wouldn’t have access to the server. If so what would be a practical way?

If it's a remote HTTP proxy, SSH is not the tool for the job. SSH -D can open a local port to act as a SOCKSv4 or SOCKSv5 proxy, but this requires you to connect to a remote SSH server, not an open HTTP server. SSH -R or SSH -L also require the endpoint to offer SSH authentication so they won't work as plain HTTP proxies.

Proxychains is likely what you're after, or just configuring the browser to use the proxy (Firefox offers this for sure, not sure about other browsers).

SoCat or NetCat would work as 'dumb' proxys as they are effectively just tools for handling TCP connections and don't require authentication, but you may have to experiment with them through an HTTP proxy. Again, not likely the right tool for this.

@domen thanks for correcting me. Clearly wasn't thinking straight when I wrote the first version ;)


Anti-CSFR tokens and SQLi I follow a SQLi tool on github and recently saw a conversation between the developer and a user. The user had tried to inject and gotten some errors, in the requests there was a anti-csfr token. The developer then told the user that they didn't know what they were dealing with and closed the issue, because one, they were trying to force an incorrect database, and two, they had gotten the token. Now I'm not saying that the developer is wrong, I'm just curious.

If I'm correct, CSFR, and SQLi are two completely different vulnerabilities and do not correspond with one another. If you have a token that's all fine and dandy, but it's not going to help you with SQLi.

So my question is, what does an anti-CSFR token and SQLi have anything to do with one another, do they go hand in hand?

I'm pretty sure they don't, but I've been wrong before.

The only relation I see is that the server might abort if the CSRF token is invalid before running any SQL, so you would need to have the CSRF token to exploit an SQL injection vulnerability.

Of course this would only apply to requests that include CSRF validation, which is generally limited to POST requests, and if there's an SQL injection vulnerability in a POST request there's probably one in a GET request somewhere too.


Is it less secure to require password and phone on sign in? I'm concerned about the security of a system that requires its users to enter both their "email & password" and also their registered phone number which has to be verified upon each login.

To me this seems like just another point of failure for a social engineer to take advantage of. We have seen plenty of people who are willing to transfer accounts into their own names to commandeer two factor authentication.

Also, Is what I am describing two factor authentication still? Or is it something entirely different?

I am asking because my client is begging me to implement this strange authentication standard.

Any Links to the studies on this subject would be extremely useful. Thanks.

To clarify, every time you login these steps will be taken.

Enter Email.
Enter Password.
Enter Registered Phone Number.
Verify Phone Number. If you can't, the system logs you out.

Yes, this is two factor authentication, and it adds significant security.

  To me this seems like just another point of failure for a social engineer to take advantage of.

This is not adding another weak point. It is adding another layer of protection.

  We have seen plenty of people who are willing to transfer accounts into their own names to commandeer two factor authentication before.

It is not 100% perfect. Nothing is. But it is a big improvement over just using a single factor.

There are almost daily report of huge data breaches with passwords in plaintext all over pastebin. Attackers write scripts to automatically test these credentials against different services to steal valuable information. Do you think they will go through the trouble of attacking your site, when they will have to make a phone call to transfer a phone number they might not even have for every single account they want to breach? No.

I also suspect that in many countries, phone companis who just transfer a number like that without any verification could be held legally responsible. Again, just because a system has been broken under some circumstances does not mean it is completely useless.

  Also, Is what I am describing two factor authentication still? Or is it something entirely different?

Unless I am missing something, this is plain old 2FA. The password is something you know, the phone is something you have.

  To clarify, every time you login these steps will be taken. [...]

Some points here:

Make sure it is not possible to get the system to tell what phone number a user account is connected to.
Why do you have to reenter the phone number? That should already be stored in the database, right? (I am asuming each account is connected to a phone number, otherwise this is sort of pointless.)
You say that if you can't verify the phone number, the system logs you out. I would say that you should not be allowed to log in until you have verified the phone number.


What are the main security concerns for Enteprise Software running on internal networks? What do Enterprise Security teams test when they buy third party products, before they sign the check?

Presumably they have a standard despite the main protection being the firewall and IDS. Is there a standard of security they want their internal services to adhere to?

Specifically I'm asking about industrial management software, not software that stores or access personal data.

Data classification will largely drive the requirements. An enterprise will adopt a data classification system to help identify which systems need which protections.  We can assume your question applies to sensitive data.  Even then, different requirements apply depending on the source of that data and the classification.

Sometimes, outside forces dictate the requirements.  For example, due to the type of data we work with, we are audited every year by an outside party.  They require, among other things, that we pass scans by Nessus and AppDetectivePro.  So, to ensure we pass, we run those tools against systems in scope.

"Before you sign the check" is the time where an enterprise would make sure they have permission to do the required tests. For example, the contract might require the vendor to provide a test environment to run invasive application security scans.   The procurement process might require that these scans be allowed before the product is purchased.

Vendors can be asked for proof that they've complied with standards.  For example, vendors to the federal government must meet FedRAMP requirements.  Cloud vendors are judged against SOC 2 requirements.


MFA using PKI certificates I'm trying to set up a multi factor authentication using PKIs certificates.
A PKI infrastructure is ready to use and i'm planning to put these certificates on smart cards.
I was looking for a smart card reader and I came across this one :
https://www.amazon.ca/-/fr/Gemalto-Idbridge-CT30-USB-lecteur-carte/dp/B00G46Y7CG?language=en_CA
My question is : Do I need software to put certificates on my cards?
Thank you.

There is actually more to putting certificates on the card than just a software. You have two options when putting certificates on the card:

The private key is generated on the card alongside with the CSR that is sent to the CA for signing and the cert is then installed on the card. This is the preferred option for authentication certificates, the fact that the private key is on the chip and can't be extracted provides additional security.

The keystore is generated outside of the card (including private key) and the keystore is then pushed to the smart card (installed). This is the preferred option for private keys that may require archival (e.g Mail encryption certificates that you want to use to decrypt your old emails). Private key must be generated outside of the smartcard as the one generated on the card can't be extracted (for archival).

Usual process of getting certificates on the smart card consists of two steps:

Pre-personalisation (some vendors deliver blank cards that require this step on your side, others take care of it for you as a part of solution they're selling) of the card where:

the firmware is installed on the card (different cards allow different versions of the firmware, each with different functions and capabilities)
generation of the private keys (this is sometimes done as a part of personalisation
generation of the PIN/PUK and operator PIN (pin used to access the card for administration purposes like installation of the certificates, key generation and certificate removal)

Personalisation of the card, this step involves:

generation of the CSR (if key is stored on the card) or creation of the keystore (with the private key and CSR) if the private key can exist outside
issuance of the certificate
installation of the certificate or the keystore on the card
generation/change of the PIN may be part of this process

So your question is not only if you need a software for the installation of the certificates. Depending on the type of the card you have, you need to know if they are pre-personalised (do you need to install firmware on them or not) if yes which version of the firmware is required and how do you go about the installation. If the cards is pre-personalised by the vendor, then you most likely need vendor specific software to generate the key and CSR and install the certificate. On top of that you need a card reader/printer capable of writing to the card and its driver. From my experience the drivers provided by MS are often having trouble writing to the cards.
Considering that you are creating MFA system, the key should be generated on the card, you may consider automating the issuance process with your CA to make it one smooth operation.
You should also think about PIN encryption and how you are going to take care of that (the PIN on the card should be encrypted) and many more things.
Short answer to your question is: yes you need a software.


Securely decommissioning a dedicated server One of my dedicated hosting CentOS servers hit 12 years. I received an end-of-life notice on it, and I started receiving SMART errors as well. I guess it's time to let it go. But before I do, I'd like to try and securely erase any left-over information, even though the hosting company claims that the drive will be securely disposed of. However, it's never bad to be safe and take some precautions of your own.

I have erased a number of sensitive files using:

shred -uv filename

Is there a way to generally securely "nuke from orbit" the drive while the OS is running?

EDIT - OP feels original answer isn't up to SE standards. Left it below. Newer answer right here:

Two options for a full disk wipe. The first one takes advantage of disk drive controller secure erase capabilities, but not all drives have the capability and some BIOSes block the command. It's faster than the second option.

Have a look at hdparm: hdparm --security-erase <PWD> <device>
Check out wipe. You can fetch wipe with apt-get install wipe and wipe a disk with wipe /dev/sdb1.

Also, a lot of information here about clearing linux drives including sections on hdparm and wipe.

OLD Answer

Did you hit every part of the drive? What about swap files? What about /tmp directories? What about files that were already deleted? You really need to hit every byte deleted or not still on the drive not currently used by the OS. Then, what about bad sectors that the disk driver isolated automatically? You can no longer reach those, but a drive recovery service might be able to.

I wonder if you write a program that accesses the disk device drivers directly (/dev/disk0 on my machine) and overwrites it from there. It would be a relatively small bit of C code. The program would be read into RAM and run until the disk is wiped. However, the OS will no longer work after that, and definitely not after reboot. So, you only get to do this once.

The most paranoid agencies used to steamroll and now physically shred their disk drives. Sometimes people don't do what they promise they'll do.

How paranoid are you?


Where can I get security breach alerts? I've been following a mish-mash of Google News alerts as well as some 'security' influencers on Twitter, but have a feeling there's a more efficient way to deal with this out there...

If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer.

Copy-pasting again for easy reference:

Common Vulnerabilities and Exposures project (CVE)
http://seclists.org/fulldisclosure
http://packetstormsecurity.org/
http://www.securityfocus.com/bid/ (BugTraq)
http://www.exploit-db.com/

Various list above have feeds or subscription feature which you can subscribe to get the vulnerability information delivered right to your inbox.