Can you listen to your last GSM call recorded when calling back a user? My wife called a GSM/3G number abroad and the call was dropped. She called again and she could hear the whole conversation repeated with the other party but with blank period from her side of the conversation.

How can this explained?

The call originated from Saudi and terminated in Lebanon.

This looks like a bug.

Actually, regardless of whether there was interception or not, this is bug: when you spy on someone, you certainly don't want to make that person aware of the spying. But in this case, I'd rather incline towards a more mundane buffering issue.

In phone networks, especially mobile networks, audio data is split into individual packets which are then sent to the receiver and meant to be reassembled into due order. Various technologies are employed for the data transit and some (most) of them use buffering at some point. For audio data, it makes little sense to keep a packet for a long time, because the receiver, at one point, decides that it has waited for long enough and plays whatever was received, even if there are holes. That's the common characteristic of media data: there are latency constraints, so lost or late packets must be accommodated through interpolation. Thus, buffered packets will commonly be marked with a time stamp which allows for an expiry process.

I can imagine that a buffering systems may get it wrong with the time stamping under rare conditions, e.g. if the machine's clock was unduly reset at the same time. This may induce the effect observed by your wife.

(More generally, programming blunders are way more common than genuine spying. Thinking otherwise requires assuming that people working for spy agencies are utterly more competent than the rest of the IT industry, which is not plausible,
James Bond notwithstanding.)


Is it possible to prevent SSL stripping attack via DNSSEC or IPSEC? I am pondering about SSL Stripping attack. But is there any way to prevent this attack by DNSSEC or IPSEC?

DNSSec does only prevent SSL stripping if the man in the middle attack needed for the SSL stripping attack was done using DNS spoofing. If done the more common ways like ARP spoofing or DHCP spoofing or similar it does not prevent SSL stripping.

Similar IPSec does not prevent SSL stripping if the attacker is inside the same with IPSec protected network, i.e. using a system which is part of the network. It will only prevent SSL stripping if the attacker is not part of the IPSec network and only can see the already encrypted (with IPSec) traffic.


Passwords In Securing Network Devices I don't do anything with corporate IT and networking, but I know enough to handle and get networks going.  Anyway, something I ran into in my travels when it comes to the occasions of working on individual computers and small networks when I do is the matter of securing devices which have Internet or wireless exposure.

I'm a complete novice in these matters and what is best, so I thought I would do some reading and got some basic ideas of good security practices, but still came up with some questions that weren't really answered solidly:

What are the rules for entering WPA-style passwords in most devices?  Could you get away with any standard printable character in these devices or are there some restrictions (hex-strings, some characters not allowed)?  I really don't find any good documentation on this.
Are there any good set rules for what makes a good "strong" password in terms of entropy?  I found sites like http://www.passwordmeter.com/ which seem to be a good benchmark, but I really haven't found any good rules which qualify something as an "ideal strong password" in an universal sense.  There's the random printable character method and then the xkcd method, too.
Since I figure in most cases, all that will happen with these devices after the fact is that people (primarily myself with my own stuff, but others too, think home network stuff) will use the Internet directly or their laptops in order to connect to the Internet, the password doesn't necessarily have to be easy to remember and readily reproduced, so my thought is that any password these devices are set to can be printed out or written down and stored away just in case there is a need to get back into these devices after they are set up.    Does this seem smart, or is there something I'm missing?
Given that I'm more inclined towards programming than networking overall in my experiences, I came up with a password generator, which currently just does random printable characters of certain lengths with a few rules.   Are there any suggestions on what to do to make the output of this program "gold standard"?

I could be overthinking the password issue entirely, but the thing I notice which is common to all these cases is that they are devices which generally won't have any attention paid to them as long as they are working properly (basically home use - as long as it gets me on the Internet I'm happy).  In that way, I'm wanting to learn how to make something I deal with relatively bomb-proof when it comes to anyone who might want to access it and am not entirely clear on the password end of it.

To quickly answer these:

Mostly no limits, assuming we're talking about WPA2. The password goes through a key-derivation algorithm, so the key is a fixed size regardless of password lengths. Some device vendors may put soft limits on their control panels, but these are usually pretty lax. I'd avoid unicode characters though, since they're not always identical in terms of encoding across different systems.
As long as your password is complex enough and long enough, it'll prevent the WPA2 key from being cracked. What "enough" is depends on your security requirements, but for home use I'd say 12 characters a-z A-Z 0-9 (3.22×1021 keyspace) should be more than enough, as long as it's reasonably random. You're highly unlikely to come across attackers that use complex statistical analysis to test "likely" human-random passwords first - most aren't going to be doing anything more than a dictionary attack.
Standard practice in most corporate environments is to store paper copies of mission-critical credentials in a safe. If you wish to store such backups, invest in physical security. Your desk drawer isn't actually particularly secure, but it's in your house and your house has locks. Are you really worried about attackers that break into your house to steal your wifi password?
Don't bother. For a start, there are hundreds of password generators out there that already do this; keepass has a good one. Most importantly, you don't really need to worry about cryptographically strong random passwords - just pick something "random" manually, or use an existing generator if you're paranoid. There's no need to do anything more unless you're protecting mission-critical data.

All in all, it sounds like you're overthinking it. Your main threat is dictionary attacks, which you can thwart by not using any common passwords or dictionary words.


How to securely derive a second password specific to an user I'm giving each of my users an unique Blocktrail wallet that is protected by two API keys (which the server knows) and one passphrase (unique to each wallet).

I want the wallet's passphrase to be unavailable to anyone but the logged-in user (session persistent), so that nobody, even server administrators, can look at the wallet's password and make transactions from the wallet.

I'm already encrypting user account passwords with bcrypt.

This is what I would ideally like to implement:

A passphrase that only a logged in user "has access" to. (Not directly, but through their session).
That the passphrase is available for when the user decides to make a
transaction from within the client UI (the passphrase is needed in
order to make transactions), but that the user isn't required to type
in a second password or type in their account's password every time.
That nobody is able to know what the passphrase is for any specific
user, not server admins looking at databases/server sessions, not hackers breaking
into the server and writing scripts that leak the passphrase, not
myself.

Is this possible at all? My guess is that I'd have to somehow derive a hash, perhaps, of the user password before encrypting it with bcrypt, use that as the passphrase and store that in the session, or probably in a cookie (with additional security?). But then again, administrators sneak-peaking at the server can look at whatever is stored in each session, retrieve the passphrase, and steal the bitcoins, right? And also, I think that storing a hashed password client side wouldn't be such a good idea.

I'm really new to security, so I have no clue as to what would be the best approach for this. Or perhaps I am being too paranoid, and should just use the bcrypted password or a random string (stored in a database) as the wallet's passphrase? (Considering two API keys are also required).

I'm just looking for a hint in the right direction, since I don't even know if what I want is even achievable. Thanks.

I want the wallet's passphrase to be unavailable to anyone but the logged-in user (session persistent), so that nobody, even server administrators, can look at the wallet's password and make transactions from the wallet.

That nobody is able to know what the passphrase is for any specific user, not server admins looking at databases/server sessions, not hackers breaking into the server and writing scripts that leak the passphrase, not myself.

While you can protect this against storage, an Administrator can put in some extra logging to capture this information. There's nothing you can do about that, except store the secret on the Client as @Ethan suggested. (which could be better or worse for security depending on who your clients are)
I'm going to answer with the assumption that you decided that the server needs access to the secret directly. (in which case also storing on the client would be pointless)
You can prevent plain storage server-side, assuming no malicious logging has been installed.

I'm already encrypting user account passwords with bcrypt.

Encryption is reversible with the key. Hashes are one-way. BCrypt is a hash, not encryption. (and that's a good thing)
Make sure you have a strong work factor. It should take at least 100ms (with appropriate DoS protection) to calculate the BCrypt hash. Note that attacker's hardware (should the hash be stolen) will probably calculate these hashes much more quickly when they try to brute-force.

A passphrase that only a logged in user "has access" to. (Not directly, but through their session).

When the user logs in, the server will have the information needed to decrypt the secret.

isn't required to type in a second password or type in their account's password every time.

There is going to be some password that decrypts the secret initially. This can either be the first password they use to log in, or a 'special' password if you prefer. After that, the secret will be continuously available as a part of the login session.

Is this possible at all?

Good question. The answer is Yes, I've outlined how this can be done in the below question. Basically you just need to derive encryption keys from the user's password, and then from the session token. Both of these should be hashed (not just the password) so that the attacker cannot access the original text from which the encryption key was derived. The Session Token should have enough entropy so that you can use a Fast Hash.
Once you have the encryption key management worked out, you can just store the encrypted secret on the server.
How can we serve sensitive encrypted data without storing the key? Should I use user-defined passwords for keys?
Except, in your case, instead of serving the encrypted data, you'll just be using it internally on the server.
Please read this over, and post a new question or comment if you don't understand how it can apply to your situation.
And of course, make sure your application is secure from attackers (non-admins) to begin with. That is the most important thing.


Can a querystring in a URL be protected from sniffing without HTTPS? I was using wireshark and expecting to see a JSESSIONID in a HTTP request, but it did not seem to be there for HTTP requests. I could see my own JSESSIONID however. Would upgrade-insecure-requests help protect a query string form sniffing?

I was using wireshark and expecting to see a JSESSIONID in a HTTP
  request, but it did not seem to be there for HTTP requests. I could
  see my own JSESSIONID however.

JSESSIONID is a cookie that is usually flagged with the "secure" and "no script" flags. The "secure" flag tells compliant browsers to not send that cookie over HTTP, only HTTPS.

  Would upgrade-insecure-requests help protect a query string form sniffing?

The HTTP Upgrade-Insecure-Requests request header sends a signal to the server expressing the client’s preference for an encrypted and authenticated response... more: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests

If the server receives the request with Upgrade-Insecure-Requests: 1 it can redirect the client that expressed the preference for secure requests to the HTTPS version of the site.

IN GENERAL:

Query string is part of the URL in the request. The URL appears in the request line of the HTTP request:

GET /some/url?a=b HTTP/1.1

To protect it from sniffing you need SSL/TLS that establishes a secure TCP session before sending data and then encrypts the communication/data.


Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number for what seems like 1 second for it to be entered.

At first this seems pretty nice, you don't have keyboard strokes to record, nor mouse clicks. Yet, I have the uncanny impression that there might be a problem with this system. The obvious one is that you are only allowed to put numbers in your password, would there be anything else?

These kinds of password entry systems are only good as long as the attackers do not adapt. It is a play in several acts:

Bank Web sites use passwords which are entered the traditional way, with a keyboard.
Key loggers appear, and harvest key strokes.
After some cases of actual bank password theft, banks adapt. They implement "visual keyboards" in which the user clicks on some buttons which are labeled with letters or digits.
After some time, attackers adapt. New-generation key loggers also record mouse click coordinates. These coordinates are sufficient to recompute the password.
After some time, banks adapt. They now "shuffle" the labeled buttons so that they do not always show up on the same emplacement on the screen. Mouse click coordinates are no longer sufficient to recompute the password.
After some time, attackers adapt. Next generation key loggers now take local screen shots, recording the pixels which are around the point where the user clicked. The screen shots are sufficient to recompute the password.
After some time, banks adapt. Instead of clicks, the bank's Web site will react to some "hovering" without an actual click. The current key logger generation does not record "hovering", only clicks, so they are defeated.

As you observe, we are currently at that point. Can you guess what is going to happen ?

This is an arms race. The attackers force the banks to apply more convoluted password entry methods. The banks train attackers into defeating increasingly "secure" password entry methods. Simultaneously, banks try to train their customers into dealing with more complex password entry methods. In the long term, my bet is that attackers will evolve faster than customers; the banks fight a losing battle.


Can 2FA / MFA be secure & functional in a purely offline state (PWA)? I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other stuff.

The idea has been proposed to add 2FA to the offline login to make it "more secure". However, my (limited) understanding of MFA tells me that I'd have to store the 2FA secret key locally, and this code could be retrieved and probably be used to reverse engineer the auth code, making the whole thing moot.

(For the sake of argument, let's pretend this isn't JavaScript and a malicious actor can't just "skip" past my login process to access the app offline without logging in.)

Am I correct in my assumption that this is a dead-end? Or is there a way to do 2FA purely offline in a secure manner? Is there a better way to approach this?

Authentication against a local JS application does not work. I wrote a detailed answer on this topic before. The crux of the argument is that an attacker is in complete control over the mechanism that performs the authentication, and is therefore able to always authenticate themselves successfully.

  What about Multi-Factor Authentication?

It will not fare any better. Imagine a simple scenario, in which your application would send an SMS token to your user, once they entered the correct password. An attacker can simply read out which value is expected, and enter that value.

  But what if an attacker would not be able to skip past my login?

That's the problem. In any even remotely realistic scenario, you don't get to tell the attacker how they can attack your application.

An offline JavaScript application can't securely authenticate a user, because the attacker is completely in charge of the authentication process.


Certificate Practice Statement (CPS) without CP (Certificate Policy)? This previous question discussed differences between a CP and CPS.

According to the RFC:

  The main differences between CPs and CPSs can therefore be summarized
  as follows:

  (a) A PKI uses a CP to establish requirements that state what
         participants within it must do.  A single CA or organization can
         use a CPS to disclose how it meets the requirements of a CP or
         how it implements its practices and controls.

As such, a CP sets requirements and a CPS is demonstrates how these requirements are met. Certificates have CPs specified as OIDs in the proper certificate extension. Every CP should have a CPS demonstrating how the CA satisfies a particular CP. Also, according to the RFC, CPs are basis for third-party CA audits.

Given all this, does it make any sense to have a CPS and no CP?

This question when building an internal PKI. A natural step is writing a CPS, but reading the RFC leads to realization that the CPS is basically demonstrating CP enforcement. Is a CP needed?

Your other question seems to suggest that a CA writes the CP, but this isn't the case.

A CP is written by the authority responsible for the PKI as a whole - usually called the PKI Management Authority (PMA).  It is the PMA that owns the trust relationships between the entities within the PKI and it is the PMA which therefore does everything it can to ensure that trust isn't lost.  As part of this it sets down rules (policies) which any Certification Authority has to follow if it is to be part of the PKI.

Once the PMA has written the CP, any Certification Authorities that hopes to issue certificates on behalf of that PMA must design the CA in line with the CP.  Once that's done it must write a Certification Practice Statement that demonstrates how it is following the CP.  Note that a well written CP will have audit policies that allow CAs to be checked for amongst other things, CP compliance.

A CPS without a CP is pointless.  Without a CP the content of the CPS could be absolutely anything and it wouldn't be breaking any policies.

For example, section 6.2 covers the protection of private keys.  Without a CP your CPS could say something to the effect of:

  the Root CA private key is held on a USB stick stored in the stationary cupboard

The statement is irresponsible; but it doesn't break any laws, or policies.

However, if your management deem the above unacceptable and that the private key should be stored in a FIPS-140-2 Level 3 Hardware Security Module, then that what should be in section 6.2 of your CP.  Once that's there, the previous CPS statement breaks policy and isn't acceptable.  Attempting to submit a CPS with the above statement would result in rejection by the PMA and consequently the CA wouldn't be allowed to join the PKI.

It may be tempting to only write a CPS and submit it for review by either peers or management.

If your CPS is returned without any comments and accepted, you have to ask yourself whether the reviewers know their subject, or whether you've over engineered your CA thereby wasting time and money.

If your CPS is returned with comments (maybe suggesting how the private key should be stored amongst other things?) then these comments are the beginning of a CP.  However, instead of many iterations of this review process and maybe heated discussions/arguments/firings, it would be much simpler if a senior authority (the PMA?) writes down the rules of running the PKI which all CAs must follow.  In the long run, a CP will make the process of writing a CPS much simpler - after all, all the subjects need to be discussed at some point, so do it before designing your CA.

Finally, remember that there is only one CP covering all the authorities (CAs, RAs, VAs) in the PKI. Each CA (and possibly RA and VA if they're separate entities to the CA) writes a CPS to state how they're following policies.

As a minimum, Acme Inc will have a single Acme CP (written by the PMA), followed by the Acme Root CA CPS (written by the operators of the Root CA) and the Acme Issuing CA CPS (written by the Issuing CA operators).


How can I keep track of the packages to check any strange behaviour I've just realized there was a girl that asked someone to hack my computer and also my telephone (that's why WhatsApp was working strange). Right now I'm trying to protect myself at least on my computer. I'm trying to keep track of my network to understand any pattern despite the common packages like launchd, spotify and mac updates, etc.
The reason I'm doing this is because I have a youtube channel and I don't want to have problems with my account or she boycotting my work. This might sound very childish and it is, so I apologize in advance.

The computer I'm using is a Macbook, I have the firewall activated, my computer with a username and password, but when I scan the ports and only scan the first 1000 and return only http is open. I'm also trying to configure the share options as I've never use them. Also I tried to install Snort on my computer but I couldn't, so I only use Etthercap (wireshark) to see about the packages (because netstat is not working properly). I understand Wireshark has a lot of features but that's something I will have to learn.

Anyway if someone could advice me with Snort, Suricata, Wireshark or any general advice I will really appreciate it. Thanks!

As far as setting up SNORT goes, here is a video I found on Youtube that may be helpful (it appears to be difficult to set up):
https://www.youtube.com/watch?v=_ic07nBoweg

It appears you would want to at least practice good computer security to make being hacked more difficult.  As far as tracking packages, I am not aware of what the best solution is, but it sounds like what you are looking for would be an Intrusion Detection System, and/or a file integrity checker.  For your situation, I would especially recommend "good computer security" to include at least the following:

Make sure you have a firewall turned on.  Note: you can also configure your firewall to be more secure, but do your research here first if you choose to do so because this can be tricky and can "break" things if you are not careful.  It appears you have already done this.
Make sure you have antivirus software installed and updated and set to update itself, and run a full scan.  Set up a periodic scan schedule if it is not already set up.
Change your passwords (in case you have already been hacked), and change them to long passwords (harder to hack).  Adding numbers and special characters to your passwords helps make them harder to hack too (although some sites don't seem to deal well with special characters in passwords).
Keep your programs up to date (especially internet browsers).  Vendors continue to patch security holes that hackers can use as they are found.
Keep backups of your files (e.g. on an external hard drive).
In e-mail, don't follow links or download attachments unless you know who they are from, and you need to do so.  Verify "urgent situations" with the actual place of business.
Here is an example of a phishing attempt and how to avoid it: an attacker pretending to be your bank sends you an e-mail that says they are going to close your account unless you go to the link and "verify your account".  Do NOT follow the link.  You should first verify that it really came from the place of business (e.g. visit your bank and make sure they really sent that).  Furthermore, in this example, you should report it to the bank as a phishing e-mail once they verify that they did not send it.  Usually, e-mails like that are from scammers / hackers, etc... and you should not do what they say.

There are many more things you can do to increase your security, but this list is a good start (e.g. fairly easy and adds considerable security).


SSH Version Scan Unsuccessful for Windows XP SP2 I was trying to scan the SSH version for Windows XP using "Scanner SSH Auxiliary Module" in the metasploit framework. However, there was no error while scanning but it couldn't identify the version as shown here.

Same happens with ftp_version scanner, but it works fine for smb_version scan.
Initially, I thought it was due to Windows update (which may have installed accidently) but I installed it again and the result was same (also tried different setup of Windows XP). The virtual lab setup is done using VirtualBox and I have made sure that Windows firewall and update both are off.
Is it possible that it is not able to scan due to patch file which maybe pre-installed for these scanners (as SMB was working)? If it is pre-installed patch is there any way to remove it or any link where I can purchase default Windows XP SP2 (where these scanners work)?
What is the reason behind it?
The scanner works fine with Metasploitable2.
Any help would be appreciated.

TL; DR

Windows does not come with SSH by default so unless you (or someone else) installed it, you won't get results.

If you have installed an SSH daemon on the box (for some reason), try to identify the version with nmap instead. The banner grabbing in nmap is likely more accurate anyway.

nmap -sV -p 22 <<host-ip>>

Assuming the SSH daemon is listening on 22. Adjust the port number if needed.

  Is it possible that it is not able to scan due to patch file which
  maybe pre-installed for these scanners (as SMB was working)?

There is no way to patch against a port scan. And blocking access to the port would prohibit normal operation so that's not an option either. If there is no firewall between the Kali host and the XP box, then Application or OS level IP whitelisting would be the defense.

  If it is pre-installed patch is there any way to remove it or any link
  where I can purchase default Windows XP SP2 (where these scanners
  work)?

Again, this probably isn't the issue. It's most likely because there is no SSH daemon installed on the host.


SQL injection with filtered column names I have the following MySQL query susceptible to an injection and I need to extract the password of a given user:

SELECT * FROM users WHERE login='$login' and password='$password'

However from the injection, I can see that before the request is posted, the fields $login and $password are filtered. In particular, the PHP scripts detects "OR" being used in the following injection:

login => ' || ''='
password => ' || login='bobby' && passwORd LIKE 'A%'
SELECT * FROM users WHERE login='' || ''='' && password='' || login='bobby' && passwORd LIKE 'A%''

The "OR" appearing in $password is detected, and the injection fails.

Is there any known way to bypass this?

You don't need to inject into the $password variable. Just comment out the rest of the query with the $login variable. Setting $login to bobby' -- will give you this query:

SELECT * FROM users WHERE login='bobby' -- ' and password='foobar'


What makes an Android application vulnerable to Directory Traversal? Definition of Directory Traversal

Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root directory. If the attempt is successful, the hacker can view restricted files or even execute commands on the server.

How Directory Traversal impacts the Android O.S

Directory Traversal within Android, allows attackers to perpetrate a path traversal attack in the context of a user application and read/write files inside internal storage.

Android Directory Traversal attack Example

App Name:

ES File Explorer v3.2.4.1 - Path Traversal Vulnerability

Product & Service Introduction:

ES File Explorer is a free all-in-one including a file manager & application & tasks,
support for online storage spaces (Dropbox, Google Drive, SkyDrive, Box.net, Sugarsync, Yandex, Amazon S3),

CVE-ID:

CVE-2015-1876

References (Source):

http://www.vulnerability-lab.com/get_content.php?id=1435

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1876

Technical Details & Description:

A Path Traveral web vulnerability has been discovered in the official in the official ES File Explorer v3.2.4.1 mobile android web-application.
The security vulnerability allows a remote attacker to unauthorized request local files and device system paths to compromise the application or device.

The vulnerability is located in the content://com.estrongs.files/system/ path request with the  context. The vulnerability can be exploited by
local or remote attackers without user interaction. The attacker needs to replace the sdcard path request in the com.estrongs.files/system with a
malicious path request like ./etc/passwd ./etc/hosts and continues the request. The attack vector is located on the application-side of the service
and the request is http.

My Question

Although I understand what Directory Traversal is and how Directory Traversal can take place. I don't know what factors makes a selection of Android code vulnerable to such an attack.

The generic answer for "is my code vulnerable to directory traversal?" is to ask yourself if your code:

Uses filename strings that you got from an untrusted source to read/write files on disk? "Untrusted sources" could be direct user input, things you read from files (which could have been tampered with), or from 3rd party code that your code interacts with.
If you answered 'yes' to (1), then what happens if instead of "filename.txt", you enter the string "../someOtherDir/secret.txt" (assuming this file exists)? Will the program reject it as a malicious file access, or will it happily open this file?

This kind of traversal works because unix-like environments will accept /tmp/../etc/passwds as a valid path for /etc/passwds.

Mitigation

Mitigating against Directory Traversal Attacks usually involves making sure that if you allow filenames from untrusted sources, that you restrict those file accesses to a single directory. AFAIK there's no single best way to do this, but some things to think about are:

If you are only allowing the user to specify a filename (not a folder or path) then simply reject any filename strings that contain the '/' or '\' characters. Just silently drop that request. Better is to look up the list of legal file name characters on your OS (Android in this case) and reject any string that contains a non-legal character.
If all the files that you are allowing the user access to are in /publicDir, then before you open a file with the untrusted string, make sure that the file pointed at is actually inside /publicDir. This sounds obvious, but turns out to be really tricky to get right since there are many ways to construct malicious paths, for example: "/publicDir/../etc/passwds" will fool many naive checks. So I wouldn't advise this option.

A final note is not to get into the game of "cleaning" user input, just reject it. For example, a common thing programmers like to do is to remove dangerous characters and attempt to process the request on the "cleaned" string. Don't do this. If they gave you a bad string, just reject it and let them try again. I have two reasons for this:

If the user asked you to open "../../../etc/passwd", that wasn't a typo, they didn't mean "passwd.txt", they're being an asshat. Just ignore it.
As soon as you write a function to clean strings, the game becomes to pass in a string which your cleaner with make malicious. The more complicated your string cleaner gets, the more room there is to abuse it.

So don't play the game, if it look suspicious, just reject it. I personally use mitigation option #1: rather than trying to guess which characters could be malicious, I just reject anything that contains a character other than letters, numbers, and '.'


Do hackers still use iterative password cracking techniques? It's World Password Day! Rejoice, for today is the day that all of our  friends will change their passwords from abc123 to 123abc!!! While we're on the topic of passwords, one thing websites do to encourage (well, force) a more secure password is to require that users create a password that typically includes at least:

one lowercase letter,
one uppercase letter,
one number and sometimes,
one symbol (!@#$%^&*)

But with so many websites that lock you out on the fifth attempt (sometimes third -_-), how are hackers able to figure out your password using the brute-force, iterative method (looping through a set of the most common passwords, then letter/number combinations, etc)? It seems like the requirements to make the password more complex are pointless becuase a hacker will rarely get more than five attempts before being locked out. So while people who have the typical password for their password will be easily hacked because it's the most commonly used password, having a password like fartbubbles is not likely to be discovered. Or is it?

As an insignificant addendum, I am not versed in digital security in the slightest so feel free to point out anything I say that is dumb and correct me on it. And laugh :]

To directly answer the question

  how are hackers able to figure out your password using the
  brute-force, iterative method

Generally, breaking a password using 'mass-testing' is done offline. To do this, an attacker recovers a stored password (which is usually hashed) and tries to break the storage security. There is a number of methods that can used for this, depending on how the password is secured (Hash cracking, Rainbow table)

To put it more plainly, if an attacker has a method of testing a password offline, then the lockouts websites offer are ineffective.

An implication of this, as pointed out by Trey, is that if a password is re-used, then an attacker only needs to find the easiest recovery method, and then the attacker has access to any places that password was used. If a site stores a password in plaintext, and it's then recovered, anywhere that password is subsequently used can be considered compromised, regardless of security measures.


Hacked: Can a UTF-8 encoded script execute non-UTF-8 characters? To be honest, I'm not really sure the best title for this question, or the full scope of it, but the motivation behind it is:

Motivation

Assume your server was hacked, you open up your UTF-8 encoded php script and you find a block or lines of characters that mean nothing to you mostly mapping in the UTF-8 char set to "????????????? hacker.ru"

I'm trying to get a grasp on what this could be and do:

Thoughts I'm considering

Perhaps the text editor selected font doesn’t support those chars?
Perhaps those chars were copied and pasted from non UTF-8 into the UTF-8 document

Crude Example:

non-UTF-8 binary 1111->A
UTF-8 binary 1111->B
Effectively copying bits that don’t map properly

Is there a way to properly display those chars?
This is my priority question about these characters Can I assume that these non-mapping chars do nothing? (i.e., they don’t execute aka do damage)
Are programming languages multi-lingual?

Can I write php in russain?
Can i write php in english and russian in the same file?

Assumption: if I or anyone opens a UTF-8 encoded file and type into it, in any language or chars it will properly map them and display properly.

Can anyone shine some light on this subject?

In short, the answer is yes to the use of UTF-8 characters in an attack chain. There are a few cases that have crossed my path. What I have read about this method of attack, is that this it is the last step to "drop shell" on an attack chain into a native system. With a quick "Google", this article came up.

  "Using UTF-8 Encoding to Bypass Validation Logic"

The article goes on to explain exactly how this particular method is used. Here's the executive summary.

  "This attack is a specific variation on leveraging alternate encodings to bypass validation logic. This attack leverages the possibility to encode potentially harmful input in UTF-8 and submit it to applications not expecting or effective at validating this encoding standard making input filtering difficult. UTF-8 (8-bit UCS/Unicode Transformation Format) is a variable-length character encoding for Unicode. Legal UTF-8 characters are one to four bytes long. However, early version of the UTF-8 specification got some entries wrong (in some cases it permitted overlong characters). UTF-8 encoders are supposed to use the "shortest possible" encoding, but naive decoders may accept encodings that are longer than necessary. According to the RFC 3629, a particularly subtle form of this attack can be carried out against a parser which performs security-critical validity checks against the UTF-8 encoded form of its input, but interprets certain illegal octet sequences as characters."

This subject has come up before, although the use case is unavailable during this writing. If It's found later, it will be added as a comment.

What is remembered, was a attack chain method that had gained entry to a native system and sat dormat. When entry was gained through the firewall, access further was denied. The program then transformed to a UTF-8 file until a time when it could gain access past the security software. Once the hole was opened, because of character bit coding, the python program was able to open a command prompt, or "drop shell". The attacker then had full access to the root. It then opened a gateway for another part of the program laying in wait.

It's very similar to the study "Using UTF-8 Encoding to Bypass Validation Logic" in the way it masks itself and becomes unreadable to the security software. The methods of attack are very similar.

  Methods of Attack
   1. Injection
   2. Protocol Manipulation
   3. API Abuse

In the case I had read before, the objective of the program was to penetrate as deep as possible. If blocked, if else, transforms to a UTF-8 and perform attacks in that prescribed matter. If successful, open a gateway to another part of the malware laying farther down the attack chain.

Got to say, it's interesting to think about. The way I see it, if you can write code that is able to outperform the limited scope of another system, you will have success in the attack. If the defending code has constraints and the attacking code has choices and options that were never programmed into the scope of the defender, then it's an obvious loss. Especially, when you can have an AI or machine learning attacker.

Attribute to the CAPEC Content Team,    The MITRE Corporation   2014-06-23  Internal_CAPEC_Team for the article.


Full isolation of a honeypot on a single Internet line? What happens when you swap a modem and router out with a different modem and router?

Can you achieve full isolation by alternating between which network is plugged into the Internet line?

I am looking for full isolation of a honeypot computer while protecting a secure personal computer. I have a single DSL internet line.

It would look like this:

--Internet-- modem A - router A - secure computer

             modem B - router B - honeypot computer

If I change the cable back and forth between network A and network B, is there ANY way of the honeypot and/or an attacker influencing network A's modem, router, or secure computer?

By swapping modem and router:

Does your internet line IP address change?

Does it appear to the Internet as though you have an entirely different DSL Internet line running to your house?

Could an attacker, that has entered the honeypot on network B still see the network A after I unplug network B and connect network A back to the Internet?

Are there ports that an attacker could use on network A if said attacker has compromised the honeypot network?

I agree with @schroeder. This sounds like a really bad idea.

If you keep modem and computer A physically separated from modem and computer B and only ever have one or the other connected, never both at the same time, then they can't influence each other.

HOWEVER: If you are running a honeypot on your home IP, even if it changes when you unplug your modems, chances are that it won't change by much (you might be on a small ip pool, depending on your ISP). It's entirely possible that Honeypot and secure PC will be reachable via the same IP, though of course not at the same time. And even if not, they'll be on the same subnet. Attackers regularly scan subnets, and if they find a gold mine (well, a honeypot really), and then lose access to it because you unplug and plug in your secure modem/pc, then they might scan the subnet to find it again. Which means that you're drawing unwanted attention to a) lots of other customers of your ISP and b) your secure installation. Depending on how well you set up your honeypot, attackers may also manage to start sending spam or turn your honeypot into a botnet zombie, which would then get the IP added to all kinds of black lists.

If you really want to experiment with a honeypot, get an ec2 instance at amazon or a digital ocean instance (or any other cloud server). Check their terms of service to make sure they're ok with you drawing malicious traffic. This way you're not burning your ISP's dhcp pool.

I like this quote from a Patrick Rothfuss book: The protagonist is asked whether he knows the 3 basic rules of working in this very dangerous chemistry lab, and the third rule is: Eat elsewhere.

Or more bluntly: Don't **** in your own backyard.


nmap scan explanation for open port & services I recently scanned my router domain and get this result:

What I get from that report is 3 of 1000 tested ports are open.
But what to do with "telnet" and "BusyBox telnetd" also "ISC BIND Hostmaster"?
Does that port need to open?
How to close it? My router has no port filter.

In my experience, you have to treat the SERVICE and VERSION fields of those reports with a large grain of salt. Often the tool is just looking up the port number in a table; indeed port 23 is listed as the default TELNET port (see wikipedia/List_of_TCP_and_UDP_port_numbers). So your nmap scan means that something is listening on 23, and it may or may not be TELNET.
Nmap supports a mode called "version detection" in which it will actually start the opening handshake of known protocols to try to determine what protocol is listening. This can be very slow, for example if it knows about 100 different protocols and is scanning 1,000 ports, then that's 100*1,000 = 100,000 handshakes to try. So this option is off by default. You can turn it on with -sV. You can read more in the nmap man page; ctrl+f for "version detection".


Can we just provide VM snapshopts to LEA Currently Law enforcement agencies (LEA) take your entire server (or perhaps all servers) in a VPS/Cloud or multi-tenant situation.

Have we thought of any policy guidelines where VM images/snapshots can be kepts and provided as evidence in lieu of the actually hardware?

Is there any group advocating policy change with technological alternatives to the sledgehammer approach?

Law enforcement do not care about your uptime. Law enforcement do not care about your losses. They want to preserve chain of custody and integrity of evidence. If your gear is seized as part of a raid, they'll take your whole machine. If you want to prosecute someone for breaking into your box, they'll demand a provably identical image of the drive, obtained via a method that is known to be forensically sound. For this reason, companies like Guidance will send someone to defend their forensic software in court for free, if you require it.

Law enforcement will not accept a VMWare image, because they have to prove to a judge that they have a 100% accurate copy of the data. Trying to defend a non-standard process when they've got defence lawyers staring them in the face is not something they want to try. The notion of the technicality is a common one.

At the end of the day, you need to ensure that you can make a forensic copy of the drive, and maintain chain of custody on the evidence. A defence lawyer will ask you how you know that the copy was accurate, and how you can prove that the copy or original drive was not tampered with. If you can't answer that, they'll tear your case apart.


How AV software makes sure quarantined files never get executed? This Super User question made me ask, is it really a good idea to keep files in quarantine, when you don't know what they are yet? For what I know there are more or less 2 steps that need to be performed for "losing control" of your system. First there has to be some malicious code to be injected to the system and then there needs to be a way to execute it. So what measures does AV software take for "in quarantine"-files to avoid this? I'm assuming, the case where the user is just executing the file isn't the problem. I.e. how to make sure that not a bug is causing some overflow resulting in execution of the code?

In other words: What does AV software do to prevent execution of quarantined files, and can I rely on them not being able to get executed anyway?

NOTE: I'm not asking about the ways AV's are performing the quarantine feature. The core of the post is: "What are the ways quarantine features are protecting themselves/quarantined files from beeing tricked/decoded/whatever and getting executed anyways and how likely is it this could happen?"

There are a couple ways an antivirus program might go about preventing the execution of a quarantined file:

Hold it open for exclusive access. It can simply use the normal CreateFile API and pass zero for dwShareMode, preventing all other kinds of access to the file. If an executable can't be read, it can't be executed. Since antivirus programs are usually one of the first things to start, they can reopen all such files when the system reboots.
Use Software Restriction Policies. When the antivirus program is installed, it could create an SRP that blocks the execution of programs in the quarantine directory.
Hook a function that's critical for the creation of a process. Process starting always involves NtCreateSection, so the antivirus program's kernel-mode driver could hook that and determine whether the file in question is an executable and check whether PAGE_EXECUTE is requested.

Of these, only the first is useful for non-programs (e.g. documents that may contain exploits). To keep an eye on all file loads, the antivirus program could hook NtCreateFile, since no files can be read without invoking that. Alternatively, to watch for the marking of pages as executable, it could hook NtProtectVirtualMemory. Either way, the kernel-mode driver could look around a bit at what's going on in userspace before allowing the operation to proceed.

The easiest solution, however, would be to encrypt the quarantined files with a key that's not stored on disk. With such a system, the user would have to type a password to decrypt and un-quarantine the files. This could be accomplished fairly easily with some asymmetric-key cryptography.


Credit card store first four and last four which PCI SAQ? In our application, we only transfer cardholder data to a PCI DSS compliant service provider, and don't store it ourselves. We only store first four and last four digits of credit card number for future reference:

1234 **** **** 1234

We have a lot more than 300k transactions annually, so our SP required us to fill a SAQ form, but even they are not sure which one to fill in. We are in between SAQ D (which definitely seems overkill) and SAQ A-EP. Any thoughts?

Update:

We collect the info on our website. We get the information on a form, which we post it to our backend. Then, the backend transmits the cardholder info to the PCI compliant SP, and only stores the above mask in the db.

Unfortunately for you, because the card data crosses your server (regardless of what you're storing), you're subject to the full SAQ D.  This document provides a good overview of the various levels and their requirements.

Both SAQ A and SAQ A-EP require:

  Your company does not electronically store, process, or transmit any cardholder data on your
  systems or premises, but relies entirely on a third party(s) to handle all these functions

Posting the card data to your backend server which then sends it on to the service provider means that you do "process [and] transmit cardholder data on your systems".  If your server gets compromised in any way (such as Heartbleed), the attacker would then have access to that card data.  Thus the higher SAQ level, and all the extra precautions that go with it.

Ideally, you would be able to rewrite your system to post directly from the web page to the service provider, without anything coming back to your server.  They ought to be able to provide you with a masked card number in their response, for you to store, but you can also probably just post the masked data back to your server along with their response.  You just need to make sure the full data doesn't come back, if you want to qualify for A-EP.


Simple example auditd configuration? Auditd was recommended in an answer to Linux command logging?

The default install on Ubuntu seems to barely log anything.  There are several examples that come with it (capp.rules, nispom.rules, stig.rules) but it isn't clear what the performance impact of each would be, nor what sort of environment or assumptions each would be best suited for.

What would be the best starting point for deploying auditd on, lets say, a web server?  This would include an audit.rules file, settings to enable sending the audit log stream to a remote machine in real time, and the simplest of tools to see what has been logged.

Next, how about a typical desktop machine?

Update: dannysauer notes that for security it is important to start with the goal, and I agree.  But my main intent is to spark some more useful explanations of the usage of this tool, and see a worked example of it in action, together with performance and storage implications, etc.  If that already exists and I missed it, please point to it.  If not, I'm suggesting that an example be created for one of the more common scenarios (e.g. a simple web server, running your stack of choice), where the goal might be to preserve information in case of a break-in to help track back to find out where the penetration started.  If there is a more suitable or attainable goal for use in e.g. a small business without a significant IT staff, that would help also.

Auditd is an extraordinarily powerful monitoring tool. As anyone who has ever looked at it can attest, usability
is the primary weakness. Setting up something like auditd requires a lot of pretty in-depth thought about exactly
what  it is that needs auditing on the specific system in question. In the question you decided on a web server
as our example system, which is good since it's specific.

For sake of argument let's assume that there is a formal division between test/dev web servers and production
web servers where web developers do all of their work on the test/dev systems and changes to the production
environment are done in a controlled deployment.

So making those rather large assumptions, and focusing on the production system, we can get down to work. Looking at the auditd recommendation in the
CIS benchmark for RHEL5 we can start building out the following suggested ruleset:

-a exit,always -S unlink -S rmdir
-a exit,always -S stime.*
-a exit,always -S setrlimit.*
-w /etc/group -p wa
-w /etc/passwd -p wa
-w /etc/shadow -p wa
-w /etc/sudoers -p wa
-b 1024
-e 2

This will cause logs to be written out whenever the rmdir, unlink, stime, or setrlimit system calls exit. This should
let us know if anyone attempts to delete files or jigger with the times. We also set up specific file watches on the
files that define groups, users, passwords, and sudo access. Instead of looking at system calls for each of those an
audit log will be written every time one of those files is either:

opened with the O_WRONLY or O_RDWR modes
an attribute is changed

Since we've already made the assumption that we're talking about a production web server, I would recommend adding the line:

-w /var/www -p wa

This will recursively watch all of the files under the /var/www directory tree.

Now we can see the reason for the "controlled environment" assumption made earlier. Between monitoring all files in
the web root, as well as all unlink or rmdir events, this could be prohibitively noisy in a development environment. If
we can anticipate filesystem changes, such as during maintenance windows or deploy events, we can more reasonably filter
out this noise.

Combining all of this into a single, coherent, file we would want /etc/audit/audit.rules to look like

# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 1024

-a exit,always -S unlink -S rmdir
-a exit,always -S stime.*
-a exit,always -S setrlimit.*
-w /var/www -p wa
-w /etc/group -p wa
-w /etc/passwd -p wa
-w /etc/shadow -p wa
-w /etc/sudoers -p wa

# Disable adding any additional rules - note that adding *new* rules will require a reboot
-e 2


Where exactly in the OSI model does TLS/SSL belong I am trying to understand where exactly SSL/TLS sits in OSI model. If I look at this answer on StackExchange,

  While all network models are imperfect, this question can only be
  answered by looking at what SSL (TLS really) does. (1) On top of a
  reliable network stream (TCP at OSI layer 4) it provides an encrypted
  bidirectional stream and (almost always) guarantees the identity of
  the server and (optionally) the client. The authenticating client can
  be a process, user or some other entity which can properly answer the
  required authentication challenges.

  TLS means Transport Layer Security. However since it does implement
  session identity, integrity, start up, tear down and management it
  very much belongs in the session layer. The Wikipedia page states that
  this belongs to the OSI presentation layer. This is probably wrong.
  The presentation layer is more concerned with marshalling data into
  non-network-dependent formats and interpreting it on the host side
  through the appropriate application.

  At-rest encryption (say in a database field or email message) might be
  a candidate for the presentation layer, but I would suggest that it's
  closer to a form of OS or application security.

  So in reality TLS is mostly session-layer as it provides
  point-to-point session security for the transport (TCP). In other ways
  it provides authentication functions which are clearly application
  layer (OS, utility or user app).

  So it's a lot of layer 5 and a little of layer 7.

It explains how it sits on layers 7 and 5.

But these slides explaining BEAST attack on SSL/TLS says its on layer 6,

Can someone please explain (if possible with a diagram) where exactly SSL/TLS happens?

The OSI model is defined in the ITU document X.200.

The document doesn't expressly mention encryption.

Section 7.2.4 (Functions within the Presentation Layer

Item b says

  representation of the abstract syntax chosen by the application-entities in the transfer syntax negotiated or
  renegotiated, including format and special purpose transformations (for example, data compression);

This definition is the best fit I can find for what I would describe as TLS doing. I would say TLS is Layer 6.


Metasploit MsfVenom - Payload binds shell, but unable to spawn it with netcat Running a SEH BoF exploit script that contains a payload that is generated from msfvenom as such:

msfvenom --payload windows/shell/bind_tcp --format py --arch x86 --platform windows --bad-chars "\x00\x20" EXITFUNC=seh

After running the script containing the said payload, I checked all active connections on the victim machine (WinXp SP3) by running netstat -an, there is an open port listening on 4444 (the default port from msf payload). However on the attacker's machine (Fedora 27) I was not able to spawn the shell using netcat as such:

nc [victim IP] 4444

after running the above command the cursor just blinks below it. And after hitting enter (return), nc is killed and so is the vulnerable program from victim's PC. Anybody have any ideas?

The only possible explanation right now is that the problem lies within the payload from msfvenom? I assume that is because the payload was definitely executed since there was an open port at 4444 on the victim's PC. So if the problem did not exist while the script was running, then it must be the payload that is creating the problem, what do you guys think?

After a while of messing with the attack, I noticed how the exploit would crash the program and the alerted error message contained a module called hungapp, and offset of 00000000. Some more research were done, hungapp looks like a microsoft security feature that blocks TCP connections. The last microsoft security update for the victim's pc was published in 5/15/2017, that most likely patched up against this type of Seh attack.


Is it possible to DNS-spoof Exchange ActiveSync? My company's SSL Certificate for basically all their websites and Activesync servers have expired long ago. For my upcoming meeting's sake I need to explain how this is very insecure. Unfortunately I am not too read up on the subject of these security flaws.

Will it be possible now to poison the DNS and engage Man-in-the-Middle attacks without a proper SSL certificate?
If the DNS has indeed been poisoned, is it possible to imitate an exchange ActiveSync server to hijack all incoming and outgoing emails, including taking over staff's phone?
What are the implications and consequences of not having a valid SSL certificate?

I've read up online on the benefits of having a SSL certificate, but no one seems to enjoy talking about how an actual attack is carried out. Please list terminology, so I can maybe google-fu my way around this issue.

an expired SSL certificate means:

There is no more way to validate the authenticity of the certificate. (I can no longer tell if its correct, or replaced by an attackers).
All proper software will complain every time I connect with this service, which trains people to ignore the messages. So when an attacker does the same no one reports anything.
the way the certificate and key are made could be outdated. (a MD5 hash is easily to find an collision for, as example).
The longer a key is in use, the higher the changes of someone breaking or stealing it. To limit this certificate expiration was invented.
As for the money to replace the certificates. SSL certificates are no longer as pricey as they ones were. most single domain certificates are below €10,-
an expired certificate also shows a lack of concern from management and IT. which undermines people's trust in the company.
etc...


How to verify TLS renegotiation DoS vulnerability? (CVE-2021-3449) I am trying to verify whether I am vulnerable to the OpenSSL TLS renegotiation vulnerability CVE-2021-3449 (fixed in OpenSSL 1.1.1k).
When I connect to the website using openssl s_client -tls1_2 -connect example.com:443, it says "Secure Renegotiation IS supported". When I then send the request for renegotiation, it disconnects:
$ openssl s_client -tls1_2 -connect example.com:443
[...]
---
GET / HTTP/1.1
R
RENEGOTIATING
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = <my domain>
verify return:1
write:errno=0

I first tried without sending data first, but figured it might want some data before accepting the renegotiation. Either way, though, it disconnects. In Wireshark I see three encrypted handshake messages: first me to server, then server to me, then me to server. Before the last one, the server already sent me a FIN+ACK and so I get a RST packet back in the end, though my system also sends a FIN+ACK.
When I ran a test on it from SSL Labs, it says:

Secure Renegotiation Supported
Secure Client-Initiated Renegotiation No
Insecure Client-Initiated Renegotiation No

Does that mean I am safe since since Client-Initiated Renegotiation is disabled? I don't know when or why my web server would ever choose to renegotiate of its own accord. A PoC that I can test against my server would also be appreciated.

This seems like a good potential test package that you can use https://github.com/terorie/cve-2021-3449


Different scanning results with Nmap Me and my friend have access to a private enviroment, and we use Nmap to scan one domain and a www.

I get the following result:

======================================================================
                          INCORRECT SCANNING
======================================================================

nmap -sS -v www.site.com.br

Starting Nmap 7.31 ( https://nmap.org ) at 2017-01-02 13:45 EST
Initiating Ping Scan at 13:45
Scanning www.site.com.br (173.x.x.20) [4 ports]
Completed Ping Scan at 13:45, 0.20s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 13:45
Completed Parallel DNS resolution of 1 host. at 13:45, 0.45s elapsed
Initiating SYN Stealth Scan at 13:45
Scanning www.site.com.br (173.x.x.20) [1000 ports]
Discovered open port 22/tcp on 173.x.x.20
Discovered open port 53/tcp on 173.x.x.20
Discovered open port 21/tcp on 173.x.x.20
Discovered open port 554/tcp on 173.x.x.20
Discovered open port 111/tcp on 173.x.x.20
Discovered open port 80/tcp on 173.x.x.20
Discovered open port 7070/tcp on 173.x.x.20
Completed SYN Stealth Scan at 13:45, 6.73s elapsed (1000 total ports)
Nmap scan report for www.site.com.br (173.x.x.20)
Host is up (0.17s latency).
rDNS record for 173.x.x.20: 14.5d.2d.static.xlhost.com
Not shown: 990 closed ports
PORT     STATE    SERVICE
19/tcp   filtered chargen
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
80/tcp   open     http
111/tcp  open     rpcbind
554/tcp  open     rtsp
5555/tcp filtered freeciv
7070/tcp open     realserver

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 7.72 seconds
Raw packets sent: 1034 (45.472KB) | Rcvd: 1022 (40.896KB)

But my friend gets this:

======================================================================
                          CORRECT SCANNING
======================================================================

nmap -sS -v www.site.com.br

Starting Nmap 7.31 ( https://nmap.org ) at 2017-01-02 15:26 BRT
Initiating Ping Scan at 15:26
Scanning www.site.com.br (173.x.x.20) [4 ports]
Completed Ping Scan at 15:26, 0.21s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:26
Completed Parallel DNS resolution of 1 host. at 15:26, 0.01s elapsed
Initiating SYN Stealth Scan at 15:26
Scanning www.site.com.br (173.x.x.20) [1000 ports]
Discovered open port 80/tcp on 173.x.x.20
Discovered open port 111/tcp on 173.x.x.20
Discovered open port 22/tcp on 173.x.x.20
Discovered open port 21/tcp on 173.x.x.20
Discovered open port 53/tcp on 173.x.x.20
Completed SYN Stealth Scan at 15:26, 6.58s elapsed (1000 total ports)
Nmap scan report for www.site.com.br (173.x.x.20)
Host is up (0.17s latency).
rDNS record for 173.x.x.20: 14.x.x.x.x.com
Not shown: 991 closed ports
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
80/tcp   open     http
111/tcp  open     rpcbind
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
2301/tcp filtered compaqdiag

My results do not make sense, and his is correct. Why do we get different results, and how can I fix it?

Let's focus just in the relevant data: port 554 and 7070 open in your scan.

There is 1h and 19 minutes (13:45 EST = 16:45 BRT) of difference between the scans, so maybe when you scanned the target, it had a RealServer running (ports 554 and 7070), and when your friend scanned it, it didn't have the RealServer running.


Can EAP-TLS and AES256 encryption be used together? What is the difference between EAP-TLS and AES 256 encryption? Can they be used together? Or are they separate protocols?

What is the difference between EAP-TLS and AES 256 encryption?

They are not just different protocols, they are entirely different concepts.

AES - the Advanced Encryption Standard - is a block cipher algorithm. In AES-256 the 256 denotes the key size (different key sizes also trigger slightly different of AES). AES can be used for the transport encryption used within TLS; i.e. it can be the cipher that actually encrypts the payload. AES is a subset of Rijndael standardized by NIST.

EAP describes a framework for authentication. The authentication mechanisms provided by EAP-TLS can be used within the handshake of TLS to authenticate the client and/or server. Usually it is used to perform both client and server authentication though (compared to web browsers that usually only perform server authentication).

So we aren't comparing apples and oranges here, we're comparing apples and asparagus.

  Can they be used together? Or are they separate protocols?

The handshake phase and the actual encryption/decryption phase of TLS are not directly coupled. So yes, if this combination has been implemented by the client and server, you should be able to use both.

However, the EAP-TLS specification only requires the TLS_RSA_WITH_AES_128_CBC_SHA ciphersuite to be available for the use of AES. And that's a SHOULD, not a MUST, so you need to check this as well at the client and the server (although this cipher suite is generally supported). If a ciphersuite with AES_256 is supported it is not a standardized solution.

AES-128 is considered very secure; AES-256 may not make that much a difference with regards to security of the entire system. Note that I don't see an option for forward secrecy (DHE or ECDHE cipher suites) or TLS 1.2 either. That should probably worry you more.


How should the counter value for HOTPs be stored? RFC4226 describes the HOTP algorithm to "based on an increasing counter value and a static symmetric key known only to the token and the validation service", specifically:

HOTP(K,C) = Truncate(HMAC-SHA-1(K,C))

How would one go about storing the counter (i.e. C part of the algorithm), assuming that each user would have their own unique counter?

An answer to your question will depend on what exactly you're using the counter value for.

There are various OTP schemes. One, HOTP, is using a counter, so maybe you're talking about an HOTP implementation. However, your question could also imply that you have a list of valid passwords lying around and you need to remember which one is the next valid one. This would strike me as a bad idea altogether and you can easily improve on it and solve your counter problem at the same time. So if you aren't talking about an HOTP counter or a similar solution, here's a suggestion:

Destroy used-up passwords

There is no need to keep around passwords which are already "used up". I can't immediately see why keeping old passwords around might be a problem, since they're no longer used, but if there is no need to keep them, I would make sure to destroy them. Depending on what you're using these passwords for, you might compromise forward security by keeping them around, for example.

If you throw away old passwords, you also fix the counter issue - you don't need to keep a counter at all because the next valid password is just the next one in your list. You might also get a bit of extra security by choosing one of the remaining passwords randomly instead of always taking the next one.

Other approaches

But if you don't need the random password selection, there are simpler solutions is an easier solution doesn't require you to store a list of passwords, for example

HOTP
TOTP
Lamport OTP

HOTP is basically building a hmac given a secret and a counter and using
the result as a password. TOTP uses the time instead, so it can't be used
with paper lists of passwords, but has the advantage of making it possible to expire OTPs.

Securing HOTP server-side

Edit: Added this section to better answer the updated/edited question

I think what you need to worry about when using HOTP is not whether to keep the counter secure, but how to keep the secret secure that you're using. If an attacker gains access to the secret key, he/she can generate all past and future passwords. With this knowledge, he might guess a range of counter values to try. Knowledge of the counter value itself is less dangerous, since without the secret, you can't produce a valid password.

So it seems to me that since you already need a solution to store the secret key securely, you could just err on the side of caution and store the counter value in the same way. If you don't want that, I'd simply add an additional column to my user table in the database and store the counter value there.

You could encrypt this counter value beforehand using another password (and random iv, so identical counter values don't produce identical ciphertexts!), but frankly I don't see much gain for the following reasons:

The counter value itself isn't helpful to an attacker unless he
  already has the user's password list or your secret key, and in
  both cases, you're pretty much screwed anyway. (One exception: With knowledge of the counter, an attacker might social-engineer the coresponding password from a user, using his knowledge of which password came next to convince the user that he was legit)
Encrypting will only protect the counter when someone manages to
  steal your database, but can't steal the encryption key or run the
  decryption code on his behalf. I think that's an unlikely scenario.

Securing sensitive server state by not storing anything sensitive

Lamport OTP is a simple, beautiful solution to OTPs which doesn't need a shared secret and which you might also consider.

Basically, the idea is to hash a hash of a hash of a hash.... For a simple
idea on how it works, consider the following OTP solution: Take a secure password hash function H(x), and hash an initial random seed secret S which only you know. To generate the list of passwords for the user, take the result and hash it again, and again, and again, as many times as is necessary to yield the required number of passwords. So basically you're building a list of OTPS:

[ H(S), H(H(S)), H(H(H(S))), ...]

Now one problem you have is that if you use the hashes directly as passwords, if an attacker learns just one of them, he can calculate all the future ones, too.

You can fix this in a variety of ways. For example, you could take the resulting hash and use it as a password to encrypt another secret string, and then use the encrypted string as the password to put on the list and verify against. (I just made that up - don't use this without carefully thinking about whether this is secure, as it probably isn't).

Lamport OTP does it way more clever. It's basically sending the hashes backwards; e.g. you calculate the first 100 hashes based on a seed and give the user a list of them in reverse order. So the first one he sends is number 100.

The next one he sends is number 99. The server can now check if H(OTP99) = OTP100. Because Hash functions are one-way, knowing OTP 100 doesn't help an attacker to get at OTP99.

The nice thing here is that the server doesn't need to store anything that can be compromised. It must keep the last sent password (e.g. hash) stored somewhere, so in the beginning it must have the value for OTP101, and when the user successfully logs in with OTP100, it must then replace OTP101 by OTP100, but even if an attacker gets to know the currently stored value at the server side, it won't help him, since what he actually needs to know is S (or any of the derived hashes), and they're hopefully secure at the client. The server never needs to store S at all, meaning that after you generate the list of passwords and OTP101 to store at the server, you no longer need to know S or any of OTPs 1-100. This strikes me as a very beautiful solution which completely sidesteps your question of whether you need to keep the counter value secure - with Lamport, there isn't anything to keep secure at the server side.

I've simplified a bit, read up on the algorithm/protocol to see how to implement this in detail.


Lost RAR password, is there any way to access my data? I lost my winrar password of my file. I need to access it. Is it possible? If yes, how?

It depends on the strength of your password. Winrar implements proper AES-128 encryption with 262144 iterations of KDF, there's no known bypass for that. You need to estimate the number of possible passwords (what's the length, what characters were used, did it contain words, etc.), and if it is large enough to not be bruteforceble there's nothing you can do, cryptographically speaking.

The other avenue is to find the password. If it was stored in a file then you can recover it for some time after the deletion, this may well be the easiest way.


How to understand "Encrypted Data" in TLS message type? In this Wireshark screenshot, there is a message type "Encrypted Data". Does anyone know what this is and in which situations this message type will be sent?

You should probably start with a general overview of how TLS works. We have a good introductory post here:
How does SSL/TLS work?

To answer your question: every time a new TLS connection is opened, you will see something like this message exchange in Wireshark:

The Hello and Key Exchange messages are to set up an encrypted channel that only the client and the server can read. They will not send any important data until the encrypted channel has been established, after which all communication between the two will look like the Encrypted Data packet that you see. This is TLS working as intended.

As @TorstenS points out in their answer, Wireshark has the ability to decrypt TLS traffic, but you need to be in control of either the client or the server so that you can extract the session private keys and give them to Wireshark.


Can VPN traffic be easily identified? / China - VPN Here's the problem
https://www.theguardian.com/technology/2017/jan/23/china-vpn-cleanup-great-firewall-censorship

10-12 weeks pr. year I'll be in China and I need to access Google and Facebook.

My neighbour in China has been kind enough to let me use his Wifi so I'll connect to it and then connect to a VPN server I run on my ASUS RT-AC68U router in Europe.

Question 1: Can chinese authorities easily identify this traffic (like encrypted PPTP traffic to same IP for several hours every day)?

I don't want my neighbour to get in trouble.

Encrypted traffic is very easy to spot but determining what it's being used for is not always so easy. China does still allow some encrypted traffic so you may want to dig into what they actually allow first and see if you can find a solution that isn't a problem. Supposedly they are ok with large businesses using VPN for actual work but are cracking down on smaller home-made solutions and VPN providers known more for anonymous connections rather than for corporate use.

You may want to read the comments in the following article which discuss what types of traffic are actually blocked and what is allowed.

https://www.schneier.com/blog/archives/2012/12/china_now_block.html

In any case, the answer to your question is YES it is super easy to identify and block PPTP traffic.

There are ways to setup a secure web-server with a hidden web-proxy behind it or leverage Secure-Shell for tunneling in a manner that looks like shell access but you need to be very careful how you handle DNS and potential IPv6 leaks which could potentially allow them to know what you are doing.

Basically, if you can you want to make it look like you are just working occasionally.

You may also want to look at the following web page which shows details on what they block and why.

https://en.wikipedia.org/wiki/Internet_censorship_in_China

Do understand that you may be breaking laws which may have punishments at a greater cost than the value of your Facebook and Google communications. The trade-off may not be worth the risk.


Source code auditing and fake builds I am wondering about source code auditing and how hard it would be to fake a build to be audited? Let me explain.

Say I would be a dishonest programmer that would wish to put in some backdoor into the system I would be selling or what have you. I need to get some certifications to make myself look more legitimate, so I decide to undergo source code audit. However, knowing well that my fraud would be detected, I create a spotless version of the code that does not have the backdoor which I would be submitting to the review. Passing that with flying colours, all I need to do now is scrap the fake build and replace it with my own, malicious version that I would proceed to distribute. If someone would get a hold of it, how would they know the code was tampered with?

How would source code audits help to detect a situation like this? How easy would it be to detect?

It all depends on the scope of the audit.

If the audit is purely of the code (ie give the auditor a copy of the code, they audit it and return a report) then it could be very easy to tamper with it after the fact.

If the audit is a bit more comprehensive, and includes the code development, test and promotion to live environment procedures, then you should be able to rule out most opportunities for tampering to take place.

If you additionally audit the ongoing change management process, and carry out regular confirmation checks on live code then you give yourself an even greater level of assurance that the code in live is the code developed and tested, and that it is appropriate for purpose.

This is why limited scope audits can be essentially useless, aside from getting a tick in the box (which may be useful...)


is computrace a permanent backdoor? I was reading about CompuTrace and this thing is pretty much a backdoor and irremovable. It's in the firmware, in the BIOS and survives formatting and even hard drive change and OS reinstalls.

Some question came to mind,

Does CompuTrace work with Linux?
Does CompuTrace still work when using VPN or Tor?
How do you find out if it's on the computer, even if inactive?

I did some reading online and this exploit/backdoor is very dangerous. It can basically obtain ANY information and send it back home and is a poison pill and a tracking device. One of the issues I have noticed is the purchasing of used notebooks which you cannot be sure are not stolen.

Read this: http://www.freakyacres.com/remove_computrace_lojack

One comment was particularly interesting, apparently coming from a cop, which claims (quote)

"It's all nice in theory to sit here and talk about how you think you can disable the software, but from a law enforcement perspective I can tell you it is a LOT more persistent than you know and it does a whole lot more than you think it does."

That does not sound good and is pretty much an information security killer.

Am I missing something here or is this a permanent, irremovable exploit/backdoor?

According to "Absolute Computrace Revisited" and "Absolute Computrace / System Requirements" answers to your questions are:

Yes (Ubuntu, Debian). There should not be a big problem for
CompuTrace developers to make it work with RH or SuSE I
believe, since SW versions, placement of binaries and packaging are
more or less standard in these distributions also. RH SeLinux and
SuSE AppArmor can be a bit of a problem, but it is more
administrative (to get a proper profile built-in) than technical.
Yes/probably. Since VPN just wraps IP traffic and routes all or part
    of it to another location, CompuTrace will follow that routing. If
    the addresses it wants to contact are routed to VPN gateway and the gateway
    does not know/is not configured to route these addresses further, CompuTrace will
    not work, but this issue is not specific to VPN, the same is also
    true for any router that has configurable routing tables. As for TOR
    if a TOR proxy is set in IE properties of a user then IE process launched by CompuTrace will also use this setting. Other ways to
    connect to Internet are not announced, but there is no problem for CompuTrace developers to build TOR presence detection and act accordingly.
On the first linked page there is a list of signs of CompuTrace
presence on a computer. Also on CompuTrace official site there is a list of laptop models where CompuTrace is preinstalled by manufacturers, so if you buy a new laptop that is in the list - you have CompuTrace.

And the answer to your last question would be "Yes, but..." Technically CompuTrace is a permanent irremovable (for an average/above-average user) backdoor. Legally it was not developed with malicious intentions in mind (or I hope so) so at least in some countries it is not considered malware. It is not an exploit per se, since it was made to function exactly like it functions, but it can be exploited by bad guys, just like any other network-enabled SW.


How is mail automatically sent from my account? Today I have received an email with an 'out of office' notification, as a reply to one of my emails, which I actually didn't send. I think it was sent automatically from my address, as a result of submitting some code, to some people that needed to be automatically notified.

How is this done? Is this related to the domain login?
What other things may I assume from this? (It is a corporate work
email account)
Why this choice of account usage? I mean someone could be notified of my actions from any account. (I was thinking of simplicity or integration with other solutions maybe)

Your question was pretty tough to follow and understand. I understood this: You got an auto-reply from someone's email, but you never sent an email to them in the first place. And you're thinking that something else sent an email as you and you want to know how that is possible. My response is based off of that assumption.

Mail forgery is pretty simple. Anyone can set up a SMTP mail server that sends email out from yourname@yourdomain.com. Most mail servers will reject it, based off of PTR and MX record checks (I believe) and they'll see it came from an IP address that doesn't quite match up with the MX records. However, I think a lot of mail servers will accept mail if it sees the "from" part is coming from it's own domain, or if the content of the email is simple (text only, no links).

That is how I can get mail from all of my servers without them being "official" mail servers for my domain. As part of my business's application, the users have the ability to email themselves content from certain parts of our app. When our mail server sends the email out, we forge the email with the user's address in the "From" part, so when they get the email, it looks like it came from themselves.

At any rate, to directly answer your question, this process can easily be scripted and put in a cron job.


Limited JavaScript app scenario: Attack vectors and mitigation I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser memory as long as they are on the page. Any input will need to be redisplayed to the user who has entered it.

What attack vectors are there in this kind of scenario?
What would you do to mitigate any attack vectors?

Options to me seem to be dumb JavaScript HTML encoding before adding to the DOM or simply keeping the textual input in the textarea as is and disabling it.

The two biggest threats are Clickjacking and accessing the offline storage.  The offline storage maybe accessed with DOM Based XSS or if the machine running it has been compromised.  Even if your application doesn't use GET/POST/Fragment as input,  one of your libraries might.


How is DDoS different from DRDoS? I understand DDoS is a DoS assault from multiple sources, where a coordinated stream of requests is launched against a target.

How is DRDoS different?

To put it straight and simple, DDOS is is making the server unavailable or denying the service to the users for a particular time.
DRDOS is sending forged requests imitating the target (victim) to millions of computers and making the target flooded by the responses from those computers.

More info on DRDOS
The attacker sends the requests from his server. Using IP address spoofing, the source address is set to that of the targeted victim, which means all the replies will go to (and flood) the target.


Do I have to store refresh token in database? If I generate refresh tokens with expire time of 14 days, do I have to store them in my database and compare them when an access token is renewed, or verifying them (with jwt library) is enough?
Also, does it make sense to generate new refresh tokens for the users when they attempt to obtain a new access token?

The idea behind cryptographically singed  tokens is that you can pass them through untrusted parties and still trust their content as long as the signature is valid and the private key has not been compromised.

If your refresh token contains all the information needed to issue a new access token and the signature is valid (meaning no one has modified the token content) you can trust the token.

The only reason why you would want to store some parts of the refresh token is so you can check if the token has been revoked. Revocation is a bit more difficult with stateless tokens because the token itself stays valid even though you want to revoke it. Usually you would want to store a „user must reauthenticate“ bit in the database and check that if your issue a new access token with a valid refresh token.


Is the injection in a NoSQL database architecture also called SQL injection? Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection?

For example, an injection in code that communicates with the following database architectures:

Hadoop / HBase
Cassandra
Elasticsearch
MongoDB
CouchDB
Berkeley DB

Those are called NoSQL Injections instead of SQL injections.

You can find more information about NoSQL injections, in the OWASP Testing Guide.


Sniffing Packets for IoT devices I'm looking to do some packet sniffing on some of my IoT devices to see how much they are phoning home, and to see some the ports I can block to keep them from doing so.

They are a mix of wireless and wired devices so a simple promiscuous mode Wireshark isn't sufficient. I'm running a Netgear router at the moment so I can't run the sniff from there either.

Is my best option a MITM attack using ARP poisoning?  I don't want to go through all the effort to try to setup some sort of proxy to sniff.

I'd like to do this from Linux.  Is Ettercap the best tool for this these days?

If you can put 2 interfaces on the Linux box, poisoning and attacks are not needed at all. Setup interfaces for WAN & LAN, add DHCP server and some NAT rules and you can easily monitor traffic with any tools including ethercap, tcpdump, wireshark, etc and later block those undesired streams.

If 2 interfaces are not handy, do the same above on one interface: Disable DHCP on the router, give Linux a static address, do the rest just like above and let the Linux do the job.


Encryption and decryption in the browser on the client's side – is it safe? There is a possibility to download the file with one’s PII from the dedicated web server. The file might be decrypted by filling the two factors. These two factors are delivered via email and SMS. The sum of these factors is the key from which is generated the hash by, let’s say, bcrypt. This hash is the main password to decrypt the PII from this file.
It is transparent for the user.  The user only needs to provide these two factors.
All processes: scaling two factors, making hash, decryption; are executed in the browser (java) on the client's computer, on the client's side.

In my opinion, it is not good practice and not safe. The process of decryption is on the client's computer. Also, the algorithm is delivered on the client computer. Because it is written in Java so it is possible to find out about the function that is used to decrypt the file.
The attacker can steal the file and the knowledge and try to gain access to the file. The main security of confidentiality is based on a strong algorithm like bcrypt.

What is your opinion about this case?
Or maybe I am crazy about it and wrong and this is a good and safe practice.

Let's put some of the specific technical implementation details aside and focus on what you have asked or assumed:

is decryption on the client-side safe?
is finding out what encryption has been used a problem?
is a strong hash as a key strong security?

Decrypting client-side
There is nothing wrong with having all the decryption client-side, and for very secure implementations, it's actually preferable. If it is all client-side, then the transmitting and storage is all inherently encrypted. "But an attacker could steal it from the client!" Yes, but they could do that anyway. PII is all over a client machine. If an attacker has access to the client device, they have everything anyway.
Knowing the encryption algorithm
There is a concept in cryptography called "Kerckhoffs's principle", which proposes that all encryption should aim to be safe even if an attacker knows exactly what encryption method was used. The only secret thing should be the key. All approved encryption algorithms meet Kerckhoffs's, so no, it's not a problem if an attacker knows how the file was encrypted.
Hash as key
The problem with your key generation idea is that the different factors and how you use them to create a hash which becomes the key doesn't matter. The final string is the password to the file. If the file needs to be opened again, the string can be saved, stored, and reused. So all your work to "protect" the key is defeated. You just created an awfully inconvenient random string generator.
And if you purposely prevent the user from doing this, you cannot prevent an attacker from creating their own version of your Java app and simply cutting out all your controls. So all you will end up doing is making it very difficult for users.
What to do
You could simplify your entire process by simply using standard Java encryption libraries and protect the encryption key with a user password. This is what online password managers do, and they protect data far more sensitive than PII.


Which graphic image formats contain revision history?  Does the image editing software being used matter? It's common knowledge among graphic designers that they can rename a PDF file and import it into Illustrator and access the "layers" within the document, revealing hidden information.
I don't know enough about the binary image formats (jpeg, bmp, gifs), or the variety of applications that exist to edit or manipulate such images, but I think it's feasible for another image format (or tooling) to include historic edits.
One example where this is unwanted is when a user posts a screenshot and blacks-out confidential information such as server names, or IP addresses.

Under what conditions can an anonymous viewer of "blacked out information" reveal private information?

What is the correct way to "black out" information that will be posted on a public forum such as Stack Exchange?

Layers and history are not the same thing.

PDF is a vector format. Picture elements are geometric figures which are to be "painted" successively in a precise order, so that newer figures hide parts of older ones. This is not per se a trace of how the image was edited, only an artefact of the way things are drawn in PDF. It is not equivalent to typing Ctrl-Z on a Word document to perform some "undo" commands. But it still means that in the scenario you allude to (trying to "black out" some part of the picture), the naive editor may believe that he destroyed the information while he merely hid it.

(Anecdote: I did have, at some point, the job of "anonymizing" PostScript documents submitted by researchers in a review process. The submission guidelines specified quite clearly that manuscripts were not allowed to include any identifying element, but the grasp of mundane realities by researchers being what it is, quite a few of the manuscripts featured the name and institution address of the author. The solution involved adding an extra white rectangle over the offending area and editing the image so that the author name read as a bunch of 'X' even if the rectangle was removed.)

In bitmap formats, the picture is made of elementary pixels which are juxtaposed, and which do not hide each other. When you modify a bitmap picture by applying a black rectangle on them, the colour previously held by the pixels is forgotten, not merely hidden. There are a few bitmap formats which handle "layers" and thus could potentially have the issue you evoke (depending on how the black painting is done), but the common bitmap formats (including JPEG, PNG, BMP and GIF) do not have layers, and when you paint some pixels in black, information is gone for good.

With the GIMP, a free wannabe replacement for Photoshop, you can see the image layers, and when you save to a format which does not support multiple layers, you get an explicit warning that layers have to be "merged" -- which means that hidden pixels are eradicated.


Can a malware jump from a virtual to the physical machine? Possible Duplicate:
  How secure are virtual machines really? False sense of security?

I found out that malware authors check if the hard drive volume name,
or network card MAC matches default virtual machine settings or other more esoteric solutions so their malware knows that its in a VM.So I was wondering if a malware can jump out from the VM and harm the physical(host) OS.

Check this out : https://security.stackexchange.com/a/20341/11218

Ideally, the malware should not jump out from the VM to harm the host system. This is what virtualization software strive to achieve. But there have been demonstrated attacks of VM ESCAPE that shows how a malicious program can modify the memory of the host OS.

So, unless the virtualization software used is really old and un-updated, a malware wouldn't be able to jump to the host OS.


How to check my application passes multiple virus scanners I have an application I am trying to bring to market and I want to ensure that nothing in it is picked up by a virus scanner (since that would reflect badly on me).

Since I only have a single scanner on my machine (MSE), I'm finding it hard to test it in as many different scanners as possible.

I have found VirusTotal does exactly what I want, but they have a very low file size limit (64mb) whereas my application installer is about 300mb.

Are there any online tools that will scan a file with multiple scanners, or is there another way to scan my installer with as many different scanners as possible, short of installing each scanner?

You may be able to use any of another services such as No Virus Thanks. You will need to perform further research to determine whether it will meet your size and other needs.