NMAP - Closed vs Filtered A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found).

I want to understand why NMAP decides to tell me that a specific port is "FILTERED" when there are technically over 60,000 "filtered" ports.

For the sake of this example...

My host (192.168.1.100) is listening on ports TCP 80, 443 and 3389
My firewall only permits TCP 80, 443, 135 and 445 (not 3389)

192.168.1.100   80      open
192.168.1.100   135     closed
192.168.1.100   443     open
192.168.1.100   445     closed
192.168.1.100   3389    filtered

Since my host is not listening on TCP 135 and 445, it responds with a TCP RST, and thus it is "closed"
Since my firewall is not permitting TCP 3389, it is technically filtered

However, this is what I dont get. TCP ports 21, 22, 23, 24, 25, 26, etc are ALL filtered by the firewall (ie, not permitted), but NMAP only tells me this particular port (3389) is being filtered.

Why?! Should it not be a gigantic list like:

192.168.1.100   1       filtered
192.168.1.100   2       filtered
192.168.1.100   3       filtered
192.168.1.100   4       filtered
192.168.1.100   5       filtered
    ...        ...        ...
192.168.1.100   76      filtered
192.168.1.100   77      filtered
192.168.1.100   78      filtered
192.168.1.100   79      filtered
192.168.1.100   80      open
    ...        ...        ...
192.168.1.100   131     filtered
192.168.1.100   132     filtered
192.168.1.100   133     filtered
192.168.1.100   134     filtered
192.168.1.100   135     closed
etc...

This largely depends on the used scan, and the nmap scan types page explains the status of the port and the reasons per scan.

Some examples:

TCP SYN Scan (-sS)

 - Sends a TCP packet with SYN flag set
 - If a SYN/ACK (or SYN) is received --> Port is Open, TCP initiation accepted
 - If a RST is received --> Port is closed
 - If no response is received --> Port is considered filtered
 - If a ICMP Unreachable is received --> Port is considered filtered

UDP Scans (-sU)

 - Nmap sends a UDP Packet to the specified ports
 - If an ICMP Port Unreachable comes back --> Port is closed
 - Other ICMP Unreachable errors --> Port is filtered
 - Server responds with UDP packet --> Port is opened
 - No response after retransmission --> Port is Open|Filtered

And a "contrast" example that could produce different results than -sS:

TCP ACK Scan (-sA)

This scan nevers determines OPEN or OPEN|Filtered:

 - A packet is sent with only the ACK flag
 - If a System is unfiltered, both Open and Closed ports will both return RST flagged packets
 - Ports that don't respond, or send ICMP Errors are labeled Filtered.

Basically, your results will be influenced by the scan types and extra options you add. It is important to understand how the different NMAP scan types work at a higher level in order to perform a good and conclusive scan.

Multiple options might be required to get a proper view of your firewall rules.

Also, the --reason flag might give you more insights as to why a port is being shown differently than you expect.


Why is a 32 character hex string not a md5 hash? This string, when dropped into hash detection tools, is not being identified as a hash. As far as I knew, an md5 has was a 32 digit string with hex numbers. Everything below is hex. So what other rules does md5 have that prevent this from being a hash?

8019ed9fa0c5d1c36c7ef3a4e931205368da339079331

Here is just one example of an ID failure for this string:

https://www.onlinehashcrack.com/hash-identification.php#results

"Your hash may be one of the following :
Sorry we cannot identify your hash.."

It's not 32 digits. It's 45. That's 180 bits, not the 128 bits you expect from md5.

You can see this easily in a monospace font:

8019ed9fa0c5d1c36c7ef3a4e931205368da339079331
d41d8cd98f00b204e9800998ecf8427e

(The lower hash is the md5sum of an empty string)

Apart from that it's important to realise that a hex number is just another number. Most hashes doesn't carry any metadata in the hash identifying the algorithm or what kind of number it is.


How to be sure laptop's trusted certificates are safe I have a Windows 8.1 Lenovo laptop.  The evil Superfish app and certificate have been removed.   My laptop has 36 certificates in certmgr.msc current user\third-party root certification authorities\certificates.

Is there a way to know if a certificate might be malicious or compromised?  Since certificates are so important to security, there should be a way for an admin to be sure that the trusted certificates on user PC are safe or not.

Most of the certificates are updated through whichever update mechanism that is available to the system. You cannot be certain that the certs that are installed with the browser are not effectively used for mitm. On the other hand, you could write a small script that uses openssl client mode to retrieve the x509 certs of SSL based targets and from there do a comparison with the incoming site's signature.

This does not scale very well though. Also you might be aware that, at least of macosx, there is the ocsp client that also functions to revoke x509 certs. The problem is such that once you have a rogue root cert installed in your system, just about everything can be spoofed, which includes downloading of any solution over https. At the very worst, you can download, at least for firefox, the set of certs that are installed in the browser and do a quick corroboration test. But over the same broken system? Boot up in a livecd, possibly ubuntu, and do the downloads that way.

Please hug your poor system administrator that has to confirm whether your certs are in order.


Certs stop hackers from pretending to be a server. What stops them from pretending to be you? Reading this answer on stackoverflow, I understand that certificates help identify that a public key and encrypted data are indeed sent by the one we're talking to.

However, the data I send back to the machine I'm talking to is encrypted with my private key. But I don't have a CA-signed certificate. Is a hacker then able to intercept my connection, and replace the data I'm sending with his own encrypted data and include his own public key?

The data you send back is not encrypted with your private key. You randomly generate a session key (used for symmetric encryption), which you send to the server, encrypted with the server's public key.


As in the first line is it visible, he tried to use the Shellshock security hole of the bash shell.

His idea was probably the following: the Shellschock works by evironment variables, i.e. in some cases the bash would execute an environment variable as a shell function. And apache maps the parameters of the http requests (cookies, query strings, posted arguments, etc) to environment variables.

If there had been a cgi script on your server written in bash and interpreted by an unfixed bash shell, his commands could have been executed.

Later he tried to execute different shell commands. These commands had sent their output on tcp or udp protocol to a server under his control. It is because bash has an internal redirection mechanism to tcp and udp data streams, i.e. files beginning with /dev/tcp/ip/port are mapped to network sockets. It is an internal mechanism of the bash shell.
It was probably not a direct, manual attack, but a robot tracking for vulnerable servers.
The IP addresses he used are probably not his original server(s), but the ones he can already control remotely.


Do randomized PIDs bring more security? What is the concrete advantage of using random PIDs instead of traditional sequential ones?

Some times ago, I've read an article in the french magazine MISC (no. 74 - July/August, 2014) publishing a flaw affecting stunnel and libssh, article written by the discoverer of these flaw himself.

To make things short, this flaw relies on the fact that a hello cookie created by the server is generated using the current Unix timestamp (so up to the second) and the PID of the process handling the request. The exploit sends a high number of connections attempts in order to force the server to generate duplicated cookies. At the end this attacks aims to deduce the server private keys.

The author explains that such attack is not realizable on systems using sequential PID because it would require more than 65000 connections attempts to made in less than one second.

However thanks to random PIDs the author demonstrates that, with 20 connection attempts per seconds, there is statistically more than one chance over two to generate a duplicate in less than 5 minutes.

For me, this clearly shows that random PID creates new security weaknesses over sequential PIDs.

I was therefore wondering what was the exact threat that random PIDs are trying to solve. The answer I got from here, here, there and my personal experience do not satisfy me:

Poorly coded software are using the PID to generate "unique" temporary file names and as a main source of entropy: poorly coded software should remain limited to "Hello world" projects and minesweepers ports and should never be used for sensitive tasks. Moreover, weakening the whole OS just to bring a marginal security gain for such software seems really counter-productive. At last, the flaws above show that as long as entropy is concerned, sequential PID would be even more secure than random ones...
Protection against unknown future threats: I do not see the logic behind opening severe current and known threats to protect against potential future and unknown threats...
Race conditions: if it refers to the poor software using the PID to generate temporary file names, then I already covered this point. Otherwise, the flaw above shows how random PID is more prone to race conditions than sequential ones.
OpenBSD already uses it: this is indeed a good explanation regarding the fashion aspect of this measure, but it has nothing to do with security.

I complete my own answer after a more in-depth comparison between the OSes I am the more familiar with and which have taken quite surprisingly different directions...
PID randomization was popularized by OpenBSD which added it as soon as 1997. At that time it pursued two main goals:

Protect against PID prediction vulnerabilities affecting mostly software which use the PID value to generate temporary file names. This was a common concern at that time, but today I think it would be quite rare to encounter production-level software still not using a proper method.

As a general preventive measure, "If something can be random, make it random.", encompassing putting randomness at several places in the OS (from the IP stack to the memory allocation). While some of the protection resulting from this randomness proved to be useful and became more common, PID randomization has a more troubled history.

As detailed in my question, the cure may be worse than the disease. Due to faster PID reuse, fully random PID may allow remotely exploitable flaws, while sequential PID was mainly known to allow local-only exploits.
As a side note, in an ideal world, all this should not cause any issue (yes, I talk of this ideal world where software is free of bugs and vulnerabilities). In fact these vulnerabilities usually find their root in wrong usage of the PID. Wikipedia defines the PID as being a "number used [...] to uniquely identify an active process". Therefore:

A PID is not designed to build temporary file names. Temporary files are usually created in a shared place, and that means danger! Because of this, temporary files must be created using dedicated functions which will ensure that the three required actions (checking that the file doesn't already exists, create it and set restricted access permissions) are done in an atomic (uninterrupted) way. The C language proposes mkstemp() and tmpfile(), and most Unix environments offer a mktemp command to be used by shell scripts, etc.

A PID is not designed to seed a random number generator or generate session ID or cookies. Here again you must refer to your language or environment documentation to get a proper entropy source. On UNIX systems the /dev/urandom device file is there for this purpose.

It is not by accident that Wikipedia definition explicitly states active process. On some language like C, you stay proprietary of the child process' PID until you wait for it, but this is not true for all languages (for instance in shell scripts...) and never true for processes which are not your child. In these cases the PID is just a shared resource, and you should remember that this "shared" notion implies "danger", so must therefore ensure that your take proper care and use the right functions designed to match your situation and needs.

Linux
Linux kernel main stream never implemented PID randomization, however this feature was commonly provided for several years through a security oriented third-party patch which finally decided to abandon it.
Around year 2000-2001, several people tried to implement PID randomization for the Linux kernel (examples can be found here and there), however none of these patches were accepted by the kernel development team who rejected them mostly as "security through obscurity".
However, since randomness may actually increase the global security posture of the OS and prevent some attacks, these kernel modifications finally reached their public through the third-party project: grsecurity.
This project started in 2001, bringing several new and advanced security features to the Linux kernel. It allowed to enable/disable randomized PID using a specific sysctl parameter: kernel.grsecurity.rand_pids. However, in the late 2006 (I guess - I hate news thread mentioning dates with no year!) they finally decided to drop randomized PID functionality:

grsecurity 2.1.10 was released today for Linux 2.4.34 and 2.6.19.2. Changes in this release include:

Removal of randomized PIDs feature, since it provides no useful
additional security and wastes memory with the 2.6 kernel's pid bitmap

OpenBSD
OpenBSD having initiated randomized PID functionality, it is still present for historical purposes but has no real security scope nowadays. It is up to the application themselves to ensure they correctly handle fast PID reuse.
OpenBSD aim is to encourage good development practices and thorough code security auditing. That's why they consider that it is not the responsibility of the OS to protect their users against flawed application. On the contrary an application flaw should be detected as soon as possible and corrected in the application instead of remaining hidden by OS ("The sooner we can break it, the sooner we can fix").
As a side note, while such assertion justifies itself for the base OS which is under direct control of the OpenBSD team, this becomes more disputable with third-party software:

Which do not go through the same audit as the base OS,
While OpenBSD provides and recommends the use of binary packages over ports, binary updates are only provided between OS releases for “security issues or other major fixes”.
Some software versions may be outdated. For each case this might be either a deliberate choice from OpenBSD team or a consequence of the lack of resources in OpenBSD team.

However, in this context OpenBSD team makes the assumption that, for a correctly developed and audited software, the PID generation algorithm chosen by the OS must have no impact (neither stability nor security) on the software behavior. If some software is vulnerable to an attack taking advantage of the PID being reused, then it's up to the software to be corrected, and not to the OS to ensure that the PID are not reused too quickly¹.

¹: For the curious, OpenBSD added in 2013 an hardcoded table storing the 100 lastly freed PIDs in order to limit reliability issues on low loaded systems. However, this does not constitutes a security measure since it quickly becomes effectless with higher loads, would this load be caused by genuine activity or as part of an attack.

FreeBSD
FreeBSD provides a sysctl parameter allowing the administrator to tune the PID generation algorithm from sequential to fully random. It is sequential by default.
FreeBSD implemented random PIDs in 1999 (FreeBSD 4), using OpenBSD as reference, and improved it to let the administrator set a balance between potential issues caused by sequential PID (mostly PID prediction) and potential issues caused by PID randomization (PID reuse and resource consumption).
In fact, FreeBSD design seems quite original since it is not actually the PID which is random, but the PID increment which is a random value taken between 1 and the kern.randompid parameter:

If PID randomization is disabled, then the increment will always be 1,
At maximum this parameter can be set to PID_MAX³, in this case the next PID will be fully randomly chosen.

By default PID randomization is disabled (PIDs are generated sequentially). To take effect, the kern.randompid parameter must be at least greater than 100.
If sequential PID remains a concern, I would personally recommend to set this parameter to a low value like a few hundreds: this should be sufficient to limit trivial PID prediction issues while avoiding more nasty issues caused by PIDs re-use.

³: For the purists it is actually PID_MAX - 100 to cover only non-reserved PID range, it can also be set by using the special value -1. Out of range values are corrected immediately when setting the sysctl parameter so no risk to cause any damage here anyway.


How exactly are new viruses discovered? When Evil McJones develops Virus X and initiates its propagation, what events must transpire for AV companies (and AV testing/validation companies) to recognize Virus X?

This answer to this question gives a brief list of high-level ways the virus can be found:

  Samples are sent in by customers
  Malware detected by heuristic scanners (i.e. stuff that behaves like a virus) is further analysed
  Mail blocked as spam can be analysed for malware attachments.
  "honeypots", which are public servers or email addresses designed to collect malware
  going undercover in malware writers communities

But, what's are the specifics? Are the non-customer initiated means of collecting viruses completely automated? Or, are there N people in a lab trying to contract something?

What heuristics / behaviors lead to a more in depth analysis? And what does the more in-depth analysis consist of? What's the "final marker" of a virus?

... And who names the darn thing?

Most AV companies have a team of analysts that monitor incoming samples collected from a variety of sources.

These sources include but are not limited to:

acquisition of samples from sandboxed machines working in a honeypot
samples sent in via customers either automatically or manually
samples acquired from third parties including competing vendors

The first and last ones are generally the main sources of data.

Most malware collected from these main sources are replayed and actions the malware performs are then recorded. Once this has been done, someone at the AV vendor may end up reviewing it but in some other cases it is completely automatic--it all depends on the complexity of the malware itself, but more often than not it does require someone to look at the file itself.

Naming them is a different story. Some malware ends up getting the same or at least similar name across all vendors but how they approach the naming scheme usually ends up being up to the vendor itself.

Addendum since an edit was made

Since you added an item about heuristics, it should kept in mind that heuristics don't actually work for end users, but they do allow for AV vendors to become suspicious about a file itself. Certain behaviours like a file in a OS directory being edited or a security setting being changed can trip the detection when running in the sandbox.

Sometimes it isn't about what it does on the file system but instead what operating system API calls it makes or even instructions it throws at the CPU too. There are many examples of malware just making useless instructions or performing API calls that just don't make sense--such as a file disguising as a calculator application making calls to the printer spool even though the calculator app doesn't print.

To make matters more complicated, malware authors will also often encode the file using a packer, meaning that the malicious file gets encoded in a manner that requires you to 'unpack' it in order to know what is going on--think of file compression here. AV vendors may struggle with this because certain packers can come from legitimate sources meaning that you cannot take the packing part of the application as malicious because then you could be hosing other legitimate applications making use of said packer. This can make signatures a bit of a pain.


Is it necessary to protect user data if they know and agree to it being insecure? If I'm running a website that, say, takes a survey, must I protect user data from disclosure if the users are informed initially that it's insecure? I'm not storing financial data or social security numbers, just opinions, (user)names and e-mails.

You expect user's to read the agreement? Really? That simply doesn't happen, it's a rare user that reads the EULA instead of simply clicking next or checking that checkbox that says they read it.

These days there's an implicit assumption that you'd going to take some care over what you're doing, in the same way that you expect a surgeon to know what organ to remove, and even if you sign a piece of paper before going into surgery agreeing not to sue if they remove a leg instead of a kidney the implicit duty of care expectation and subsequent publicity nightmare when you're hopping mad on television because they lopped off a leg (pun intended!) would sink that doctor's career for good.


Sending order details in hidden input fields? I'm developing payment extensions for multiple php based eCommerce platforms for a company that has their own payment processor (they just take post request; do couple checks and process it toward a real payment gateway).

Their mechanism is plain and simple (and risky, I suppose). They want me to develop extensions that would, at the end, make a post call to their payment processor like this:

<form method="post" action="https://pp.payment-processor-xyz.com">
<input name="order-amount" type="hidden" value="90.00" />
<input name="order-id" type="hidden" value="1" />
<input name="user-email" type="hidden" value="something@email.com" />
....
....

How do I tell them (or demonstrate, perhaps) that this is risky and that this is can easily be intercepted by a client and altered?

PS: Their processor has no access to merchant's cart inventory, that's plugin's job.

Looking at the details you have provided.Logic attacks can be conducted using burpsuite or any other proxy.The order amount can be changed to any arbitrary value.

P.s:- insufficient details about server side processing and checks.


Time Based Authentication Verification Token I'm building a long-lived session system which requires that users verify their authentication before performing "dangerous" operations, such as changing critical settings, deleting their account, etc. This requirement is analogous to Facebook requiring you re-enter your password before changing your email address, for example. I would like to allow the user to make dangerous changes within some period of time T after verifying their password.

The system will scale horizontally, so remembering "who validated when" in memory isn't possible and I'd like to avoid storing the information in the database, and looking it up on each "dangerous" action. I believe that leaves generating some secure time-sensitive token as my best alternative.

Here's my approach to generating and verifying this token, please let me know if you think I've overlooked anything, or am making some foolish security error. All client-server communication is over TLS/SSL.

1. Alice wants to perform some "dangerous" operation (client side).
2. Alice is presented with a "verify password" modal or similar UI element
   where she enters her password.
3. The client-side system sends the password to the server.
4. The server checks if the password matches Alice's stored password.
5. If the passwords match, a token is generated as follows:
   a. Let `id` be Alice's user ID (UUID), `t` be a fixed length
      string representation of the current timestamp, and `secret`
      be a secret key appropriately protected on the server.
   b. Generate the secure part as `k = (string) HMAC(secret, id + t)`
      (Assume `k` to be typecasted or converted to a string representation.)
   c. Finally, let `token = k + t` where `+` is the string concatenation
      operator
6. Send the token to Alice.
7. For each "dangerous" operation, Alice includes `token` with the request.
8. The server can verify the `token` by splitting `k` and `t` and
   validating `k` as in step 5.b above, and verify that time `T` hasn't
   elapsed since Alice verified her password.

I believe this approach solves the problem. Suggestions? Am I missing something?

I would suggest making t a reduced-precision timestamp instead, where you set the precision to be half of the wish precision. The reason for this, is to both avoid having to send more data than neccessary to the client, which increases security, but also, to be able to filter the data on the server side more effecively, to avoid attacks that rise out of unsafe/tainted input.

So for example, if you want the token to alive for 10 minutes, you make a timestamp that will change roughtly once every 5 minutes.

Using a standard unix timestamp, divide this with the half number of seconds you want the token to be alive for, and strip off the decimal.

So 1466182513, which is current time. Divide it with 300 (5 minutes) and int() it. You get: 4887275

which will be valid from:

Fri, 17 Jun 2016 16:55:00 GMT

to

Fri, 17 Jun 2016 16:59:59 GMT

This decimal value can be included in the hash. So the value 4887275 is effectively a "clock" that "ticks" each 5'th minute.

Now to the trick:
When you verify the hash, you "try" with both the reduced-precision value for the CURRENT time, but also the reduced-precision value immediately before this. This effectively means that the client will be able to do "sensitive actions" anywhere between 5 to 10 minutes from the time when they input the password.

Don't misunderstand this now. What I mean, is that the token will expire anywhere between 5 to 10 minutes from issuance, and this expiry will depend on when, in the timeframe, they input the password.

Eg, in the above example, you try to validate the hash both with the value 4887275, which is from current time, and value 4887274, which is the value for about 1-5 minutes ago.

Of course, you can divide with other values to get other precision, for example 600 to gain a validity between 10 to 20 minutes.

The reason you should try also the timestamp immediately before, is that, lets say a person enter his password at Fri, 17 Jun 2016 16:54:59. Now he has 1 second to carry out his sensitive action, unless we also try the value immediately before.
Thats is why you should select a value half of the wish precision.

This means you don't need to send the timestamp to the client. You just send the hash, as you can easily reconstruct ALL of data in the hash.

A good idea is also to include the session ID in the hash, so the token is effectively invalidated as soon as the user logs out or the session is destroyed for some other reason. Also the password hash is a good idea to include, so if the user changes his password, any tokens become invalid.


Secure an intranet Winform application Is there a need to secure winform application in an intranet environment? Clearly, there is no external threat and only authorized personnel have access to the intranet environment, so I am not sure if there is a need to secure it. Unless it's an insider threat, however, it's still impossible as there isn't any necessary tools available or downloadable within the environment.
The only threat I can foresee is the transparency of my application. Within my winform application folder, the source files were made available to anyone and users might have the ability to understand it and reverse engineer those source files.

Aside from parameterized query or input sanitation, what other threats have I missed out?
How do I better secure those source files? obfuscation?

I want to attack a few of your assumptions. They seem, at the face of it, dubious.

Clearly, there is no external threat and only authorized personnel have access to the intranet environment

Famous last words. How sure are you that no malware may be brought on premises unwittingly, via for instance a word document with a malicious macro, a USB pen drive found in the parking lot or similar? This may give third parties access to your internal network.
If the answer is that the network is secure against such threats due to X, then that should be documented as part of the security model for you application. After all, it's an access restriction.

Unless it's an insider threat, however, it's still impossible as there isn't any necessary tools available or downloadable within the environment.

How is it impossible? None of the computers have for instance Microsoft Office, with the possibility to write VBA macros? Or Powershell? Or the possibility to plug in random USB devices with Python on them?

The only threat I can foresee is the transparency of my application. Within my winform application folder, the source files were made available to anyone and users might have the ability to understand it and reverse engineer those source files.

What are you protecting? What is your asset? An application may be an asset by itself, or it may simply be a front end for a backend database, in which case you may not care if someone modifies or copies your application, as long as integrity of backend is preserved. The approaches in those two cases would be totally different.


If I visit a https site from a Family Safety-enabled computer, and someone drops in on the connection, will I be notified? While reading about Family Safety and HTTPS:

Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is essentially a man-in-the-middle attack.
To consent to such snooping, and suppress all "Untrusted Certificate" warnings arising from this scheme, you need to instruct Firefox to trust Microsoft's SSL certificate that is used for re-encrypting.

the following questions arised:
I asked myself whether Microsoft Family Safety would be a security risk. If I make a connection to https://google.com on a Family Safety-enabled computer, and the google certificate is borked (because someone is dropping in with invalid cert, or because google forgot to renew it), will I be notified? Or will I only see that the connection to Family Safety is good?
So wouldn't online banking from a Family Safety-enabled account be a big security risk? (I didn't see this mentioned in the Microsoft advertisements)
Furthermore, to re-encrypt, Family Safety would need to have the private key for the cert on my personal computer, and on six billion other personal computers, and IE trusts that cert. So a malicious user could use this private key and his servers would be certified Microsoft servers and trusted by IE by default. Correct?

I played around with Family Safety on Windows 8.1, and from what I can tell, it's seems to be smart enough to check the validity of the original certificate before it proceeds to replace it with a Microsoft certificate.

From the screenshot below, you can tell that when I visited Google, Google's real certificate was replaced by the Microsoft Family Safety certificate:

However, if I visit a site with an invalid certificate, it still presents a warning:

So it is pretty clear that if the certificate check fails, Family Safety will NOT replace the certificate and will instead allow the warning to be shown. I tested this in both Internet Explorer and Google Chrome and both display the same behavior.

  Furthermore, to re-encrypt, Family Safety would need to have the
  private key for the cert on my personal computer, and on six billion
  other personal computers, and IE trusts that cert. So a malicious user
  could use this private key and his servers would be certified
  Microsoft servers and trusted by IE by default. Correct?

The family safety certificate isn't being used for website verification, so there's no need to install the same one on every computer in the world. I'd imagine that it is randomly generated and added as trusted when you enable Family Safety (or at least when the computer is installed). Theoretically if someone steals the key for the certificate on YOUR particular computer, the might be able to man-in-the-middle YOU without generating warnings, but no one else.


Is there a drawback for local log in compared to server log in? For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have to manage multiple passwords if he has multiple devices, is there a drawback for the former choice? Also, the app is supposed to connect to internet anyway, so "no internet connection" is not an issue.

You need to clarify your question to get a more helpful response.

Here's the generic answer: storing authentication credentials on a device puts those credentials at risk of offline attack. If a device is responsible for saying it is authenticated, then the somebody may spoof it.

Credential caching is not without merit or precedent. Windows systems perform credential caching for network-disconnected logins.


Risks of deploying MIRAI on my local network for testing? Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What would the safest way to try this be?

Releasing known malware just doesn't seem like a good idea.  A botnet's whole purpose is to engage massive numbers of devices in a coordinated attack - generally the perpetrators don't want it known that they're there and purposefully wrecking devices in the botnet keeps it small, reducing its usefulness.  I'd be more worried about my screwing up and having my devices part of a public botnet than damage to them.

If you're going to insist on doing that, there are a couple things I would make sure I do:

Ensure that the entire network is air-gapped, including wireless
Prevent any use of USB devices on any device there
If you're going to insist on using USB drives, restrict their use to your air-gapped network
Turn off wireless and bluetooth on all devices to prevent their accidental connection to other devices
Reimage everything when done with whatever is going on


SEToolkit Not Cloning Login Page I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo.  I have placed in all the following options

(1) Social-Engineering Attacks
(2) Website Attack Vectors
(3) Credential Harvester Attack Method
(2) Site Cloner

I placed in all of the necessary information afterward. This is the only message I receive

[] You may need to copy /var/www/ into /var/www/html depending on where your directory structure is.
Press {return} if you understand what we're saying here.
[*] The Social-Engineer Toolkit Credential Harvester Attack
[*] Credential Harvester is running on port 80
[*] Information will be displayed to you as it arrives below:

It just hangs after that. I am expecting tons of information to fly across the terminal screen, but nothing happens. I checked the /www/var/ directory as well as the HTML directory and nothing is populating.
This is a very straightforward tool and I have had no problems with it in the past. I do in fact have internet and I can, in fact, access the login page of the site I am attempting to clone. I attempted to clone multiple sites with the same results. I don't know what other criteria is necessary for this process to work as expected. How can I further diagnose this issue? What else can I check?
EDIT: I had to stop apache2. SEToolkit does NOT use Apache. It uses its own HTTP daemon. I had to Google how to turn apache ON in the config file. Please mark this as solved.

I had to stop apache2. SEToolkit does NOT use Apache. It uses it's own HTTP daemon. I had to Google how to turn apache ON in the config file. Please mark this as solved.


Sent and Received text messages that I didn’t send or receive I reviewed my usage detail for my iPhone 6S today online and it shows 3 texts sent from my phone late at night and shortly thereafter it shows that I received four, which I never did.

I contacted Bell and they see the texts but cannot explain why. I was sleeping at the time and nobody had access to my phone, I was home by myself.

Is it possible that someone could have hacked my phone, like an ex, and sent the texts and deleted the ones I received? I’ve read about people being able to have access to your phone without actually physically having the phone.

Note that at one time my phone was left unattended and could have been compromised.

Yes it's possible an iPhone can get hacked to send and receive messages and delete them as well.

It's also possible somebody linked your iMessage account to another device so check what devices are authorized.

Otherwise reset all passwords. Enable 2FA/MFA where possible. Update IOS to the latest version. Uninstall any recently installed apps. Update any existing apps to the latest version. If it happens again restore the phone to factory defaults.


Need example and working Security Token Service (STS)? Can anyone explain or post any link to a simple example and introduction about the
Security Token Service (STS)?

Some posts I've written (.NET based, but basic enough):

http://blogs.objectsharp.com/cs/blogs/steve/archive/2010/10/30/the-basics-of-building-a-security-token-service.aspx
http://blogs.objectsharp.com/cs/blogs/steve/archive/2011/07/04/part-4-secure-architecture.aspx (section on authentication)
http://blogs.objectsharp.com/cs/blogs/steve/archive/2011/02/22/multiple-identity-providers-in-a-multi-tenant-system-using-access-control-services.aspx
http://blogs.objectsharp.com/cs/blogs/steve/archive/2011/01/31/the-problem-with-claims-based-authentication.aspx
http://blogs.objectsharp.com/cs/blogs/steve/archive/2010/10/18/what-makes-claims-based-authentication-secure.aspx


Custom data in SSL certificate I am looking for a way to add extra, custom data in a SSL server certificate issued by a standard CA.  Is this possible?

I want to get a SSL server certificate issued by a standard CA, so that it'll be accepted by standard browsers.  However, I have a small amount of extra data that will be used by my private application that I'd also like to have included in the certificate.  I'm looking for a way to include it in the certificate, in a way that standard browsers will ignore and (critically) that the CA won't strip out.

Is there a field or place where I can store arbitrary data, without it being stripped out by public CAs?

Maybe the otherName part of subjectAltName: will it be preserved by any standard CA?  Should I be looking at a custom x509 extension?

The critical requirement is that for this to be not stripped out or modified by the CA.  I need there to exist at least one CA that's trusted by major browsers, and won't strip out this custom data.  I know that some fields of the certificate signing request (CSR) are filtered or stripped out by CAs, but I haven't been able to find documentation on which ones (if any) allow arbitrary data and will be preserved from the CSR into the final cert.

This question is related, but not the same: it doesn't have the requirement that the certificate be signed by a CA that's trusted by modern browsers.  Also, I've found lots of information about how to add custom extensions to a x509 CSR, but that's not what I'm looking for; that doesn't tell me which extension to stuff the data into (which extension won't be stripped by major CAs).  I know how to create a CSR containing custom data, but I don't know which fields of the CSR will get copied unmodified into the final server cert.  I'm also not looking for a solution that involves running my own CA: I want the server cert to be accepted by standard browsers.  This question also looks similar, but I don't see a clear answer there.

Well, I would contact CAs to ask if they would do it. They could do it, and maybe are willing to do it if you pay enough. Any non-critical fields that broswers do not understand will be ignored and could be added by the CA. The question is if they would do it and that only can be answered by them.

Some CPS even mention the possibility of adding non critical extensions (and thos can be private) and NOT adding, of course, critical private extensions (https://www.digicert.com/docs/cps/DigiCert_CP_v409-1-June-2015-signed.pdf - 7.1.2). Its just a matter of wanting to do it.

  Issuer    CAs shall   use certificate extensions  in  accordance  with
  applicable    industry    standards,  including   RFC 3280/5280. Issuer   CAs
  shall not issue   certificates    with    a   critical    private extension.

But probably the right way to do what you want is using Attribute Certificates. You could have a Attribute Certificate Issuer that you control and issue ACs to your SSL cert giving to it the extra attributes you need and only you understand. TLS has support to providing those ACs to your client or you could send those latter on using the already created SSL tunnel, and those could be interpreted by the client as needed.


How can I identify a machine with two network interfaces as one? When I run nmap on different subnets it finds different hosts. They are identified by their ip and if they are one the same subnet as the scanning device also by their mac address. But how can I identify machines as one, that have different interfaces in different subnets?

There are lots of interesting techniques that others are covering in their answers. Many of these are also discussed in Michal Zalewski's book Silence on the Wire. But the easiest method with Nmap is to use the duplicates NSE script. This uses various methods such as SSL certificates, SSH host keys, and MAC addresses to identify addresses that could be on the same system. It's not foolproof, but nothing really is. New techniques may be added in the future as well. Note that this only works if both addresses are scanned in a single Nmap scan.


Should other processes be running while an iPhone or Android is generating a cryptographically random number? I need to generate a cryptographically secure random number on iOS and Android.  I could use a software approach or leverage the built in OS API for this.

In each case, is it better to generate a secure random number when no other processes are running?

I ask because I'm thinking of displaying an animation during the generation and want to know if the animation will affect the RNG positively or negatively... especially because I'm unsure of how the internal threading model is.

In case it matters (w.r.t. the threading model) in iOS I'm using Objective C, and with Android I'm using an alternative to the Dalvik kernel produced by Xamarin, which has its own threading options.  Regardless, I'm interested in any Dalvik information you may have, since I can interopt with that.

To get randomness, you must obtain sufficient initial entropy from some "really random" events, that come from physical systems. Once you have sufficient initial entropy, you can extend it indefinitely with a cryptographically secure PRNG. The PRNG being a deterministic process, its output is not impacted by whatever other process may run at the same time on the machine.

The OS kernel is in ideal position to collect that initial seed, since it has direct access to the hardware. A good OS will collect hardware events to feed its internal pool, and run the PRNG, and provide an API to get the PRNG output. On iOS, this is the SecRandomCopyBytes() function, that itself reads the /dev/random special file (in iOS, like in OS X and FreeBSD, /dev/random is identical to /dev/urandom). By using it you are already doing fine; it already has all the cryptographic security that you can reasonably hope for; its security won't be impacted by running animations since the initial seed is gathered quite early in the booting process. On Android, use java.security.SecureRandom -- same discussion (it uses Linux's /dev/urandom).

In much older days, some people were talking about Java applets, that, by definition, were sandboxed and could not access the OS to obtain good randomness. These applets thus needed to find random events from other sources, and about the only one that remained was measuring the speed at which the OS scheduler could switch between two threads (e.g. see this code). That thread-spinning method required an otherwise mostly idle machine; otherwise, the produced numbers were severely non-random. Other methods leveraged the user: they asked the user to wiggle the mouse, and the applet would use the successive pointer positions as source of entropy.

Fortunately, these atrocious gimmicks are things of the past (or so we hope... because sometimes, some developers for banking systems get "creative"). For an app on a smartphone, you have access to the OS facilities, so use them and be happy.


Anatomy of a Botnet takedown So Microsoft was partly responsible for taking down the Kelihos botnet back in Sept 2011.  They used a variety of legal and technical measures to do so.  I don't want to get into the global politics and legalities of what legal measures they took, but from a technical perspective, what makes up someone's toolchest when they are trying to take down a botnet?  The toolset must be rather constrained due to the various -- potentially uncooperative -- players.

As a secondary question: Does Microsoft have an advantage on the war on botnets simply because of their ability to push out the malicious software removal update each month?

I'm going to take a stab at this question by pondering some various things I know. Don't take this as advice from a professional who actually works in this area or anything. This is written with what I've heard about botnets in mind, not that specific one. And what I've heard may now be historic. Basically, this isn't a great answer. With these things in mind...

Firstly, most traditional botnets are viewed as three entities from various types of people: the client, the master-client, and the server. The client goes on the victim, the server issues commands, and the master-client is just a spiffy interface to handle the server. Having the executable on the victim's machine as a server that allows a client to connect and control it is what many 'skids' do, but is worthless in 2012 due to decent firewalls being ubiquitous. Therefore, botnets use a system various types call 'reverse connection'.

So if you wanted to shutdown a botnet, you would hit the server, thus killing the ability for the master-client to issue commands to the victims. Sounds great on paper, but not so great when you go to apply it. For example, a lot of botnets are P2P, so there's no centralised control, or at least not one that's easy to locate. Some can detect when a server has been knocked off and then automatically start up a new one elsewhere. You could have servers managing servers managing servers, each step being done through layers of masquerading indirection. You get the idea.

Many botnets have updating features. That is, the server can issue upgrades to the client executable on infected machines. These updates may have new ways of bypassing newer heuristic scanners, for example. So one way to eliminate the botnet would be to get control of the server and issue an update that replaces the infecting client code with an empty executables across all of the victims. Just an idea...

I read a book by Symantec a while back (forgot the name). It detailed a process where anti-malware companies have vulnerable machines connected to the Internet purely to get infected so they can check out what's floating around. So perhaps a fad botnet would infect one of these machines, and then the company can check where the commands are coming from. Naturally such commands would go through dozens of layers of indirection, but it's a start, right?

Here's another idea: maybe such companies got a person into the areas where such botnets are developed. Private forums and the like. Crackers love to brag about their prowess, boiling all of their achievements down to an ego trip. It's pretty obvious how this can go wrong for them.

Also, you have different categories of people who write these nasty things. The herders, the researchers, etc. I don't honestly think all of them fit into this, but it's a good way of looking at it. So there may be multiple responsible, which complicates a permanent takedown.

It takes one person of technical prowess to make a new aspect that dozens of script kiddies then employ on their malware like botnet clients. RunPE, for example, was probably actualised by a geek who had no intention of infecting, but was then used by the kids since the said geek provided an easy-to-use interface that the kids could comprehend.

So when you do find those responsible for a botnet, no doubt a lot of the contributors get let off the hook. Who do you blame primarily? Anyone's who code was used in it, and that such code was specific enough to be /only/ used for nefarious purposes? Or Just the main coder? I don't know to be honest.

Sorry for this ramble. I was just pondering how botnets might get taken down in general =)

EDIT: To answer your second question, security updates can render a piece of malware completely inoperable from only a small tweak in the system. Malware is often highly specific to certain setups.

Windows is the top target of malware, so Microsoft being the official updater of it means they have a lot of power to get rid of the botnet clients. Not only by rendering botnet clients inoperable with system changes, but also by updating their security software like Malicious Software Removal Tool to pick such malware up.


Is a self-signed SHA-1 certificate sufficient security for a company transmitting sensitive data? We recently decided to pay an ISP (a substantial sum, mind) for a managed internet service up to and including the router in our head office.

Part of the initial discussions made it clear that whatever solution the ISP thought was best it had to include a VPN as various members of staff are on the road a lot, coffee shops and trains and the like.

The ISP delivered a VPN solution in the form of Cisco AnyConnect which keeps showing security warnings as the certificate is self-signed. The certificate is also SHA-1.

1) My main question is this. Is this adequate security for a paid-for solution?

2) My second question (although it may be out of place in this area of SE) is this. Is it reasonable to assume the ISP would provide an adequate solution certificate given that the sensitive nature of the data we transmit was divulged to them?

Use of SHA-1 is irrelevant here.

The problem with a self-signed certificate is that there is no way for anybody to verify that the certificate is the correct one or not; this is exactly what the client warnings mean. When one of your staff sees the warning, and he clicks through to connect nonetheless, then that user could be connecting to a fake VPN server, ran by an attacker, who could then forward the data to the true server but also inspect it as it goes: a classical Man-in-the-Middle attack.

One may even say that with the self-signed certificate, you are training your staff to disregard warning messages, so, in all generality, you have lowered your security.

One way to fix the problem is to install the VPN certificate as "trusted", explicitly, in each client machine. This means that you instruct the client machine to accept that exact certificate as the right one. The Cisco documentation should tell you how to do it.

Another method is to have the ISP buy and install a certificate obtained from one of the "commercial CA" that existing machines already trust; this is the same kind of certificate as what you need for an https:// Web site that does not insult its users. This is traditionally known as an "SSL certificate" and you can have one for a few dollars per year (even for free with some CA).


Help me understand this adware (compute-1.amazonaws.com) I ran TCPdump on my Macbook and saw a lot of communication going back and forth between 10.239.68.143 and compute-1.amazonaws.com.  I looked up my private IP address with ifconfig and found that that address is indeed mine and not someone else's.  I also did a Google search on compute-1.amazonaws.com and it looks like it's an adware that infects certain web pages.  Apparently whenever I have certain web pages open, those pages are sending messages back to the amazonaws server.

I would like to understand this adware better.  I want to understand how to get rid of it, but I also want to understand how it works.  What exactly is it doing, and how can I tell which page it is that's infected?  What is this adware?  Is it basically a virus that infects web pages?  Also, is there any way of knowing where the adware came from, how it got on my computer?

compute-1.amazonaws.com  is just part of the amazon cloud services. Anybody can rent resources there so that domain is not necessarily associated with adware although of course it can also contain adware, malware but the majority is probably benign.

  Apparently whenever I have certain web pages open, those pages are sending messages back to the amazonaws server.

It is very common that companies rent resources in the amazon cloud to easily adapt their computing power to the current load. It is nothing to worry about and it is not an indicator that you are infected with adware or malware. See also What is s3.amazonaws.com, and why is Chrome blocking it? for a similar question or read here for details about the amazon cloud services.


Downside of allowing uncertified Certificates I've seen Firefox poping up the message "Untrusted Connection" where self signed certificates are involved.

However, I could not understand what the following means (in bold) :
XXXX.XXXX.XXXX:8443 uses an invalid security certificate.

The certificate is not trusted because it is self-signed.
The certificate is only valid for DI-PRE-UFCG

(Error code: sec_error_untrusted_issuer)

Also firefox shows the following under "I understand the risks"
If you understand what's going on, you
can tell Firefox to start trusting this site's identification.
Even if you trust the site, this error could mean that someone is
tampering with your connection.

Can anybody please explain what does tampering with connection in this scenario mean ?
Also what does valid for DI-PRE-UFCG mean ?

Thanks in advance

The purpose of certificates is to prove the identity of the remote party you are communicating with. Failing this would make it possible for impersonation to take place: active MITM attackers could intercept the traffic and alter it to make it pass as their own.

It's quite similar to verifying someone's identity by checking a passport. Suppose you want to verify the name of the person in front of you, who is showing you a passport.

You want to verify that you trust the authenticity of the passport itself. A local sports club membership card might not be enough. Checking this aspect of a certificate is what building a certification path to a trusted CA in the PKIX specification (RFC 5280/RFC 3280) is for; it also provides other aspects such as what purpose the CA was willing to allow it for.
You want to verify that the passport belongs to the person whose identity you're trying to check. (In this analogy, the server name is more akin to the person's picture, since you're trying to find the person's name, knowing what they look like (*).)

It's one thing to trust the the passport is real, but it should be issued to the person who is claiming its usage. Failing that, anyone who has got hold of a passport of a country you recognise could claim they're anyone in any country you recognise.

In the HTTPS world, this is done following the rules in RFC 2818 (Section 3.1), and more generally in SSL/TLS in RFC 6125.
The last point is not strictly part of the certificate verification itself. You want to verify bind the picture in the passport to the person in front of you. In this analogy, the picture to person link is ensured by the authenticated key exchange in TLS, which guarantees that the remote party has the private key matching the public key in this certificate.

Having performed those three steps successfully, you can then bind the name in the passport to the physical person in front of you.

Certificates in SSL/TLS have the same role: you want to make sure the certificate comes from a CA you trust, make sure that it's issued to the server you want to communicate with, and make sure you're talking to the party to which that certificate was issued.

More specifically in your example, the certificate was issued to DI-PRE-UFCG, which is a different name to the one you're trying to contact and sec_error_untrusted_issuer indicates that the browser doesn't even recognise it as issued by an entity it trusts (which makes sense for a self-signed certificate that wouldn't be imported explicitly).

(*) I'm only making the analogy in that order because it's more natural in practice in my experience. You rarely start off by looking for a specific person by name, given a crowd and their passports, but this could make sense in some circumstances. You would have similar problems if someone had multiple aliases, but the one you're looking for wasn't the one of their passport.


How to check if my usb drives are vulnerable by BAD USB Mark pointed out that only one chip type is vulnerable to BAD USB, id like to check if mine are, am using only Kingston flash drives here so can you tell me if they are, or if there exists a list somewhere i could check this? thank you.

You need to determine what flash controller your device has. Different devices may have different controllers even if they have the same manufacturer - it seems to only depend on what the factory had at the time.

One way is to disassemble the device and read the label on the controller chip

Another (non-invasive) way is to use software such as ChipGenius. This can be found via Google on a number of Russian sites. Make sure to check your copy for malware. "usbdev.ru" is one source of usb software/firmware programming files.

After you know the controller in use, you can search around to see if it is vulnerable or use / modify the manufacturer's firmware flashing tool to flash your own firmware onto it. If you succeed then the device is probably vulnerable. If afraid of "badusb" I would avoid micro-controller based memory controllers and stick to those which use single use chips.

Similar research was performed into flash memory in SD cards a while before "badusb" emerged and this CCC talk is quite interesting. It explains the reasoning behind using micro-controllers because of flash quality / economics. Much of the information applies to USB flash drives as well.


How is it possible for boss to know I am finding a job? Today, when my boss talking with me, he suddenly said: No you don't need to worry about it, everyday you have 3 or 4 messages with agent in Linkedin right?
I am very very surprised, because :

I work at home.
I don't use VPN.
I use Linux (Ubuntu) system which installed by me.
I login with my Chrome / Gmail account.
I use my personal outlook.
everytime I talk with interviewers, I use my Zoom account.
I use myself mobile phone, my sim card.

The only thing is I daily use laptop provided by company. But as a 15 years IT engineer, I can not see how possible company can view my data. Especially he know there are 3 or 4 people I talking with everyday.
The only possible is is there any possible Linkined provide service that would send my data to our company?

Your boss is likely making assumptions. They can't read your messages on LinkedIn (unless you have your inmails forwarded to your work email and your company is monitoring your inbox....unlikely)
The data LinkedIn publishes suggests that 80% of its users are open to hearing about new career opportunities and these days if you can even spell security then you're likely already getting many inmails with recruiters hitting you up for jobs.
I think maybe your boss is just probing....Don't address it, it's not their business.


As a Software Industry Editor, how to avoid my software being quarantined? I'm a well established software company. For more than 30 years, my business has been delivering both hardware and software.

My Windows software is being quarantined by some of my customer's antivirus.

How I handle it, up to now, is that I have been asking Symantec to whitelist every single executable binary I build, but this is a real pain because :
- I don't know inadvance which AV provider my customer will use, so I should also tacket with Kapersky, MS ...
- The whitelisting request could be denied by the AV provider, making my customer not to be able to use my software, unless the customer creates manual exceptions. And many Tier-1 customer will definitely not accept this.
- The whitelisting process is manual, and lengthy

From my understanding, signing the installer/executables would probably help, but with no guarantee.

What is the ideal procedure to gain reputation and being able to deploy installers/executables not being quarantined ? How do new software editors make it possible to deploy their applications without being quarantined ?

It's difficult to find a "one-size fits all" resource on the Web, all are AV specific.

Most AV vendors have some form of a "Trusted Software Vendor List". Any binary signed by a vendor on this list automatically gets trusted, so you do not have to beg for each binary to be whitelisted. Symantec had one but cancelled it.

Some AV vendors will adjust their detection score if you simply sign the binary (which is a little scary, in and of itself).

You are correct, there is no one-size-fits-all solution. And there shouldn't be. Think of the opportunities for abuse if there was some kind of central list or a universal way for a new binary to be automatically whitelisted by all products.

If your software performs risky functions, then it is legitimate for AV to protect the system from it.

There might be ways to make your process more efficient, though. You could submit a non-production version your new binary to VirusTotal and then go through the process for each product (apply for whitelist, submit a "false positive" report, etc.) that pinged on your binary. If you submit a production version, then the hash of that binary might be quarantined faster in the field by your customers.


UPS my choice -- How can I access my public records? I was signing up for UPS my choice and they asked me some security questions.
It asked me questions that signified that it was able to figure out:

Who my father is and when my father was born.
My past addresses.
What year I graduated high school.

I called up UPS technical support and they told me this information is pulled from public records. The information they had was: My Name, my address, and my birthdate.

These questions seem completely useless from a security standpoint. If they can obtain that information, so can another person. In order to better understand this security concern, I was hoping someone here can tell me more about these records.

These kinds of things are a little odd from a security stand point, but they do add a slight bit of value if they are not the exclusive mechanism used.  The idea is that they should be giving a limited time to respond to the question and pull from a broad enough set of information that it would be difficult for someone other than you to have the information all at hand when it is needed.  It certainly can be fooled and shouldn't be relied on as the only method of verifying identity, but it's at least a little harder than simply saying "yes, I'm me."


How can a router or my ISP protect against phishing? I see a few services advertising the ability to protect against phishing and ransomware attacks. ISPs sell services which supposedly protect you and some routers like Check Point 700/900 series. Is this real? How does this work? If I download malware/ransomeware or am sent a phishing email - that's likely TLS encrypted. Can the ISP/router decrypt and scan such traffic? Or is what they're advertising only for non encrypted traffic or just doesn't work?

In general, phishing attacks comes on emails, and the majority of ISPs gives you email services for you in their platforms not on the home routers (in general). So the email services are hosted and process by your ISP, that is normally how ISPs protects you from that types of attacks.

For phishing attacks normally they have antispam/antiabuse systems that allows them to filter domains, ips, suspect emails and so on


How does Facebook avoid crawling over their site? I used Netsparker community edition and tried to find a vulnerability in my personal site.  Then I thought let's try with Facebook.  It didn't show a single webpage also because normally it shows links inside the website, whole site structure but here it didn't.

Why? What is the reason?

Other than the user's privacy settings, Facebook doesn't inhibit spiders. My scans show they are not even using a Web Application Firewall to block requests. The load to scrub every HTTP request of the most popular website would be massive undertaking.  The problem is that your scanner isn't equipped to interact with a mostly JavaScript client communicating to a REST backend.  Netsparker is also unable to detect DOM Based XSS,  which is more common on facebook.


SSH Security allowing only certain users to connect to the server I have set up a remote ssh server on the cloud. I am newb at these things and have managed to bypass the required firewall using SSH. Now I plan on giving the access to only 2 more friends of mine so as to share the costs of data transfer so that only 3 users at max can connect and only the friends. So my question is that How can I achieve this?

The server is running Ubuntu Linux. Also, the college has a static IP so each one gets a proxified IP. Is there any way that I can do MAC filtering over the Server?

Also, if you insist on using SSH KEYS, then would they restrict access if someone just copied the key and used it?
Please also suggest a way, if the MAC spoofing could be bypassed?

You can't do MAC filtering unless all the clients are on the same network segment as the server (i.e. no router in between). This is not the case here; the server has no way to know the client's MAC address.

You can set up an IP-based filter with iptables (Linux's low-level firewall configuration command) or with one of its numerous frontends such as ufw, which the official firewall tool on Ubuntu.

Here's an ufw example, assuming you want to allow only addresses of the form 192.0.2.x and deny all other incoming connections:

ufw default deny incoming
ufw allow proto tcp from 192.0.2.0/24 to any port 22

This blocks connections before the SSH server even sees them. You may impose additional restrictions in the SSH server configuration. For example, you could allow the pranav account to log in from anywhere, and users in the friends group only from 192.0.2.x, and other users not at all. You can do this with the following configuration in /etc/ssh/sshd_config:

DenyUsers *
AllowUsers pranav
Match 192.0.2.0/24
    AllowGroups friends

You cannot prevent someone from giving their password or key to another person. If your friends do that, tell them they can't be your friends anymore after such a breach of trust.


SSH MITM on new host If you are connecting to a new host for the first time, what is to stop an intruder from performing a MITM attack: swap out the public key and fingerprint for a public key they have the private key to and the fingerprint of that new Pub-key? Thus getting all the information, so the user never actually connects to the correct server,since there is no form of PKI with certs. Is this mitigated somehow?

If you connect to a totally unknown server, you can indeed be victim of a MITM where someone gives you the fingerprint of a key-pair he controls.

However, the way to go is: setting up the server, get the public key's fingerprint. Then you can validate the fingerprint you see on connect matches the fingerprint you know from the server. If someone were to perform a MITM your client would show a different fingerprint.


Anti-live forensic programs Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example).

I was wondering do software exists against live forensic ? Can you give me a list for windows and linux (the most popular) ?

What other ways there are to protect themselves from this type of "attack" ?

For example EnCase ® Forensic is used by law enforcement for live forensic (inter alia).
http://media.govtech.net/Digital_Communities/Guidance_Software/EnCase_Forensic_for_Law_Enforcement.pdf

I assume what you mean by "live forensics" would be what the infosec community usually refers as memory forensics, eg. taking your machine while it is active and unlocked and proceeding to dump all data from it.

The solution to your problem would be twofold:

First you need to have good physical security, so that attackers can't access your unlocked computer.
Secondly you would need to make sure that attackers can't get access to your machine remotely too. SELinux might be helpful here.

So to TL;DR it for you:

"Live forensics" requires a live system (duh). If someone has access to your live system you have already lost.

If you really worry about government agencies then you should start by educating yourself about your local laws and your (local) personal rights (as rights appear to be quite non-consistent across the globe) and make an effort to stay within their bounds.


How to use CIS Benchmarks without being a CIS member I am trying to audit my Linux systems with the CIS security benchmarks. There are OS tools like OpenSCAP or Lynis that can do security-related benchmarks, and come with some benchmarks which might be close to the CIS benchmarks but are not the same.

Has anyone gone through the chore of converting the freely available Benchmarks in PDF form and converted them into something that can be fed to OpenSCAP or Lynis and made the result publicly available?

I have searched but could not find something, but maybe I have overlooked something.

I checked the legal side of things - which basically explains why I could not find anything useful. In short: You cannot use CIS Benchmarks and call them CIS Benchmarks without being a member.

Quoting from the "Terms of Use" of one of the PDFs that are provided freely:

  Terms of Use
  This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Public License. The link to the license terms can be found at https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode
  To further clarify the Creative Commons license related to CIS Benchmark content, you are authorized to copy and redistribute the content for use by you, within your organization and outside your organization for non-commercial purposes only, provided that (i) appropriate credit is given to CIS, (ii) a link to the license is provided. Additionally, if you remix, transform or build upon the CIS Benchmark(s), you may only distribute the modified materials if they are subject to the same license terms as the original Benchmark license and your derivative will no longer be a CIS Benchmark. Commercial use of CIS Benchmarks is subject to the prior approval of the Center for Internet Security.

[emphasis mine]

In short: If I transform that PDF into some sort of script, I can no longer call it "a CIS Benchmark". Also, no commercial use.

So if you really need your asset to be CIS benchmarked, there is no way around a membership. Cost-wise it's not as bad as I thought, but might be difficult for very small organisations.

Tenable publishes a machine-readable form, however it also has a restrictive license, so again, there is no way around paying.

If its "just" security that one is interested in, there are, of course, various good alternatives (see question), and a lot of them seem to be CIS inspired (or the other way around). But in our case, our customers were asking about CIS, so we need to get a membership.


Block SYN,ACK response with iptables I have a virtual environment and I am making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020.

I realized that a countermeasure for this attack is to limit or block the responses to the SYN packets, which are the SYN,ACK.

But how can I do this with iptables?

What else should be done to prevent that kind of attacks?

Blocking the SYN,ACK response is not the right way to go about SYN flooding. Every TCP 3-way-handshake starts with a SYN. If you block the SYN,ACK response, no client will be able to successfully connect to your server anymore.

I recommend reading up on SYN flooding and prevention techniques in this Hakin9 article. The key mechanism, if you want to solve it with an iptables rule set, is limiting the rate of SYN requests from a single IP. The following is a suitable configuration, although you could of course have false positives, if a get a lot of legitimate requests from a single IP address (e.g. if there is a large network behind a NAT).

# iptables -A INPUT -p tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 20 -j DROP
# iptables -A INPUT -p tcp -m state --state NEW -m recent --set -j ACCEPT


How to handle disk encryption for remote connection? I have at my workstation, an ubuntu 14.04 installation with full disk encryption. I now have to travel frequently for days and am planning to ssh into this machine from my chromebook to work remotely.

I don't have any guarantee that this machine will never be shut down(the cleaning staff may do so). On rebooting the system asks for encryption password everytime while booting up, which I guess will not be possible to do remotely (as I believe the networks and especially sshd will start only after reading the encrypted disk/booting). How can I tackle with this situation? Is it possible to continue with the encrypted HDD? Or if not, how can I remove HDD encryption (if possible, which I doubt)

You can use dropbear ssh to ssh to your machine and then unlock the LUKS volume. There's a tutorial here which can assist you with setting up.


What to do when GSM/Wifi is jammed and ethernet cables are cut? So.. There are household alarm systems (to defend against burglars) which send  SMS/e-mail alerts if an intruder has been detected or an alert is trigged.

However, Mobile networks can be jammed, and the phone lines and ethernet cables can be cut. Also wireless networks like WiFi (which rely on the hard-lines anyway) could be jammed too leaving the alerting in a useless state.

Is it possible that an attacker with low budget tools can stop the system sending alarms?

How can this be avoided? Are there any communication solutions that cannot be jammed or DoS'd?

No, there is no way to communicate without being jammed.

You can create redundancy so that the system has several ways of communication. If the system detects that any one way is jammed it can send an alarm another way.

Another possibility is to send the alarm from an external system. Your alarm system regularily contacts the external system sending a status and the exteral system sends an alarm if either a message indicating an alarm is received or it receives no message for some time.


Can you establish a weak/common password policy in Active Directory in line with NIST guidelines? Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations:

https://pages.nist.gov/800-63-3/

I'm not an Active Directory expert, but from what I read so far, this should not be possible with AD alone. You might want to take a look at this Microsoft article. It explains how password polices are set up and all that. There is no mention of password dictionaries or blacklisting.

I also found this (mabye outdated) answer in the Windows Server forums. The accepted answer there also says, that this is not possible. This is a post from 2011 though.

There are third party tools which claim to accomplish this. I have no idea if these will actually work and I don't want to advertise them, so I won't link them here.


Is a substring of base64 encoded random_bytes less secure then just using random_bytes $bytes = random_bytes(15);
$encoded = base64_encode($bytes);
$output = substr($encoded, 0, 15);

Does this code affect the complexity of the output vs just using

$output = random_bytes(15);

I think it might because a in base64 is YQ== and thats more letters
If it does affect it please tell me by how much

If you have 15 random bytes and encode these as base64 you get 20 bytes since base64 encodes 3 bytes into 4 characters. If you then take only the first 15 bytes from the encode 20 bytes you thus use only 3/4 of the original 15 bytes, i.e. 11.25 bytes - or 90 bits. These 90 bits are definitely less  than the original 120 bits (15*8).  How this effects the security depends on your specific (unknown) use case.


Detecting USB-based(Arduino Leonardo) attacks Can a USB-based atack, e.g., BadUSB, RubberyDucky be detected by observing the output from dmesg?

I bought a brand new DFRobot Beetle, which is essentialy a miniaturized Leonardo.
A few seconds after plugging it in, the USB keyboard I'm using stops working. It's possible that it may have been caused by low power, but checking the output from dmesg, I noticed that the device is detected and disconnected three times without being physically moved.

What is most interesting is that Mfr and product changes twice:

  [Tue Jan 15 09:42:54 2019]usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0

  [Tue Jan 15 09:43:18 2019]usb 1-1.2: USB disconnect, device number 6

  ...

  [Tue Jan 15 09:43:19 2019]usb 1-1.2: new USB device found, idVendor=2341, idProduct=0036

  [Tue Jan 15 09:43:19 2019]usb 1-1.2: New USB device strings: Mfr=2, Product=1, SerialNumber=0

  [Tue Jan 15 09:43:18 2019]usb 1-1.2: USB disconnect, device number 7

  ...

  [Tue Jan 15 09:43:19 2019]usb 1-1.2: new USB device found, idVendor=2341, idProduct=8036

  [Tue Jan 15 09:43:19 2019]usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3

In addition, idProduct also changes briefly.

Initially, I thought maybe the had become loose and so was detected several times, but after rebooting and checking dmesg again, it was not shown to be disconnected even when I wiggled the device around in the USB port. The second set of values, i.e., Mfr=2, Product=1 and idVendor=2341, idProduct=0036 also never show up.

Is all this normal or is this possibly signs of a USB-based attack?

What you describe is pretty normal. I would suspect that the device has a driver that is installed upon initial connection. When a driver is installed it can disconnect device a few times. After the device driver is installed it will then be properly recognized hence no more installation and disconnections. You can always remove the driver, and debug USB port to see what is happening in the background.


Test suite for a white-box fuzzer I have created a white-box fuzzer by extending the Crest.

Now, I'm looking for a test suite (a set of c programs with known vulnerabilities) to test the functionality of my tool.

where i can find such benchmarks?

Have you tried the Metasploitable? https://community.rapid7.com/community/metasploit/blog/2009/03/22/vmware-virtual-pc-and-fdcc-images

Also, you could try making your own applications, they aren't difficult to make:

#include <stdio.h>

void call_me()
{
    system("/bin/bash");
}

int main(int argc, char **argv)
{
    char in[20];
    setresuid(5002,5002,5002);

    strcpy(in,argv[1]);
    return 0;
}

Something like the above is all it takes for application vulnerabilities.


How to gain credibility for your application? Let's say that you have built an application. It doesn't really matter which type of application but the security of the application is a very important feature.

How do you proceed to gain some credibility that your application is secure?

Of course, you could just say "yes it's very secure because it uses state of the art encryption (plug algorithm name here) and ..." but that's just hearsay. You need some kind of better proof right? So, what can help to convince others that your application is secure?

There are several popular approaches to this.

First, is getting an independent, 3rd party auditor to vouch for you. This is most effective if it is done by a well-known name (e.g. get Troy Hunt to vouch for you, or Charlie Miller if you're on Apple's OS), or a huge household name (if your target market are non-technical / non-security folk) - e.g. E&Y, or Accenture.

Taking this a step further, you can get accredited by a 3rd-party regulation or certification. This is possibly the most popular, and IMO likely the least effective.
This could range from PCI-DSS (which you would have to do anyway if you handle credit cards), through to the infamous "HackerSafe" (I think its called "McAfeeSECURE!!1!" now). Either way, it doesn't actually show any real quality, and in some cases is easily spoofed. cough cough

There is a third option, which is much more difficult to do right, but a lot more effective particularly with those that most understand what this means. This option requires two steps:

Actually being secure, and having a strong process to ensure this;
Sharing details of that process, and what it actually entails.

Being secure is a much wider question and out of scope of this answer; sharing the details is obviously much less common in big corporates, though I am starting to see this in more startups and even larger, but technical, enterprises.

This could include information about your SDLC; explanations of your security requirements; technical details about your implementation; possibly an open bug bounty, but at least a statement of response to researchers (and follow through!); maybe even opensourcing your codebase, if relevant; and so on and so on.

Obviously you would need an experienced security expert to help you get your application to be secure; a very good one could help you "open the kimono" in a productive, yet secure, manner. Done right, this could even increase marketing efforts, and still not reveal any sensitive details that could help an attacker bypass your controls.

Interestingly often old-school security pros (especially those with a corporate background) will insist on not revealing anything; but not only should this not at all increase your risk or attack surface (if done right), it can definitely help allay any potential customer fears or worries, especially if they understand what they're reading.
Just make sure you have someone who knows what they're doing.


Check signature of an HTTPS response So I want to do the following

Check the RSA public key of a https server
Make a GET request to that server
Get a response+signature from the server
I should be able to check if ANY reponse+signature pair matches the publickey.

I was able to get the public key based on another qeustion https://security.stackexchange.com/a/16091
openssl s_client -connect the.host.name:443 | openssl x509 -pubkey -noout

But I don't know how to get a signature on the response message.
Is it possible? Do I need to specify a request header with curl? Am I missing something?
The reason I need this is because I'm trying to setup a smart contract (blockchain), with the public key stored. People will send messages and I want to be able to check the messages come from server.

So I want to do the following

Check the RSA public key of a https server
Make a GET request to that server
Get a response+signature from the server
I should be able to check if ANY reponse+signature pair matches the publickey.

There are a number of problems with what you are proposing, as I see it.
First, the RSA private key is not used to sign application data. The TLS handshake sets up a shared symmetric encryption key to protect the data. Furthermore, the integrity of this data is not protected by signing it, it is protected with a MAC that is performed on the application data prior to encryption (MAC-then-encrypt).
Second, The GET request is an application-level HTTP request ("application layer" in the TCP/IP networking model). Similarly, the response (at that same level) is a HTTP response. Neither the request nor the response are encrypted at the application level. The encryption happens via TLS which is "in-between" the application and transport layers. But, like I mentioned above, these individual application data blobs aren't signed by the RSA private key.
If you want to dig in a little deeper, use Wireshark to observe a connection to an HTTPS website. You will see a TLS "Client Hello" as part of the connection setup (this is part of the handshake that sets up the symmetric encrypiton channel). Then you will see a bunch of TLS protocol "application data" blobs. Prior to decryption it will not be clear which correspond to a given HTTP request or response.


Content-Type and Code Execution I just got a message from a security guy that my application is executing remote code if they pass a Content-Type: image/asp. For now he does not disclose anything. Now my question is that if I am using ASP.NET 5 MVC application using IIS webserver on Windows Server 2012 R2, does any can send a specific content-type to web server in order do remote code execution?

Yes any one can upload file with Malicious Code
to make remote code execution, stored XXS or OS injection
read this answer
MIME Type vs. Magic Numbers


What are the risks of not patching a server or hypervisor for Meltdown? The patch for Meltdown is rumoured to incur a 30% performance penalty, which would be nice to avoid if possible. So this becomes a Security vs Performance risk-assessment problem.

I am looking for a rule-of-thumb for assessing the risk of not patching a server or hypervisor.

From reading the whitepapers, my understanding is that you definitely need to apply the patch if your machine:

is a workstation that runs random potentially malicious code - including, it turns out, java script from random websites,
is a VM that could potentially run malicious code (which essentially becomes the first case).
is a hypervisor that runs untrusted VMs next to sensitive VMs (which essentially becomes the first case),

My understanding is that the risk is (significantly) lower in the following cases:

server running on dedicated hardware running a tightly-controlled set of processes in a tightly-controlled network (including not using a web browser to visit untrusted sites)
VM running a tightly-controlled set of processes on a virtualization stack of other tightly-controlled VMs, all in a tightly-controlled network.

Is that logic sound, or am I missing something?

UPDATE: early adopters of the patch in Azure are reporting no noticeable slowdown, so this may all be moot.

Related question:
What are the risks of not patching a workstation OS for Meltdown?

Basically, if you run code from untrusted sources on a machine that has data you don't want that code to have access to, you need to patch.  Desktop computers should be patched because they've got an unfortunate habit of encountering untrusted code; shared-hosting servers, particularly virtual private server hosts, must be patched, because Meltdown lets one user access every other user's data.

Note that the Meltdown attack cannot be used to break out of a virtual machine.  You can break out of a container, sandbox, or a paravirtualized system, but performing the Meltdown attack in a fully-virtualized system just gets you access to that VM's kernel memory, not the host's kernel memory.


Secure end-to-end when part of conversation must be over HTTP We have a situation where a user's identity can be verified as follows: the network provider knows the identity of the user and injects secure headers into the HTTP request, which our servers can use to authenticate the user.

We're writing client-server applications and want to use this mechanism to automatically authenticate the user. We can't use HTTPS end-to-end for the authentication request because obviously the network couldn't inject headers in that case.

EDIT: roughly equivalent setup:

(client <-VPN-> HTTP proxy) <-internet-> our server

Assume the VPN (bold section) is secure and the user is authenticated within in the VPN.

The client generates a HTTP request. A proxy within the network knows the client's identity and generates a token which is automatically added to the headers in the proxied HTTP request. All of this happens in a secure domain and cannot therefore be compromised. (Unfortunately we can't change anything in the VPN setup, such as have the proxy make a HTTPS request instead.)

Our server can query back to the network (securely) to determine the identity of the client who initiated the request.

Assumptions:

This HTTP requirement is a given and can't be changed.
An attacker can't fool the identity verification process by presenting fake headers.
An attacker might be able to otherwise intercept/compromise the HTTP request/response.
Server is stateless (so no storing one-time keys server-side).
Storing a private key in the client application is not an option as it could be compromised
The HTTP request/response will be used auto-authenticate the user, but all other interactions before (if necessary) and afterward will be over HTTPS.

Here's what we've tried so far:

Client fetches a public key PK from server over HTTPS
Client generates a symmetric key SK
Client encrypts SK using PK, and sends this to server over HTTP
Server verifies user's identity and generates authentication token AT
Server encrypts AT using SK -> E(AT,SK)
Server signs E(AT,SK) using its private key and sends to client
Client uses PK to verify signature
Client uses SK to decrypt E(AT,SK) giving AT
Client uses AT to authenticate all subsequent HTTPS traffic.

(And we should probably use separate key pairs for encryption and signing, but let's ignore that for now).

As far as I can see, this is secure against eavesdroppers (as they won't have SK) but if a malicious attacker can modify the HTTP request, there is nothing stopping them from generating their own symmetric key instead of SK, encrypting it with PK, replacing the request payload with that and the server will have no idea that it's not talking to the real client. The server will then happily encrypt a valid AT and send it back to the attacker who can then proceed with impunity.

Is there a way to shore up this hole? Is it even possible to do this with a stateless server?

EDIT: if the server can detect tampering and abort the authentication process, that would be sufficient. "This is not possible because X" is also a valid answer, if it can be demonstrated.

Why can't it be changed?  You can use an HTTPS proxy where the user connects via SSL to the gateway adding the headers and then relays the communication on to your servers, also over SSL.  You can't have one SSL connection the entire way though, but that doesn't mean you can't have SSL connections for each step of the journey.

Otherwise, you are effectively asking an impossible question because you want to have a secure connection between you and the client, but want someone else to be able to be a man in the middle and modify what you are sending.  Those are mutually exclusive goals unless you make it so that the intended man in the middle can be in the middle of the communication.


What is the purpose of "gibberish" comments posted to my blog? Fairly frequently, the contact form on my blog gets comments that look similar to this (each field represents a text box users can enter into the HTML form on the blog):

  Name: 'ceguvzori'
  Email: 'gwizwo@avbhdu.com'
  Website: 'QrSkUPWK'
  Comment:

vaB5LN pepddqfgpcwe,
[url=http://hvyhfrijavkm.com/]hvyhfrijavkm[/url],
[link=http://cwiolknjxdry.com/]cwiolknjxdry[/link], http://ubcxqsgqwtza.com/

I'd consider them to be spam, but the sites they link to don't exist, so they aren't helping SEO or spreading malicious links. Not even the email host, avbhdu.com, exists. What is the purpose of these comments?

They're probing your site. First,  whether the comment will be published. Second, note how they use several popular syntaxes for links - it's an attempt to check which of them will result in an actual HTML link. If your site lets those posts through, expect more spam, this time more malicious.


Risks of leaving my Redis port open and unsecure? I left port 6005 open on a server of mine. Currently, if the server goes down, it won't be much of a loss. But my port 6005 is open for Redis queues and I don't necessarily want to have deal with it going down.

To clarify, port 6005 is open to all connections with no encryption or password. It is on a server with nginx, mySql, etc. All potential users have been warned to not use any real passwords or sensitive data.

What's the risk of leaving a port open and insecure and does it matter that it's just Redis?

In addition to your data being exposed, allowing the open internet to access a misconfigured service could allow an attacker to establish a foothold on the server. Attacks have been carried out against redis that add an attackers SSH key to the redis user's authorized_keys file, granting the attacker SSH access.

See this answer for links to other resources about possible risks: https://stackoverflow.com/a/33693810


Do I need an SSL Certificate for a HTTP only site? The cert for our public facing site is about to expire soon. Our site is entirely http. The site runs on SharePoint, and with SharePoint working with NTLM, the credentials that are passed over the site are done so securely (not in plain text). This is for users going to the site and making basic changes (text/images). Once they are authenticated, they edit the site on http.

So, is there any need for us to renew our cert?

Thanks

If the certificate is there, then chances are that it is used for something, and that something will probably break when the certificate expires.

In your case, if you use pure NTLM, then it seems that no certificate is used at all, so maybe you can let the certificate die and see that nothing happens. However, authentication in SharePoint can be complex so I won't claim to give any definite guarantee here.

Note, though, that the NTLM protocol is vulnerable to offline dictionary attacks: someone observing the traffic won't see the passwords "as is", but will learn enough to "try passwords at home" at a rate limited only by the number of PC that the attacker can muster -- and that will be counted in dozens of millions per second. Not many user-chosen passwords last long under these conditions. And, of course, a HTTP-only site is easy prey to attackers: if you use authentication, then you fear unauthorized accesses; if the data is confidential then a passive eavesdropper will see the data as it is retrieved by normal users; and an active attacker can hijack connections at will (that's the classic Man-in-the-Middle: the attacker forwards bytes in both direction, and when the authentication has been done, he takes control of the connection).

In simple words: if you really need some security in your case, then it seems highly implausible that you can get away with not using SSL. And if you do not need some security, then why are use using authentication at all ?


How does Windows knows a particular software is an AV? First, I did some GoogleFu and came up with nothing.

My question is: How does Windows 10 know things like McAfee, Symantec, AVG, etc are antivirus solutions?

My assumption is that they set a registry key or something similar but I cannot seem to find documentation on this.

Thanks in advanced for any help.

They need to register themselves with WMI (Windows Management Instrumentation), and store some information in the WMI repository. See here for details on how it works.


How do I protect myself against SIM hijacking/social engineering? There are several posts like these:

https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd

https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-instagram-email-tmobile

How does one protect themselves against an attack like this?

What are the specific logistics behind services or phones or technologies that can be used to create a structure which isn't vulnerable to this? And how does the data flow through it?

Also, how do high risk people like celebrities handle stuff like this?

Edit

These are the things that are most critical to protect

Cellular account if used for any SMS (but maybe it can be avoided entirely by only using email recovery?)
A "root" email account that is for recovery
Domain accounts (eNome, namecheap, etc)

One of the main culprits for allowing this to happen is the marketing of 2FA as something more secure than just maintaining consistency with already well known security practices. The simple answer to your question is, don't use SMS based 2FA.

The longer answer to your sub-questions are:

Hedge your account credentials!
Don't connect your social network accounts with foolish easy-login features, like that provided by using Facebook and Google logins.
Compartmentalize your accounts according to importance. I.e. (Don't
use the same Google account for your Banking operations as you use to
signup to random websites.) For example:

Banking & Assets
Gov't Services
Social Networks
Random Web-site signups
IoT / Mobile Device use

Avoid any SMS related service if possible (rather insist using Signal)
Use anonymization providers for temporary/disguised emails, Temp Credit Cards etc.