Is it possible to protect your software and similar from being cracked? With reverse engineering, you can disassemble, edit and do a lot more. This is probably used for cracking software in order to get the full versions and avoid using actual money.

I do not really know how keygens work though... but I have read a lot of articles about the difficulty of protecting your work from reverse engineering.

Let's focus on the part of a program where you have to pay in order to get the full protection, then people can do some reverse engineering and find out how to program work and then replace some variables in order to crack the access point or by doing another smart move.

Is it even possible to protect yourself from such things? I mean even with an obfuscated coding style, it is still possible to disassemble and edit the program correct?

As long as the user has full control of the hardware where the software is running on (i.e. typical PC) it is impossible to fully protect the software. At most one can make it harder with code obfuscation or similar techniques.

To get better protection one has to move at least some essential parts of the software into an area which can not be controlled or reverse engineered by the user, i.e. specialized tamper resistant hardware or a remote system which is under your control. An example for hardware are smart cards which only allow operations using a secret key but don't give access to the key itself. An example for remote system is the typical setup of a browser and a web server where the business logic is running on the server and only the frontend is running in the browser. This way the software implementing the business logic can not be directly accessed and reverse engineered by the client. An attacker is thus restricted to a black box approach, i.e. can only deduct the functionality by comparing input and output and maybe replicate part of the functionality in its own software. But the attacker cannot access, modify or copy the original software.


Can the salt for PBKDF2 be a hash of the user-entered password? I want to derive a key from a password in a client application that will be used as a master key that decrypts a data key. As far as I understand the salt should be private knowledge. Would it be enough to use the hash (e.g. SHA-1) from a password as the salt parameter for PBKDF2?

Again, as far as I understand, when the attacker would gain knowledge of this algorithm the salt should be worthless. But wouldn’t it be easier for an attacker to retrieve a generated, but stored, salt? I have to store it somewhere, because the key won’t be used only once.

A salt is not a secret, it is meant to make the Hash/PBKDF2 result unique to each used instance. As far as a know, the very definition of salt requires it to be random for each computed hash. If it was password derived, two users with the same password could end up with the same verifier -> Bad.


Security scan with, or without, IP whitelisting in the firewall and isn't that introducing a weak point? In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the firewall?

Example scenario/cluster:

firewall
loadbalancer
webserver 1
webserver 2
database server
storageserver
log/monitoring server

Let's assume the website or web application is only accessible over port 80 (HTTP) and port 443 (HTTPS). All other ports are filtered by the firewall except one extra open port for a (management) VPN connection. All the traffic is going from firewall to loadbalancer, to webserver (using database- and storageserver). The log/monitoring server is stand-alone.

On one side I could argue that scanning behind a firewall (with IP whitelisting) is more desirable because you could possibly get insight in more vulnerabilities and mitigate those, even while it's unlikely they can be exploited.

On the other side, I could argue not to whitelist the scanner IP addresses because this scenario is more realistic (blackbox) and wouldn't give the advantage of scanning areas that are filtered from the world wide web in the first place.

Nobody can access the database server or monitoring server directly but if those machines are for example using "123456" as a root password or missing 100+ OS patches making them vulnerable to a load of CVE's. You'd like to get to know that I suppose.

What is the desirable solution/scope here and what is best to advice someone about this? Does the IP whitelisting introduce a higher responsibility for me as an ethical hacker? Since the customer is introducing a weak point in their security by whitelisting the scanner IP addresses.

Nobody can access the database or monitoring server directly

... as of now.

My opinion is that one must assume a worst case scenario, where all the obscuring/protection layers are gone (whether this is because of a hack or a mistake) and the bare application together with its stack is available.

On top of that you may run into issues when scanning through a firewall (resources exhaustion). This is something which you can usually fine tune but there is a risk anyway. I once ran zmap by mistake against networks behind firewalls and it did not end well (this is an extreme case).

The same question arises when discussing whether to pentest with a WAF on or not. Again, I find that knowing there is an issue and relying on virtual patching / blocking is too risky.


Can a compromised OpenSSHD server be used to upload a malicious payload to a client? Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other nefarious code) back to a completely uncompromised client who was connecting to it.

I suppose a poorly-coded SSH client could definitely fall victim to this kind of attack through some sort of buffer overflow, but could it happen to a SSH client that followed the protocol to the letter, like the well-maintained, stable, and battle-tested like the OpenSSH client?  If so, has a documented example of such an exploit occurred in the past?

Yes. The server is sending back data of its choice to be processed by the client. If there is a flaw or an exploit, it can be taken advantage of by the malicious server. Even if this is legitimate software.

The fact that its well maintained, battle tested, etc does not mean its guaranteed to be free of vulnerabilities. There may be new bugs introduced with new features, protocol misimplementations, etc. The probability may be lower, but its not impossible.

Based on your edit as we discussed below, the protocol does not need to have a flaw in order to be abused. Following the protocol does not mean it's not use weak ciphers, misimplementations in processing, etc. It can follow the protocol and bad things can still happen. Bad data can go over a good protocol.

A protocol weakness could allow for known plain text or compression analysis type attacks (e.g., CRIME). When you are attacking a encryption protocol, you are generally trying to mess with the confidentiality by finding a way to guess keys, decrypt, influence key choice, etc.

It sounds like perhaps your are asking if a protocol could have rules such that good data is modified and then interpreted on the other end such that it triggers an exploit. Theoretically based on the options and processing of protocol, that may be possible, but in most cases that would still be considered  flaw in the sever or client.


Nmap loads on its own, scans addresses, with a different source address than my PC. How is this possible? 10 minutes after installing Nmap on a fresh install of windows, NMap loaded on its own and attempted to scan dozens of IP addresses around the globe. I never initiated the scan. Notice the source address is different than my own IP 192.168.50.241. How is this possible? Is this a feature in NMap? Packet generator? Virtual address injected into my hyper-visor through AMD PSP?

The answer is that nmap has this functionality built in, I just noticed the folliwng:

Source option: "use decoy to hide identiy" code: -D

  Send fake decoy probes from spoofed addresses to hide your own
  address. Give a list of addresses separated by commas. Use RND for a
  random address and ME to set the position of your address.


Getting exploit reliability when using the off by one framepointer overwrite on linux We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian standard x86.

We may run:

buf[256];

for(int i=0; i <=256; i++)
  buf[i] = argv[1][i];

However, I want to put my shellcode into buf and then jump to it. If I would use a normal stack overflow, I could get exploit reliability by going to a loaded library which has the jmp $esp instruction somewhere encoded, and then put my shellcode where the function arguments are and so forth. But this is not possible here.

So what do you do if it's a remote process (you can't hardcode the address values) and need exploit reliability? The only thing that came to mind is stack alignment where we could be able to predict the low bits (2 or 3 bits maybe?).

I just need to know the low byte of the frame pointer so I can overwrite it with a little smaller value control eip to point to jmp esp and at the instruction at esp would be like a short jump -0x80 or something such as that.

I have decreased the frame pointer => ret gets executed => control eip => point eip to jmp esp instruction => next instruction is the short jump -0xsomevalue execution => payload gets executed.

I thought about other heuristics like writing the pointer to jmp esp over and over into the buffer so that it's more likely to get control of eip, but that way my method of jmp -0xsomevalue wouldn't work anymore.

I had an extremely similar homework problem that I had in a security class. The reliability of your exploit depends on how large the buffer is. If you are overflowing a particularly large buffer, then your exploit will have a larger chance of working.

Here is how your exploit sandwich should be structured:

[NOPS][Shellcode (usually about ~60 bytes)][FP overwrite]

As you know, you will only be able to overwrite the last couple of bits of the Frame Pointer. This will cause the EIP to point into your sled if you are lucky enough. If you have a buffer of size 265 like in your example, here is how a good sandwhich would look:

[NOPS * 150][Shellcode][FP overwrite] << FP Overwrite MUST be at index 256

Now as I said, the reliability of your exploit is going to rely on the size of the sled you can produce. If you buffer is 1024 bytes, then your exploit will be very efficient.

If you come up with a good value for your Frame Pointer overwrite, then you are going to have a lot more success with your exploit. Also creating the largest possible sled is going to be key here as well. For this exploit, it is probably safe to use:

NOPS = (size of exploited buffer + 1) - length of shellcode - 1

simply:

NOPS = (size of exploited buffer) - length of shellcode

This will give you the largest change possible of landing in your NOP sled. Now just play with the FP overwrite value and find a value that is pretty consistent.

helpful info on off-by-one errors:

http://en.wikipedia.org/wiki/Off-by-one_error

How a nop sled works:

https://stackoverflow.com/questions/14760587/how-does-a-nop-sled-work

Here is the article I had to read for my class, it was really helpful:

http://insecure.org/stf/smashstack.html


Attacks against HIDS software running on the same machine I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database stored on an external machine or media, but lets say that is not the case, and everything is just on one machine.

Firstly these programs would necessarily be detected right? Through Cron or RC scripts or even just as a running process...or do they take steps to hide and obscure themselves?

If they do hide themselves, what steps could an attacker take to detect them?

Let's say an attacker manages to end the process...will they report this? Can an attacker just end and then restart the process without this being reflected in the logs?

What about notifications....can they be prevented from sending out notifications?

I think HIDS is a very interesting and useful technology, but as with anything I know it cannot be solely relied on, so am interested in the types of attacks against these systems. If anyone knows other sources of information I would appreciate it also.

Would Tripwire's use on a system would be detected by malware?

While a properly secured system would make it difficult to detect system security measure like Tripwire, I believe a sophisticated piece of malware could detect the presence of Tripwire or another HIDS. A program like Tripwire is no necessarily hidden, but it is protected by OS access controls. For example removing other read permission to the directory /usr/local/tripwire is not so much hiding as protecting.

Do HIDS [they] take steps to hide and obscure themselves?

Tripwire itself, excluding how an administrator sets it up on a system, does not attempt to hide itself from detection by malware. Tripwire does encrypt and authenticate its configuration and database files. Again I would describe this as protection instead of hiding.

What steps could an attacker take to detect them?

It depends on the system and what vulnerabilities it has. Attacks can be very inventive, and do anything from exploiting specific library functions, to using unintended signaling channels. For example, an attacker developed a method of determining characters in a password by monitoring page-faults.

"Let's say an attacker manages to end the HIDS process...will they report this?"

Depending on how the process was ended a HIDS may or may not explicitly log the unexpected termination. However, a properly configured system should explicitly log the unexpected termination of a security program. Even if the system did not explicitly log the unexpected termination the fact would be easily discoverable by evidence like a missing or incomplete audit report.

"Can an attacker just end and then restart the process without this being reflected in the logs?"

If the system is properly configured, usually no. If the system kept all its audit and logging data locally, the attacker was sophisticated, and the attacker effected a full access compromise, then yes the attacker could modify the HIDS logs to show normal operation.

"What about notifications....can they be prevented from sending out notifications?"

Again it depends on the system, how its security is constructed, and the sophistication of the attacker. A HIDS can be configured to send e-mail or other types of notifications, and the system may be configured to protect those notifications.


Why is an HSM required to protect CA certificates (rather than a regular USB token)? Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on.

The same vendors also offer distinct products called HSMs (Nitrokey HSM, YubiHSM). The suggested use case is protecting CA certificates. They also have a USB token form factor.

Why is a different hardware product required for this use case?

Hardware Security Modules's (HSM's) are used in systems where a company has determined that the risk involved requires a higher level of control that a personal key.

The Use of HSM's for Certificate Authorities

HSM's are common for CA applications, typically when a company is running there own internal CA and they need to protect the root CA Private Key, and when RAs need to generate, store, and handle asymmetric key pairs.

Uses outside of a CA

HSM's are suggested for a companies Privileged Access Security System. These system's use the concept of a "vault" which is unlocked via a key or multiple keys. These keys are usually only required on startup of the vault.

With vaulting systems, typically options for storage are:

Store them on the server. This is not very secure even when you limit access to the server.
Store them on Disk/USB. This requires that disk be mounted every time the system is restarted (trouble if you do regular restarts).
Store them on a HSM.

In secure systems, this allows key to be generated without a human needing access to it, stored in a system that is FIPS Level 2+ compliant, and only accessed when a system starts.

Using an USB Key vs a HSM

Primarily, end user USB's are designed for the end-users access. They are storing keys which might authenticate them, have encryption keys for data they are responsible for, or are part of a process that identifies the user is who they say they are.

Examples of this are the use of a YubiKey to hold the private encryption key for sensitive company data. You might have access to a trade secret, or are allowed to perform analysis on compliance critical data such as PII and Healthcare or Credit Card Data.

HSM's are not designed to be a personal authentication unit. They are installed on servers to provide a secure generation, storage, auditing, and distribution of keys for high risk applications and systems.

Examples include the storage of server certificates for authentication between systems, encryption keys which are used by processes but don't need to be seen by humans, and shared keys between servers used to access encrypted data or establish encrypted connections.

Pseudo-Summary

You could think of the use cases in terms of people verses systems.

If a company has a need to provide increased security of systems which a person uses require access to as part of there job, something like a YubiKey makes sense.

If a company has a need to provide increased security to systems where processes and the systems themselves need access but a user wouldn't normally be required to know, then a HSM is the better option.

Anecdote

Imagine walking around with they key to your companies entire certificate authority in your pocket that provides the authenticity for 1200 servers and that Key slipped out a hole in your pants. Now imagine the nightmare of having to re-issue a new CA certificate, all the new signing certificates, and all the server certificates.

edits:

At the suggestion of @MikeOunsworth, I updated and expanded this answer.


How can I assess the trust worthiness of a browser add-on? Having learned a bit more about what add-ons/extensions can do in Firefox, I want to minimize my risk and use some safer mechanism to download videos (FLV in particular) for later viewing.

Considering the question What are the security implications of people downloading addons, wrongly thinking that they are safe?, is there any way to trust an (open source?) browser add-on? I can examine the code myself if it's not 100,000 lines of illegible gunk.

The most popular video-downloader add-ons are closed source AFAIK.

I use the Greasemonkey extension for Firefox. It allows to write small "user scripts" that Greasemonkey injects into the specified websites.

There is a repository of user scripts at http://userscripts.org/ Most of them are really small and easy to understand.

There is a popular script for video downloads from youtube. It is a lot more complex than usual scripts but seems fine on a quick glance. There are many more simpler scripts through.


Is using an free and anonymous VPN service safe? There are VPN services that are totally free and high speed vpn which makes me think, how can they offer such a service for free without ads nor donations?

Is using this VPN safe?
Regarding my accounts emails/FACEBOOK and  regarding my laptop and IPAD info?

There's no way to be 100% certain, but bear in mind that it's entirely possible for your VPN provider to see ALL of your traffic. Personally I do not sign into any personal account when using a VPN, particularly a free one.

I'm guessing that you want something to bypass country specific law? The safest way is to purchase your own VPS (which you can find for a few dollars a month) and route your traffic through that, then you are in charge of your data.


Is there a way to identify the location of a person trying to intrude your wifi network? my wifi router is picking up his attempts Aug 30 20:28:09 dropbear[6799]: Child connection from ::ffff:5.10.69.82:38463
Aug 30 20:28:11 dropbear[6799]: login attempt for nonexistent user from ::ffff:5.10.69.82:38463
Aug 30 20:28:12 dropbear[6799]: exit before auth: Disconnect received
Aug 30 20:28:12 dropbear[6800]: Child connection from ::ffff:5.10.69.82:38805

I have MAC filtering and WPA2 security in place. Is this enough to protect my network?

The user isn't trying to attack over wifi.  They're trying to attack over the Internet.

Aug 30 20:28:09 dropbear[6799]: Child connection from ::ffff:5.10.69.82:38463
Aug 30 20:28:11 dropbear[6799]: login attempt for nonexistent user from ::ffff:5.10.69.82:38463
Aug 30 20:28:12 dropbear[6799]: exit before auth: Disconnect received

::ffff:5.10.69.82 is an IPv6-mapped IPv4 address, specifically 5.10.69.82.  The log shows the attacker connecting to an SSH server on your router, trying an invalid username/password pair, and disconnecting.

This is probably a part of the distributed SSH brute-force attack that's been going on for years.  MAC filtering and WPA2 will do nothing to stop it, since it isn't coming in over the wireless connection.  Rather, you should take the appropriate precautions for dealing with an attack on SSH.


Server Certificates, certificate authority, and servers I currently have a valid wildcard certificate installed on OS X 10.8.2 server.  To make sure we know what I'm talking about the cert is *.domain.com (example only)  I'd love to use this to secure as much of everything as I can.

Can I use this certificate to generate certificates for computer1.domain.com, computer2.domain.com, (subdomains inside MY domain) etc... ?  Or do I just install the wildcard cert everywhere?

I do have the ability in Keychain Access under Certificate Assistant to create a Certificate Authority.

I can create code signing certs using Certificate assistant as well.

I'd also like to be able to create Digital signatures for mail.domain.com based on the Wildcard SSL.

Is any of this possible?  My goal is to have everything be legitimate and above board.

Are there any questions I can answer to help clarify anything I've stated?

A certificate is only as good as whoever validates it thinks it is. A certificate is good for SSL as long as the SSL clients (e.g. Web browsers, or VPN clients) accept it as good. Whatever you do, the existing clients will lead the dance.

A "wildcard" certificate is described in RFC 2818, section 3.1:

  Names may contain the wildcard
     character * which is considered to match any single domain name
     component or component fragment. E.g., .a.com matches foo.a.com but
     not bar.foo.a.com. f.com matches foo.com but not bar.com.

This is the only place where the "*" character has any special meaning. This means that your wildcard certificate is "a wildcard certificate" only in the context of a HTTPS server: in that context, the client will require that the intended server name (the one in the URL) matches the name in the certificate; the "wildcard" is a kind of match-all. So your certificate will be accepted by clients as a certificate for servers foo.domain.com, bar.domain.com, qux.domain.com... and so on.

Note that a few other protocols have more or less adopted the same name matching rules; e.g. a certificate for an IMAPS server will also need to contain the server name (that is, the name that the clients expect). Also, note that complete support for wildcards is kind of a rarity (clients who accept to consider *fo*.domain.com as matching foo.domain.com are not legion).

This is completely orthogonal to the question of issuing sub-certificates. A certificate which is accepted as an issuer for other certificate is called a CA certificate and the hallmark of a CA certificate is that it contains a Basic Constraints extension with the cA flag set to TRUE (see RFC 5280, section 4.2.1.9). No client will accept a certificate issued by your "wildcard" certificate unless it has this flag; and the presence or absence of a "*" character in the name is totally irrelevant here.

As a side note, I find a bit dubious the idea of "securing everything" by copying the same certificate and private key in many machines. The more you copy a private key, the less secret it becomes. Asymmetric cryptography was meant as a way to avoid copying secret keys. The normal certificate paradigm is that each entity in a network should have its own private key, instead of sharing the same private key between hosts.


Is malware or screen capture possible with iMac as external display? If using a foreign iMac as an external display (through the Thunderbolt to Thunderbolt, or Mini DisplayPort to Mini DisplayPort cable, and Command+F2 on the iMac, as per iMac Target Display Mode FAQ), is there a chance that my MacBook or ThinkPad could get infected with some sort viruses through the said port, have the keystrokes recorded, or get its screen captured by the aforementioned iMac?

I'm specifically interested in the aspect of making sure that my laptop is not subject to these attacks, but I guess Thunderbolt is a double-way street.

I see that according to Wikipedia, it appears that Thunderbolt may be subject to DMA attacks, but only in certain circumstances.  If my ThinkPad X230 has a "++DP" logo next to its port, does it mean it's not vulnerable?  How do you determine if you may or may not be vulnerable?  Is there a way to minimise any possible privilege escalation?

You are correct in that there are risks with the Thunderbolt to Thunderbolt connectivity when connecting two devices.

The DMA type of attack you mention is a distinct and very real attack vector.
https://en.wikipedia.org/wiki/DMA_attack

However Tramell Hudson's talk on Thunderstrike is probably the best description of the security issue you are asking about.
https://trmm.net/Thunderstrike

At this time, unlike BadUSB ( https://srlabs.de/badusb/  ) we don't currently know of a specific tool taking advantage of this issue but given the complete lack of security controls and the similarities to known vulnerabilities in FireWire and USB we do expect exploits to be developed which will take advantage of the Thunderboldt protocol.

As for the ++DP on the Thinkpad Laptop I believe that actually means it supports Dual displays but regardless of the configuration since the Laptop is communicating using the Thunderboldt protocol it will be subject to attacks as they arise.

Additional Relevant link: http://www.extremetech.com/mobile/197005-new-apple-malware-is-undetectable-unstoppable-and-can-infect-any-thunderbolt-equipped-device

Hope this helps.


Does using the client keep the Keybase server honest even if you also use the web interface? According to Keybase's documentation:

  [The] keybase clients in the wild play a crucial role in keeping the Keybase server honest. They check the integrity of user signature chains, and can find evidence of malicious rollback. They alert Alice when her tracking of Bob breaks, if either Bob or the server was compromised. They check the site's published Merkle tree root for consistency against known signature chains. And they sign proofs when all these checks complete, setting up known safe checkpoints to hold the server accountable to in the future.

And a bit later:

  We fully understand that users of the Keybase Web client don't get these guarantees. But our hope is that enough users will use the Keybase command-line client to keep the Web users safe, by catching server misbehavior in the case of a compromise.

If you use the website to sign, verify, decrypt, or encrypt a message, you have to give up your private key and use your passphrase each time. Obviously, that's a risk. But if you sometimes use the website, will using the command line client verify the integrity of the server? Or do I need to trust keybase.io to not get hacked if I ever let it have my private key?

The keybase client DOES NOT verify the integrity of the keybase server. The client can to some extent verify behavior of the server to make sure, it is not providing wrong information to clients. That only includes withholding data, for example not saying Alice revoked her key and therefore allowing the compromised key to be exploited. It does not help against the server stealing keys, metadata or any other compromise.

Also, it is important to note, that the server can still pretend to Alice that it is unavailable to prevent her from ever submitting her revocation. While Alice would detect this, no-one else would. Alice would have to inform everyone and somehow prove this, which may be difficult.


How to verify the authenticity of Facebook users? While I was not surprised at all by Facebook stating that "8.7 percent of accounts belonging to its 955 million monthly active users are fake"; link is a news story that providers a summary of their statements and a link to the source of those statements, Facebook's full 10-Q report.

Here's the thing though, to me it seems like identifying fake accounts would be easy, what would be hard would assigning a value of authenticity to a given account.

Has Facebook publicly stated how they are identifying accounts as "fake" or real? If not, how would this be done?

Facebook relied on user generated "abuse reports" as leads for identity investigation. Meaning, you can report a suspicious account and it will be review by FB team (I`m guessing we are talking about log checks, "believable" friend pool and etc)

They got no automatic policy for account identification besides the following:

Feature overuse: Simply Checking the rate of usage for features (i.e. Too many messages/reoccurring content)

Unwanted contact: High "deny friendship" rates/repeat "friendship request" are deemed suspicious.

I actually think they got the right idea here, as behavior-based challenges are probably the best way to find fake FB users.

There are maybe few other things you can do (having a a "suspicious contact pool" signature for example and some Bot challenges like JS/Header and others) but, for me, the main issue here is their Enforcing Policy.
Currently, you have to work pretty hard to get banned from FB, and in the end - with all of their cash flow problems - a large user base is still Facebook's main claim-2-fame and I don`t see them messing with it any time soon.

As for the numbers, I`m assuming they've just based on an avg. or previous fake/real user statistics.


Is the "2038 bug" considered as a vulnerability? is it possible to exploit this? Is it possible to use the "2038 bug" on all kinds of systems / sites that use a calendar and similar features, in order to exploit a certain system in some way?

Yes, "2038 bug" might be a vulnerability, but it fully depends on how the application you're attacking is coded.

Say, you have a web application that does this:

if ($todayTimestamp > $user['rightExpiresTimestamp']) {
    did('Not allowed');
}

So the user was granted access until, say, 2018 so it's now expired, because today's timestamp is about 1571325274 and is greater than 1514764800 which is 2018 timestamp.

Now, you wait until 2038 and the server is bug-prone. Then $todayTimestamp will overflow, and be interpreted as something like -2147483648 which is lower than 1514764800 so access is not blocked.

Question is very broad tho, and will require 19 more waiting years to be exploitable in these (rare) cases...!


httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header? There's a new fancy-named, branded vulnerability called HTTPOXY.

My question here: Are sites served via TLS also affected? Or is this an issue only for HTTP sites (unencrypted communication channel)?

EDIT: Added image to clarify the threat and the attack scenario:

I did not know about this until I read the link you posted, so do not view this answer as authorative. I would recommend you to take the precautions listed under "Immediate Mitigation" now, until you are completely sure you are not affected.
First, how does this vulnerability work? This is a short form of the PHP example explained under "How it works":

The attacker sends a request with the Proxy header set to an evil IP controlled by the attacker.
If the server runs CGI, the values of all headers end up in getenv("HTTP_NAME_OF_HEADER"), or in this case getenv("HTTP_PROXY").
If the script running on the server also uses an HTTP client (like Guzzle) to send requests of its own, it might also read getenv("HTTP_PROXY"), but not to get the header but to know if it should use a proxy for the outgoing traffic. The IP sent by the attacker will then be used as a proxy.
The attacker can now MITM all the outgoing requests the server makes.

The important thing to note is that there are two requests being made here:

A. One in step #1, where the attacker makes a request to the vulnerable server.
B. One in step #3, where the vulnerable server acts as a client and makes a request somewhere else.

If you use HTTPS for A it does not matter (I guess that is what "sites served via TLS" would mean). It gets encrypted to plain old HTTP anyway. So you are vulnerable.
However, if you use HTTPS for B it can matter, since (as hectorct pointed out in comments) the attacker will not be able to MITM the request anyway, assuming the client checks the certificate and the TLS is good and so on. It is that second request that they are talking about in these passages (my highlight):

A few things are necessary to be vulnerable:

Code running under a CGI-like context, where HTTP_PROXY becomes a real or emulated environment variable
An HTTP client that trusts HTTP_PROXY, and configures it as the proxy
That client, used within a request handler, making an HTTP (as opposed to HTTPS) request

And, of course, another defense-in-depth strategy that works is to use HTTPS for internal requests, not just for securing your site’s connections to the outside world. Those aren’t affected by HTTP_PROXY.


What due diligence is required for HTTPModules that run within IIS? I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it.

Since there has already been an exploit with a similar component produced by Microsoft, what should be done with *.AXD's produced in-house and 3rd parties?

Should I treat servers with custom AXD's differently than other web servers (such as creating a high security VLAN?)

HttpModules are application-level code. They are enabled for an application in its web.config and should not (accidentally) affect other application pools. They don't inherently have any more rights than any other app code.

Consequently they deserve the same level of auditing as any other custom code you're running, but don't bring in any risks to the infrastructure that you don't already have.


What's the difference between DRM and CAS? As I see it, both are used within the scope of content security, to restrict who has access to what.

So what's the difference between a DRM system and a Conditional Access System? Is CAS a subset of a DRM integration?

The main difference is that Conditional Access Scrambling and Digital Rights Management are that the first is a transport protection mechanism and that the second an asset protection mechanism. With CAS you can offer a stream like with television for example and everyone who has the right key can unscramble the stream within a certain timeframe as most videostreams for television have a time based lock. This is almost all done in hardware and think about the CI+ modules for televisions as a working example of this.

DRM is a way to protect content when it is both in transport as in rest. This allows for the consumer of the content to access it when he has the right key and is not restricted to a certain timeframe as with CI+ for example where the encryption key is rotated every 120 seconds and would make playback and/or timeshifting difficult. Some DRM implementations as for example with Microsoft Office require access to Active Directory to verify the keys to access protected content, but this is mostly due to key management to not have both the protected content and the keys to unlock it on the same device.

Now with modern technologies the lines between CAS and DRM are fading slowly, but in essence you could compare it to SSL versus PGP. Both have their purposes, but CAS will most likely be around as long as we have streaming video and the solutions in hardware to support them. And most DRM implementations have to overcome how protect both the content and keys in rest, but also how to protect the interaction with the protected content.


PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context? Setting up a new company with ecommerce app, and looking at PCI compliance.

What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire?

The context in which we will be processing payments will be in one of the following scenarios:

Option 1 PayPal pro - credit card information is processed on our domain and website, but is not stored in our database - it is simply transmitted to PayPal.

Option 2 SagePay server & inIframe - credit card information is entered on our website, but never hits our system because the SagePay hosted Iframe sends the data directly to SagePay.

Any advice appreciated. I have read PCI documentation, but still unsure about the process.

No, the point of the self-questionairre is that you don't need a QSA.
On the other hand, you might want some assistance or guidance, to verify that you complete it correctly - you still may be subject to an audit, and you'd be worse off after filling it out incorrectly.

Also, you'll still need an ASV (authorized scanning vendor) to run your quarterly scans.


What's the concrete case for code flow being more secure than implicit flow? It's seeming like the extra loop via the client backend in code flow only adds obscurity - not security. If, in the end, the client backend dishes out the same access token to the front end as the auth server would via implicit flow, what specific attack is mitigated by the extra back channel communication?

Having read around on the topic, it sounds like code flow's superiority is only achieved if the client front end never sees the access token. Is that true?

1st question: it mitigates attacks described in OAuth 2.0 Security Best Current practice draft-ietf-oauth-security-topics-133.1.2.  Implicit Grant, mainly:
- browser history token leakage
- compromised devices where an attacker can somehow manipulate the client (such as a malicious browser extension)

2nd question: the client will necessarily have to use the acces token. In the authorization code flow, however, the access token doesn't go through the web flow which helps with mitigating attacks on the web stack. On the contrary, it exchanges the authorization code against tokens on the /token API direct. Moreover, use of PKCE prevents an attacker from using an authorization code intercepted in the browser or on the host application (eg. on mobiles, by claiming the redirect URI which cannot be owned by a single application).


Security of nested ssh First of all, by nested ssh, I mean the following way of using ssh:

ssh usera@Bob 'ssh usera@C'

suppose A wants to login on server C, but for some reason C is not directly available to A (e.g. C's behind a certain FW or NAT or so). Fortunately, A's friend, Bob has direct connection to C and A can connect to Bob as well. So, in order to login on C, A would actually do the aforementioned thing.

My question here is, will Bob be able to see the communication between A and C in clear, given Bob is the administrator of his server. My guess is yes, but not so sure about my understanding of SSH internals.

The reason I think Bob can see the plaintext is: There are two session keys: kab and kac, for the outer and nested ssh command respectively. kac is unknown to Bob ideally. (Is that true when Bob is the root user?). Anyway, when a message arrives at Bob, it has to be decrypted with kab, then encrypted with kac and send to C. So between the encryption and decryption, the plaintext is somewhere in the memory. Bob should be able to see it, not straightforwardly though.

Any insight?

Yes, as deviantfan has explained, if you do it that way, Bob can see your traffic.

A more secure way to achieve your goal is to use the proxy features built into SSH. The simplest way, if you have OpenSSH 7.3 or later:

ssh -J usera@Bob usera@C

For older OpenSSH versions versions, if you have at least OpenSSH 5.4 you can instead add the following to your ~/.ssh/config:

Host C
ProxyCommand ssh -W %h:%p usera@Bob

With even older OpenSSH versions, you'll need to use netcat instead (assuming Bob has it installed):

Host C
ProxyCommand ssh usera@Bob nc %h %p

Now when you connect to C, ssh will first connect to Bob and start up a proxy (either its built-in one or Bob's netcat). The connection from your local machine to C is then forwarded through this proxy. The connection is end-to-end encrypted with your local ssh client at one end and the remote server C at the other. The session key is negotiated between you and C; Bob never sees it.

Of course, Bob as your proxy can still impersonate C; but as long as you've previously verified C's host key fingerprint, you can easily detect this in the usual way.


Many suspicious requests are going from my browser whenever open any site Whenever I open any site there are so many suspicious request are shown in my network panel of browser. I scan my system with many antiviruses too, but still facing the same issue.
And sometimes I click any link will redirect me to a porn site or other sites. I formatted my system too but no success.

here is the one link that open rapidly i-gency.ru

  Edit

here is the list on the extensions and plugins

Here is the one more site which block by my antivirus every time I load Stackoverflow

What I should do?

All the URLs in your first screen capture/snippet are related to ad-providers who show ads on webpages you visit to gain revenue. The plugins and addons shown are legit.

So, its a possibility that something else is causing the traffic, possibly some ad-injecting programs or DNS hijacking. May be that's even not on your machine, but on modem/router/ISP.

Try setting your DNS servers to any of the following (how-tos described in the linked pages itself):

Norton Connect safe : http://connectsafe.norton.com
Open DNS            :
https://www.opendns.com/home-internet-security/

[edit] Sorry, I saw your MBAM screen capture very late. It seems the issue is related to DNS itself. You must inspect your modem/router DNS configuration (log-in to those devices) and change to above entries if necessary. Make sure the firmware of modem/router are up-to date (restart modem/router later).
To verify the settings on your machine, issue the below command at command propmt (CMD.EXE):

ipconfig /all

and check the DNS server entries.

To avoid ads in webpages, use addons like ublock, adblockplus, noscript and ghoestry (for firefox)

  I scan my system with many antiviruses too, but still facing the same issue. And sometimes I click any link will redirect me to a porn site or other sites.

No security software can work 100% perfect all the time. I don't know if malware removal assistance is permitted in the community nor I'm entitled to do so, but if you suspect infection, you can get it removed and fixed freely at volunteer forums like bleepingcomputer or geekstogo.


Penetration testing HTTP client code I am working on HTTP client code that makes REST api calls to a server and processes responses.

The client talks to server via SSL, but the SSL session is terminated at a Web Application Firewall.The Web Application Firewall is like a man-in-the-middle proxy.

I would like to make the client robust enough to handle any erroneous behavior by this proxy. Are there any tools that provide such tests? For instance, the proxy could redirect the client elsewhere, or modify the response sent by the server. I am able to find a lot of test suites to test web server code, but not client code. I looked at https://mitmproxy.org/ and some options in Kali Linux that let you setup malicious web server that serves malware. Are there any other options?

Your client should check response for errors regardless error source: be it proxy error, server error or TCP error.

Your should simulate web server (the way you do it depends on your favorite language and environment) and check following situations:

404, 403, 500 and other non-200 error codes. You can check status codes like "moved permanently" as well.
Junk response (not even valid HTTP, i.e. stream of random bytes)
Valid HTTP with junk inside (if you wait for json, then send .png as response body)
Interrupted response (send valid respond but disconnect client after sending 95% of it)
Timeout (accept request and make client wait for 40 seconds before answer)
Huge bomb (send 500 mb as response)
Response with logic errors (i.e. if you wait for positive integer "age" field in JSON, try sending "-9000" or "abc123" or random 500 bytes for it)

If all these cases are handled correctly, your client is ready for any proxy error, I believe.


Logging out of Basic HTTP Authentication As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP Authentication.

Currently I'm sending an HTTP 401 to do so like this:

GET logout.php

<?php
header('HTTP/1.1 401 Unauthorized', true, 401);
exit;

And upon subsequent requests, I'm prompted by the browser with the credentials modal. Upon clicking Cancel, I receive an HTTP 401 response, the intended result.

This is an internal application and HTTPS is used.

Are there any potential security issues with this? I'm using the LDAP module (hence the Basic HTTP Authentication). Does Apache "cache" the credentials in any manner or are the credentials verified with each request from the user-agent? Is there anything else I need to do to ensure that requests without valid credentials from the user-agent always receive an HTTP 401 response?

Basic auth credentials are transmitted with each and every request by the browser. Hence why you cannot traditionally "log out" without closing the browser.

The reason why this approach works is because the browser is stateless. Normally when it sends a GET/POST/HEAD request it receives a 200 OK response. If it receives a 401 response it will prompt the user for credentials and resubmit the request with these credentials. If those credentials are wrong the server will again send a 401 response and the browser again prompts. So when the browser receives a 401 response it assumes the credentials sent in the prevoius request were wrong and will ask again.

It is important to remember that you are relying on client side behaviour to clear the credentials and ask for new ones from the user and as such there is always a risk associated with something outside of your control.


If I use my school's access key to activate Windows 10 Education on my personal computer (at home) will the school be able to monitor my activity? I downloaded Windows 10 Pro (unactivated) when I first built my PC, but was given an activation key from my school's IT website after logging in. I entered the key which activated windows and now I am using Windows Education. How much (if at all) can they monitor my activity (what applications I have open, what files I have on my PC, what websites I visit, etc)

An activation code does only that: it activates the Windows license. It doesn't add the installation under the control of your school, like logging in to the computer with an organizational account would do (Intune, Autopilot etc.).
However, using such licenses on personal devices might be a violation of the license terms. But that's a bit out of scope for this question and more of their problem than yours.


principle of splitting sensitive data across multiple machines running different operating systems Suppose you're trying to store data as securely as possible, including splitting it across multiple machines (encrypted in a manner so that it's unreadable unless all pieces of the data are recovered).  If the attacker knows your algorithm and compromises all of your machines, they can always recover the data, so there is always some nonzero probability of this happening.  But you want to reduce the probability as much as possible.

It seems the strategy would be to encrypt the data with a key, and then split the key across multiple machines, such that all the machines (the data storage machine and the key-storage machines) are as physically independent as possible and are running different operating systems (with each OS always applying all of the latest available patches).

Running different operating systems means that the probability of compromising one machine is more independent of the probability of compromising the other machines.  If you have three machines and they're all running Windows Server, and in a given time frame you have a 10% of chance of finding a vulnerability in Windows Server that gives you read access to the machine, you have a 10% of compromising the whole system because then you'll own all three machines.  But if there are three machines, each running a different OS, and for each OS you have a 10% of finding a vulnerability in that OS, and the odds are independent for each OS, then you have a 0.1% chance of compromising the whole system.

You can also re-encrypt the data periodically with a new key and then split the new key.  Then the attacker only beats the system if they compromise all of the machines in the same time period before re-encryption.

Now, this does also mean that if any of the machines fails, you lose all the data, but the fragment of the key on each machine can be backed up to another machine.  And in this case, while the backup machine should still be physically separate to reduce the chance of both being lost at once, it could be running the same OS as the machine it's backing up.  The idea is that if A1 is backed up to A2, then the attacker compromises the same amount of data whether they hack into A1 or A2 or both, so there's no reason A1 and A2 can't run the same OS (with the same potential vulnerabilities).

However, I've never heard of a security principle along the lines of "split sensitive data across machines running different operating systems".  Did I just re-discover something well-known and obvious that has a name already?  Or is there some reason the whole logic is flawed (and that's why it doesn't have a name)?

You can use the Shamir's Secret Sharing with the threshold scheme which specifies how many key fragments you need to reconstruct the key. So if you have 20 key fragments total and you require at least 10 fragments to reconstruct the key this means that 10 of your servers can go down and you still will be able to get the key.
You will also need to set the replication factor so you don't lose the data if one node goes down.

Alternatively, instead of splitting your key into fragments you could split the encrypted data and specify the threshold to allow some of the servers to fail without any data loss.


How to input generic type or determine data types for selected values in UNION ALL SQL injection attack? I've determined that the application is vulnerable to SQL injection and the proper amount of values to SELECT in the corresponding UNION ALL query:

foo' UNION ALL SELECT '1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1','1' --

My problem is that the selected values aren't of the same type as those selected by the original query. In this case, the timestamp error (see below) could refer to any of the selected values. How can I select values that doesn't generate type error, or determine the proper types to use?

Error:

Implicit conversion from data type varchar to timestamp is not allowed. Use the CONVERT function to run this query.

[SqlException (0x80131904): Implicit conversion from data type varchar to timestamp is not allowed. Use the CONVERT function to run this query.]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +3306108
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +736
   System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +4061
   System.Data.SqlClient.SqlDataReader.TryConsumeMetaData() +90
   System.Data.SqlClient.SqlDataReader.get_MetaData() +99
   System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString, Boolean isInternal, Boolean forDescribeParameterEncryption, Boolean shouldCacheForAlwaysEncrypted) +604
   System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, Boolean inRetry, SqlDataReader ds, Boolean describeParameterEncryptionRequest) +3303
   System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean& usedCache, Boolean asyncWrite, Boolean inRetry) +667
   System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method) +83
   System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method) +301
   System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +201
   System.Data.Common.DbDataAdapter.Fill(DataTable[] dataTables, Int32 startRecord, Int32 maxRecords, IDbCommand command, CommandBehavior behavior) +453
   System.Data.Common.DbDataAdapter.Fill(DataTable dataTable) +141
   test.getTable(String select) +129
   test.write(String whereField, String searchFor, String searchWhen, String searchTo) +363
   test.search(String searchFor, String searchBy, String searchWhen, String searchTo) +436
   test.submitsearch_Click(Object sender, EventArgs e) +122
   System.Web.UI.WebControls.Button.OnClick(EventArgs e) +11758848
   System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +150
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5028

You'll probably need to brute force it. But that looks like way to many columns to brute force at the same time! But don't worry, NULL comes to the rescue:

foo' UNION ALL 1, NULL, NULL, NULL, NULL, NULL, NULL, NULL, ...

Set all columns to NULL, and try different types for the first column. When you got that one nailed down, move on to the next. And so on.

EDIT: This seems to be wrong, see comments.


Encrypted data embedded in JPG and Other file types This is some data found near the end of a JPG file:

  18{8uck3y3$}
! 18{b4063c521f76545d8c94e999dd63f445d8c01cfc}
# 18{U2FsdGVkX19RJjdBbDB51ok1hkFXaB91NpZNoQjbVXYlMeMTaWRTdg==}?

Other files on the site have similar blocks of data, i.e.

n{<some l33t>}! n{<hex string>}# n{<base64>}?

Where n is constant.  Some of the base64 strings (this one included) when decoded begin with Salted__.  I've read that this often means the encryption was done by "openssl enc".  Not all of the base64 strings begin with this.

I am looking for suggestions on how to take my analysis further.  I believe the base64 string is the encrypted string.  I believe the "l33tsp34k" string is the key or very similar to the key ("buckeyes" in this example).  And I believe the hex info might be a hash (but the hash sizes are not always the same length).  I think if I can crack one, then the others should also crack.

Any suggestions?

I think you're on the right track.

The best you can do is to attempt to identify the information as a specific type, and this is what you've begun doing. Sometimes this is easy, other times it's not possible and you need to brute force guess different potential formats.

Along these lines:

You're correct about the hash guess
You're correct about the base64 encoded 'Salted__' being the identifier for openssl encrypted output. The next 8 bytes are typically the salt, and then after that the encrypted data

So you've been given some hints on the format of the encrypted data and a couple of strings that look like passwords of some sort. I think you're now at the brute force part of the puzzle.

Specific to reversing hashes: I'd suggest putting it into google as a first attempt to finding the pre-hash value. Google is a fantastic tool for this.

Good luck!


2FA and https enough security for public wifi? I'm at a place where there is public wifi, and I want to use it with trading accounts that contain some money. I have my account set up with google authenticator, and the connection is https. is all of this enough, or should I spend $100/week to use my phone's (slower) internet for security?

A public Wifi means an uncontrolled router an possibly an HTTP proxy. That means that you cannot rely on that to securely connect you to the correct server, not speaking of any MiTM attack.

But that is what SSL/TLS is made for: if your client browser is correctly configured (it should be...), the certificate presented by the server guarantees that you have reached the correct server, provided you control that the URL is the correct URL and actually uses HTTPS(*). Then the protocol ensures that everything exchanged between your client and the server is encrypted so you can pass you credentials there, and do whatever you need to do without risk of MiTM attack.

But the additional rule is that you should control the URL in the address bar of your browser - what should be done consistently anyway...

(*): if the URL does not start with https:// or is not exactly what you are used to, immediately close the connection because security cannot be guaranteed...


Is it okay to log sql queries for debugging I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I am kind of confused because some times logging statements can contain personal information like contact details, names and such. (No card or bank account details)
The minimum logging level at production would be info which means debug statements would be basically no-op. But I was wondering that can it be used as a security vulnerability?

You are talking around the idea of "data classification" without actually talking about it.
The data in your database has a certain level of data classification, whether you formally assign a classification or not. You secure and control this information based on its sensitivity and classification (e.g. passwords, personal data, company-sensitive data, etc.).
If you log query data, then those logs now have this data and should be secured and controlled in the same way as the database.
To not secure and control this data in the same way in line with the security and controls in the database that supports the data classification, then, yes, you are inappropriately exposing this data.
So, yes, it is ok to run debug logs of queries, as long as you secure and control it in line with the protections the data requires.


How to find PHP filename and ID of the URL? .htaccess is now a very common URL rewrite to make it SEO friendly and cover the database IDs.

What are the ways to explore php file on the server given to URL via .htaccess?

Example :
The URL is www.domain.com/news/56.

I expect to find news.php?id=56 i.e. www.domain.com/news.php?id=56

No, there is no way for you to find this.
The reason for this is that rewrite rules are not visible to the client, as they are performed server-side. You further cannot be sure whether or not it is a simple rewrite, or if the whole HTTP request is handed over to a complex web application, which parses the route to determine which class and method sends the response.


Does MITM refer to what you do in the middle or how you get there? Does the term "MITM attack" refer to what happens once an attacker is between two hosts or to attacks like ARP poisoning, DHCP snooping that allow the attacker to insert himself between two hosts in the first place?

A MiTM attack refers to the high level concept of intercepting traffic from host A, reading it, and/or modifying it, and then sending it to the original destination B, as if A sent it.

The techniques to accomplish this are an entirely different matter.  It might entail ARP poisoning, physically tapping a line, DNS attacks, sniffing wireless traffic, or even secretly stealing a briefcase of secret documents carried by a courier.


How is the Veracrypt decryption speed faster than simply duplicating the same data? I'm thinking of installing Veracrypt and I read that it takes Veracrypt about 5 minutes to decrypt a 500 gig SSD.  How is this possible?  It takes me much longer to duplicate the same 500 gigs on my SSD!
Can someone explain how this is possible?
This is how I analyze the situation.  The following are the fundamental tasks of each procedure:
1. Vercrypt has the computer read the data, decrypt the data, and then finally write the data on the SSD.  It does this over and over again.
2. When the same computer copies 500 gigs on the same SSD, the computer reads the data and then writes the data on the SSD.  It does this over and over again.
∴ Relative to the 2nd procedure of simply copying, the Veracrypt procedure is exactly the same except Veracrypt has the additional, complicated task of decrypting the data.  Veracrypt has to take longer time, no?
How could the Veracrypt decryption be faster?

Your initial claim seems incorrect. On modern processors with hardware AES instruction set and using SSDs with write speed equal or higher than read speed, VeraCrypt decryption is theoretically as fast as unencrypted SSD duplication.
From the VeraCrypt website:

Parallelization and pipelining allow data to be read and written as
fast as if the drive was not encrypted.

Assuming it takes hardware AES 3.5 cycles to decrypt 1 byte of AES data (as suggested by Wikipedia) modern entry-level processor with 4 cores should decrypt a few hundreds gigabytes of AES data per second.
4 cores * 4 GHz/core / 3.5 hertz/byte > 250 GB/min

The fastest consumer NVME SSDs on the market today can serve data just short of 3 GB/s, so unless the CPU is busy computing other data then the bottleneck is the SSD.


Mitigating the LUKS decryption key residing in RAM for FDE I've come to find Full Disk Encryption to be a rather unsafe method of securing data as standardized tools are becoming available to just read out the encryption key from RAM, where the system needs it to be to make use of the system partition.

The more secure approach I suggest is to have a separate data partition with user data with a separate encryption used as a cold storage and only mounted when files on it is used.

Preferably, the system partition should be secured as well.
My best idea for doing this is scripting a time delayed purging of keys from RAM, or shutdown, if the script has not received a timer reset. The timer reset could be anything, like a successful logon within 24 hours for a laptop. I'm guessing that one would normally logon to a personal laptop within 24 hours, but if lost in any way, it will not be in the hands of experts that read out RAM within that time.

Let me know what you think of this?

Rather unsafe is a little exaggerated. It's secure enough for the vast majority of people trying to protect their data from offline attackers.

If you are worried about a malware reading the encryption keys, you are worried about the wrong threat. A malware should be running with root privileges to read the content of the master keys on the memory, but a malware with root privileges would have access to all data anyway.

If you want to protect against someone stealing your machine while you are away, just configure your screen lock to unmount all LUKS partitions during the lock. You can even install blueproximity to automatically lock the machine when your bluetooth-enabled smartphone gets away.

If some agent with the knowledge and resources to be able to use a cold boot attack is targeting you, you will have to think on more than LUKS to protect yourself.

It's easier to get you to fall for a spear-phishing scheme than to use a cold boot attack. If someone is targeting you, and knows how to employ a cold boot attack, they know how to employ a host of targeted attacks before having to resort to a cold boot. Hole-watering, spear phishing, DNS redirection, even phony traffic tickets and USB-drive gifts can be used for tricking you.

A cold boot would require the attacker to get physically close, and at least steal your computer and disassemble it. But if the attacker can get close enough to take your machine, he can take you too, and easily getting your keys employing Rubber-hose cryptanalysis.


Handling the loss of a phone with FIDO UAF I would like to know how this UAF method works when we lose our phone. With Google Authenticator we have to save on a paper some info about the generation of the secret key. But how does this work with UAF?

If you have also some website that implements it and where I can try it thank you for sharing them.

According to the documentation, it appears that there is no graceful way to pass registration over to another device. Only deregistration and re-registration.

This makes sense since the keypair is generated on the device.


Is the standard scheme of RSA CCA and CPA secure? I'm looking through old tests in an information security course - and there's a question about CCA and CPA security of RSA.

I can't seem to grasp how I'd either show insecurity or prove the security for this.
(This is not a homework question, it is for my own personal understanding)

The question is as follows (relates to the basic scheme RSA):
For CPA secure, does an algorithm A exist so that given some ciphertext c, picks m plaintexts pt1,pt2,pt3,pt4,..., gets their ciphertexts and then returns the plaintext p for the given ciphertext c.

For CCA secure, does an algorithm B exist so that given some ciphertext c, picks m ciphertexts ct1,ct2,ct3,ct4,... , gets their appropriate plaintexts, and returns the correct p for ciphertext c.

Your "basic RSA" is probably not standard RSA as specified in PKCS#1, but the so-called "textbook RSA", which is insecure because it is reduced to the core modular exponentiation and does not include the padding, which is essential.

In "textbook RSA", public key consists in n (modulus) and e (public exponent). Private key is d (private exponent). Plaintexts are integers modulo n. The encryption of m is me mod n; decryption is obtained by raising to the power d because (me)d = m mod n for all integers m in the 0 to n-1 range.

Indeed, textbook RSA is not secure against Chosen Ciphertext Attacks because of the following: for the modulus n and all messages m and m', you have:

(mm')e = (me)(m'e) mod n

In other words, the encryption of a product is the product of the encryptions. In the CCA setup:

There is a message m and its ciphertext c = me mod n. Attacker knows c and wants to find m.
Attacker is allowed to obtain the decryption of ciphertexts that he chooses, as long as none of them is equal to c.
Attacker generates a random m' (modulo n) and computes c' = m'e mod n.
Attacker asks for the decryption of cc' mod n: this is an integer modulo n, distinct from c, so the attacker gets a response.
The response is necessarily equals to mm' mod n. Attacker knows m' (he chose it himself) so he computed m easily.

As for Chosen Plaintext Attacks: asymmetric encryption is necessarily secure against CPA, if it is to offer any security at all. Indeed, encryption uses the public key, which is public, thus known to everybody, including the attacker. If the attacker wants to encrypt some messages of his choosing, then he... just does it. He does not need any help from the private key owner, since encryption uses only public elements.

If textbook RSA was not secure against CPA, then standard RSA, with the padding, would be weak too: using his breaking method, the attacker would recover the padded message, from which he would obtain the non-padded message.

Now this does not mean that textbook RSA is secure against attackers who cannot obtain the decryption of custom ciphertexts. Textbook RSA has (at least) the following very serious issues:

As noted above, it is insecure against CCA.
If the message is a small integer, then the RSA problem may become very easy. For instance, if m is a 200-bit integer and the public exponent is e = 3, then me is a 600-bit integer, while the modulus is normally larger (at least 1024 bits). This implies that m can be recovered with a simple, non-modular cube root (which is easy).
Textbook RSA is deterministic; thus, if the message itself is amenable to brute force (e.g. it is a password), then it can be recovered by trying potential message values until a match is found.

Standard padding, as specified in PKCS#1, solves these issues: the padding ensures that the padded integer is large enough; padding includes random bytes. The old-style PKCS#1 padding (dubbed "v1.5") is actually not very strong against CCA, although it still is tolerably good when employed properly, as in SSL (it requires that the SSL server does not complain when the decryption of what the client sends does not have a syntactically valid padding). The new-style PKCS#1 padding (dubbed "OAEP") is strong (and even "proven strong" for an appropriate meaning of "proven").


Would it make sense to use Bcrypt and PBKDF2 together? I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would using both of them (presumably in a serial way one before the other) accrue the benefits of both and thus achieve an optimally secure solution?

Mixing the two functions would not really help. Bcrypt and PBKDF2 both have a configurable cost: you are supposed to set the number of iterations at the maximum value which is still tolerable in your situation, given the available hardware and the environmental constraints (e.g. average user patience). If you want to use both function together, then they must share the same CPU budget; in other words, you would have to decrease the number of iterations compared to what you would use in either function alone.

So you do not get something stronger that way; instead, you get a security level which is an average of what you would have got with Bcrypt alone, or with PBKDF2 alone.

Combining two hash functions or similar functions together is good to avoid a catastrophic failure, if one turns out to be broken; but, assuming that both Bcrypt and PBKDF2 are strong, and the question is mostly about performance (both bcrypt and PBKDF2 are about making exhaustive search slower, so this is all about performance). For optimal slowness, combining bcrypt and PBKDF2 is not a good idea.

For the choice between bcrypt and PBKDF2, see this previous answer. To sum things up:

Bcrypt is better if your hardware is PC-like (i.e. has several kilobytes of RAM with fast access). It is harder for the attacker to optimize exhaustive search with a GPU, if bcrypt is used, compared to PBKDF2.
PBKDF2 has NIST's blessing (it is Approved, with a big 'A'). NIST says nothing about bcrypt.
Bcrypt outputs 192 bits, which is fine for a password verification token, or if you just need 192 bits (or less) of password-derived key material. On the other hand, PBKDF2 is a key derivation function and can produce as many bits as you wish, which is good if you need more than 192 bits of key material.


Is LastPass' Formfill inherently compromised? Is there any sort of documentation to verify that the user info inputted with automatic formfill on "Secure forms" is protected from theft by a keylogger or trojan collecting clipboard data?

I ask this question because looking at their security implementation from an end-user stand point, it seems the only viable attack surface is capturing the formfill data, assuming you the account is otherwise secured with 2FA.

Aren't you kind of already at a worst case scenario level with security when there is a keylogger installed?

It would be very dangerous to assume that LastPass (or any program) can protect plaintext from being read on a compromised machine.

This question/answer might help guide your security practices:
LastPass - Best practices on foreign devices


does filling phone memory overwrite all previous data I'd like to ask a question. Does filling phone memory with junk data actually overwrite all previous data. Just in case I would like to say that I'm asking for android and iphone memory.
And is eeprom used in these phone or flash memory?

ps i also would like to ask one more thing. in iphone(above 3gs) when you factory reset the data in encrypted and the keys are deleted. so is the data in the worn out area also encrypted

No, not necessarily. Flash memory uses wear levelling (changing the physical location of data stored) to maximize memory life. Most flash memory has some "spare" space that is unreported that allows it to replace bad parts as they wear out. This means that there may well be small amounts of (worn/bad) memory that still holds some of your data even after overwriting all memory reported by the phone. However the data on this memory would be arbitrary and I would expect it would require forensic tools to recover it.

I'm not sure on the eeprom/flash part


How to store credit card information for repeated transactions and still be PCI compliant? I'm overhauling our absolute time-bomb of an order processing system that would put us out of business tomorrow were we audited for PCI compliance. It's so amateur it's scary.

I'm planning on making a case to the higher-ups that the liabilities of storing CC information outweigh the conveniences of not having to re-ask the customer for numbers, but I know I'm going to get asked how vendors like Amazon and such get away with storing information for repeat purchases, and I have no answer to this.

So, how do vendors like Amazon and everybody else who bills monthly authorize future charges without storing things like CVV info, which is expressly forbidden by PCI DSS v3?

I read elsewhere that tokens can be created and stored in lieu of stripe info, but isn't possession of a token representing the contents of the stripe just as valuable as the stripe info itself? Anybody with possession of the token could make fraudulent charges, so who cares whether they have that or the actual CC/CVV info?

Or is token conversion just a way of saying "we're not storing the actual PAN/CVV" and passing along regulatory compliance issues to whoever issued it?

Ivan, this is an absolutely huge topic. And you have a bunch of questions here. I'll try to help but this will likely be closed as too broad.

  I'm planning on making a case to the higher-ups that the liabilities of storing CC information outweigh the conveniences of not having to re-ask the customer for numbers, but I know I'm going to get asked how vendors like Amazon and such get away with storing information for repeat purchases, and I have no answer to this.

It's perfectly acceptable to store credit card data, but there are a ton of rules surrounding how you do it - where, how, auditing, etc. There are a lot of books on this subject.

  So, how do vendors like Amazon and everybody else who bills monthly authorize future charges without storing things like CVV info, which is expressly forbidden by PCI DSS v3?

You don't need to have the CVV info at all, it just helps with fraud. After checking it the first time (which can be done without writing it to disk) you can assume the card is not fraudulent. It has done the job it needed to do.

  I read elsewhere that tokens can be created and stored in lieu of stripe info, but isn't possession of a token representing the contents of the stripe just as valuable as the stripe info itself? Anybody with possession of the token could make fraudulent charges, so who cares whether they have that or the actual CC/CVV info?

Tokenization is good if you manage to get the cardholder information out of your environment and into someone else's care. The 'token' is a unique identifier that allows your system to still act in the traditional sense. You provide a list of tokens to your provider and they translate them into the real numbers.

This is good because it is their responsibility to store / process / etc the real numbers. Your liability disappears in this regard.

  Or is token conversion just a way of saying "we're not storing the actual PAN/CVV" and passing along regulatory compliance issues to whoever issued it?

Exactly, except it's to whomever processes it, not who generates the tokens. :)

Edit: a lot of businesses don't take interest without understanding the cost of non compliance.

See http://www.pcistandard.com/card-association-fines/


What does "hosts-modifier" tag in VirusTotal Intelligence means? I went through the help pages of VT and VT Intelligence, saw documentation about most tags, but couldn't find anything about the "hosts-modifier" tag, can anyone explain to me what does it mean?

It means the malware tries to modify the file named "hosts" (located inside "C:\windows\system\drivers\etc\"), in an attempt to alter the address the system will use to communicate with a specific DNS name.

For example, by adding the entry

127.0.0.1   update.microsoft.com

your system will always know that the IP address for "update.microsoft.com" is "127.0.0.1", and it would not need to make requests to DNS servers for that domain address.

The DNS name he tries to put there is stated under "Behavioural information", as you may see in this example.


entropy change when reading from /dev/urandom vs /dev/random I noticed that when reading from /dev/random, I have a very real impact on the entropy available on my linux box.

(reading from /proc/system/kernel/random/entropy_avail),

Yet when reading from /dev/urandom, (I understand seeded by real entropy but actually a CSPRNG), I can generate high quality entropy data, but my entropy_avail doesn't drop...

How is this possible, or am I missing something?

/dev/urandom uses a CSPRNG (Chacha20 last time I checked) to generate a stream of random data from an initial seed and allows the user to read an arbitrary number of bits from it. /dev/random pulls data out of a random pool that needs to be replenished.

It is possible to read from /dev/urandom before the system has enough entropy to provide a secure stream of data, in which case the kernel log should show a warning about an uninitialized read from it. If this is a concern, for example in embedded systems, then you'll need to use a hardware random number generator to generate additional entropy before you let programs start using it.

Provided the system gathered enough entropy, you'll get cryptographically secure random data from urandom and information theoretically secure data from random. If you're using a non-information-theoretically-secure encryption scheme or you're not generating vast quantities of encryption keys, then you might as well just use urandom.

You shouldn't read from /dev/random or /dev/urandom directly since the kernel exposes a nice getrandom system call that you can use in your programs, and it will help you avoid some pitfalls when trying to read from the character devices directly.

This answer has additional details about the differences between the two RNG devices.


Criminals using my IP when I use a VPN Is it possible for my IP address to be used by other parties when I use a VPN? My friend says that someone who is computer smart can use it for illegal activities, so it´s traced back to me.

Even when you use a "VPN done right" which makes all activity originate from the external IP of the VPN provider, you might still trigger a false positive and get wrongly accused for what another VPN user did.

VPN User A has an account on example.com. A is a perfect model citizen of the example.com community.
Then VPN User B also creates an account on example.com, and proceeds to break every written and unwritten rule of the website.
The admin of example.com intervenes. They check the IP of User B and see that A and B both have the same IP address. They therefor believe that A and B are the same person and both accounts get banned.

When the admin of the website notices that the IP is a VPN exit point and they are reasonable, they might revoke the ban for A. But they might not notice that unless contacted. That appeal process will still be inconvenient for A.

I've also seen websites which experienced increased abuse over VPNs and overreacted by assuming that nobody would use a VPN unless they have nefarious intentions (after all, if you have nothing to hide...) and decided to proactively ban all users who use VPNs.


What is the real benefit of a three tier architecture? As per title, what is the real advantage of using three tiered architecture, where the user interface in one layer, the second layer for application and third layer for database? I can understand that , for example if the user interface is compromised then hackers have another two layers to hack in order to get to the data. However on another point of view, wouldn't my applications be slower if my database is on another server? Also, does a three tier architecture always need to be protected by firewall in between each layer? Overall I think if one layer is compromised, it means it's compromised...no matter how well you protect your systems.

A three tier architecture does not necessarily mean that all the tiers are on different servers or even processes. It is more a thing that you abstract the parts  of your application from each other that lets them interact only with clearly defined interfaces. In your case it means keeping the storage logic (database) separate from the business logic (application) and from display of the results (HTML, CSS, ...). This separation is mainly a logical separation that allows an easier physical separation should you need it. The separation can be done inside processes (i.e. different objects for the tiers), or even different systems.

The separation between these parts is not mainly done because of security but so that you can easier understand and manage the application. It makes it possible to make changes on one layer without many changes to the other layer, i.e. you could scale the database or even change the underlying database without much impact to the application layer. Or you could have different UI (web, mobile app...) ideally without changing the application layer and the database.

Of course this kind of separation can be helpful for security too. Clearly defined interfaces between the tiers make it easier to audit the application. You could also better detect and deter possible attacks if you actually know how the parts should interact with each other. In short the application can be made more robust  with less effort, which helps to scale, it but also helps in security.
And if the different tiers are actually separate processes (which is usually the case with at least web server and database) then you could put them into different security realms, i.e. different user accounts, different containers, VM or even different servers. This helps in keeping the system more robust and less attackable too.


Intel SGX and MSRs - what do developers need to know? Intel SGX is an intriguing new technology that will ship as part of upcoming Intel processors.  It is designed to enable running software in a secure enclave.  Code running in the enclave will be isolated by the hardware from untrusted code running on the same processor, so you can execute security-critical code in the enclave and protect it from attack.  While SGX is not supported in currently available processors, Intel suggests that it will be available soon.  The hope is that this might provide a strong foundation for certain kinds of isolation: developers will be able to run certain code (e.g., crypto key management code) in a secure enclave, with guarantees that other code won't be able to tamper with it.

A model-specific register (MSR) is a special configuration register that controls the operation of the processor.  For instance, MSRs can be used to enable branch tracing, performance counters, hardware watchpoints, and other useful special features.  Normally, only privileged code can read and write most MSRs.

My question: How does SGX mode interact with MSRs?  What do developers of code that runs in SGX mode need to know about MSRs?

The SGX specification doesn't say how SGX mode interacts with MSRs.  However, you could imagine that MSRs could potentially pose a risk to code running in an enclave, depending upon how the two interact.  For instance, if untrusted code could enable branch tracing (via a MSR) and then trigger invocation of a secure enclave, and if this setting was retained across the mode switch causing all branches taken by the enclave code to be recorded into memory accessible by untrusted code, then this could allow untrusted code to mount powerful side-channel attacks against enclave code.

So, how do the values of the MSR affect execution of code running in an enclave?  Are the MSRs ignored when running in enclave mode?  Does code designed to run in an enclave need to clear/reset all the MSRs before doing anything sensitive?  What do developers of code that'll run in an enclave need to know about how MSRs work in SGX mode, to write secure code and protect their code from attack?

This is a great question! Never thought about this until you asked.
Firstly, code running inside a secure enclave runs in ring 3. So all restrictions that apply to untrusted non enclave ring 3 code apply. So an enclave cannot write to MSR's.

Next, the specs don't explicitly mention anything about MSR's but it does tell you about interaction with IA32 features. For the branch tracing example you gave, look at the section on LBR(last branch record). This tells you exactly how it interacts. From my understanding, EENTER/EXIT instructions are seen as one long branch each to the entry point inside the enclave. Anything that happens after you jump to code inside the enclave is not recorded or visible to untrusted code no matter the privilege because the branch records are popped out of the LBR stack on enclave exit. It is only visible on a debug opt in entry that can be set by the developer of the enclave and as the name clearly states, the enclave is in debug mode.(See chapter 7,section 5 on branch tracing.) So the side channel you are talking about should not be possible.

Branch tracing side channel attacks might not be an issue, but other kinds of performance monitoring could be an issue.  Page faults, memory accesses, cache behavior, etc. can still be monitored. Cache-based side channel attacks are still possible as well. So yes side-channel attacks are possible against enclave code. The Haven paper from Microsoft explains the kind of limitations that SGX still has in terms of side-channel attacks.

And to answer your question, what an enclave developer needs to know about MSR's depends on what kind of attacks the developer expects in his code. I assume there will be some sort of threat modeling while designing and developing the enclave and based on what threats you expect, you need to figure out how SGX treats these threats. The branch side channel attach is an example of figuring out how SGX treats it.

For the most part, I expect any MSR/register/processor state that could leak information about the enclave and its execution are hidden/protected from untrusted code, privileged or unprivileged and an enclave writer need not worry about it.


File inclusion on a website always appending .php I'm looking at a website that uses a URL parameter to include the current page, like http://host.tld/index.php?page=about.

If I add anything other than the current page (e.g. http://host.tld/index.php?page=test) it reflects the parameter, added with a .php and states that the resource was not found.

Here reflected XSS already works, but I'm trying to include other files.
Now, if I put /etc/passwd as the parameter, it doesn't find the /etc/passwd.php file.

I've tried to add %00, %2500 and \0 to the end of the parameter, none of which works:

%00 throws an error:

  Warning: file_exists() expects parameter 1 to be a valid path, string given in /var/www/html/index.php on line 69

%2500 reflects the parameter (test) as "test%00.php"
\0 is simply added to the parameter when reflected, like test\0.php

The .php is not added on the client-side.

Is there any other way to exploit this to include other system files?
The server response states Apache/2.4.10 (Debian).

Did you check if you can include a remote file (did you specify a URL as file)? If it's a classical LFI then you might not be going far with it because the php guys eventually fixed the bug with adding a %00 to cut off the string. What you can do now is you can scan the web server file system for php files. Maybe that allows you to detect new attack vectors but as often in pentesting you have to use your creativity if you want succeed.


John The Ripper 'No password hashes loaded' Please forgive the newbiew question, but we all have to start somewhere, right?

Following reading this excellent book, I am trying to learn John. I've been through the FAQ and this tutorial, but am stuck.

I have made a SHA256 password hash. It's super simple. The password is 'password' mixed with the salt and hashed just once. I now want to use a tool to crack it.

I've saved it to a file in a format that I think is correct (see screenshot below).

When running the following command, I get 'No password hashes loaded'

What should I do to get this working please?

Command: john -single passw

Your hash is base64 coded. You must decode this before use john.
You can use the command :

base64 -d <hash>

If you want to be sure of the hash format, you can use :

hash-identifier


Can I determine the cipher used to encrypt a file with OpenSSL? I have two files which were encrypted using OpenSSL. I know that that first one was encrypted using bf-cbc, and I also know the password to decrypt it. The second file is likely to use the same password, but when I try to decrypt it I get the following error message:

bad decrypt
29034:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:330:

If I try and decrypt it using a different cipher (say aes-128-cbc as it's the the first in the list) I get the exact same error message.

So is the error I'm getting due to a bad password or the wrong cipher? Is it actually possible to tell? I figure I could try every cipher in my OpenSSL version and see if any of them work. Is there a shortcut to try this?.

If your cipher is using padding (i.e. is not in a streamed mode such as CFB, OFB, CTR or CTS), then it may be able to tell just by looking at the encrypted data's size. For instance if it is 24 bytes (192 bits), then it could be Blowfish (because it has a block size of 64 bits, and 192 is divisible by 64), and it cannot be AES because 192 cannot be divided by 128 (AES's block size). But since most block sizes are multiples of one another, this will probably not be very helpful, but it can be used to narrow the choice down sometimes.

If the above method failed, then it is computationally infeasible to distinguish data decrypted with the wrong key with the correct cipher and data decrypted with the correct key with the wrong cipher. They both produce random data. (this can be formalized assuming the cipher is a random permutation). This is unless the cipher has big weaknesses, of course, which is probably not the case if it is included in OpenSSL (except the old export-safe ones like 40-bit rc4).

So the only way is to try all the possible ciphers the data could have been encrypted with (there are an infinite number of potential ciphers, but only a few are actually used in the world). You could always whip up a script to automate it.

Of course, you can store the cipher used to encrypt the file next to it (or within it), like a byte that takes a different value for each cipher. If the key is kept secret, this presents no security risk (modern ciphers are designed to rely completely on the key - see Kerckhoffs's Principle).


How does a PCI QSA audit a company? Corporate setups are often complex with data centers in multiple locations, complex ACL's and networks setup between them.

How does a PCI auditor actually audit the systems ?
How does he get to know about the insides of the network in that
corporation ?
Is there any policy by which the company has to disclose facts to
the auditor for his work?

If a company wants to store, transmit or process credit card payments they must provide the information the QSA requests. If they deny access to this information, they can be denied the use of VISA and Mastercard payments - which can put a company out of business very quickly!

When I have run pre-PCI audit readiness engagements, I will want full information about every part of the payment data pathway, including physical controls, network infrastructure, team access, authentication, encryption, storage, 3rd parties etc.


Does SSL VPN work with standalone mobile applications? I have been reading a certain article about SSL VPN and it got me thinking. Is it possible to integrate this technology in a banking server? can or does it support standalone mobile applications?

To summarize the discussion in the comments:

SSL/TLS is an established technology to provide communication well protected against sniffing and modification. It is used most prominently as the security layer in HTTPS, i.e. to securely access web sites. But it is also to secure mail delivery and more.
A VPN is used to securely connect to a different network. SSL-VPN's are using SSL/TLS as the underlying protocol to provide the necessary security, similar to HTTPS using SSL/TLS as the underlying protocol.
In case of connecting a mobile banking app to a server using a SSL/TLS connection (often with HTTP on top, i.e. HTTPS) is the common way to provide the needed protection for data exchange.
While in theory one could also use a SSL-VPN in this case this would not provide any benefits since only the connection between mobile app and the server application need to be secured and not between the mobile app and the whole banking network. In other words: the protection by SSL/TLS is needed but only as a connection between two application and not in form of a VPN. Moreover, using a SSL-VPN instead of a simple SSL/TLS connection would add useless complexity which actually might decrease the security instead of increasing it.


Does storing two components of a secret in two places increase safety? Let's say I have a secret integer X, and so I don't risk losing it, I store it encrypted on some cloud service.  But I think there's a small probability that it gets hacked.  So to help allay those fears, I generate a random number R, and store X+R on the cloud, and R on some other cloud service.  It seems like I should feel more secure, since a hacker cannot do anything with X+R alone, or R alone.  Is this right?

PS: I guess I have also increased my chance of losing my data (roughly doubled).  But it seems like probability of someone figuring out X has probably decreased by a much greater fraction (1/P) than this doubling.

Yes, storing parts of secrets in multiple locations helps prevent against their unauthorized use.  An attacker would need both parts (in the scheme you describe) to make use of your secret.  As you point out, it also doubles the risk of you losing access to your secret.  In the world of the CIA triad (Confidentiality, Integrity, and Availability), you've traded off lower Availability for higher Confidentiality.  If you're comfortable with that ratio, you can stop here.

If you want more control over the ratio of Confidentiality and Availability, then you can use a scheme invented by Adi Shamir (the S in RSA).  Shamir's Secret Sharing Scheme is essentially "RAID" for secrets.  You store multiple pieces such that some number of pieces is necessary to reconstruct it.  For example, you can "split" the secret into 5 pieces, but in a way that only 3 are necessary to recover the original secret.  Assuming you have enough places to put the keys, this means you'd need 3 failures to lose access to your key, and an attacker would need to compromise 3 hosts to gain access to the key.


Risks of running Honeypot [specific setup] I'm planning to run a Honeypot with the following network setup:

In order to avoid the honeypot coming in direct contact with my Internal network, I put it behind a firewall configured on a Linux VM with iptables.

There are the rules:

iptables -P FORWARD DROP

iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-destination 10.0.0.5

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -d 10.0.0.5 -m state --state NEW -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Running a port scan on GRC Shields Up successfully shows the relevant ports to be open. And accessing

netstat -antp

Shows no services running on the Linux VM. In case this VM is attacked.

Are there any holes or misconfigurations in this setup? That can lead to the honeypot coming in contact with the 192.168.1.0/24 network?

As long as your router has its access rules to not allow any connections from your honeypot to the rest of your network then that should work out fine. Only allow connections from the management network or IP addresses to the linux VM host and honeypot, that way if either is hacked it won't be able to attack your network directly.

Make sure there's no information on the linux VM host or the honeypot that can be used to attack your network. Don't use the same usernames or passwords, and don't store any information on them at all.

Also, hopefully you've given us fake IP address ranges, otherwise you're enumerated the IP Address ranges you use on your network in which case I'd change them.