How can someone sinkhole domains? The Wikipedia article about CryptoLocker says:

  In late-October 2013, security vendor Kaspersky Labs reported that with the help of a researcher, it had created a DNS sinkhole to block some of the domain names used by CryptoLocker.

The Wikipedia article about DNS sinkhole says:

  A DNS sinkhole, also known as a sinkhole server, internet sinkhole, or BlackholeDNS is a DNS server that gives out false information, to prevent the use of the domain names it represents. The most common use is to stop botnets, by interrupting the DNS names the bot net is programmed to use for coordination. Sinkholes can be used both constructively and destructively, depending on the target.

How does this work? Who can sinkhole domains? I‘m a DNS layman, so please bear with me.

As far as I understand it, you need to control/own one of the top DNS servers that other DNS servers use, right? That way all the other DNS servers get the updated (= wrong) IPs for the domains in question. Otherwise you’d only reach a small number of users (e.g. those that use a specific custom DNS server you control etc.).

So does it mean that "Kaspersky Labs and the researcher" control such a DNS server? Or does it mean that they simply identified the domains in question and submitted them to the DNS server operators (in the hope that they’d block them)? Or is there a way to sinkhole the domains without controlling a DNS server?

And is there a way to notice that a domain is sinkholed? Maybe a flag or something? Or is the only way to consult an additional, alternative DNS server and compare the resolved IPs?

In the article referenced by the Wikipedia page, things are clearer. Here is the story:

The CryptoLocker malware encrypts the user files with a randomly generated key. In order to enact the ransoming, the malware must send the decryption key to a command-and-control centre operated by the bad guys. A single, fixed C&C server IP or name would soon be shut down by authorities. To avoid this issue, the CryptoLocker authors used the following scheme: the C&C registers random-looking domain names at a rather high rate (1000 per day !). The domain names are generated with a deterministic pseudo-random algorithm, that the malware knows too. Therefore, when CryptoLocker executes on a victim's computer, it tries to use one of the domain names du jour in order to talk to the C&C. The attacker's hope is that law enforcement agencies will have to go through heavy administrative bureaucracy to force the shut down of a domain name, and won't be able to do that 1000 times per day.

Since the malware knows the domain-generation algorithm, a researcher (Dimiter Andonov) reverse-engineered the code, and thus became able to predict the domain names in advance. Kaspersky "sinkholed" three domain names out of the 3000 for three consecutive days; this means that they simply... registered these domains. Which prevented the bad guys from doing the same, but also gives some data to Kaspersky. Kaspersky wanted to make measures, not to contain the infection. With their three domain names, the saved about 1/1000th of the CryptoLocker victims during three days (not a high achievement, generally speaking), but they also obtained statistics on the worldwide distribution of victims: 1/1000th of the CryptoLocker-infected machines, during these three days, talked not to the C&C, but to Kaspersky's systems, who of course told them not to encrypt the data, but also noted who talked to them.

To really block CryptoLocker at the DNS level, all 1000 domains each day would have to be blocked (e.g. by root DNS), which could imply some collateral damage (normal, honest domains may be, out of bad luck, part of the randomly generated names).

The term "sinkhole" is somewhat abusive here. A real DNS sinkhole implies something more forceful: the sinkhole is a DNS server which "somehow" gets inserted in the chain of DNS servers who will get asked for their opinion on the resolution of a given name. A local version is easy: put some explicit host-to-IP information in /etc/hosts (or its Windows equivalent), which will override anything that external DNS system may say about the name. For a more global effect, this has to be done either at the OS level (e.g. Microsoft may push an OS patch which alters name resolution) or on a root DNS (or a "sub-root" like the ones for "co.uk").

In that sense, the difference between a DNS sinkhole and DNS spoofing is that in the former case, it is performed by "good" people. Formally, it is a kind of attack... which reminds us that the vendor of the OS and browser you use (e.g. Microsoft) and the root DNS operators are "trusted": if they are hostile to you, you are doomed.


Could a Chromecast be compromised from its default open network? I left my apartment for few days, so I disconnected my wireless router but I forgot to disconnect my Chromecast as well. I remember that when a Chromecast can't find the network it was connected to anymore, it creates an open network that can be used to reconnect to another wireless network.
The issue is that I'm away from my apartment for a few days and my Chromecast is probably currently broadcasting an open network that anyone can connect to.
Even if there is no internet connection on that open network, there are two things I'm worried about.

The Chromecast could be attacked from a wireless exploit. We don't know how someone else's computer could be infected by malware, the Chromecast could be attacked once that infected computer connects to it (for example, by running wireless exploits against). Even, the worst scenario could be an attacker just connecting to that Chromecast open network and directly run exploits against it.

It might be possible for someone who can attack the Chromecast to get the wireless network password that the Chromecast was previously connected to. This password might be obviously stored somewhere on the Chromecast memory and with some access to the filesystem by a kind of jailbreak (for example, the point 1), it could be retrieved and used to connect to my wireless network.

Considering those two points, should I factory reset my Chromecast once I'm back to my apartment? Or even safer, should I get rid of this Chromecast considering that the firmware could have been compromised and buy a new one?

An attacker could connect to the open network, but there is nothing but the Chromecast itself they could reach there since nothing else is connected. If the TV is turned on, they could potentially cast to the TV and play whatever they wanted on it. This could be used for some less than fun pranks I guess.
As for your points #1 and #2, these are theoretically possible. Any device can be hacked. But it is not on the level I would expect from an opportunistic attacker who happends to stumble upon an open network. Unless you are a high value target, I would not be worried.
So should you factory reset the Chromecast? Yeah, if nothing else to make sure no one else but you has access to it. You could change your wifi password as well. But should you buy a new Chromecast? No. The cost benefit calculation on that one is not good. Theoretically, your TV could have been compromised through the HDMI connection of the Chromecast but you wouldn't throw your TV out because of this, would you?


Can my computer be compromised by uBlock/Adblock filter list? uBlock is open source and suppose I trust the author. But filter lists are something that is maintained by other people. Is it possible to add something to a filter list to compromise computer/browser, for example, get my data and send them to the attacker's server?

The question was emerged by reading:

  High-medium generic filters are implemented as follow: All the
  high-medium generic filters which matches the 8 first characters of
  the URL of a link on a web page will be seen as relevant to the web
  page and thus a CSS selector based on these filters will be injected
  in the web page, in order to hide the unwanted links.

If the author of the extension not only hides DOM elements, but injects something (CSS?, only CSS?, is safe to inject CSS?) to the page, can it be possible to inject JS script to all my pages, which will send my data to the attacker's server?

Without doing a complete code review of uBlock, the answer would be "yes" the author of an extension that has access to modify the DOM could add and remove CSS and JS. The LastPass chrome extension injects javascript to form-fill passwords. uBlock uses CSS and blocks remote library requests. Both of these permissions can lead to vulnerabilities and unintended consequences such as the recent revelation that CSS can be used to steal credit card information under certain circumstances.

I have personally seen rogue extensions that have been installed on customer machines that add "Russian Bride" and pharmacy ads to Google's homepage by modifying the DOM.

That being said, the community that works with uBlock block lists are diligent, and if there was a problem, I would imagine it would be short lived.

In the end, as you pointed out in your question, you have to decide if you are going to trust the extension and the author.


What encryption is possible for ReadyBoost? ReadyBoost is a technology to assist getting Windows Vista or 7 to load faster on memory-constrained PC's.

Since a USB stick can be easily removed, what security options are available for this solution that won't negate the performance benefit?

ReadyBoost by default uses Advanced Encryption Standard 128 (AES-128) encryption, which should be sufficient. I doubt very highly that your grandmother's cookie recipe needs DoD grade encryption. If the system is in contact with highly confidential information, perhaps you should invest in more RAM and find a full-disk encryption solution (also enable encryption on dump/log & hibernation files).
I haven't tried this, but you could attempt encrypting the USB with TrueCrypt. In order for ReadyBoost to work, it will need to be mounted in TrueCrypt (since Windows can't work with data that is encrypted by the user). All subsequent data that is written to the drive will be encrypted (both by ReadyBoost and TrueCrypt). This of course presents a new threat, if someone took your computer (or transferred data) while the drive was mounted in Windows and TrueCrypt it would be in plain text.
Since ReadyBoost is only used for cache purposes, read/write overhead due to encryption/decryption won't be noticed. Typically, if data is eligible for cache-storage, it's no longer in use anyway. You should also make sure that the cache on the drive is cleared at shutdown, since you'll no longer need it (I don't think Windows will clear drive's contents, even if it is for cache purposes, I could be wrong!).
Additionally, you should consider clearing your virtual paging file on shutdown as well, it will add a significant overhead to your shutdown time though. So if you need quick graceful shutdown to clear your session keys from memory (FBI knocking?), this may not be a good idea.

Windows Administration - Inside the Windows Vista Kernel: Part 2 (Underneath figure 1: ReadyBoost device test results in the registry)
ReadyBoost Q&A (Q: Isn't user data on a removable device a security risk?)


Cufon or Prototype as an attack vector for Blackhole exploit kit? I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.

Specifics:

It's being detected as a Blackhole exploit kit inside of a Cufon font.
The exploit adds some Javascript intending to load more Javascript from an off-site URL (Currently down, so no way of further analyzing.)
The page appears to be flat HTML -- no server-side code at all. This rules out quite a number of attack vectors.
The only other Javascript on the page is cufon.js, prototype.js and Google Analytics.

To that end:

Is it at all possible to use Cufon.js or Prototype.js to write to the server's filesystem, ultimately using those scripts as an attack vector for Blackhole?
If not, are there any possibilities other than server-level vulnerabilities (SSH/FTP passwords, insecure server configuration, etc.), with maybe the exception of the designer using a compromised pirated font?

Many thanks!

As JavaScript runs on the client side, you can't use it to write to the server's filesystem unless the filesystem/server is already compromised. In other words, the attacker already included, for example, a PHP script that will respond to the JavaScript commands and execute them on the server side.

Your first step now is to scan the server for any such dynamic files. Note that there are also other tools such as http://nodejs.org/ and many many others that the attacker might install to conduct additional attacks.

Having done the above, and cleaning up the Cufon font file, I guess you'll be pretty secure.

Final recommendation. Use this awesome security scanner: http://sitecheck.sucuri.net/scanner/

Cheers!


Packet Filter vs Application proxy http://postimg.org/image/b1w3bujnv/

I don't understand the highlighted part in red.

Firstly,Why is a packet filter is enough in a situation where traffic is busy?

Secondly,Isn't application proxy safer than packet filter considering proxy can filter bad data like virus?

Thirdly, is it okay to use stateful packet filter instead of packet filter?

Fourthly, when should i use non-stateful packet filter, stateful packet filter and application proxy?

An application proxy (or more commonly called application level gateway) is a firewall at the application level. A packet filter is a firewall at the packet level. This mean with a packet filter you are not able to filter web traffic for malware since it has no understanding of the applications protocols of the web (i.e. HTTP). An application level gateway instead understand the protocol and can thus scan the body of a HTTP response for malware.

See also the OSI model: a packet filter is at layer 4 while an application level gateway is at layer 7.

  Firstly,Why is a packet filter is enough in a situation where traffic is busy?

This statement is wrong. The only criterion to decide if you use a packet filter or an application proxy should be the security requirements and not the performance. While a packet filter is much faster than an application proxy it is of no use if you actually need application level inspection.

But a packet filter has its use too as a way to separate networks or as the first line of defense like against DOS attacks.

  Secondly,Isn't application proxy safer than packet filter considering proxy can filter bad data like virus?

That is correct and very important.

  Thirdly, is it okay to use stateful packet filter instead of packet filter?

A stateful packet filter is still a packet filter so you can use it. Keeping states has the advantage that you can make more strict rules (i.e. based on connections and not on single packets). But it needs more memory.


Apple ID Created With My Email Address A little similar to this question. but rather than hack my email address someone has created an Apple ID with a gmail address that is similar to mine, but had dots '.' in it.  For example if I have myemailaddress@gmail.com some one has used myemail.address@gmail.com as their apple ID.

According to google support I effectively own both email addresses as the dot is ignored.  Given this,  I am receiving a number of emails from apple for this ID (mainly app purchases, all through store credit), along with emails asking to verify the account.

So

What should I do about it?  I have no means of contacting the real user of the apple ID
Given that I own the email address am I allowed to change the password and lock out the "owner" of the apple account? As an incentive to get the other person to correct their mistake.

To Clarify I do have an apple ID account, but it is not tied to my gmail account

Is he using your credit? If so contact Apple.

If he's not, then he just might have the same name as you and he's not really doing anything wrong. What you can do is send an email to apple making them aware of the problem so they can force the user to choose a new email address. Since you do not own the apple account, it's not really your right to change the password.


Permanently delete a record Say there is a SQL database that stores certain records in encrypted. A person wants deletion of a record in a way that even hard drive recovery services cannot recover it without breaking the hard drive.
Is it possible to delete records this way?

The more layers you add above the actual data, the harder it will be to securely erase it, because it could have been stored in caches, journals, etc.
Most SQL databases first store information for data modification in a rollback segment to be able to rollback the transaction. Unless a specific database has an option to securely wipe the rollback segment, you should take care of it yourself, and depending on the database, it could be hard if it is even possible.
Furthermore, for security reasons, many professional-grade databases offer a journaling feature. This is a nice recovery feature in case of a crash: you re-install a backup, and replay the journal files registered from the backup date. It guarantees that all records added since that backup are stored in the journal files.
And this does not account for possible caching operations...
Said differently, if you want to securely erase some record, you are better off storing the record directly in a file and preferably not on a SSD drive*. That way, you could rewrite the records many times with a well-known erasure pattern making the original record un-recoverable.

(*) ssd drives can write a new version of a block in a different place. Most offer a secure erasure of the full disk, unsure for the secure erasure of a disk sector.


Personal digital certificate how to verify A server certificate would have its domain name at its subject field. A personal certificate would have your name as the subject field. How can you be sure that there are no two certificates with the same name?

Eg:- Assume you need to send some encrypted data to userA. How can you be sure that its userA and not some other person?  Just by verifying the name on the certificate would not remove the risk of man in the middle attack I suppose.

The purpose of a certificate is to bind a public key with an entity and this is the responsibility of the PKI's Registration Authority to ensure that the entity identity in the certificate matches the key holder entity (e.g. for SSL certificate an entity can be a server, the identity is the domain name).

The procedures describing how this match is performed by the RA can be found in a public document published by PKI and named the Certificate Policy.

This is the responsability of the user of a certificate (for encryption of signature validation) to read the CP and decide how trustworthy the Certification Authority which issued this certificate is. Of course you do not put the same confidence in some PKI which declares that only the key holder's email is verified and a PKI which delivers the certificate on a smartcard, directly in the hands of the key holder, with an offical ID check. But sometimes verifying the email may be sufficient.

Actually the most important questions to ask are:

which data in the certificate have been checked by the RA?
did these data collected in a trustworthy way?
according to your needs (email signing, electronic signature of a contract...) can you trust the certificate?


US export control on open source libraries I want to ask, is the US export control applicable only to US citizens?
E.g. I think Bouncy Castle are Australians.
Do use of their library fall into export control regulations?
I do not understand this export control

As I understand it, if I build it from within the US and sell it to other countries it's under export control.

If I consume someone else's libraries while I am in the US that were built either in or out of the US and sell it to other countries its under export control.

If I consume someone else's libraries that were built in or out of the US and only sell to companies in the US, it's not under export control. However, those who I've sold it to are under export control if they resell the product to an external country.


CEH or GIAC - Which one should I pursue? After a lot of Google and forum searches, I found out CISSP is one of the few valuable certs. Unfortunately, I only have 2 years of experience and don't have any specific experience in security testing. Which should I pursue, CEH or GIAC? Are there any other good options for me?

If you are focusing on Security Testing, the CEH does seem to be a useful entry level certificate. See the answers on this question on professional certifications. It will get you an understanding of the common tools used in the industry and it is recognised by recruitment agencies.

It doesn't give you the broader view of security, as to where it fits in with real world business needs, but to be honest, that will be further down the road for you and when you want to start looking along those lines, studying CISSP (links to free resources here) gives you a wider perspective and it is a very well respected cert.

GIAC is more in depth, and requires more knowledge and experience, but is valued higher than CEH. It is not an entry level cert.


What you can do with super cookies on subdomain to harm domain? When you search in Google for user cookies top results are VPN services that say that it's used by ISP to track the users. Wikipedia Supercookie say nothing about HTTP headers and what exactly are super cookies.
I'm interested what the subdomain can do to harm the domain. Are supercookies the same as HSTS supercookies as describe in this question What are HSTS Super Cookies?
I was suggested by some person when we were discussing scheme.org that will act like umbrella for different subdomains that the domain should be reported to https://publicsuffix.org/ otherwise subdomain can steal login cookies, this is unlikely because in one article (at some VPN company) I read that those are not actually cookies only HTTP headers.
So can someone explain what are exactly super cookies and what potential attacker can do to harm the domain? Or what are any vector attacks the evil person can do with super cookies?

A super cookie is basically and identifier which makes it possible to identify a specific user or user group over multiple domains and which is more or less resistant against anti measures.
The actual implementations vary. But the basic idea is that the identifier is not bound to a single property like HTTP cookie, browser fingerprint, IP address, Etag, HSTS or simlar but that it combines multiple properties. This makes it resistant against particular anti measures, since it is possible to identify the user again even with a subset of the original properties.


What is the state of the Windows Update certificate after Flame? May 28, The Flame malware is discovered in Iran and by Kaspersky Labs.

June 5, Dan Goodin (Ars Technica) points out that Flame had hijacked WindowsUpdate, spreading signed malware through that channel.

June 17, Ryan Hurst argues that the certificate is flawed based on Qualsys SSL Labs reports, and is countered by Ivan Ristić stating "SSL Labs reuses Mozilla’s trust store", which (I think) means that SSL Labs is unable to correctly critique out-of-browser  systems such as WindowsUpdate.

Today, SSL Labs still does not trust the certificate.

My questions are:

Is the WindowsUpdate certificate (still?) flawed?
Can SSL Labs be used to rate such a service?
Is there a reason for WindowsUpdate to support SSL 2.0?

In short:

No, all CRLs were updated to revoke the offending cert, and Microsoft took steps to prevent MD5-based certs from being issued again.
Possibly, if you use a proxy to inspect the traffic. Not really sure how you'd go about setting this up. You could manually check the handshake in Wireshark though.
Maybe. There are still some strange crypto export rules in the US, which SSL 2 might help get around. It may also be a legacy thing - I bet there are still old XP SP0 boxes out there with no SSL 3 support.


This facebook page looks different - phishing attempt? After logging on to a public wifi, I was redirected to this page appearing to be from facebook, and being done via https:

which looks markedly different from my normal facebook page

I understand that if I don't trust a web site, I shouldn't use it.

But what's going on here?

The page is legitimate, even though it looks different - maybe it's in mobile mode.
The wifi is taking me to a page with a domain that looks like "facebook.com", but is a homograph attack.
The wifi is telling me that the page has a domain name of facebook.com, but it's lying.

This is a normal facebook page. They just redirected you to a "Company page", that actually looks quite different than your personal "feed" page.

The wifi actually redirected you to this page:
https://www.facebook.com/CityLifeAUS
and its pretty common for Wifi's to redirect you to their custom "start page" after authentication as a form of advertisement.

and thats why you got logged in automatically too.


How to prevent ISP impersonating me to send email? My email server(admin@myEmailDomain.com, ip 1.2.3.4) ---> ISP network ----> Gmail

I built my own email server on my personal computer(ip 1.2.3.4). I also control the domain.

It seems that my ISP can impersonate me to send emails on my behalf.

The threat mode I am imagining is that my ISP allows normal traffic flows in and out but it just sends some emails from time to time on my behalf. My ISP doesn't take away my IP or stop me sending emails or accessing the Internet.

And I think neither SPF, DKIM or DMARC can protect me from that. And TLS is pointless here. My ISP doesn't need to look at my email, it can directly pretend to be me and send emails via plain text or TLS connection.

I was thinking that DKIM can protect me from that threat. But I made a test Can I set dmarc to tell receiver to fail if no DKIM signature provided in email? and it seems that DMARC might not work in this way.

Question:

Is the threat I described feasible? (I may get it wrong, but I think an ISP can do that)
What can I do?

If an entity other than you (e.g. your ISP, or your email service provider) has control of the domain of your email address (e.g. comcast.net, or gmail.com), then it's possible that this entity could forge messages from you (in that these messages would appear to have been sent from your email address), and do so in such a way that these messages would pass all SPF, DKIM, and DMARC checks.

However, if it is your practice to digitally sign messages that you send (e.g. using S/MIME or GPG or PGP), and your recipients are in the practice of verifying the digital signatures on your messages, then this would prevent these entities from forging messages from you, assuming that these entities do not have the private key that you use to sign your messages.


Using different GPG keys for encrypting emails and encrypting personal files? I'm going to use GPG for

Signing my documents
Encrypting emails
Encrypting my personal documents.

Will it be better for security measures to use different encryption keys for 2 and 3? For 3, it is just for encrypting my personal files and I think using the same key for encrypting and receiving emails which of course, published to the public will be a security risk.

This depends on your threat model. From a purely cryptographic perspective, there is no downside to encrypting different types of data with the same key. GnuPG creates a master key which is used only for signing, and then creates, by default, a single subkey for encryption. I take it you are asking whether or not you should use that single subkey or you should create an additional subkey?

The main reason to create a new subkey is to facilitate key management. You have increased control and can, for example, revoke one subkey without revoking the other. You can also use different passwords for each key, or even keep them on different media (such as smart cards), reducing the risk of compromise. Compartmentalizing each subkey and assigning it to a particular task is often good practice reasons like this, even if there is no specific security risk in terms of cryptography to using the same key for two distinct purposes.

I think I should point out that you may not want to encrypt personal documents with asymmetric cryptography. If you are the only one who will be encrypting and decrypting the files, you should instead use a symmetric cipher, such as AES. GnuPG supports pure symmetric encryption without using an RSA keypair. This has the benefit of being more efficient, as well as not being vulnerable to advances in quantum computing or breakthroughs in integer factorization.


How do personal/private cloud products work? On amazon.com I found some personal cloud NAS products and was wondering how some of them work. In this article the author discusses the My Cloud app and how it can be used from any internet connection to download the data save on the the personal cloud. Doesn't that make it not personal anymore, because doesn't the data have to go through  WD's big server? Otherwise how can a simple NAS act as a server without having a static ip (etc.) configured?

Basically I'm asking, how can these devices be accessed from anywhere and still be secure and private? To quote one review

  Once I downloaded the WD MyCloud app to my iPhone, it was game
  on...The first time I clicked on the share that my music was stored on
  while I was driving in the car

how does this work?

The data is stored locally on your drive and not transferred to them.

I believe they use OpenVPN in some way (that is transparent to the user), so that when you link it to their online service, it connects back to your local drive.

So they do not store your data, but they do hold the keys to your drive.  If you were concerned about this, you could disconnect the NAS drive from their online service, and use your own VPN if you need to access the data remotely.


What vulnerabilities does a malware exploit? I have a malware sample. I want to know what vulnerabilities does it exploit (and of which software). I tried analyzing it in IDA Free and it seems that the code was developed in Visual C/C++ runtime. I know that C/C++ code is hard to decompile. Can anyone tell me how do I find what vulnerabilities does the malware exploit without having to decompile the malware? I don't need an exact methodology. Even pointers to think would be helpful. Thanks.

There are two sort of malware analysis dynamic and static each has its own pros and cons. As you are trying to reverse engineer the malicious code you may require adequate machine language knowledge to analyze the code and identifying different routines. The second way is go with dynamic analysis by executing the code in the sandbox environment. There are few open source automated malware analysis tools like cukoo that can identify the threat data the malware is trying to exploit


How to make a site vulnerable to SQLi? I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I can practice on. In other words, basically maybe one content page, a login page, and a database with say admin, users, passes, so on and so forth.

I will have to learn SQL, but that will take me half an hour, I've already skimmed over a few sites. I will probably need HTML, and some basic PHP...?

My question: am I missing anything? And what exactly defines vulnerable SQL code? Sorry, I being a bit broad here. The closest I found is this: http://forum.codecall.net/topic/39264-make-a-script-vulnerable-to-sql-injection/

On a side note, is SQLi a good place to start with web vulnerabilities?

Thanks in advance!

EDIT: thanks for all the wonderful answers!

Don't bother writing your own site for a practice like that. Instead, make use of the plentiful resources on the web.

A good practice target is the Damn Vulnerable Web Application(DVWA) project. The OWASP WebGoat project is another nice one.


How does (remote) XSS work (in CSRF)? I've just read an article about CSRF and it mentions 3 attack vectors; XSS, Manipulated Links and a local exploid.

Whereas the last two methods seem to be possible (for me), I'm quite unsure, how XSS will play a role here.

Based on my understanding that I'd like to exploit a website through a victim, I see no option how I can use XSS here. I could only understand how to do it if I'm the one that does the XSS, but in this case I wouldn't need a victim, would it?

The only option I can think about is a spoofed URL with the Payload as Parameter, but that would be vector 2 already.

Edit: Now I think I have a clue; the attacker would create a persistent XSS that is triggered, when a (any) victim visits the legitimate site.

Is this idea correct?

Actually if there is XSS,  CSRF tokens don't offer any protection. The moment you can inject JavaScript, you could easily also fetch the token protecting the form.


Sending multiple MAC addresses to the same port on a switch What could happen if someone continuously sends frames with different source MAC addresses to the same port on a switch? Knowing that this port doesn't apply the "port-security" mode.

That depends on the firmware of the equipment.  Since you asked, "What COULD happen," I'll enumerate (from the POV of an embedded software engineer) what I can think of.

The switch may pass all frames on regardless of the source MAC.
The switch may reject frames arriving at a single port when the source MAC  differs from the source MAC recorded when the wire protocol began if a breach of that protocol has not been detected.
The switch may record the discrepancies in a log that network engineers can read after authenticating with the device.
A bug could be triggered, rendering the device unstable or inoperative until rebooted.

The first of these may be a security risk depending on the nature and security in place on the other equipment receiving such passed frames.


Store cookies for multiple sites on remote server and connect from multiple clients Would it be secure to:

Store all my website cookies (stack sites, webhost, github, web-based email, etc) on a remote server (using an customized open-source VPN or something)
Login to the server with password + 2fa (and maybe have a trusted devices list?)
Keep the cookies only on the server... never actually download them to any of my devices
When visiting stackexchange.com, for example, my server would send the cookies to stack exchange, get the response, and send it back to me, but REMOVE any cookies & store them only on my server

Benefits (I think):

I could keep diverse and very strong passwords for every website, but don't store the passwords anywhere digitally (keep them on paper in a safe at home or something)
logging in to all the sites I use on a new device only requires one sign in (to my custom VPN server)
Only cookies would be stored digitally, so if anything went wrong server-side, my passwords would be safe & I could disable all the logins through each site's web-interface

Problems (I think):

If the authentication to my custom VPN is cracked, then every website I've logged into would be accessible
The time & energy & learning required to set something like this up.

Improvement idea:

When I sign in to the server the first time, the server creates an encryption key, encrypts all the cookies with it, and sends the encryption key to me as a cookie. Then on every request, my browser uploads the key, the website's cookie is decrypted, then the request is made to whatever website I'm visiting. Then only one client could be logged in at a time (unless the encryption cookie were stolen)
Encrypt each cookie with a simple password, short password or pin number
An encryption key that updates daily (somehow)
Keep a remote list of trusted devices, identified by IP address? Or maybe by cookie?

Why not just sign into the browser and sync cookies across devices?

Signing into Firefox mobile & Firefox on my computer doesn't give the cookies to Twitter's or Facebook's web-browsers (that frustratingly always open first instead of taking me to my actual browser!)
It's not as cool?
That would require me to trust a third-party (of course, I'll ultimately have to trust my web-host to some extent)

No, it won't be any practical nor solve anything.
First, there are cookies set or read from Javascript. Those cookies won't be stored on the server and will be different on each device. Every site using them will fail somehow. Sites that store the browser on a session variable will detect that your cookie was used with Firefox mobile and desktop, and may lock your session or password for suspected session hijack.
Second, it increases the complexity considerably, without any benefit. Having a custom VPN on each device is costly, both on speed and on battery consumption. Using a proxy on the server would be simpler, but will reduce speed as well.
Third, you will have to install a custom CA on each device, intercept the SSL connection server-side, create a certificate on-fly and encrypt the connection with the generated certificate before sending to the client. This is a huge issue if someone hacks into the server (more on this later).
Lastly, you will have to maintain a backend infrastructure to store and manage every cookie, and write a custom process to check every HTTP header, strip all cookies, store them securely, and send to the client. On the other side, you will have to intercept every connection from every client, search for cookies, alter the request, and add the cookies.

I could keep diverse and very strong passwords for every website

You would better use a password manager for that.

logging in to all the sites I use on a new device only requires one sign in

With a password manager, one keystroke will login you back.

If the authentication to my custom VPN is cracked, then every website I've logged into would be accessible

Only cookies would be stored digitally, so if anything went wrong server-side, my passwords would be safe

Not even close. The cookies are the least of your problems. If something goes wrong server-side (like an attacker compromising it), the attacker will be in position to MitM every single HTTP/HTTPS connection you have. They have the private key of your custom, trusted CA, and can create valid certificates for everything. A custom CA enables you (and the attacker also) to bypass HSTS validation, so even websites protected by HSTS will be able to be attacked.
Imagine downloading a driver for any device you have, and the attacker changing the download on-fly to embed a root-level backdoor and keep the device signed. Or going to your bank to transfer money to someone, and the attacker changing server-side all transfer details but keeping the client-side unchanged, so you put the destination account on the form, read the confirmation page with the correct destination, press "Confirm" to send the money, read the confirmation page with the correct details, but server-side the attacker wired the money somewhere else. And that is possible because of the custom CA and the interception proxy.
They will have access to every single website you already accessed, and have access to every single website you access from that point on, being able to read and change anything at will. And be able to even change sites that you never accessed before, even when you don't use your custom proxy.
How? HTTP Caching. He can backdoor, for example, https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.js or https://code.jquery.com/jquery-3.5.1.js and put a very long expiration date. As soon as your browser cache this backdoored version, it does not matter if you are using the proxy or not, every site that uses this CDN version of JQuery can be compromised.

It's not as cool?

For me, looks like a disaster waiting to happen...


Most secure way to deliver web app for offline access Having built a web app based on a PHP stack which is deployed on a server, I would like to have a way to provide access to it offline. There's a database of patients and appointments that needs to be consulted for read access when a connection is down or not available. Access to the web app requires an account login.

The concern is that, given the sensitive nature of the data, both in terms of code and DB, simply deploying the web app locally in its original form is definitely not an option.

I was wondering whether putting together an encrypted VM bundled with the web app and a web server would provide enough security. The client would be prompted for a password, run the VM and connect to the web app using a local address, in the similar way they would for the remote server.

My expectations in terms of security would be that an attacker with access to the local system would not:

be able to log into the VM
have access to the actual code of the web app while the VM is running
have access to the DB data while the VM is running
can not infer sensitive information via memory dump while VM is running
even if they copy the image they won't be able to use it without the password

Is this achievable with a VM and how much protection encrypting it provides? From what I've seen, the kind of information vendors are willing to provide, is more in terms of of configuration steps and less in terms of security capabilities.

I was also wondering whether providing a trimmed down version of the web-app as an obfuscated executable client (which I'd have to reimplement from scratch and keep in synch with the actual web app) and an encrypted database would make for a better solution.

Depends on the virtualisation platform, but pretty much all bets are off if an attacker gets access to the VM whilst it is running. Assuming they can reboot without needing to enter a password, they can gain single user access and grab whatever data they want at that point.

Similarly, you have no control over the system that is used to run the image - if it dumps memory to disk, the data will get dumped. A sufficiently motivated attacker could write a compatible virtualisation system which has this behaviour.

Ideally, you don't want to store full data locally at all. A better solution, although obviously costlier, might be to look at redundant connections to this system, since it's clearly critical to the practice. Alternatively, it might be possible to run a local server with a copy of the data - this has many of the same issues as a virtualised appliance, but can probably be monitored for tampering more easily, and stored in a physically protected location making physical access more difficult. This server would otherwise need to be treated in the same way as the main application server, receiving patches and being properly firewalled - it would effectively be a mirror of the main server. This should only be considered if there is sufficient technical expertise in running high risk systems though.


what is an internal iso 27001 technical auditor? i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor".

My employer told me that my job is described as follow:

this job is created because of the need of a technical resource who will take care of technical issues not organisational issues
i am attached to the ISO team and not to the IT team
i am going to take care of everything related to pentesting, log review, configurtation review, securing electronic threads, backup , ...
defining physical and logical security measures that should be taken are not in my scope

i am a little bit confused and  can't really understand my responsabilites, moreover i didn't find such job in the ISO norm.

i need to know if there is a such well known job , and what are it's real responabilites

Thanks

I think you're responsibilities is to verify on on-going basis if your company is adhering to the ISO27001. So basically your third point describes what you will be doing: reviews.

Basically you are an auditor, which indeed means you are NOT part of the IT department, but the audit department. This is to ensure independence and objectiveness as no-one of the upper management in the IT department should be able to pressure you based on performance reviews for instance.


XSS attack remediation in older technologies My application is vulnerable to XSS attack. Technology used in the application are Servlet 2.2, JSP 1.1, Jdk 1.3, WAS 4.0. I wanted to remediate XSS vulnerability with migration of technology or remediate with the current technology. As of now i thought to migrate servlet 2.2 to 2.3 to use filter interface. Please advise what changes i need to make in the current application to migrate servlet from 2.2 to 2.3. Any other advise for remediation is also welcome.

Fundamentally XSS is one of:

Failure of input validation
Failure of output escaping

If you have well known data entry points you can potentially clean all input. If you must preserve special characters and formatting then you must also escape output. Output escaping is non-trivial and depends on the context of the output (e.g. in a link, in an anchor, in a text block, in a form field). It's well worth using a standard library to carry out this action.

This OWASP article has more information: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

A web application FW may also provide some level of protection if configured correctly depending on the nature of your data.


Is data stored in Firebase really private? Recently I have been looking a little bit into the security topic in Firebase databases and I know about the security rules. My question is, even having implemented the rules, does Google itself have access to the data stored in my database? Can Google legally use and publish this data? In other words, is Firebase database suitable for storing sensitive information, or should I search for other platforms?

General rule of thumb: if it's not running on your own stack, down to the hardware, someone else has access to it. (of course, it does not mean that if it's running on your own stack, nobody has access, it's just a required condition).

The typical way of handling such an issue is to encrypt all data you store on the leased part of the stack and make sure the decryption keys aren't located there as well.


Is it possible to detect host-machine of my virtual-machines? So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine.

In my lab I have lots of workstations, each running a VirtualBox with network adapter bridged to the host adapter (eth0 or wlan0). Each virtual machine has a malformed MAC and of course different IP addr (set statically or through DHCP).

When I analyze packages with tcpdump (or wireshark) I can't see any common points between hosts and particular VMs. But maybe I'm wrong?

Is there a way to find a host-machine based a traffic generated by VMs doing for example nmap scanning of my lab network?

IMHO, the main point that can expose the identity of host machine is the way you configure the network between the host and guest.

For example, in NAT setting, it would be possible for other machines in Host machine's network to identify that you are in NAT network and they can easily guess the NAT address for the host machine and try footprinting. But in bridged network, it won't be possible as it presents guest as another host in the network.


Is implementing an SSL proxy server considered a good practice? There are many questions on this site from users finding out that their employer has a certificate proxy in place, essentially implementing a man-in-the-middle attack so that all traffic is able to be decrypted.

I've been told from our security professional who put it in place that this policy is considered best practice. Apparently it helps anti-virus software (in particular, McAfee) do its job. I presume this does not mean that it aids in preventing infection, but that it provides a way to discover where the infection came from.

I've had other people tell me that the only reason companies ever do this is so they can keep tabs on their employees maliciously. In this thinking, any other reasoning given for this policy is not to be believed.

Who is right? Is this policy actually considered best practice? What benefit does a certificate proxy provide?

According to Mozilla Telemetry half of the top results in the Google search used https in 04/2017 and they projected a further growth to 65% at the end of the year. And while it was once kind of used as an indicator of trust into the content of the site itself, https is now ubiquitous enough to protect traffic to sites delivering malware or phishing, either because they were setup this way or because a formerly harmless site was hacked.

This means content delivered through https cannot be trusted just because of the https but needs to be inspected like any other potentially malicious content. Such inspection can be done either at the endpoint of the encryption or in between. In the latter case one uses for example enterprise firewalls offering SSL interception but also many desktop AV have local proxies doing SSL interception. The other option would be to analyse the content only after decryption, for example using extensions inside the browser which have access to any decrypted content or analyzing any file access.
These different methods of content inspection don't have the same capabilities because they work on different data, have different communication context and are applied in environments which are differently trusted, i.e. the different methods have different advantages and disadvantages.

Doing SSL interception in the perimeter firewall gives visibility into both incoming and outgoing data at the network level. This provides a broader picture of the network where data to different systems can be analyzed together. It helps also to detect or restrict botnet communication. And, while basic blocking of whole web sites can often be achieved without SSL interception more granular control, like blocking only posts to Facebook, can only achieved by having access to the content. The biggest problem with SSL interception is that it destroys the expected end-to-end encryption of the traffic and can actually weaken the security if not properly implemented. And unfortunately, often it is badly implemented.

Analyzing the decrypted content in the browser instead is not really less invasive than doing SSL interception and adds some additional problems. To be effective in detecting and blocking malicious content the browser plugin needs to have access to any content in the browser before it gets executed by the browser. But, this is code running on a system which should be treated as less trustable as the firewall since attacks against clients with their huge attack surface are much more common and successful than against a firewall. Thus one has to consider the case that an attacker find a security problem in the plugin and can either  disable it or worse hijack it to control everything in the browser.

Detecting potentially malicious content with file system monitoring, system call monitoring or similar provides some advantages because it monitors the malware in real action instead of only doing static analysis or running short test inside a sandbox. But it also loses a lot of information about the communication context in which these activities happen, i.e. where does the content come from. Also, it is impossible to detect the typical phishing sites this way which just trick the users into providing their passwords. Apart from that it might actually increase the attack surface too since these monitoring solutions usually run with elevated privileges but are far from bug free.

In summary: Like other kinds of content analysis SSL interception has its advantages and disadvantages, i.e. it increases the security while also decreasing it in a way. But, properly implemented and used the increase in security will outweigh the decrease in many use cases.  And, while there are other ways to fight malware and phishing they have their own advantages and disadvantages and are not necessarily better than SSL interception. Also, it is for example useful to have both central SSL interception in the perimeter firewall and desktop AV as part of a defense in depth strategy.


How to prevent users from downloading executable files or portable apps? Is it possible to prevent executables or portable apps from being downloaded in a corporate environment on the network layer? (i.e not some agent on a host preventing it)
Would this require MITM SSL certificates being installed to dissect to the traffic? I can imagine that there are solutions with deep packet inspection to prevent them from being downloaded if sent in cleartext (over HTTP or FTP for example).

In short, what is good practice to prevent users from downloading executables?
I know that for installing/running them one can whitelist applications, that is not the question.

Depends in the scope of the proyect and the ammount of data thats managed for the network. This could have different approaches:

Web Security Appliance

You can deploy a WSA (Web Security Appliance) there you can modify the configuration to block certain types of files to be downloaded.

Proxy

You could use a proxy were you can define the type of traffic allow to enter your network

Active Directory Policy

You can Set "Allow file download" policy to "Disabled" in the OU that affect your users. Sadly this is inefective if there is already other browsers installed in the host.

Firewall

You could configure your ISA server to block downloading all together.


Why should someone block all methods other than GET and POST in a RESTful application? TL;DR:
Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist allowed request paths and methods.
In other words, is there any difference from the security standpoint in allowing the deletion of a record via either DELETE or POST methods without changing the code and security checks in it?
Full question
Our customer configured their Tomcat instance with the following, according to their corporate standard:
<security-constraint>
    <web-resource-collection>
        <web-resource-name>restricted methods</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>CONNECT</http-method>
        <http-method>PUT</http-method>
        <http-method>DELETE</http-method>
        <http-method>OPTIONS</http-method>
        <http-method>TRACE</http-method>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
    <auth-constraint />
</security-constraint>

This, among the Http Header Security Filter configuration, made our application break.
Our application provides the same HTTP Header security features in Spring Security. Also, our application is RESTful, so we widely use PUT and DELETE methods for file upload. In future releases, we are also planning to use websockets (but from a search, they don't use CONNECT, which is for proxying).
Our customer said that they will have to raise a policy exception in production in order remove the offending lines from Tomcat configuration and make the application work.
The security exception policy is triggered when vendor applications do not comply with security requirement in a way that 1) fixing the issue cannot be done within the schedules and 2) no evident vulnerability is found. Exception policies require senior management approval.
However, security policy exceptions require our customer to engage the vendor within 6 months in "fixing the security issue". Within 6 months, vendor has to provide costs and deadlines to meet the security policy.
This means that they will return to me asking for a quotation to make the application work with enabled HTTP method filtering and HTTP Header Security filter.
I don't want to do them a favour and change all Ajax calls from RESTful patterns to GET/POST only, not even for money if possible. I would like instead to prove that their security implementation is not only incompatible, but redundant, with regards to the security implementations within the application.
If we set a precedent in doing this customer a favour with PUT and DELETE requests, we will have to face requests like "be compatible with my framework/policy/environment" from a large customer base (all banks and financial institutions). In the future, that may turn against our cost management.
Question is, as in the TLDR, could using PUT and DELETE methods alone, regardless of the security features of the application, pose a security risk?
If proven that the sole HTTP verb does not pose a security risk, I will be able to raise a permanent exception policy and confront the IT staff with solid argumentation.
Edit
I work in a software factory that deploys the same product instance to a large number of customers and our cloud. We are fully using all the tools we have on board, including the REST pattern. We are planning to employ HATEOAS, WebSockets, resumable file downloads, and everything the web technology can offer us to deliver better experience. Yes, sounds like a marketing line. Anyway, security is still a concern in our products.

I suspect this is a case of someone zealously applying "best practices" that they don't understand.

HTTP Verb Tampering Attack

The reason this best practice exists is because of the HTTP Verb Tampering Attack. From this article:

  Many Web server authentication mechanisms use verb-based authentication and access controls. For example, an administrator can configure a Web server to allow unrestricted access to a Web page using HTTP GET requests, but restrict POSTs to administrators only. However, many implementations of verb-based security mechanisms enforce the security rules in an unsecure manner, allowing access to restricted resources by using alternative HTTP methods (such as HEAD) or even arbitrary character strings.

So someone decided that because some apps are badly-written, all apps should be banned from accepting HTTP verbs other than GET or POST, because ... you know ... mumble mumble SECURITY!!

My opinion (possibly incomplete / incorrect, please post comments) :

Pure HTML / CSS / js content should be restricted to GET and POST because these are the only verbs allowed in the HTML spec.
APIs (AJAX, REST) should be allowed to use any verb from the HTTP spec, that said:

Be aware that even if your application-layer correctly enforces verb-based access controls, your webserver front-end may not, so you owe it to your customers to do some security testing and make sure your app enforces proper authentication and access controls on all verbs that you support. I recommend following the OWASP testing guide.

It sounds like your app is fine and your customer has an overly-zealous security policy.

As an aside, HEAD is an interesting example; some security scanners seem to complain if your app responds to HEAD requests, because some apps will return valid headers without invoking the proper auth checks. However, most properly designed apps will process a full GET and then only return the headers, including the correct content-length:. So for apps using modern frameworks, there is probably no way to bypass auth logic on your GET controller. Do some quick tests though!
(Thanks @usr-local-ΕΨΗΕΛΩΝ for pointing this out in comments. See this Stack Overflow post for detail on how Spring MVC handles this.)


Why use DNS over TLS/HTTPS if ISP could find out target domain by other means? There are initiatives to protect DNS, for example DNS over TLS or DNS over HTTPS. Given that the ISP can find out the domains the user visit by other means (Host header in plain HTTP, SNI in TLS handshake with HTTPS) I don't understand the threat DNS over TLS/HTTPS is adressing.

The main point of DNS over TLS/HTTPS today is likely to bypass DNS based blocking of sites which are considered harmful, which might include Google, Youtube, Facebook ... depending on where you are. DNS based blocking is easy and cheap since most users use the DNS server provided by the ISP which can simply return a different response for blocked domains. Even if the user explicitly configures a different public DNS server the ISP can create a cheap packet filter rule so that any traffic to port 53 (DNS) gets transparently handled by the ISP's DNS server, even if the user tried to use a different one. While there is in theory DNSSec to allow authorized DNS answers it is not used for a large part of the domains which also means that clients usually don't enforce it.

If the user instead uses DNS over TLS or HTTPS then the simple redirect of port 53 will no longer work since the ISP does not have the matching certificates for these TLS connections. While the ISP could simply block any traffic on port 853 (DNS over TLS) in the hope that the client falls back to normal DNS, blocking DNS over HTTPS can not be done without serious side effects since it uses the same port (443) and maybe even the same destination (content delivery networks) as normal HTTPS web traffic.

This means that in order to block sites the ISP has to rely on  DPI (deep packet inspection) to extract the destination from the Host header (plain HTTP) or SNI in the TLS handshake (HTTPS) and then block the traffic. This is way more expensive than a simple layer 4 (port based) redirect and also impacts the performance of the traffic. This makes it more likely that the ISP lobby will oppose the blocking, especially if the ISP's has to come up with all the additional costs themselves.

Additionally the proposed encrypted SNI means that even DPI will not reliably help to find out the visited site and thus blocking a site based on the domain name will not reliably work.


Kaspersky Lab malware faking. How worried should I be? Well most probably we will never know the truth, but anyway:

Beginning more than a decade ago, one of the largest security companies in the world, Moscow-based Kaspersky Lab, tried to damage rivals in the marketplace by tricking their antivirus software programs into classifying benign files as malicious, according to two former employees...
In one technique, Kaspersky's engineers would take an important piece of software commonly found in PCs and inject bad code into it so that the file looked like it was infected, the ex-employees said. They would send the doctored file anonymously to VirusTotal.

Full article
Since I am a user of a no Kaspersky AV, I am getting a bit worried. In which cases an AV decides to "clean" a file instead of permanently deleting it? (We could for instance talk about Avast). Is this "injection" of bad code in a "health" file as described in the article, likely to be cleaned instead of deleted?

As the article states, this issue was observed between 2009 and 2013, so is not current anymore. It relied mainly on two things:

According to the anonymous Kaspersky employees, because other anti-virus software editor were allegedly copying, "stealing" Kaspersky technology,
And in all case with more certitude because there was at least during this period a real marketing race to which editor was the first to detect an infected file and to detect the largest amount of them.

The trick was therefore relatively simple: submit some code sample to VirusTotal which will be flagged as malicious by Kaspersky alone, and the other editors will soon "catch up" by updating their signature base to include this one as well. The most technically difficult part was to manipulate other editor's software into producing a signature matching also legitimate files.

IMHO this showed a very poor approach where marketing takes precedence over security.

This article also explains how such deception practice were discovered by the anti-virus companies (for instance a sudden rise of customers calling the AV support because their printer's driver has been quarantined), and how they saw this as a flaw in their anti-virus software and signature management processes to be fixed.

So these software and processes being (theorically at least!) harder to corrupt nowadays, such flaw should not happen anymore and, therefore, to answer your question you should not worry anymore.

At the time of such practice was observed however, the anti-virus would not clean the file but quarantine or delete it because its code matches a pattern wrongly flagged as suspicious. There is indeed nothing to clean, the file being a legitimate one! The "bad code" was only injected in the initial sample sent to VirusTotal in a way that competitors will not add the bad code to their signature base, but the legitimate one...


How do authentication system know if I am reusing a password? How is this secure? My question is how is it possible to know if I am reusing a password? Are they storing my old password as well [in plaintext]?

If an admin had access to the backend, wouldn't they have access to all my passwords?

What is the point of that much security?

In a well design system, your actual password is never stored. Instead, a one-way function, called a hash, is used. Hash functions are mathematically designed so that there is no one-way relationship that allows you to do the function in reverse and get back the original input. You can get a basic understanding from this article.

In the backend, only the hash is stored. In the normal application logic, when the password is received from the user at login, it is hashed the same way as when the password was created. The stored hash value and the hash of the password typed at login can then be compared.

Using this design, we compare these password substitutes and never store the password. As a result, if someone found the hash in the backend, they would not have your password. They could not abuse the normal login flow with just the hash because they cannot reverse it. If the IT admin or a hacker only had access to the password hashes it would not be enough to do anything directly.

*Note: Password hashes cannot be reversed, but you could calculate values for given input passwords and see if the match. Salting and other techniques can help to make this more difficult. Read the article I linked to above for an intro to the concept

In terms of password history, you don't need to store the passwords, but you can store all of the hashes as well. When you are asked to enter a new password, that password will be hashed and then that hash will be compared to all of the hashes in the history list. This means that no old passwords need to be stored directly, so no one can get to them.

It is also possible to use the hash history to test for passwords which are similar to those used in the past without knowing the plaintext:

For example, if you entered a password of "DogFood" you could also generate lots of variations using some algorithm so you would get something like {"dogfood", "DOGFOOD", "dOGfOOd", etc. }. The algorithm may try all sort of modiciations like character replacements, one off keys, check for incrementing numbers (e.g., if you do "password1" it will add "password2", "password3", etc). Then for each variation you also calculate the hash. If the hash of the original password or any of the possible variations match a hash already in your history then it is too close a match and will not be allowed.

The key point is that comparisons are never with the actual value, but with the hashes computed.

One last thing, it is possible for a system to "encrypt" instead of "hashing" passwords. In this case there is a higher likelihood of the actual password being exposed. However, hashing is used 99.9% of the time and password encryption is only used for specific needs or by a bad software design choice.


Bad password policy at my bank I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons".

The policy for new passwords is: 6 to 10 characters, no special characters, no repeated characters, not case-sensitive.

My old password was much better than this. I used a random password generator.

I am not a security expert but this seems like a lax policy. Am I being overly paranoid? This is a business account.

Should I suspect that I myself was hacked?

Note: The ATM card number is not part of the bank's online authentication process.

Note2: I went to Password Meter and was able to cobble together some passwords that meet this criteria and that Password Meter deemed "Very strong". Am I wrong to still be concerned?

Yes it is a bad password policy, but it is mitigated by:

second factor authentication
strong account lockout features
your knowledge that it is a bad policy

Do not compare it against policies meant to withstand offline cracking: if you fear offline password cracking at your bank, you may as well fear direct password sniffing.


What are stolen passwords used for? Say there is a line of business application which has username/password datatable in the DB. Personal email address is not stored, and usernames are assigned by an administrator. Someone gains access to the database, and finds out, among other things, mentioned user data.

Why would one be interested in passwords, when he has access to all the data in the database?

Users often reuse their password, so you can try those passwords on other databases or applications as well.

You can try and find out their personal email address through other ways than just the database (social engineering). From there you can get access to their paypal account, facebook, etc.

Anyway if you store your password unhashed in a database something is wrong.


Should I set a password for 'root'@'localhost' in MySQL? The 'root'@'localhost' MySQL account can only be accessed by someone currently on the server hosting the MySQL server.

Assuming that only the person or persons who are in charge of the MySQL server even have the password to ssh in, and given that the server is hosted on an internal network so that you can't ssh in from outside, is there any reason to put a password on the MySQL server for 'root'@'localhost'?

Reasons not to have a password:

Managing passwords in a volatile system is incredibly cumbersome, with each additional password increasing entropy in the system.
If a password gets lost it can cause a lot of headache.
If someone has ssh'ed into a machine, and if the root password for the machine is the same as the user they logged in as, they can just start up MySQL without a password anyway.
If the server is on a local network, and your only concern is how much damage someone can do to your MySQL server, someone logging in as root while ssh'ed into the server is the least of your concerns. They could just physically take the hard drive(s), or wreck the machine in any number of ways.

So, despite these reasons stating having a password in this situation would just make things harder without any real benefit, is there a compelling reason to give one to 'root'@'localhost'?

The first rule of 10 Immutable Laws of Security Administration written by Scott Culp, is a good law regarding your situation:

  Law #1: Nobody believes anything bad can happen to them, until it does.

Even though your server is only accessible from within your local network, try to think of how many computers or servers are connected to that internal network. Pivoting from one computer to the other is part of a hackers job, and having perimeter-only security will save you from nothing as soon as one of the employees are victim to a spear phishing attack, and click that link in that email.

Another possibility is, what happens when someone can get a shell using a vulnerability in your website? The person can then try to access and run MySQL-commands from the shell, and in the worst case drop/dump your entire database?

Yes, managing passwords in a multiuser environment is hard, that's why software such as KeePass and LastPass offer Multi-User databases, such that multiple users can have access to the same keychain and same passwords.

My recommendation is, secure it with a strong password, because it's probably not going to be as much of a hassle as you think, and it could potentially stop your database from getting leaked or dropped. The more friction you create for potential hackers, the better!

Be proactive!


The AES Crypt implementation hashes a password 8192 times to generate the key. Is this necessary? I'm considering encrypting some small files (hundreds of kb apiece) using the AES Crypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the password by concatenating the two into a buffer which is then repeatedly hashed. So the IV is acting as the "salt" for the hash. By repeatedly, I mean 8192 times.

I understand that the benefit of this is to increase the time required to generate the key, making it more expensive to perform brute-force attacks to discover the password. I also understand that the drawback is that it takes longer to do the legitimate encryption and decryption tasks for the real users. Further, as both the users and attackers buy faster machines over time, the benefit and drawback will tend to zero.

So my question is, given current computer capability, and assuming a motivated attacker who doesn't own a dedicated cluster, is 8192 iterations insufficient, overkill, or "just right"? Also, have a missed anything in my analysis of this key generation: is there some other reason for choosing such a number of iterations that makes it a good choice?

RSA's standard for password-based cryptography recommends "at least 1000" iterations, so the factor seems to be in the ballpark.

With 8192 iterations, you are essentially increasing the time needed to complete a brute-force attack by a factor equivalent to adding 13 bits of entropy to the password or 2 alphanumeric characters (with respect to brute-force attacks only). This is a good way of thinking about it because it is independent of increasing computational power.

The question is: given the security of the passwords you or your users will be using, is it feasible to brute-force it? If you add 13-bits to it, is it feasible to brute-force it?

If your users are using strong passwords, the answer is probably no to both. If your users are using a dictionary word, 13-bits is probably not enough to push it into secure territory. Your answers to these questions will change over time as computers become more powerful.


How does Chromium's sandboxing compare to Firejail's? I am increasingly being requested to join videoconferences through Zoom, which I don't trust to run on my machine.  I understand that there are two common ways of sandboxing this software: you can either download the standalone Zoom application and then run it with the aid of some access control system, such as Firejail or AppArmor, or you can join the videoconference via Chromium, which will prompt the browser to download and run Zoom in its own sandboxed environment.
Another question here addresses the difference between Firejail and AppArmor (for the general case, not just for Zoom).  But what are the differences between running an application in a Firejail sandbox versus running it in a Chromium sandbox?  Using Chromium seems to be more convenient, since it doesn't require the user to separately download and install an access control system and the standalone application.  But are there any differences from a security point of view?  Do Chromium-sandboxed applications have access to any parts of one's system that Firejail-sandboxed applications do not, or vice versa?  Are there any other advantages or disadvantages to consider?
(Note that although this question arose from pressure to use Zoom, I'm really interested in the more general issue of how Firejail and Chromium differ in their approach to sandboxing.  I understand that the standalone Zoom application may differ in behaviour from the browser-based version that Chromium runs and so answers need not necessarily address any security risks specific to Zoom.)

The browsers do not allow application to directly access the filesystem. They can only:

Ask the user to upload a file of their choosing.
Start downloading a file that will be safe in the directory chosen by the user (by default the "Downloads" directory).

Installed applications can have a full access to the filesystem.
On top of that, further restrictions can be added by Firejail or Apparmor to limit the access to the filesystem (among other resources). Those restriction can be applied to any applications, including browsers. So instead of choosing between a Chromium sandbox and a Firejail sandbox, you can use both.


Is blacklisting IP addresses a waste of time? After months of logging, I have collated a list of rogue IP addresses trying to perform SSH brute-force logins, send SPAM, hack Wordpress admin logins, upload spammy links, etc:

SSH logins
SRC             Count
222.186.15.202  121
115.231.218.23  114
218.77.79.43    97
103.41.124.60   80
61.160.224.128  47
...

So far nothing untoward has happened to my server. I was wondering, what should I do with this blacklist. I have over 1500 unique IP addresses distributed across 1000 different /24 subnets. Blocking all of them would introduce additional workload on my server.

Is there any value for an IP addresses blacklist?

Blocking a couple thousands of IP addresses will not incur significant load on your webserver. If you are using iptables, the overhead is pretty negligible.

I have implemented fail2ban on my server, and it blacklists everybody trying a bruteforce on my server. Portscanning gets the ban hammer too. It gives a temporary ban (I configured it to 6 hours), so I don't have an enormous list of blacklisted addresses, and the attacker gives up on my server way before the ban expires.

You can use fail2ban to protect Wordpress too, and Apache. If anyone gets too much HTTP-404 errors in a timeframe, ban them. If they send spam, ban them.

As the vast majority of the attacks today are not directed attacks, a blacklist will make the attacker (or bot) leave your server and attack the next on the list. It's not to make your server unbeatable, but to make it less interesting than the next on the list.


Security benefits to have IP-filter in HttpModule instead of Page-Load in asp.net pipeline? I'm working on implementing an IP-filter which  blocks all requests by machines outside our IP-range. This is for an asp.net project (written in c#).

I've read on multiple forums that the safest way to put your IP-filter code is in an HTTP Module which picks up the request early in the aspx-pipeline.

However, I've implemented my IP-filter code directly in the page-load method of the ASPX-pages code behind.

Are there any commonly known security benefits of using a module instead or other reasons why it's considered best practice? I don't know much about ASPX but I'm using IIS 7 if it's any help.

From a security perspective, it's desirable to discard the unwanted traffic further up the chain and typically at the lowest level of the OSI model you can.

This is beneficial because it reduces unwanted noise, can save processing cycles on the equipment downstream, and makes the control less likely to be bypassed.

In regards to IIS specifically, the request filtering module (Where IP address restrictions are specified) is processed before all other modules.

Image from: http://www.iis.net/learn/extensions/url-rewrite-module/iis-request-filtering-and-url-rewriting

So the answer would be the above falls under best practice.

Is there a reason that you aren't taking advantage of the native IIS IP address filtering capabilities?

Please reference: Configure IPv4 Address and Domain Name Deny Rules (IIS7)


WordPress private exploit? I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more information regarding it from him, and I did manage to do so.

He says it does deal with wp-config. I asked if he has to deal with the Auth Keys, which most people do not change, and he said no. Then I asked about plugins, because I am running none on this blog. He said no again.

Then I tried to see how "real" of a threat his claim is. I said "Why don't you take down a well known website running WordPress, if you know your private exploit is going to work" [Basically, with that question, I tried to see how much bullcrap he could talk about going after a target that matters when it comes to eFame]

Is there a known exploit that is public or 'private' currently available to take down a WordPress Site with only running the core web application? How secure is WordPress right now without plugins? Or is he a Script Kiddy?

Private exploits exist for many famous software out there, and the fact that a software is open-source, popular or many years old doesn't change a thing.

A vanilla Wordpress installation without additional modules is less likely to be exposed, but again, it is very possible that exploits exist for it.

Now, the question is more: does your friend have the technical skills needed to find this kind of vulnerabilities and exploit them?

Besides, asking him to "take down a well known website running WordPress" is a very bad idea, as this is illegal unless this website belongs to you or if you have a proper mandate to do so. If you want him to prove his point, you should install Wordpress on a server you own and authorize him to exploit it.


Excessive logons from domain controllers I am quite new to analyzing the windows logs. I have been seeing excessive logons with 4624 and 4625 with the Subject/account name: DomainController(actual name of the domaincontroller is different) to user accounts.

I understand that it makes sense to have logons requests from user machine to the Domain controller. But why there would be excessive logon requests from domain controllers to user accounts that too with misspelled usernames and passwords as Failure reason and the process name as lsass.exe?

There are a lot of things it could be.  For example, someone may have typed their username wrong in their WiFi settings on their cell phone, causing their phone to try to authenticate over and over again erroneously.  There are too many other possibilities without knowing every dynamic of your environment.


How attaching to a process with a debugger can compromise system's security? Visual Studio shows a warning, trying to attach to a different user's process:

Searching for an explanation, I've found the MSDN article, claiming that:

  An untrusted process that contains malicious code has the potential to damage the computer doing the debugging.

To my knowledge, it's quite the opposite - you actually can attach a process with a debugger in order to prevent its (presumably malicious) behavior. Assuming a malicious code is already running in my system, how attaching with a debugger to it can compromise the system's security even more?

Your note that it's a "different user's process" is the key here. If the malicious process is limited to that user's context, then attaching a debugger (which usually requires deep permissions) gives the process access to more resources.

While a debugger might be used to prevent malicious activity, there is no way for the debugger to know what exactly you will do. You could simply run the process to completion to analyse the logs later.

The warning is appropriate, although there are possibly ways where it is not necessary. Better to have it in order to remind everyone of the very real problems.


Is momentary physical access dangerous? I’m asking the question with these conditions:

The device (computer or mobile phone) is in a running state.
“Momentary” refers to a reasonably short period of time, such as 5 to 10 seconds.
The system may not be in a “locked” state (e.g. showing a lock screen asking for a password). However, the active session doesn’t have superuser privilege (the usual case for a mobile phone).

What can a hacker do to gain further access to the system?

That all depends on the system, the attacker, and the level of preparation they had. If they have unlimited preparation, they could do effectively anything that they could do with an unlimited access window. Even if they do not have in-depth knowledge of the specific system, it would not be difficult to very quickly inject malicious code that allows for subsequent remote access. They could:

Connect a PCMCIA or PCIe card and dump memory or inject code.
Splice a hardware keylogger in between the keyboard's PS/2 or USB cable.
Quickly download and execute malicious code, or modify existing code.
Access sensitive files and save them (e.g. with a camera or USB flash drive).
Physically destroy the computer (e.g. with a hammer or a power surge over USB).
Simply grab the system and pawn it off for a quick buck.

Time for a story. I once had a target who I would be in close proximity to for a brief period. My goal was to gain persistence on their laptop to exfiltrate sensitive documents. I knew I had only a few seconds every time they went out of sight, so I couldn't just grab their laptop and take my time. I obviously also could not steal it. Luckily, I came prepared. I had a programmable USB device that I plugged in. As soon as it was plugged in, it simulated keyboard input to open PowerShell and execute a few commands to download a payload I had set up earlier. The scenario went like this:

I waited until this person had left to get something for me in another room.
I leaned over on the table where the laptop was and surreptitiously plugged in the device.
I waited a few seconds to be safe, unplugged it, and tried to keep a straight face.
After they gave me what I asked for, I thanked them and left.
When I got home, I got on my computer and connected to their machine.

It was not difficult, did not take an extensive period of preparation, and was moderately stealthy. I could have made it even more stealthy if I used something that looked like a cell phone so I could claim I was just charging the device and didn't see any other USB ports around. The moral is that you can do a lot with just a few seconds of access, so you must never underestimate the risk.

So how do you protect against these threats? You need to develop a threat model. Figure out who your adversary is, what assets of yours they are after, and what their resources are. If you don't want your mother to see your porn when you're at her house, you probably don't need to worry about exploits abusing corrupt EDID in a VGA or HDMI cable. If you are holding extremely valuable company secrets in a highly competitive industry (robotics, epoxy, etc) and are going to a high-risk country like France or China, you absolutely need to worry about sophisticated attacks, because industrial espionage (aka the more illicit side of "corporate intelligence") is rampant. Stay with your computer at all times in adversarial situations. Lock it if you are going out of its line of sight, and bring it with you or physically secure it in a safe if you are going to be away for a longer period.


Root CA or Intermediate CA in firewall trust store I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and server certificates are implemented and required for authentication. Everything is working great but I had some questions about integrating a third device.

I have a firewall that is going to look for a client certificate in order to authenticate users. The clients already have the root CA certificate uploaded to their trust store (ie the root CA that issued the Intermediate CA that issued the client cert).

In order for the firewall to authenticate users, I believe I need to add the Root CA certificate to the firewall trust store as well so that when a client presents a client certificate, the firewall can trust the client possesses a certificate that has a chain of trust back to the Root CA. This is where I am a little confused. I am fairly certain that I add the Root CA cert to the firewall but I am also wondering if the Issuing CA certificate needs to be added as well or not at all.

From this I have two questions:

The firewall received a signed certificate from the Intermediate CA and the client did as well. Do I need to add the Root CA certificate or the Intermediate CA certificate to the firewall trust store?

More importantly, why? Why is the Root CA certificate added and not the Issuing CA certificate? I think I know why but I don't know all the details, if someone could break down the details and go through what the exact process the firewall would go through to validate the client certificate.

I won't give a full explanation of how certificate validation works as there are already a number of great answers on this site if you search "how does certificate validation work".

Your questions:

  The firewall received a signed certificate from the Intermediate CA and the client did as well. Do I need to add the Root CA certificate or the Intermediate CA certificate to the firewall trust store?

The only real answer here is "Depends how your firewall works, the manual should tell you". Usually you trust a root CA.

  More importantly, why? Why is the Root CA certificate added and not the Issuing CA certificate? I think I know why but if someone could break down the details and go through what the exact process the firewall would go through to validate the client certificate.

For the exact process, see any of the other excellent answers on this site.

For an intuition, ask your self why you set up a root CA and an Intermediate CA in the first place? Why didn't you just make a root and issue your client certs off that? Usually the answer is that you want the ability to revoke the Intermediate CA if it gets compromised. If you tell your programs to explicitely trust the Intermediate CA, then even if you revoke it at the root, the software will continue to trust it, because you told it to. You may also run in to technical problems as many cert validation engines get unhappy if the cert chain doesn't end with a self-signed cert.


Common attacks when no ports are open If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like injection attacks or DDoS attacks? If there are some, how could you defend against them?

An attacker can still use the full range of attacks on the webserver: everything from password guessing to code injection to buffer overflows to path traversal to who-knows-what.  The only thing closing non-HTTP ports does is prevent the attacker from going after other programs that might be listening for incoming traffic (eg. a mailserver).


What could an attacker do with informations about devices in my local network? If a malicious website would scan my local network (via WebRTC) for devices, what could the attacker do it with it?
Does it need to be in the same WIFI-Network in order to login to a service? (for example a web based interface to configure your IP home-phone)

I'm asking because I came across this website today: http://webkay.robinlinus.com/
The "Network Scan" feature lets you are scan for devices in your local network. (Worked for me in the latest Google Chrome)

Just a few examples:

Detect the type of router and exploit it via CSRF. Then change the DNS settings and thus have man in the middle attack. See this example where millions of DSL routers got hacked.
Use CSRF, XSS, DNS rebinding etc to extract information from internal web sites, i.e. internal web mail, company wiki etc.
Use the web interface of VoIP phones to make expensive calls or switch on the microphone and listen to whatever happens in the room.
Just collect various information which then help to attack specific targets (i.e. intelligence).


Is two copies of the same data stored on a RAID 1 array considered a "backup" Since I got/built my computer I've been working towards improving my backup situation and my planned setup goes something like this:

My PC: 240 GB SSD
Backup Array: 1TB RAID1, incremental time machine backup of PC, will be plugged into PC most of the time
Archive Array: 500GB RAID1

Since a common rule of backups that I have read about is to always have at least two copies of your data (and yes im aware that RAID does not count as a backup), I want to be able to have a way to back up my "archive" of stuff, AKA the stuff that I don't really need on my computer immediately, such as old projects, last years school assignments and years-old photos; stuff I still want to keep but don't have space to store on my PC.

However, taking these files off my PC also means that they aren't being backed up with time machine and that means there are only 1 (or 0 of time machine disk gets full and deletes stuff) copies of this data and its no longer backed up.

So my question is, if I put this "archive" data onto a RAID1 array containing 2 partitions, with each partition containing a copy of the data, is that considered a "backup" or no?

The reason I am asking is because I feel like the duplicate partition sufficiently protects the data against user error (accidental deletion etc) to a degree that constitutes a "backup", and, even though both copies are on the same disk, the RAID array protects against total sudden disk failure.

In case this is not a good idea, is there a better way of backing up this type of infrequently used (maybe accessed once or twice a month, if that) data?

Is there anything I am doing right or wrong with this kind of thinking?

Clarification 1: For the archive RAID setup, im talking about two drives in a RAID array where the whole array (appearing as one disk on my computer) is broken into two partitions. I am not trying to RAID two partitions together, but merely store two copies of the archive data on the disk.

A backup is when you have two or more independent copies of something.  If one of the copies is destroyed, you can still use another copy.  For the purposes of backup, RAID 1 counts as just a single copy, since its two copies of the file are dependent: anything that happens to one will usually happen to the other as well.

If you've got a live copy of the data on your computer, and a second copy of the data on a removable RAID array stored somewhere else, you've got a backup: it takes two incidents (or one really large one) for you to lose all copies of the data.

From the description of your setup, your "backup array" doesn't count as a backup.  Since it's attached to your computer most of the time, it only protects you against hard-drive failure or accidental deletion.  It won't protect you against ransomware, or fire, or theft, or...

Your "archive array", on the other hand, can be used as a backup.  The partitioning you propose doesn't count (the only thing it protects against is user error), but if you store the hard drives making up the array in different places (eg. one drive at home, one at work) whenever the array's powered down, you've got your two independent copies.  You're still at risk any time the array's assembled and powered up, but it sounds like that won't be very often.


How to protect login data against MitM with HTTPS enabled? Even after enabling HTTPS the user is not completely safe regarding MitM attacks, because there is the chance of a compromised root certificate store. So of course you can use certificate pinning for mobile apps. But are there additional options to securely transfer the login data/critical data?

... because there is the chance of a compromised root certificate store.

You  effectively assume that the attacker is able to compromise the system where the client is running on. In this case it is impossible to protect the client. While certificate pinning can be used to protect against a modified trust store the attacker can still modify the client itself and thus get to the unencrypted data. Examples for this are browser extensions which have access to the plain data but it can also be done with replacing the TLS library linked to the client application or modifying the client application itself.

Like the name suggests: a man in the middle attack is only about a man in the middle and not about a man in the client. Properly implemented TLS protects against man in the middle but cannot protect against a compromised client or server like in your case. And there is no way to fully protect the data if client or server is already compromised.


What's the difference between escaping, filtering, validating and sanitizing? An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and interchangeable use of these terms although they are obviously not all equivalent.

I'm looking for a clarifying overview about the differences and the correct usage in a security context.

Escaping.  Converting a control character to its escape sequence.  For example, a < symbol may be converted to &lt; so that the characters following the < are not interpreted as an XML tag instead of XML content.

Filtering.  Like escaping, but instead of replacing the control character, it is simply removed.

Validated.  Comparison of an input against a white list or regular expression to detect control characters or other character sequences that would trigger an unauthorized behavior.  For example, an account number entered by a user might be validated against a list of account numbers known to be tied to the user.

Sanitized.  A combination of escaping, filtering, and validation that ensures that an input to a system function does not trigger an unexpected and unauthorized behavior.


Is Pentesting now all about running Tools? is Pentesting now just about running tools like Nessus and creating a report based on it ?
and not actually exploiting anything on your own based on the Agreement ?

In my conception, what you described can be called vulnerability assessment, which consists of finding out possible points of penetration in the system. It is greatly enhanced by automated tools due to the volume of tests it can process in no time. It should be noticed, though, that vulnerability assessments are not perfect and, usually, require manual assist from the operator.

Penetration test, on the other hand, is more than just it. It deals with actually get access to the system by exploiting the vulnerabilities available. Moreover, it can use non-digital methods, such as social engineering. In penetration testing, it is required great manual effort from the operator.

tl;dr: No. Penetration testing is not just running automated tools.