Hydra gives wrong answers Problem: Hydra keeps giving me incorrect passwords every time.
I'm using brute-force via Hydra to guess the correct password on a certain website.

First of all I used BurpSuite to intercept the page request:

POST /abcdefg/ HTTP/1.1
Host: localhost:2000
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:2000/abcdefg/ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 23

usr=admin&pass=password

I am using these parameters for the command-line:

hydra -f -v -V 127.0.0.1 -s 2000 http-post-form -l admin -P /documents/pass.txt "/abcdefg/:pass=^PASS^:incorrect password"

Host = 127.0.0.1 ( I know I can also try with localhost)
Port = 2000 (My local computer is listening for HTTP at port 2000)
Method = http-post-form
URL = /abcdefg/
Form parameters = pass=^PASS^
Failure response = incorrect password. When I click submit, the page reloads with the same URL, but with only the text 'incorrect password' on screen.
User = admin
Password file = pass.txt

The page source of the login page:

 <title>Login</title>

        <form action="./" method="post">
        username <input type="text" name="usr">

        password <input type="password" name="pass">

        <input type="submit" value="Submit">
        </form>

The page source of the 'incorrect password' page:

 <title>Login</title>

incorrect password

Please do take a look at all the parameters to make sure I am using the right commands.
I have also taken a look at this question:  Why does Hydra return 16 valid passwords when none are valid? which suggests to check the page cookies, but the webpage I'm trying to brute force into does not use cookies, so I think that is irrelevant?

I am just starting off penetration testing so it would be cool if you guys can help me out, I might be missing obvious details :) Thanks in advance!

Shouldn't

"/abcdefg/:pass=^PASS^:incorrect password"
 be set to

"/:usr=^USER^&pass=^PASS^:incorrect password"

to match your form action as <form action="./" and username input as <input type="text" name="usr">?


Security protocol for NFC stickers/cards Lets say I'm using NFC cards for access control. NFC cards/stickers are easily readable and writable, so my worry is that the data on them could easily be cloned onto another card/sticker and bypass the security.

My idea to detect cloning is to include 2 pieces of info on each card:

User Id
Random value

So lets say the following happens:

User A's card is cloned by user B, so now user B also has a card with that data
When user A enters, a new random value is generated and saved both on the card and in the backend. This random value must be presented in the next access attempt.
User B tries to enter with his cloned card containing user A's "User Id", but has an incorrect "Random value", so he is not allowed to enter.

Does this seem like a good way to fix this issue? Are there other ways?

The method you propose is actually what is used by some IC card formats including Sony's FeliCa:

  FeliCa's encryption key is dynamically generated each time mutual
  authentication is performed, preventing fraud such as impersonation.
  (From Wikipedia)

This could be implemented simply by hashing the card ID (or other unique data) and the last system authentication time (in milliseconds provided by your backend server) with a hidden secret as a salt, and writing that to the card each time authentication is performed. When next used for authentication, the backend would rehash the cardID with the stored last access time and make sure they match.

A cloned card would let an attacker impersonate the real user, but the fraud would be discovered the next time the real user tried to authenticate and was unsuccessful (unless the attacker can get repeated physical access to the original card to clone the updated information back).

Other ways the card could be protected include special format NFC cards that require an encryption code to be sent first before the data area becomes readable/writable, preventing card access without knowing the code for the card (I don't know if this conforms to NFC spec or not), or requiring multiple factors for authentication (such as passcodes, biometric information, etc), which would mean that a single factor would not be enough for impersonation.


Why do people hide their license plates in the EU? I often recognise that people blur their license plates on pictures on the internet in Germany. I can't figure out what's the fuss. The information is public nevertheless (I mean it's on your vehicle), nobody but appropriated authorities can get any data out of it, and people also do it on platforms where they are identifiable anyways (Facebook, car selling platforms etc.).

So what's the problem of having your license plate visible on the internet (in Germany/EU)?

It's a matter of privacy.

The thing you definitely determine from the license plate in some countries is the county of the registered car. In small countries some counties have a small number of registered vehicles and that eases tracking one.

Other things you may be able to determine in quite a lot of EU countries:

year of birth of the owner (since some use 2 number character in the plate number)
name of the owner (since many use the 2 or specially 3-letter abbreviation of their name)

Example: a car in Romania with the number CT-90-GEO will give you quite good information: the location of the registration is in the Constanta county (abbreviated CT for vehicles) and the owner is named George and was born in 1990.

So many people prefer not to release something like this in the wild.


Hashcat bruteforce define digit range form and to I know this password is between 90,000,000 and 500,000,000

how can I tell hashcat to bruteforce exactly in that range? I mean starting from 90,000,000 and ending at 500,000,000

I go the password doing this, but is so inefficient! I would like to know the proper way

./hashcat64.bin --hash-type 2500 --attack-mode 3 ~/Desktop/wifi.hccapx ?d?d?d?d?d?d?d?d

./hashcat64.bin --hash-type 2500 --attack-mode 3 ~/Desktop/wifi.hccapx ?d?d?d?d?d?d?d?d?d

Let's start by bruteforcing between 90000000 and 99999999:

./hashcat64.bin --hash-type 2500 --attack-mode 3 ~/Desktop/wifi.hccapx 9?d?d?d?d?d?d?d

Then let's bruteforce from 100000000 to 499999999:

./hashcat64.bin --hash-type 2500 --attack-mode 3 ~/Desktop/wifi.hccapx -1 1234 ?1?d?d?d?d?d?d?d?d

Finally, let's try 500000000:

./hashcat64.bin --hash-type 2500 --attack-mode 3 ~/Desktop/wifi.hccapx 500000000


Safely use compromised USB drive to transfer data from one PC to another How to use a USB hard disk to transfer files from Ubuntu to Windows 10 PC in a secure manner? I have not used that disk for a while but it was probably exposed to a few PCs that do not belong to me. What would be a secure way to use it? Ideally, I would like to preserve files on it.I would prefer some antivirus or such tool rather than reformatting whole disk, if there are any viruses there they are probably pretty old (disk was  not used for a while)

It depending on the Operating System you are using.
If it is a Windows machine, first I would recommend you formatting that usb disk drive into ext4 format, CAUTION: if you format the USB drive, as I am suggesting above, the information on your USB drive will be deleted forever!, but will prevent any automated scripts from executing when you plug in the USB. Then you can use command-line utility like robocopy:
robocopy C:\SourceDir E:\DestDir /E

the flag /E will also copy the empty folders as well.
If you are on a Linux machine, I would recommend using rsync, but first make sure your USB drive is mounted to your system. To find out your USB device use command tool like lsblk.
If you are moving from Windows machine to another windows machine, you could also download rsync utility for windows and use it. it will be preserved and you can always resume the copy if something interrupts the copy process


Will an IP packet to the own IP address ever leave the computer? I am working on a system that consists of several applicaitons communicating with each other. Some of these applications will run on the same server and some will run on a different one. So there is going to be communication from one server to another one and from one server to itself.

The communication will be TLS protected which of course takes time. In order to make the system more efficient I could only TLS-protect the communications that are not on the same server. Of course this is only safe if the non-protected content never leaves the server it comes from and also goes to.

Let's say One server has the IP 1.2.3.4 and wants to send an IP packet to 1.2.3.4 (itself). Will this IP packet ever leave the server so that it would need to be protected or will it never leave the NIC of the server?

You can be absolutely sure the traffic doesn't leave your machine, if you use the loopback interface (IP 127.0.0.1) for addressing the server itself. See this question.

Communication on the loopback interface doesn't just not leave the machine, it doesn't even enter your network card. It is fully emulated by your OS (at least in linux).


Is my shell prompt visible to public? Let say my local system's shell prompt is in this format: myname@mysurname:~$

Is it logged in some server when I login there via SSH/FTP? Or is it completely private information?

No, not by default. When setting up a connection no local username will be send over to the server, only the username / password needed to connect to that server.

They can try to find this out by using something like finger once you have connected, but since you would have to have fingerd running, this is unlikely to happen.

If it is needed to send over the local username, you could send this over as a variable, but this would also need to be configured on the server.


Cannot reproduce MSF fuzzer results? This is my first time asking for some support in my case. Please forgive me, as I am still learning...
The scenario is really simple:

Some device with HTTP server is being fuzzed by metasploit's module (http_get_uri_long) which requests long URIs and awaits for response.
The HTTP server crashes when receiving about 1700 chars of URI, completely  freezing the device until it is restarted manually by unplugging it from power socket.
I have made multiple tests, and always when HTTP server receives "GET /XXXX..." (about 1700 of Xs) the device freezes which confirms the bug exists.

However, upon creating a simple PoC in Python (2.7) using socket module, I am requesting the same amount of Xs within URI, but without my goal (freezing the device).
For shorter URI, normal 404 error is returned. But when requesting longer URIs, HTTP server doesn't reponse with anything. And the device is still up.

I have tried wireshark, to check if (maybe) I made something wrong within my PoC code, but the packets seems to be same.

Here is my PoC:

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ip = "192.168.0.11"
port = 80

s.connect((ip,port))
data = "GET /" + 'X' * 1800 + " HTTP/1.1\r\nHost: %s\r\n\r\n" % ip
print data
s.send(data)
print s.recv(4096)
s.close()

My goal is: achieve same result as MSF's HTTP URI fuzzer, means freezing up the device. The problem is I cannot reproduce the same with my python code.

Any help is greatly appreciated :)

Okay, I've found what caused the problem. Seems like the vulnerability I was testing is not traditional Denial of Service (like creating one HTTP packet with long string inside), but the "Resource Exhaustion". I've tweaked my code and now it is hanging the device properly.

Time to write a nice mail to device manufacturer :)


Should I trust and play every embedded video on Facebook? Regarding to trusted sites like YouTube, should I trust other videos when embedded to Facebook, usually, when user shares a link a thumbnail image will be created and previewed, then, we need only to click on Play icon (Or the thumbnail) to play the image.

Is there any risk behind that? Considering an attacker can bypass Facebook security and adds fake video so that when user clicks on it will be redirected to Malware download.

Facebook embeds videos in the News Feed and Timeline by using previous knowledge of the way each site supports embedding videos. That means Facebook tries to "understand" the page to which you're linking, and then attempts to embed it; the user doesn't actually control how the embedding happens, ie. when you see an embedded video on Facebook, you can be sure it's embedded in the way Facebook intends it to be embedded.

The key here is know to where the link is leading: Notice in the domain name in this Facebook post

That field cannot be manipulated by the poster without actually changing the domain to which the link is leading. So unless you're being MiTMed, when you see a video embedded that way in Facebook, and you see www.youtube.com as the target domain, then you can be relatively sure that clicking the thumbnail will load the genuine content from YouTube. Same goes for other video providers (Vimeo, DailyMotion, etc.)

However, beware of the rouge Facebook apps that are able to embed videos and trick you into installing malware after you click on the thumbnail. You'll notice that app-embedded videos don't have that domain field.

In any case, app or not, video or not, always be cautious whenever you click on anything

Update: I've just noticed a different Facebook behaviour which is also legitimate and it doesn't involve the domain field mentioned earlier.

Sometimes when the video is shared from within YouTube to your Facebook account, the domain field will not appear in the post, but it will explicitly say "Via YouTube". So also watch for this, it can also be "Via DailyMotion", or "Via Vimeo", etc.


Why are lengthy passwords stronger than complex ones? So all my life I've been listening to people tell me to make my password complex: upper case / lower case / numeric / symbols. Recently though I've been reading / seeing that length above all seems to make for more secure passwords. Now I understand that some password strength checkers can be bogus or not very accurate so I'm hoping someone can shed some light on whether or not length is more secure than complexity and why. Here's the password I'm testing:

this password is supposed to be weak and easy to crack but its strong

All Lower Case
Dictionary Words
69 Characters Long

I've ran this 'password' through 3 password strength checkers:

The Password Meter
Rumkin
Microsoft Password Checker

Each of these websites says that my password is very strong. I realize this makes a password hard to brute force but what I don't understand is how this make it secure from things like dictionary attacks since it's all lower case and all dictionary words. Is it accounting for the human factor?

Obligatory XKCD Comic

Simply because exponential growth is much faster than polynomial growth.

For a password  which has a fixed length n, where the number of characters in your character set (x) is variable will give you a complexity of xn.

This is a polynomial function, and grows accordingly as x is increased.

On the other hand, fixing the character set to n and keeping the number of characters x variable gives you exponential growth nx. This increases much faster as x is increases. (Compare the derivateves for reasonable values of x and n if you wish)

Basically, for reasonable values of x and n, increasing x is much more effective in increasing complexity in the second case.

This is why the strength checkers say that it is secure.

However, using dictionary words does open it wide for dictionary attacks, which can be less secure. Try to use a few random strings in there as well.


Logging in a user after password reset via link Lets say password reset functionality flow is the following:

User submits email address used for his account.
An email is sent to that email address with a link with a password reset hash.
Upon clicking, a user can reset password.

I see websites redirect a user to a login page after a password reset is complete. Is there a security risk in logging in user automatically after password reset is complete?

From a security point of view, whether the "password reset" logs you in automatically or not is rather neutral. Neither behaviour is inherently more secure than the other. I suppose that most sites do what was simplest to implement on the server side.

A point to consider is that security is achieved as long as everybody cooperates; in particular, the principle of least surprise is of paramount importance. That principle, applied to security, means that trouble is afoot when things don't occur as the human user expects it. In this case, the human user may or may not expect to be logged in after a reset. Let's see what happens if the user is "surprised":

If the user expected to be logged in, and is not, then he may be somewhat irked by the necessity to enter his password again. However, consequences stop there. Notably, the requirement to have to enter the password a third time will not induce the user to choose a weaker but easier to type password, because, by definition, he was not aware of this third entry when he chose the password.
If the user did not expect to be logged in after a password reset, and still is logged in, then that user may simply not notice that he is logged in, and remain so. This contradicts the user control of open sessions (the reason why most sites have a prominent "logout" button).

In that sense, a (rather weak) case can be made against logging the user automatically on password reset: security consequences of an unnoticed login can be worse than consequences of an unexpected lack of automatic login.


Securing protected routes/pages with JWT Let's imagine I have a website with a React front-end that renders two pages, one is "View Data" and the other is a welcome page with a login form.

Scenario: You log in and the server accepts it and you get a JWT. When you click on "View Data" the server is sent the Token and it views it as valid. What does the server send back to allow the front-end to display the page, does it just resend the token? Couldn't the front end save it? Can't a REST response be spoofed/modified within the browser developer tools? If not, I know you can set JavaScript variables and such, so I'd have to imagine that it wouldn't be difficult to access the protected page. I can protect the data, but I don't understand how to properly protect the page itself.

To reiterate the various questions:

What does the server send back, does it just resend the token?
Can't a REST response be spoofed/modified within the browser developer tools
If not, I know you can set JavaScript variables and such, so I'd have to imagine that it wouldn't be difficult to access the
protected page. If this is the case, what is the solution?

I think the issue here is a misunderstanding of what needs protected. Let me lay out your situation to make sure I understand it:

You have a JS frontend that renders all pages
You have some pages that shouldn't be accessed without authentication
You're not sure how to protect those pages, given that users may spoof "show this page" responses to the client

The important question is, does the page need protected, or does the data on the page need protected?

If it's just the data that matters, simply have the server avoid sending the data unless the user is authenticated. The user can display the page all they want, but they won't have the data that makes the page useful, so it doesn't really matter.

If the page itself must be kept secret (are you sure? It seems odd to me to keep a layout secret...) then you must not include it in your frontend. If you put it in your frontend and send it to unauthenticated users, they will be able find it if they're determined.


How cloud based web proxy works (ex:Zscaler)? 1) How zscaler see the clients traffic from cloud and how it filters malicious traffic?

2)  How zscaler protects the web applications from external threats?

1) How zscaler see the clients traffic from cloud and how it filters malicious traffic?

Because it is configured as a proxy and thus the client sends its web traffic there.

  2) How zscaler protects the web applications from external threats?

zscaler is not a Web Application Firewall, i.e. it does not protect the web application but the client browsing the web. It is doing this by the usual range of techniques, i.e. blacklists, antivirus etc.


Does changing my password after OAuth login in mobile app help reduce risk? When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and password on their server, then passing it to Google OAuth.

Does changing your password immediately after OAuth login help reduce risk somewhat? If I understand correctly, the third party would still have their token for limited API access, but at least not the master password to my Google account (even if they are storing it improperly).

On a related note: On Android, I didn't have to login again for OAuth for a third party app, I could just select the Google account that was already registered on the phone. But on iOS, the third party apps I used required a Google OAuth login via webview. Is it possible for iOS apps to have the "integrated" OAuth without login?

No. When an application uses and of Google's identity APIs (to include OAuth and Google+ Sign in) the application receives a token from Google indicating that you are you. Then the application signs you in.

One of the major benefits of offloading the password management to Google is that the application doesn't have to store your password (notice that at no point in the above diagram does the application receive your password).

If you decide to not allow an application access to your profile you can simply revoke access, and the token is invalidated.

Generally with all of the ID management methods the application can get mostly basic information about you. Here is a source about what the application may request for Google+ sign in.


Untrusted connection visiting https://www.opensource.apple.com/ Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/

When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on Stackoverflow say they don't have a problem with the link.

But, apparently, some people, besides me, do have a problem with this link
If even Apple cannot properly install certificate

When I check the certificate at https://www.digicert.com/help/?host=www.opensource.apple.com it says "Certificate does not match name www.opensource.apple.com"

Why do I get this warning when I visit https://www.opensource.apple.com/? Why do some people not get the warning? Is this something I should worry about or can I safely ignore this warning and move on?

Looks like the certificate is only valid for opensource.apple.com, not www.opensource.apple.com:

  www.opensource.apple.com uses an invalid security certificate.

  The certificate is only valid for opensource.apple.com

  (Error code: ssl_error_bad_cert_domain)

You can simply use the former.


POODLE and TLS...not SSL In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent this?

Lots of articles I read stated that due to CBC block cipher used in SSL this causes issues and I saw a great article someone wrote on this website that explained it well...but at all times I always read "this does not affect TLS"...but,now it seems it does affect it.

From reading various articles it seems like a lot state "some implementations of TLS are affected"...what does that mean???! What specific implementation are they talking about?

We have already disabled SSL 3.0 back in October but trying to understand what else we can do to prevent the new attack on TLS?

I cannot find anything apart from some articles that explain that F5 and some A10 systems or websites were affected but nothing as to how to fix this on Windows Servers.

I have also seen issues whereby the advice is not to use older browsers - I am not really interested in that as I look after servers and not desktop space and the desktop guys will know what browsers they have. I know servers have browsers so I guess I am interested a bit but internet access on servers are disabled in our company...unless you're on terminal servers..

Specifically is there anything in the registry under TLS keys that I need to change etc? I have no idea what will break if we disable TLS 1.0 (but if this newest POODLE attack affects TLS 1.1 and 1.2 then we cannot turn the whole thing off!).

Some implementations of TLS 1.0 did not properly validate the padding as required by the TLS specification. This led to a situation in which the POODLE bug could be leveraged against TLS 1.0, despite the fact that it should be secure against the attack. Later versions of TLS (i.e. 1.1 and 1.2) are inherently secure against POODLE and other padding oracle issues because they authenticate the encrypted message (CBC-then-MAC) rather than authenticating the plaintext (MAC-then-CBC) (EDIT: That bit was wrong, see Thomas Pornin's comment below)

As far as I know, the only major implementations affected are in equipment from F5 Networks, A10 Networks, and Cisco. The SSL Labs scanner checks for the bug, but it can only target internet-facing IPs. The Windows SSL stack, as far as I can tell, properly implements the padding checks in TLS 1.0 and therefore isn't vulnerable to the TLS variant of POODLE. As such, you shouldn't need to do anything.


Do LUKS2 encrypted partitions with Keyfiles use a KDF? I gather from the cryptsetup manpages that LUKS2 uses argon2i by default for strengthening a user-password to decrypt the partition. However if a 256 bit keyfile with data from /dev/random, how does a KDF make guessing that password harder?
Wouldn't you just have the 2^256 probability either way then? So an attacker would just try and guess the password that's used for e.g. AES-XTS and not the keyfile.
So if I were to use a 256bit random keyfile(longer doesn't seem to do anything useful either),
could I just disable the KDF?
Does it help me if I generate a 1MB keyfile and set argon 2i(d) to 10k iterations and use 2GB ram?

Yes you can use the key file instead of a password: simply specify the file at the time:
cryptsetup luksAddKey /dev/the /your/key/file
When you wish to unlock, cryptsetup open ... --key-file /your/key/file /dev/the (My understanding is that cryptsetup will still use a KDF though, just one that requires no user input.)
If you wish to have a key file and a passphrase, you need to 'unlock' your key file using some tool that demands user input, then make this file available to cryptsetup. (If this is your goal let me know and I'll update this answer later on with some options.)
If you use 10k iterations and 2GB of ram, you'll be waiting a long time for Argon2 to complete. 10 iterations might be more usable (at the time of writing) and still provide good security, as long as your password is 'good', eg: b/pz8prnzx2sv.r2o/y3khykkacqja6ghx9u442o (which, according to KeepassXC, provides "228.40 bits" of input to key derivation functions!)
MASTER KEY As you pointed out in your comment, LUKS stores a hash-digest for the master key in the header. This value MK-digest is PBKDF2-derived from the master-key with MK-salt and MK-iterations as input. The underlying hash function is the algorithm you specify using cryptsetup luksFormat --hash, by default, SHA2/256 on my version of cryptsetup: 2+. The number of iterations is 1000 and I don't believe you can change this, however, this may be incorrect. (See the LUKS1 spec, Figure-4, p10)
KEY-SLOTS Each attempted key-slot derivation becomes the key to decrypt that key-slot's copy of the master key, as described in this answer. It's not clear from the spec whether a key-slot file is also fed into a key-slot's corresponding password-based KDF, however, I believe it is because if you tune an Argon2 slot to take a few seconds, it will take the same time regardless of whether its via --key-file or a typed password.
This answer gives a good overview as well as details about the LUKS header arif '19.
So yes, an attacker can perform an exhaustive search to find an input that produces the MK-digest that is stored in the header. This input will be the master key. You want your adversary to be in the worst-case position of having to search, on average, half the key-space to find a match. (More follows subsequently on exhaustive searches.)
You can provide the master key to cryptsetup at the time of creation with the --master-key-file option. By default, cryptsetup will draw random bytes in accordance with its default setting, or, if you specify a random input file. Read the man page carefully, as you can provide the master key file at time of luksFormat, at open, as well as other circumstances.
You can also open the LUKS volume directly with your master key, however, I personally think the better option is to unlock the key-slot and then somehow destroy the insecure copy of your key-file. (I like modprobe brd and shred.) This leaves the kernel to manage the master key. It also allows you to have two or more separate copies of the master key, in case of hardware failure, but this will double etc. the likelihood that an attacker can find your volume master key.
You also need to think about what file-system the master key file or any key-slot file will be stored on during its use, because this has the potential to hang around in its unencrypted form.
RANT ON KEY SIZES From a security persepective, there's no point producing more than 256 bits of high-quality random input for your aes-xts-plain64 key derivation. The reason why is, that this is an impossible wall to climb when it comes to guessing... but feel free to provide as much as you're comfortable with - there might be other good reasons to produce large input. (It's a lot easier to lose small things!)
Joking aside, in fact you can't even enumerate each possible number in a fraction of this range with present-day technology, (in your lifetime), let alone test them all in an exhaustive search. To put it into perspective, the newer AntMiner s19 can hash 95 T-hash/sec of SHA2/256, so if your security rests on this primitive, then to test say 70 bits of truly random input, it will take this single piece of hardware 2⁷⁰ ÷ (95 × 10¹²), or ~12 million seconds, say, 3k 24-hour periods. Also remember that PBKDF2 has a tunable number of iterations which you'll then need to divide 95 × 10¹² by. (Ps. I'm not suggesting 70 bits is enough, but this is a tractable number for people to understand - remember - each additional bit doubles the previous search space.)
(Incidentally, the same computation shows why a poor choice of password falls swiftly in the face of parallel, offline dictionary attacks. Also of note, the AntMiner s19 operates at roughly 8-times the rate of the s9, ~12 T-hash/sec, for roughly 3-times the power consumption.)
The point is: you want any key to come from a sufficiently large, non-deterministic and equally likely number of possibilities, ie. you want it to be of high entropy.


Why do embedded systems store server's public certificate in ROM? In the home automation scenario, smart gateway can bridge the many smart devices with Internet. In many cases, a server's public certificate is stored in the embedded system's ROM during manufacturing.

For example, in case of AlertMe gateway, each gateway device is manufactured with a unique ID. In addition, it also holds the public certificate of the AlertMe servers in ROM. On first boot, the gateway device generates a random RSA key pair, connects to the AlertMe servers, verifies the server’s identity (using the ROM public certificate), and gives the server its random public key.

My question is, since in the SSL/TLS connection the server will send its certificate to the gateway, why does the gateway have to store a public certificate in the ROM, before its first boot. If, like what it says, it is for the verification purpose, how does the gateway verify the server's identity? Does it just compare the gateway's certificate in the ROM with server's certificate sent at SSL handshake? Can't the embedded system contact the CA, to verify the identity of the server?

Moreover, on first boot, gateway will generate RSA key pair, and then the certificate.  Where is the safest place in the Linux based gateway/embedded system to store the key?

For your question why the server certificate is saved in the ROM:

The saved certificate is checked against the certificate sent back by the server. This is a correct assumption from you. Therefore only one server is trusted at this moment.

You ask why the device does not simple connect to a CA. This would be another way to work. But even then the CA root certificate must be embedded in the ROM. This is needed because else how would you connect to the CA? You need also SSL/TLS to connect to the CA because else all the PKI would be senseless. So at least one certificate must be embedded in ROM.


Accessing hidden partitons I have two disks. They're both bootable and run Linux.
When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see for example /dev/sdb1. It seems like someone has gone into a lot of effort to hide the partitons but I don't know how.

I've tried using testdisk and it detects 2 partitons on each disk, but I know there are more than that. The partitions found are quite useless and I know there must be a boot partition. I've tried changing the disk geometry but this hasn't helped.

How can I work out how they've been hidden and any suggestions on how to unhide them so that we can mount those other partitons?

EDIT: This is what is displayed during boot:

Mar 27 12:44:11 (none) user.notice kernel: sd 0:0:0:0: [sda] 8388608 512-byte hardware sectors (4295 MB)
Mar 27 12:44:11 (none) user.notice kernel: sd 0:0:0:0: [sda] Write Protect is off
Mar 27 12:44:11 (none) user.debug kernel: sd 0:0:0:0: [sda] Mode Sense: 61 00 00 00
Mar 27 12:44:11 (none) user.notice kernel: sd 0:0:0:0: [sda] Cache data unavailable
Mar 27 12:44:11 (none) user.err kernel: sd 0:0:0:0: [sda] Assuming drive cache: write through
Mar 27 12:44:11 (none) user.info kernel:  sda:
Mar 27 12:44:11 (none) user.warn kernel: custom_partition sda: partition 4 exceeds device capacity using largest possible size reduced from 5120000 to 4259840
Mar 27 12:44:11 (none) user.notice kernel: sd 0:0:1:0: [sdb] 167772160 512-byte hardware sectors (85899 MB)
Mar 27 12:44:11 (none) user.notice kernel: sd 0:0:1:0: [sdb] Write Protect is off
Mar 27 12:44:11 (none) user.debug kernel: sd 0:0:1:0: [sdb] Mode Sense: 61 00 00 00
Mar 27 12:44:11 (none) user.notice kernel: sd 0:0:1:0: [sdb] Cache data unavailable
Mar 27 12:44:11 (none) user.err kernel: sd 0:0:1:0: [sdb] Assuming drive cache: write through
Mar 27 12:44:11 (none) user.info kernel:  sdb: unknown partition table
Mar 27 12:44:11 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Mar 27 12:44:11 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Mar 27 12:44:11 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Mar 27 12:44:11 (none) user.info kernel: EXT3 FS on loop1, internal journal
Mar 27 12:44:11 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Mar 27 12:44:11 (none) user.warn kernel: Clocksource tsc unstable (delta = 607842230 ns)
Mar 27 12:44:11 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Mar 27 12:44:11 (none) user.info kernel: EXT3 FS on sda4, internal journal
Mar 27 12:44:11 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Mar 27 12:44:11 (none) user.info kernel: Adding 1048568k swap on /dev/swap.  Priority:-1 extents:1 across:1048568k
Mar 27 12:44:11 (none) user.info kernel: kjournald starting.  Commit interval 5 seconds
Mar 27 12:44:11 (none) user.info kernel: EXT3 FS on sdb2, internal journal
Mar 27 12:44:11 (none) user.info kernel: EXT3-fs: mounted filesystem with ordered data mode.
Mar 27 12:44:11 (none) user.info kernel: EXT3 FS on dm-0, internal journal

How can I work out how they've been hidden

Hiding partitions is actually relatively straightforward. First up, some theory.

Your disk is a big bunch of memory addresses as far as the operating system knows - we call this LBA addressing. Ignore everything your read about CHS unless you're dealing with XP and earlier - modern hard disks do not come with cylinders, heads and sectors although they do come with some strange compatibility support for people who want CHS values.

Now, on this big empty space you need to decide how to lay out your data. You do this by having a partition table - that is, a known area of the disk that holds data describing your partitions. There are two schemes in use in most consumer PCs - MBR partitions and GPT ones. MBR stands for the master boot record and everything, the code needed to launch the OS and the partition table, lives in the first 512 bytes. Wikipedia describes the format as it goes for GPT partition schemes.

Things can get more complicated. As you are no doubt aware, MBR limits you to four partitions per disk, which is how logical volumes were born. Logical volumes are basically another type of partitioning scheme inside one of your four MBR partitions. Of course, when I say "logical volumes" I could mean logical volumes from Microsoft, LVM as part of the Linux Kernel and so on. These schemes are unnecessary (but LVM can and might be used) on GPT disks because these support unlimited partitions, or if you are on Windows, an arbitrary 128-partition limit. Mind you, you can't have that many drive letters in Windows anyhow.

So back to your question: how do you hide a partition? Two ways, as far as Linux is concerned:

remove the entry from the partition table by supplying a null entry where the partition should have been.
fill up the partition table, but don't fill up the disk. Allocate the new partition in the free space.

These two have the same on disk result - they're just different in the order of events that are needed to make them happen.

  and any suggestions on how to unhide them so that we can mount those other partitons?

The most obvious way would be to re-write the partition table entries for these partitions. You can then run kpartx -l to see what would be mounted and kpartx -a to trigger a re-evaluation.

However, editing partition tables is a bit of a fraught process unless you're really happy totally breaking things and I'm not sure I'd recommend it. Luckily the Linux kernel has an awesome trick called device mapper.

The sole purpose of device mapper is to take one or more block devices and map them in some defined way to produce a virtual block device. Long story short, you can use device mapper to say "map from my hard disk starting at block 1000 and ending at block 2000 this new block device". Then the resultant device is a 1000 block device which maps back to the original device but can be used as a block device in its own right - containing a filesystem! If you're familiar with loopback devices, the trick is quite similar.

To create such a mapping, simply do:

dmsetup create mappingname --table "0 2048000 linear /dev/sdx 0"

where 0 2048000 represents the starting block and ending block this "window" creates on device /dev/sdx. If this succeeds, you should have a block device /dev/mapper/mappingname. You can find the documentation for this as part of the Linux kernel.

As an aside because I can't help myself, "fake" RAID cards on Linux works in exactly this way. The command dmraid -ay analyses your attached disks for RAID card metadata and creates the appropriate device mapper mappings.

  It seems like someone has gone into a lot of effort to hide the partitons but I don't know how.

Now, the ultimate crux of the issue is that whatever you do, you need to know where the partition is on the disk. Most filesystems have recognisable super-block structures. NTFS for example begins with a BIOS parameter block and various other metadata - you can see this here. Ex4 has a superblock with various magic values. Repeat for just about every file system out there.

How you go about finding partitions matching a given set of file systems - well, I would have hoped TestDisk would have identified the metadata. Failing that, you could write something yourself.

An encrypted volume may be more problematic. Depending on the software in use, there may be no magic value that indicates a file system at all - indeed, it may be indistinguishable from the random junk also on the disk and abandoned by legitimate file systems. The only hope you have in this case is that the disk has not ever been repartitioned and there are still identifiable "empty zones" between the valid partition ending and the encrypted partition beginning.

At this point, you've exhausted my personal knowledge. It looks very much like you may need to write some custom scripts/tools to parse your disk (image) to find what you need, identify the range and then map the volume. There may be users here who have more experience of forensics and can point you at existing tools, so I'd be tempted to hang around and wait to see if any materialize.

Disclaimer: I work in disk imaging and recently happen to have upgraded our Linux environment to support fake RAID cards. Oh and LVM too.


Prevent the tampering of the logs of a service In a security-sensitive service with REST APIs, what is the best way to produce tamper-resistant audit logs?

Signing each log entry is a possibility, but that does no prevent a malicious operator from hiding some of the logs.

Use Central Log Server - it can be as simple as cronjob to copy log files at one place or using Syslog-NG to store logs in Database. (https://syslog-ng.org/ )
Or You can use AIDE sort of tool to ensure integrity of the logs. Rotate logs at frequency based on size and criticality.

Also an excellent answer is given here Techniques for ensuring verifiability of event log files and https://crypto.stackexchange.com/questions/8104/tamper-proofing-log-files


Prevent metasploit meterpreter process migration Is there any way to prevent meterpreter process migration.?

Based on this question, process migration requires the SeDebugPrivilege to create a thread attached to a remote process, so denying it should block the migration process. Sadly, there is no clear definition on how to do it, but seems like this privilege is part of the user / group privileges so using a non-admin user without this privilege should block process migration.

Also any advanced AV-System should be able to detect and block process migration, but I only tested it on Kaspersky which did block mirgration.


Which files are more insecure than others? Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, I'd like to ask:

Which files are more insecure than others in contexts of handling them on a server after uploading or on a client computer after downloading?
What specifically makes those particular types of files insecure or more insecure than the others?

I don't mention a type of OS in order to not narrow down my question without strong reason. If it is the important factor for an answer then, please, specify it.

Typically the "insecurity" of files comes into play when they are accessed, not just by having them downloaded. Downloading a file unopened and having it pwn your computer is the stuff of Hollywood and science fiction (as far as I know, though there may be research into this too).

Thus, to understand the problem, the real question is not about the file types, but rather about the typical programs commonly used to access those files.

Thus, a .txt file should be relatively harmless, since it's accessed in raw form by simple text readers and not recognized as code in any way. (Though of course a 0day vuln found in e.g. Windows Notepad could change that....)

PDFs and Office docs are typically opened by Adobe Reader and MS Office programs, respectively - and these all recognize numerous types of dynamic content, e.g. Office Macros. Furthermore, there is a whole lot of data handling, parsing, translating, activating, and rendering going on, and there can be (and are, and were) many different vulns at each step of the way, in each of those programs (and of course others).

Same thing goes for media files - JPEGs and GIFs can have hidden code (see GIFAR), movie files can have embedded codecs, etc.

Of course, executable files and code (compiled or not) are the most dangerous, since they are trivially exploitable - the code is already there, and the user explicitly asks to excute it. This includes, e.g. on Windows exe, dll, com, bat, htm/html, js, vbs, jar, etc.
Of course source code (.java, .cs, .vb, .c, .cpp, etc) can also be an issue, since these are typically passed directly to a compiler - arguably one of the most complex pieces of common software - and gives execution instructions, not to mention the later output... It is not too complicated to obfuscate malicious code.

Choice of OS is not necessarily the most important factor here, though of course different files will execute differently on each OS - and each OS has its own share of unsafe filetypes.
More importantly, is if/when a malicious file is executed, what kind of damage can it do? An OS that defaults to minimal user privileges (compare Win7 to WinXP), will of course be that much safer.


Recent attacks and vulnerabilities How can I be up to date and get news on recent attacks and vulnerabilities?

Is there any trusted source of information (websites, databases, ...)

Theres a few sites you can use - I'll link a few below:
News
Krebs On Security
Kaspersky
Erata Security
Packet Storm
Hacker News
We Live Security
Vulnerabilities
CVEDetails
OWASP
EDIT: I'll update this list with more links shortly!
Updated the list to reflect @Nomad 's comment


Choice of Anti Virus Tool vs Anti Malware Tool? We've had a breach in our network recently and we have been challenged over the the AV tool we are using. Because the malware/virus was cleaned (variant of Ransomware) by using an advanced anti malware tool.

Question 1: What are the factors to be considered in selecting appropriate tool (AV vs Anti Malware) or  we need to have both the tools installed?

Or

Question 2: Is industry practicing different mechanism to protect their assets?

Note: We've researched on web but couldn't find conclusive answers. The following is one article but no conclusive answer.

https://lifehacker.com/the-difference-between-antivirus-and-anti-malware-and-1176942277

Anti-virus and Anti-malware are the same thing.

The term Anti-virus is from early in the industry where viruses where the bulk of malware affecting users systems and being written so for marketing reason anti-virus was name chosen. Since then the categories of malicious programs has expanded and will continue to as we move forward.

Virus / Worm / Trojan / Ransomware are different types of malware.

Selecting the tool - well this is going to be up to your team to gather requirements. Do you have a large fleet and a security team that handles these incidents? Well you're going to need a centralized pane of glass for reporting and taking action. How easy is to push out to your machines?
Are you a small business? Well then maybe just a stand lone product on your machines is fine or using Windows Defender.
Maybe take some sample malware you get run it through virus total and pick your AV product based off those results
Protecting assets - there is no single tool. Virus total shows a good example of AV products detecting some malware but not others. This doesn't mean go load up all the different AV products it just points no all cases are going to be covered.

Security is layers so look at AV + Host Firewall + Application white listing + Monitoring + Least privileged as an example


Form and Processing page on separate HTTPS domains. Any risks? If I have a form on a HTTPS site and my processing page (which is also HTTPS) is on a completely different domain, will the data be secure?

For example: https://example.com has a form with action="https://processingpage.com" is there any risk with the data that is sent from the form?

Can it be intercepted? Does it have to be encrypted?

In the situation you described the data is transported securely and cannot be intercepted between the two domains.

However, it may be harder to implement something to prevent cross site request forgery in your situation.


OpenSSH windows 10 user's password not configured I'm currently using openSSH and my admin user configured without login password, i.e automatically logging in during startup. I wonder what happens in such case, is there an automatic default password for SSH connectivity?

I've another related question, during installation I chose "Run as LOCAL_SYSTEM" what does it mean?

C:\WINDOWS\system32>ssh -V
OpenSSH_7.4p1, OpenSSL 1.0.2j  26 Sep 2016

By default OpenSSH does not allow empty passwords, as you can read in manual page for sshd_config.

PermitEmptyPasswords
When password authentication is allowed, it specifies whether the server allows login to accounts with empty password strings.  The default is no.

This is reasonable for remote login. Unless you change this option, or set a password for your user, you should not be able to use SSH to log in to your system.


How do I report a vulnerability? How would I report an international security vulnerability which could cause a lot of damage?

I am asking how & where I would report this vulnerability, not now to create a simple vulnerability. :)) so & I am trying to trade it to free someone.

You need to privately contact the person who manages the software in which you found a vulnerability. Tell them about the vulnerability you found, including how you think it can be exploited and what you think it can do. Give them some time (often in the range of a few months) to verify your claims and provide a solution.

Once they have fixed the issue and a link to a patch has been made available to their customers, contact the CVE list and ask for a CVE number if you're out for the glory.

Edit: be aware that some software providers are morons and refuse to acknowledge their mistakes, so they try and sue whoever presents them with a vuln in order to quiet them and avoid the shame of having security issues in their software. Some cryptology researchers I've met have had this issue time and again with smart card manufacturers. If you suspect you're facing this type of individual, stay anonymous when reporting.


How to know if two IP addresses point to the same web server? Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application.

They are different public (accessible through Internet) IP addresses and there are no explicit redirects (30X) between them.

What I'm looking for are indicators that can help me to conclude that both web servers are just one.

Is it possible to know if both IP addresses are pointing to the same web server? How?

You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts.

You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the IPs are likely to be different machines with their clocks out of sync.

If the site uses session cookies, you could start a session on the first IP, and then try using the same session cookie with the second IP, and see whether it recognises your session. If it doesn't then you are probably on a different host, if it does then you might be on the same host, or the sessions are not getting managed in the web server.


What's the difference between pixie attack and other attacks on WPS? I have been studying about the brute-force attack on the WPS PIN, and I understand that because the last digit is the check digit, and  that the PIN is divided into two halves in M4 and M6 messages, one can brute-force the WPS PIN in 11.000 attempts.

Though, I recently heard about Pixie attack on WPS, and it said something like it takes advantage of the low entropy in some routers. What exactly is Pixie attack, and how does it affect WPS? One more question, how can one find the WPA key from brute-forced WPS PIN?

Pixie works by exploiting weaknesses in the generation of the E-S1 and E-S2 nonces which are used to produce the enrollee hash, as described in the Pixie Dust Attack.

Traditional attacks attack the two halves of the WPS PIN (PSK1, PSK2) in an online attack, essentially brute-forcing all possible options for the PIN until it is found. This has to be done online against the target, so it takes a long time.

The WPS exchange involves computing two hashes (E-Hash1, E-Hash2) which are derived from two nonces (E-S1, E-S2), the public keys of the enrollee and registrar (PKE, PKR), the authkey (a value derived from the Key Derivation Key / KDK), and two halves of the WPS PIN (PSK1, PSK2). The values PKE, PKR, E-Hash1 and E-Hash2 are known by an attacker since the router will give you them (or you're providing them as a client) and you need to find the correct combination of E-S1, E-S2, PSK1, and PSK2 in order to break the hash offline.

Cracking the PSK1 and PSK2 parts is relatively easy; there are only 10,000 possible values for PSK1 and 1,000 for PSK2 (the last number is a checksum) and each hash is separate so you only need to compute 11,000 hashes. This doesn't take a lot of time on a modern system.

However, the problem is that you need to know the two nonce values E-S1 and E-S2. This makes the offline bruteforce approach untenable, as these are 128-bit values.

The crux of the Pixie Dust Attack is that the E-S1 and E-S2 nonces are not generated securely in many routers. As an example, MediaTek routers are known to just use zero for both values. In some Broadcom routers, the PRNG used is a weak one (likely an LFSR or something like Mersenne Twister) and it is also used to generate the PKE. By guessing the possilbe PRNG seed values until you find one which generates the same PKE as the router gave, you can then generate the E-S1 and E-S2 values trivially. Realtek routers use the Unix timestamp in seconds to generate the PKE, E-S1, and E-S2 values, but since the generation is fast it's usually the case that E-S1 = E-S2 = PKE (or E-S1 = E-S2 = PKE+1 in the case that it did tick over a second boundary) and since we know PKE, we now know E-S1 and E-S2.

This is why the Pixie attack is so fast. Instead of trying 11,000 possible PINs against the live router (which is slow and might result in the router blocking you), it captures the WPS hash values and cracks them offline, utilising weaknesses in nonce generation so that it only has to try 11,000 PIN values against each possible guessed E-S1 and E-S2 value pair.


What is the difference between a backdoor and a rootkit? I was reading the "What is a rootkit ?" post and I'm confused about the difference between a rootkit and a backdoor. As I understood it, both :

Are a piece of code written by the attacker and injected in a system
Allow the access into the the system only to the user that wrote the code, or at least has knowledge of the code
Are hard to detect and to patch

So, are those terms similar and both can be used to mean the same thing ? Is one more generic than the other ?

Thomas Pornin's answer to the linked question starts off with a pretty good definition of a rootkit, I think:

A rootkit is a set of tools that you run on a target machine when you somehow gained access to it with root-level privileges. The point of the rootkit is to transform that transient access into an always-open door.

First, let's see how this fits with your points:

Is a piece of code written by the attacker and injected in a system.

"Injected into a system" is pretty broad, but accurate.  It doesn't need to have been written by this attacker, though; they could've gotten one off-the-shelf, especially if it's using a common tool (like openssh) to keep the elevated privileges.

Allow the access into the the system only to the user that wrote the code, or at least has knowledge of the code

A rootkit allows an unauthorized user to gain root privileges if they know "the secret handshake" (whatever the trigger is for the rootkit).  Authorized users (for instance, sysadmins) are still able to do the things they normally do.  And another attacker doesn't need to know the specifics of the rootkit implementation, just the details of how to get it to work (the user interface, shall we say).  A good example of this distinction is the Sony copy protection rootkit, which hid any process that matched a certain name pattern and was used by several unrelated pieces of malware.

Are hard to detect and to patch

Generally, yes, since the attacker has root access and all of the privileges that come with it.

A backdoor is a much more generic term, referring generally to some sort of way for an unauthorized user to gain access to a system.  The name comes from the physical world, where you might have the front door to a building guarded, but a little-known back door that is unguarded (or more loosely guarded).
I suppose that a rootkit is a sub-type of a backdoor; the specific access it gives is persistent root access on a Unix-like system.
However, backdoors can cover a much wider area.  One of the most common associations with backdoors is disgruntled former employees.  Imagine that you had a developer working at your company on some sort of web app that has an administrative panel.  Normally, the panel requires a valid username and password to access.  However, this developer secretly added code that allows them to double-click in the top-left corner and bypass the login screen.  This would be a back door (given access that they should not), but is not a rootkit (there's no root account here).


Proper precautions when studying darknet malware activity I would like to get more into studying black market internet activities related to malware. I often see specific malware or kits for sale or ddos services, etc.

How do researchers go about studying these things without having to illegally purchase them? Is it just a risk people take to stay on top of the industry, or do countries like the US (where I am based) provide any protections for this sort of thing?
What technical precautions should be taken to ensure I do not harm myself (my identity)? I am ignoring my safety with respect to actually studying the malware itself since that is a well discussed elsewhere, but I am specifically referring to everything up to and through the acquisition of said malware.

Okay, here are my 2 cents.

You don't necessarily have to purchase malware to study them. You can scour the interwebs looking for malware, get infected, get hold of the right files and start researching them! Or, you can find malware to study on Github. Take a look at - https://github.com/rshipp/awesome-malware-analysis#malware-corpora.
The only technical precaution I would take while purchasing malware or mal-services online would be to pay in Bitcoins. That would take care of not revealing your identity and your payment information to malware-sellers. I doubt Governments would spend their time, money and effort hunting down people that purchase malware with Bitcoin.

Hope this helps!


Reversing a block hash of SHA-1 with known Plaintext? Is it possible to reverse the hashing of a block in a Datastream fed to an SHA1 if the plaintext for that block is known? If it is not possible (which I assume) does it make attacks to retrieve the state easier?

An example what I'm trying to figure out:
The following data is known:

suffix1
The result of SHA1(secret + suffix1)
The length of secret, which happens to be exactly 512 bit (ie a full SHA block)

Now what I'd like to figure out is SHA1(secret + suffix2) (a different known suffix)

(+ means String concatenation)

(suffix1 is known but can not be manipulated a length extension attack is (probably (?)) not possible)

Is this possible? Is there any research on doing this or is it just plain out impossible? If it is possible: Does this also apply to the SHA-2 family?

Thank you!

Recomputing secret from SHA-1(secret || suffix1) (for any known value of suffix) would constitute a preimage attack. No preimage attack faster than luck is currently known for SHA-1 ("luck" works in average effort 2160 for SHA-1, i.e. totally infeasible). You won't get the secret value.

However, if your goal is to compute SHA-1(secret || suffix2) then that one may be possible, depending on the value of suffix2. It is called the length extension attack. Namely, suffix2 must begin with suffix1, followed by some padding bits which depend on the length of secret || suffix1; after these bits (which you do not choose), you can put whatever data you want. In that sense, suffix2 is partially controlled by the attacker.

Length extension attacks are sufficient to show that SHA-1(secret || data) is a poor MAC, and HMAC should be used instead (all of this applies equally well with the SHA-2 functions, by the way).

Now if you do not want to put any constraint on suffix2, then this is going to be hard. The effect of secret boils down to an unknown 160-bit state at the start of the second block. I don't have time this morning to work this out mathematically, but my intuition is that finding that state value from the output of SHA-1(secret || suffix1) would be equivalent to exploring a cycle in the permutation incarnated by the SHACAL block cipher with suffix1 as key (assuming suffix1 + padding fits in one block). Since SHACAL is supposed to be a "good" block cipher, this permutation should behave as if chosen randomly among the set of possible permutation of a space of size 2160, meaning that the cycle should have, on average, a length close to 280. This again implies a cost too high to do it in practice.

Note that being able to do what you try to achieve would not contradict the properties of SHA-1 as a "good hash function" (resistance to collisions, preimages and second preimages). It does not mean that we don't care about it, but it highlights why hash functions and random oracles are not exactly the same thing.


Why should I run OWASP Broken Web Applications Project as host only or NAT? We have a hard time getting VMWare to work in bridged mode. We can get it to work in Bridged mode.
Why is it so important to run it with host only or NAT?

The name 'Broken Web Applications' infer that they are a collection of applications which has insecure code deliberately put together for educational or practice purposes.

Using Bridged mode means, other users in your network can connect to this host.
So technically if you are running 'OWASP BWA' using bridged mode, others in your network or LAN can exploit this insecure code and get access to your machine or the machine hosting this 'BWA'. We wouldn't want that and so using NAT ( if you need this host only for outgoing connections such as to the Internet, not allowing incoming connections ). Host only network gives access only to other VM's running under the same hypervisor, with no external access.
Therefore NAT, Host-Only networking provide limited access to this VM running insecure code.
It is strongly suggested NOT* to run 'OWASP BWA' or any other such intended insecure application in Bridge-mode.


Opened a phising email on school email Hello I opened this email sent to my school email and I realized it was a phising email.

And now my OCD and anxiety are going haywire. Is it possible I got infected? I did not click on any links. I just opened it.

I tried to change my password but the school system wont let me and their offices are closed. I opened it on my galaxy 9 . Is the phone infected? Will I be safe in connecting it to the school wifi that is connected to the email ? Should I change all my passwords on the apps on my phone??

You weren't the only one who noticed this message had malicious content: Office 365 noticed it, too:

To help protect your privacy, some content in this message has been blocked. To re-enable the blocked features, click here.
To always show content from this sender, click here.

Unless you enabled the harmful content or clicked any links on the email, you should be safe. If you clicked something, then it depends: this question doesn't have enough information  to say anything about the harmful content itself. However, you should not try and get this information by clicking anything.


Enable RDP for internal network only I just got a tablet and I want to use it to RDP into my main computer. The thing is, the first thing I did when I set up my PC was to disable RDP. I am not comfortable, and have no use for, allowing RDP connections from outside my network.

I might be using the term network wrongly; I don't have any sort of network setup, just your standard commercial router.

I tried going into the firewall settings to try to limit port 3389 and I did not see any way to limit traffic by IP address.

I am using Windows 7 ultimate.

The standard commercial router you mentioned do not allow any incoming connection from outside to the inside of the network. You need to specify allow the incoming connections through port forwarding. If you want to connect to the PC through the same network i.e. both tablet and PC are connection to the same local area network, you don't need to worry about outside users connection to the PC from the Internet since the NAT device (the router) won't allow it by default.

If you want to access the RDP from outside the network e.g. through the Internet, but want to restrict the access to specific IP address, I don't think the commercial router would be flexible enough for such a rule. However, you can accomplish this through your Windows firewall. In order to restrict RDP to specific IP addresses,

Go to the control panel->Administrative Tools
Windows Firewall with Advanced Settings
Inbound Rules
Remote Desktop (TCP-In)
Go to the Properties->Scope tab
Add the IP (or IP range) in the Remote IP addresses section


CVSS score for no-input validation During a security assesment I found that an application wrote JavaScript from input fields directly in the database. The application it self had good output sanitization so no XSS was possible in that application. A different application that used the same data didn't have good output sanitization and had a XSS vulnerability, which has been fixed since then.

So wat I have now is a finding that input data is not properly validated, which might pose problems for applications that do not sanitize output well but not in the current application. What CVSS score would I put on that? I cannot well make it a high vulnerability because it is impossible to exploit now. But in the future it could pose problems and I do want it fixed in the context of "defense in depth"

Question: What would the CVSS score be for a non-exploitable input validation vulnerability?

The score would be 0.0. Since there is no immediate impact, the confidentiality, integrity and availability would be set to none, which would make the score 0.0.

Also, it is not necessarily a security issue that user input is saved as-is in the database. The important thing is that it is correctly encoded on output.


DeAuth sent to router doesn't deauthenticate I'm trying to perform a De-authentication attack on my wifi network.

My command is:

aireplay-ng -0 0 -a B8:A3:86:5E:9C:DC wlan0

The response looks like this:

20:35:59  Waiting for beacon frame (BSSID: B8:A3:86:5E:9C:DC) on channel 11

NB: this attack is more effective when targeting a connected wireless client (-c <client's mac>).

20:35:59  Sending DeAuth to broadcast -- BSSID: [B8:A3:86:5E:9C:DC]

And so on the DeAuths go.

But it doesn't do anything. I can still browse the web and using for example airodump-ng to get a handshake just waits still. So the devices are not getting deauthenticated. Targeting a specific client doesn't help. I left it up like this for about 5min and still nothing. What am I doing wrong here? The MAC address is correct.

Edit:

After targeting the client I'm getting the following:

12:04:16  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [37| 0 ACKs]
12:04:16  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [86| 0 ACKs]
12:04:17  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [12| 0 ACKs]
12:04:17  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [ 5| 1 ACKs]
12:04:18  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [ 0| 0 ACKs]
12:04:18  Sending 64 directed DeAuth. STMAC: [40:40:A7:4C:3F:25] [ 0| 0 ACKs]

Interestingly, I'm getting the acks only when I'm using the internet on my phone.

My WiFi card is Intel Corporation Wireless 7265 (rev 61)

There are a bunch of reasons why this might not be working. The documentation explains a few:

Why does deauthentication not work?
There can be several reasons and one or more can affect you:

You are physically too far away from the client(s). You need enough transmit power for the packets to reach and be heard by the clients. If you do a full packet capture, each packet sent to the client should result in an “ack” packet back. This means the client heard the packet. If there is no “ack” then likely it did not receive the packet.
Wireless cards work in particular modes such b, g, n and so on. If your card is in a different mode then the client card there is good chance that the client will not be able to correctly receive your transmission. See the previous item for confirming the client received the packet.
Some clients ignore broadcast deauthentications. If this is the case, you will need to send a deauthentication directed at the particular client.
Clients may reconnect too fast for you to see that they had been disconnected. If you do a full packet capture, you will be able to look for the reassociation packets in the capture to confirm deauthentication worked.

(emphasis mine)
Keep in mind that, in regard to the final point, many WiFi stacks will simply reconnect immediately without notifying the user. As such your deauthentication may be working, but you're not seeing any effects from it. In general sending a single deauthentication packet does not cause a long-term outage; the device will just reconnect. This behaviour is really useful when you're trying to capture lots of 4-way handshakes to crack WPA/WPA2.


Bash: Why would sourcing a file be less safe than bashing it (executing in another session)? Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

Is it the case, or I completely misunderstood?

I've heard in the the context of sourcing a sub-script from a master-script. For example, you curl and source remote script which sources one or more script (for the sake of the question let's assume that all of these scripts are safe and okay).

What I try to understand is why would someone think it's less safe to source the internal script, rather then running it (~/sub-script.sh or bash ~/sub-script.sh).

If this entire question sounds unlikely or absurd please don't be sarcastic, but please do make sure to vote to close it if you can as it might just be based of a misunderstanding from my side, or a misphrasing of some deeper intention of the man that said that.

I don't know the exact statement and its context so I can only guess what was meant: if a script gets sourced instead of executed in a separate shell then any variables or functions defined in this script or any changes to variables will be visible in your shell after the script was done. This might be intended in some cases (and that's why you can source a script) but it might also be an unintended pollution of the current environment of your shell with unwanted side effects.

Thus, unless you explicitly want to let the script make changes to your local bash environment you should execute it as shell-script (i.e. separate shell) and not source it.

And note that this is actually not a problem of information security: from a security standpoint the sourced script and the script executed in a separate shell  can  both execute malicious code with the permissions of the user.


Vulnerabilities for Red Team assessment I'm working on my dissertation for my bachelor's degree. I'm trying to create a framework which would make it possible to launch an entire virtual infrastructure, this would then be used to simulate a Red/Blue team assessment. I'm getting close to being finished, but need some vulnerabilities to implement for one of my scenarios. The current environment currently consists of 4 workstations (windows 10), 1 domain controller (server 2016), 1 file server (Server 2016 core) and a mail and web server (Linux).

Its relatively easy to find some basic vulnerabilities, but I rather implement something that would be consistent with a real-world scenario. Any of you have any tips on what vulnerabilities I could implement?

By implementing, I am assuming you mean one of the following:

1) Developing a vulnerable application yourself and then deploying it to one of your servers.

2) Taking an existing piece of software (likely an older release) that is vulnerable to certain attack. Perferrably, for learning purposes, the deployed software will already have common vulnerabilities that have been publicly disclosed on the Internet.

Here are some examples of common vulnerabilities you may find in real-world software deployments that may be within your scope:

Denial of service vulnerabilities via a buffer overflow in a C/C++ applications.
Directory traversal vulnerabilities in misconfigured web servers.
Code injection vulnerabilities in web applications.
Integer overflow vulnerabilities in C/C++ applications.
Information disclosure vulnerabilities in any sort of application.
The list goes on...

Whether you want to develop your own software or use something that already exists is up to you.

Overall though, I feel like this is a very broad topic, but I think one of the best ways for learning more about software vulnerabilities is by reading existing bug bounty reports and technical details found in CVEs.


How do we exchange public key securely in a DV SSL connection? Let's said we're running asymmetric encryption on a server with DV SSL encryption. With this condition set, how do we send the users' public key and private key generate in server to client in order they can decrypt and encrypt their message in their end securely?

I have an idea that is make a POST protocol which can prevent normal user visit using GET to retrieve. Then, how do we send it securely? We shouldn't send the key pair in plain text right? But how can we send it encrypted while user don't know the decryption key? And if we send them the key the same issue occurs again.

Edit:

As @Steffen Ullrich mentioned, my private and public key meant the key pair use for encrypting message to send to other user (quite like the Bob and Alice, it's the key pair that Bob use to encrypt/decrypt message to/from Alice and vice versa), the only SSL related word in DV SSL which I said it because the secure level, since most security expert said you should use a EV SSL to provide a more secure environment but I only have DV.

If I understand your question correctly you attempt to make the encryption stronger by adding another encryption layer on top of SSL. And you want to do this since you believe that EV certificates provide a stronger encryption than DV certificates but you cannot get an EV certificate.

If I understood you correctly then you are having a wrong understanding of SSL/TLS: the strength of the encryption does not depend on DV vs. EV certificates. The only difference between these is that there are fewer issuers for EV certificates and that these issuers check the identity more thoroughly of the party applying for an EV certificate. This means, there are no real technical differences which affect the encryption strength, but mainly organizational ones. One difference is though that browser tend do enforce revocation checks on RV certificates but often not for DV certificates.

But due to this organizational differences the chance is higher that somebody gets a DV certificate for your domain, for example by compromising your site, DNS or email for a short time. Thus you might be inclined to increase the trust in your peer by adding another protection layer. Only, the way you envision to exchange a key pair will not work since this would use the connection you already distrust. Instead such information would need to be provided either out of band (like send your certificates key in a really secure and trustable way to the peer) or by doing trust on first use (TOFU), i.e. assume that the first contact will be not compromised and exchange for example the expected key fingerprint for all future connections using HPKP.


Can a .sh file be malware? Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes, can someone read this script**  and tell me if it safe and does it affect GnuPG security? It gives me an option to encrypt files with a right-click on Ubuntu.
**[mod note: link removed since we no longer analyse code]

.sh files are shell scripts. They are analogous to .bat files (cmd scripts) under Windows. All of these (shell scripts, cmd scripts, .exe Windows executables, Linux executables (which usually have no extension)) are executable programs; if you run one, it can do anything you can do. So yes, shell scripts can be harmful. Treat a shell script (or a Perl script, or a Python script, or a Ruby script, etc.) with the same suspicion you would treat any other application.
It's a bit harder to hide malware in a shell script without looking suspicious, because this is a script which can be read by people with knowledge of the scripting language. But it is not much harder; few people, even with the technical knowledge, would bother to review the code, so you could hope to go unnoticed.
As a practical matter, there is less malware for Linux floating around than for Windows. This is probably mainly because Linux has a lot less of a market share than Windows on the desktop, so the payback for writing Linux malware is less. Also, there is a long-ingrained culture of sharing little improvements to the system in the Linux world, more so than in the Windows world; so the balance of probability says that this is someone sharing a little improvement and not malware. But it could be malware posing as a little improvement. In the end, you need to decide whether you can trust the site where you're getting this application, or the people who recommended this site. Favor programs that come from your distribution (i.e. that you can install from the software center), as they have undergone some review.

Now regarding this specific program: I had a quick look, and it looks benign. I didn't see anything that would store your password anywhere without telling you or that would do things on your computer other than what it's advertised to do. Note that I only did a 2-minute review, which any remotely clever malware writer could get past. The program looks reasonably well-written.
I wouldn't necessarily recommend this program unless you feel a pressing need that isn't addressed by packages in the Ubuntu distribution. Ubuntu comes with the seahorse  GUI frontend to GPG (there is also kgpg  for KDE users). You may also want to install seahorse-nautilus  (or seahorse-plugin  in older versions) for Nautilus integration.


MitM Android Java Application I'm trying to MitM an Android Application for research purposes (it's designed to be broken).

I'm using Burp as an attack proxy and already exported the Burp CA certificate and imported it into the Android CA store.

I also tried 3 different tools that promise to break certificate pinning (Android-SSLTrustKiller and others).

However every time I set my Burp as proxy, the app throws the following error in logcat:

09-14 20:18:07.446: W/System.err(2478): javax.net.ssl.SSLHandshakeException:
checkServerTrusted: Expected public key: 30820122300d06092a864886f70d0......

My best guess is that the Java "Environment" is using different certificate settings than the rest of the Android OS.

I can already decode the browser or Google maps just fine.

So how can I get Java to ignore the certificate pinning?

So how can I get Java to ignore the certificate pinning?

To get around certificate/public key pinning you must usually make changes to the application itself since the pinning is done there with an application specific trust manager. That means it does not work to just add your CA as trusted to the system wide CA store.

For a recent write-up of how this can be done see Defeating SSL Pinning in Coin's Android Application
.


Is there a book about secure system design? I'm interested in learning about secure system design - the whole stack. Currently, I'm an expert .net/C# developer and I know about the differences between different hash functions, public/private key encryption and similar techniques, but my application is only a small part of the system as a whole.

For example, public/private key encryption isn't simply about the code I write - it's about protecting the private key. I need to give it to clients and they need to keep it save. Then there are other avenues, for example if my web service is secure but someone can just waltz into the database and download all the data, my application's security doesn't matter.

I'm looking into Bruce Schneier's Cryptography Engineering and Applied Cryptography 2nd edition, but these are low level books about the cryptographic algorithms. I need something several layers higher up, something that explains possible attack vectors to be aware of and how to protect against them and mistakes that people commonly make.

I saw a few questions here on Security.SE, but these seemed specific to individual designs or were limited to the Application and not the system as a whole, so I wonder if there is something modern (ideally something that knows about stuff like SHA-3 and "modern" brute force attacks using Cloud or GPU based computing clusters) and authoritative?

If you're looking for non-language/framework specific stuff, you could start with a pair of books on security engineering

Security Engineering by Ross Anderson
Engineering Security by Peter Gutmann

Usefully both are available for free online.

If you're looking for more platform specific stuff, if you haven't already I'd recommend looking through Microsofts SDL Documentation


Has the WPS brute-force cracking issue been fixed? I have heard a rumor that the WPS brute force attack doesn't work on newer devices. Is that true?

The three major problems with WPS are: (1) it requires only an 8 digit pin (10^8 is a small keyspace), (2) one digit of that pin is a checksum (hence 7 independent digits and 10^7 pins to check), and (3) the first group of four digits is checked independently - that is you need to only check at most 10^4 ~ 10000 pins to break the first group of four digits; and then 1000 to check the second group (since you know one digit due to the checksum).  And really the expected number of attempts is half that; so on average only ~5500 attempts are needed.

WPS slightly mitigates this by mandating that you are locked out for 60 seconds after three consecutive bad attempts.  Originally, not all WPS routers enforced this timeout (very bad even without vulnerabilities 2 and 3; checking at a rate of 10 per second; means you can break your neighbor's router in a few months).  Some manufacturers will increase this timeout on subsequent failures, which is good.  Note the three attempts = 60s timeout is not a panacea; e.g., will take 3.82 days on average (and at most 7.64 days) to crack into your neighbors WPS enabled router.  Granted exponential timeouts could mitigate brute forcing; however how these timeouts are implemented is important.  (E.g., if the attacker changes their wifi mac address on each attempt will they continue to be blocked out?  Otherwise can you use this to DoS WPS connections?).

Now to answer your question: CERT (last updated May 2012)  is "currently unaware of a practical solution to this problem" and recommends disabling WPS.

Also while there are rumors of a new WPS 2.0 standard eventually coming out, especially in the responses to this vulnerability.  Hopefully, this fix would not let an attacker know if they've found a portion of the key and hopefully would require all digits to be independent instead of having a worthless checksum.  However, the wifi alliance page on WPS doesn't mention this at all (e.g., the last press-release on WPS is from Feb 2008) unless its in one of the standards that cost $100-$200 to purchase.  Standards tend to change slowly as it requires both the software and hardware end of the client and router to be fully compatible (and backward-compatible).

Granted, I'd expect nowadays more WPS enabled routers to implement the 60s + exponential timeout, but still would never recommend for anyone to use WPS.


What will I get if I "decrypt" a plaintext? If an encrypted text is decrypted with its corresponding key, we would get the plaintext. However, what if I were to decrypt plain text? What would result? An error or some nonsensical number?

"Encryption" is a large term. In all generality, encryption takes an input message in some space of possible input messages; usually arbitrary "sequences of bits" with various restrictions on length, e.g. "length in bits must be a multiple of 8" (i.e. input must be a sequence of bytes), or "length must not exceed 245 bytes" (typical of asymmetric encryption with RSA in PKCS#1 v1.5 mode, with a 2048-bit RSA key). The output is al part of some space of possible output messages.

Computers being computers, both input and output messages are ultimately encoded in sequences of bits, so it may happen that input and output message spaces overlap, in which case you can conceptually take an input message (a "plaintext"), interpret it as an output message, and try to decrypt it. This is not necessarily possible: for instance, with RSA asymmetric encryption (PKCS#1 v1.5) and a 2048-bit key, input messages (plaintexts) are arbitrary sequences of 0 to 245 bytes (inclusive) while output messages (ciphertexts) are sequences of exactly 256 bytes, so it is not possible, in such a case, to try to "decrypt a plaintext": possible plaintexts are not long enough to feed the decryption engine.

When you can "decrypt a plaintext", what happens depends on the encryption system. Usually, when decryption works at all, what you get is essentially random-looking nonsense. In some cases, encryption is an involution (e.g. stream ciphers such as RC4 that work by XORing the message with a key-dependent stream), meaning that decryption and encryption are actually the same operation, so by "decrypting" the plaintext you are actually encrypting it.

However, it may also happen that not all sequences of bits of the right length are valid ciphertexts. For instance, consider a block cipher in CBC mode. To encrypt a message m, you must:

Pad the message to a length multiple of the block size, by appending between 1 and n bytes (n is the block size) with some specific contents.
Generate a new random IV of the same size as the block size.
Apply CBC encryption on the padded message, using that IV.
Output is the concatenation of the IV and the encryption result.

In such a case, when decrypting, not only must the length be a non-zero multiple of the block size, but after decryption, a valid padding must be found. If using the usual "PKCS#7 padding" (when adding k bytes, all added bytes have value exactly k), the probability that a plaintext of a compatible length actually decrypts to something with a valid padding is about 1/255. In that case, "decrypting the plaintext" will produce a decryption error 99.61% of the time, and some random-looking junk the remaining 0.39%.

Good encryption system include a MAC, in which case attempting to decrypt something which was not the result of encryption with the same key should result in a duly reported decryption error with overwhelming probability.

Summary: when you try to do something that does not make sense, you can obtain various results.


Is accepting an invalid credit card number a security issue? I am testing a website which accepts invalid credit card numbers for reservations. The interesting thing is they do CC validation if the currency is USD, but not for any other currencies. Should I report this as a security issue or will it come under fraud management?

Should I report this as a security issue or will it come under fraud management?

There may be a business risk issue, which you can document under security, but how significant it is depends on the business.

You say the web site

  accepts ... credit card numbers for reservations.

What are those reservations for?

If it's a hotel room, then there is limited potential for fraud, since the actual card would be required at check-in time.  An attacker could attempt to impact service by blocking off rooms with bogus cards, thus reducing the pool legitimate visitors could reserve, but I see that as a minor concern based on scalability and sustainability issues.

If it's a game store that is purchasing stock based on pre-order reservations, then the store is extending actual capital to stock games they might then be stuck without buyers for.  This sort of business is more threatened by invalid card reservations, because they're sinking real dollars into the expected sales those reservations indicate.

There are other businesses where 'reservations' are largely meaningless, a way to encourage engagement by the customer at no real cost.  In these cases, the business impact is negligible.

  The interesting thing is they do CC validation if the currency is USD,
  but not for any other currencies.

And that may be reflective of business risk acceptance.  If 99% of their reservations are in USD, then the risk of accepting invalid non-USD card reservations may be negligible.  If implementing non-USD validation has any specific cost to it (fees from processor?  coding time to handle if-then-else branches?) then it's a legitimate option to leave it out at 1% coverage.


Nmap not following redirect when using "http-title" script I am trying to scan a bunch of IPs for their http-title.
Now the problem I have is that nmap pretty much never follows any redirects.
Usually the title I want is behind that redirect though.

For example I try to run nmap like this:

nmap --script http-title wikipedia.com

Output:

Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-17 03:09 EDT

Nmap scan report for wikipedia.com (91.198.174.192)

Host is up (0.032s latency).

Other addresses for wikipedia.com (not scanned): 2620:0:862:ed1a::1

rDNS record for 91.198.174.192: text-lb.esams.wikimedia.org

Not shown: 989 closed ports

PORT     STATE    SERVICE

...

80/tcp   open     http
|_http-title: Did not follow redirect to http://www.wikipedia.org/

139/tcp  filtered netbios-ssn

179/tcp  filtered bgp

443/tcp  open     https
|_http-title: Did not follow redirect to https://www.wikipedia.org/

...

Nmap done: 1 IP address (1 host up) scanned in 2.53 seconds

I am running the current Kali build, fully up to date.
I am using a VPN in this example but the result is the same without it.

Does anybody have a solution?

It has to do with the kind of redirect.

Here is the code: https://github.com/nmap/nmap/blob/master/scripts/http-title.nse

  -- check for a redirect
  if resp.location then
    redirect_url = resp.location[#resp.location]
    if resp.status and tostring( resp.status ):match( "30%d" ) then
      return {redirect_url = redirect_url}, ("Did not follow redirect to %s"):format( redirect_url )
    end
  end

If the status code is anything in the HTTP 300 range, then ""Did not follow redirect to ..."

So, basically, it is hardcoded to not follow redirects.

I found another NSE script called showHTMLTitle.nse to allow one redirect.


How can I decrypt data with Java, without hard-coding the key? I hope this is not a chicken-egg problem or reinventing the wheel but here goes.
I have a Java application that needs to access a password protected file (actually during the application startup).
The password protected file's path that it is supposed to be accessed is in a configuration file and the encrypted password is also in this configuration file.
So the problem is how to decrypt the encrypted password to be able to access the file?
I could just hardcode the decryption key in my code and be able to decrypt it.
Pro:

It works

Con:

I can not use it since the code is not obfuscated (can not be for various reasons) and the decryption key can be found
The password can not change since the decryption would hardcoded to the application

Note: I mainly care about (1);(2) is desired but not needed for me.

So is there a good/standard approach for this?

Any input is highly appreciated.

You need to store a "password" (or password to decrypt the password, or password to decrypt the password to decrypt the password, etc ad infinitum), somewhere.

So, either you can store it

on the computer, but then it can be deobfuscated and read (if your program can do it, any program can do it)
or in the user's head (harder to get at programatically, but has its own set of problems - 12345, Post-It notes, etc.)
or in a device that the user takes with them (likely to get lost/stolen, more expensive)

Depending on what you're protecting (a bank vault, or lolcat pictures?), these approaches can be combined or used separately. You also should take into account the encryption strength, in addition to password strength - "no point in using a vault door on a garden shed which has a window in the back".


Which approach provides more authenticity of image ownership: cropping, or reduced resolution? Even if this particular approach likely provides medium to low assurance, which approach is more trustworthy:

Suppose I take a set of photos that I own, and crop all of them after I magnified by 25%. How reasonable is it to assume I "own" the picture if I share some or all of that cropping?
Is it more or less reasonable to prove ownership by sharing a higher quality image, can that prove ownership if I share a portion of that?

Both of these techniques are used in-practice by various digital media companies.  I would assume the degree of cropping / de-resoultion has usability and security tradeoffs and would love to hear about the optimal approach.

Secondarily, I'm thinking this can be used as a UX metaphor in a ZKP/Zero knowledge proof system.  If this is actually a viable security scheme, I will hide the technical details (bitcoin) from the user.

There are a few ways to achieve proof of ownership.

For image content where there are higher resolution source files that show content from outside the frame (e.g. a RAW file from a camera, or a Photoshop / Illustrator file) you could digitally sign the content using a personal certificate (with a proper trusted root CA) and use a Timestamp Authority (TSA) to prove that your content and signature was not created after a particular date. You can create this signed file before publication and it will provide strong evidence that you did create it.

Additionally, you could research a concept called robust digital watermarking. This area of research focuses on embedded watermarking features into common media formats (JPEG, MPEG, MP3, etc.) which survive transformation such as cropping, brightness/contrast adjustment, time stretching, re-encapsulation (e.g. moving an X.264 video stream from an MPEG-4 container to a Matroska container) and various other attempts to obfuscate the source. This sort of thing has been implemented in various copyright enforcement systems and, as I understand it, underpins a lot of the copyright detection mechanisms on sites like YouTube.